A network protocol fuzz testing method based on format constraints

Abstract

The present invention discloses a network protocol fuzz testing method based on format constraints, comprising: step s1: representing a network protocol as a protocol format knowledge base; step s2: dividing a network protocol data packet into multiple message sequences; step s3: constructing a message sequence subtree and a message structure tree; step s4: performing message-level mutation, constructing an updated message sequence, and randomly selecting fields in the message tree for mutation; step s5: reinserting the selected mutated fields into the message tree, and saving the generated message tree message sequence as a protocol test case; step s6: passing the test case to a fuzz testing tool to perform a round of fuzz testing; step s7: the fuzz testing tool feeds back the test results to the fuzzer, guiding the fuzzer to perform mutation based on the format constraints; and step s8: repeating steps s5 to s7. The present invention has the advantages of simpler principle, easier implementation, and significantly improved testing efficiency.

Description

Technical Field

[0001] The present invention mainly relates to the technical field of network security, and in particular to a network protocol fuzzy testing method based on format constraints. Background Art

[0002] With the development of internet technology, network protocol software is increasingly appearing as dedicated software components. These components are embedded into other application software, embedded systems, and IoT firmware, forming part of network service-driven application systems. However, network implementations expose complex interfaces and protocol interactions during runtime. Furthermore, network implementations are deployed extensively, and the causes of vulnerabilities are often hidden. Consequently, the types of vulnerabilities and the resulting damage are widespread. Promptly discovering and patching vulnerabilities in network protocol software is crucial for internet security.

[0003] Fuzz testing is highly effective in discovering vulnerabilities in network protocol software. Academic research on network protocol fuzzing began with black-box approaches based on specialized knowledge and predefined templates. In recent years, coverage-guided fuzz testing tools have demonstrated success in vulnerability discovery. Numerous researchers have proposed optimization methods for testing efficiency, test case quality, and state discovery models, achieving significant results. However, the effectiveness of mutation-based protocol fuzzers is limited by the quality of their test cases. Unconstrained mutation methods often corrupt message formats, generating test cases that are rejected by the protocol software. Summary of the Invention

[0004] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a network protocol fuzzy testing method based on format constraints, which has a simpler principle, is easier to implement, and can greatly improve testing efficiency.

[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0006] A network protocol fuzz testing method based on format constraints, comprising:

[0007] Step s1: Represent the network protocol into a protocol format knowledge base;

[0008] Step s2: using format knowledge to divide the network protocol data packet into multiple message sequences, and dividing the message seed into multiple fields;

[0009] Step s3: Generate a message sequence subtree of field information nodes covered by the message for all messages; construct the message sequence subtree into a message structure tree in the form of a serial table;

[0010] Step s4: Perform message-level mutation based on the message structure tree, construct an updated message sequence, and randomly select fields in the message tree, and pass the selected fields to the fuzzifier for mutation;

[0011] Step s5: reinsert the selected mutation field into the message tree, and save the generated message tree message sequence as a protocol test case;

[0012] Step s6: Pass the mutated protocol implementation test case to the fuzz testing tool, send the mutated message to the target software, and perform a round of fuzz testing;

[0013] Step s7: The fuzz testing tool feeds the test results back to the fuzzer, guiding the fuzzer to perform mutation based on format restrictions;

[0014] Step s8: Repeat steps s5 to s7.

[0015] As a further improvement of the present invention: in the step s1, data packets in the network protocol communication process are collected and analyzed in line format using an analysis tool; the analysis tool is Wireshark, and Wireshark is used to capture network communication data packets of the tls library, and the data packets are stored as pacp format files.

[0016] As a further improvement of the present invention: step s2 includes:

[0017] Use Wireshark to parse the format of the network protocol data packet in the pacp file;

[0018] Load the stored pacp format file, use Wireshark's network data analysis capabilities to parse the protocol type and packet format of the data packet in the pacp file, and obtain the field blocks in the data packet.

[0019] As a further improvement of the present invention: step s3 includes:

[0020] Use the tls network protocol data packet format identified by Wireshark to perform secondary processing and identify all field types in the protocol data packet;

[0021] For each field, intercept the data packet content of different lengths and compare it with the parsing results of Wireshark;

[0022] Get the length information of each field in the data packet and output the generated format knowledge base .json file.

