Stateful protocol differential testing method and system based on behavioral difference guidance

Abstract

The present invention discloses a stateful protocol differential fuzz testing method and system based on behavioral difference guidance. In the test preparation stage, the method compiles a data model and a state model as the input of the fuzzifier according to the protocol specification of the protocol to be tested. In the target state selection stage, an optimal state to be tested is selected according to the behavioral difference information. In the message sequence selection stage, the message sequence that can best trigger the behavioral difference between programs under the current target state is selected and mutated. In the behavioral difference guidance stage, the behavioral difference information generated by all the programs to be tested executing the test case is collected and synchronized to the target state selection and message sequence selection. The present invention effectively solves the problems that the existing network protocol differential testing work cannot effectively realize automated testing of the complete state space of the protocol, as well as the existing blind selection of state and message sequences, thereby improving testing efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of network communication protocol testing, and in particular to a stateful protocol differential testing method and system based on behavior difference guidance. Background Art

[0002] Fuzz testing, a method for discovering vulnerabilities by providing unexpected input to a target system and monitoring for abnormal results, has become a mainstream vulnerability discovery technique. Existing fuzz testing methods for network protocols primarily detect vulnerabilities that cause program crashes. Differential fuzz testing is used to detect "logical vulnerabilities" or "semantic errors" that do not trigger program crashes or assertion failures. Differential testing involves simultaneously inputting the same message sequence into multiple programs with similar functionality. If differences occur after executing the message sequence, it indicates that one of the programs may contain a "logical vulnerability" or "semantic error."

[0003] Differential fuzz testing of network protocols can effectively detect semantic errors in network protocol implementations. Frankencert is a black-box, unsupervised differential testing tool used to discover semantic errors in the certificate verification process in TLS protocol implementations. Mucert optimizes the random certificate generation process based on the code coverage of each input executed in a single application and uses Markov Chain Monte Carlo sampling to select the seed with the highest coverage for differential testing. Petsios has developed NEZHA, a domain-independent, general-purpose differential testing tool, by using behavioral asymmetric information between multiple programs to guide testing.

[0004] The above network protocol differential testing work still has the following deficiencies: (1) Blind state selection problem: All states have equal chances of being selected and the testing time is equal, so it is impossible to perceive which states trigger more behavioral differences, and the test is relatively blind. However, semantic errors do not appear equally in every protocol state. In order to improve the efficiency of detection, during the test process, more attention should be paid to those states that can trigger more differences, so as to maximize the discovery of semantic errors. (2) Blind message sequence selection problem: Each time, a seed is randomly selected from the corpus for mutation, which is a relatively blind method. Since the effectiveness of each seed in triggering differences between the protocol implementations to be tested is actually different, in order to ensure that the test is carried out in the direction of triggering more differences between protocol implementations, the seed that can trigger the most differences should be selected each time to improve the test effect. Summary of the Invention

[0005] The present invention proposes a stateful protocol differential fuzz testing method based on behavioral difference guidance. To address the first deficiency mentioned above, the present invention adopts the idea of ​​evolutionary testing and proposes a target state selection strategy based on behavioral difference guidance, focusing the test on certain states that are most likely to trigger behavioral differences. To address the second deficiency mentioned above, the present invention proposes a message sequence selection strategy based on behavioral difference guidance, which can determine which message sequence can trigger more behavioral differences between programs. Therefore, it can solve the problem of blind state selection and message sequence selection that exists in existing work when testing stateful protocol implementations.

[0006] The method consists of a test preparation phase, a target state selection phase, a message sequence selection phase, and a behavior difference guidance phase. In the test preparation phase, a data model and a state model are compiled based on the protocol specification of the protocol to be tested as input to the fuzzer. In the target state selection phase, an optimal state to be tested is selected based on behavioral difference feedback information. In the message sequence selection phase, the message sequence that is most likely to trigger behavioral differences between programs under the current target state is selected and mutated. In the behavior difference guidance phase, behavioral difference feedback information generated by the execution of the message sequence by all programs to be tested is collected and synchronized into the target state selection and message sequence selection.

[0007] The present invention proposes a stateful protocol differential fuzz testing method based on behavior difference guidance, which mainly includes four stages: test preparation stage, target state selection stage, message sequence selection stage, and behavior difference guidance stage.

[0008] 1Test preparation phase

[0009] Deploy the protocol implementation program to be tested, and write the data model and state model as the input of the fuzzer according to the protocol specification of the protocol to be tested. Specifically, it includes the following:

[0010] 1.1 Deployment of the protocol entity program to be tested

[0011] All protocol implementation programs to be tested are instrumented, compiled, and deployed using the fuzz testing tool AFL++ to ensure that they can establish a communication connection with the fuzzer and obtain the coverage information generated after executing the message sequence.

[0012] 1.2 Building the protocol data model and state model

[0013] The present invention defines the concepts of state model and data model based on the BOOFUZZ tool according to the specification of the network protocol to be tested. The data model defines the structural format of the protocol message packet, including all message sequences m of the protocol to be tested. The state model defines the state space of the protocol interaction, including each state s in the state model StateModel. i and state transition paths.

[0014] Therefore, the present invention also manually parses the specification of the protocol P to be tested into a data model DataModel and a state model StateModel as the input of the fuzzifier. The fuzzifier will perform generation-based mutations on the seed according to the data model and select the target state for each round of testing according to the state model.

[0015] 2 Target state selection stage

[0016] First, the fuzzer maintains a behavior difference feedback information table StateDiffTab, for each state s in the state model StateModel i , StateDiffTab records the behavioral difference feedback information. After each round of testing, the fuzzer will record the jth message sequence m in this round. j (i.e., message sequence m j ) triggers the behavior difference feedback information DiffInf between the protocol implementation programs j , and synchronized to the message sequence m j Corresponding state s i In the corresponding table entry in the behavior difference feedback information table StateDiffTab.

[0017] Then, when the next round of testing is performed to select the target state, the fuzzer selects the target state according to each state s. i The behavior difference feedback information recorded in the difference feedback information table StateDiffTab is for each state s i Calculate a weight, the higher the weight, the more differences can be triggered by selecting the state.

[0018] Finally, the fuzzer selects the state with the highest weight as the target state for this round of testing.

