A Fuzzy Testing Method for Ethernet / IP Protocol Based on Generative Adversarial Networks

Abstract

The present application belongs to the technical field of Ethernet / IP protocol testing and vulnerability mining, and specifically relates to an Ethernet / IP protocol fuzz testing method based on a generative adversarial network, comprising the following steps: constructing an Ethernet / IP protocol sample library; preprocessing communication data packets in the Ethernet / IP protocol sample library; constructing a training set of corresponding types through a variety of clustering construction methods; generative adversarial network training; generating fuzzy test sample data; performing Ethernet / IP protocol fuzz testing to form an abnormal test case set; performing Ethernet / IP protocol fuzz testing on abnormal test cases to confirm that the case is an abnormal test case and the vulnerability caused by it. In the Ethernet / IP protocol fuzz testing method based on a generative adversarial network of the present application, a generative adversarial network is used to autonomously learn and generate high-quality fuzzy test cases, which reduces the manpower of protocol analysis and case construction during the fuzzy testing process, and realizes efficient and intelligent fuzz testing.

Description

Technical Field

[0001] The present application belongs to the technical field of Ethernet / IP protocol testing and vulnerability mining, and specifically relates to an Ethernet / IP protocol fuzz testing method based on a generative adversarial network. Background Art

[0002] Industrial control systems are widely distributed in key infrastructure fields such as industry, energy, electricity, water conservancy, and transportation. As a carrier for transmitting operating instructions in industrial control systems, the importance of communication protocols is self-evident. Therefore, how to effectively explore potential vulnerabilities in communication protocols and improve the anti-attack capabilities of communication protocols is crucial to improving the security of industrial control systems.

[0003] There are many types of communication protocols for industrial control systems. Among them, the Ethernet / IP protocol is a communication protocol widely used in industrial control systems in transportation, energy and other industries. Ensuring the secure communication of the Ethernet / IP protocol is the cornerstone for ensuring the safe operation of industrial control systems.

[0004] Fuzz testing is a method to discover potential vulnerabilities by providing a large amount of unexpected input to the target program and monitoring abnormal results. The core of this technology lies in how to construct effective test data (unexpected input data). There are two main methods for constructing test data: 1) Mutation-based construction method: by making targeted mutations on the input data, and then inputting the mutated data into the industrial control system to trigger the vulnerability; 2) Generation-based construction method: defining the test data format according to known protocol rules, and generating test data from scratch. However, the current industrial control protocol fuzz testing method still has some shortcomings: 1) Most test cases rely on manual analysis and design, which is not only time-consuming and labor-intensive, but also the quality of test cases depends entirely on human prior knowledge, so the pass rate and path coverage of test cases are uneven. 2) The current test case generation method is mainly constructed based on the publicly available vulnerability knowledge base, which has certain limitations for the mining of new vulnerabilities, and in the existing public vulnerability knowledge base (including CNVD, CNNVD, CVE, etc.), Ethernet / IP protocol vulnerabilities are very limited. Summary of the invention

[0005] In order to solve at least one technical problem existing in the prior art, the present application provides an Ethernet / IP protocol fuzz testing method based on a generative adversarial network.

[0006] The present application discloses an Ethernet / IP protocol fuzz testing method based on a generative adversarial network, comprising the following steps:

[0007] Step 1: Build an Ethernet / IP protocol sample library;

[0008] Step 2: Process the communication data packets in the Ethernet / IP protocol sample library to obtain decimal Ethernet / IP protocol sample data;

[0009] Step 3: Using the Ethernet / IP protocol sample data processed in step 2, a training set of corresponding types is constructed by using a variety of different clustering construction methods;

[0010] Step 4: Use different types of training sets to train the generative adversarial network respectively;

[0011] Step 5: Generate fuzzy test sample data, wherein the fuzzy test sample data includes multiple test cases;

[0012] Step 6: Input all test cases in the fuzzy test sample data into the industrial control system one by one to perform Ethernet / IP protocol fuzzy testing. If a test case causes abnormal operation of the industrial control system, the test case is recorded as an abnormal test case, and finally an abnormal test case set is formed;

[0013] Step 7. Input all abnormal test cases in the abnormal test case set into the industrial control system one by one again for Ethernet / IP protocol fuzzy testing, and manually check whether the industrial control system operation abnormality caused by each abnormal test case is a false alarm. If it is a false alarm, delete the test case from the abnormal test case set. If the abnormal test case causes an abnormality again, confirm that the case is an abnormal test case, and record the abnormal test case and the vulnerability it causes.

