5g hierarchical multi-granularity variant fuzzing device and method

Abstract

The application discloses a 5G layered multi-granularity variant fuzzy testing device and method, a protocol field intelligent variant module selects a variant strategy according to a basic data type field and a complex data type field, a state transition module performs state transition on a target network element and sends variant data, a state monitoring module monitors the running state of a target application, records variant data packets causing problems of the target application, a protocol IE fine-granularity fuzzy testing module performs fuzzy testing on the structure information elements of a protocol with a message element as a basic granularity, a protocol single-state fuzzy testing module performs fuzzy testing on the conversion state of a protocol with a protocol single state as a granularity, state safety detection is completed, and a protocol approximate full-interaction state fuzzy testing module finds out potential weak points through approximate full-interaction state traversal of a target protocol, so that the mobile communication network protocol is subjected to all-round fuzzy testing through multiple modules, thereby checking protocol safety and discovering protocol vulnerabilities in time.

Description

Technical Field

[0001] The present application relates to the field of mobile communication technology, and in particular to a 5G layered multi-granularity variation fuzzy testing device and method. Background Art

[0002] As the latest generation of cellular mobile communication technology, 5G has achieved unprecedented communication innovation through the continuous evolution of standards. The core concept in the design of 5G mobile communication networks assumes that the system operates in an open, untrusted environment. The challenge of building a trustworthy communication network and providing more secure services in this environment must be addressed. Although 5G protocols have diligently designed their security architecture to meet the security requirements of 5G services, cases of insecure protocols still exist, which may provide operators with opportunities to implement denial of service or steal sensitive user information. Furthermore, 5G protocol specifications often fail to fully conform to actual conditions, resulting in potential security risks in network configurations. Detecting and remediating security vulnerabilities in 5G protocols has become a pressing issue in current 5G security research.

[0003] By comprehensively assessing the security of 5G protocols, conducting specialized security testing, and performing vulnerability scans, potential security vulnerabilities can be effectively identified and promptly addressed. Discovering and remediating security vulnerabilities in 5G protocols is crucial to ensuring the stable and secure operation of 5G communication networks. Researchers have conducted vulnerability discovery and security analysis of 5G protocols and discovered two main types of security flaws: protocol logic flaws and protocol implementation flaws.

[0004] Protocol logic flaws refer to vulnerabilities within the protocol itself. Previous research has uncovered several protocol logic flaws through vulnerability discovery, such as vulnerabilities in the 5G security context validity check and the 5G AKA protocol. These vulnerabilities could allow an operator to impersonate a victim to access a 5G network or track targeted 5G users. Furthermore, with the widespread adoption of 5G, the industry has conducted formal analysis of 3GPP standard documents, uncovering issues with missing security assumptions, the protocol's unlinkability to active risks, and a range of privacy issues and design weaknesses.

[0005] Protocol implementation flaws refer to errors that occur during the protocol implementation process. In 5G, fuzz testing is frequently used to test the security of network protocols. In recent years, researchers have developed a number of fuzzing tools, which have been used to discover security vulnerabilities in multiple protocols. Furthermore, researchers have proposed methods that leverage natural language processing (NLP) and machine learning to analyze protocol standards and specifications, enabling automated testing and vulnerability detection.

[0006] In recent years, with the development of 5G, the research on mobile network protocol security testing has become a trend. From the perspective of fuzz testing, the protocol fuzz testing is mainly divided into three types: static analysis, dynamic analysis and negative testing. Fuzz testing technology plays a huge role in many application scenarios, especially in baseband protocol testing. At the same time, the advent of 5G and the introduction of new communication protocols and technologies bring new challenges to fuzz testing. The significant increase in the complexity of 5G protocols puts higher demands on testing methods. Relying solely on traditional fuzz testing may not be able to effectively reveal all hidden problems.

[0007] The traditional fuzz testing technology mainly has two shortcomings: first, it does not realize the vulnerability mining of different logical level target codes: only considers the existence of a single protocol, ignores the scenario of multiple protocols coexisting; only considers the defects existing in the protocol process, and does not consider the field level test. Second, the test cases have randomness: it is usually difficult to comprehensively cover the logical state of the communication protocol; the test results also have the characteristics of large quantity, difficult analysis, etc. SUMMARY

[0008] The purpose of the present application is to overcome the existing technical defects and provide a 5G layered multi-granularity variation fuzz testing device and method. Through multiple modules, the mobile communication network protocol is comprehensively fuzz tested, so as to check the protocol security and discover the protocol vulnerabilities in time. The existing fuzz testing technology only considers the existence of a single protocol, ignores the scenario of multiple protocols coexisting, and leads to incomplete coverage of the fuzz testing case scenario.

[0009] The purpose of the present application is achieved by the following technical solutions:

[0010] In a first aspect, the present application provides a 5G layered multi-granularity variation fuzz testing device, which comprises a protocol field intelligent variation module, a state transition module, a state monitoring module, a protocol IE fine-grained fuzz testing module, a protocol single state fuzz testing module and a protocol approximate full interaction state fuzz testing module.

