Network protocol fuzz testing method and device based on state guidance and seed variation

Abstract

The invention discloses a network protocol fuzz testing method and device based on state guidance and seed variation, and the method comprises the steps: 1), manually constructing a high-quality basic seed according to an official RFC protocol document, and enabling the seed to be mapped with a corresponding state; 2) inputting the message sequence into a target program for fuzzy testing, interacting with the target program, monitoring a program state, and obtaining feedback; 3) according to the protocol state code and path coverage rate feedback, selecting seeds with high coverage rate to carry out information retention variation, and reserving the state conversion function of the seeds to reduce the number of invalid seeds; and 4) generating a state guide message sequence: selecting a target test state according to a current state and a returned protocol state code, preferentially selecting a state which is not reached or has few arrival times as a target, and then generating a message sequence capable of reaching or approaching the target state according to the basic seed. According to the method provided by the invention, the state information of the protocol is fully utilized, the state conversion capability of the seed is reserved in the seed variation process, and the efficiency and the quality of the network protocol fuzz test are improved through state guidance and targeted message sequence generation.

Description

Technical Field

[0001] The present invention relates to the technical field of network protocol vulnerability mining, and in particular to a network protocol fuzzy testing method and device based on state guidance and seed mutation. Background Art

[0002] With the continuous development and application of modern networks, network architecture is becoming increasingly complex, with a wide variety of protocols covering a wide range. As the basis of data transmission and communication, the security of network protocols is directly related to the stability and security of the entire network system. However, once vulnerabilities in network protocols are maliciously exploited, they may lead to serious consequences such as data leakage, service interruption, and even system crash. Therefore, detecting and repairing network protocol vulnerabilities has become an important part of ensuring network security.

[0003] At present, traditional network protocol vulnerability detection methods mainly include static analysis and dynamic analysis. Static analysis methods check the potential vulnerabilities of the code. Although they have a wide coverage, they cannot find vulnerabilities at runtime. Dynamic analysis methods discover vulnerabilities by monitoring the running status of the program. Although they can capture exceptions at runtime, their detection cost is high and their efficiency is low. In addition, traditional vulnerability detection methods often rely on expert experience and manual operations, which have great subjectivity and limitations, and are difficult to cope with complex and changeable network protocol environments. Fuzz testing, as an effective vulnerability detection technology, triggers potential vulnerabilities by inputting random or semi-random data into the system under test. Compared with traditional methods, fuzz testing has the advantages of high automation and wide coverage, and can discover hidden vulnerabilities in the program in a relatively short time. However, the existing fuzz testing technology still has some shortcomings in network protocol vulnerability detection.

[0004] Network protocols usually have complex state machines and state transition processes, and different states affect the way the protocol handles input data. However, traditional fuzz testing technology has a low utilization rate of protocol state information. In most cases, it only relies on random or predefined test seeds, while ignoring the impact of protocol state changes on vulnerability discovery. This method results in the inability to effectively cover all states of the protocol during the test, especially some deep-level vulnerabilities that are only exposed in specific states. In addition, traditional fuzz testing methods often lack an intelligent feedback mechanism and cannot adjust subsequent testing strategies based on abnormal behaviors or partial results found during the test. This lack of goal-oriented testing not only wastes a lot of computing resources, but may also miss important vulnerabilities. Especially when facing complex network protocols and diverse attack surfaces, blind random fuzz testing is difficult to cover all potential vulnerability scenarios, resulting in low test coverage and vulnerability discovery rates. In order to solve these problems, there is an urgent need to provide an efficient network protocol fuzz testing method. Summary of the invention

[0005] In order to overcome the shortcomings of the existing methods, the present invention proposes a network protocol fuzzy testing method and device based on state guidance and seed mutation.

[0006] The technical solution adopted by the present invention to solve its technical problem is:

[0007] A first aspect of the present invention relates to a network protocol fuzz testing method based on state guidance and seed mutation, the method comprising the following steps:

[0008] 1) Construct basic seeds: According to the protocol message format in the official protocol RFC document, manually construct high-quality basic seeds for each state and map the seeds to each state.

[0009] 2) Fuzz testing: Input the message sequence into the target program for fuzz testing, interact with the target program and monitor the program status, obtain the protocol return status code and path coverage feedback.