[0014] According to at least one embodiment of the present application, the Ethernet / IP protocol fuzz testing method further includes:

[0015] Step 8. Copy the data of all abnormal test cases finally recorded in step 7, and then perform random value inversion or random value data mutation operations, and then return the mutated abnormal test case data to steps 4 and 5, so as to generate fuzzy test sample data that is more likely to trigger Ethernet / IP protocol vulnerabilities.

[0016] According to at least one embodiment of the present application, in step one, a manual collection method is adopted to capture Ethernet / IP protocol communication data packets from the industrial control system using the Wireshark packet capture tool, thereby obtaining an Ethernet / IP protocol sample library.

[0017] According to at least one embodiment of the present application, in the second step, the communication data packets in the Ethernet / IP protocol sample library are parsed, other protocol headers are removed, the Ethernet / IP protocol sample data in hexadecimal is automatically extracted, and then the hexadecimal Ethernet / IP protocol sample data is converted bit by bit into decimal.

[0018] According to at least one embodiment of the present application, in the third step, multiple different clustering construction methods include:

[0019] Constructing by classifying according to message length: According to different message lengths, the Ethernet / IP protocol sample data is divided into different training sets, and data augmentation is performed on the smaller training sets;

[0020] Constructing by classifying according to function codes: According to the types of Ethernet / IP protocol function codes, training sets corresponding to different function codes are constructed, and then the data in different training sets are aligned and filled respectively;

[0021] Hybrid construction: All Ethernet / IP protocol sample data is used as a training data set.

[0022] According to at least one embodiment of the present application, in the method of constructing by classifying according to message length, data augmentation includes:

[0023] Copying the data in the smaller training set, and then performing data mutation operations such as flipping the numerical value of a specific index bit, taking the inverse of the numerical value, or randomly taking a value on the copied data.

[0024] According to at least one embodiment of the present application, in the method of constructing by classifying according to function codes, there are 8 types of function codes, and the data in different training sets are aligned and filled through the following relational expression (1):

[0025]

[0026] Among them, S0 is any original message, len() is the length function, MaxLen is the maximum length of the messages in the current training set, x is the padding character and x = 'PAD';

[0027] When len(S0) = MaxLen, it means that the original data does not need to be filled, and the original data S0 is retained in the training set;

[0028] When len(S0) < MaxLen, it means that the original data needs to be filled, the padding length is n = MaxLen - len(S0), the original data S0 is removed from the training set, and the padded message S1 is added to the training set.

[0029] According to at least one embodiment of the present application, in step 4, a long short-term memory network LSTM is selected as the generator model network, a convolutional neural network CNN is selected as the discriminator model network, and Dropout is used to avoid model overfitting, wherein the generative adversarial network training includes:

[0030] Step 4.1, initialize the LSTM generator and CNN discriminator network parameters;

[0031] Step 4.2: Input the training set data into the input layer of the LSTM generator, and then input the data into the embedding layer and hidden layer to preliminarily learn the feature distribution of the training data and update the weight parameters of the LSTM generator.

[0032] Step 4.3: Use the LSTM generator obtained in step 4.2 to generate negative sample data, and then use the real data as positive sample data. Use these data to train a binary CNN discriminator to initially learn to distinguish between generated data and real data, and update the weight parameters of the CNN discriminator.

[0033] Step 4.4: Cycle adversarial training of LSTM generator and CNN discriminator.

