Vulnerability security detection method, device, equipment and storage medium

Abstract

The present application discloses a vulnerability security detection method, device, equipment and storage medium, the vulnerability security detection method comprising: obtaining the interaction messages between components in the network protocol of a preset mobile communication network simulation model; determining the control flow message state transition diagram of the network protocol based on the interaction messages; mutating the control flow messages in the control flow message state transition diagram based on a preset mutation algorithm, and detecting whether the control flow messages after mutation are abnormal, generating corresponding test cases; executing and verifying the test cases to obtain detection results. The present application performs vulnerability testing on a pre-built mobile communication network simulation model, obtains the control flow message state transition diagram for testing by analyzing the message sequence of the interaction between the components of the model, and realizes comprehensive mining of vulnerabilities by mutating the control flow messages, thereby detecting more types of vulnerabilities and improving the practicality and efficiency of vulnerability detection.

Description

Technical Field

[0001] The present application relates to the technical field of mobile communication network security detection, and in particular to a vulnerability security detection method, device, equipment and storage medium. Background Art

[0002] With the development of mobile communication networks, in addition to traditional voice and data services, users also focus on multimedia services, Internet services, e-commerce and other information services. In such a large environment, the work of detecting security issues in mobile communication networks is becoming increasingly important.

[0003] In the prior art, referring to the application number 202110890726.7, a 4G and 5G air interface attack vulnerability method based on signal and signaling fingerprint is proposed. The method first searches for the signal in a certain network area on the terminal, and extracts the EARFCN (E-UTRA Absolute Radio Frequency Channel Number) and PCI (Peripheral Component Interconnect) in the target protection area network, and initiates an authentication request to obtain the signaling fingerprint and signal fingerprint corresponding to EARFCN and PCI, and then compares it with the normal signaling fingerprint and signal fingerprint to determine whether the network in the area is under attack. However, since it uses 5G network hardware equipment to detect vulnerabilities in a real network environment, it is only possible to detect the vulnerability after passively waiting for hacker attacks, and it cannot be effectively evaluated. In addition, this method can only detect one type of air interface vulnerability in the 5G network, and cannot detect more types of vulnerabilities, resulting in poor practicality and low efficiency of vulnerability detection. Summary of the invention

[0004] The main purpose of this application is to provide a vulnerability security detection method, device, equipment and storage medium, aiming to solve the technical problems of poor practicality and low efficiency of vulnerability detection in the prior art.

[0005] To achieve the above objectives, the present application provides a vulnerability security detection method, which includes:

[0006] Obtaining interaction messages between components in a network protocol of a preset mobile communication network simulation model;

[0007] Based on the interaction message, determining a control flow message state transition diagram of the network protocol;

[0008] Based on a preset mutation algorithm, the control flow message in the control flow message state transition diagram is mutated, and whether the mutated control flow message is abnormal is detected, and a corresponding test case is generated;

[0009] Execute and verify the test case to obtain the test result.

[0010] Optionally, the step of determining a control flow message state transition diagram of the network protocol based on the interaction message includes:

[0011] Determining an interactive data packet containing the interactive message in the network protocol;

[0012] A graph attribute analysis is performed on the interactive data packet to obtain a graph attribute vector, and based on the graph attribute vector, a control flow message state transition graph of the network protocol is determined.

[0013] Optionally, the step of performing graph attribute analysis on the interactive data packet to obtain a graph attribute vector, and determining a control flow message state transition graph of the network protocol based on the graph attribute vector includes:

[0014] Performing coarse-grained analysis on the interactive data packet to obtain a control flow vector;

[0015] Performing fine-grained analysis on the interactive data packets to obtain the state vector of each component and the direction vector of message transmission between the components;

[0016] Based on the control flow vector, the state vector and the direction vector, a control flow message state transition diagram of the network protocol is composed.

[0017] Optionally, the step of mutating the control flow message in the control flow message state transition diagram based on a preset mutation algorithm, detecting whether the mutated control flow message is abnormal, and generating a corresponding test case includes:

[0018] Based on a preset mutation algorithm, the control flow messages in the control flow message state transition diagram are mutated in execution order and message value, and whether the mutated control flow messages are abnormal is detected to obtain a first mutation result;

[0019] The first mutation results are screened, and abnormal results in the first mutation results are determined as test cases.

