A Network Protocol Vulnerability Mining Method Based on a Hybrid Mutation Strategy

Abstract

A network protocol vulnerability mining method based on a hybrid mutation strategy belongs to the technical field of network protocol vulnerability mining. The present invention solves the problem that existing network protocol vulnerability mining methods have poor capabilities in mining unknown network protocol vulnerabilities, and existing network protocol vulnerability mining methods are only targeted at a single network protocol and cannot be applied to vulnerability mining of different network protocols. The present invention is based on an improved generative adversarial network model and an offline vulnerability knowledge base to guide the generation of sample data mutations to improve the vulnerability triggering rate, thereby generating more effective and more targeted test cases, reducing the generation of invalid test cases for vulnerability mining, and can intelligently and efficiently mine vulnerabilities of unknown network protocols. The method of the present invention is applicable to most different network protocols, greatly reducing the time for manual analysis of data frames, and can be migrated and applied to different network protocols. The method of the present invention can be applied to vulnerability mining of network protocols.

Description

Technical Field

[0001] The present invention belongs to the technical field of network protocol vulnerability mining, and in particular relates to a network protocol vulnerability mining method based on a hybrid mutation strategy. Background Art

[0002] Network protocols are the rules, standards, and conventions established for data exchange between terminal devices. Currently, many existing network protocols are designed to improve efficiency and reliability. With the deepening integration of informatization and industrialization, while efficiency gains have also exposed numerous network security issues, impacting industrial safety and the development of intelligent industrial systems. Network protocol fuzz testing technology plays a vital role in ensuring the security and reliability of communication processes. Therefore, how to efficiently and accurately uncover network protocol vulnerabilities is a pressing issue.

[0003] Network protocol vulnerability discovery methods primarily include reverse engineering, penetration testing, and fuzz testing. Traditional methods primarily target specific, known network protocols, but are less effective at detecting vulnerabilities in unknown protocols. They also require the target's operating environment and certain logic code. Furthermore, these methods focus on a single protocol and are incapable of adapting to diverse network protocols. These methods are often time-consuming and error-prone, lacking specificity, and exhibiting low vulnerability detection efficiency, thus failing to achieve intelligent and efficient detection.

[0004] Deep learning, a branch of machine learning, has attracted widespread attention in the technology community and has shown promising application prospects in certain fields. Consider applying deep learning models to address network protocol vulnerability discovery. Summary of the Invention

[0005] The purpose of the present invention is to solve the problem that the existing network protocol vulnerability mining methods have poor ability to mine unknown network protocol vulnerabilities, and the existing network protocol vulnerability mining methods are only targeted at a single network protocol and cannot be applied to vulnerability mining of different network protocols. A network protocol vulnerability mining method based on a hybrid mutation strategy is proposed.

[0006] The technical solution adopted by the present invention to solve the above technical problems is:

[0007] A network protocol vulnerability mining method based on a hybrid mutation strategy, the method specifically comprising the following steps:

[0008] Step 1: Build an offline vulnerability knowledge base

[0009] Collect various existing vulnerability types and their characteristics, abnormal data frame sets of various vulnerability types in known network protocols, and abnormal data frame characteristics to build an offline vulnerability knowledge base;

[0010] For any vulnerability type, find the abnormal data frame set and the characteristics of the abnormal data frame set under the vulnerability type according to the characteristics of the vulnerability type, the name of the vulnerability type and the content of the vulnerability type; filter out data frames from the given communication data frame set according to the characteristics of the abnormal data frame set found, and find the abnormal data frame set under the vulnerability type.

[0011] The abnormal data frames and the filtered data frames are used as the mutation seed data frame set;

[0012] According to the triggering frequency of the vulnerability type, perform data frame feature mutation and feature field mutation operations on the data frames in the mutation seed data frame set to obtain the mutated data frame set;

[0013] Similarly, the above processing is performed on each vulnerability type, and finally a set of mutated data frames corresponding to each vulnerability type is obtained;

[0014] Step 2: Build a generative adversarial network model, preprocess the obtained mutated data frame, and establish the initial training data set of the model;

[0015] Step 3: Train the generative adversarial network model based on the initial training dataset, and generate a test dataset through the generative adversarial network model;

[0016] Step 4: Fuzz test the test dataset

[0017] Inject the test data frames in the test data set into the test program or test device, and collect the work log content and communication records of the test program or test device;