[0034] According to at least one embodiment of the present application, in step 4.4, the cyclic adversarial training LSTM generator includes:

[0035] Step 4.51, loop training LSTM generator and generate sequence data;

[0036] Step 4.52: Input the generated sequence data into the CNN discriminator to obtain the corresponding reward;

[0037] Step 4.53, use the Policy Gradient algorithm to pass the Reward to the LSTM generator to update the weight parameters of the LSTM generator;

[0038] Cyclic adversarial training of CNN discriminator includes:

[0039] Step 4.61, use the negative sample data generated by the updated LSTM generator and the real sample data set to cyclically train the CNN discriminator;

[0040] Step 4.62: Update the weight parameters until the model converges.

[0041] According to at least one embodiment of the present application, in step 5, generating fuzzy test sample data includes:

[0042] Step 5.1, in the process of cyclic adversarial training of LSTM generator and CNN discriminator in step 4.4, save the LSTM generator model once every 5 training cycles;

[0043] Step 5.2: Arrange the generator models saved in a complete generative adversarial training process in chronological order according to the saving time, and divide the generator models into early models, mid-term models, and late models in a ratio of 1:7:2;

[0044] Step 5.3: Extract the Ethernet / IP protocol data generated by the generator models in three different periods in the same proportion as the fuzzy test sample data.

[0045] This application has at least the following beneficial technical effects:

[0046] 1) In the Ethernet / IP protocol fuzz testing method based on generative adversarial networks of the present application, generative adversarial networks are used to autonomously learn and generate high-quality fuzz test cases, which reduces the manpower of protocol analysis and case construction during the fuzz testing process and realizes efficient and intelligent fuzz testing;

[0047] 2) In the Ethernet / IP protocol fuzz testing method based on generative adversarial networks of the present application, a variety of different clustering strategies are used to classify and construct protocol samples, which can enable the generative model to generate more diverse and standardized test cases, thereby increasing its path coverage, which is more conducive to triggering more potential vulnerabilities of the Ethernet / IP protocol and improving the security and anti-attack capabilities of the industrial control system;

[0048] 3) In the Ethernet / IP protocol fuzz testing method based on generative adversarial networks of this application, a method for extracting fuzz test sample data in proportion is proposed. The saved generator model is divided into early, mid-term and late models in chronological order, and the generated fuzz test samples are extracted in a specific proportion. Only a small amount of generated data of early and late models is extracted, which well balances the pass rate and randomness of test cases in fuzz testing, thereby solving the balance problem of test case pass rate and randomness in fuzz testing;

[0049] 4) The test cases generated by the Ethernet / IP protocol fuzzy testing method based on generative adversarial networks in this application have a high pass rate and vulnerability detection rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a flowchart of the Ethernet / IP protocol fuzzy testing method based on the generative adversarial network of this application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical scheme and advantages of the implementation of this application clearer, the technical scheme in the embodiment of this application will be described in more detail below in conjunction with the drawings in the embodiment of this application. The described embodiment is a part of the embodiment of this application, not all of the embodiments. The embodiments described below with reference to the drawings are exemplary and are intended to be used to explain this application, and should not be understood as limiting this application.

[0052] like Figure 1 As shown, the present application discloses an Ethernet / IP protocol fuzz testing method based on a generative adversarial network, comprising the following steps:

[0053] Step 1 (Ethernet / IP protocol sample library construction): Build the Ethernet / IP protocol sample library.

[0054] Specifically, this step adopts a manual collection method, using the Wireshark packet capture tool to fully capture Ethernet / IP protocol communication data packets from the industrial control system, thereby obtaining a complete Ethernet / IP protocol sample library.

[0055] Step 2 (sample data preprocessing): Process the communication data packets in the Ethernet / IP protocol sample library to obtain decimal Ethernet / IP protocol sample data.

[0056] Specifically, this step is to parse the communication data packets in the Ethernet / IP protocol sample library, remove other protocol headers, automatically extract the hexadecimal Ethernet / IP protocol sample data, and then perform a base conversion operation to convert the hexadecimal Ethernet / IP protocol sample data into decimal bit by bit.

[0057] Step 3 (constructing a training set): Using the Ethernet / IP protocol sample data processed in step 2, a training set of corresponding types is constructed through a variety of different clustering construction methods.