[0020] Optionally, the step of performing execution order mutation and message value mutation on the control flow messages in the control flow message state transition diagram based on a preset mutation algorithm, and detecting whether the control flow messages after mutation are abnormal, to obtain a first mutation result includes:

[0021] Based on a preset mutation algorithm, the execution order of the control flow messages in the control flow message state transition diagram is fully randomized, and whether the control flow messages after mutation are abnormal is detected to obtain a second mutation result;

[0022] Randomizing the message value of the control flow message in the control flow message state transition diagram, and detecting whether the mutated control flow message is abnormal, to obtain a third mutation result;

[0023] Randomizing the execution order and message values ​​of the control flow messages in the control flow message state transition diagram at the same time, and detecting whether the mutated control flow messages are abnormal, to obtain a fourth mutation result;

[0024] Based on the second variation result, the third variation result and the fourth variation result, a first variation result is composed.

[0025] Optionally, the step of executing and verifying the test case to obtain a test result includes:

[0026] Execute the test case and obtain an abnormal test result;

[0027] Analyze the abnormal test results to obtain information on the vulnerability attack principle that caused the abnormality;

[0028] Based on the vulnerability attack principle information, an attack instruction is determined, and the attack instruction is executed in the mobile communication network simulation model to obtain a detection result.

[0029] Optionally, the step of determining corresponding attack instructions based on the vulnerability attack principle, and executing the attack instructions in the mobile communication network simulation model to obtain a detection result includes:

[0030] Based on the vulnerability attack principle, call the corresponding attack instruction in the preset instruction attack library;

[0031] The attack instruction is executed in the mobile communication network simulation model, and the communication of the mobile communication network simulation model is monitored to see whether it is abnormal, so as to obtain a detection result.

[0032] The present application also provides a vulnerability security detection device, the vulnerability security detection device comprising:

[0033] An acquisition module, used to acquire interaction messages between components in a network protocol of a preset mobile communication network simulation model;

[0034] A determination module, configured to determine a control flow message state transition diagram of the network protocol based on the interaction message;

[0035] A mutation module, used to mutate the control flow message in the control flow message state transition diagram based on a preset mutation algorithm, detect whether the control flow message after mutation is abnormal, and generate corresponding test cases;

[0036] The verification module is used to execute and verify the test case to obtain the test result.

[0037] The present application also provides a vulnerability security detection device, the vulnerability security detection device comprising: a memory, a processor, and a program stored in the memory for implementing the vulnerability security detection method.

[0038] The memory is used to store a program for implementing a vulnerability security detection method;

[0039] The processor is used to execute a program for implementing the vulnerability security detection method to implement the steps of the vulnerability security detection method.

[0040] The present application also provides a storage medium, on which is stored a program for implementing the vulnerability security detection method, and the program for implementing the vulnerability security detection method is executed by a processor to implement the steps of the vulnerability security detection method.

[0041] The vulnerability security detection method, device, equipment and storage medium provided by the present application are compared with the prior art that can only detect the vulnerability passively after waiting for hacker attacks, cannot effectively evaluate it, and can only detect one air interface vulnerability in the mobile communication network, cannot detect more types of vulnerabilities, resulting in poor practicality and low efficiency of vulnerability detection. In the present application, the interactive messages between the components in the network protocol of the preset mobile communication network simulation model are obtained; based on the interactive messages, the control flow message state transition diagram of the network protocol is determined; based on the preset mutation algorithm, the control flow message in the control flow message state transition diagram is mutated, and whether the control flow message after mutation is abnormal is detected, and the corresponding test case is generated; the test case is executed and verified to obtain the detection result. That is, in the present application, the vulnerability test is performed on the pre-built mobile communication network simulation model, and the control flow message state transition diagram for testing is obtained by analyzing the message sequence of the interaction between the components of the model, and the comprehensive mining of the vulnerability is realized by mutating the control flow message, so that more types of vulnerabilities can be detected, and the practicality and efficiency of vulnerability detection are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art description will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0043] Figure 1 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application;

[0044] Figure 2 This is a flow chart of the first embodiment of the vulnerability security detection method of the present application;

[0045] Figure 3 This is a module diagram of the vulnerability security detection device of this application;

[0046] Figure 4 5G control flow state transition diagram for vulnerability security detection method of this application;

[0047] Figure 5 Pseudo code of the control flow message mutation algorithm based on the control flow state diagram of the vulnerability security detection method of this application;

[0048] Figure 6 A flowchart of a vulnerability verification method in the vulnerability security detection method of this application;

[0049] Figure 7 This is a flow chart of the second embodiment of the vulnerability security detection method of the present application.

