A method for optimizing network security scenarios based on fuzzing techniques

Abstract

This invention relates to the field of network security technology and discloses a method for optimizing network security scenarios based on fuzzing technology. The method includes: collecting basic information about the application under test; encoding text data in the application under test using Gray code to obtain a Gray code file; instrumenting the Gray code file through memory modification after VxWorks firmware startup to generate test cases; the fuzzing execution main program sending test cases to the target application and running the test cases; using AFL to detect whether the target application returns an exception; if so, analyzing the data and resending new test cases; otherwise, directly sending new test cases; collecting exception information and generating a final fuzzing report; and optimizing the network security scenario based on the fuzzing report. This invention can improve the accuracy and stability of the generated test cases while reducing the probability of network application systems being attacked by networks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a method for optimizing network security scene based on fuzzy testing technology, which is used to improve the accuracy and stability of generated test cases and reduce the probability of network application system being attacked by network. BACKGROUND

[0002] Nowadays, with the rapid development of Web technology and the popularization of the Internet, Web application has become the main target of hacker attacks, and the property loss caused by the security problems of Web application is in the hundreds of millions. In order to solve the problem of vulnerability mining in Web application, fuzzy testing technology gradually becomes a vulnerability mining technology with high frequency in network security because of its high automation and low difficulty. However, the test case generation in traditional fuzzy testing technology has high randomness, which leads to low accuracy of generated test cases. This not only affects the running efficiency of vulnerability mining tool, but also increases the false negative rate and false positive rate of vulnerability scanning results, and affects the running effect of fuzzy testing tool.

[0003] Therefore, the present application provides a method for optimizing network security scene, which can scan the security vulnerabilities in the network application to be tested, improve the accuracy and stability of the generated test cases, and reduce the probability of network application system being attacked by network. SUMMARY

[0004] The present application aims to provide a method for optimizing network security scene based on fuzzy testing technology, which realizes the function of improving the accuracy and stability of generated test cases, and has the effect of reducing the probability of network application system being attacked by network.

[0005] The present application is realized by the following technical scheme: a method for optimizing network security scene based on fuzzy testing technology, comprising the following steps:

[0006] Step S1, collecting the basic information of the application to be tested, using the network crawler in fuzzy testing technology to crawl the test points of the application to be tested, and sending the basic information and test point information of the application to be tested to the fuzzy testing execution main program;

[0007] Step S2, the fuzzy testing execution main program uses the Gray code method to encode the text data in the application to be tested, and obtains the Gray code file;

[0008] Step S3, the fuzzy testing execution main program inserts the Gray code file through memory modification after starting the Vxworks firmware, and generates test cases;

[0009] Step S4, the fuzzy test execution main program sends a test case to the target application program, and runs the test case, uses AFL to detect whether the target application program returns an abnormal program, if yes, analyzes the data and then sends a new test case, if no, directly sends a new test case;

[0010] Step S5, collects abnormal information and generates a final fuzzy test report, and optimizes a network security scene according to the fuzzy test report.

[0011] In order to better realize the present application, further, the basic information of the application program to be tested in step S1 includes station code size, domain name information, IP address, database information and server information.

[0012] In order to better realize the present application, further, step S2 includes:

[0013] The text data in the test case is converted into its corresponding binary form, and the binary form is converted into a Gray code form;

[0014] Suppose that there are N-bit binary numbers B(i) in the binary form, wherein 0≤i≤N-1, the binary numbers are converted into Gray codes G(i) with the same number of bits;

[0015] The conversion formula of the binary number and the Gray code is G(i)=B(i+1)⊕B(i); G(i)=B(i), i=N-1.

[0016] In order to better realize the present application, further, step S3 includes:

[0017] Step S31, static Gray code file analysis is performed on the Vxworks firmware in units of functions;

[0018] Step S32, Gray code file plugging is performed;

[0019] Step S33, the Vxworks firmware is run and tested.

[0020] In order to better realize the present application, further, step S32 includes:

[0021] When the Gray code file plugging is performed, probes for detecting program instruction flow and branch judgment are inserted into the Vxworks firmware, and a Gray code file address disinfection function is introduced, a function stack is disassembled and reconstructed, a redzone area and corresponding detection codes are added.

[0022] In order to better realize the present application, further, step S5 includes:

[0023] The monitoring server end returns abnormal information, and then collects the abnormal information and generates a final fuzz testing report.

[0024] In order to better realize the present application, further, the present application also provides a computer readable storage medium, which has computer program instructions stored thereon, the program instructions are executed by a processor to realize the steps of the above method.