[0010] 3) Seed mutation: According to the protocol status code and path coverage feedback, seeds with high path coverage are selected for mutation to generate new seeds, and the state transition function of the seeds is retained during the mutation process to reduce the number of invalid seeds.

[0011] 4) Generate state-guided message sequence: Select the target test state based on the current state and the returned protocol status code, and give priority to the state that has not been reached or has been reached less times as the target. After the state is selected, generate a message sequence that can reach or approach the target state based on the basic seed.

[0012] Furthermore, in step 1), constructing the basic seed includes the following steps:

[0013] Step 101, according to the RFC document and related technical specifications of the target protocol, deeply study the message structure of the target protocol, understand the specific meaning of each field of the protocol, such as source IP, destination IP, checksum, etc. Detailed analysis of each interaction process and state transition rules of the protocol.

[0014] Step 102: Based on the information obtained from the protocol, manually construct a set of basic test seeds that meet the protocol specifications and have high quality. These seeds should cover the main functions and common operation processes of the protocol to ensure their diversity and representativeness.

[0015] Step 103, map each constructed basic test seed with the corresponding protocol state. In the specific code implementation, the information of each seed is stored in the structure of the corresponding protocol message format. In addition, the structure also contains the protocol state code corresponding to the seed, recording the current state of the seed and the next state that can be triggered in the current state. This step provides data support for subsequent state selection and message sequence generation.

[0016] Furthermore, in step 2), the fuzzy test includes the following steps:

[0017] Step 201, during the first test, a number of basic seeds are randomly selected to form a message sequence in a random order, the target program is executed, the generated message sequence is input into the target program, and the fuzz testing process is started. During non-first tests, a number of mutated seeds are used to form a message sequence for testing.

[0018] Step 202 monitors the state transition and code coverage of the protocol in real time during the fuzz test, and records the number of times each state is reached, abnormal errors, and crashes. For the state transition and the number of times the state is reached, the fuzz tester can know the current protocol state through the returned status code. In addition, before the fuzz test, the target program source code is compiled with stubs, and stubs are inserted at each node branch of the code. After that, during the fuzz test, the stub code will write the target program code coverage into the shared memory, and the fuzz tester will continuously obtain the code coverage from the shared memory.

[0019] Step 203, record the results of each test in detail, including the input message sequence, the target program's response, and the state transition information. These data provide a basis for subsequent feedback analysis and seed mutation.

[0020] In step 3, the seed mutation includes the following steps:

[0021] Step 301: Analyze the paths covered by each seed during the test and select high-quality seeds according to the path coverage rate. A seed with a high coverage rate indicates that it can trigger more protocol states and code paths and has a higher test value.

[0022] Step 302, mutate the selected seeds to generate new test cases. Mutation operations include bit flipping, field replacement, random insertion and deletion, etc., and the state conversion capability of the seeds should be retained during the mutation process to ensure that the state conversion can continue and reduce invalid seed generation. When performing seed mutation, the fuzz tester divides the seeds into a control segment and a data segment. The control segment retains the state information of the seeds and does not perform mutation operations. Only the data segment is mutated. The specific implementation of the bit flip mutation algorithm is as follows: the bit flip operation includes selecting 1bit, 2bit, 4bit, 8bit, 16bit and 32bit6 flip modes, randomly selecting a flip mode during mutation, and then randomly selecting a position that does not exceed the data segment address for bit flipping, changing the selected bit from 0 to 1 or from 1 to 0. The specific implementation of the field replacement mutation algorithm is as follows: first, randomly generate a replacement field, randomly select a replacement field from the data part of the seed that triggers the crash or causes the highest code coverage, or generate a random value as the replacement field. Replace the original value of the target field with the selected replacement value to ensure that the replaced seed retains the protocol state information. The random insertion mutation algorithm is implemented as follows: first, randomly select the data field position in the target seed as the insertion address, generate a random data value or use the same method to select the field as the insertion data, insert the data into the selected position, and adjust the message format to comply with the protocol specification. The deletion mutation algorithm is implemented as follows: first, select the deletion position, and select one or more data segment addresses as the deletion position according to the message format. Secondly, select the deletion range, randomly select the size of the deleted data segment, but ensure that the message complies with the protocol specification after deletion. Finally, delete the data and adjust the message structure. In actual operation, the fuzz tester will combine the above multiple mutation algorithms for combined mutation to increase the diversity and coverage of test cases. For example, you can first perform bit flipping, then field replacement, and then insert random data. Each mutation strategy has its own unique number, and several of the numbers will be randomly selected as the mutation combination during mutation. By combining multiple mutation strategies, more diverse test cases can be generated, further improving the coverage and vulnerability discovery capabilities of fuzz testing.