[0050] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] like Figure 1 As shown, Figure 1 It is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiment of the present application.

[0053] The terminal in the embodiment of the present application can be a PC, or it can be a smart phone, a tablet computer, an e-book reader, an MP3 (Moving Picture Experts Group Audio Layer III) player, an MP4 (Moving Picture Experts Group Audio Layer IV) player, a portable computer, or other portable terminal devices with display function.

[0054] like Figure 1 As shown, the terminal may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0055] Optionally, the terminal may also include a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, and the like. Among them, sensors include light sensors, motion sensors, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display screen according to the brightness of the ambient light, and the proximity sensor may turn off the display screen and / or backlight when the mobile terminal is moved to the ear. As a type of motion sensor, the gravity acceleration sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile terminal (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; of course, the mobile terminal may also be equipped with other sensors such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., which will not be repeated here.

[0056] Those skilled in the art will understand that Figure 1 The terminal structure shown in the figure does not constitute a limitation on the terminal, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0057] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating device, a network communication module, a user interface module, and a vulnerability security detection program.

[0058] exist Figure 1 In the terminal shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the vulnerability security detection program stored in the memory 1005.

[0059] Reference Figure 2 The present application embodiment provides a vulnerability security detection method, the vulnerability security detection method comprising:

[0060] Step S100, obtaining interaction messages between components in a network protocol of a preset mobile communication network simulation model;

[0061] Step S200, determining a control flow message state transition diagram of the network protocol based on the interaction message;

[0062] Step S300, based on a preset mutation algorithm, mutate the control flow message in the control flow message state transition diagram, detect whether the mutated control flow message is abnormal, and generate a corresponding test case;

[0063] Step S400, execute and verify the test case to obtain a test result.

[0064] In this embodiment, the specific application scenario may be:

[0065] In the prior art, vulnerability security detection of mobile communication networks is usually performed by searching for signals in a certain network area on the terminal, extracting EARFCN and PCI in the target protection zone network, and periodically initiating authentication requests to obtain the signaling fingerprint and signal fingerprint corresponding to EARFCN and PCI, and then comparing them with normal signaling fingerprints and signal fingerprints to determine whether the network in the area is under attack. However, since it uses 5G network hardware equipment to perform vulnerability detection in a real network environment, it is only possible to detect the vulnerability after passively waiting for hacker attacks, and it is impossible to effectively evaluate it. In addition, this method can only detect one type of air interface vulnerability in the 5G network, and cannot detect more types of vulnerabilities, resulting in poor practicality and low efficiency of vulnerability detection.

[0066] The specific steps are as follows:

[0067] Step S100, obtaining interaction messages between components in a network protocol of a preset mobile communication network simulation model;

[0068] In this embodiment, the vulnerability security detection method is applied to a vulnerability security detection device.

[0069] In this embodiment, the mobile communication network simulation model is a model designed to simulate the communication interaction of the mobile communication network, and is a pre-designed model. The mobile communication network simulation model includes but is not limited to a simulation model of a 4G environment and a simulation model of a 5G environment. The mobile communication network simulation model includes UE (user terminal), gNB (the nextGeneration NodeB, base station) and a core network. Preferably, in this embodiment, a simulation model of a 5G environment is adopted, wherein the simulation model of the 5G environment utilizes the open source software free5GC to simulate the 5G core network, utilizes the open source software UERANSIM to simulate the 5GUE and gNB, and through a certain configuration, the three can be interconnected to obtain a simulation model of the 5G environment, that is, the preset mobile communication network simulation model.

