Training method for security test case mining model for mobile communication protocols

Abstract

The present invention provides a training method for a security test case mining model for a mobile communication protocol, wherein the security test case mining model is a BP neural network model, and the method comprises: S1, obtaining a known protocol attack mode in the mobile communication protocol, wherein the known protocol attack mode comprises a transmission process and transmission information of an attacked signaling, and an attack type corresponding to the attacked signaling; S2, based on the characteristics of mobile communication, obtaining a protocol feature vector corresponding to the attacked signaling in each known attack protocol mode according to the transmission process and transmission information of the attacked signaling in the known protocol attack mode, and forming a training set with the protocol feature vector corresponding to the attacked signaling as a sample and the attack type of the attacked signaling as a sample label; S3, performing multiple iterative training on the BP neural network model based on the training set obtained in step S2.

Description

Technical Field

[0001] The present invention relates to the field of information security, specifically, to the field of wireless communication information security, and more specifically, to a training method for a security test case mining model for a mobile communication protocol in the field of mobile communications, a security test case mining method and a system. Background Art

[0002] A security test case is a set of test inputs, execution steps, and expected results that verify whether the product meets the security requirement definition and product quality standards when product development is basically completed. Security test case generation technology is divided into two categories: black-box security test case generation technology and white-box security test case generation technology. Among them, the symbolic execution-based security test case generation method belongs to the white-box security test case generation technology, and the model-based, random test-based, and demand-based security test case generation methods all belong to the black-box security test case generation technology.

[0003] The security test case generation method based on symbolic execution refers to collecting constraints through symbolic execution of the software to be tested, and generating security test cases for each path with the help of a constraint solver.

[0004] The random test-based security test case generation method refers to an automated testing technology that generates security test cases by randomly generating test inputs on the input domain. For example, in reference [1], Mao et al. proposed an adaptive random security test case generation method in 2020, which not only ensures that the generated security test cases have high randomness but also ensures that the test cases are evenly distributed. For another example, in reference [2], Y. Hu et al. proposed a method of randomly generating a data sequence that conforms to the protocol data format as a test case in 2022, and inputting the test case into the cellular mobile network system, and verifying the validity of the test case by obtaining the message returned by the core network and monitoring the current status of the core network. Random testing is a simple and easy-to-implement test method that does not involve complex software requirements or internal program structure information. It only needs to randomly select test cases in the input domain.

[0005] The requirement-based security test case generation method refers to a method that analyzes the requirement documents of the system to be tested and derives security test cases. For example, in reference [3], in 2021, Y. Chen et al. used natural language processing and machine learning technology to intelligently analyze security standard documents, and successfully mined 42 attack behaviors of the cellular mobile network protocol of 4G LTE. Specifically, first, keywords extracted from a few known attack behaviors, such as "abort procedure" and "consider USIM", were used to learn words that are strongly related to them, such as "releaseresources" and "deactivate context". These words were then used to analyze the 3GPP LTE 24.301 document, that is, all sentences containing these words in the document were captured, and natural language processing was used to analyze the conditional statements and result statements in the long sentences. Then, the test case generation module was used to convert the sentence content into a test case, that is, a test case template that includes the four-tuple of participants, operations, information, and targets. Finally, after system verification and analysis, real and feasible attack behaviors were obtained.

[0006] The model-based test case generation method refers to a method of deriving test cases from the model by establishing an abstract description model of the expected behavior of the tested protocol or software. The models for test case generation are mainly divided into Unified Modeling Language (UML) state diagram, Finite State Machine (FSM) and Markov chain model. When deriving test cases based on the model diagram, search algorithms such as breadth-first, simulated annealing, particle swarm optimization and genetics can be used to achieve higher path coverage and an effective proportion of generated cases. When building the model, care should be taken to avoid problems such as low test efficiency and falling into a loop due to cyclic paths and redundant paths.