[0058] Specifically, the clustering construction methods in this step include the following three:

[0059] 1) Construction by message length classification: According to different message lengths, the preprocessed protocol data is divided into different training sets, and data amplification is performed on smaller training sets to increase the influence of this part of the training set; this construction method ensures the randomness of the data while ensuring the similarity of the generated test cases, thereby increasing the pass rate of the test cases.

[0060] Among them, the data augmentation method refers to: copying the data in a smaller training set, and then performing data mutation operations such as flipping the values of specific index bits, taking the inverse of the values, or randomly generating values on the copied data, so as to achieve data augmentation for a small data set.

[0061] 2) Construct according to function code classification: construct training sets corresponding to different function codes according to the types of Ethernet / IP protocol function codes, and then align and pad the data in different training sets respectively. It should be noted that such a construction method can fully test the robustness of each function of the Ethernet / IP protocol.

[0062] In this embodiment, excluding the reserved fields of the Ethernet / IP protocol, there are 8 function codes in the Ethernet / IP protocol, as shown in Table 1 below. 8 different training sets are constructed according to different function codes:

[0063] Table 1 Ethernet / IP function codes

[0064] Code name Function 0x0000 NOP TCP Open Probe 0x0004 ListServices List Service 0x0063 ListIdentity List ID 0x0064 ListInterfaces List interface 0x0065 RegisterSession Register Session 0x0066 UnRegisterSession Terminate a session 0x006F SendRRData Send Encapsulation Packet 0x0070 SendUnitData Send unit data

[0065] Furthermore, in this step, the data in different training sets is aligned and padded through the following relational expression (1) (that is, the original data S0 is aligned and padded according to relational expression (1) to obtain new data S1):

[0066]

[0067] Among them, S0 is any original message, len() is the length function, MaxLen is the maximum length of the messages in the current training set, x is the padding character and x = 'PAD';

[0068] When len(S0) = MaxLen, it means that the original data does not need to be padded, and the original data S0 is retained in the training set;

[0069] When len(S0) < MaxLen, it means that the original data needs to be padded, the padding length is n = MaxLen - len(S0), the original data S0 is removed from the training set, and the padded message S1 is added to the training set.

[0070] 3) Hybrid construction: Take all the Ethernet / IP protocol sample data as a training data set, give full play to the randomness of fuzz testing, so that the generated test cases have higher coverage.

[0071] Step Four (Generative adversarial network training): Use different types of training sets to perform generative adversarial network training respectively.

[0072] Specifically, in this step, according to the characteristics of the Ethernet / IP industrial control protocol such as fixed frame format and strong timing, the long short-term memory network (LSTM) is selected as the generator model network, the convolutional neural network (CNN) is selected as the discriminator model network, and Dropout is used to avoid model overfitting.

[0073] In addition, the LSTM generator constructed in this application includes two hidden layers and one output layer, where each of the two hidden layers consists of 64 hidden states, and the output layer adopts a fully connected method and uses softmax as the activation function; the CNN discriminator network hierarchy is Embedding layer, convolution layer, pooling layer, Dropout layer, and output layer. Similarly, the output layer adopts a fully connected method and uses sigmoid as the activation function.

[0074] Furthermore, the generative adversarial network training in this step includes the following steps:

[0075] Step 4.1: Initialize the LSTM generator and CNN discriminator network parameters;

[0076] Step 4.2 (pre-training LSTM generator): input the training set data into the input layer of the LSTM generator, and the input layer then inputs the data into the embedding layer and hidden layer to preliminarily learn the feature distribution of the training data and update the weight parameters of the LSTM generator;

[0077] Step 4.3 (pre-training CNN discriminator): Use the LSTM generator obtained in step 4.2 to generate negative sample data, and then use the real data as positive sample data. Use these data to train a binary classification CNN discriminator to initially learn to distinguish generated data from real data, and update the weight parameters of the CNN discriminator;

[0078] Step 4.4: Cycle adversarial training of LSTM generator and CNN discriminator.