[0011] The protocol field intelligent variation module is used to select a variation strategy according to a basic data type field and / or a complex data type field;

[0012] The state transition module is used to perform state transition on a target network element and send variation data to the state monitoring module;

[0013] The state monitoring module is used to monitor the running state of a target application, record variation data packets causing problems in the target application, and the variation data packets are used for vulnerability analysis;

[0014] The protocol IE fine-grained fuzzing module is configured to perform message element-based fuzzing on the structure information elements of the protocol.

[0015] The protocol single-state fuzzing module is configured to perform fuzzing on the transition states of the protocol with the protocol single state as the granularity, and complete state security detection.

[0016] The protocol approximate full-interaction state fuzzing module is configured to find potential vulnerabilities by traversing the approximate full-interaction states of the target protocol and performing approximate full-interaction state message mutation in the fuzzing.

[0017] In a possible implementation, the protocol field intelligent mutation module is further configured to select a mutation strategy through a data verification operation, and the data verification operation includes one or more of bit inversion, byte inversion, assignment operation, special value replacement, special string overwriting, special string insertion, random processing, and intelligent field type selection mutation.

[0018] In a possible implementation, the state migration module is further configured to construct a corresponding protocol data packet by means of object-oriented programming, perform data transmission and reception by using an SCTP library, and perform protocol state jumping by using an NGAP protocol.

[0019] In a possible implementation, the state migration module includes an NGAP protocol jumping submodule, which is configured to, in a user equipment context management function, based on a closed state, send an initial context establishment message request to an AMF core network to establish a connection, return to the closed state if the connection fails to be established, successfully establish the connection by a related mechanism if the connection is successfully established, and perform a release connection operation after a user equipment context management procedure is completed.

[0020] In a possible implementation, the state monitoring module is further configured to detect running state information of the target application when the Agent tool sends a data packet corresponding to a state to the target application.

[0021] In a case where the target application crashes, the current data packet is recorded and stored in a corresponding directory.

[0022] The target application is restarted to perform the next round of fuzzing.

[0023] In a possible implementation, the protocol IE fine-grained fuzzing module is further configured to specify the mutation object to a specific field, and complete compliant mutation on the sample.

[0024] The selected field is mutated, the mutated field and the normal field are re-encapsulated into a data packet by using a protocol interpreter, and the data packet is sent to the core network.

[0025] In a possible implementation, the protocol single-state fuzz testing module is further configured to dynamically adjust and control the execution path of the protocol, so that the protocol state machine enters a specific state that a user wants to check, and full security detection of the specific state is achieved.

[0026] In a possible implementation, the protocol approximate full-interaction state fuzz testing module is further configured to perform complete encapsulation on each service flow, so that each service flow is implemented.

[0027] A random number variation seed is added to each service flow, and the random number variation seed is used to vary the protocol state in the service flow.

[0028] In a second aspect, the application provides a layered multi-granularity fuzz testing method, which is applied to a 5G layered multi-granularity variation fuzz testing device and includes the following steps:

[0029] Step 1: Analyze standard documents and data formats to assist in formulating message formats for fuzz testing.

[0030] Step 2: Establish a variation strategy based on packet capture samples and key data, generate a compliant sample based on the variation strategy and the data format, and interact with the 5G core network to obtain the result generated by the core network.

[0031] Step 3: Analyze the result generated by the core network to determine the running state of the core network.

[0032] Step 4: Analyze the test sample that causes an abnormal situation of the core network, and optimize the variation strategy through feedback.

[0033] Step 5: Analyze the output sample and the monitor record to find out the vulnerabilities of the protocol implementation.

[0034] The above main scheme and each further selected scheme can be freely combined to form multiple schemes, all of which are the schemes that can be adopted and claimed by the application; and the application can be freely combined between (each non-conflicting selection) and other selections. Those skilled in the art can understand that there are many combinations according to the prior art and common knowledge after understanding the schemes of the application, and all of them are the technical schemes claimed by the application, which will not be listed here.

[0035] The present application discloses a 5G layered multi-granularity mutation fuzz testing device and method. The protocol field intelligent mutation module selects a mutation strategy according to the basic data type field and the complex data type field. The state migration module transfers the state of the target network element and sends the mutation data. The state monitoring module monitors the running state of the target application and records the mutation data packets that cause problems in the target application. The protocol IE fine-grained fuzz testing module performs fuzz testing on the structural information elements of the protocol with the message element as the basic granularity. The protocol single-state fuzz testing module performs fuzz testing on the conversion state of the protocol with the protocol single state as the granularity to complete the state security detection. The protocol approximate full-interaction state fuzz testing module finds potential vulnerabilities by traversing the approximate full-interaction state of the target protocol. Through multiple modules, a full range of fuzz testing is performed on the mobile communication network protocol, thereby checking the security of the protocol and discovering protocol vulnerabilities in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 A schematic diagram of a 5G layered multi-granularity variation fuzzy testing device in an embodiment of the present application is shown.