[0007] Although there are many methods for generating security test cases, these methods have the following defects:

[0008] 1. It is difficult to apply the security test case generation technology based on symbolic execution in practice;

[0009] 2. The test cases generated by the random test-based security test case generation technology are inefficient, have high test case redundancy and low coverage;

[0010] 3. The technical results of demand-based security test case generation are overly dependent on the requirements document and require a lot of internal information of the system being tested;

[0011] 4. The fitness function of the current security test case generation method based on the protocol model and its search algorithm is an artificially defined indicator, which cannot simultaneously take into account the two contradictory indicators of the effectiveness of the generated case and the coverage of the generated case. Therefore, it is necessary to solve how to automatically set the fitness function to balance the two contradictory problems of the effectiveness of the generated case and the coverage of the generated case.

[0012] References:

[0013] [1]Mao C, Wen L, Chen T Y. Adaptive random test case generation based on multi-objective evolutionary search [C / OL] / / 2020IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom).2020:46-53.DOI:10.1109 / TrustCom50675.2020.00020.

[0014] [2]Hu Y, Yang W, Cui B, et al. Fuzzing method based on selection mutation of partition weight table for 5g core network ngap protocol [M]. InnovativeMobile and Internet Services in Ubiquitous Computing, 2022

[0015] [3]Chen Y, Yao Y, Wang Summary of the invention

[0016] Therefore, the purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a training method for a security test case mining model, a security test case mining method and a system that can take into account both the efficiency and coverage of generated test cases.

[0017] According to a first aspect of the present invention, there is provided a training method for a security test case mining model for a mobile communication protocol, wherein the security test case mining model is a BP neural network model, and the method comprises: S1, obtaining a known protocol attack method in the mobile communication protocol, wherein the known protocol attack method comprises a transmission process and transmission information of the attacked signaling, and an attack type corresponding to the attacked signaling; S2, based on the characteristics of mobile communication, obtaining a protocol feature vector corresponding to the attacked signaling in each known attack protocol method according to the transmission process and transmission information of the attacked signaling in the known protocol attack method, and forming a training set with the protocol feature vector corresponding to the attacked signaling as a sample and the attack type of the attacked signaling as a sample label; S3, performing multiple iterative training on the BP neural network model based on the training set obtained in step S2.

[0018] Preferably, the mobile communication protocol is a 5G communication protocol.

[0019] Preferably, step S2 includes: S21, constructing an abstract feature tree based on the characteristics of the mobile communication protocol, the abstract feature tree including multiple feature constructors, each feature constructor corresponding to a feature object of the mobile communication protocol, and each feature constructor including multiple typed field nodes representing the state of its corresponding feature object; S22, according to each feature constructor, mapping the typed field attribute values ​​in the transmission information of the attacked signaling of a known protocol attack method to the corresponding typed field nodes in the abstract feature tree; S23, for a known protocol attack method, executing a tree construction action to traverse the abstract feature tree according to the corresponding transmission process of the attacked signaling to obtain a protocol feature vector composed of the typed field attribute values ​​of the attacked signaling.

[0020] In some embodiments of the present invention, the abstract feature tree includes: a feature constructor corresponding to the node state of a sender network element, a feature constructor corresponding to the node state of a receiver network element, and a sensitive information feature constructor.

[0021] Preferably, in step S23, for known protocol attack methods, based on the transmission path of the corresponding attacked signaling, starting from a single root node of the abstract feature tree, the abstract feature tree is traversed from top to bottom and from left to right.

[0022] Preferably, in step S3, the BP neural network is trained using the training set until a preset error is met or the number of iterations reaches a preset number. In some embodiments of the present invention, the preset error is 10-2 , the preset number of times is 5000.

[0023] Preferably, the training error of the BP neural network is calculated by the following function:

[0024]

[0025] Among them, C is the training error, y is the actual attack type vector corresponding to the known protocol attack method, It is the attack type vector output by the BP neural network for known protocol attack methods.

[0026] According to a second aspect of the present invention, a method for mining security test cases for mobile communication protocols is provided, the method comprising: T1, obtaining a complete set of mobile communication protocols for security test cases to be mined, the complete set of protocols containing transmission processes and transmission information of multiple protocol signalings; T2, obtaining a protocol feature vector of each protocol signaling in the complete set of protocols based on the characteristics of mobile communications; T3, using all protocol feature vectors obtained in step T2 as input of a mining model trained by the method described in the first aspect of the present invention, mining security test cases to obtain a processing result of whether each protocol signaling is at risk of being attacked, and generating security test cases with the transmission processes corresponding to the protocol signalings at risk of being attacked.