[0018] Step 5: Result analysis

[0019] Analyze the work log content and communication records of the test program or test equipment to filter out abnormal information; then find the data frame that triggers the vulnerability based on the abnormal information, and record the characteristics of the triggering vulnerability and the resulting consequences. The data frame that triggers the vulnerability, the recorded characteristics of the triggering vulnerability, and the resulting consequences are encapsulated together to obtain abnormal message information;

[0020] Based on the dynamic matching results between the encapsulated abnormal message information and the content of the constructed offline vulnerability knowledge base, the offline vulnerability knowledge base is updated to obtain an updated offline vulnerability knowledge base;

[0021] Step 6: The data frames generated by the generative adversarial network model in step 3 and the mutated data frames used in this iteration are used as the pre-mutation dataset. The updated offline vulnerability knowledge base information is used to perform mutation guidance operations on the data frames in the pre-mutation dataset to obtain the optimized mutated dataset. The abnormal message information obtained in step 5 is directly added to the optimized mutated dataset.

[0022] Step 7: Combine the pre-mutation dataset and the optimized mutation dataset as the dataset for the next iteration;

[0023] Step 8: Using the data set obtained in step 7, repeat the process from step 3 to step 7 until the final offline vulnerability knowledge base information is obtained when the iterative stopping condition is met. Vulnerabilities in the network protocol are mined based on the information in the final offline vulnerability knowledge base.

[0024] Furthermore, the various existing vulnerability types collected include buffer overflow, denial of service, null pointer, address out of bounds, Web attack, C&C remote control attack, ARP traffic, ARP attack, malformed packet attack and remote code execution.

[0025] Furthermore, the characteristics of the abnormal data frame set include message length characteristics, special characters (commonly including the null character in ASCII and some boundary characters), data frame feature fields, and vulnerability triggering frequency.

[0026] Furthermore, the data frames are screened out from a given communication data frame set according to the characteristics of the found abnormal data frame set, and the abnormal data frames found under the vulnerability type and the screened out data frames are used as the mutation seed data frame set; the specific process is:

[0027] By comparing the features of the found abnormal data frame set with the features of the known given communication data frame set, the data frames that are most similar to each of the found abnormal data frames are selected from the known given communication data frame set, and all the selected data frames are used as the filtered data frames;

[0028] The found abnormal data frames and the filtered data frames are used as the mutation seed data frame set corresponding to the vulnerability type.

[0029] Furthermore, in step 2, the obtained mutated data frame is preprocessed to establish an initial training data set for the model; the specific process is as follows:

[0030] Step 2.1: For any data frame in the mutated data frame set, formalize the data frame into a sequence S 1:n =(e1,e2,e3,...,e x ,...,e n ),ex ∈E,S 1:n ∈S * , where E represents a hexadecimal data set, e1, e2, e3, ..., e x ,...,e n Represents sequence S 1:n The 1st, 2nd, 3rd, ..., x, ..., nth elements in the sequence S, where n represents 1:n The total number of elements in S * is the sequence set corresponding to the mutated data frame set;

[0031] Similarly, obtain the sequence corresponding to each data frame in the mutated data frame set;

[0032] Step 2.2: Convert the hexadecimal data in the sequence into decimal data representation, and then store the converted sequence;

[0033] Step 2.3: Cluster the data frames in the mutated data frame set according to the transformed sequences;

[0034] Step 2.4: Enhance the data frame based on the clustering results to obtain the initial training data set for the model.

[0035] Furthermore, in step 2.3, the data frames in the mutated data frame set are clustered according to the converted sequence, and the clustering methods adopted are frame length clustering and K-means clustering.

[0036] Furthermore, in step 2.4, the data frame is enhanced in the following manner:

[0037] Select the category with the smallest number of data frames from the clustering results (in some cases, there may be more than one category with the smallest number of data frames. In this case, the data frame enhancement method should be used to process each category separately). For any data frame a in the selected category, calculate the Euclidean distance between the data frame a and each other data frame in the selected category to obtain the k nearest neighbors of the data frame a.

[0038] Set the sampling rate, and then randomly select several samples from the k nearest neighbors according to the set sampling rate. For the selected sample data frame b, construct a new data frame c in the following way;

[0039] c=a+rand(0,1)×|ab|

[0040] Among them, rand(0,1) represents a random number between (0,1), |ab| represents the distance between data frame a and data frame b;

[0041] Similarly, the above processing is performed on each data frame in the selected category.