[0038] Figure 2 The flowchart of the NGAP protocol TestRegistration proposed in the embodiment of the present application is shown.

[0039] Figure 3 A flow chart of a 5G layered multi-granularity fuzz testing method proposed in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0040] The following describes the embodiments of the present application through specific examples. Those skilled in the art can easily understand the other advantages and effects of the present application from the content disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other unless they conflict.

[0041] Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of this application.

[0042] In the prior art, fuzz testing for protocols is mainly divided into three types: static analysis, dynamic analysis and negative testing.

[0043] Static analysis: Traditionally, protocol analysis methods often rely on manual analysis of standards to uncover protocol vulnerabilities. Kim et al. proposed BASESPC, a tool for analyzing baseband and standards. BASESPC systematically examines the message structures implemented in baseband software by leveraging the standardized message structures in the specifications. This requires a one-time manual analysis effort to determine how the message structures are embedded in the target firmware. BASESPC then compares the extracted message structures with those in the specifications in both syntax and semantics. Finally, mismatches are reported. These mismatches indicate developer errors that have caused the baseband to not conform to the specifications, or indicate potential vulnerabilities.

[0044] Dynamic analysis: Building upon static analysis, more efficient semi-automatic / automatic testing tools have been introduced. Kim et al. implemented the semi-automatic testing tool LTEFuzz using open-source LTE software. The authors systematically generated test cases by defining three fundamental security properties. Based on these security properties, LTEFuzz generated test cases and sent them to the target network, categorizing problematic behaviors solely by monitoring device-side logs. The semi-automated dynamic testing process consists of three steps: 1) creating security properties based on specification analysis; 2) generating and executing test cases that violate the security properties; and 3) categorizing problematic use cases.

[0045] Previous work has mostly analyzed only a small number of firmware images for a few device models and often relied heavily on time-consuming manual static analysis or fuzz analysis of single functions. To fill this gap, Hernandez et al. proposed FIRMWIRE, the first full-system emulation platform for baseband processors that can execute unmodified baseband binary firmware.

[0046] Kim et al. believe that dynamic baseband analysis suffers from accessibility issues, leading to many errors being missed. Static analysis methods, such as those used by BaseSpec, require extensive manual analysis and are limited to message decoding, failing to support integrity protection, a critical requirement in mobile communications. The authors propose a novel semi-automatic baseband analysis method, BASECOMP, for analyzing integrity protection. To reduce the complexity of baseband firmware, BASECOMP leverages probabilistic reasoning to identify integrity protection features.

[0047] Negative testing is a fuzz testing method that contains only invalid or prohibited messages in its test cases. Because the 3GPP standard lacks negative testing, and previous research has only considered a limited range of states in LTE networks, Park et al. proposed a systematic testing framework, DoLTEst, to address these shortcomings. DoLTEst generates test cases based on the specification, including every key point of the negative test case. However, due to the large size and complexity of the standard, a complete understanding of the standard is nearly impossible.

[0048] Therefore, traditional fuzz testing technology has two major shortcomings: First, it fails to identify vulnerabilities in target code at different logical levels: it only considers scenarios where a single protocol exists, ignoring scenarios where multiple protocols coexist; and it only considers flaws in protocol flow processing, ignoring field-level testing. Second, the randomness of test cases makes it difficult to fully cover the logical state of a communication protocol, and test results are numerous and difficult to analyze.

[0049] In order to solve the problems that the existing fuzz testing technology only considers the existence of a single protocol and ignores the scenarios where multiple protocols coexist, resulting in incomplete coverage of fuzz test case scenarios and the randomness of test cases leading to a large number of fuzz test packages, space explosion, and long testing time, the embodiment of the present application proposes a 5G layered multi-granularity variation fuzz testing device and method, which is targeted at 5G mobile communication network protocols and has the characteristics of targetedness, fine granularity, and wide coverage, so as to better discover 5G protocol vulnerabilities and maintain network security.

[0050] Please refer to Figure 1 , Figure 1 A schematic diagram of a 5G layered multi-granularity mutation fuzz testing device in an embodiment of the present application is shown, which includes a protocol field intelligent mutation module, a state migration module, a state monitoring module, a protocol IE fine-grained fuzz testing module, a protocol single-state fuzz testing module, and a protocol approximate full-interaction state fuzz testing module;

[0051] The protocol field intelligent mutation module is used to select mutation strategies based on basic data type fields and / or complex data type fields;

[0052] The protocol field intelligent mutation module selects mutation strategies based on basic data type fields of bits / bytes / strings, complex data type fields with granularity such as existence / structure, and intelligent selection mutation strategies that include the above two strategies.

