An in-vehicle network protocol fuzzing method, platform, device and storage medium

Abstract

This invention discloses a fuzz testing method, platform, device, and storage medium for vehicular network protocols. These are corresponding solutions. The solutions utilize a large language model to automatically parse protocol semantics, enabling intelligent generation of test cases, reducing reliance on manual protocol analysis, and improving testing efficiency and coverage. Furthermore, semantically aware mutation strategies enhance test case quality and improve the ability to discover deep protocol logic vulnerabilities. In addition, protocol parsing, test case generation, test execution, and result analysis are integrated into a single design, achieving automated and closed-loop management of the testing process, thus improving the overall performance and practicality of vehicular network protocol security testing.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, platform, device and storage medium for fuzz testing of vehicle network protocols. Background Technology

[0002] With the rapid development of information technology and the widespread application of the Industrial Internet, network protocols play a core role in the interconnection of smart devices, industrial control systems, and the Internet of Things (IoT) environment. Especially in industrial IoT and smart manufacturing scenarios, network protocols such as MQTT and Modbus are widely used for device communication and data transmission, and their security directly affects the stable operation of the system and data security. If vulnerabilities exist in the protocol implementation, it may lead to serious consequences such as system attacks, data leaks, or even production interruptions. Therefore, the security issues of network protocols are gradually receiving increasing attention.

[0003] Researchers have conducted studies on network protocol security from multiple perspectives. Common security enhancement techniques include protocol hardening, intrusion detection, and fuzzing.

[0004] Protocol hardening primarily enhances data transmission security and prevents unauthorized access and data tampering by encrypting and authenticating the communication process. Intrusion detection technology monitors network traffic and system behavior to identify abnormal communication patterns, thereby uncovering potential attacks. Intrusion detection methods can be categorized based on their implementation, including feature-based methods, statistical analysis-based methods, and machine learning-based methods.

[0005] Compared to the methods mentioned above, fuzzing is widely used for network protocol vulnerability discovery because it does not rely on the internal implementation details of the protocol, has a high degree of automation, and requires fewer resources. Traditional network protocol fuzzing methods typically rely on manual analysis of the protocol format and the construction of test cases based on existing communication data, generating test inputs through random or simple mutation methods. However, this type of method has significant shortcomings: first, it requires a high level of expertise from the testers, necessitating a deep understanding of the protocol structure; second, the quality of test cases is limited by existing data, resulting in limited coverage; and third, the mutation strategy lacks semantic guidance, making it difficult to trigger deep protocol logic vulnerabilities.

[0006] In recent years, large language models have demonstrated strong capabilities in natural language understanding and structured information generation, providing a new technical approach for automated testing of network protocols. By utilizing large language models to semantically parse protocol specifications, protocol state information and data structures can be automatically extracted, and test cases conforming to the protocol semantics can be generated, thereby reducing the need for manual intervention and improving testing efficiency. However, currently, there is a lack of a complete platform for systematically applying the capabilities of large language models to fuzz testing of network protocols, and a closed-loop system from protocol parsing, test case generation, intelligent mutation to test execution and result analysis has not yet been formed.

[0007] Building upon the proposed automated testing methods, a unified platform is also needed to manage and verify the testing process. Currently, network protocol testing largely relies on fragmented tools, lacking a standardized and integrated testing environment, making it difficult to automate the testing process and achieve unified analysis of results.

[0008] Therefore, in summary, there is an urgent need to propose a network protocol fuzzing test scheme based on a large language model, which integrates protocol parsing, test case generation, fuzzing execution, and result analysis to achieve low-threshold and high-efficiency network protocol security testing.

[0009] In view of this, the present invention is hereby proposed. Summary of the Invention

[0010] The purpose of this invention is to provide a method, platform, device, and storage medium for fuzz testing of vehicle network protocols. It integrates protocol parsing, test case generation, fuzz test execution, and result analysis into a single design, enabling low-threshold and high-efficiency security testing of vehicle network protocols.

[0011] The objective of this invention is achieved through the following technical solution: A method for fuzz testing of vehicular network protocols includes: Semantic parsing of the target network protocol specification is performed based on a large language model to construct a protocol state machine; wherein, the target network protocol is the vehicular network protocol in the protocol system under test. The protocol state machine is used to automatically generate initial test case seeds; Based on the large language model, semantically aware mutation operations are performed on the initial test case seeds to construct a test case set; Input the test cases from the test case set into the protocol system under test and execute the automated fuzz testing process; Perform statistical analysis on the execution results obtained during automated fuzz testing, and evaluate the test coverage and abnormal behavior.