[0019] Specifically include the following:

[0020] 2.1 Behavioral Difference Feedback Record

[0021] The fuzzifier is for each state s of the state model StateModel i Each state maintains a behavior difference feedback table, StateDiffTab, which records all behavior difference feedback information related to state selection. Specifically, this information includes: the total number of coarse-grained path difference indicator updates triggered by all message sequences in the state (PDCoarseTimes), the total number of fine-grained path difference indicator updates triggered (PDFineTimes), the total number of response difference indicator updates triggered (ODTimes), and the number of times the state was selected (T).

[0022] Specifically, the above three difference indicators are represented by the δ-diversity defined in NEZHA. The specific definitions are as follows:

[0023] (1) Response difference index: Given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and a message sequence m, each target protocol implementation program in SUT will generate a response r after executing the message sequence m. m,sut_i , then define the response difference index of message sequence m as a tuple OD m = <r m,sut_1 ,r m,sut_2 ,…,r m,sut_n >. Each state s i There is a response tuple hash table, which stores the non-repeated response tuple set |∪m∈M[OD m ]|.

[0024] (2) Coarse-grained path difference index: Given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and a message sequence m, each target protocol implementation program in SUT will leave an execution path path of the control flow graph after executing the message sequence m. m,sut_i , the cardinality of these paths is |path m,sut_i |, then the coarse-grained path indicator of the message sequence m is defined as a tuple PDCoarse m =<|path m,sut_1 |,|path m,sut_2 |,…,|path m,sut_n |>. Each state s i There is a coarse-grained path tuple hash table, which stores the non-repeated coarse-grained path tuple set |∪m∈M[PDCoarse m ]|.

[0025] (3) Fine-grained path difference indicator: Given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and a message sequence m, each target protocol implementation program in SUT will leave an execution path path of the control flow graph after executing the message sequence m. m,sut_i , remove the duplicates from these paths and get u_path m,sut_i , then the fine-grained path indicator of the message sequence m is defined as a tuple PDFine m = <u_path m,sut_1 ,u_path m,sut_2 ,…,u_path m,sut_n >. Each state s iThere is a fine-grained path hash table that stores the non-repeated fine-grained path tuple set |∪m∈M[PDFine m ]|.

[0026] The present invention defines the behavior difference feedback information DIffInf as a tuple representation composed of the above three difference indicators, that is, given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and a message sequence m j , defines the current message sequence m j The behavioral difference feedback information is:

[0027]

[0028] in, Represents message sequence m j The response difference index, Represents message sequence m j The coarse-grained path difference index of Represents message sequence m j A fine-grained path difference indicator.

[0029] After each round of testing, the message sequence m sent in this round will be judged first. j Whether the update of the above indicators is triggered, if not, no record is made and the next round of testing is carried out directly, otherwise the behavior difference feedback information DiffInf is triggered j Update to the message sequence m j Corresponding state s i In the corresponding table item in the behavior difference feedback information table StateDiffTab, the message sequence is added to the message sequence corpus of the corresponding state Corpus i middle.

[0030] 2.2 State Selection

[0031] Before selecting a state, the fuzzer will determine whether the number of execution rounds of the current test has reached the specified threshold K. If not, it will enter the warm-up phase, otherwise it will enter the adaptive selection phase for state selection. The details are as follows:

[0032] 2.2.1 Warm-up phase

[0033] (1) The fuzzer randomly selects a state s from the state model StateModel i As the target state of this round;

[0034] (2) Record the current message sequence m executed by all protocol implementation programs in this round of testing jThe behavior difference feedback information DiffInf generated when j , and synchronize it to the current target state s i In the corresponding table entry in the behavior difference feedback information table StateDiffTab.

[0035] 2.2.2 Adaptive Selection Stage

[0036] (1) The fuzzer is based on each state s i The corresponding behavior difference feedback information table StateDiffTab, for all states s in the state model StateModel i The weight calculation formula is as follows:

[0037]

[0038] Among them, PDCoarseTimes represents the total number of times that all message sequences corresponding to this state can trigger the update of the coarse-grained path difference index, PDFineTimes represents the total number of times that all message sequences corresponding to this state can trigger the update of the fine-grained path difference index, ODTimes represents the total number of times that all message sequences corresponding to this state can trigger the update of the response difference index, and T represents the number of times this state is selected.

[0039] (2) Select the state s with the highest weight score i As the target state of this round;

[0040] (3) Record the current message sequence m executed by all protocol implementation programs in this round of testing j The behavior difference feedback information DiffInf generated when j , and synchronize it to the current target state s i In the corresponding table entry in the behavior difference feedback information table StateDiffTab.

[0041] 3. Message sequence selection phase

[0042] The fuzzer maintains a behavior difference feedback information table MessageDiffTab. For each message sequence m in the data model DataModel, MessageDiffTab records its behavior difference feedback information. After each round of testing, the fuzzer will determine the message sequence m in this round. j Whether the behavior difference feedback information DiffInf between protocol implementation programs is triggered j If there is no trigger, no record will be made, otherwise the message sequence m of this round will be j Add to its corresponding state s i Corpus iAt the same time, the generated behavior difference feedback information DiffInf j Synchronize to the information table MessageDiffTab of the message sequence.

[0043] Then, after each selection of the target state for this round of testing, the fuzzer will feedback the behavior difference information DiffInf recorded in the information table MessageDiffTab as the message sequence corpus Corpus of the target state. i Calculate the weight of each message sequence in the test, and select the message sequence with the highest weight as the message sequence for mutation in this round of testing.

[0044] Specifically include the following:

[0045] 3.1 Behavioral Difference Feedback Record

[0046] The behavior difference recording feedback phase occurs after each round of testing. The fuzzer records the behavior difference for each state s. i Maintains a message sequence corpus Corpus i If the message sequence m currently being tested j Can trigger behavioral differences, then add it to its corresponding state s i Corpus i When the next round selects the same state s i When , it is still possible to select the message sequence m j as a message sequence and perform further tests on its mutation.

[0047] The fuzzer stores each message sequence in the Corpus i Each message sequence m maintains an information table, MessageDiffTab, which records behavioral difference feedback related to the message sequence selection. Specifically, this information includes: the execution time t of the message sequence, the total number of coarse-grained paths (PDCoarseCount) of all triggered protocol implementations, the total number of fine-grained paths (PDFineCount) of all triggered protocol implementations, and the total coverage (Coverage) of all triggered protocol implementations.

[0048] After each round of testing, if the message sequence m sent in this round is found j Can trigger behavior difference feedback information DiffInf j , then add it to the corresponding state s i Corpus i and convert the above information into DiffInf j Collected into the corresponding information table MessageDiffTab.