[0053] The Protocol Field Intelligent Mutation module is an advanced testing technology used to improve the robustness and security of protocol parsing and data processing components. This module triggers and detects potential errors in software by intelligently changing field values ​​in data packets.

[0054] Mutation strategies for basic data type fields can include bit-level mutation, byte-level mutation, or string mutation. Bit-level mutation targets basic data types such as integers and floating-point types. The intelligent mutation module will make detailed changes at the bit level, such as bit flipping and adding / subtracting bits to generate new values, thereby testing the software's ability to handle data precision and sign changes.

[0055] Byte-level mutation transforms data at the byte level, which can include reversing the byte order and randomly modifying the byte content. This helps to detect the compatibility and error handling mechanism of the byte order (big endian / little endian) in the protocol implementation.

[0056] String mutation is a change made to a string field, including character replacement, special character insertion, and length change. It checks whether the software's processing logic for illegal or boundary strings is correct.

[0057] Complex data type field selection mutation strategies can include existential mutation and structure mutation. Existential mutation changes the existence of fields within a complex structure, such as adding, removing, or rearranging structure members, to explore software requirements for data structure flexibility. For complex types like structures, the module intelligently applies the basic type mutation strategies described above based on the field types within the structure, while also considering inter-field dependencies to ensure that the mutated structure remains legal.

[0058] Intelligent mutation strategy selection combines the two aforementioned strategies, dynamically adjusting the priority and intensity of mutation strategies based on the characteristics of the target protocol or data format, as well as feedback from historical test results. For example, it prioritizes frequently problematic fields or specific types of data, or automatically strengthens mutation testing of related types when new types of errors are discovered. This is demonstrated not only by the flexible application of mutation strategies but also by its ability to learn and predict which mutations are most likely to reveal new defects, effectively guiding test case generation.

[0059] The state migration module is used to transfer the state of the target network element and send the variation data to the state monitoring module.

[0060] State transition logic defines and implements clear state transition rules. When preset conditions are met (such as receiving a specific instruction, reaching a specific time point, or detecting an error), the module triggers a state transition, such as from operational to maintenance. Transmitting variant data is intended to test the network element's ability to handle abnormal or edge conditions in certain state transition scenarios. Variant data differs from normal service traffic and may contain error codes, non-standard formats, and extreme values. This data is intended to elicit system responses and expose potential stability and security issues.

[0061] A state monitoring module is configured to monitor a running state of the target application, and record a variant data packet causing a problem of the target application, the variant data packet being used for vulnerability analysis.

[0062] The state monitoring module performs real-time monitoring to continuously collect running data of the target application, including but not limited to CPU usage, memory occupation, network traffic, disk I / O, thread state, exception log and the like, to ensure that the health status of the application can be understood in time. Abnormality detection is also performed, and a threshold and a rule are set to automatically identify an index or a mode deviating from normal behavior, such as a sudden increase in resource consumption, a prolonged response time, an increased error rate and the like. These abnormalities often indicate potential problems, and a variant data packet that can cause a problem of the target application is recorded, the variant data packet being used for subsequent vulnerability analysis, and being not only a clue for troubleshooting, but also valuable information for security audit and vulnerability analysis. The attack scene is reproduced by using the data packet, and the security weakness of the application is further explored, and then measures are taken to reinforce protection.

[0063] A protocol IE fine-grained fuzzing module is configured to perform fuzzing with a message element as a basic granularity for a structure information element of a protocol.

[0064] The protocol IE fine-grained fuzzing module has structure information element identification, and can deeply understand the internal structure of the measured protocol, and identify all key and variable information elements in the protocol. These information elements can be fields in a protocol header, specific parts of payload data or control bits and the like. The protocol IE fine-grained fuzzing module performs accurate testing by deeply accessing a micro level of a protocol message, and greatly improves the efficiency and accuracy of discovering protocol implementation vulnerabilities.

[0065] A protocol single-state fuzzing module is configured to perform fuzzing with a protocol single state as a granularity for a transition state of a protocol, to complete state security detection.

[0066] The protocol single-state fuzzing module performs fuzzing with a protocol single state as a granularity for a transition state of a protocol, and can perform relatively complete security detection for a certain state in a relatively short time. All variant samples are tested for the selected protocol state, so that complete security detection for the state is realized.

[0067] A protocol approximate full-interaction state fuzzing module is configured to find potential weak points by approximate full-interaction state message variation as a granularity through approximate full-interaction state traversal of a target protocol in fuzzing.

[0068] The protocol approximate full-interaction state fuzzing module improves the code coverage of fuzzing and more comprehensively finds potential weak points by approximate full-interaction state message variation as a granularity through approximate full-interaction state traversal of a target protocol in fuzzing.

[0069] exist Figure 1 In

[15] , the protocol field intelligent mutation module is used to generate compliant mutation samples before fuzz testing.