[0042] Furthermore, in step 2.4, the data frame is enhanced in the following manner:

[0043] The category with the smallest number of data frames is selected from the clustering results (in some cases, there may be more than one category with the smallest number of data frames. In this case, each category should be processed separately using this data frame enhancement method). For the selected category, the data frames in the category are randomly truncated, and then the randomly truncated data frame information is spliced to obtain the spliced data frame.

[0044] Furthermore, the specific process of step 3 is as follows:

[0045] Step 3.1: Parameterize the latent space vector as a Gaussian mixture model:

[0046]

[0047] Among them, g(z|μ i ,∑ i ) represents the Gaussian distribution N(μ i ,∑ i ) is the probability of getting data frame z, M represents the total number of Gaussian distributions, μ i represents the mean of the i-th Gaussian distribution, ∑ i represents the variance of the i-th Gaussian distribution;

[0048] Step 3.2: Convert the data frame z into a differentiable variable by reparameterizing it, that is, write each Gaussian distribution into a form containing a standard Gaussian distribution:

[0049] z=μ i +σ i ε, ε~N(0,1)

[0050] Among them, μ i ,σ i are the weight parameters that adjust the Gaussian distribution to the standard Gaussian distribution, representing the mean and variance of the standard distribution respectively; ε represents the auxiliary noise variable;

[0051] Step 3.3: The generative adversarial network model includes three generators and one discriminator. Three Gaussian sample sets after the reparameterization of the Gaussian mixture model are randomly extracted as inputs of the three generators respectively.

[0052] Step 3.4: Set the training parameters of the generative adversarial network model, including the learning rate, boundary clipping weight, and training cycle;

[0053] Divide the dataset generated by the generator and the three randomly selected Gaussian sample sets in step 3.3 into several datasets of equal size. Input the divided datasets into batches to the discriminator until all training data are input. This round of training ends.

[0054] Step 3.5: Input the real sample dataset and the dataset generated by the generator into the discriminator at the same time until the generative adversarial network model reaches a stable model training state, and then end the training;

[0055] The set of data frames generated by the three generators of the generative adversarial network model is used as the test dataset.

[0056] Furthermore, the stopping condition of the iteration is: the information in the offline vulnerability knowledge base is no longer updated with new content or the new vulnerability triggering ratio is less than the set vulnerability triggering ratio.

[0057] The beneficial effects of the present invention are:

[0058] The present invention is based on an improved generative adversarial network model and an offline vulnerability knowledge base to guide the generation of sample data variations to improve the vulnerability trigger rate, thereby generating more effective and targeted test cases, reducing the generation of invalid test cases for vulnerability mining, and can intelligently and efficiently mine vulnerabilities in unknown network protocols. By using an improved generative adversarial network model, the model training speed is accelerated, the diversity of test sample data is enhanced, and the problem of fuzzy crashes during training is alleviated. At the same time, the method of the present invention is applicable to most different network protocols, which can greatly reduce the time of manual analysis of data frames and can be migrated and applied to different network protocols, achieving the effect of saving costs and improving work efficiency.

[0059] The offline rapid mutation strategy can accelerate the generation of effective test cases and learn the characteristics of abnormal data frames, allowing for more targeted exploitation of network protocol vulnerabilities. This method improves test acceptance rates, enhances the diversity of generated data, and increases vulnerability trigger rates, making it highly effective for network protocol vulnerability discovery. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A diagram of the vulnerability mining architecture for the online and offline combined strategy;

[0061] Figure 2 This is the DMGAN model structure diagram;

[0062] Figure 3 Flowchart for optimizing dataset. DETAILED DESCRIPTION

[0063] The present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments.

[0064] The present invention uses an improved multi-generator generative adversarial network model (DMGAN) and combines it with an offline seed rapid mutation strategy to solve the current problem of network protocol vulnerability mining, improve the diversity of fuzzy test data, the acceptance rate of the test system, and the number of fault triggering. The use of the DMGAN model can effectively reduce the time and cost of manual analysis, and effectively reduce the manual input of test cases without sacrificing the vulnerability detection effect. Therefore, it is very necessary to use a vulnerability mining method based on the DMGAN model. Figure 1 As shown, the method of the present invention specifically includes: building an offline vulnerability knowledge base, preprocessing and building a data set, model design and model training, fuzz testing, result analysis, and data set optimization process:

[0065] Step 1: Build an offline vulnerability knowledge base

[0066] Experts build an offline vulnerability knowledge base by analyzing the collected vulnerability information, and then use the knowledge base content to guide data frame mutation to generate more effective seed test cases to discover more potential vulnerabilities.