[0027] Preferably, step T2 includes: T21, mapping all protocol signaling in the protocol set to an abstract feature tree corresponding to the characteristic attributes of the mobile communication protocol, wherein the abstract feature tree includes multiple feature constructors, each feature constructor corresponds to a feature object of the mobile communication protocol, and each feature constructor includes multiple typed field nodes representing the state of its corresponding feature object, and the mapping of protocol signaling to the abstract feature tree is achieved by mapping the type field attribute value in the transmission information of the protocol signaling to the corresponding typed field node in the abstract feature tree; T22, for each protocol signaling, executing tree construction to traverse the abstract feature tree according to its corresponding transmission process to obtain the protocol feature vector composed of its corresponding typed field attribute value.

[0028] According to a third aspect of the present invention, there is provided a security test case mining system for mobile communication protocols, which is used to mine security test cases in the entire set of mobile communication protocols. The system comprises: a feature extraction module, which is used to obtain a protocol feature vector corresponding to each protocol signaling in the entire set of mobile communication protocols to be mined based on the feature attributes of the mobile communication protocol; a BP neural network model, which is used to perform security test case mining based on all protocol feature vectors to obtain whether each protocol signaling has a risk of being attacked, and to generate security test cases based on the transmission process corresponding to the protocol signaling that has a risk of being attacked, wherein the BP neural network model is trained using the method described in any one of claims 1 to 8.

[0029] Preferably, the feature extraction module includes: an abstract feature tree, which includes multiple feature constructors, each feature constructor corresponds to a feature object of the mobile communication protocol, and each feature constructor includes multiple typed field nodes representing the state of its corresponding feature object; a conversion system, which is used to execute a tree construction action for each protocol signaling according to its transmission process to traverse the abstract feature tree to traverse the abstract feature tree to obtain the protocol feature vector composed of its corresponding typed field attribute values.

[0030] Compared with the prior art, the advantages of the present invention are: the present invention introduces a BP neural network into the model-based test case generation method, realizes modeling by automatically setting a fitness function for existing 5G protocol attack methods, and predicts unknown protocol signaling based on the modeled BP neural network to generate possible security test cases. The generation of security test cases by the present invention can take into account both the efficiency and coverage of the generated test cases. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The embodiments of the present invention are further described below with reference to the accompanying drawings, in which:

[0032] Figure 1 A schematic diagram of a basic principle framework according to an embodiment of the present invention;

[0033] Figure 2 A schematic diagram of an abstract feature tree structure according to an embodiment of the present invention;

[0034] Figure 3 It is an example schematic diagram of BP neural network;

[0035] Figure 4 A schematic diagram of a BP neural network structure for 5G protocol attack mode mining established using MATLAB according to an embodiment of the present invention;

[0036] Figure 5It is a schematic diagram of regression results after using MATLAB to train a neural network for illegal interception signaling attacks according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail by specific embodiments below. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0038] At present, the fitness function of the model-based security test case generation method and its search algorithm is an artificially defined indicator, which cannot take into account the two contradictory indicators of the efficiency of the generated case and the coverage of the generated case. Therefore, in order to take into account both the efficiency and coverage of the generated case, the present invention introduces a BP neural network algorithm, which learns to predict whether all other paths in the communication protocol model are valid by learning the attack characteristics, so as to search for test cases that are more likely to produce attack effects under the premise of ensuring high coverage.

[0039] The present invention is described in detail below with reference to the accompanying drawings and embodiments, wherein the present invention is described using a 5G communication protocol system as a measured object.

[0040] In order to better understand the present invention, the inventive concept of the present invention is first introduced.

