A vulnerability mining method based on an improved generative adversarial network framework

Abstract

The invention discloses a vulnerability mining method based on an improved generative adversarial network framework, proposes an improved generative adversarial network model framework, solves the problems of poor training effect of objective function in the test case generation process and mode collapse in the model training process; then, in view of the problem that the feedback information obtained by a generator network from a discriminator network during the training process is insufficient, resulting in too slow convergence speed and insufficient quality of generated test cases, the model can complete convergence faster and obtain test cases with higher quality; finally, a vulnerability mining system based on the Modbus‑TCP protocol is designed and implemented, and fuzzy testing experiments are carried out in a simulation environment and a real industrial environment; the invention improves the acceptance rate of test cases, can trigger various anomalies of a tested target, and discovers vulnerabilities of the Modbus‑TCP protocol, thereby solving the problems of low acceptance rate and low vulnerability mining capability existing in traditional vulnerability mining methods.

Description

Technical Field

[0001] The present invention relates to the field of network security of industrial control systems, and in particular to a test case generation method based on an improved generative adversarial network framework and a vulnerability mining method based on the Modbus-TCP protocol. Background Art

[0002] Industrial control systems are widely used in infrastructure industries that affect people's lives, such as electricity, oil, steel, and rail transit. While promoting industrial upgrading and accelerating transformation in traditional industries, social productivity has been rapidly improved. The production and operation processes of the manufacturing industry will be automated and controlled through information technology, while also forcing itself to interact more frequently with the outside world, causing the originally relatively closed environment to gradually increase its "exposure" surface, resulting in a significant increase in the security risks it faces.

[0003] Faced with the increasingly severe external environment of the industrial control industry, finding an effective solution to improve the system's defense capabilities is one of the current research hotspots. Vulnerability mining technology is a detection technology for unknown vulnerabilities and a key technology for detecting whether there are vulnerabilities in industrial control systems. How to use vulnerability mining technology to discover vulnerabilities in industrial control systems has become one of the research hotspots in recent years.

[0004] The vulnerability mining methods of traditional information systems are mainly divided into three types: white box method, gray box method and black box method. The black box method refers to the vulnerability mining without knowing the target at all, and the typical representative is fuzz testing technology. Due to the generally high privacy of industrial control systems, fuzz testing technology is widely used in the field of industrial system security. In recent years, there has been some progress in the research on vulnerability mining technology at home and abroad, but the problem of low acceptance rate and low vulnerability mining rate has appeared in the process of applying the test case construction method of industrial control protocol to vulnerability mining experiments. As we know, how to construct a large number of effective test cases has become one of the research hotspots in the field of industrial control security, and it has also become one of the research points that need to be improved in the development of vulnerability mining technology. Summary of the invention

[0005] In order to solve the above problems, a vulnerability mining method based on an improved generative adversarial network framework is proposed. This method takes the Modbus-TCP protocol as the research object. Through the generator model of this framework, a large number of test cases can be generated for vulnerability mining experiments. The experiments show that this method can not only monitor the running status of the object under test in real time, but also improve the acceptance rate of test cases and vulnerability mining capabilities.

[0006] In order to verify the usability and practicality of the present invention, the implementation scheme adopted by the present invention includes the following steps:

[0007] 1) Test case generation: The generator model based on the dynamic feedback learning mechanism is used for adversarial training to generate test cases for the Modbus-TCP protocol;

[0008] 2) Exception monitoring and processing: Send the generated test cases to the test target and monitor the running status of the target at the same time, record and store exceptions and handle the abnormal status of the target.

[0009] 3) Vulnerability mining and discovery: For the sent test cases, determine whether there are any exceptions based on the response status, and analyze the message pair files stored in the exception monitoring phase to find out the triggered vulnerabilities.

[0010] In the test case generation phase, the influence of irrelevant information on model training is reduced, and the training data set delivered to the discriminator model is the protocol data unit part of the Modbus-TCP protocol message; in addition, the model's training data set is obtained by using a traffic capture tool to capture the original Modbus-TCP protocol traffic messages directly from a real industrial environment. Moreover, each message sequence will be preprocessed before entering the model, and a start tag and an end tag will be inserted at the head and tail of each sequence respectively.