[0067] Step 1-1: Collect 10 existing vulnerability types and related feature information, including: buffer overflow, denial of service, null pointer, address out of bounds, Web attack, C&C remote control attack, ARP traffic, ARP attack, malformed packet attack, remote code execution; the specific content of the vulnerability knowledge base includes: vulnerability type, vulnerability characteristics, abnormal data frame set for a certain network protocol, abnormal data frame characteristics: such as message length characteristics and special characters, data frame feature fields, and vulnerability triggering frequency.

[0068] Step 1-2: Utilize the vulnerability knowledge base content to find the abnormal data frame set and the features of the abnormal data frame set under the corresponding vulnerability based on the characteristics of vulnerability types such as buffer overflow vulnerability, null pointer vulnerability, and address out of bounds. By comparing the features between the abnormal data frame set in the offline vulnerability knowledge base and the given communication data frame set, establish the most similar vulnerability mutation seed data frame set.

[0069] Step 1-3: Based on the mutated data frame set and its characteristics, the genetic mutation algorithm is combined to perform data frame feature mutation and feature field guided mutation operations on the given communication data frame.

[0070] For example, buffer overflow vulnerabilities are often caused by a failure to check the length boundaries of incoming data frames, null pointer vulnerabilities are caused by a failure to handle nulls, and address out-of-bounds vulnerabilities are caused by a failure to check the boundaries of data frame contents. Therefore, based on these characteristics, data frame feature mutations can be implemented by changing the message length and special characters within the message, while feature field mutations can be implemented by matching similarities between fields and mutating the message segment size boundaries.

[0071] Steps 1-4: Considering the triggering frequency of vulnerability types, mutate the given initial data frames that trigger the vulnerability for each vulnerability type according to the weight ratio of the vulnerability triggering frequency, add the mutated data frames to the initial data frame set, and obtain the model training data frame set.

[0072] Step 2: Preprocessing to build the initial dataset

[0073] Primarily, statistical and machine learning methods are used to align, convert, and cluster raw data frames. Communication data packets have the following characteristics: they exist in a sequence, vary in length due to differences in data fields during communication, and generally follow a fixed protocol format. Initial communication data frames are obtained through mutation guided by an offline vulnerability knowledge base and subsequently processed to construct the initial dataset for model training.

[0074] Step 2-1: Formalize the original data frame sequence obtained after mutation into S 1:n =(e1,e2,e3,...,e x ,...,e n ),e x ∈E and S 1:n ∈S * , where E represents a hexadecimal data set, the elements of which are composed of letters and numbers, S * It is a sequence of data frames, whose elements consist of data frames.

[0075] Step 2-2: Base conversion: convert the hexadecimal data frame into decimal data representation, and then store it in a specific file or database to unify the data format in the input training model.

[0076] Steps 2-3: Cluster the data frames, using both frame length clustering and K-means clustering to enhance the diversity of the sample data. Frame length clustering prioritizes frames sharing the same type, primarily using the length of the data frames. K-means clustering prioritizes groups of frames with the same functionality, primarily using the Euclidean distance between data vectors.

[0077] (i) Frame length clustering: First, count the lengths of the data frames in the dataset and divide the dataset into different classes based on the lengths.

[0078] (ii) K-means clustering: First, K elements are randomly selected from the initial sample data set as the initial cluster centers. The distance between each element and the cluster center is then calculated, and each element is assigned to the cluster center with the closest distance. The cluster center represents a cluster. After all elements are assigned, the cluster center is recalculated based on the existing elements in the cluster. This process is repeated iteratively until a termination condition is met. The termination condition can be one of the following: no (or a minimum number of) elements are reassigned to different clusters, that is, the category to which the sample belongs does not change, no (or a minimum number of) cluster centers change again, or the sum of squared errors is locally minimized.

[0079] Steps 2-4: Data frame augmentation, introducing noisy data. Data frame augmentation further maintains the diversity of generated data. Using data augmentation during model training can prevent overfitting. In real-world scenarios, the distribution of collected data is uneven. To maintain the diversity of generated data, new samples are artificially synthesized to address sample imbalance. The data frame ratio is appropriately adjusted to enhance the depth and breadth of model training.

[0080] (i) SMOTE method: In the first step, for each sample element in the minority class, the distance from it to all samples in the minority class sample set is calculated using the Euclidean distance standard to obtain its k nearest neighbors. In the second step, a sampling ratio is set according to the sample imbalance ratio to determine the sampling magnification N. For each minority class sample a, several samples are randomly selected from its k nearest neighbors, assuming that the selected nearest neighbor is b. In the third step, for each randomly selected nearest neighbor b, a new sample is constructed with the original sample a according to the following formula: c = a + rand(0,1) × |ab|, ultimately achieving the effect of balancing the large and small sample sets.