[0041] like Figure 1As shown, in the modeling (also called model training phase) stage, the present invention obtains ① information related to the attacked signaling (each known 5G protocol attack contains the transmission process and transmission information of the attacked signaling, as well as the attack type) through known 5G protocol attacks (known 5G protocol attacks are determined 5G protocol attack methods, and each 5G protocol attack method refers to a protocol process composed of one or more attacked signalings, and the execution of the protocol process triggers the attack to attack the attacked signaling. The security test case is to generate such a process to detect whether the execution of such a process in the tested protocol system will trigger an attack) and then extracts the attacked signaling and the transmission process, transmission information and corresponding attack type of the attacked signaling based on the feature extraction module, and uses the feature extraction module to extract ② the protocol features of the attacked signaling, and then uses the protocol features of the attacked signaling as samples and the attack types corresponding to the attacked signaling as labels to form a training set for ③ modeling a BP neural network model, and automatically generates the optimal fitness index by learning and modeling the known attacked signaling features, and classifies and predicts whether all other attack paths in the 5G protocol model are valid based on this fitness index. In the application stage, the present invention obtains the 5G protocol set of the tested 5G communication protocol system, which includes the transmission process and transmission information of multiple 5G protocol signalings, obtains ④ the signaling set from the 5G protocol set, still uses the feature extraction method to extract the protocol features corresponding to each protocol signaling and form ⑤ the protocol feature set, uses the trained BP neural network model to perform ⑥ prediction on each protocol feature in the protocol feature set to predict whether it is at risk of being attacked, generates a new 5G protocol attack method based on the transmission process of the protocol signaling that is at risk of being attacked, and uses it as a security test case to test the 5G communication protocol system.

[0042] The modeling stage and the application stage of the present invention are respectively introduced below in conjunction with specific embodiments.

[0043] 1. Modeling Phase

[0044] The main purpose of the modeling phase is to build a model based on known 5G protocol attack methods to predict whether the protocol signaling of the system under test is at risk of attack, including two stages: feature extraction of known 5G attack protocols and model training.

[0045] 1. Feature extraction of known 5G attack protocols

[0046] According to one embodiment of the present invention, a known 5G attack protocol is processed by a feature extraction module, wherein the feature extraction module includes two parts: an abstract feature tree and a conversion system. The abstract feature tree is composed of a plurality of feature constructors, wherein each node on the tree corresponds to a typed field in the constructor. In view of the characteristics of the 5G protocol, the feature constructor mainly includes a sender network element node state feature constructor, a receiver network element node state feature constructor, and a sensitive information feature constructor carried by the signaling. The three feature constructors are selected by analyzing the causes of illegal interception of signaling attacks, illegal forgery to initiate signaling attacks, and the use of signaling to initiate DDOS attacks, which can fully and clearly demonstrate the characteristics of attacks in the 5G protocol. For example, illegal interception of signaling attacks is mostly due to the fact that an attacker can be inserted into the transmission link between the sender network element node and the receiver network element node, and the signaling message transmitted between the sending and receiving nodes is intercepted as an intermediary, resulting in information inequality between the sending and receiving nodes, and resulting in attack effects such as being unable to page and unable to respond. This feature selection method based on known attacks avoids the problem of inefficiency caused by unclear features.

[0047] Each constructor includes multiple type fields, among which owl:thing is the root node; Sender_status is the root node of the sender network element, and below it are the sender network elements that may exist; receiver_status is the root node of the sender network element, and below it are the sender network elements that may exist; Sensitive_information is the root node of sensitive information, and below it are the sensitive information that may exist. The sender / receiver is a network element, and its typed fields include RAN, UE, SMF, UPF, AMF, OLD AMF, NEW AMF, UDM, UE deregistration, UE registration, etc. Sensitive information is the special information it carries that may cause attacks, such as null, 5G-GUTI or SUCI, SUPI, NF ID. Wherein, RAN represents radio access network, UE represents user terminal, UPF represents user plane function, AMF represents access and mobility management function, OLD AMF represents connected AMF, NEW AMF represents AMF to be connected, UDM represents unified data management function, UE deregistration represents user terminal deregistration, UE registration represents user terminal registration, Null represents no sensitive information, 5G-GUTI or SUCI represents globally unique temporary UE identifier or encrypted SUPI, SUPI represents 5G encrypted terminal identifier, and NF ID represents network function identity information. When constructing a feature function, some typed fields are used. According to an example of the present invention, such as Figure 2As shown in the figure, the sender network element node state feature constructor mainly includes typed fields such as SMF, UEderegistration, and Old AMF; the receiver network element node state feature constructor mainly includes type fields such as New AMF, UE registration, and RAN; the sensitive information feature constructor mainly includes typed fields such as SUCI or5G GUTI, NF ID, and SUPI.