[0079] Furthermore, the cyclic adversarial training LSTM generator in step 4.4 above includes the following steps:

[0080] Step 4.51, loop training LSTM generator and generate sequence data;

[0081] Step 4.52: Input the generated sequence data into the CNN discriminator to obtain the corresponding reward;

[0082] Step 4.53, use the Policy Gradient algorithm to pass the Reward to the LSTM generator to update the weight parameters of the LSTM generator;

[0083] Correspondingly, the cyclic adversarial training of the CNN discriminator includes the following steps:

[0084] Step 4.61, use the negative sample data generated by the updated LSTM generator and the real sample data set to cyclically train the CNN discriminator;

[0085] Step 4.62: Update the weight parameters until the model converges.

[0086] Step 5 (generation of fuzzy test sample data): Generate fuzzy test sample data, wherein the fuzzy test sample data includes multiple test cases.

[0087] It should be noted that after the generative adversarial network training in step 4 above, different trained LSTM generators will be obtained. If only the last trained LSTM generator is used to generate test cases, it can be guaranteed that the generated test cases have a high similarity with the real Ethernet / IP communication data, that is, it can be guaranteed that the generated test cases have a high pass rate; however, this runs counter to the concept of fuzz testing (inputting a large amount of unexpected data to trigger vulnerabilities). The test cases generated by the well-trained LSTM generator cannot give full play to the unexpectedness and randomness of the fuzz test, which involves the balance problem between the pass rate and randomness of the test cases in the fuzz test.

[0088] To this end, in this step, generating fuzzy test sample data includes the following steps:

[0089] Step 5.1: During the cyclic adversarial training of the LSTM generator and the CNN discriminator in step 4.4, the LSTM generator model is saved every 5 training cycles.

[0090] Step 5.2: Arrange the generator models saved in a complete generative adversarial training process in chronological order according to the saving time, and divide the generator models into early models, mid-term models, and late models in a ratio of 1:7:2;

[0091] Step 5.3: Extract the Ethernet / IP protocol data generated by the generator models in three different periods in the same proportion as the fuzzy test sample data.

[0092] In summary, since the generator model at different times has different training levels, the test cases it generates have different degrees of difference from the actual communication data, so the entire test case set can maintain a good diversity and randomness.

[0093] Moreover, because the early model was only trained for 5 rounds and the fitting effect was poor, in order to ensure the pass rate of the test cases, only 10% of the Ethernet / IP protocol data generated by the early model was extracted as the final fuzzy test sample; similarly, because the late model can generate test cases with a high similarity to the real Ethernet / IP communication data after multiple rounds of iterative training, in order to ensure the randomness of the test cases, only 20% of the Ethernet / IP protocol data generated by the late model was extracted as the final fuzzy test sample; the remaining 70% of the fuzzy test samples were extracted from the Ethernet / IP protocol data generated by the mid-term model. The above method of the present application innovatively adopts the method of generating fuzzy test sample data according to the above ratio, which can well balance the pass rate and randomness of the test cases in the fuzzy test.

[0094] Step 6 (Ethernet / IP protocol fuzzy test): Input all test cases in the fuzzy test sample data into the industrial control system one by one to perform Ethernet / IP protocol fuzzy test. If a test case causes abnormal operation of the industrial control system, the test case is recorded as an abnormal test case, and finally an abnormal test case set is formed.

[0095] Specifically, in this step, Python script is used to encapsulate the Ethernet / IP protocol fuzzy test module. First, the generated decimal fuzzy test sample data is converted into a hexadecimal fuzzy test case, and then the fuzzy test case is sent to the industrial control system using the socket.send() command, and the running state of the industrial control system is monitored using the PING command, while the return command of the industrial control system is received using the socket.recvfrom() command, and the return status code is parsed. If the status code of the returned data packet is not 0x0000 (success), the fuzzy test case and the corresponding status code are recorded, and then used to calculate the pass rate of the test case to evaluate the quality of the generated model. If the fuzzy test case causes the industrial control system to run abnormally (including downtime, communication interruption, program crash, logical anomaly, etc.) or is parsed to contain information such as Error and Exception in the returned data packet, the test case is recorded as an abnormal test case, and finally an abnormal test case set is formed.