[0070] In this embodiment, the device performs vulnerability detection through the preset mobile communication network simulation model, can conduct active attack experiments, and conduct comprehensive active attacks to detect comprehensive vulnerability information, thereby improving the practicality and efficiency of vulnerability detection.

[0071] In this embodiment, the network protocol is a set of rules, standards or agreements established for data exchange in a computer network. The network protocols adopted by different communication networks are also different, such as mobile communication network protocols, industrial control protocols, and OSI network protocols. Preferably, this embodiment adopts a mobile communication network protocol, wherein the network protocol includes information about each component of a mobile communication network simulation model and interaction messages between components. For example, the simulation model of a 5G environment includes components UE and gNB-DU (gNB Distributed Unit). The interaction message between UE and gNB-DU includes RRC Setup Request, which is a UE sending an RRC (Radio Resource Control) connection request message to gNB-DU.

[0072] In this embodiment, the device obtains the interaction messages between the components in the network protocol of the preset mobile communication network simulation model by performing protocol detection on the mobile communication network simulation model through the set protocol detection module, or by uploading the network protocol information therein to the device when constructing the mobile communication network simulation model.

[0073] Step S200, determining a control flow message state transition diagram of the network protocol based on the interaction message;

[0074] In this embodiment, the control flow message state transition diagram is an abstract representation of a process or program, which is often represented in the form of a data structure chain, and is a diagram showing the state transition of control flow messages between components in a network protocol. The control flow message state transition diagram is presented in the form of a diagram that can be recognized by a computer, and is composed of control flow vectors, state vectors, and direction vectors of message transmission of each component. Specifically, refer to Figure 4 , Figure 4 The control flow state transition diagram in the network protocol of the simulation model of the 5G environment is shown in Table 1 below. Figure 4 Table 2 is a table of related symbols. Figure 4 A table of related information:

[0075]

[0076] Table 1

[0077]

[0078]

[0079]

[0080] Table 2

[0081] In this embodiment, the device determines the control flow message state transition diagram of the network protocol based on the interactive message. Among them, the 5G protocol also has a "four-way handshake" similar to the Stream Control Transmission Protocol SCTP protocol to establish a connection between two endpoints. This application analyzes the control flow message sequence of the interaction between each component in the 5G network protocol, and extracts a control flow message state transition diagram suitable for 5G network fuzz testing. It can be understood that the control flow message state transition diagram corresponding to the network protocol is also used in other network protocols.

[0082] In this application, a general method for extracting state diagrams from network protocols is proposed and applied to 5G network protocols. By analyzing the control flow message sequences of interactions between components in the 5G network protocol, a control flow message state transition diagram suitable for 5G network fuzz testing is extracted. Based on this state diagram, the messages of state changes in each component and the overall process of changes in the entire system as the states of each component change can be clearly observed.

[0083] Specifically, the step S200 includes the following steps S210-S220:

[0084] Step S210, determining an interactive data packet containing the interactive message in the network protocol;

[0085] In this embodiment, the network protocol contains an interactive data packet of interactive messages between various components, and the device obtains the interactive data packet based on the network protocol.

[0086] Step S220, performing graph attribute analysis on the interactive data packet to obtain a graph attribute vector, and determining a control flow message state transition graph of the network protocol based on the graph attribute vector.

[0087] In this embodiment, the device analyzes the interactive data packet to obtain a graph attribute vector in the network protocol, wherein the graph attribute vector includes a control flow vector, a state vector, and a direction vector, etc., and thereby obtains a control flow message state transition graph of the network protocol.

[0088] Specifically, the step S220 includes the following steps S221-S223:

[0089] Step S221, performing coarse-grained analysis on the interactive data packet to obtain a control flow vector;

[0090] In this embodiment, the device performs a coarse-grained analysis on the interactive data packet, which may be performed by using wireshark to capture the interactive data packets between the UE, gNB, and core network in the 5G simulation environment. The device locates the control flow message in the source code based on the interactive data packet, that is, Figure 4 The circle is divided into control flow messages.

[0091] Step S222, performing fine-grained analysis on the interactive data packet to obtain the state vector of each component and the direction vector of message transmission between components.