[0048] The conversion system is used to map known 5G protocol attacks to an abstract feature tree through a series of tree construction actions, and extract the protocol features of the attacked signaling by traversing the abstract feature tree. According to the 3GPP regulations on the protocol, the protocol features of the signaling may include one or more typed fields in each constructor as its value. That is to say, each signaling is mapped to the abstract feature tree, and the protocol feature vector corresponding to each signaling can be obtained by traversing the abstract feature tree according to the signaling transmission process. According to one embodiment of the present invention, when performing a tree construction action for a known 5G protocol attack, the generation process starts with an initial derivation with a single root node, and traverses the abstract feature tree from top to bottom and from left to right to form a concrete protocol feature vector corresponding to the attacked signaling, avoiding missing possible protocol features and improving the prediction accuracy of the training model.

[0049] 2. Model training

[0050] According to one embodiment of the present invention, the present invention adopts a BP neural network model for modeling. The BP model is a feedforward neural network based on error back propagation, which has a strong generalization ability. Therefore, the present invention adopts a BP model for modeling. Based on the modeled BP model, the protocol characteristics of unknown interactive signaling are input. The output result calculated by the model can be used to judge whether the signaling with the protocol characteristics has a security risk of being exploited by an attacker, thereby realizing the mining of attack methods for the 5G protocol.

[0051] In order to better understand the present invention, the principle of the BP neural network model is briefly introduced below.

[0052] The so-called BP neural network model refers to a neural network model that uses the back propagation algorithm, in which the so-called back propagation (BP) algorithm is a commonly used neural network algorithm that can adjust the weights and biases between the internal neural node connections by processing and learning the extracted features, and train a neural network model that meets the expectations. The BP algorithm was first proposed by Webers in 1974, and has many advantages such as high adaptive autonomous learning ability and strong generalization ability. High adaptive autonomous learning ability means that the BP algorithm can continuously and autonomously iterate according to preset requirements to optimize the weights and bias parameters between nodes in the mathematical model to achieve the expected output results. Strong generalization ability means that after the BP algorithm trains a certain neural network model, it can classify and predict the newly input unknown feature data, that is, the learned old knowledge can be applied to the solution of new problems. It can be seen that based on the autonomous learning ability and generalization ability of the BP algorithm, the BP algorithm is very suitable for solving the problem of attack mode mining for the 5G protocol. That is, the BP algorithm can train a model for active attack on the 5G protocol by adaptively learning the parameters between the neural nodes based on the feature input of the known 5G protocol active attack. Based on the generalization ability of the BP algorithm, the newly input unknown protocol features are classified to predict whether the signaling with the protocol features has security risks that can be exploited by active attackers, thereby realizing the mining of attack methods for 5G protocols.

[0053] The learning process of the neural network model based on the BP algorithm is mainly divided into two steps. The first step is the forward propagation of the signal, and the second step is the back propagation of the error. Figure 3 What is shown is an exemplary BP neural network structure diagram, which includes an input layer, two middle layers (also called hidden layers), and an output layer. However, it should be noted that the BP neural network is not limited to two middle layers. The present invention takes two middle layers as an example to illustrate the learning process of the BP neural network.

[0054] In the BP neural network model, the process of forward propagation of the signal is the process of passing the input to the output layer after being processed by each hidden layer. If the error between the output result of the output layer and the expected result is less than the expected error target, the iteration is stopped. If the target is not reached, the error back propagation process is performed, that is, the output error is reversely processed by each hidden layer until it reaches the input layer. In this process, the weights and bias parameters of each neural node are adjusted according to the output error. After continuous iteration of the two steps of forward signal propagation and error back propagation, the output result of the output layer continues to approach the expected result until the expected error is met or the number of iterations reaches the pre-set number of learning times.

[0055] Taking the 5G protocol in the above embodiment as an example, based on the feature extraction of active attacks on known 5G protocols, the protocol features of each attack are used as the input of the BP algorithm, which mainly includes the state of the sender network element node, the state of the attacker network element node, and the sensitive information carried. The input sample can be expressed as The attack type is defined as the output y of the BP algorithm.

