A Fuzzing-Based Method for Testing Rules in Intrusion Detection Systems in 6G Networks

Abstract

With the growing development of 6G techniques, it is more challenging than ever to tune rules in the signature-based network intrusion detection system (NIDS). Often, network managers have to tailor the ruleset manually. However, rules are prone to be problematic because of improper rule configuration. Moreover, the 6G network poses new challenges and requirements in rule verification. Hence, to evaluate the soundness of NIDS rules in 6G networks, we propose a new fuzzing solution for testing rules of signature-based NIDS. To achieve stateful fuzzing, we used a tunable responder to generate context-specific responses to construct network states. Moreover, fuzzing strategies (e.g., signature combination, repetition, and obfuscation) tailored for NIDS rules are designed to ensure effectiveness and rule coverage in fuzzing. With our prototype implementation, we find problems in the detecting rules of NIDSs, including conflicted rule, performance degradation, and NIDS bypassing, which seriously threaten the security of 6G networks.