[0025] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0026] The present application solves the problem that binary encoding of fuzz testing is easy to produce individuals with more characters, thereby increasing the mutation space, by using the Gray code method to encode the text data in the application program to be tested.

[0027] The present application improves the vulnerability mining capability and vulnerability detection capability by inserting the Gray code file after the Vxworks firmware is started through memory modification to generate test cases. BRIEF DESCRIPTION OF DRAWINGS

[0028] The present application is further described in combination with the following drawings and examples, and all the conceptual innovations of the present application should be regarded as the disclosed content and the protection scope of the present application.

[0029] Figure 1 A flowchart of a method for optimizing a network security scenario based on a fuzz testing technique is provided.

[0030] Figure 2 A Gray code conversion table diagram in a method for optimizing a network security scenario based on a fuzz testing technique is provided.

[0031] Figure 3 A structure diagram of a fuzz testing report in a method for optimizing a network security scenario based on a fuzz testing technique is provided. DETAILED DESCRIPTION

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the described embodiments are only a part of the embodiments of the present application, and should not be regarded as limiting the protection scope. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0033] In the description of the present application, it should be noted that the fuzzing test technique is also known as a black box test. The fuzzing test technique is a defect injection-based vulnerability test technique network that can automatically mine vulnerabilities of a test object. The fuzzing test inputs some semi-random data to the target software to be tested and executes the program, monitors the running status of the program, records and further analyzes the abnormality of the target program to find potential vulnerabilities. The so-called semi-random refers to the data input to the target program, the important data format and most of the data are valid and legal, while the other part of the input does not meet the input data format specification of the target program. Since the target program may not consider error handling for all illegal data when it is written, the semi-random data may cause the target program to crash, thereby triggering the corresponding security vulnerability.

[0034] The security vulnerability mining technique is currently mainly divided into the following three ways: white box test, black box test and gray box test. Which of the three test methods is used is mainly determined by the resources that the tester can obtain. The white box test is also known as code-based test, which is an extreme case. The tester has access to all resources of the application to be tested, including source code and design documents, etc. That is, the application to be tested is completely transparent to the tester, and the tester can directly and clearly understand the internal running logic of the target to be tested. The white box test is also a test method that tests through program source code without involving user interface. The black box test is another extreme case. The black box test is also known as function test. The tester needs to input test case data and judge whether there is a security vulnerability according to the output result of the program. Since the tester needs to detect vulnerabilities without knowing the internal implementation details of the target to be tested, the black box test has great randomness and blindness. The gray box test is a relatively moderate test method. The gray box test not only needs to pay attention to the correctness of the program input and output, but also needs to pay attention to the internal situation of the program. The gray box test can obtain the source code of the application to be tested by using reverse engineering analysis techniques such as disassembly or decompilation, but it is not as detailed and complete as the white box test, but it pays more attention to the internal logic of the program than the black box test.

[0035] From a methodological perspective, current vulnerability discovery techniques can be categorized into manual detection, patch comparison, and fuzzing. Manual detection requires testers to manually analyze the source code of the target, demanding not only advanced security skills but also extensive experience. Undoubtedly, this method consumes significant human and material resources, and the vulnerability detection rate is not high. Patch comparison is primarily used to discover currently "known" security vulnerabilities. This method precisely locates the vulnerable code by comparing the binary files of different patch versions. However, precisely because it targets "known" vulnerabilities, its applicability is limited and will not be discussed further here. Fuzzing is a highly automated vulnerability discovery technique suitable for black-box testing scenarios and applicable to most attack scenarios. To maximize the simulation of network attack behavior, this invention chooses to use fuzzing to design and optimize methods for network security scenarios. Example 1:

[0036] This embodiment presents a method for optimizing network security scenarios based on fuzz testing technology, such as... Figure 1 As shown, the core process of fuzz testing is as follows: First, test cases are constructed, then the test cases are sent to the target. If the target returns abnormal data, new test cases are resent after data analysis; otherwise, new test cases are sent directly. Common methods for constructing test cases to filter for the optimal test cases include binary encoding and Gray code encoding. Using binary encoding to encode individuals makes encoding / decoding and cross-compiling test cases relatively convenient. However, individuals using binary encoding often exhibit significant phenotypic changes after mutation, frequently deviating from the optimal solution. Furthermore, binary encoding tends to produce individuals with a large number of characters, leading to an increased mutation space. To address this issue, this invention selects Gray code conversion and Vxworks instrumentation.

