Modbus protocol fuzzy test case generation method based on genetic algorithm and logic mapping

Abstract

The invention discloses a Modbus protocol fuzzy test case generation method based on a genetic algorithm and logic mapping. Relates to the technical field of automatic test case generation. Through a protocol structure analysis technology, variable fields are accurately divided, key fields are extracted, and a test case generation range is narrowed to a variable part. The mode can ensure that the test case is not discarded by the equipment, and the test efficiency is improved; according to the method, a Logistic mapping function is introduced to guide mutation operation, and mutation intensity is dynamically adjusted according to population fitness: diversity is enhanced at a high mutation rate at an initial stage, convergence is improved at a low mutation rate at a later stage, and population prematurity is avoided. And in combination with interlace operation of protocol format constraint, the generated test case is ensured to conform to protocol specifications and have differentiated characteristics. Through a closed loop of protocol analysis-intelligent generation-fuzzy testing, the core problems of high redundancy, low coverage rate and poor convergence in industrial control fuzzy testing are solved, and the resource consumption is reduced while the testing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of automated test case generation, and in particular to a Modbus protocol fuzzy test case generation method based on genetic algorithm and logic mapping. Background Art

[0002] In the field of Modbus protocol fuzz testing, existing test case generation methods have the following technical flaws:

[0003] (1) The test cases generated by Peach software are highly redundant and fail to cover all possible test scenarios, especially complex and marginal test cases. The generation method based on simple rules lacks flexibility and intelligence and is difficult to adapt to the ever-changing test requirements.

[0004] (2) As the scale of testing expands, the cost of manually writing test cases rises sharply, which not only increases labor costs but also prolongs the testing cycle and affects the product's time to market.

[0005] (3) Existing methods are inefficient in generating test cases and cannot meet the needs of large-scale and high-efficiency testing, which limits the improvement of production efficiency and test quality.

[0006] (4) With the development of industrial automation and the Internet of Things, users' demands for Modbus protocol testing are becoming increasingly diversified. Existing technologies are difficult to meet users' demands for customized and intelligent test cases. Summary of the Invention

[0007] This paper provides a method for generating Modbus protocol fuzzy test cases based on a genetic algorithm and logical mapping, addressing the technical problem of automatically and efficiently generating high-quality test cases in software testing. By combining the global search capabilities of a genetic algorithm with the random exploration characteristics of fuzz testing, the method aims to automatically generate test cases that cover potential software defects, thereby improving the efficiency and effectiveness of software testing.

[0008] The technical solution adopted by the present invention is: a Modbus protocol fuzzy test case generation method based on genetic algorithm and logical mapping, the method comprising the following steps:

[0009] Step 1: Based on the Modbus protocol structure, the fields included therein are divided into variable fields to narrow the scope of test case generation;

[0010] Step 2: Based on the determined variable fields, the variable fields of the input Modbus protocol data are iteratively optimized and generated based on the genetic algorithm, and Modbus protocol fuzzy test cases are dynamically generated through selection, crossover, and mutation operations;

[0011] In the mutation operation of each variable field, Logistic mapping is introduced to guide the mutation operation to balance diversity and convergence.

[0012] Furthermore, in step 1, the two fields of the protocol identifier and the unit identifier in the message header of the Modbus protocol are set as immutable fields, and the remaining fields are set as mutable fields.

[0013] Furthermore, in step 2, when the variable fields of the input Modbus protocol data are iteratively optimized and generated based on the genetic algorithm, the sum of the string similarities of all variable fields of the individual before and after the optimization generation is used as the individual fitness of the genetic algorithm.

[0014] Preferably, the expression of individual fitness can be: Among them, S im (() represents a similarity function, such as the cosine function, Respectively represent the strings of the jth variable field before and after optimization, and K represents the number of variable fields set. In addition, when calculating individual fitness, the individual similarity can also be directly obtained by directly comparing the similarity between the encoding vectors of the individual before and after mutation (before and after optimization).

[0015] Furthermore, in the mutation operation, the mutation probability is adjusted based on the difference between the individual fitness and the average fitness:

[0016]

[0017] D f =fF i

[0018] Among them, M′ and M are the mutation probabilities before and after the update, respectively, and D f Represents the average fitness f and individual fitness F i The subscript i is the individual number.