[0012] A fuzz testing platform for vehicular network protocols, used to implement the aforementioned method, includes: The protocol parsing module is used to perform semantic parsing of the target network protocol specification based on a large language model and construct a protocol state machine; wherein, the target network protocol is the vehicle network protocol in the protocol system under test. The test case generation module is used to automatically generate initial test case seeds using the protocol state machine; The intelligent mutation module is used to perform semantically aware mutation operations on the initial test case seed based on the large language model to build a test case set; The fuzz test execution module is used to input test cases from the test case set into the protocol system under test and execute the automated fuzz test process. The results analysis module is used to perform statistical analysis on the execution results obtained during automated fuzz testing, and to evaluate the test coverage and abnormal behavior.

[0013] A processing device includes: one or more processors; and a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the aforementioned method.

[0014] A readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned method.

[0015] As can be seen from the technical solutions provided by the present invention above, (1) the large language model is used to automatically parse the protocol semantics, realize the intelligent generation of test cases, reduce the dependence on manual protocol analysis, and improve test efficiency and coverage; (2) the quality of test cases is improved by semantic awareness mutation strategy, and the ability to discover deep protocol logic vulnerabilities is enhanced; (3) the protocol parsing, test case generation, test execution and result analysis are integrated into a design, realize the automation and closed-loop management of the test process, and improve the overall performance and practicality of vehicle network protocol security testing. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the overall process of a fuzzy testing method for vehicle network protocols provided in an embodiment of the present invention.

[0018] Figure 2 This is a detailed flowchart illustrating a fuzzy testing method for vehicle network protocols provided in an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of a vehicle network protocol fuzzy testing platform provided in an embodiment of the present invention.

[0020] Figure 4 This is a schematic diagram of a processing device provided in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0022] First, the following explanations are provided for the terms that may be used in this article: The terms "comprising," "including," "containing," "having," or other similar semantic descriptions should be interpreted as non-exclusive inclusion. For example, including a technical feature element (such as raw material, component, ingredient, carrier, dosage form, material, size, part, component, mechanism, device, step, process, method, reaction conditions, processing conditions, parameter, algorithm, signal, data, product or article of manufacture, etc.) should be interpreted as including not only the expressly listed technical feature element, but also other technical feature elements that are not expressly listed and are well-known in the art.

[0023] The term "composed of" excludes any technical features not expressly listed. When used in a claim, it closes the claim to exclude all technical features other than those expressly listed, except for associated conventional impurities. If the term appears only in a clause of a claim, it limits the claim to the elements expressly listed in that clause; elements recited in other clauses are not excluded from the overall claim.

[0024] The following provides a detailed description of a fuzzy testing method, platform, device, and storage medium for vehicle network protocols provided by this invention. Contents not described in detail in the embodiments of this invention are prior art known to those skilled in the art. Unless otherwise specified in the embodiments of this invention, conditions are performed according to conventional conditions in the art or conditions recommended by the manufacturer. Instruments used in the embodiments of this invention, unless otherwise specified by the manufacturer, are all commercially available conventional products.

[0025] Example 1 like Figure 1 The diagram shown is a flowchart of a fuzzy testing method for a vehicle network protocol provided by an embodiment of the present invention, which mainly includes the following steps: Step 1: Perform semantic parsing of the target network protocol specification based on the large language model and construct the protocol state machine.

[0026] The preferred implementation method for this step is as follows: (1) The protocol control fields, data structures, and communication processes are parsed using a large language model. In this embodiment of the invention, the target network protocol is the vehicle network protocol in the protocol system under test.

[0027] (2) Construct an initial protocol state machine based on the parsing results, including the protocol states and transition relationships.

[0028] (3) By prompting the engineering to guide the large language model to complete the protocol state and abnormal state path, a complete protocol state machine is obtained.

[0029] (4) Convert the complete protocol state machine into a structured representation.

[0030] Step 2: Use the protocol state machine to automatically generate initial test case seeds.

[0031] The preferred implementation method for this step is as follows: (1) Generate initial test cases that conform to the target network protocol specifications based on the protocol state machine.

[0032] (2) Construct diverse test sequences based on different state paths in the protocol state machine, with each test sequence serving as a test case.

[0033] (3) Perform format validation on the generated test cases.

[0034] (4) Based on the state path of each test case, the test cases are named, stored in the form of seed files and classified and managed. Each test case that passes the format verification is stored in a single seed file to form the initial test case seed.

[0035] Step 3: Perform semantically aware mutation operations on the initial test case seeds based on the large language model to construct the test case set.

