Bug mining method and device

Abstract

The invention provides a bug mining method, which comprises the following steps of: obtaining each piece of service data of industrial control equipment in the current communication process, and generating at least one service sequence according to service information of each piece of service data; wherein the service sequences are arranged from the tail end of each service sequence to the front end of the service sequence; performing data deformation on each piece of service data in the service sequence to obtain fuzzy test data and a test sequence; sending each test sequence to the industrial control equipment, triggering the industrial control equipment to apply the test sequences to communicate with the application program, detecting whether the communication between the industrial control equipment and the application program is abnormal or not, and generating a corresponding vulnerability report when the communication between the industrial control equipment and the application program is abnormal so as to realize vulnerability mining of the industrial control equipment. By applying the method and the device, each piece of business data in the business sequence is subjected to data deformation orderly, the generated test sequence meets the basic processing requirements of the industrial control equipment, the code coverage rate of vulnerability mining on the industrial control equipment is improved, and the coverage rate of the industrial control equipment is improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method and device for mining a loophole. Background technique [0002] Industrial control equipment is an important part of the industrial control system. Generally, the embedded control equipment used in the industrial control environment is called industrial control equipment. In order to ensure the safety of industrial control equipment, the industrial control equipment will be tested for safety before it is put into use. Through the application of vulnerability mining technology, the possible loopholes in the industrial control equipment will be excavated to repair the loopholes and ensure safety. Vulnerability mining technology refers to the exploration of unknown vulnerabilities, through the comprehensive application of various technologies and tools, to find potential vulnerabilities as much as possible. [0003] Vulnerability mining is usually implemented by fuzz tes...

AI Technical Summary

Problems solved by technology

[0004] According to the research of the inventors, it is found that the acceptable business data of industrial control equipment usually has sequential business logic, but the business logic of the business data is not considered when generating the test data, resulting in confusion of business logic and field confusion in the generated test data; When the industrial control equipment processes the test data, the test data that does not meet the business logic conditions or field conditions are discarded, resulting in a low test rate of the test data and reducing the coverage of the code

Images