[0019] Furthermore, when the variable fields of the input Modbus protocol data are iteratively optimized and generated based on the genetic algorithm, the diversity of the population is represented by the average Hamming distance between all individuals in the current generation of the population, and the iterative convergence condition of the genetic algorithm is set based on the average Hamming distance.

[0020] Preferably, when the average Hamming distance reaches a preset value, the iterative optimization generation based on the genetic algorithm is stopped.

[0021] Furthermore, by introducing the Logistic mapping to guide the mutation operation, the specific operations include:

[0022] Generate a random number between 0 and 1 as the initial value of the Logistic map, and then perform multiple iterations of chaotic value generation based on the Logistic map;

[0023] Scale the chaotic value generated by the last iteration to the range of 0-255 and replace the corresponding gene in the current variable field of the individual.

[0024] The technical solution provided by the present invention brings at least the following beneficial effects:

[0025] (1) Significantly reduce test case redundancy and improve test efficiency

[0026] Traditional industrial control protocol fuzz testing methods typically use full-field random generation or fixed template coverage strategies, resulting in a large number of redundant test cases, wasted computing resources, and low efficiency. This invention uses protocol structure analysis technology to precisely divide variable fields and extract key fields (such as check bits and function codes), narrowing the test case generation scope to the variable parts. This approach ensures that test cases are not discarded by the device, improving testing efficiency.

[0027] (2) Enhance test case diversity and protocol compatibility, and improve vulnerability discovery depth

[0028] Existing fuzz testing methods based on genetic algorithms often use fixed mutation probabilities, which can easily lead to falling into local optimality or generating invalid protocol format data, resulting in insufficient test coverage. The present invention introduces a Logistic mapping function to guide mutation operations, and dynamically adjusts the mutation intensity according to the fitness of the population: a high mutation rate in the early stage enhances diversity, and a low mutation rate in the later stage improves convergence and avoids premature population maturation. Combined with the crossover operation of protocol format constraints, it ensures that the generated test cases not only comply with the protocol specifications but also have differentiated features. Comparative experiments show that this method has a 35% higher coverage of industrial control protocol boundary conditions and abnormal states than traditional genetic algorithms, effectively triggering deep protocol parsing vulnerabilities.

[0029] In summary, the method of the present invention solves the core problems of high redundancy, low coverage and poor convergence in industrial control fuzz testing through the closed loop of "protocol analysis-intelligent generation-fuzz testing", while reducing resource consumption while improving test efficiency. It provides a new efficient and lightweight approach for industrial control system security testing, and has important social value for ensuring the security of critical infrastructure. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0031] Figure 1 A flowchart of a method for generating Modbus protocol fuzzy test cases based on genetic algorithm and logical mapping provided by an embodiment of the present invention.

[0032] Figure 2 This is a general framework diagram of the Modbus protocol fuzzy test case generation method based on genetic algorithm and logical mapping provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described in detail and completely in conjunction with the drawings in the implementation of the present invention. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings can be arranged and designed using different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present invention.

[0034] The embodiment of the present invention provides a Modbus protocol fuzzy test case generation method based on genetic algorithm and logical mapping. The method aims to automatically generate test cases with wide coverage and diversity through the optimization capability of genetic algorithm and the flexibility of logical mapping, so as to improve test efficiency and quality, meet users' customized requirements for test cases, and solve the problems of low test case generation efficiency and limited coverage in the prior art.

[0035] The core of the method proposed in this embodiment of the present invention is to improve the efficiency and security of industrial control protocol data processing through in-depth analysis and application of the Modbus TCP protocol. Specifically, based on in-depth analysis of the Modbus TCP protocol, this embodiment of the present invention generates protocol fuzzy test cases using a genetic algorithm and logical mapping.

[0036] During the protocol analysis and research phase, we focused on a detailed analysis of the functional modules and data transmission of the Modbus TCP protocol. After an in-depth study of the standard format of the protocol, and on this basis, this embodiment formulated detailed field mutation rules to divide the original data into a variable part and a fixed part, so as to avoid the mutated data being directly discarded by the device under test, thereby improving the test efficiency. After entering the protocol fuzzy test case research phase, this embodiment conducted a comprehensive application exploration of the Modbus TCP protocol. In this embodiment, a genetic algorithm is used to generate fuzzy test cases, and at the same time, logical mapping is combined to implement the mutation operation of the genetic algorithm, thereby improving the efficiency and accuracy of test case generation. Through these processing means, this embodiment not only improves the data processing capabilities of the Modbus TCP protocol, but also enhances its data security and the efficiency of redundant processing.