[0096] Step 7 (Vulnerability Verification): All abnormal test cases in the abnormal test case set are input into the industrial control system one by one again for Ethernet / IP protocol fuzzy testing. Manually verify whether the industrial control system operation abnormality caused by each abnormal test case is a false alarm. If it is a false alarm, delete the test case from the abnormal test case set. If the abnormal test case causes an abnormality again, confirm that the case is an abnormal test case, and record the abnormal test case and the vulnerability it causes.

[0097] Furthermore, the Ethernet / IP protocol fuzz testing method based on a generative adversarial network of the present application may also include the following steps:

[0098] Step 8 (model retraining): copy the data of all abnormal test cases finally recorded in step 7, and randomly perform data mutation operations such as numerical inversion or random value taking, and then return the mutated abnormal test case data to steps 4 and 5; wherein, the mutated abnormal test case data is used as a training data set in the generative adversarial network in step 4, adjust the model parameters, and use the new data set to retrain the generative adversarial network model, so as to generate fuzzy test sample data that is more likely to trigger Ethernet / IP protocol vulnerabilities in step 5.

[0099] Unlike the previous step 4 in the generative adversarial network training process, step 4 initially uses the normal Ethernet / IP protocol data after preprocessing and clustering as the training data set; while in the model retraining process, step 4 uses the abnormal test case data after replication and mutation as the training data set.

[0100] Different from the previous step 5 in the process of generating fuzzy test sample data, in order to balance the pass rate and randomness of test cases in fuzz testing, the initial step 5 needs to extract the generation model arranged in the order of storage time according to the proportion, and generate fuzzy test sample data in the same proportion; in the process of model retraining, in order to enable the model to fully learn the characteristics of abnormal test cases and generate fuzzy test sample data that is more similar to abnormal test cases, step 5 uses the LSTM generator model saved after the last round of training cycle to generate retrained test samples.

[0101] In summary, this application uses generative adversarial networks to autonomously learn and generate high-quality fuzz test cases, thereby effectively reducing the manpower consumption of protocol analysis and case construction during fuzz testing, and realizing efficient and intelligent fuzz testing. At the same time, this application innovatively introduces different clustering strategies to improve the diversity of generated test cases and increase path coverage, which is more conducive to triggering more potential vulnerabilities in the Ethernet / IP protocol and improving the security and anti-attack capabilities of industrial control systems. In addition, this application solves the problem of balancing the pass rate of test cases and randomness in fuzz testing by introducing the idea of ​​extracting fuzz test samples in proportion.

[0102] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A fuzzy testing method for Ethernet / IP protocol based on generative adversarial network, characterized in that: The steps include: Step 1: Build an Ethernet / IP protocol sample library; Step 2: Process the communication data packets in the Ethernet / IP protocol sample library to obtain decimal Ethernet / IP protocol sample data; Step 3: Using the Ethernet / IP protocol sample data processed in step 2, a training set of corresponding types is constructed by using a variety of clustering construction methods; Step 4: Use different types of training sets to train the generative adversarial network separately; Step 5: Generate fuzzy test sample data, wherein the fuzzy test sample data includes multiple test cases; Step 6: Input all test cases in the fuzzy test sample data into the industrial control system one by one to perform Ethernet / IP protocol fuzzy testing. If a test case causes abnormal operation of the industrial control system, the test case is recorded as an abnormal test case, and finally an abnormal test case set is formed; Step 7: Input all abnormal test cases in the abnormal test case set into the industrial control system again one by one to perform Ethernet / IP protocol fuzzy testing, and manually check whether the abnormal operation of the industrial control system caused by each abnormal test case is a false alarm. If it is a false alarm, delete the test case from the abnormal test case set. If the abnormal test case causes an abnormality again, confirm that the case is an abnormal test case, and record the abnormal test case and the vulnerability caused by it; In step 4, a long short-term memory network LSTM is selected as the generator model network, a convolutional neural network CNN is selected as the discriminator model network, and Dropout is used to avoid model overfitting. The training of the generative adversarial network includes: Step 4.1, initialize the LSTM generator and CNN discriminator network parameters; Step 4.2: Input the training set data into the input layer of the LSTM generator, and then the input layer inputs the data into the embedding layer and the hidden layer to preliminarily learn the feature distribution of the training data and update the weight parameters of the LSTM generator. Step 4.3: Use the LSTM generator obtained in step 4.2 to generate negative sample data, and then use the real data as positive sample data. Use these data to train a binary CNN discriminator to initially learn to distinguish between generated data and real data, and update the weight parameters of the CNN discriminator. Step 4.4: Cycle adversarial training of LSTM generator and CNN discriminator; Further, in step 4.4, the cyclic adversarial training LSTM generator includes: Step 4.51, loop training LSTM generator and generate sequence data; Step 4.52: Input the generated sequence data into the CNN discriminator to obtain the corresponding reward; Step 4.53, use the Policy Gradient algorithm to pass the Reward to the LSTM generator to update the weight parameters of the LSTM generator; Cyclic adversarial training of CNN discriminator includes: Step 4.61, use the negative sample data generated by the updated LSTM generator and the real sample data set to cyclically train the CNN discriminator; Step 4.