[0070] The protocol field intelligent mutation module inputs the generated mutation samples into three fuzzy testing modules of different granularities (parallel relationship), namely: protocol IE fine-grained fuzzy testing module, protocol single-state fuzzy testing module, and protocol approximate full-interaction state fuzzy testing module.

[0071] In addition, the state transition module is responsible for controlling the state jump of network elements during the fuzz testing process, such as disconnecting and sending compliant data packets to advance the protocol process.

[0072] The state migration module is responsible for monitoring the running status during the fuzz testing process and outputting mutated data packets that may have problems.

[0073] In one possible implementation, the protocol field intelligent mutation module is also used to select a mutation strategy through data verification operations, where the data verification operations include one or more of bit reversal, byte reversal, assignment operations, special value replacement, special string overwriting, special string insertion, random processing, and intelligent field type selection mutation.

[0074] The implementation steps of bit reversal are: invert a specific bit and use the inverted data as a test sample. For example, select bits 1, 2, and 4 to reverse, traverse the test sample and generate the mutant sample.

[0075] The implementation steps of byte reversal are: reverse a specific byte and use it as a mutation sample. For example, select 1, 2, or 4 bytes to reverse at a time to construct a mutation sample.

[0076] The assignment operation is performed by adding or subtracting a value within a range from the corresponding byte at a time, and replacing the old value with the new value as a test sample. For example, 1, 2, and 4 bytes are processed at a time. It is worth noting that for multi-byte methods, i.e., 2 and 4 bytes in the above examples, this application also considers big-endian and little-endian methods.

[0077] The implementation steps of special value replacement are as follows: select some special data for fuzzy replacement. Taking 1 byte as an example, select special values ​​such as 127, -128, 0, 1, and 4 as the data to be fuzzy replaced.

[0078] The implementation steps for special string overwriting are: Use some special strings to overwrite the values ​​in the data area. This requires constructing a dictionary library, including binary string and command line injection. Select the elements in the dictionary library that keep the length of the data area unchanged for overwriting.

[0079] The implementation steps of special string insertion are: insert each string in the dictionary library in turn without length detection.

[0080] The implementation steps of random processing are: using random methods to fuzzy process the data in the data area, such as random value replacement, insertion, deletion, copying, etc.

[0081] The implementation steps for smart field types are as follows: For the protocol's five basic data types (Boolean, integer, enumeration, bit string, and octet string), a mutation strategy tailored to their characteristics is adopted. For the protocol's five complex data types (sequence, selection, optional, TLV structure, and integrity protection field), a mutation strategy tailored to their characteristics is also adopted.

[0082] In a possible implementation, the state transition module is configured to construct corresponding protocol data packets through object-oriented programming, use the SCTP library to send and receive data, and perform protocol state transitions through the NGAP protocol.

[0083] The state transition module first defines the structure of each type of data packet and the state transition diagram of the protocol. During the state transition process of the network protocol, the transition from the current state to the next state depends on some stimulus. This stimulus can come from active behavior, such as shutting down or disconnecting the link, or it can come from passive behavior, such as receiving a qualified data packet to complete the state jump. In order to achieve the goal of state transition, we deeply study the state machines of the NGAP and PFCP protocols in 5G and the detailed structure of each type of data packet.

[0084] First, the corresponding protocol data packet is constructed through object-oriented programming. Secondly, since the NGAP protocol is based on SCTP, the SCTP library is used to implement data transmission and reception, and finally the protocol state jump is performed.

[0085] The state migration module includes an NGAP protocol jump submodule, which is used to send an initial context establishment message request to establish a connection through the AMF core network based on the closed state in the user equipment context management function. If the connection establishment fails, it returns to the closed state. If the establishment is successful, the connection is successfully established through the relevant mechanism, and the connection is released after completing the user equipment context management program.

[0086] In the UE Context Management function, starting from the closed state, the InitialContextSetup message (initial context establishment message) is sent through the AMF core network to request connection establishment. If the connection establishment fails, it returns to the initial closed state; if the establishment is successful, the connection is successfully established through authentication and other related mechanisms. After completing the UEContext Management (user equipment context management) program, the connection is released. Please refer to Table 1, which shows the complete state transition:

[0087] Table 1

[0088]

[0089] In a possible implementation, the state monitoring module is further configured to detect the running state information of the target application when the Agent tool sends a data packet of a corresponding state to the target application;

[0090] In the event that the target application crashes, the current data packet is recorded and stored in the corresponding directory;

[0091] Restart the target application for the next round of fuzz testing.

[0092] The agent tool's primary responsibility is to send specific data packets to the target application. These packets are typically used to test the application's stability and security, as part of fuzz testing. The agent's job is to automate this process, with each packet sent designed to trigger potential vulnerabilities or abnormal behavior.