[0037] See also Figure 1 In one embodiment, the method for generating Modbus protocol fuzzy test cases based on genetic algorithm and logic mapping provided by the embodiment of the present invention includes:

[0038] Step 1: Variable field division based on protocol structure analysis. By parsing the protocol format, key variable fields are extracted to narrow the scope of test case generation. That is, based on the Modbus protocol structure, the fields included in it are divided into variable fields.

[0039] Step 2: Based on the global optimization generation mechanism of the genetic algorithm, high-coverage test cases are dynamically generated through selection, crossover, and mutation operations. That is, according to the determined variable fields, the variable fields of the input Modbus protocol data are optimized and generated based on the genetic algorithm, and Modbus protocol fuzzy test cases are dynamically generated through selection, crossover, and mutation operations.

[0040] Step 3: Logistic mapping is introduced to guide the mutation operation to achieve population mutation and balance diversity and convergence.

[0041] The method proposed in the embodiment of the present invention first performs an in-depth analysis of the industrial control protocol, extracts variable fields and constructs an initial test case pool; secondly, it uses iterative optimization of the genetic algorithm and combines the Logistic function to dynamically adjust the mutation intensity to enhance the diversity of use cases and protocol compatibility; then, it uses similarity calculation to evaluate individual fitness, prioritizes use cases with significant differences and high probability of triggering anomalies, and suppresses the generation of redundant data. In specific implementation, in order to address the problem of high redundancy in the generated test cases in the fuzzy test of the industrial control protocol, a genetic algorithm is used to guide the generation of fuzzy test cases based on the variable fields of the divided industrial control protocol, and Logistic is used to complete the mutation operation in the genetic algorithm, so that the generated test cases are more optimized. At the same time, the similarity calculation idea is used to design the individual fitness value. Finally, the effectiveness of this method is analyzed through experimental comparison, as shown in the following example. Figure 2 shown.

[0042] In one embodiment, the Modbus protocol fuzzy test case generation method based on genetic algorithm and logical mapping provided by the embodiment of the present invention includes the following process:

[0043] (1) Extract variable fields in Modbus protocol data;

[0044] This determines which fields in the Modbus protocol are considered variable. Modbus protocol data consists of the MBAP protocol message header (message header) and the protocol data unit (PDU). The PDU includes a function code and data. The MBAP protocol message header includes a transaction identifier, a protocol identifier, a length unit, and a unit identifier. The protocol identifier and unit identifier are immutable, while the remaining fields are variable.

[0045] (2) Build an initial test case pool

[0046] When building the initial test case pool, the above variable fields are extracted and processed accordingly.

[0047] The initial test case composition actually collects Modbus protocol data through software acquisition, and then sets the variable and immutable parts before mutation, and then uses the subsequent genetic algorithm to generate fuzzy test cases.

[0048] (3) Generate fuzzy test cases based on genetic algorithm.

[0049] Genetic algorithms typically include encoding, adaptive function, selection, crossover, mutation, and other processes. In the embodiment of the present invention, the encoding, selection, crossover, and other steps are not specifically limited. However, in the mutation operation, the embodiment of the present invention introduces a logical mapping to guide how the test case is mutated.

[0050] (4) Similarity calculation is used to evaluate individual fitness.

[0051] To demonstrate the superiority of the resulting test case population, this example uses the average Hamming distance between individuals. The average Hamming distance measures the diversity of a population. A larger average Hamming distance indicates higher population diversity, while a smaller average Hamming distance indicates lower population diversity. A higher population diversity indicates a greater variety of test cases, and a greater chance of detecting vulnerabilities.