[0023] As a further improvement of the present invention: step s4 includes:

[0024] Provide the format knowledge base to the protocol tree builder, and use the format knowledge to generate a message structure tree for each message sequence;

[0025] The method for generating a message structure tree is to divide the message seed into different fields according to the format information based on the protocol format information, use the field value and field length and other information as the structure tree nodes, insert the field nodes into the message structure tree in the form of a linked list to form a message structure tree; the message format tree is implemented in the form of a linked list.

[0026] As a further improvement of the present invention: step s5 includes:

[0027] Through the message-level mutation algorithm, the subtrees of the message structure tree are dynamically removed from the message structure tree, or a subtree in a message structure tree is inserted into another message structure tree, or the order of different subtrees in a message structure tree is swapped, thereby mutating the order of messages in the message sequence and generating more message sequences.

[0028] Randomly select message field nodes as mutation nodes on the new message structure tree, use the fuzzifier to mutate the selected nodes, and insert the selected fields back into the structure tree after mutation to form a new message sequence.

[0029] As a further improvement of the present invention: the algorithm input of the message-level mutation algorithm is the message sequence MS, the number of messages MS_lenth in the message sequence MS, and the algorithm outputs MMS and the message sequence pool MS_pool.

[0030] As a further improvement of the present invention: the process of the message-level mutation algorithm includes:

[0031] Step s51: first assign MS to MMS; then generate a random number num, ranging from 0 to 5;

[0032] Step s52: If num is 0, a random message is deleted. Next, a random number num1 is generated, the num1th message is deleted from the MMS, and the MMS is output;

[0033] If num is 1, a random message exchange is performed. Next, two random numbers num1 and num2 are generated. The positions of the num1th message in the MMS are exchanged with the num2th message, and the MMS is output.

[0034] If num is 2, a random message is inserted. A MS is randomly selected from the MS pool. Next, two random numbers num1 and num2 are generated. The num1th message is selected from the MS and inserted into the num2th position of the MMS. The MMS is then returned.

[0035] If num is greater than or equal to 3, MMS is returned directly.

[0036] As a further improvement of the present invention: in the step s6, the mutated protocol implementation message sequence is provided to the fuzz testing tool to perform a round of fuzz testing of the network protocol, and the fuzz testing tool feeds back the execution information of the test message sequence to the fuzzer; the feedback includes the code execution scope and the changed program status information of the protocol software in the process of processing the message sequence.

[0037] As a further improvement of the present invention: in step s7, the fuzzifier evaluates the value of the message sequence based on the received feedback information, and selectively retains high-value and useful message sequences based on the evaluation results, and updates the message structure tree; the fuzzifier also dynamically adjusts the energy of the nodes in the generated structure tree based on the evaluation results, so that important fields have more mutation opportunities.

[0038] Compared with the prior art, the advantages of the present invention are:

[0039] The present invention's format-constrained network protocol fuzz testing method has a simpler principle, is easier to implement, and can significantly improve testing efficiency. The present invention adopts a format-constrained fuzz testing method, adding format information constraints during message mutation, making the mutation of the mutated message sequence more purposeful, thereby generating a more effective message sequence. This gives the mutated message sequence a greater chance of passing the format parsing stage of the protocol implementation and avoids test case rejection by the implementation, thereby improving the testing efficiency and quality of the network protocol. The present invention ensures the validity of protocol messages through structured mutation, and the message-level mutation algorithm designed based on the characteristics of the protocol can trigger more state transitions in the protocol implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic flow chart of the method of the present invention in a specific embodiment.

[0041] Figure 2 It is a schematic diagram of the principle of the present invention in a specific embodiment.

[0042] Figure 3 It is a schematic diagram of a message structure tree implemented in a specific embodiment of the present invention.

[0043] Figure 4 This is a schematic diagram of the TLS JSON format in a specific implementation of the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0045] like Figure 1 、 Figure 2 、 Figure 3 and Figure 4 As shown, the present invention provides a network protocol fuzz testing method based on format constraints, which includes:

[0046] Step s1: Represent the network protocol into a protocol format knowledge base;

[0047] Step s2: using format knowledge to divide the network protocol data packet into multiple message sequences, and dividing the message seed into multiple fields;

[0048] Step s3: Generate a message sequence subtree of field information nodes covered by the message for all messages; construct the message sequence subtree into a message structure tree in the form of a serial table;

[0049] Step s4: Perform message-level mutation based on the message structure tree, construct an updated message sequence, and randomly select fields in the message tree, and pass the selected fields to the fuzzifier for mutation;

[0050] Step s5: reinsert the selected mutation field into the message tree, and save the generated message tree message sequence as a protocol test case;

[0051] Step s6: Pass the mutated protocol implementation test case to the fuzz testing tool, send the mutated message to the target software, and perform a round of fuzz testing;

[0052] Step s7: The fuzz testing tool feeds the test results back to the fuzzer, guiding the fuzzer to perform mutation based on format restrictions;

[0053] Step s8: Repeat steps s5 to s7.