[0093] When the target application receives a data packet from the Agent, the Status Monitoring module immediately checks the application's operational status. If it detects that the target application has crashed or exhibited an anomaly due to receiving certain data packets, the Status Monitoring module records the offending data packets and saves them to a specific directory for subsequent vulnerability analysis and exploit research by security analysts. Furthermore, the Status Monitoring module automatically restarts the target application to resume the next round of fuzz testing, ensuring a consistent and efficient testing process.

[0094] Fuzz testing of 5G network protocols often requires more complex mechanisms than traditional software fuzz testing, primarily due to data characteristics. A single type of protocol data often contains numerous fields. Traditional fuzz testing techniques often mutate each data point sequentially to generate malformed packets. This approach has significant drawbacks: it consumes time and places unnecessary network load. If a field is a protocol-specific identifier, blindly mutating it will invalidate all packets affected by the mutated field, significantly increasing testing efficiency.

[0095] In the process of mutating a sample, it is necessary not only to mutate it effectively, but also to pay attention to not destroying the format of the data packet itself as much as possible to avoid direct network discard.

[0096] Taking the NGAP protocol as an example, although the protocol data packets contain a large number of fields, the meanings and functions of different fields are different. The differences in these functions indicate that the weights (priorities) of different fields are different. Some fields can easily cause security problems in the network. For example, for the field representing the length in the protocol data, if the protocol processing module of the target entity handles it improperly (there is no security check on this part of the field), there will be potential security issues such as integer overflow, buffer overflow, and null pointer.

[0097] Therefore, according to the principle of efficient fuzz testing, such fields have higher priority and cost-effectiveness, and the mutation strategy should be given priority. For some fields where mutation is not very meaningful, such as specific identifiers, the protocol processing module of the target entity determines whether this field is data of the corresponding protocol. If this field is mutated, it will be meaningless and will cause subsequent data packets to be directly discarded. For some fields with perfect error handling mechanisms, even if the value corresponding to the field is modified to deformed data, a good error handling mechanism can handle the data packet error, and it is difficult for security issues to occur. Therefore, this application designs a protocol IE fine-grained fuzz testing module.

[0098] In a possible implementation, the protocol IE fine-grained fuzz testing module is also used to specify the mutation object to a specific field to complete the compliance mutation of the sample;

[0099] The selected fields are mutated, and the mutated fields are repackaged with normal fields using a protocol interpreter to form a data packet, which is then sent to the core network.

[0100] The mutation object is specified to a specific field, and these fields are used as objects to complete the compliance mutation of the sample without destroying the basic protocol format of the sample. In this way, the present application selects a specific field and performs mutation on the selected field. Then, the protocol interpreter is used to re-encapsulate the mutated field with the normal field, and the data packet is sent to the core network after the encapsulation is completed. At the same time, the monitor monitors the status of the core network, thus completing a sample test and improving the granularity of the overall fuzz test.

[0101] For multi-state protocols, there is a continuous relationship between the protocol states, and achieving a complete protocol flow requires completing multiple steps of protocol message interactions. By performing fuzz testing on a specific state, the security of the protocol stack in that specific protocol state can be tested. However, if only the protocol message corresponding to the target state is sent, the test will not be complete due to the lack of protocol interactions before the state. Therefore, this application designs a protocol single-state fuzz testing module.

[0102] In one possible implementation, the protocol single-state fuzz testing module is also used to dynamically adjust and control the execution path of the protocol, so that the protocol state machine enters the specific state that the user wants to check, thereby achieving complete security detection of the specific state.

[0103] The protocol single-state fuzz testing module can specify a complete security check for a certain state. Users can perform a relatively complete security check on a certain state in a relatively short period of time. All variant samples are tested against the selected protocol state, thereby achieving complete security testing of this state.

[0104] If you want to test a specific state, the protocol state machine must reach that state to perform effective testing. You can choose to reach a single state to perform comprehensive testing on all single states.

[0105] Since the state transition module reflects the processing logic of the protocol entity program, in the process of fuzz testing a stateful protocol, if the fuzz test covers every state of the protocol, it is considered that the fuzz test covers the main processing logic in the protocol entity program and can achieve relatively sufficient coverage of the test target.

[0106] To test a protocol's ability to process packets in a specific state, a single-state fuzz testing module sends a packet preamble sequence before fuzz testing the target state. However, there are situations where it's necessary to send special packets in one or more states preceding the target state to trigger vulnerabilities in the target state. Traditional packet sequence testing methods are insufficient for these situations.

[0107] Furthermore, some vulnerabilities are not simply flaws in the protocol itself, but also involve logical flaws in the business process. For example, if a user_id is specified as 10001 in the a field, but is subsequently assigned 10002 during connection establishment, the user_id is inconsistent. Without a proper handling mechanism, this can lead to illegal connection establishment. Serious business logic vulnerabilities can result in null pointers and, consequently, core network downtime. However, previous modules were unable to detect these vulnerabilities. To address this, a protocol near-full-interaction fuzz testing module was designed.