[0023] In the step 4), the state guidance message sequence generation includes the following steps:

[0024] Step 401, during the fuzz test, the code will automatically construct a state transition graph, in which each node represents a unique state, and each node maintains a counter to record the number of times the state is reached. In addition, the graph also records all possible state transitions. According to the state monitoring results, the state that has not been reached is given priority, followed by the state with the least number of times reached for fuzz testing. If all states of the current protocol have been reached, and the number of states with the least number of times reached is greater than 1, a state with the least number of times reached is randomly selected as the next target state.

[0025] Step 402, divide the state into the current state, the intermediate state and the target state. The current state is the protocol state returned by the fuzz tester in the last test, the intermediate state is the state to be experienced from the current state to the target state, and the target state is the state selected to be tested. After the target state is selected, a new test case is generated through a mutation algorithm based on the mapping information of the seed and the current protocol state information, and the test cases are combined into a message sequence that can reach or approach the target state. The message sequence consists of a series of seeds that can reach the intermediate state and a seed that can reach or approach the target state. After the message sequence is generated, the sequence is handed over to the fuzz tester for testing.

[0026] The second aspect of the present invention relates to a network protocol fuzz testing device based on state guidance and seed mutation, comprising a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement a network protocol fuzz testing method based on state guidance and seed mutation of the present invention.

[0027] A third aspect of the present invention relates to a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements a network protocol fuzz testing method based on state guidance and seed mutation of the present invention.

[0028] The technical concept of the present invention is to use the status code feedback of the protocol to obtain the status information of the current protocol, select more valuable states for fuzzy testing based on the current protocol status information, and then use an information-preserving mutation algorithm that retains the seed state transition capability to generate higher quality test cases and reduce the generation of useless test cases.

[0029] The beneficial effects of the present invention are mainly manifested in: making full use of the status information of the protocol, selecting more valuable protocol states for testing, reducing the generation of invalid test cases, improving the testing efficiency, and achieving a higher detection speed and a larger number of crashes compared to previous more traditional fuzzy testing methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1is a flow chart of the method of the present invention.

[0031] Figure 2 It is an illustration of the state information preserving variation method of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described below in conjunction with the accompanying drawings.

[0033] Example 1

[0034] Reference Figure 1 , a network protocol fuzz testing method based on state guidance and seed mutation, comprising the following steps:

[0035] 1) Basic seed construction: According to the protocol message format in the official protocol RFC document, manually construct high-quality basic seeds for each state, and map the seeds to each state.

[0036] 2) Fuzz testing: Input the message sequence into the target program for fuzz testing, interact with the target program and monitor the program status, obtain the protocol return status code and path coverage feedback.

[0037] 3) Seed mutation: According to the protocol status code and path coverage feedback, seeds with high path coverage are selected for mutation to generate new seeds, and the state transition function of the seeds is retained during the mutation process to reduce the number of invalid seeds.

[0038] 4) State-guided message sequence generation: Select the target test state based on the current state and the returned protocol status code, and give priority to states that have not been reached or have been reached less frequently as the target. After the state is selected, a message sequence that can reach or approach the target state is generated based on the basic seed.

[0039] Furthermore, in step 1), the basic seed construction includes the following steps:

[0040] Step 101, according to the RFC document and related technical specifications of the target protocol, deeply study the message structure of the target protocol, understand the specific meaning of each field of the protocol, such as source IP, destination IP, checksum, etc. Detailed analysis of each interaction process and state transition rules of the protocol.

[0041] Step 102: Based on the information obtained from the protocol, manually construct a set of basic test seeds that meet the protocol specifications and have high quality. These seeds should cover the main functions and common operation processes of the protocol to ensure their diversity and representativeness.