[0056] In the forward propagation process of the signal, assuming that there are N-1 neurons in the first hidden layer, the corresponding weight W (1) With deviation b (1) They are:

[0057]

[0058] b (1) =[b 1 ,b 2 ,…,b N-1 ]

[0059] Then the input Z of the first hidden layer is (1) for:

[0060]

[0061] After the activation function f(x), the output of the first hidden layer is f(Z (1) ), where the expression of the activation function f(x) is:

[0062]

[0063] Similarly, in order to output a y value, the second hidden layer is set with 1 neuron, and the corresponding weight W (1) With deviation b (1) They are:

[0064] W (2) =[ω(1,N)ω(2,N)…ω(N-1,N)]

[0065] b (2) =[b N ]

[0066] Then the output of the second hidden layer is for:

[0067]

[0068] The final error function C between the model’s predicted output and the expected output y is defined as:

[0069]

[0070] The forward propagation process of the signal ends. If the error function C is greater than the expected error target and the number of iterations does not exceed the preset number of learning times, the error reverse propagation process is performed.

[0071] During the back propagation of the error, the weights and biases of each neuron node need to be adjusted according to the error function. The parameter adjustment formula for the second hidden layer is:

[0072]

[0073]

[0074] where α is the learning rate and α∈{0,1}, In order to seek partial guidance.

[0075] According to the error function, the parameter adjustment formula of the first hidden layer is:

[0076]

[0077]

[0078] At this point, the error back propagation process is completed. According to the adjusted weight and bias parameters, the signal forward propagation process is performed again, and the error value is obtained again until the expected error is met or the number of iterations reaches the preset learning times. The feature learning process of the known protocol attack is completed, and the corresponding fitness function is modeled.

[0079] According to one embodiment of the present invention, the preset number of learning times is 5000 and the error target is 10 -2 , the learning rate is set to 0.1.

[0080] Based on the above characteristics of the BP neural network, the protocol feature vectors corresponding to the attacked signaling in the known 5G protocol attacks are used as samples, and the attack types corresponding to the attacked signaling are used as labels to train and model the BP neural network model. In this way, a model can be obtained that can predict whether there is a risk of attack based on the protocol characteristics of unknown 5G protocol signaling.

[0081] 2. Application Phase

[0082] After modeling in the modeling phase, a trained BP neural network model is obtained and used to predict the attack risk of unknown 5G protocol signaling.

[0083] First, the full set of 5G protocols corresponding to the 5G system to be detected is mapped to the abstract feature tree, and the protocol feature vectors corresponding to all protocol signaling are obtained to form the full set of protocol features. The mapping process is consistent with the previous training process and will not be repeated here.

[0084] Then, based on the complete set of protocol features obtained, each protocol feature vector is used as the input of the trained BP neural network model to obtain the prediction result of whether the protocol signaling corresponding to each protocol feature vector is at risk of attack. Security test cases can be generated based on the transmission process of the protocol signaling that is at risk of attack.

[0085] In order to better illustrate the effect of the present invention, the present invention verifies the coverage and efficiency of the security test cases generated based on the present invention through experiments and simulations.

[0086] First, the present invention uses the method of the present invention to perform simulation mining experiments in the protocol signaling set consisting of a total of 69 protocol signalings of the 5G protocol. The experimental results are shown in Table 1.

[0087] Table 1

[0088]

[0089] As can be seen from Table 1, the experimental results include 17 attacks that are indeed feasible and have produced specific attack effects, and 8 are current attack methods that cannot be implemented, or there are specific defense measures in the mobile communication device. Therefore, the present invention mines the full set of 5G protocols and generates 25 security test cases. Since the test cases are generated for the full set of 5G protocols, the 25 test cases are a risk full set with high coverage. Since the present invention learns from known attack features, the subset of 25 test cases has certain security risks, and it has been verified by experiments that most of the subsets of test cases are indeed feasible and have produced specific attack effects. Therefore, the present invention takes into account the efficiency of generating use cases under the premise of high coverage. It can be seen from the simulation running time that the present invention can generate more security test cases in a shorter time, and the security test cases are highly effective, and most of the security test cases can be applied in practice. It can be seen that the present invention takes into account the efficiency of generating use cases under the premise of high coverage, and achieves the purpose of balancing the two contradictory problems of the efficiency of generating use cases and the coverage of generating use cases.