[0011] The generator model in the test case generation phase mentioned above contains two modules, one is the feature conversion module and the other is the text generation module. The text generation module can use real samples to perform pre-training operations with correct label supervision before the system as a whole starts training, while the feature conversion module converts the high-order feature vector extracted by the discriminator model into a latent factor vector. The latent factor vector will determine the distribution of the next character together with the text generation network after the dimensional transformation of the linear transformation layer.

[0012] The improved generative adversarial network framework consists of two parts: a generator model and a discriminator model. A long short-term memory neural network is used as the generator of the framework, and a convolutional neural network is used as the discriminator of the framework. The discriminator model uses the advantages of convolutional neural network feature extraction to map the input character sequence to a high-order feature space, and feeds these feature vectors back to the generator model to better guide the optimization of the generator model parameters. The gradient descent algorithm can complete the training of the generator network end-to-end.

[0013] The abnormal monitoring stage is to send the test case to the test target, monitor the response status of the test target and compare the captured request / response message pairs to determine whether the test target has any abnormal phenomenon.

[0014] The vulnerability mining stage is to analyze the test cases and response messages that trigger the exceptions when an exception occurs in the target under test. If there is no response, it is necessary to send a heartbeat packet to determine whether the test case is rejected or the test target is attacked and hangs or crashes.

[0015] The present invention proposes an improved vulnerability mining method for a generative adversarial network model. By improving the model structure of the GAN model and adding a dynamic feedback learning mechanism, the generator model can feedback a larger amount of high-order feature information of real samples, increase the frequency of information interaction between the discriminator network and the generator network, and jointly guide the generation effect of test cases through adversarial training between the two. By generating a large number of test cases through the improved generator model, when conducting vulnerability mining experiments, not only the diversity of samples is increased, the acceptance rate is improved, but most importantly, the vulnerability mining ability is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the overall research idea of ​​the vulnerability mining method in the present invention.

[0017] Figure 2 It is a schematic diagram of preprocessing the training data set input into the model in the present invention.

[0018] Figure 3 It is a schematic diagram of the improved generative adversarial network framework structure in the present invention.

[0019] Figure 4 It is a schematic diagram of the abnormal monitoring and capture execution flow in the present invention. Specific implementation plan

[0020] The present invention will be described in detail below with reference to the specific embodiments shown in the accompanying drawings.

[0021] Figure 1 It is a schematic diagram of the overall research idea of ​​the vulnerability mining method in the present invention, which is divided into two stages: test case generation and exception monitoring and capture.

[0022] In the test case generation phase, the first step is to capture the training data set required by the model. In the present invention, this is achieved by building a simulated Modbus-TCP protocol communication environment, and then preprocessing these original traffic data sets. Then, in view of the problems of mode collapse and other problems existing in the generative adversarial network model itself, an improved generative adversarial network framework is proposed; then, in view of the problem of insufficient feedback information obtained by the discriminator model, a dynamic feedback optimization method is proposed to achieve the goal of efficiently generating high-quality test cases.

[0023] In the abnormal monitoring and capture phase, the test cases generated by the improved generative adversarial network test case generation method proposed in the test case generation phase through adversarial training are sent to the test target through the network data packet sending tool, and the state of the test target is monitored at all times to observe whether the test target has abnormalities, such as crashes and response abnormalities. If an abnormality occurs, the capture operation must be performed in real time to analyze the cause of the abnormality and whether the abnormality triggers a vulnerability.

[0024] Figure 2 This is a schematic diagram of preprocessing the training data set input into the model in the present invention, and the steps are as follows:

[0025] (1) The Modbus-TCP protocol message is composed of hexadecimal values, and the model can only accept digital input, so the function code field and the data field need to be converted into decimal values ​​first. The hexadecimal value range of one digit is 0x0~0xF, and the corresponding decimal data value range is 0~15.