[0049] 3.2 Message Sequence Selection

[0050] After selecting the target state for this round of testing, the fuzzer will first determine whether the number of execution rounds of the current test has reached the specified threshold K. If not, it will enter the warm-up phase. Otherwise, it will enter the adaptive selection phase to select the message sequence. The details are as follows:

[0051] 3.2.1 Warm-up phase

[0052] (1) The fuzzer generates a message sequence through the input data model DataModel and mutates it to generate a message sequence m j ;

[0053] (2) Record the current message sequence m executed by all protocol implementation programs in this round of testing j The generated behavior difference feedback information DiffInf j , determine whether it is a new behavioral difference;

[0054] (3) If yes, it means that the current message sequence can trigger a new behavior difference, which is retained in the corresponding state s i Corpus i and convert the above information into DiffInf j Collect the corresponding information table MessageDiffTab. Otherwise, discard the message sequence and do not record it.

[0055] 3.2.2 Adaptive Selection Stage

[0056] (1) The fuzzer is based on the current target state s i Corpus i The behavior difference feedback information table MessageDiffTab for each message sequence in Corpus i The weight of each message sequence m is calculated using the following formula:

[0057]

[0058] Among them, PDCoarseCount represents the total number of coarse-grained paths of all protocol implementation programs that can be triggered by the message sequence, PDFineCount represents the total number of fine-grained paths of all protocol implementation programs that can be triggered by the message sequence, Coverage represents the sum of coverage of all protocol implementation programs triggered by the message sequence, and t represents the execution time of the message sequence.

[0059] (2) Select the message sequence with the highest weight as the target message sequence for this round of testing, and mutate it to generate the message sequence mj ;

[0060] (3) Record the current message sequence m executed by all protocol implementation programs in this round of testing j The generated behavior difference feedback information DiffInf j , determine whether it is a new behavioral difference;

[0061] (4) If yes, it means that the current message sequence can trigger a new behavior difference, which is retained in the corresponding state s i Corpus i and convert the above information into DiffInf j Collect the corresponding information table MessageDiffTab. Otherwise, discard the message sequence and do not record it.

[0062] 4Behavioral Difference Guidance Stage

[0063] The present invention uses the behavioral difference indicators defined by the differential testing tool NEZHA to quantify the behavioral difference feedback information generated after different protocol implementation programs execute the same message sequence. These indicators are the response difference indicator and the control flow graph difference indicator. The control flow graph difference indicator is further divided into the coarse-grained path indicator and the fine-grained path indicator. If any of the above difference indicators is updated, the current round of message sequence is added to the message sequence corpus of the corresponding state. i This indicates that it can trigger behavioral differences. Therefore, as the test progresses, the number of message sequence seeds that can be selected in each round of testing will gradually increase.

[0064] The specific guidance content is as follows:

[0065] 4.1 Response Difference Indicator Guidance

[0066] The present invention maintains a response tuple hash table for each protocol state, which is used to store all non-repeated response tuple sets generated by the message sequence of the state.

[0067] For each message sequence sent during testing, the fuzzer collects the responses generated by each protocol implementation program after executing the message sequence. If any differences are found in these responses, the message sequence of this round is saved in a difference log so that it can be analyzed for differences after the test is completed.

[0068] The fuzzer will record all responses generated by the current message sequence in the form of a tuple and determine whether the tuple has appeared in the response tuple hash table. If it has not appeared, it means that the message sequence has triggered a new response difference, then the tuple will be added to the response tuple hash table corresponding to the current state, and the message sequence will be added to the message sequence corpus Corpus.i In the next round of testing, the current message sequence may still be selected as the seed to continue testing.

[0069] 4.2 Control Flow Graph Difference Indicator Guidance

[0070] For each message sequence sent during testing, the fuzzer collects information about the edge sequences accessed in the control flow graph (CFG) during the execution of the message sequence by each protocol implementation under test. The details are as follows:

[0071] 4.2.1 Coarse-grained path difference indicator guidance

[0072] The coarse-grained path difference metric only records the cardinality of the paths in the control flow graph visited by each protocol implementation program when executing a message sequence.

[0073] The fuzzer maintains a coarse-grained path tuple hash table for each protocol state, which is used to store the set of tuples of non-repeated path cardinalities generated by the message sequence of that state.

[0074] For each message sequence sent during the test, the fuzzer collects the cardinality of the control flow graph paths visited by each protocol implementation program, forms a tuple of these path cardinality, and determines whether the tuple has appeared in the previous test. If not, the tuple is added to the coarse-grained path tuple hash table corresponding to the target state of this round, and the message sequence is added to the message sequence corpus Corpus. i In the next round of testing, the current message sequence may still be selected as the seed to continue testing.

[0075] 4.2.2 Fine-grained path difference indicator guidance

[0076] The fine-grained path difference indicator only records the non-repeated paths in the path set of the control flow graph accessed when each protocol implementation program under test executes the message sequence.

[0077] The fuzzer maintains a fine-grained path tuple hash table for each protocol state, which is used to store the set of non-repeated fine-grained path tuples generated by the message sequence of that state.

[0078] For each message sequence sent during the test, the fuzzer collects the unique paths of the control flow graph accessed by each protocol implementation program, groups these paths into a tuple, and determines whether the tuple has appeared in the previous test. If not, the tuple is added to the fine-grained path tuple hash table corresponding to the target state of this round, and the message sequence is added to the message sequence corpus Corpus. i In the next round of testing, the current message sequence may still be selected as the seed to continue testing.

[0079] Based on the above method, the present invention proposes a stateful protocol differential fuzz testing system based on behavior difference guidance, which includes a test preparation module, a target state selection module, a message sequence selection module, a message sequence generation module and a behavior difference guidance module.

[0080] The test preparation module deploys the implementation program of the protocol to be tested before fuzz testing, and writes the data model and state model according to the protocol specification of the protocol to be tested.

[0081] The target state selection module receives the state model and determines whether to perform random selection or adaptive selection based on whether the number of test execution rounds reaches a threshold. If it is adaptive selection, the state that can more effectively trigger behavioral differences will be selected from the state model as the target state based on the accumulated experience data from previous tests.

[0082] The message sequence selection module receives the target state and selects a message sequence that can more effectively trigger more control flow graph paths or has a higher coverage rate as the target message sequence based on the behavior difference feedback information recorded in the target state corresponding information table.

