Distributed heterogeneous network vulnerability mining method based on Fuzzing algorithm

Abstract

The invention relates to a distributed heterogeneous network vulnerability mining method based on the Fuzzing algorithm. The method comprises the following steps: performing automatic analysis on a network protocol of a test target, and determining protocol key information of the test target; performing comprehensive description on the protocol key information, combining the protocol key information into a specific data structure, and constructing a protocol test script; combining operation states of the protocol into a protocol vulnerability mining path map according to the protocol test script; sending a test script to the test target according to the protocol vulnerability mining path map and a control instruction, sending the control instruction to a target monitor, and receiving monitoring information from the target monitor; and storing the sent test script and the tested vulnerability information, and displaying the same in an information display interface. By adoption of the distributed heterogeneous network vulnerability mining method provided by the invention, the coverage and validity of protocol mining are improved, and the leakage probability of the vulnerability is reduced; and a friendly operation interface is provided to display corresponding information in real time, thereby facilitating the user check ad reducing the entry threshold of vulnerability mining.

Description

technical field [0001] The invention relates to the technical field of network vulnerability mining, in particular to a distributed heterogeneous network vulnerability mining method based on Fuzzing algorithm. Background technique [0002] In the development process of software and hardware products, product testing is a very important and indispensable process. Therefore, major manufacturers pay great attention to the testing process of software and hardware products. Common testing techniques for software and hardware products include: white box testing, Black box testing and gray box testing etc. Different testing methods require different levels of resources of the system under test, and black-box testing hardly requires any resources of the system under test. In a distributed heterogeneous network, various network devices are numerous and complex, and software products are also diverse. Therefore, black-box testing and gray-box testing can achieve better results in dis...

AI Technical Summary

Problems solved by technology

[0022] Although the Fuzzing testing technology that exists at this stage is relatively mature, it still has some shortcomings and there is room for further improvement.

[0023] 1. Existing fuzzing testing technology is not efficient enough for protocol coverage. Many technical solutions can only test certain states and fields of the corresponding protocol, but cannot completely cover the execution path of the entire protocol, which leads to the failure of vulnerability mining. Not efficient enough

[0024] 2. Existing fuzzing testing technology has a low degree of automation. Many testing technologies rely on manual input, or a large amount of manual interference, and there is no friendly human-computer interaction interface available, which leads to the failure of vulnerability mining and fuzzing testing. The threshold is too high and it is not easy to promote on a large scale

[0025] 3. Many of the existing fuzzing testing technologies lack the corresponding data persistence layer, which is not conducive to subsequent further analysis, resulting in a greatly reduced effect of vulnerability mining and testing

Images