[0081] (ii) Methods based on decomposition or mixing: First, for datasets with few sample elements, data truncation is performed randomly based on the data frame information; second, the randomly truncated data frame information is spliced; third, the sample size of the dataset is measured to balance the dataset elements.

[0082] Step 3: Model design and model training

[0083] like Figure 2As shown in Figure 1, the basic model of a generative adversarial network (GAN) consists of a generator and a discriminator. The generator generates data that shares features with real data, while the discriminator distinguishes between real and fake data. This paper proposes an improved GAN model (DMGAN), which trains the DMGAN model by feeding a preprocessed dataset into the model. The latent space vectors are first parameterized using a Gaussian mixture model (GMM). These parameterized latent space vectors are then reparameterized, introducing multiple different Gaussian samples. Samples are then drawn from a corresponding Gaussian distribution and fed into a multimodal generator, which learns the spatial structure of the input data frame. The discriminator then distinguishes the authenticity of the generated data, ultimately achieving a stable Nash equilibrium. The GMM is a simplifying assumption that accelerates model training. The sample data obtained by training a stable DMGAN model is highly diverse, similar to the structure of real data samples while ensuring a certain degree of random difference. Gaussian sample data with different parameters are introduced into the multi-modal generator respectively, and then the samples generated by the generator and the pre-processed real samples are used as the input of the discriminator. The loss function of the generator and discriminator is optimized through the identification results given by the discriminator, gradually improving the performance of the generator and discriminator, and obtaining more accurate test cases. The loss function optimized by model training is:

[0084]

[0085] P data Represents the data distribution of real samples, P z Represents the data distribution of generated samples, and θ represents the loss function of the model, which is actually a game process of solving a maximum and minimum value.

[0086] Step 3-1: First, reparameterize the latent space vector into a Gaussian mixture model to increase the modeling capability of the prior distribution without increasing the depth of the model. Define the distribution of z as a mixture Gaussian model.

[0087]

[0088] Among them, g(z|μ i ,∑ i ) represents the Gaussian distribution N(μ i ,∑ i ), the model is equivalent to uniformly randomly selecting a distribution from N Gaussian distributions to sample z, where each Gaussian distribution has μ i and ∑ i Two parameters, μ i represents the mean of the Gaussian distribution, ∑ i represents the variance of the Gaussian distribution.

[0089] Step 3-2: The gradients of the two parameters of the above model cannot be directly backpropagated through the sample parameter z because z is a non-differentiable random variable and the gradient cannot be passed here. Therefore, the reparameterization technique is introduced to solve the current problem. The principle is to transform z into a differentiable variable, that is, each Gaussian distribution can be written as a form containing a standard Gaussian distribution:

[0090] z=μ i +σ i ∈,∈~N(0,1) (3)

[0091] Among them, μ i , σ i are the heavy parameters that adjust the Gaussian distribution to the standard distribution, representing the mean and variance respectively; ∈ represents the auxiliary noise variable, so that z is converted into a differentiable variable.

[0092] Step 3-3: Build the DMGAN model, set up three generators and one discriminator, and randomly extract three Gaussian sample sets after the Gaussian mixture model is re-parameterized and input into the three generators for training. Define the parameters μ = [μ1, μ2, ..., μ N ] T and σ=[σ1,σ2,...,σ N ] T ,The settings in the mixture model include some simplified collections: the diagonal covariance matrix of each component, the equally weighted mixture components, which limit the model's ability to approximate more complex distributions. It is necessary to continuously optimize and adjust the Gaussian mixture model parameters and the proportions and weights of these parameters to better approximate the potential distribution, and ultimately make the p generated by the generator data (G(μ i +σ i ∈)|∈) has the largest probability value. By combining the Gaussian mixture model with multiple generators, the model training speed can be accelerated, achieving a better fitting effect on the samples, and ensuring the diversity of sample data, reducing the possibility of fuzzy collapse problems.