[0092] In this embodiment, the device also performs a fine-grained analysis on the interactive data packet to obtain the state vector of each component and the direction vector of the message transmission between each component. Specifically, each interactive message in the interactive data packet is printed into the log to perform a more fine-grained analysis on the interaction between the components in the network protocol to obtain the state vector of each component and the direction vector of the message transmission between each component, that is, Figure 4 The solid and dashed lines between the control flow messages.

[0093] Step S223: Based on the control flow vector, the state vector and the direction vector, a control flow message state transition diagram of the network protocol is formed.

[0094] In this embodiment, the device composes a control flow message state transition diagram of the network protocol based on the control flow vector, the state vector and the direction vector.

[0095] Step S300, based on a preset mutation algorithm, mutate the control flow message in the control flow message state transition diagram, detect whether the mutated control flow message is abnormal, and generate a corresponding test case;

[0096] In this embodiment, the mutation algorithm is an algorithm for mutating the control flow messages in the control flow message state transition diagram. By mutation, that is, changing the state of the control flow messages in the control flow message state transition diagram, it is detected whether the communication is normal after the control flow message state is changed, so as to perform vulnerability testing on the mobile communication network simulation model. If an abnormality occurs, the state of the abnormal control flow message is recorded, and further verification testing is performed to detect the vulnerability.

[0097] Specifically, the step S300 includes the following steps S310-S320:

[0098] Step S310, based on a preset mutation algorithm, performing execution order mutation and message value mutation on the control flow messages in the control flow message state transition diagram, and detecting whether the control flow messages after mutation are abnormal, to obtain a first mutation result;

[0099] In this embodiment, the device performs execution order mutation and message value mutation on the control flow messages in the control flow message state transition diagram based on a preset mutation algorithm, and detects whether the control flow messages are abnormal after the mutation. Since most of the latest research methods on 5G vulnerabilities are still theoretically analyzed at the protocol level, the impact of changes in the execution order of 5G control flow sequences on 5G vulnerability detection is not considered. This method performs vulnerability testing on the 5G simulation model by performing execution order mutation and message value mutation on the control flow messages in the control flow message state transition diagram obtained between 5G components to obtain the first mutation result, wherein the first mutation result includes the result of whether the control flow message is abnormal after each mutation. For example, there are three control flow messages A, B, and C in the 5G control flow message state transition diagram, the normal execution order is ABC, and the execution order after mutation is ACB. The mutated control flow message is detected, and the result of this mutation is normal.

[0100] Specifically, the step S310 includes the following steps S311-S314:

[0101] Step S311, based on a preset mutation algorithm, the execution order of the control flow messages in the control flow message state transition diagram is fully randomized, and whether the mutated control flow messages are abnormal is detected to obtain a second mutation result;

[0102] In this embodiment, refer to Figure 5 , Figure 5It is a preset mutation algorithm. The algorithm first defines and executes the INITIALIZE initialization procedure for the four input objects G, v, ω and γ. The four input objects G, v, ω and γ are the control flow state graph, the initial state of the graph, the currently executed control flow path and the currently detected abnormal path. The definition of G is map <String v0,<Edege e,String v1> >, indicating that Figure 4 In the control flow state diagram shown in the figure, e represents the edge of states v0 and v1 in the state diagram, v is defined as string, which represents the initial state of the state diagram, ω and γ are both defined as List, ω represents the currently executed control flow path, and γ represents the currently detected abnormal path, that is, the detected vulnerability list. During the initialization process, a message will be recorded for each component. During the recording, we do not care what messages the program records, but simply copy and extract the messages sent by the component, and implement the subsequent FUZZER (fuzz test) program based on the extracted messages, which reflects the idea of ​​only focusing on the output of the system in black box fuzz testing. After the message is initialized, the FLOWFUZZER, VALUEFUZZER and FLOWANDVALUEFUZZER programs are executed respectively. The FLOWFUZZER program essentially uses the method of recursive traversal of the graph to randomize the execution order of the control flow sequence in the state diagram, and detects whether the system has errors. If it is detected that the current execution sequence causes the system to fail, the execution sequence is added to the vulnerability list to obtain the second mutation result.