[0108] In one possible implementation, the protocol approximates a fully interactive state fuzz testing module, and is also used to fully encapsulate each business process to implement each business process;

[0109] A random number mutation seed is added to each business process, and the random number mutation seed is used to mutate the protocol state in the business process.

[0110] The protocol approximate full-interaction state fuzz testing module fully encapsulates each business process in advance, requiring each process to be fully implemented. After this functionality is implemented, a random number mutation seed is added to each business process. This mutation seed is designed to randomly mutate two or three protocol states within a given business process. This solves the aforementioned issues and comprehensively detects potential security flaws within the business process.

[0111] Taking the NGAP communication protocol as an example, Figure 2 The following figure shows a flowchart of the NGAP protocol TestRegistration proposed in an embodiment of the present application. This protocol mainly has nine business processes: TestServiceRequest, TestRegistration, TestDeregistration, TestGUTIRegistration, TestN2Handover, TestPaging, TestPDUSessionReleaseRequest, TestReSynchronisation, and TestXnHandover. Each state has a different number of protocol interactions, which are also data interactions in the business logic. For example, TestRegistration is a test registration process.

[0112] In summary, the 5G layered multi-granularity mutation fuzz testing device proposed in this application can guide the layered multi-granularity test sample mutation, complete fuzz testing at three granularities: message element, protocol single state, and approximate full interactive state message mutation, and realize vulnerability mining for target codes at different logical levels.

[0113] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0114] First, through the protocol single-state fuzz testing module and the protocol IE fine-grained fuzz testing module, the effect of automated detection of 5G core network protocol vulnerabilities is achieved, and the vulnerabilities in the 5G system protocol are mined as much as possible, avoiding the problems of high false alarm rate and low protocol state coverage of traditional static and dynamic analysis vulnerability mining methods.

[0115] Second, the efficiency of protocol fuzz testing is improved by using the protocol approximate full-interaction state fuzz testing module, and fuzz testing is performed on each state of the protocol, solving the problem of incomplete test coverage caused by the high interaction and multi-state of the protocol.

[0116] Since the protocol only accepts data packets that are suitable for a certain state, if the mutated data packets are directly used for testing, only defects in the protocol in that state may be discovered, which will be relatively inefficient. Fuzz testing of all states of the protocol can effectively improve the efficiency of vulnerability detection.

[0117] Second, please refer to Figure 3 , Figure 3 A flow chart of a 5G layered multi-granularity fuzz testing method proposed in an embodiment of the present application is shown. The method is based on the 5G Next Generation Application Protocol (NGAP) and the Packet Forwarding Control Protocol (PFCP). The method is applied to a 5G layered multi-granularity variation fuzz testing device, including:

[0118] Step S100: Assisting in developing a message format for fuzz testing by analyzing standard documents and data formats;

[0119] Step S200: Establish a mutation strategy based on the captured samples and key data, generate a compliant sample based on the mutation strategy and data format, and interact the compliant sample with the 5G core network to obtain the result generated by the core network;

[0120] Step S300: Analyze the results generated by the core network to determine the operating status of the core network;

[0121] Step S400: Analyze the test samples that produce abnormal conditions in the core network and optimize the mutation strategy through feedback;

[0122] Step S500: Analyze the output samples and monitor records to find loopholes in the protocol implementation.

[0123] First, we analyzed standard documents and data formats. By thoroughly analyzing the 5G communication protocol standard documents, we understood the various message types, formats, and interaction processes specified. We also used packet capture tools to capture data packets circulating in the actual network and analyzed the actual data formats and structures of these "wild" samples to ensure that the test samples were realistic.

[0124] Secondly, the fuzz testing message format is developed. Using the information obtained from standard documents and packet capture analysis, the initial message format for fuzz testing is defined, including determining which fields will be used for mutation strategies and the legal value range.

[0125] Constructing mutation strategies and generating compliant samples: Based on the above analysis, a set of mutation algorithms or strategies are designed, focusing on changing key data fields while ensuring that the generated samples still comply with the 5G protocol specifications, namely "compliant samples." Using these strategies, the system automatically generates a series of mutation samples in preparation for interaction testing with the 5G core network.

[0126] Interaction Testing and Status Monitoring: Compliant variant samples are sent to the 5G core network for interaction. The monitor continuously tracks the core network's response and status, recording any abnormal behavior or crashes. If an anomaly is detected, the system automatically collects relevant information and feeds it back to the mutation strategy for optimization, enabling more precise testing of vulnerabilities and improving testing efficiency.

[0127] Vulnerability analysis and strategy iteration: Analyze test samples that lead to abnormal results. Based on the analysis results, continuously iterate and optimize the mutation strategy to ensure wider test coverage, thereby effectively improving the accuracy and efficiency of the entire fuzz testing system.