[0054] In a specific application example, in step s1, data packets in the network protocol communication process are collected and analyzed using an analysis tool. According to actual needs, a tool that can be used is Wireshark, which is used to capture network communication data packets in the tls library and store the data packets as pacp format files.

[0055] In a specific application example, step s2 includes:

[0056] Use Wireshark to parse the format of the network protocol data packet in the pacp file;

[0057] Load the stored pacp format file, use Wireshark's network data analysis capabilities to parse the protocol type and packet format of the data packet in the pacp file, and obtain the field blocks in the data packet.

[0058] In specific application examples, see Figure 3 , the step s3 comprises:

[0059] Use the tls network protocol data packet format identified by Wireshark to perform secondary processing and identify all field types in the protocol data packet;

[0060] For each field, intercept the data packet content of different lengths and compare it with the parsing results of Wireshark;

[0061] Get the length information of each field in the data packet and output the generated format knowledge base .json file.

[0062] In a specific application example, step s4 includes:

[0063] The format knowledge base is provided to the protocol tree builder, and a message structure tree is generated for each message sequence using the format knowledge.

[0064] Furthermore, the method for generating a message structure tree is to divide the message seed into different fields according to the format information of the protocol format information, use the field value and field length and other information as the structure tree nodes, insert the field nodes into the message structure tree in the form of a linked list, and form a message structure tree.

[0065] Furthermore, the message format tree is implemented in the form of a linked list, and message-level variation can be achieved through simple unlinking and linking. The chain implementation physically isolates the content of the protocol message.

[0066] In a specific application example, step s5 includes:

[0067] Through the message-level mutation algorithm, the subtree of the message structure tree is dynamically removed from the message structure tree, or a subtree in a message structure tree is inserted into another message structure tree, or the order of different subtrees in a message structure tree is exchanged, and the order of messages in the message sequence is mutated, thereby generating more message sequences.

[0068] Randomly select message field nodes as mutation nodes on the new message structure tree, use the fuzzifier to mutate the selected nodes, and insert the selected fields back into the structure tree after mutation to form a new message sequence.

[0069] As a preferred embodiment, in this example, the message-level mutation algorithm inputs are the message sequence MS, the number of messages in the message sequence MS_lenth, and the algorithm outputs MMS and the message sequence pool MS_pool. In actual application, the process may include:

[0070] Step s51: first assign MS to MMS; then generate a random number num, ranging from 0 to 5;

[0071] Step s52: If num is 0, a random message is deleted. Next, a random number num1 is generated, the num1th message is deleted from the MMS, and the MMS is output;

[0072] If num is 1, a random message exchange is performed, and then two random numbers num1 and num2 are generated, and the positions of the num1th message and the num2th message in the MMS are exchanged, and the MMS is output.

[0073] If num is 2, random message insertion is performed, a MS is randomly selected from the MS pool, two random numbers num1 and num2 are generated, the num1th message is selected from the MS, inserted into the num2th position in the MMS, and the MMS is returned.

[0074] If num is greater than or equal to 3, MMS is returned directly.

[0075] In a specific application example, in step s6, the mutated protocol implementation message sequence is provided to the fuzz testing tool for a round of fuzz testing of the network protocol. The fuzz testing tool feeds back the execution information of the test message sequence to the fuzzer. The feedback includes information such as the code execution scope, the changed program status, etc. of the protocol software in the process of processing the message sequence.

[0076] In a specific application example, in step s7, the fuzzifier evaluates the value of the message sequence based on the received feedback information. Based on the evaluation results, it selectively retains high-value and useful message sequences and updates the message structure tree. The fuzzifier also dynamically adjusts the energy of the generated structure tree nodes based on the evaluation results, giving important fields more mutation opportunities.

[0077] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A network protocol fuzz testing method based on format constraints, characterized in that: include: Step s1: Represent the network protocol into a protocol format knowledge base; Step s2: using format knowledge to divide the network protocol data packet into multiple message sequences, and dividing the message seed into multiple fields; Step s3: Generate a message sequence subtree of field information nodes covered by the message for all messages; Construct the message sequence subtree into a message structure tree in the form of a serial table; Step s4: Perform message-level mutation based on the message structure tree, construct an updated message sequence, and randomly select fields in the message tree, and pass the selected fields to the fuzzifier for mutation; Step s5: reinsert the selected mutation field into the message tree, and save the generated message tree message sequence as a protocol test case; Step s6: Pass the mutated protocol implementation test case to the fuzz testing tool, send the mutated message to the target software, and perform a round of fuzz testing; Step s7: The fuzz testing tool feeds the test results back to the fuzzer, guiding the fuzzer to perform mutation based on format restrictions; Step s8: Repeat steps s5 to s7.