[0052] When generating fuzzy test cases based on a genetic algorithm, the embodiment of the present invention introduces a logical mapping to guide the specific processing process of how the test cases are mutated:

[0053] Logistic mapping is the most common type of chaotic mapping. It refers to a function or rule that maps input space to output space, which can produce chaotic phenomena. Chaotic phenomena refer to a system state that is extremely sensitive to initial conditions, with unpredictable long-term behavior but still maintains some inherent regularity. The corresponding mathematical model is the difference equation formula as follows:

[0054] x n+1 =f(x n , μ)=μx n (1-x n )

[0055] Where μ is the control parameter and n is the number of iterations. When 3.569946≤μ≤4, the Logistic map is in a chaotic state. The closer μ is to 4, the more obvious its pseudo-random distribution characteristics are. n , μ) represents the chaotic mapping function, x n Represents the input variable at the nth iteration, that is, the corresponding mapped object, x n+1 Represents the mapped object at the n+1th iteration. After a certain number of iterations of the Logistic mapping, a large number of chaotic points are distributed on the line segment (0,1), and the analytical expression of its probability density p(t) is:

[0056]

[0057] Where t represents the sampling point.

[0058] Chaotic variables The evolution formula is:

[0059]

[0060] C(x n+1 )=4C(x n ) i ·(1-C(x n ) i ) i=1,2,...,N

[0061] In the formula, C(x n ) i represents the i-th chaotic variable The value after the nth step of chaotic transformation, N represents the number of chaotic variables. and It will iterate within (0,1) and produce chaotic phenomena. The optimization variable x in the above formula is i ∈[a i ,n i ] can be combined with the chaotic variables through the following formula To perform a bidirectional mapping:

[0062]

[0063] Among them, x i , is the value obtained after the i-th chaotic variable is converted into a conventional optimization variable after chaotic mapping, a i ,b i Then they are x i The upper and lower limits of the value range.

[0064] Based on the above theory, the process of using logical mapping to perform genetic algorithm mutation operation in this embodiment is as follows:

[0065] In the mutation operation, a new mutation value is generated using the Logistic map. First, a random number between 0 and 1 is generated as the initial value of the Logistic map. Then, multiple iterations are performed to ensure chaotic behavior. Finally, the chaotic value generated by the most recent iteration is scaled to the range of 0-255 and the corresponding gene in the individual is replaced.

[0066] In this way, the chaotic map provides a new deterministic random source for the mutation operation, which helps the genetic algorithm maintain diversity and exploration ability during the search process.

[0067] When calculating the difference between individual fitness and average fitness, we are calculating the difference between average fitness and individual fitness. The corresponding expression is as follows:

[0068]

[0069] D f =fF i

[0070] Among them, f represents the tie fitness, F i represents individual fitness, D f It represents the difference between the average fitness and the individual fitness.

[0071] If the individual fitness is lower than the average fitness, its mutation probability is increased to increase the diversity in the search process. The updated mutation probability expression is:

[0072]

[0073] In the above formula, M′ and M are the mutation probabilities before and after the update, respectively.

[0074] Finally, the mutation operation uses the Logistic map to generate new gene values ​​for replacement, and the expression is:

[0075] X n+1 =r×x n ×(1-x n )

[0076] d n+1 =int(255×X n+1 )

[0077] In the above formula, x n represents the current iteration value, r represents the control parameter, X n+1 In the mutation operation, a random number between 0 and 1 is first generated as the initial value X0 of the Logistic map, and then the Logistic map is iterated multiple times to ensure its chaotic behavior, that is, X is calculated multiple times. n+1 Finally, the generated chaos value d n+1 Scale to the range of 0 to 255 and replace the corresponding gene in the individual.

[0078] In this embodiment of the present invention, to better express the diversity within a population, the Hamming distance is used to represent diversity. This means that the number of different characters between two strings (S1, S2) is calculated. By comparing the corresponding positions of the two strings character by character, the number of different characters between them can be calculated. The expression involved is as follows:

[0079]

[0080] Among them, S1 and S2 represent two strings of equal length, with length L. S1[i] and S2[i] represent the i-th character of the strings S1 and S2 respectively.

[0081] Based on the above expression, this embodiment calculates the average Hamming distance between all individuals in a population. First, the Hamming distance between each pair of individuals is calculated, and then these distances are added together. Next, the sum is divided by the number of pairs (i.e., the number of individual pairs) to obtain the average Hamming distance. The calculation process can be expressed as follows:

[0082]

[0083] Here, n represents the number of individuals.