[0093] Step 3-4: Set the model training parameters at the same time, set the learning rate, boundary clipping weight and iterative training cycle parameters, set the learning rate to 0.001, the weight clipping value to [-0.01, 0.01], and set 50 iteration cycles. i The value of is set to a random value in (-1,1) from the uniform distribution; σ iThe value of is set to a fixed value of 0.2 and cannot be zero to avoid fuzzy collapse. The dataset generated by the generator and the initial sample dataset are divided into multiple datasets of equal size and fed into the discriminator in batches until all training data has been fed in, ending the training cycle. Based on the set training cycle of 50, the generator model is saved every 10 training epochs. This method not only allows for obtaining the final trained model, but also maintains data diversity, generating test cases with varying degrees of similarity and improving the diversity of generated data.

[0094] Steps 3-5: After training is complete, verify that the generator can generate data frames that are highly similar to real data. A reserved dataset of real samples for model validation is extracted and fed into the discriminator simultaneously with the generated dataset. If the discriminator's probability of distinguishing between the two remains approximately 1 / 2, the model training is considered stable and training ends.

[0095] Step 4: Fuzz Testing

[0096] After model training is complete, the three generators we set up can generate a large number of test data frames, whose formats are similar to the given variant sample data frames, and can ensure their diversity and test acceptance rate. These data frames are then sent to the test program or device for fuzz testing.

[0097] Step 4-1: Set up multiple test methods and inject test data frames into the device or program in different ways for testing.

[0098] Step 4-2: Connect to the interface of the test program or test equipment, gradually inject test data frames into it, record the operation of the test program or test equipment, and collect log information during the work process and data frames of the communication process.

[0099] Step 4-3: Send a large number of data frames generated by the DMGAN model to a specific program or device for stress testing, and input these test data frames into the test target at the same time to achieve the effect of stress testing. The same method is used to log and record information on the communication process and the operation process.

[0100] Step 5: Result Analysis

[0101] The entire communication process and work status are recorded in a log file. By analyzing the log file, valid test data frames and related information that caused the exception are screened out. In addition, the log files generated during the stress test need to be analyzed to obtain relevant vulnerability knowledge and information.

[0102] Step 5-1: First, analyze the work log content and communication records of the test program or test equipment to filter out abnormal information related to the vulnerability.

[0103] Step 5-2: Find the sending and receiving data frames that trigger the vulnerability based on the abnormal information captured in the log, and record the characteristics of the triggering vulnerability and the consequences caused, and other related information, and encapsulate the above abnormal message information together.

[0104] Step 5-3: Dynamically match the encapsulated abnormal message information with the offline vulnerability knowledge base content. If there is information in the known offline vulnerability knowledge base that is similar to the newly encapsulated vulnerability information (similarity means that the length of the abnormal message information and the format and size of specific fields are similar), the vulnerability knowledge base will not be updated. If they are not similar, the information in the vulnerability knowledge base will be updated. The content of the vulnerability knowledge base will be updated iteratively step by step. This process enriches the vulnerability mining capabilities.

[0105] Step 6: According to Figure 3 The process optimization data set shown

[0106] According to the 80 / 20 principle in software testing, namely the principles of temporal locality and spatial locality, vulnerabilities are mainly caused in 20% of the use case modules. The DMGAN model can be used to further mutate, screen, and learn the test seed set.

[0107] Step 6-1: Set the initial given data frame set and the set mutated by the mutation strategy as the model initial training set. This process is only performed once during model training.

[0108] Step 6-2: Consider constructing a new model training dataset. Set the data frame set generated by the model and the data frame set obtained using the mutation strategy during the previous training round as the pre-mutation dataset for the optimized dataset. Combined with the latest vulnerability knowledge base information, perform the mutation operation in Step 1 on the pre-mutation dataset to obtain the mutated dataset of the optimized dataset. The set of abnormal messages reported by the fuzz testing results is directly added to the mutated dataset.

[0109] Step 6-3: Combine the pre-mutation dataset and the mutated dataset as the dataset for the next round of model training. This process ensures the diversity of learning data samples and optimizes the effectiveness of the generated model in generating test cases. After each round of model training, repeat steps 6-2 and 6-3 to obtain the dataset for the next round of training.

[0110] Step 6-4: Perform model training and fuzz testing on the newly constructed optimized data set again to discover more vulnerabilities. By analyzing the test cases that discovered the vulnerabilities, the offline vulnerability knowledge base is continuously and dynamically improved until the vulnerability rule base no longer updates new content or the number of new vulnerabilities triggered is less than a certain ratio, at which point the vulnerability mining process ends.