2. The network protocol fuzz testing method based on format constraints according to claim 1 is characterized in that: In the step s1, data packets in the network protocol communication process are collected and format parsed using an analysis tool; the analysis tool is Wireshark, and Wireshark is used to capture network communication data packets in the tls library and store the data packets in a pacp format file.

3. The network protocol fuzz testing method based on format constraints according to claim 2 is characterized in that: The step s2 comprises: Use Wireshark to parse the format of the network protocol data packet in the pacp file; Load the stored pacp format file, use Wireshark's network data analysis capabilities to parse the protocol type and packet format of the data packet in the pacp file, and obtain the field blocks in the data packet.

4. The network protocol fuzz testing method based on format constraints according to claim 2 is characterized in that: The step s3 comprises: Use the tls network protocol data packet format identified by Wireshark to perform secondary processing and identify all field types in the protocol data packet; For each field, intercept the data packet content of different lengths and compare it with the parsing results of Wireshark; Get the length information of each field in the data packet and output the generated format knowledge base .json file.

5. The network protocol fuzz testing method based on format constraints according to any one of claims 1 to 4, characterized in that: The step s4 comprises: Provide the format knowledge base to the protocol tree builder, and use the format knowledge to generate a message structure tree for each message sequence; The method for generating a message structure tree is to divide the message seed into different fields according to the format information based on the protocol format information, use the field value and field length information as the structure tree nodes, insert the field nodes into the message structure tree in the form of a linked list, and form a message structure tree; the message format tree is implemented in the form of a linked list.

6. The network protocol fuzz testing method based on format constraints according to any one of claims 1 to 4, characterized in that: The step s5 comprises: Through the message-level mutation algorithm, the subtrees of the message structure tree are dynamically removed from the message structure tree, or a subtree in a message structure tree is inserted into another message structure tree, or the order of different subtrees in a message structure tree is swapped, thereby mutating the order of messages in the message sequence and generating more message sequences. Randomly select message field nodes as mutation nodes on the new message structure tree, use the fuzzifier to mutate the selected nodes, and insert the selected fields back into the structure tree after mutation to form a new message sequence.

7. The network protocol fuzz testing method based on format constraints according to claim 6 is characterized in that: The algorithm input of the message-level mutation algorithm is the message sequence MS, the number of messages in the message sequence MS MS_lenth, and the algorithm outputs MMS and the message sequence pool MS_pool.

8. The network protocol fuzz testing method based on format constraints according to claim 7 is characterized in that: The process of the message-level mutation algorithm includes: Step s51: first assign MS to MMS; then generate a random number num, ranging from 0 to 5; Step s52: If num is 0, a random message is deleted. Next, a random number num1 is generated, the num1th message is deleted from the MMS, and the MMS is output; If num is 1, a random message exchange is performed. Next, two random numbers num1 and num2 are generated. The positions of the num1th message in the MMS are exchanged with the num2th message, and the MMS is output. If num is 2, a random message is inserted. A MS is randomly selected from the MS pool. Next, two random numbers num1 and num2 are generated. The num1th message is selected from the MS and inserted into the num2th position of the MMS. The MMS is then returned. If num is greater than or equal to 3, MMS is returned directly.

9. The network protocol fuzz testing method based on format constraints according to any one of claims 1 to 4, characterized in that: In step s6, the mutated protocol implementation message sequence is provided to the fuzz testing tool to perform a round of fuzz testing of the network protocol, and the fuzz testing tool feeds back the execution information of the test message sequence to the fuzzer; the feedback includes the code execution scope and the changed program status information of the protocol software in the process of processing the message sequence.

10. The network protocol fuzz testing method based on format constraints according to any one of claims 1 to 4, characterized in that: In step s7, the fuzzifier evaluates the value of the message sequence based on the received feedback information, and selectively retains high-value and useful message sequences based on the evaluation results, and updates the message structure tree; the fuzzifier also dynamically adjusts the energy of the generated structure tree nodes based on the evaluation results, so that important fields have more mutation opportunities.

Images