[0026] (2) During the training and learning process of the model, the dimensional size of the input and output is immutable. Since the byte length of the PDU part of the protocol message varies due to different function codes, the longest PDU sequence is selected as the input sequence length of the model, and zeros are added to the insufficient length.

[0027] (3) In order to distinguish whether the 0 at the end of the sequence is added due to the insufficient length or the value of the data field, before the 0-padding operation is performed, the start marker STA (start) and the end marker END (end) should be inserted at the head and tail of each sequence respectively.

[0028] Figure 3 It is a schematic diagram of the improved generative adversarial network framework structure in the present invention, which is divided into two parts: the discriminator network and the generator network.

[0029] The discriminator network uses a convolutional neural network to extract high-order features from real samples and generated samples. On the one hand, the extracted feature vectors are sent to the classifier for true or false judgment; on the other hand, they are fed back to the generator network to guide the training direction of the generator network.

[0030] In order to converge faster, the generator network will be pre-trained and real samples will be input into it to guide the direction of parameter optimization.

[0031] During adversarial training, the input of the generator network is Gaussian distributed noise, and samples are generated through the sample generation network module. In order to enable the generator to obtain more feedback information to guide training, the sample high-order feature vector fed back by the generator is received and converted into a latent factor vector through the sample conversion vector, which is transmitted to the adoption layer to jointly determine the output of the next character.

[0032] The test cases generated by the generator network are input into the discriminator network, and the true or false is judged by the feature extraction network layer, and the output of the next character in the generator network is affected by the extracted high-order feature vector. The discriminator network and the generator network compete with each other and conduct adversarial training, and finally reach a Nash equilibrium.

[0033] Figure 4 This is a schematic diagram of the abnormal monitoring and capture execution process in the present invention, and the steps are as follows:

[0034] (1) By calling the data communication module to build a Modbus-TCP communication environment, the client (master station) sends the test case to the server (slave station) to start the vulnerability mining experiment.

[0035] (2) Each time a test case is sent to the test target, it is necessary to determine whether a response message is returned. If a response is received, the request / response message is compared and analyzed.

[0036] (3) Compare and analyze the messages according to the Modbus-TCP protocol, and determine whether the Transaction ID, Protocol ID, Length Field, and Unit ID of the request and the corresponding message are equal. If they are not equal, the response is abnormal. If they are equal, continue to compare and analyze.

[0037] (4) Then determine whether the Function code fields of the two are equal. If not, determine whether the response FC is equal to the request FC + 0x80. If so and EC is also a Modbus exception code, then determine that it is abnormal. Otherwise, the response message is abnormal.

[0038] (5) If the Function code fields of the request and response messages are also equal, the data field values ​​of the two are compared to determine whether they comply with the protocol specifications. If they comply, the response is normal; if not, the response is abnormal.

[0039] (6) If there is no response when sending a test case to the test target and no corresponding response message is returned, it is necessary to determine whether the test case is rejected by the test target or triggers an exception in the test target.

[0040] (7) In the present invention, the reason for the unresponsiveness is analyzed by sending a heartbeat packet. If there are multiple unresponsiveness cases in the test cases in the heartbeat packet, it means that the test case causes the test target to crash, otherwise it means that the test case is rejected.

[0041] (8) Perform storage analysis on the test cases that trigger the exceptions to identify the vulnerabilities.

