Regularization state machine model design method with stateful protocol

Abstract

The invention discloses a regularization state machine model design method with a stateful protocol. The regularization state machine model design method is used for improving a traditional fuzz test aiming at a stateful network protocol, enables a test case generated by the traditional fuzz test to be targeted but not indigested, has a wide cover range and is efficient. The regularization state machine model design method comprises the steps of step 1, obtaining the protocol specifications of a to-be-tested network protocol, and obtaining the protocol rules and a preliminary protocol state machine model through format analysis on the to-be-tested network protocol; step 2, generating a regularization state machine model for simplifying state space according to the preliminary protocol state machine model and the information of the state rules; step 3, generating a state generating tree combined with a state and the rules according to the protocol rules and the regularization state machine model, simplifying the relation between the state and a message through the state generating tree, and eliminating insignificant combinations; step 4, generating a preliminary test case; step 5, carrying out regular variation on the preliminary test case, and obtaining a final test case set.

Description

technical field [0001] The invention relates to a method for designing a regularized state machine model of a stateful protocol, and belongs to the technical field of security loophole detection. Background technique [0002] The security design and implementation of network protocols is not only related to people's privacy and property security, but also related to the interests of the country. Network protocol vulnerability has become a research hotspot in the field of information security. Currently, the vulnerability mining technologies for network protocols include: fuzzy testing technology, manual testing, binary comparison, static analysis, and dynamic analysis. Among them, fuzz testing technology is the most widely used and researched. [0003] Fuzz testing is currently the most effective method for security testing and vulnerability mining. Many of the currently announced security vulnerabilities were detected using fuzzing techniques, and there are many fuzzing ...

AI Technical Summary

Problems solved by technology

[0008] Although traditional fuzz testing is the most effective and good at finding the highest level of dangerous vulnerabilities, it is widely used in the field of vulnerability detection, but it also has problems such as large amount of test data and low efficiency.

Images