[0083] The message sequence generation module receives the data model and the target message sequence, and uses the mutation seed library provided in the BOOFUZZ tool to mutate the target message sequence, and sends it to all the protocol implementation programs to be tested.

[0084] The behavior difference guidance module collects the behavior difference feedback information generated by all the protocol implementation programs under test after executing the current message sequence, and saves the message sequence that can effectively trigger the behavior difference into the message sequence corpus of the corresponding state. i and updates the behavior difference feedback information to the target state selection module and the message sequence selection module.

[0085] The beneficial effects of the present invention are:

[0086] 1. The present invention proposes a stateful protocol differential fuzz testing method based on behavioral difference guidance. The behavioral differences between multiple protocol implementation programs are used to guide the selection of target states and message sequences for each round of testing, effectively solving the problem that existing network protocol differential testing cannot effectively perform automated testing on the complete state space of protocol implementation programs.

[0087] 2. The target state selection strategy based on behavioral difference guidance proposed in the present invention can focus the test on certain states that can best trigger behavioral differences, effectively solving the state selection blindness problem existing in existing methods.

[0088] 3. The message sequence selection strategy based on behavioral difference guidance proposed in this invention can ensure that the test is carried out in the direction of triggering more differences between protocol implementation programs. In each round of testing, the seeds that are most capable of triggering differences are given priority, thereby improving seed quality and test efficiency, and effectively solving the problem of blind message sequence selection in existing methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0089] Figure 1 This is an overall flow chart of a stateful protocol differential fuzz testing method based on behavioral difference guidance according to the present invention;

[0090] Figure 2 This is an example diagram of three behavioral difference indicators in a stateful protocol differential fuzz testing method based on behavioral difference guidance of the present invention;

[0091] Figure 3 This is a test guidance flow chart based on behavioral difference feedback in a stateful protocol differential fuzz testing method based on behavioral difference guidance of the present invention;

[0092] Figure 4 This is a schematic diagram of the system modules implemented by the stateful protocol differential fuzz testing method guided by behavioral differences in the present invention. DETAILED DESCRIPTION

[0093] The technical solutions of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings of the present invention.

[0094] like Figure 1 As shown, the stateful protocol differential fuzz testing method based on behavior difference guidance proposed in the present invention mainly includes four stages: test preparation stage, target state selection stage, message sequence selection stage, and behavior difference guidance stage.

[0095] 1Test preparation phase

[0096] Deploy the protocol implementation program to be tested, and write the data model and state model as the input of the fuzzer according to the protocol specification of the protocol to be tested. Specifically, it includes the following:

[0097] 1.1 Deployment of the protocol entity program to be tested

[0098] All protocol implementation programs to be tested are instrumented, compiled, and deployed using the fuzz testing tool AFL++ to ensure that they can establish a communication connection with the fuzzer and obtain the coverage information generated after executing the message sequence.

[0099] 1.2 Building the protocol data model and state model

[0100] The present invention is implemented based on the BOOFUZZ tool, which defines the concepts of state model and data model according to the specification of the network protocol to be tested, wherein the data model defines the structural format of the protocol message packet, and the state model defines the state space of the protocol interaction.

[0101] Therefore, the present invention also manually parses the specification of the protocol P to be tested into a data model DataModel and a state model StateModel as the input of the fuzzifier. The fuzzifier will perform generation-based mutations on the seed according to the data model and select the target state for each round of testing according to the state model.

[0102] 2 Target state selection stage

[0103] The fuzzer first calculates for each state s i Maintain a behavior difference feedback information table StateDiffTab. After each round of testing, the fuzzer will record the message sequence m of this round j DiffInf, the behavior difference feedback information between the triggered protocol implementation programs j , and synchronized to the message sequence m j Corresponding state s i In the corresponding table entry in the behavior difference feedback information table StateDiffTab.

[0104] Then, when the next round of testing is performed to select the target state, the fuzzer will select the target state according to each state s. i The behavior difference feedback information DiffInf recorded in the information table StateDiffTab calculates a weight for each state. The higher the weight, the more differences can be triggered by selecting the state.

[0105] Finally, the fuzzer selects the state with the highest weight as the target state for this round of testing.

[0106] Specifically include the following:

[0107] 2.1 Behavioral Difference Feedback Record

[0108] The behavior difference feedback recording phase occurs after each round of testing. The fuzzer generates a i Each state maintains a behavior difference feedback table, StateDiffTab, which records all behavior difference feedback information related to state selection. Specifically, this information includes: the total number of coarse-grained path difference indicator updates triggered by all message sequences in the state (PDCoarseTimes), the total number of fine-grained path difference indicator updates triggered (PDFineTimes), the total number of response difference indicator updates triggered (ODTimes), and the number of times the state was selected (T).

[0109] Specifically, the definitions of the above three difference indicators are as follows:

[0110] (1) Response difference index: Given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and a message sequence m, each target protocol implementation program in SUT will generate a response r after executing the message sequence m. sut_i , then define the response difference index of message sequence m as a tuple OD m = <r sut_1 ,r sut_2 ,…,r sut_n >. Each state s i There is a response tuple hash table, which stores the non-repeated response tuple set |∪m∈M[OD m ]|.

[0111] (2) Coarse-grained path difference index: Given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and a message sequence m, each target protocol implementation program in SUT will leave an execution path path of the control flow graph after executing the message sequence m. sut_i , the cardinality of these paths is |path sut_i |, then the coarse-grained path indicator of the message sequence m is defined as a tuple PDCoarse m =<|path sut_1 |,|path sut_2 |,…,|path sut_n |>. Each state s i There is a coarse-grained path tuple hash table, which stores the non-repeated coarse-grained path tuple set |Um∈M[PDCoarse m ]|.

[0112] (3) Fine-grained path difference indicator: Given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and a message sequence m, each target protocol implementation program in SUT will leave an execution path path of the control flow graph after executing the message sequence m. sut_i , remove the duplicates from these paths to get unique_path sut_i , then the fine-grained path indicator of the message sequence m is defined as a tuple PDFine m = <unique_path sut_1 ,unique_path sut_2 ,…,unique_path sut_n >. Each state s iThere is a fine-grained path hash table that stores the non-repeated fine-grained path tuple set |∪m∈M[PDFine m ]|.