Claims

1. A vulnerability mining method based on an improved generative adversarial network framework, the research object of which is the industrial control protocol - Modbus-TCP protocol, characterized in that: The method comprises the following steps: 1) Test case generation phase: First, build a test case generator model, then capture the original communication traffic of the Modbus-TCP protocol, perform preprocessing operations, and use it as a training data set. Input it into the discriminator model, perform adversarial training, and generate test cases. The test case generation phase includes two steps: building a generative adversarial network framework and building a test case generation method based on a dynamic feedback learning mechanism. The discriminator model uses a convolutional neural network to extract high-order features from real samples and generated samples. The extracted feature vectors are sent to the classifier for true or false judgment, and are fed back to the generator model to guide the training direction of the generator model. During adversarial training, the input of the generator model is Gaussian noise, and samples are generated through the sample generation network module. In order to enable the generator to obtain more feedback information to guide training, the sample high-order feature vector fed back by the generator is received and converted into a latent factor vector through the sample conversion vector, which is then transmitted to the adoption layer to jointly determine the output of the next character. The test cases generated by the generator model are input into the discriminator model, and the authenticity is judged through the feature extraction network layer, and the output of the next character in the generator model is affected by the extracted high-order feature vector; the discriminator model and the generator model compete with each other and conduct adversarial training, and finally reach a Nash equilibrium; The test case generator model consists of two modules: a feature conversion module and a text generation module. Before the system starts training, the text generation module uses real samples to perform pre-training with correct label supervision, while the feature conversion module converts the high-order feature vector extracted by the discriminator model into a latent factor vector. The latent factor vector is transformed by the linear transformation layer and determines the distribution of the next character together with the text generation network. 2) Exception monitoring and capture stage: (1) The Modbus-TCP communication environment is constructed by calling the data communication module. The client sends the test case to the server and starts the vulnerability mining experiment. (2) Each time a test case is sent to the test target, it is necessary to determine whether a response message is returned. If a response is received, the request / response message is compared and analyzed; (3) Compare and analyze the messages according to the Modbus-TCP protocol, and determine whether the Transaction ID, Protocol ID, Length Field, and Unit ID of the request and the corresponding message are equal. If they are not equal, the response is abnormal. If they are equal, the comparison and analysis continues. (4) Then determine whether the Function code fields of the two are equal. If not, determine whether the response FC is equal to the request FC + 0x80. If so and EC is also a Modbus exception code, then determine that it is abnormal. Otherwise, the response message is abnormal. (5) If the Function code fields of the request and response messages are also equal, the data field values ​​of the two are compared to determine whether they comply with the protocol specifications. If they do, the response is normal; if not, the response is abnormal. (6) If there is no response when sending a test case to the test target, and no corresponding response message is returned, it is necessary to determine whether the test case is rejected by the test target or triggers an exception in the test target; (7) Analyze the cause of the no response by sending a heartbeat packet. If there are multiple no responses in the test cases in the heartbeat packet, it means that the test case causes the test target to crash. Otherwise, it means that the test case is rejected. (8) Perform storage analysis on the test cases that trigger the exceptions to identify the vulnerabilities.

2. A vulnerability mining method based on an improved generative adversarial network framework according to claim 1, characterized in that: In the test case generation stage, the Modbus-TCP protocol message is divided into two parts: MBAP protocol message header and PDU protocol data unit, and the training data set input into the discriminator model is the protocol data unit part.

3. The vulnerability mining method based on the improved generative adversarial network framework according to claim 1 is characterized in that: Use the traffic capture tool to directly capture the original Modbus-TCP protocol traffic messages from the real industrial environment as the training data set of the model.

4. The vulnerability mining method based on the improved generative adversarial network framework according to claim 1 is characterized in that: In the preprocessing operation of the training data set, a start tag and an end tag are inserted at the head and tail of each sequence respectively.

5. The vulnerability mining method based on the improved generative adversarial network framework according to claim 1 is characterized in that: In the generative adversarial network framework, a long short-term memory neural network is used as the generator of the framework, and a convolutional neural network is used as the discriminator of the framework.

6. The vulnerability mining method based on the improved generative adversarial network framework according to claim 5 is characterized in that: The maximum average difference is added to the original objective of the generative adversarial network framework by matching the high-dimensional hidden feature distributions of real and generated samples through the kernelized difference metric.

7. The vulnerability mining method based on the improved generative adversarial network framework according to claim 1 is characterized in that: The high-order features extracted from the penultimate layer in the discriminator model are passed to the generator model, allowing the generator model to obtain more feedback information.

Images