[0037] The basic process of fuzzing an application in this invention is described as follows: First, before the test begins, testers need to collect basic information about the application under test, such as website code size, domain name information, IP address, database information, and server information. Next, the web crawler module in fuzzing technology is used to crawl URL test points and form test points in the application under test. After crawling all vulnerability test point information, this data needs to be sent to the fuzzing execution entity, and the continuation of fuzzing requires the generation of fuzzing test cases. At this point, vulnerability test vectors need to be generated, and the generated data is sent to the fuzzing execution entity. After obtaining the vulnerability test points and vulnerability test vectors, the fuzzing entity is responsible for constructing test data packets and sending them to the target application. Finally, the abnormal information returned by the server and the local abnormal data are monitored, and then the abnormal logs are collected to generate the final vulnerability test report, i.e., the fuzzing report. Example 2:

[0038] This embodiment further optimizes Embodiment 1. Gray code is an improvement on binary encoding. After Gray code encoding, the test cases can better maintain the genetic continuity of individuals before and after mutation. Gray code is chosen to encode the text data. First, the text data in the test cases is converted into its corresponding binary form, and the conversion table is as follows. Figure 2 As shown, given an N-bit binary number B(i), where 0 ≤ i ≤ N-1, it can be transformed into a Gray code G(i) of the same number of bits. The conversion formula between binary and Gray code is: G(i) = B(i+1) ⊕ B(i), where ⊕ is the XOR operation, where 0 represents the same bit and 1 represents a different bit; G(i) = B(i), i = N-1. The rule for converting binary Gray code to binary code is to retain the highest bit of the Gray code as the highest bit of the natural binary code, and the second highest bit of the natural binary code is obtained by XORing the highest bit of the natural binary code with the second highest bit of the Gray code. The remaining bits of the natural binary code are obtained in a similar way to the second highest bit. Next, after the encoding conversion is completed, the test case data in Gray code form needs to be constructed into the corresponding test case genotypes. After the final test cases are generated, the individuals in Gray code form also need to be decoded; the decoding process is the reverse of the encoding process.

[0039] The other parts of this embodiment are the same as those in Embodiment 1, so they will not be described again. Example 3:

[0040] This embodiment further optimizes upon Embodiments 1 or 2 described above. Instrumentation of Gray code encoding is essentially a security technique that injects additional functionality into a binary program by adding extra code. In this embodiment, this is achieved by adding extra code to the Gray code file. This embodiment enhances vulnerability discovery and vulnerability detection capabilities through static instrumentation of VxWorks firmware. Instrumentation of the Gray code file must achieve the effect of adding extra functional code without modifying the normal operation of the program. Analyzing these extended functional codes can yield important information such as the number of branches in the functional module and the fuzzing execution flow.

[0041] First, static Gray code file analysis is performed on the Vxworks firmware. Then, automated reverse analysis is performed on the Vxworks firmware function by function to obtain branch information, function stack parameter arrangement information, etc., for instrumentation of static Gray code file.

[0042] Secondly, Gray code file instrumentation is performed. In this embodiment, Gray code file code injection is mainly achieved by inserting new code segments into the Vxworks firmware. The advantage of doing so is that there are no space restrictions on the extended functions, thereby reducing the pressure of instrumentation. During instrumentation, probes for detecting program instruction flow and branch judgment are inserted into the Vxworks firmware, and Gray code file address sanitization is introduced. The function stack is disassembled and reconstructed, and a redzone region and corresponding detection code are added to it, thereby further improving the ability to detect user data out-of-bounds access.

[0043] Finally, the VxWorks firmware is run and tested. The static instrumentation method used in this embodiment differs from traditional static instrumentation methods. Directly performing static instrumentation on the VxWorks firmware would result in the firmware file structure being modified and unrecognizable by the VxWorks network device loader. Therefore, the VxWorks firmware instrumentation in this invention is implemented through memory modification after the VxWorks firmware has started, following static analysis to determine the instrumentation code and location. The advantage of this approach is that it still functions correctly for application scenarios where firmware cannot be modified or is not allowed to be modified.

[0044] The other parts of this embodiment are the same as those in Embodiment 1 or 2 above, so they will not be described again. Example 4:

[0045] This embodiment further optimizes any one of embodiments 1-3 above. In AFL, afl-fuzz first calls the fork function to start the child process (the fork function is a forking function in UNIX or UNIX-like systems; the fork function splits a running program into two almost identical processes, each starting a thread that executes from the same location in the code. The threads in these two processes continue to execute, just as if two users simultaneously started two copies of the application), and allocates pipes for communication and shared memory for sharing a large amount of coverage data. Then, the instrumented target program is called in the child process, i.e., the child process content is replaced by the target program process, becoming fbrkserver, and returns 4 bytes of information through the pipe to indicate that the workflow can start and enter the loop listening mode. In the run_target function (checking whether the target process exists), afl-fuzz writes 4 bytes of data to the pipe to notify the forkserver to start working. The awakened forkserver calls the fork function to restore the normal working flow of the target program in the child process, and the parent process returns the path coverage information of the child process during execution to the shared memory through the pipe. When a child process terminates, forkserver retrieves its termination status and pipes it back to afl-fuzz, then resumes the loop waiting process. afl-fuzz retrieves the target process's termination status and coverage information, determines whether it has timed out or crashed, and then further schedules other processes in the fuzz test accordingly.