[0090] Then, the present invention uses MATLAB to perform simulation of the present invention.

[0091] Figure 4 The BP neural network structure for 5G protocol attack mining established by MATLAB is shown. The number of input values ​​of the neural network is 5, the number of hidden layers is 7, and the training parameters of the neural network are set as follows: the number of iterations is 5000, the error target is 10 -2 , learning rate 0.1.

[0092] Figure 5 The regression results after using MATLAB to train the neural network for illegal interception signaling attacks are shown in the figure. Figure 5 (a) is the mean square error graph of the network output, Figure 5 (b) The model correlation coefficient R is represented in the figure. The correlation coefficient of the model is also called goodness of fit. The larger the correlation coefficient, the higher the degree of explanation of the independent variable to the dependent variable, the higher the percentage of the change caused by the independent variable in the total change, the denser the observation points are near the regression line, and the range of the correlation coefficient is within [0,1]. The closer to 1, the better the performance of the model, and the closer to 0, the worse the performance. Figure 5 (a) It can be seen that after 87 learning iterations, the mean square error of the output is reduced to 10 -1 The following is because the iteration is stopped because the mean square error has not decreased for multiple consecutive times. The default in MATLAB is 6 times. And the correlation coefficient of the results calculated by the model is 0.98714, which is very close to 1. It can be seen that the model can predict the results well.

[0093] Based on the BP neural network model built using MATLAB, the protocol signaling of the five processes of user registration, user-side deregistration, network-side deregistration, user-side service request, and network-side service request in the TS 23.502 document in the 5G protocol is classified and predicted, and security test cases that may have the risk of illegal interception in addition to known risks are generated. The results are shown in Table 2.

[0094] Table 2

[0095]

[0096] As can be seen from Table 2, the present invention predicts 11 security test cases that may be illegally intercepted in addition to known risks, which fully demonstrates the security test case mining capability of the present invention.

[0097] As we all know, the mobile communication system is a very complex system. Due to the excessive number of states in the system, the existing mining methods for security test cases of mobile communication systems (such as state diagrams, Markov chains) have state explosions. Therefore, when using such mining methods, it is often necessary to simplify such models, and some special cases / details may be lost in the process of simplification. The present invention uses the full set of 5G protocols, inputs every possible signaling process, and does not require simplification, so the coverage rate is higher than that of existing mining methods. In addition, the present invention uses a BP neural network, which can learn known attacks based on the extremely strong generalization ability of the BP neural network. Using the characteristic function given by the present invention, when modeling for the risk of illegal interception, based on the previous embodiment, it can be seen that the correlation coefficient is 0.98174, so the characteristic function under this modeling is strongly correlated with the risk of illegal interception. Therefore, the security test cases mined based on the present invention have the characteristics of high effectiveness.

[0098] In summary, the present invention introduces a BP neural network into the model-based test case generation method to achieve modeling by automatically setting a fitness function for existing 5G protocol attack methods, and predicts unknown protocol signaling based on the modeled BP neural network to generate possible security test cases. The generation of security test cases using the present invention can take into account both the efficiency and coverage of the generated test cases.

[0099] It should be noted that although the above describes the various steps in a specific order, it does not mean that the various steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently or even in a different order as long as the required functions can be achieved.

[0100] The present invention may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0101] Computer readable storage medium can be a tangible device that holds and stores instructions used by an instruction execution device. Computer readable storage medium can include, for example, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a protruding structure in a groove on which instructions are stored, and any suitable combination thereof.