[0036] The preferred implementation method for this step is as follows: (1) Use a large language model to perform semantic analysis on test cases and select mutation strategies; the mutation strategies include random byte mutation, field length tampering, function code replacement and illegal state insertion.

[0037] (2) Use the selected mutation strategy to process the key fields and generate mutated test cases; among them, the key fields mainly include: identification and addressing fields, length fields, control fields, sequence and session fields, and payload structure, etc.

[0038] Step 4: Input the test cases from the test case set into the protocol system under test and execute the automated fuzz testing process.

[0039] The preferred implementation method for this step is as follows: (1) Start the protocol system under test and establish a communication connection with it.

[0040] (2) Input the test cases from the test case set into the protocol system under test.

[0041] (3) Listen to the response of the protocol system under test and record the returned data.

[0042] (4) Determine whether an abnormal or erroneous behavior is triggered based on the returned data.

[0043] Step 5: Perform statistical analysis on the execution results obtained during the automated fuzzing process, and evaluate the test coverage and abnormal behavior.

[0044] The preferred implementation method for this step is as follows: (1) Statistically analyze the code paths and branches triggered during the test, and calculate the branch coverage.

[0045] (2) Count the number of protocol states and the number of state transitions, and calculate the state coverage rate.

[0046] (3) Classify and label abnormal behaviors.

[0047] (4) Evaluate the test coverage effect based on branch coverage and state coverage, and evaluate the abnormal behavior based on the abnormal behavior classification and labeling results.

[0048] Preferably, the test results are integrated and a test report is automatically generated. The steps are as follows: Based on the branch coverage and state coverage, as well as the abnormal behavior classification and marking results, a test report containing coverage indicators, abnormal information and vulnerability analysis is generated; and the protocol security assessment results and improvement suggestions are inserted into the test report.

[0049] The above-mentioned solutions provided by the embodiments of the present invention have the following advantages: (1) Automatic parsing of protocol semantics using a large language model to realize intelligent generation of test cases, reduce reliance on manual protocol analysis, and improve test efficiency and coverage; (2) Improve the quality of test cases through semantic awareness mutation strategy and enhance the ability to discover deep protocol logic vulnerabilities; (3) Integrate protocol parsing, test case generation, test execution and result analysis into a unified design to realize automated test process and closed-loop management, thereby improving the overall performance and practicality of vehicle network protocol security testing.

[0050] To more clearly demonstrate the technical solution and its effects provided by the present invention, the method provided by the embodiments of the present invention will be described in detail below with reference to specific examples.

[0051] I. Overall Overview of the Plan

[0052] This invention provides a fuzzy testing method for vehicular network protocols. Developed based on general-purpose computing devices and operating system environments, the method stores test data and results in a unified database and implements human-computer interaction and test control through a visual interface. The entire solution mainly includes the following components: Protocol parsing: Based on the large language model, the input protocol specification is processed. Upon receiving the protocol description information, the format of the input content is first validated. If the format does not meet the requirements, an error is prompted and the parsing is terminated. If the format is correct, the control fields, data structures and communication process information in the protocol are further extracted, and the protocol state machine is constructed.

[0053] Test case generation: Initial test case seeds are automatically generated based on the protocol state machine. During the generation process, test sequences are constructed according to different state paths, and the test cases are format-validated to ensure they conform to the protocol specifications. They are then stored as seed files and categorized according to state paths.

[0054] Intelligent mutation: This feature expands upon initial test cases by invoking a large language model to perform semantic analysis and select appropriate mutation strategies. These strategies include random byte mutation, field length modification, function code replacement, and illegal state insertion. Boundary value expansion and outlier construction are performed on critical fields to generate diverse test cases, thereby improving test coverage.

[0055] Fuzz testing execution: The generated test cases are input into the protocol system under test. After establishing a communication connection, test data is sent sequentially, and the system response results are monitored in real time. The returned data is used to determine whether any abnormal behavior is triggered, and relevant test information is recorded.

[0056] Results Analysis: Statistical analysis is performed on the data acquired during the testing process, including code path coverage, the number of protocol states, and the number of state transitions. Abnormal behaviors are categorized and marked. Finally, a test report is generated based on the analysis results, outputting the protocol security assessment results and improvement suggestions.

[0057] II. Detailed introduction of the plan.

[0058] like Figure 2 The diagram shows the overall process of this solution.

[0059] 1. Protocol parsing.

[0060] The main process is as follows: (1.1) Use a large language model to parse the protocol control fields, data structures and communication processes.

[0061] (1.2) Construct a protocol finite state machine model based on the analysis results, including each state and its transition relationship.