[0113] The behavior difference feedback information DiffInf is defined as a tuple representation consisting of three difference indicators, that is, given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_m] and a message sequence m j , defines the current message sequence m j The behavioral difference feedback information is

[0114]

[0115] in, Represents message sequence m j The response difference index, Represents message sequence m j The coarse-grained path difference index of Represents message sequence m j A fine-grained path difference indicator.

[0116] After each round of testing, the message sequence m sent in this round will be judged first. j Whether the update of the above indicators is triggered, if not, no record is made and the next round of testing is carried out directly, otherwise the behavior difference feedback information DiffInf is triggered j Update to the message sequence m j Corresponding state s i In the corresponding table item in the behavior difference feedback information table StateDiffTab, the message sequence is added to the message sequence corpus of the corresponding state Corpus i middle.

[0117] 2.2 State Selection

[0118] Before the fuzzer selects a state, it will determine whether the number of execution rounds of the current test has reached a specified threshold K (K = 10-15 rounds in the implementation). If not, it will enter the warm-up phase, otherwise it will enter the adaptive selection phase for state selection. The details are as follows:

[0119] 2.2.1 Warm-up phase

[0120] The warm-up phase occurs when the number of execution rounds of the current test has not yet reached the specified threshold K. The specific steps are as follows:

[0121] (1) The fuzzer randomly selects a state s from the state model StateModel i As the target state of this round;

[0122] (2) Record the behavioral difference feedback information DiffInf generated by all protocol implementation programs in this round of testing when executing the current message sequence, and synchronize it to the current target state s i In the corresponding table entry in the behavior difference feedback information table StateDiffTab.

[0123] 2.2.2 Adaptive Selection Stage

[0124] The adaptive selection phase occurs after the number of execution rounds of the current test exceeds the specified threshold K. The specific steps are as follows:

[0125] (1) The fuzzer is based on each state s i The corresponding behavior difference feedback information table StateDiffTab, for all states s in the state model StateModel i The weight calculation formula is as follows:

[0126]

[0127] Among them, PDCoarseTimes represents the total number of times all message sequences corresponding to the state can trigger the update of the coarse-grained path difference indicator, PDFineTimes represents the total number of times all message sequences corresponding to the state can trigger the update of the fine-grained path difference indicator, ODTimes represents the total number of times all message sequences corresponding to the state can trigger the update of the response difference indicator, and T represents the number of times the state has been selected. Using this formula for state selection always prioritizes those states that are more effective in triggering behavioral differences as target states. At the same time, the number of times a state is selected also affects its weight, thus avoiding the "starvation" problem of the remaining states.

[0128] (2) Select the state s with the highest weight score i As the target state of this round;

[0129] (3) Record the behavioral difference feedback information DiffInf generated when all protocol implementation programs in this round of testing execute the current message sequence, and synchronize it to the current target state s i In the corresponding table entry in the behavior difference feedback information table StateDiffTab.

[0130] The pseudo code for this process is as follows:

[0131]

[0132] 3. Message sequence selection phase

[0133] The fuzzer first maintains a behavior difference feedback information table MessageDiffTab for each message sequence m. After each round of testing, the fuzzer will determine the behavior difference feedback information table MessageDiffTab for each message sequence m. j Whether the behavior difference feedback information DiffInf between protocol implementation programs is triggered j If there is no trigger, no record will be made, otherwise the current message sequence m j Add to its corresponding state s i Corpus i At the same time, the generated behavior difference feedback information DiffInf j Synchronize to the information table MessageDiffTab of the message sequence.

[0134] Then, after each selection of the target state for this round of testing, the fuzzer will feedback the behavior difference information DiffInf recorded in the information table MessageDiffTab as the message sequence corpus Corpus of the target state. i The weight is calculated for each message sequence in , and the higher the weight, the more differences the message sequence can trigger.

[0135] Finally, the message sequence with the highest weight is selected as the message sequence for mutation in this round of testing.

[0136] Specifically include the following:

[0137] 3.1 Behavioral Difference Feedback Record

[0138] The behavioral difference recording feedback phase occurs after each round of testing. i A message sequence corpus Corpus is maintained. If the message sequence m currently being tested j Can trigger behavioral differences, then add it to its corresponding state s i Corpus i When the next selection is the same state s i When , it is still possible to select the message sequence m j as a message sequence and perform further tests on its mutation.

[0139] The fuzzer stores each message sequence in the Corpus iEach message sequence m maintains an information table, MessageDiffTab, which records behavioral difference feedback related to the message sequence selection. Specifically, this information includes: the execution time t of the message sequence, the total number of coarse-grained paths (PDCoarseCount) of all triggered protocol implementations, the total number of fine-grained paths (PDFineCount) of all triggered protocol implementations, and the total coverage (Coverage) of all triggered protocol implementations.

[0140] After each round of testing, if the message sequence m sent in this round is found j Can trigger behavior difference feedback information DiffInf j , then add it to the corresponding state s i Cropus Message Sequence Corpus i and convert the above information into DiffInf j Collected into the corresponding information table MessageDiffTab.

[0141] 3.2 Message Sequence Selection

[0142] After selecting the target state for this round of testing, the fuzzer will first determine whether the number of execution rounds of the current test has reached a specified threshold K (K = 10-15 rounds in the implementation). If not, it will enter the warm-up phase. Otherwise, it will enter the adaptive selection phase to select the message sequence. The details are as follows:

[0143] 3.2.1 Warm-up phase

[0144] The warm-up phase occurs when the number of execution rounds of the current test has not yet reached the specified threshold K. The specific steps are as follows:

[0145] (1) The fuzzer generates a message sequence through the input data model DataModel and mutates it to generate a message sequence m j ;

[0146] (2) Record the behavioral difference feedback information DiffInf generated by the execution of the current message sequence by all protocol implementation programs in this round of testing, and determine whether it is a new behavioral difference;

[0147] (3) If yes, it means that the current message sequence can trigger a new behavior difference, which is retained in the corresponding state s i Corpus i and convert the above information into DiffInf j Collect the corresponding information table MessageDiffTab. Otherwise, discard the message sequence and do not record it.

[0148] 3.2.2 Adaptive Selection Stage

[0149] The adaptive selection phase occurs after the number of execution rounds of the current test exceeds the specified threshold K. The specific steps are as follows:

[0150] (1) The fuzzer is based on the current target state s i Corpus i The behavior difference feedback information table MessageDiffTab for each message sequence in Corpus i The weight of each message sequence m is calculated using the following formula:

[0151]

[0152] Where PDCoarseCount represents the total number of coarse-grained paths across all protocol implementations that can be triggered by the message sequence, PDFineCount represents the total number of fine-grained paths across all protocol implementations that can be triggered by the message sequence, Converage represents the total coverage of all protocol implementations triggered by the message sequence, and t represents the execution time of the message sequence. When selecting a message sequence using this formula, message sequences with short execution times and the ability to effectively trigger more control flow graph paths or higher coverage are always prioritized as target message sequences.