[0102] The embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A training method for a security test case mining model for a mobile communication protocol, wherein the security test case mining model is a BP neural network model, characterized in that: The method comprises: S1. Acquire a known protocol attack method in a mobile communication protocol, wherein the known protocol attack method includes a transmission process and transmission information of the attacked signaling, and an attack type corresponding to the attacked signaling; S2. Based on the characteristics of mobile communications, according to the transmission process and transmission information of the attacked signaling in the known protocol attack mode, the protocol feature vector corresponding to the attacked signaling in each known attack protocol mode is obtained, and the protocol feature vector corresponding to the attacked signaling is used as a sample and the attack type of the attacked signaling is used as a sample label to form a training set; wherein, the step S2 includes: S21. Based on the features of the mobile communication protocol, construct an abstract feature tree, wherein the abstract feature tree includes a plurality of feature constructors, each of which corresponds to a feature object of the mobile communication protocol, and each of which includes a plurality of typed field nodes representing the state of the corresponding feature object; S22, according to each feature constructor, mapping the typed field attribute value in the transmission information of the attacked signaling of the known protocol attack mode to the corresponding typed field node in the abstract feature tree; S23, for a known protocol attack method, execute a tree construction action to traverse the abstract feature tree according to the corresponding transmission process of the attacked signaling to obtain a protocol feature vector composed of typed field attribute values ​​of the attacked signaling; S3, based on the training set obtained in step S2, the BP neural network model is trained for multiple iterations, wherein the BP neural network is trained using the training set until a preset error is met or the number of iterations reaches a preset number, wherein the preset number is 5000 and the preset error is 10 -2 The training error of the BP neural network is calculated as follows: Among them, C is the training error, y is the actual attack type vector corresponding to the known protocol attack method, It is the attack type vector output by the BP neural network for known protocol attack methods.

2. The method according to claim 1, characterized in that The mobile communication protocol is a 5G communication protocol.

3. The method according to claim 2, characterized in that The abstract feature tree includes: The feature constructor corresponding to the sender network element node state, the feature constructor corresponding to the receiver network element node state, and the sensitive information feature constructor.

4. The method according to claim 3, characterized in that In the step S23, for known protocol attack methods, based on the transmission path of the corresponding attacked signaling, starting from a single root node of the abstract feature tree, the abstract feature tree is traversed from top to bottom and from left to right.

5. A method for mining security test cases for mobile communication protocols, characterized in that: The method comprises: T1. Obtain a complete set of mobile communication protocols for security test cases to be mined, wherein the complete set of protocols includes transmission processes and transmission information of multiple protocol signaling; T2, based on the characteristics of mobile communications, the protocol feature vector of each protocol signaling in the protocol set is obtained; T3. Using all protocol feature vectors obtained in step T2 as input to the mining model trained by the method as described in any one of claims 1 to 4, perform security test case mining to obtain the processing results of whether each protocol signaling is at risk of being attacked, and generate security test cases based on the transmission process corresponding to the protocol signaling that is at risk of being attacked.

6. The method according to claim 5, characterized in that The step T2 comprises: T21. Map all protocol signaling in the protocol set to an abstract feature tree corresponding to the feature attributes of the mobile communication protocol, wherein the abstract feature tree includes a plurality of feature constructors, each of which corresponds to a feature object of the mobile communication protocol, and each of which includes a plurality of typed field nodes representing the state of its corresponding feature object, and the mapping of the protocol signaling to the abstract feature tree is achieved by mapping the type field attribute value in the transmission information of the protocol signaling to the corresponding typed field node in the abstract feature tree; T22. For each protocol signaling, execute tree construction to traverse the abstract feature tree according to its corresponding transmission process to obtain the protocol feature vector composed of its corresponding typed field attribute values.

7. A security test case mining system for mobile communication protocols, used to mine security test cases in the entire set of mobile communication protocols, characterized in that: The system comprises: A feature extraction module, used for obtaining a protocol feature vector corresponding to each protocol signaling in the full set of mobile communication protocols to be mined based on the feature attributes of the mobile communication protocol; A BP neural network model is used to mine security test cases based on all protocol feature vectors to determine whether each protocol signaling is at risk of being attacked, and to generate security test cases based on the transmission process corresponding to the protocol signaling at risk of being attacked, wherein the BP neural network model is trained using the method described in any one of claims 1 to 4.

8. The system according to claim 7, characterized in that The feature extraction module comprises: An abstract feature tree, comprising a plurality of feature constructors, each of which corresponds to a feature object of a mobile communication protocol, and each of which comprises a plurality of typed field nodes representing states of the corresponding feature object; The conversion system is used to perform a tree construction action for each protocol signaling according to its transmission process to traverse the abstract feature tree to obtain a protocol feature vector composed of its corresponding typed field attribute values.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program can be executed by a processor to implement the steps of any method described in claims 1-4, 5-6.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the electronic device to implement the steps of the method as described in any one of claims 1-4, 5-6.

Images