[0062] (1.3) Obtain complete protocol state information and abnormal state paths through prompts and guidance, and obtain the complete protocol state machine.

[0063] (1.4) Output structured state transition information for subsequent test processing.

[0064] 2. Test case generation.

[0065] The main process is as follows: (2.1) Generate initial test cases that conform to the protocol specifications based on the protocol state machine.

[0066] (2.2) Construct diverse test sequences based on different state paths, with each test sequence serving as a test case.

[0067] (2.3) Perform format validation on the generated test cases.

[0068] (2.4) Store test cases in seed files and classify them for management.

[0069] 3. Intelligent mutation.

[0070] (3.1) Use a large language model to perform semantic analysis on test cases.

[0071] (3.2) Select an appropriate mutation strategy based on the analysis results. The mutation strategy includes random byte mutation, field length tampering, function code replacement and illegal state insertion.

[0072] (3.3) Use selected mutation strategies to process key fields (e.g., boundary value expansion and outlier construction) to generate diverse test cases.

[0073] 4. Perform fuzz testing.

[0074] (4.1) Start the server of the protocol system under test and establish a communication connection.

[0075] (4.2) Input the test cases into the protocol system under test in sequence.

[0076] (4.3) Listen to the response of the protocol system under test and record the returned data.

[0077] (4.4) Determine whether an abnormal or erroneous behavior is triggered based on the returned data.

[0078] 5. Results analysis and test report generation.

[0079] (5.1) Results analysis, namely, monitoring and analyzing state coverage and code coverage during the testing process: (5.1.1) Statistically analyze the code paths and branches triggered during the test, and calculate the branch coverage.

[0080] (5.1.2) Record the number of protocol states and the number of state transitions, and calculate the state coverage.

[0081] (5.1.3) Classify and label abnormal behaviors.

[0082] (5.1.4) Evaluate the effectiveness of fuzz testing based on coverage metrics.

[0083] (5.2) Test report output, i.e., integrating test results and automatically generating a test report: (5.2.1) Conduct a comprehensive analysis of the test results.

[0084] (5.2.2) Generate a test report that includes coverage metrics, anomaly information and vulnerability analysis.

[0085] (5.2.3) Output protocol security assessment results and improvement suggestions.

[0086] Through the above description of the embodiments, those skilled in the art can clearly understand that the above embodiments can be implemented by software, or by using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions of the above embodiments can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.), including several instructions to cause a computer device (such as a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0087] Example 2 This invention also provides a vehicle network protocol fuzzy testing platform, which is mainly used to implement the methods provided in the foregoing embodiments, such as... Figure 3 As shown, the system mainly includes: The protocol parsing module is used to perform semantic parsing of the target network protocol specification based on a large language model and construct a protocol state machine; wherein, the target network protocol is the vehicle network protocol in the protocol system under test. The test case generation module is used to automatically generate initial test case seeds using the protocol state machine; The intelligent mutation module is used to perform semantically aware mutation operations on the initial test case seed based on the large language model to build a test case set; The fuzz test execution module is used to input test cases from the test case set into the protocol system under test and execute the automated fuzz test process. The results analysis module is used to perform statistical analysis on the execution results obtained during automated fuzz testing, and to evaluate the test coverage and abnormal behavior.

[0088] The platform provided in this embodiment of the invention is developed based on a general computing device and operating system environment. Test data and result information are uniformly stored in a database (data storage module), and human-computer interaction and test control are realized through a visual interface.

[0089] Those skilled in the art will understand that, for the sake of convenience and brevity, the above-described division of functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the platform can be divided into different functional modules to complete all or part of the functions described above.

[0090] Example 3 The present invention also provides a processing device, such as Figure 4 As shown, it mainly includes: one or more processors; a memory for storing one or more programs; wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in the foregoing embodiments.

[0091] Furthermore, the processing device also includes at least one input device and at least one output device; in the processing device, the processor, memory, input device, and output device are connected via a bus.

[0092] In this embodiment of the invention, the specific types of the memory, input device, and output device are not limited; for example: Input devices can be touchscreens, image acquisition devices, physical buttons, or mice, etc. The output device can be a display terminal; The memory can be random access memory (RAM) or non-volatile memory, such as disk storage.

[0093] Example 4 The present invention also provides a readable storage medium storing a computer program that, when executed by a processor, implements the method provided in the foregoing embodiments.

[0094] In this embodiment of the invention, the readable storage medium is a computer-readable storage medium and can be disposed in the aforementioned processing device, for example, as a memory in the processing device. Furthermore, the readable storage medium can also be any medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), magnetic disk, or optical disk.