[0153] (2) Select the message sequence with the highest weight as the target message sequence for this round of testing, and mutate it to generate the message sequence m j ;

[0154] (3) Record the behavioral difference feedback information DiffInf generated by the execution of the current message sequence by all protocol implementation programs in this round of testing, and determine whether it is a new behavioral difference;

[0155] (4) If yes, it means that the current message sequence can trigger a new behavior difference, which is retained in the corresponding state s i Corpus i and convert the above information into DiffInf j Collect the corresponding information table MessageDiffTab. Otherwise, discard the message sequence and do not record it.

[0156] The pseudo code for this process is as follows:

[0157]

[0158] 4Behavioral Difference Guidance Stage

[0159] The present invention uses the behavioral difference indicators defined by the differential testing tool NEZHA to quantify the behavioral difference feedback information generated after different protocol implementation programs execute the same message sequence. The indicators are response difference indicators and control flow graph difference indicators, respectively. The control flow graph difference indicators are further divided into coarse-grained path indicators and fine-grained path indicators.

[0160] The specific guidance content is as follows:

[0161] 4.1 Response Difference Indicator Guidance

[0162] The present invention maintains a response tuple hash table for each protocol state, which is used to store all non-repeated response tuple sets generated by the message sequence of the state.

[0163] For each message sequence sent during testing, the fuzzer collects the responses generated by each protocol implementation program after executing the message sequence. If any differences are found in these responses, the message sequence of this round is saved in a difference log so that it can be analyzed for differences after the test is completed.

[0164] The fuzzer will record all responses generated by the current message sequence in the form of a tuple and determine whether the tuple has appeared in the response tuple hash table. If it has not appeared, it means that the message sequence has triggered a new response difference, then the tuple will be added to the response tuple hash table corresponding to the current state, and the message sequence will be added to the message sequence corpus Corpus. i middle.

[0165] 4.2 Control Flow Graph Difference Indicator Guidance

[0166] For each message sequence sent during testing, the fuzzer collects information about the edge sequences accessed in the control flow graph (CFG) during the execution of the message sequence by each protocol implementation under test. The details are as follows:

[0167] 4.2.1 Coarse-grained path difference indicator guidance

[0168] The coarse-grained path difference metric only records the cardinality of the paths in the control flow graph visited by each protocol implementation program when executing the message sequence according to the program.

[0169] The fuzzer maintains a coarse-grained path tuple hash table for each protocol state, which is used to store the set of tuples of non-repeated path cardinalities generated by the message sequence of that state.

[0170] For each message sequence sent during the test, the fuzzer collects the cardinality of the control flow graph paths visited by each program, forms a tuple of these path cardinality, and determines whether the tuple has appeared in the previous test. If not, the tuple is added to the coarse-grained path tuple hash table corresponding to the target state of this round, and the message sequence is added to the message sequence corpus Corpus. i middle.

[0171] 4.2.2 Fine-grained path difference indicator guidance

[0172] The fine-grained path difference indicator only records the non-repeated paths in the path set of the control flow graph accessed when each program under test executes the message sequence.

[0173] The fuzzer maintains a fine-grained path tuple hash table for each protocol state, which is used to store the set of non-repeated fine-grained path tuples generated by the message sequence of that state.

[0174] For each message sequence sent during the test, the fuzzer collects the unique paths of the control flow graph accessed by each program, groups these paths into a tuple, and determines whether the tuple has appeared in the previous test. If not, the tuple is added to the fine-grained path tuple hash table corresponding to the target state of this round, and the message sequence is added to the message sequence corpus Corpus. i middle.

[0175] Figure 2 The following are examples of three behavioral difference indicators. Assume that the existing protocols to be tested implement programs sut_1, sut_2, and sut_3. For a certain state s during the test process, iThe message sequence m below will output responses r1, r2, and r3 respectively after execution. When executed, it will access the paths [1a, 1b, 1a], [2a, 2b], and [3a] respectively. Assume that the test has been running for a while, and the tuple sets corresponding to the three current difference indicators are not empty. The response tuple set is (<r1,r2,r4> ), the coarse-grained path tuple set is (<3,2,1>), and the fine-grained path tuple set is (<[1a,1b],[2a,2c],[3b]>). The fuzzer will now determine whether the tuples consisting of the responses and control flow graph information generated after the execution of the message sequence m exist in the above tuple set. If they do exist, no update will be performed, otherwise the tuples consisting of these information will be added to the corresponding tuple set. It can be found that after the above update, the response tuple set has changed from the original (<r1,r2,r4> ) is updated to (<r1,r2,r4> ,<r1,r2,r3> ); the coarse-grained path tuple set (<3,2,1>) is the same as the coarse-grained tuple obtained in this round of testing, so it is not updated; the fine-grained path tuple set is updated from the original (<[1a,1b],[2a,2c],[3b]>) to (<[1a,1b],[2a,2c],[3b]>,<[1a,1b],[2a,2b],[3a]>). Since the current message sequence can trigger the update of the response tuple set and the fine-grained path tuple set, it is added to the state s i Corpus i and update the relevant information to the state s i The next round of testing is carried out in the information table of and the information table of the message sequence m.

[0176] Figure 3 This is a flowchart for the test guidance based on behavioral difference feedback in the present invention. As can be seen from the figure, if the message sequence in the current round triggers an update of the behavioral difference indicator, it is updated to the message sequence information table and the state information table, and the message sequence is retained. In the next test round, weights are calculated based on this information, and the state and message sequence with the highest weight are selected.

[0177] Another object of the present invention is to propose a stateful protocol differential fuzz testing system based on behavioral difference guidance, such as Figure 4 As shown, it mainly includes:

[0178] The test preparation module deploys the implementation program of the protocol to be tested before fuzz testing, and writes the data model and state model according to the protocol specification of the protocol to be tested.

[0179] Target state selection module: This module determines whether to perform random selection or adaptive selection based on whether the number of test execution rounds reaches a threshold. If it is adaptive selection, the state that can more effectively trigger behavioral differences will be selected as the target state based on the accumulated experience data from previous tests.