[0046] The other parts of this embodiment are the same as any one of the embodiments 1-3 above, so they will not be described again. Example 5:

[0047] This embodiment is a further optimization based on any one of embodiments 1-4 above, such as... Figure 3 As shown, in this embodiment, the process of collecting anomaly logs and generating the final fuzz test report is as follows: First, the test program that generates the fuzz test report is started. The test program monitors the anomaly information and anomaly data returned by the server. Then, the anomaly logs are collected and the final fuzz test report is generated. The fuzz test report includes the application under test, the fuzz test report name, the fuzz test report ID, the fuzz test report test process, the number of anomalies, and the number of vulnerabilities. Finally, the anomalies and vulnerabilities are repaired based on the number of anomalies and vulnerabilities to optimize the network security scenario.

[0048] The other parts of this embodiment are the same as any one of the embodiments 1-4 above, so they will not be described again. Example 6:

[0049] This embodiment is a further optimization based on any one of the above embodiments 1-5. This embodiment of the present disclosure also provides a computer-readable storage medium storing computer program instructions thereon. When the program instructions are executed by a processor, they implement the steps of the product description text generation method provided in this disclosure. The computer program product includes a computer program that can be executed by a programmable device. The computer program has a code portion for executing the above-mentioned product description text generation method when executed by the programmable device.

[0050] The other parts of this embodiment are the same as any one of embodiments 1-6 above, so they will not be described again.

[0051] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method for optimizing a cyber-security scenario based on fuzzing techniques, characterized in that, The method comprises the following steps: Step S1, collecting basic information of the application to be tested, using a network crawler in the fuzz testing technology to crawl test points of the application to be tested, and sending the basic information and test point information of the application to be tested to a fuzz testing execution main program; Step S2, the fuzz testing execution main program uses a Gray code method to encode text data in the application to be tested, and obtains a Gray code file; Step S3, the fuzz testing execution main program inserts the Gray code file through memory modification after starting the Vxworks firmware, and generates test cases; Step S31, performing static Gray code file analysis on the Vxworks firmware in units of functions; Step S32, performing Gray code file insertion; when performing Gray code file insertion, probes for detecting program instruction flow and branch judgment are inserted into the Vxworks firmware, and a Gray code file address disinfection function is introduced, function stacks are disassembled and reconstructed, a redzone area and corresponding detection code are added; Step S33, running the Vxworks firmware and performing testing; Step S4, the fuzz testing execution main program sends test cases to the target application, and runs the test cases, uses AFL to detect whether the target application returns an abnormal program, if yes, analyzes the data and then sends new test cases, if no, directly sends new test cases; Step S5, collecting abnormal information and generating a final fuzz testing report, and optimizing a network security scene according to the fuzz testing report.

2. The method for optimizing network security scenarios based on fuzzing techniques according to claim 1, characterized in that, The basic information of the application to be tested in the step S1 includes station code size, domain name information, IP address, database information and server information.

3. The method for optimizing network security scenarios based on fuzzing techniques according to claim 1, characterized in that, The step S2 comprises: converting text data in the test cases into corresponding binary forms, and converting the binary forms into Gray code forms; assuming that there are N binary numbers B(i) in the binary form, where 0≤i≤N-1, the binary numbers are converted into Gray codes G(i) with the same number of bits; the conversion formula of the binary numbers and the Gray codes is G(i)=B(i+1)⊕B(i); G(i)=B(i), i=N-1.

4. The method for optimizing network security scenarios based on fuzzing techniques according to claim 1, characterized in that, The step S5 comprises: monitoring server-side abnormal information, then collecting abnormal information and generating a final fuzz testing report.

5. The method for optimizing network security scenarios based on fuzzing techniques according to claim 4, characterized in that, The fuzz testing report comprises an application to be tested, a fuzz testing report name, a fuzz testing report ID, a fuzz testing report test process, an abnormal number and a vulnerability number.

6. A computer-readable storage medium having stored thereon computer program instructions, wherein, The program instruction is executed by a processor to implement the steps of the method in any one of claims 1-5.

Images