[0095] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims. The information disclosed in the background section is intended only to enhance the understanding of the overall background technology of the present invention and should not be construed as an admission or implication in any way that such information constitutes prior art known to those skilled in the art.

Claims

1. A fuzzy testing method for vehicular network protocols, characterized in that, include: Semantic parsing of the target network protocol specification is performed based on a large language model to construct a protocol state machine; wherein, the target network protocol is the vehicular network protocol in the protocol system under test. The protocol state machine is used to automatically generate initial test case seeds; Based on the large language model, semantically aware mutation operations are performed on the initial test case seeds to construct a test case set; Input the test cases from the test case set into the protocol system under test and execute the automated fuzz testing process; Perform statistical analysis on the execution results obtained during automated fuzz testing, and evaluate the test coverage and abnormal behavior.

2. The fuzzy testing method for vehicular network protocols according to claim 1, characterized in that, The step of semantically parsing the target network protocol specification based on a large language model and constructing the protocol state machine includes: Utilize a large language model to parse protocol control fields, data structures, and communication processes; An initial protocol state machine is constructed based on the parsing results, including the states of each protocol and their transition relationships; By prompting the engineering guide to complete the protocol state and abnormal state paths of the large language model, a complete protocol state machine is obtained; Convert the complete protocol state machine into a structured representation.

3. The fuzzy testing method for vehicular network protocols according to claim 1, characterized in that, The automatic generation of initial test case seeds using the protocol state machine includes: Generate initial test cases that conform to the target network protocol specifications based on the protocol state machine; Diverse test sequences are constructed based on different state paths in the protocol state machine, and each test sequence is used as a test case. Perform format validation on the generated test cases; Based on the state path of each test case, the test cases are named, stored in the form of seed files, and categorized for management. Each test case that passes the format validation is stored in a single seed file, forming the initial test case seed.

4. The fuzzy testing method for vehicular network protocols according to claim 1, characterized in that, The semantically aware mutation operation of the initial test case seed based on the large language model includes: A large language model is used to perform semantic analysis on test cases and select mutation strategies; the mutation strategies include random byte mutation, field length tampering, function code replacement, and illegal state insertion. The selected mutation strategy is used to process the key fields and generate mutated test cases; the key fields mainly include: identification and addressing fields, length fields, control fields, sequence and session fields, and payload structure.

5. The fuzzy testing method for vehicular network protocols according to claim 1, characterized in that, The process of inputting test cases from the test case set into the protocol system under test and performing automated fuzz testing includes: Start the protocol system under test and establish a communication connection with it; Input the test cases from the test case set into the protocol system under test; Monitor the response from the protocol under test and record the returned data; Determine whether an abnormal or erroneous behavior has been triggered based on the returned data.

6. The fuzzy testing method for vehicular network protocols according to claim 1, characterized in that, The statistical analysis of the execution results obtained during automated fuzzing, and the evaluation of test coverage and abnormal behavior, include: The system tracks and counts the number of code paths and branches triggered during testing, and calculates the branch coverage rate. The number of protocol states and the number of state transitions are counted, and the state coverage rate is calculated. Classify and label abnormal behaviors; The test coverage effect is evaluated based on branch coverage and state coverage, and the abnormal behavior situation is evaluated based on the abnormal behavior classification and labeling results.

7. The fuzzy testing method for vehicular network protocols according to claim 6, characterized in that, The method also includes: integrating test results and automatically generating a test report, with the following steps: Based on branch coverage, state coverage, and abnormal behavior classification results, a test report is generated that includes coverage metrics, anomaly information, and vulnerability analysis. Furthermore, the test report includes the protocol security assessment results and improvement suggestions.

8. A fuzzy testing platform for vehicle network protocols, characterized in that, To implement the method according to any one of claims 1 to 7, comprising: The protocol parsing module is used to perform semantic parsing of the target network protocol specification based on a large language model and construct a protocol state machine; wherein, the target network protocol is the vehicle network protocol in the protocol system under test. The test case generation module is used to automatically generate initial test case seeds using the protocol state machine; The intelligent mutation module is used to perform semantically aware mutation operations on the initial test case seed based on the large language model to build a test case set; The fuzz test execution module is used to input test cases from the test case set into the protocol system under test and execute the automated fuzz test process. The results analysis module is used to perform statistical analysis on the execution results obtained during automated fuzz testing, and to evaluate the test coverage and abnormal behavior.

9. A processing device, characterized in that, include: One or more processors; Memory, used to store one or more programs; Wherein, when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method as described in any one of claims 1 to 7.

10. A readable storage medium storing a computer program, characterized in that, When a computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.

Images