[0084] The average Hamming distance is used to measure the diversity of a population. The larger the average Hamming distance, the higher the population diversity; the smaller the average Hamming distance, the lower the population diversity.

[0085] The purpose of the embodiment of the present invention is to address the problems of low test case generation efficiency, incomplete protocol state coverage, and insufficient exception triggering capability in the existing Modbus protocol fuzz testing, and to construct an intelligent test case generation method based on genetic algorithm and logical mapping. By integrating the mutation method of chaotic mapping with the directed evolution strategy of genetic algorithm, it is possible to achieve more targeted test case generation and effectively improve the depth of mining of industrial control system protocol vulnerabilities.

[0086] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0087] Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the technical features being referred to. Thus, a feature defined as "first," "second," etc., may explicitly or implicitly include at least one of the features.

[0088] Any process or method description described in this specification may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed in a different order than shown or discussed, including performing functions in a substantially simultaneous manner or in a reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0089] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0090] Note that, unless otherwise explicitly stated, all features disclosed in this specification may be replaced by alternative features for achieving the same, equivalent, or similar purposes. Therefore, unless explicitly stated otherwise, each feature disclosed is merely an example of a group of equivalent or similar features. Where used, further, preferably, further, and more preferably are simply the beginning of another embodiment based on the aforementioned embodiment, and the contents of the further, preferably, further, or more preferably following the aforementioned embodiment are combined with the aforementioned embodiment to form a complete composition of another embodiment. Several further, preferably, further, or more preferably settings following the same embodiment can be arbitrarily combined to form another embodiment.

[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

[0092] The above are only some embodiments of the present invention. For those skilled in the art, several modifications and improvements can be made without departing from the inventive concept of the present invention, which all fall within the scope of protection of the present invention.

Claims

1. A Modbus protocol fuzzy test case generation method based on genetic algorithm and logic mapping is characterized by: The following steps are involved: Step 1: Based on the Modbus protocol structure, the fields included therein are divided into variable fields; Step 2: Based on the determined variable fields, the variable fields of the input Modbus protocol data are iteratively optimized and generated based on the genetic algorithm, and Modbus protocol fuzzy test cases are dynamically generated through selection, crossover, and mutation operations; And in the mutation operation of each variable field, the mutation operation is guided by introducing Logistic mapping.

2. The method according to claim 1, wherein In step 1, the protocol identifier and unit identifier fields in the message header of the Modbus protocol are set as immutable fields, and the remaining fields are set as mutable fields.

3. The method according to claim 1, wherein In step 2, when the variable fields of the input Modbus protocol data are iteratively optimized and generated based on the genetic algorithm, the sum of the string similarities of all variable fields of the individual before and after the optimization generation is used as the individual fitness of the genetic algorithm.

4. The method according to claim 3, wherein The expression of individual fitness is: Among them, F i represents the individual fitness of individual i, S im () represents the similarity function, They represent the strings of the j-th variable field before and after optimization, and K represents the number of variable fields set.

5. The method according to claim 1, wherein In step 2, when the variable fields of the input Modbus protocol data are iteratively optimized and generated based on the genetic algorithm, the fitness of the individual is set to: the similarity between the encoding vectors of the individual before and after the optimization generation.

6. The method according to claim 1, wherein In step 2, during the mutation operation, the mutation probability is adjusted based on the difference between the individual fitness and the average fitness: D f =f-F i Among them, M′ and M are the mutation probabilities before and after the update, respectively, and D f Represents the average fitness f and individual fitness F i The subscript i is the individual number.

7. The method according to claim 1, wherein When the variable fields of the input Modbus protocol data are iteratively optimized and generated based on the genetic algorithm, the diversity of the population is characterized based on the average Hamming distance between all individuals in the current generation of the population, and the iterative convergence condition of the genetic algorithm is set based on the average Hamming distance.

8. The method according to claim 7, wherein When the average Hamming distance reaches a preset value, the iterative optimization generation based on the genetic algorithm is stopped.

9. The method according to claim 1, wherein The introduction of Logistic mapping guides the mutation operations, including: Generate a random number between 0 and 1 as the initial value of the Logistic map, and then perform multiple iterations of chaotic value generation based on the Logistic map; Scale the chaotic value generated by the last iteration to the range of 0-255 and replace the corresponding gene in the current variable field of the individual.

Images