[0180] Message sequence selection module: After each round of testing, it will determine whether the message sequence in this round triggers the behavioral differences between the protocol implementation programs. If not, no record will be made. Otherwise, the message sequence in this round will be added to the message sequence corpus of its corresponding state. i At the same time, the generated behavioral difference feedback information is synchronized to the information table of the message sequence. Afterwards, based on the behavioral difference feedback information recorded in the information table, a message sequence that can more effectively trigger more control flow graph paths or have higher coverage is selected as the target message sequence for the target state.

[0181] Message sequence generation module: Use the mutation seed library provided in the BOOFUZZ tool to mutate the target message sequence and send it to all protocol implementation programs to be tested.

[0182] Behavior difference guidance module: collects behavioral difference feedback information generated by all the protocol implementation programs under test after executing the current message sequence, and saves the message sequence that can effectively trigger the behavior difference into the message sequence corpus of the corresponding state i and updates the behavior difference feedback information to the target state selection module and the message sequence selection module.

[0183] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A stateful protocol differential fuzz testing method based on behavioral difference guidance, characterized by: The steps include: S1. Deploy the protocol implementation program to be tested, and write the data model DataModel and state model StateModel as the input of the fuzzifier according to the protocol specification of the protocol to be tested; S2, the fuzzer maintains a behavior difference feedback information table StateDiffTab, for each state s in the state model StateModel i , StateDiffTab records the behavior difference feedback information. When the next round of testing is performed to select the target state, the fuzzer selects the target state according to each state s. i The behavior difference feedback information recorded in the difference feedback information table StateDiffTab is for each state s i Calculate a weight, and the fuzzer selects the state with the highest weight as the target state for this round of testing; S3. The fuzzer maintains a behavior difference feedback information table MessageDiffTab. For each message sequence m in the data model DataModel, MessageDiffTab records its behavior difference feedback information. After each target state is selected for this round of testing, the fuzzer calculates the weight for each message sequence in the message sequence corpus of the target state based on the behavior difference feedback information recorded in the behavior difference feedback information table MessageDiffTab, and selects the message sequence with the highest weight for mutation. S4. The behavioral difference indicators defined by the differential testing tool NEZHA are used to quantify the behavioral difference feedback information generated after different protocol implementation programs execute the same message sequence. They are the response difference indicator and the control flow graph difference indicator.

2. The stateful protocol differential fuzz testing method based on behavioral difference guidance according to claim 1 is characterized in that: The specific process of step S1 is as follows: S1.

1. Use the fuzz testing tool AFL++ to instrument, compile, and deploy all protocol implementation programs to be tested. S1.

2. Define the state model and data model based on the protocol specification of the protocol to be tested using the BOOFUZZ tool; The data model defines the structural format of the protocol message, including all message sequences m of the protocol to be tested; The state model defines the state space of the protocol interaction, including each state s in the state model StateModel i and state transition paths.

3. The stateful protocol differential fuzz testing method based on behavioral difference guidance according to claim 1 is characterized in that: The specific process of step S2 is as follows: S2.1、The fuzzifier is each state s of the state model StateModel i A behavior difference feedback information table StateDiffTab is maintained to record all behavior difference feedback information related to state selection; The behavior difference feedback information includes: the total number of coarse-grained path difference index updates triggered by all message sequences in this state PDCoarseTimes, the total number of fine-grained path difference index updates triggered PDFineTimes, the total number of response difference index updates triggered ODTimes, and the number of times this state is selected T; The behavior difference feedback information DiffInf is defined as a tuple representation composed of the above three difference indicators, that is, given a set of target protocol implementation programs SUT = [sut_1, sut_2, ... sut_n] and the jth message sequence m j , define the j-th message sequence m j Behavior difference feedback information DiffInf j for: in, Indicates m j The response difference index, Represents message sequence m j The coarse-grained path difference index of Indicates m j The fine-grained path difference index of m,sut_i Indicates that each target protocol implementation generates a response after executing the message sequence, path m,sut_i Indicates that each target protocol implementation program will leave an execution path of the control flow graph after executing the message sequence, u_path m,sut_i By execution path path m,sut_i Get rid of duplicates; After each round of testing, determine the message sequence m sent in this round j Whether the update of the above indicators is triggered, if not, no record is made and the next round of testing is carried out directly, otherwise the behavior difference feedback information DiffInf is triggered j Update to the message sequence m j Corresponding state s i In the corresponding table item in the behavior difference feedback information table StateDiffTab, the message sequence is added to the message sequence corpus of the corresponding state Corpus i middle; S2.

2. Before the fuzzer performs state selection, it determines whether the number of execution rounds of the current test has reached the specified threshold K. If not, it enters the warm-up phase, otherwise it enters the adaptive selection phase for state selection.

4. The stateful protocol differential fuzz testing method based on behavioral difference guidance according to claim 3 is characterized in that: In S2.2, the specific process of the preheating stage is as follows: S2.2.1.1、The fuzzer randomly selects a state s from the state model StateModel i As the target state of this round; S2.2.1.

2. Record the jth message sequence m executed by all protocol implementation programs in this round of testing j The behavior difference feedback information DiffInf generated when j , and synchronize it to the current target state s i Corresponding to the corresponding entry in the behavior difference feedback information table StateDiffTab; The specific process of the adaptive selection stage is as follows: S2.2.2.1, fuzzy according to each state s i The corresponding behavior difference feedback information table StateDiffTab, for all states s in the state model StateModel i The weight calculation formula is as follows: Among them, PDCoarseTimes represents the total number of times that all message sequences corresponding to the state can trigger the update of the coarse-grained path difference index, PDFineTimes represents the total number of times that all message sequences corresponding to the state can trigger the update of the fine-grained path difference index, ODTimes represents the total number of times that all message sequences corresponding to the state can trigger the update of the response difference index, and T represents the number of times the state is selected; S2.2.2.2.

2. Select the state s with the highest weight score i As the target state of this round; S2.2.2.

3. Record the current message sequence m executed by all protocol implementation programs in this round of testing j The behavior difference feedback information DiffInf generated when j , and synchronize it to the current target state s i This corresponds to the corresponding entry in the behavior difference feedback information table StateDiffTab.

5. The stateful protocol differential fuzz testing method based on behavioral difference guidance according to claim 1 is characterized in that: The specific process of step S3 is as follows: S3.