[0111] This paper proposes an intelligent vulnerability mining method for network protocols based on a hybrid mutation strategy. It proposes a new generative adversarial network model (DMGAN) and applies this model to network protocol vulnerability mining by combining offline rapid mutation technology and fuzz testing techniques. This method intelligently analyzes and learns the format of vulnerability data frames in network communication processes without manual analysis, allowing for faster and more efficient mining of network protocol vulnerabilities. Furthermore, this method is highly adaptable to the vulnerability mining process of unknown network protocols, achieving effective data migration capabilities and uncovering more potential network vulnerabilities.

[0112] The above examples are merely illustrative of the calculation model and process of the present invention and are not intended to limit the embodiments of the present invention. Persons skilled in the art will readily appreciate that other variations or modifications based on the above description are possible. This list of embodiments is not exhaustive; however, any obvious variations or modifications derived from the technical solution of the present invention remain within the scope of protection of the present invention.

Claims

1. A network protocol vulnerability mining method based on a hybrid mutation strategy, characterized in that: The method specifically comprises the following steps: Step 1: Build an offline vulnerability knowledge base Collect various existing vulnerability types and their characteristics, abnormal data frame sets of various vulnerability types in known network protocols, and abnormal data frame characteristics to build an offline vulnerability knowledge base; For any vulnerability type, find the abnormal data frame set and the characteristics of the abnormal data frame set under the vulnerability type according to the characteristics of the vulnerability type, the name of the vulnerability type, and the content of the vulnerability type; filter out data frames from the given communication data frame set based on the characteristics of the found abnormal data frame set, and use the abnormal data frames found under the vulnerability type and the filtered data frames as the mutation seed data frame set; According to the triggering frequency of the vulnerability type, perform data frame feature mutation and feature field mutation operations on the data frames in the mutation seed data frame set to obtain the mutated data frame set; Similarly, the above processing is performed on each vulnerability type, and finally a set of mutated data frames corresponding to each vulnerability type is obtained; Step 2: Build a generative adversarial network model, preprocess the obtained mutated data frame, and establish the initial training data set of the model; Step 3: Train the generative adversarial network model based on the initial training dataset, and generate a test dataset through the generative adversarial network model; Step 4: Fuzz test the test dataset Inject the test data frames in the test data set into the test program or test device, and collect the work log content and communication records of the test program or test device; Step 5: Result analysis Analyze the work log content and communication records of the test program or test equipment to filter out abnormal information; then find the data frame that triggers the vulnerability based on the abnormal information, and record the characteristics of the triggering vulnerability and the resulting consequences. The data frame that triggers the vulnerability, the recorded characteristics of the triggering vulnerability, and the resulting consequences are encapsulated together to obtain abnormal message information; Based on the dynamic matching results between the encapsulated abnormal message information and the content of the constructed offline vulnerability knowledge base, the offline vulnerability knowledge base is updated to obtain an updated offline vulnerability knowledge base; Step 6: The data frames generated by the generative adversarial network model in step 3 and the mutated data frames used in this iteration are used as the pre-mutation dataset. The updated offline vulnerability knowledge base information is used to perform mutation guidance operations on the data frames in the pre-mutation dataset to obtain the optimized mutated dataset. The abnormal message information obtained in step 5 is directly added to the optimized mutated dataset. Step 7: Combine the pre-mutation dataset and the optimized mutation dataset as the dataset for the next iteration; Step 8: Repeat steps 3 to 7 until the iterative stopping condition is met to obtain the final offline vulnerability knowledge base information, and perform network protocol vulnerability mining based on the information in the final offline vulnerability knowledge base.

2. A network protocol vulnerability mining method based on a hybrid mutation strategy according to claim 1, characterized in that: The various existing vulnerability types collected include buffer overflow, denial of service, null pointer, address out of bounds, Web attack, C&C remote control attack, ARP traffic, ARP attack, malformed packet attack and remote code execution.

3. The network protocol vulnerability mining method based on hybrid mutation strategy according to claim 2 is characterized in that: The characteristics of the abnormal data frame set include message length characteristics, special characters, data frame characteristic fields and vulnerability triggering frequency.

4. The network protocol vulnerability mining method based on hybrid mutation strategy according to claim 3 is characterized in that: The method further comprises filtering out data frames from a given communication data frame set according to the characteristics of the found abnormal data frame set, and using the found abnormal data frames and the filtered data frames under the vulnerability type as a mutation seed data frame set; The specific process is: By comparing the features of the found abnormal data frame set with the features of the known given communication data frame set, the data frames that are most similar to each of the found abnormal data frames are selected from the known given communication data frame set, and all the selected data frames are used as the filtered data frames; The found abnormal data frames and the filtered data frames are used as the mutation seed data frame set corresponding to the vulnerability type.