62. Update the weight parameters until the model converges; Further, in the fifth step, generating the fuzz test sample data includes: Step 5.

1. During the process of cyclic adversarial training of the LSTM generator and the CNN discriminator in Step 4.4, save the LSTM generator model every 5 training cycles; Step 5.

2. Arrange the generator models saved during a complete generative adversarial training process in chronological order, and divide the generator models into early models, middle models, and late models according to the ratio of 1:7:2; Step 5.

3. Extract the Ethernet / IP protocol data generated by the generator models in three different periods according to the same ratio as the fuzz test sample data.

2. The Ethernet / IP protocol fuzz testing method according to claim 1, characterized in that: It also includes: Step Eight. Copy the data of all the abnormal test cases finally recorded in Step Seven and perform a data mutation operation of randomly taking the opposite value or randomly taking values on the data, and then return the mutated abnormal test case data to Step Four and Step Five, so as to generate fuzz test sample data that is more likely to trigger Ethernet / IP protocol vulnerabilities.

3. The Ethernet / IP protocol fuzz testing method according to claim 1 or 2, characterized in that: In the first step, an artificial acquisition method is adopted, and the Wireshark packet capture tool is used to capture Ethernet / IP protocol communication packets from the industrial control system, so as to obtain the Ethernet / IP protocol sample library.

4. The Ethernet / IP protocol fuzzy testing method according to claim 1 or 2, characterized in that: In the second step, the communication packets in the Ethernet / IP protocol sample library are parsed, other protocol headers are removed, the 16 - bit Ethernet / IP protocol sample data is automatically extracted, and then the 16 - bit Ethernet / IP protocol sample data is converted bit - by - bit to decimal.

5. The Ethernet / IP protocol fuzz testing method according to claim 1 or 2, characterized in that: In the third step, the multiple different clustering construction methods include: Classification and construction according to message length: According to different message lengths, divide the Ethernet / IP protocol sample data into different training sets, and perform data augmentation on the smaller training sets; Classification and construction according to function code: According to the types of Ethernet / IP protocol function codes, construct training sets corresponding to different function codes, and then align and fill the data in different training sets respectively; Mixed construction: Use all the Ethernet / IP protocol sample data as a training data set.

6. The Ethernet / IP protocol fuzz testing method according to claim 5, characterized in that: In the classification and construction method according to message length, the data augmentation includes: Copy the data in the smaller training set, and then perform data mutation operations such as flipping the numerical value at a specific index bit, taking the opposite value of the numerical value, or randomly taking values on the copied data.

7. The Ethernet / IP protocol fuzz testing method according to claim 5, characterized in that: In the classification and construction method according to function code, the types of function codes include 8 kinds, and the data in different training sets are aligned and filled through the following relational formula (1): Among them, S0 is any original message, len() is the length function, MaxLen is the maximum length of the message in the current training set, x is the padding character and x= ′ PAD ′ ; When len(S0) = MaxLen, it means that the original data does not need to be filled, and the original data S0 is retained in the training set; When len(S0) < MaxLen, it means that the original data needs to be filled, and the filling length is n = MaxLen - len(S0). Remove the original data S0 from the training set, and add the filled message S1 to the training set.

Images