1. The fuzzer maintains a behavior difference feedback information table MessageDiffTab for each message sequence m stored in the message sequence corpus, recording the behavior difference feedback information related to the message sequence selection; The behavior difference feedback information includes: the execution time t of the message sequence, the total number of coarse-grained paths PDCoarseCount of all triggered protocol implementation programs, the total number of fine-grained paths PDFineCount of all triggered protocol implementation programs, and the total coverage of all triggered protocol implementation programs Coverage; After each round of testing, if it is found that the m sent in this round j Trigger behavior difference feedback information DiffInf j , then add it to the corresponding state s i Corpus i and feedback the above behavior difference information DiffInf j Collect the corresponding behavior difference feedback information table MessageDiffTab; S3.

2. After selecting the target state of this round of testing, the fuzzer first determines whether the number of execution rounds of the current test has reached the specified threshold K. If not, it enters the warm-up phase, otherwise it enters the adaptive selection phase to select the message sequence.

6. The stateful protocol differential fuzz testing method based on behavioral difference guidance according to claim 5 is characterized in that: In S3.2, the specific process of the preheating stage is as follows: S3.2.1.

1. The fuzzer generates a message sequence through the input data model DataModel and mutates it to generate a message sequence m j ; S3.2.1.

2. Record the current message sequence m executed by all protocol implementation programs in this round of testing j The generated behavior difference feedback information DiffInf j , determine whether it is a new behavioral difference; If yes, it means that the current message sequence triggers a new behavior difference, which is retained in the corresponding state s i Corpus i and convert the above information into DiffInf j Collect them into the corresponding information table MessageDiffTab; otherwise, discard the message sequence and do not record it; The specific process of the adaptive selection stage is as follows: S3.2.2.1, fuzzer according to the current target state s i Corpus i The behavior difference feedback information table MessageDiffTab for each message sequence in the message sequence corpus Corpus i The weight of each message sequence m is calculated using the following formula: Where PDCoarseCount represents the total number of coarse-grained paths of all protocol implementation programs that can be triggered by the message sequence, PDFineCount represents the total number of fine-grained paths of all protocol implementation programs that can be triggered by the message sequence, Coverage represents the sum of coverage of all protocol implementation programs triggered by the message sequence, and t represents the execution time of the message sequence. S3.2.2.

2. Select the message sequence with the highest weight as the target message sequence for this round of testing, and mutate it to generate the message sequence m j ; S3.2.2.

3. Record the current message sequence m executed by all protocol implementation programs in this round of testing j The generated behavior difference feedback information DiffInf j , determine whether it is a new behavioral difference; If yes, it means that the current message sequence triggers a new behavior difference, which is retained in the corresponding state s i Corpus i and convert the above information into DiffInf j Collect them into the corresponding information table MessagediffTab; otherwise, discard the message sequence and do not record it.

7. The stateful protocol differential fuzz testing method based on behavioral difference guidance according to claim 1 is characterized in that: The specific process of step S4 is as follows: S4.

1. Maintain a response tuple hash table for each protocol state, storing the set of all non-repeated response tuples generated by the message sequence of that state; For each message sequence sent during the test, the fuzzer collects the responses generated by each protocol implementation program under test after executing the message sequence. If any differences are found in these responses, the current message sequence is saved in the difference log and subjected to difference analysis after the test is completed. The fuzzer records all responses generated by the current message sequence in the form of a tuple, and determines whether the tuple has appeared in the response tuple hash table. If it has not appeared, it means that the message sequence has triggered a new response difference. The tuple is added to the response tuple hash table corresponding to the current state, and the message sequence is added to the message sequence corpus Corpus. i middle; S4.

2. For each message sequence sent during testing, the fuzzer collects information about the edge sequences accessed in the control flow graph during the execution of the message sequence by each protocol implementation program under test. The details are as follows: S4.2.1,The coarse-grained path difference index only records the cardinality of the paths in the control flow graph visited when each protocol implementation program executes the message sequence; The fuzzer maintains a coarse-grained path tuple hash table for each protocol state, storing the set of tuples of non-repeated path cardinalities generated by the message sequence of that state; For each message sequence sent during the test, the fuzzer collects the cardinality of the control flow graph paths accessed by each protocol implementation program, forms a tuple of these path cardinality, and determines whether the tuple has appeared in the previous test. If it has not appeared, the tuple is added to the coarse-grained path tuple hash table corresponding to the target state of this round, and the message sequence is added to the message sequence corpus Corpus. i middle; S4.2.2, the fine-grained path difference indicator only records the non-repeated paths in the path set of the control flow graph accessed when each protocol implementation program under test executes the message sequence; The fuzzer maintains a fine-grained path tuple hash table for each protocol state, storing the set of non-repeated fine-grained path tuples generated by the message sequence of the state; For each message sequence sent during the test, the fuzzer collects the non-repeated paths of the control flow graph accessed by each protocol implementation program, groups these paths into a tuple, and determines whether the tuple has appeared in the previous test. If it has not appeared, the tuple is added to the fine-grained path tuple hash table corresponding to the target state of this round, and the message sequence is added to the message sequence corpus Corpus. i middle.

8. A stateful protocol differential fuzz testing system based on behavioral difference guidance, used to implement the stateful protocol differential fuzz testing method described in any one of claims 1 to 7, characterized in that: It includes a test preparation module, a target state selection module, a message sequence selection module, a message sequence generation module and a behavior difference guidance module; The test preparation module deploys the implementation program of the protocol to be tested before fuzz testing, and writes the data model and state model according to the protocol specification of the protocol to be tested; The target state selection module receives the state model and determines whether to perform random selection or adaptive selection based on whether the number of test rounds reaches a threshold. If it is adaptive selection, the state that can more effectively trigger behavioral differences is selected from the state model based on the accumulated experience data from previous tests as the target state; The message sequence selection module receives the target state and selects a message sequence that can more effectively trigger more control flow graph paths or have a higher coverage rate as the target message sequence based on the behavior difference feedback information recorded in the target state corresponding information table; The message sequence generation module receives the data model and the target message sequence, and mutates the target message sequence using the mutation seed library provided in the BOOFUZZ tool, and sends it to all protocol implementation programs to be tested; The behavior difference guidance module collects the behavior difference feedback information generated after all the tested protocols implement the current message sequence, and saves the message sequence that can effectively trigger the behavior difference into the message sequence corpus of the corresponding state. i and updates the behavior difference feedback information to the target state selection module and the message sequence selection module.

Images