5. The network protocol vulnerability mining method based on hybrid mutation strategy according to claim 4 is characterized in that: In step 2, the obtained mutated data frame is preprocessed to establish the initial training data set of the model; the specific process is as follows: Step 2.1: For any data frame in the mutated data frame set, formalize the data frame into a sequence S 1:n =(e1,e2,e3,...,e x ,...,e n ),e x ∈E,S 1:n ∈S * , where E represents a hexadecimal data set, e1, e2, e3, ..., e x ,...,e n Represents sequence S 1:n The 1st, 2nd, 3rd, ..., x, ..., nth elements in the sequence S, where n represents 1:n The total number of elements in S * is the sequence set corresponding to the mutated data frame set; Similarly, obtain the sequence corresponding to each data frame in the mutated data frame set; Step 2.2: Convert the hexadecimal data in the sequence into decimal data representation, and then store the converted sequence; Step 2.3: Cluster the data frames in the mutated data frame set according to the transformed sequences; Step 2.4: Enhance the data frame based on the clustering results to obtain the initial training data set for the model.

6. A network protocol vulnerability mining method based on a hybrid mutation strategy according to claim 5, characterized in that: In the step 2.3, the data frames in the mutated data frame set are clustered according to the converted sequence, and the clustering methods adopted are frame length clustering and K-means clustering.

7. The network protocol vulnerability mining method based on hybrid mutation strategy according to claim 6 is characterized in that: In step 2.4, the data frame is enhanced in the following manner: Select the category with the smallest number of data frames from the clustering results. For any data frame a in the selected category, calculate the Euclidean distance between the data frame a and each other data frame in the selected category to obtain the k nearest neighbors of the data frame a. Set the sampling rate, and then randomly select several samples from the k nearest neighbors according to the set sampling rate. For the selected sample data frame b, construct a new data frame c in the following way; c=a+rand(0,1)×|ab| Among them, rand(0,1) represents a random number between (0,1), |ab| represents the distance between data frame a and data frame b; Similarly, the above processing is performed on each data frame in the selected category.

8. The network protocol vulnerability mining method based on hybrid mutation strategy according to claim 7 is characterized in that: In step 2.4, the data frame is enhanced in the following manner: A category with the smallest number of data frames is selected from the clustering results. For the selected category, a random truncation operation is performed on the data frames in the category, and then a splicing operation is performed on the randomly truncated data frame information to obtain a spliced data frame.

9. The network protocol vulnerability mining method based on hybrid mutation strategy according to claim 8 is characterized in that: The specific process of step 3 is as follows: Step 3.1: Parameterize the latent space vector as a Gaussian mixture model: Among them, g(z|μ i ,∑ i ) represents the Gaussian distribution N(μ i ,∑ i ) is the probability of getting data frame z, M represents the total number of Gaussian distributions, μ i represents the mean of the i-th Gaussian distribution, ∑ i represents the variance of the i-th Gaussian distribution; Step 3.2: Convert the data frame z into a differentiable variable by reparameterizing it, that is, writing each Gaussian distribution into a form containing a standard Gaussian distribution: z=μ i +s i ε,ε~N(0,1) Among them, μ i ,σ i are the weight parameters that adjust the Gaussian distribution to the standard Gaussian distribution, representing the mean and variance of the standard distribution respectively; ε represents the auxiliary noise variable; Step 3.3: The generative adversarial network model includes three generators and one discriminator. Three Gaussian sample sets after the reparameterization of the Gaussian mixture model are randomly extracted as inputs of the three generators respectively. Step 3.4: Set the training parameters of the generative adversarial network model, including the learning rate, boundary clipping weight, and training cycle; Divide the dataset generated by the generator and the three randomly selected Gaussian sample sets in step 3.3 into several datasets of equal size. Input the divided datasets into batches to the discriminator until all training data are input. This round of training ends. Step 3.5: Input the real sample dataset and the dataset generated by the generator into the discriminator at the same time until the generative adversarial network model reaches a stable model training state, and then end the training; The set of data frames generated by the three generators of the generative adversarial network model is used as the test dataset.

10. A network protocol vulnerability mining method based on a hybrid mutation strategy according to claim 9, characterized in that: The stopping condition of the iteration is: the information in the offline vulnerability knowledge base is no longer updated with new content or the new vulnerability triggering ratio is less than the set vulnerability triggering ratio.

Images