[0042] Step 103, map each constructed basic test seed with the corresponding protocol state. In the specific code implementation, the information of each seed is stored in the structure of the corresponding protocol message format. In addition, the structure also contains the protocol state code corresponding to the seed, recording the current state of the seed and the next state that can be triggered in the current state. This step provides data support for subsequent state selection and message sequence generation.

[0043] Furthermore, in step 2), the fuzzy test includes the following steps:

[0044] Step 201, during the first test, a number of basic seeds are randomly selected to form a message sequence in a random order, the target program is executed, the generated message sequence is input into the target program, and the fuzz testing process is started. During non-first tests, a number of mutated seeds are used to form a message sequence for testing.

[0045] Step 202 monitors the state transition and code coverage of the protocol in real time during the fuzz test, and records the number of times each state is reached, abnormal errors, and crashes. For the state transition and the number of times the state is reached, the fuzz tester can know the current protocol state through the returned status code. In addition, before the fuzz test, the target program source code is compiled with stubs, and stubs are inserted at each node branch of the code. After that, during the fuzz test, the stub code will write the target program code coverage into the shared memory, and the fuzz tester will continuously obtain the code coverage from the shared memory.

[0046] Step 203, record the results of each test in detail, including the input message sequence, the target program's response, and the state transition information. These data provide a basis for subsequent feedback analysis and seed mutation.

[0047] In step 3, the seed mutation includes the following steps:

[0048] Step 301: Analyze the paths covered by each seed during the test and select high-quality seeds according to the path coverage rate. A seed with a high coverage rate indicates that it can trigger more protocol states and code paths and has a higher test value.

[0049] Step 302, mutate the selected seed to generate a new test case. Mutation operations include bit flipping, field replacement, random insertion and deletion, etc., and the state transition capability of the seed should be retained during the mutation process to ensure that the state transition can continue and reduce invalid seed generation. When performing seed mutation, the fuzz tester divides the seed into a control segment and a data segment. The control segment retains the seed state information and does not perform mutation operations. Only the data segment is mutated. Figure 2. The specific implementation of the bit flip mutation algorithm is as follows: the bit flip operation includes selecting 1bit, 2bit, 4bit, 8bit, 16bit and 32bit 6 flip modes. During the mutation, a flip mode is randomly selected, and then a position not exceeding the data segment address is randomly selected for bit flipping, changing the selected bit from 0 to 1 or from 1 to 0. The specific implementation of the field replacement mutation algorithm is as follows: first, randomly generate the replacement field, randomly select the replacement field from the data part of the seed that triggers the crash or causes the highest code coverage, or generate a random value as the replacement field. Replace the original value of the target field with the selected replacement value to ensure that the replaced seed retains the protocol state information. The specific implementation of the random insertion mutation algorithm is as follows: first, randomly select the data field position in the target seed as the insertion address, generate a random data value or use the same method to select a field as the insertion data, insert the data into the selected position, and adjust the message format to comply with the protocol specification. The specific implementation of the deletion mutation algorithm is as follows: first, select the deletion position, and select one or more data segment addresses as the deletion position according to the message format. Secondly, select the deletion range, and randomly select the size of the deleted data segment, but ensure that the message complies with the protocol specification after deletion. Finally, the data is deleted and the message structure is adjusted. In actual operation, the fuzz tester will combine the above-mentioned mutation algorithms to perform combined mutations to increase the diversity and coverage of test cases. For example, you can first perform bit flipping, then field replacement, and then insert random data. Each mutation strategy has its own unique number, and several of the numbers will be randomly selected as the mutation combination during mutation. By combining multiple mutation strategies, more diverse test cases can be generated, further improving the coverage and vulnerability discovery capabilities of fuzz testing.

[0050] In the step 4), the state guidance message sequence generation includes the following steps:

[0051] Step 401, during the fuzz test, the code will automatically construct a state transition graph, in which each node represents a unique state, and each node maintains a counter to record the number of times the state is reached. In addition, the graph also records all possible state transitions. According to the state monitoring results, the state that has not been reached is given priority, followed by the state with the least number of times reached for fuzz testing. If all states of the current protocol have been reached, and the number of states with the least number of times reached is greater than 1, a state with the least number of times reached is randomly selected as the next target state.