[0128] Therefore, the present application discloses a 5G layered multi-granularity mutation fuzz testing device and method. The protocol field intelligent mutation module selects the mutation strategy according to the basic data type field and the complex data type field. The state migration module performs state transfer on the target network element and sends the mutation data. The state monitoring module monitors the running status of the target application and records the mutated data packets that cause problems in the target application. The protocol IE fine-grained fuzz testing module performs fuzz testing on the structural information elements of the protocol with the message element as the basic granularity. The protocol single-state fuzz testing module performs fuzz testing on the conversion state of the protocol with the single state of the protocol as the granularity to complete the state security detection. The protocol approximate full-interaction state fuzz testing module finds potential vulnerabilities by traversing the approximate full-interaction state of the target protocol. Through multiple modules, the mobile communication network protocol is comprehensively fuzz tested, thereby checking the security of the protocol and discovering protocol vulnerabilities in a timely manner.

[0129] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A 5G layered multi-granularity variation fuzzy testing device, characterized in that: The device includes a protocol field intelligent mutation module, a state migration module, a state monitoring module, a protocol IE fine-grained fuzz testing module, a protocol single-state fuzz testing module, and a protocol approximate full-interaction state fuzz testing module; The protocol field intelligent mutation module is used to select mutation strategies based on basic data type fields and / or complex data type fields; The state migration module is used to transfer the state of the target network element and send the variation data to the state monitoring module; A status monitoring module is used to monitor the running status of the target application and record mutated data packets that cause problems in the target application. The mutated data packets are used for vulnerability analysis; The protocol IE fine-grained fuzz testing module is used to perform fuzz testing on the protocol's structural information elements with message elements as the basic granularity; The protocol single-state fuzz testing module is used to perform fuzz testing on the protocol conversion state with the protocol single state as the granularity to complete state security detection; The protocol approximate full interactive state fuzz testing module is used to find potential vulnerabilities by traversing the approximate full interactive state of the target protocol during fuzz testing, with the granularity of approximate full interactive state message mutation.

2. The 5G layered multi-granularity variation fuzz testing device according to claim 1, characterized in that: The protocol field intelligent mutation module is also used to select mutation strategies through data verification operations, and the data verification operations include one or more of bit reversal, byte reversal, assignment operation, special value replacement, special string overwriting, special string insertion, random processing, and intelligent field type selection mutation.

3. The 5G layered multi-granularity variation fuzz testing device according to claim 1, characterized in that: The state transition module is also used to construct corresponding protocol data packets through object-oriented programming, use the SCTP library to send and receive data, and perform protocol state jumps through the NGAP protocol.

4. The 5G layered multi-granularity variation fuzz testing device according to claim 3, characterized in that: The state migration module includes an NGAP protocol jump submodule, which is used to send an initial context establishment message request to establish a connection through the AMF core network based on the closed state in the user equipment context management function. If the connection establishment fails, it returns to the closed state. If the establishment is successful, the connection is successfully established through the relevant mechanism, and the connection is released after completing the user equipment context management program.

5. The 5G layered multi-granularity variation fuzz testing device according to claim 1, characterized in that: The status monitoring module is also used to detect the running status information of the target application when the Agent tool sends a data packet of the corresponding status to the target application; In the event that the target application crashes, the current data packet is recorded and stored in the corresponding directory; Restart the target application for the next round of fuzz testing.

6. The 5G layered multi-granularity variation fuzz testing device according to claim 1, characterized in that: The protocol IE fine-grained fuzz testing module is also used to specify the mutation object to the field to complete the compliance mutation of the sample; The selected fields are mutated, and the mutated fields are re-encapsulated with normal fields using a protocol interpreter into a data packet, which is then sent to the core network.

7. The 5G layered multi-granularity variation fuzz testing device according to claim 1, characterized in that: The protocol single-state fuzz testing module is also used to dynamically adjust and control the execution path of the protocol, so that the protocol state machine enters the state that the user wants to check, achieving complete security detection of the state.

8. The 5G layered multi-granularity variation fuzz testing device according to claim 1, characterized in that: The protocol approximate full interactive state fuzz testing module is also used to fully encapsulate each business process and implement each business process; A random number mutation seed is added to each business process, and the random number mutation seed is used to mutate the protocol state in the business process.

9. A 5G layered multi-granularity variation fuzzy testing method, characterized in that: The method is applied to the 5G layered multi-granularity variation fuzz testing device according to any one of claims 1 to 8, comprising: Step 1: Assist in developing the message format for fuzz testing by analyzing standard documents and data formats; Step 2: Establish a mutation strategy based on captured packet samples and key data, and generate compliant samples based on the mutation strategy and data format. Interact the compliant samples with the 5G core network to obtain the results generated by the core network. Step 3: Analyze the results generated by the core network to determine the operating status of the core network; Step 4: Analyze test samples that produce abnormalities in the core network and optimize the mutation strategy through feedback; Step 5: Analyze the output samples and monitor records to find vulnerabilities in the protocol implementation.

Images