[0052] Step 402: Divide the states into the current state M0, intermediate states Mi (where i = 1, 2, 3,..., and 0 < i < n), and the target state Mn. The current state is the protocol state returned by the previous test of the fuzzer. The intermediate states are the states to be experienced from the current state to reach the target state, and the target state is the state selected for testing. After selecting the target state Mn, according to the mapping information of the seeds and the current protocol state information, new test cases are generated through the mutation algorithm, and the test cases are combined into a message sequence that can reach or approach the target state. The message sequence consists of a series of seeds that can reach the intermediate states and seeds that can reach or approach the target state. After generating the message sequence, the sequence is handed over to the fuzzer for testing.

[0053] The present invention utilizes the status code feedback of the protocol to obtain the current protocol state information, selects more valuable states for fuzz testing according to the current protocol state information. Secondly, it adopts an information-preserving mutation algorithm that retains the state transition ability of the seeds to generate higher-quality test cases and reduce the generation of useless test cases.

[0054] Embodiment 2

[0055] This embodiment relates to a network protocol fuzz testing device based on state guidance and seed mutation, including a memory and one or more processors. Executable code is stored in the memory. When the one or more processors execute the executable code, it is used to implement the network protocol fuzz testing method based on state guidance and seed mutation in Embodiment 1.

[0056] Embodiment 3

[0057] This embodiment relates to a computer-readable storage medium with a program stored thereon. When the program is executed by a processor, it implements the network protocol fuzz testing method based on state guidance and seed mutation in Embodiment 1.

[0058] The method proposed by the present invention makes full use of the protocol state information and retains the state transition ability of the seeds during the seed mutation process. Through state guidance and targeted message sequence generation, the efficiency and quality of network protocol fuzz testing are improved.

[0059] The content described in the embodiments of this specification is only an enumeration of the implementation forms of the inventive concept. The protection scope of the present invention should not be regarded as limited to the specific forms stated in the embodiments. The protection scope of the present invention also extends to equivalent technical means that can be conceived by those skilled in the art based on the inventive concept of the present invention.

Claims

1. A network protocol fuzz testing method based on state guidance and seed mutation, characterized in that: The specific steps are as follows: 1) Construct basic seeds: According to the protocol message format in the official protocol RFC document, manually construct high-quality basic seeds for each state, and map the seeds to each state; 2) Fuzz testing: Input the message sequence into the target program for fuzz testing, interact with the target program and monitor the program status, obtain the protocol return status code and path coverage feedback; 3) Seed mutation: According to the protocol status code and path coverage feedback, seeds with high path coverage are selected for mutation to generate new seeds, and the state conversion function of the seeds is retained during the mutation process to reduce the number of invalid seeds; 4) Generate a state guidance message sequence: select the target test state according to the current state and the returned protocol status code, and give priority to the state that has not been reached or has been reached less times as the target; After a state is selected, a message sequence that can reach or approach the target state is generated based on the basic seed.

2. A network protocol fuzz testing method based on state guidance and seed mutation as claimed in claim 1, characterized in that: The construction of the basic seed in step 1) specifically includes: Step 101, according to the RFC document and relevant technical specifications of the target protocol, deeply study the message structure of the target protocol, understand the specific meaning of each field of the protocol; and analyze each interaction process and state transition rules of the protocol in detail; Step 102: manually construct a set of basic test seeds that meet the protocol specifications and are of high quality based on the information obtained from the protocol; these seeds should cover the main functions and common operation processes of the protocol to ensure their diversity and representativeness; Step 103, map each constructed basic test seed with the corresponding protocol state. In the specific code implementation, the information of each seed is stored in a structure in the corresponding protocol message format. In addition, the structure also contains the protocol state code corresponding to the seed, recording the current state of the seed and the next state that can be triggered in the current state; this step provides data support for subsequent state selection and message sequence generation.

3. A network protocol fuzz testing method based on state guidance and seed mutation as claimed in claim 1, characterized in that: The fuzz test in step 2) specifically includes: Step 201, during the first test, a number of basic seeds are randomly selected to form a message sequence in a random order, the target program is executed, the generated message sequence is input into the target program, and the fuzz testing process is started; during the non-first test, a number of mutated seeds are used to form a message sequence for testing; Step 202, real-time monitoring of the state transition and code coverage of the protocol during the fuzz test, recording the number of arrivals, exceptions and crashes of each state; for the state transition and the number of state arrivals, the fuzz tester can know the current protocol state through the returned status code; in addition, before the fuzz test, the target program source code is compiled with stubs, and stubs are inserted at each node branch of the code. After that, during the fuzz test, the stub code will write the target program code coverage into the shared memory, and the fuzz tester will continuously obtain the code coverage from the shared memory; Step 203, record the results of each test in detail, including the input message sequence, the response of the target program, and the state transition information; these data provide a basis for subsequent feedback analysis and seed mutation.

4. A network protocol fuzz testing method based on state guidance and seed mutation as claimed in claim 1, characterized in that: The seed mutation in step 3) specifically includes: Step 301, analyzing the paths covered by each seed during the test, and selecting high-quality seeds according to the path coverage rate; seeds with high coverage rates indicate that they can trigger more protocol states and code paths and have higher test value; Step 302, mutate the selected seed to generate a new test case; the mutation operation includes bit flipping, field replacement, random insertion and deletion, and the state transition capability of the seed should be retained during the mutation process to ensure that the state transition can continue and reduce invalid seed generation; when mutating the seed, the fuzz tester divides the seed into a control segment and a data segment, the control segment retains the state information of the seed, does not perform mutation operations, and only performs mutation operations on the data segment; the specific implementation of the bit flip mutation algorithm is as follows: the bit flip operation includes selecting 1bit, 2bit, 4bit, 8bit, 16bit and 32bit 6 flipping methods, randomly selecting a flipping method during mutation, and then randomly selecting a position that does not exceed the data segment address for bit flipping, changing the selected bit from 0 to 1 or from 1 to 0; the field replacement mutation algorithm is specifically implemented as follows: first, a replacement field is randomly generated, and a replacement word is randomly selected from the data part of the seed that triggers the crash or causes the highest code coverage segment, or generate a random value as the replacement field; replace the original value of the target field with the selected replacement value to ensure that the seed after replacement retains the protocol state information; the random insertion mutation algorithm is specifically implemented as follows: first randomly select the data field position in the target seed as the insertion address, generate a random data value or use the same method to select a field as the insertion data, insert the data into the selected position, and adjust the message format to comply with the protocol specification; the deletion mutation algorithm is specifically implemented as follows: first select the deletion position, and select one or more data segment addresses as the deletion position according to the message format; secondly select the deletion range, randomly select the size of the deleted data segment, but ensure that the message complies with the protocol specification after deletion; finally delete the data and adjust the message structure; the fuzz tester combines the above-mentioned multiple mutation algorithms for combined mutation to increase the diversity and coverage of test cases; each mutation strategy has its own unique number, and several of the numbers will be randomly selected as the mutation combination during mutation; more diverse test cases are generated by combining multiple mutation strategies.

5. A network protocol fuzz testing method based on state guidance and seed mutation as claimed in claim 1, characterized in that: The state guidance message sequence generation in step 4) includes: Step 401, during the fuzz testing process, the code will automatically construct a state transition graph, in which each node represents a unique state, each node maintains a counter to record the number of times the state is reached, and the graph also records all possible state transitions; according to the state monitoring results, the state that has not been reached is selected first, and then the state with the least number of times reached is selected for fuzz testing; if all states of the current protocol have been reached, and the number of states with the least number of times reached is greater than 1, then a state with the least number of times reached is randomly selected as the next target state; Step 402, divide the state into a current state, an intermediate state and a target state; the current state is the protocol state returned by the fuzz tester in the last test, the intermediate state is the state to be experienced from the current state to the target state, and the target state is the state selected to be tested; after the target state is selected, a new test case is generated through a mutation algorithm based on the mapping information of the seed and the current protocol state information, and the test cases are combined into a message sequence that can reach or approach the target state; the message sequence is composed of a series of seeds that can reach the intermediate state and seeds that can reach or approach the target state; after the message sequence is generated, the sequence is handed over to the fuzz tester for testing.

6. A network protocol fuzz testing device based on state guidance and seed mutation, characterized in that: It comprises a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement a network protocol fuzz testing method based on state guidance and seed mutation as described in any one of claims 1-5.

7. A computer-readable storage medium, characterized in that: A program is stored thereon, and when the program is executed by a processor, a network protocol fuzz testing method based on state guidance and seed mutation as described in any one of claims 1-5 is implemented.

Images