[0103] Step S312, randomizing the message value of the control flow message in the control flow message state transition diagram, and detecting whether the mutated control flow message is abnormal, to obtain a third mutation result;

[0104] In this embodiment, the VALUEFUZZER program randomizes the value of the control flow message, so the control flow sequence in the sequential execution state diagram is executed using the sequence structure, and then the parameter value is randomized using RANDOMIZE(param). For example, the message values ​​such as RRC CHNNEL and PDU DATA are randomized to observe whether the randomized parameter value alone will also cause 5G system abnormalities without the influence of message sequence abnormalities, and obtain the third variation result.

[0105] Step S313, randomizing the execution order and message values ​​of the control flow messages in the control flow message state transition diagram, and detecting whether the mutated control flow messages are abnormal, to obtain a fourth mutation result;

[0106] In this embodiment, the FLOWANDVALUEFUZZER program adds RANDOMIZE(param) to randomize the message value based on FLOWFUZZER, with the purpose of detecting whether the two mutations will affect the device when performed simultaneously, whether the control flow message is abnormal, and obtaining the fourth mutation result.

[0107] Step S314: compose a first variation result based on the second variation result, the third variation result and the fourth variation result.

[0108] In this embodiment, the device composes a first variation result based on the second variation result, the third variation result and the fourth variation result.

[0109] Step S320: screening the first mutation results, and determining abnormal results in the first mutation results as test cases.

[0110] In this embodiment, the device screens the first variation results and determines the abnormal results in the first variation results as test cases. Since the first variation results include normal variation results and abnormal variation results, the test case is only to test the abnormal variation results, so it is necessary to screen the first variation results and determine the abnormal results in the first variation results as test cases.

[0111] In this embodiment, an innovation is made in the mutation strategy, the execution order of the 5G control flow message sequence and the input value of the control flow message are randomly mutated, and the security impact that the change of the 5G control flow message may have on the 5G network is comprehensively considered.

[0112] Step S400, execute and verify the test case to obtain a test result.

[0113] In this embodiment, all test cases obtained in the previous step are executed in sequence, and the device status is observed to see if there is any abnormality. The test cases that cause system abnormalities are analyzed, and the vulnerability is verified in a simulated 5G environment using the analyzed attack principle to evaluate whether it is a false alarm.

[0114] Specifically, the step S400 includes the following steps S410-S420:

[0115] Step S410, executing the test case to obtain an abnormal test result;

[0116] In this embodiment, the device executes the test cases in sequence, and observes whether the state of the device is abnormal, and obtains the abnormal test result.

[0117] Step S420, analyzing the abnormal test result to obtain information on the vulnerability attack principle that caused the abnormality;

[0118] In this embodiment, the device analyzes the abnormal test result to obtain information on the vulnerability attack principle that causes the abnormality.

[0119] In another embodiment, the device may obtain the vulnerability attack principle information that causes the anomaly by the user analyzing the vulnerability attack principle information obtained by the analysis and uploading the vulnerability attack principle information obtained by the analysis to the device.

[0120] Step S430: determining an attack instruction based on the vulnerability attack principle information, and executing the attack instruction in the mobile communication network simulation model to obtain a detection result.

[0121] In this embodiment, the device determines the attack instruction based on the vulnerability attack principle information, and executes the attack instruction in the mobile communication network simulation model to obtain the detection result. Among them, for each vulnerability attack principle, the execution state can be changed by directly modifying the source code to achieve the purpose of the attack; or the target can be attacked by calling the attack method in the preset instruction attack library to reduce the modification of the source code during the vulnerability verification process. The method of calling the attack method improves the efficiency of vulnerability verification.

[0122] Specifically, the step S430 includes the following steps S431-S432:

[0123] Step S431, based on the vulnerability attack principle, calling the corresponding attack instruction in the preset instruction attack library;

[0124] In this embodiment, the device calls the corresponding attack instructions in the preset instruction attack library based on the vulnerability attack principle, wherein the vulnerability verification mainly realizes the function of automatically verifying the detected vulnerability. Vulnerability verification is essentially the process of reproducing the vulnerability, the purpose of which is to check whether the vulnerability is a false alarm. This application provides users with an instruction attack library. After analyzing the attack principle of the vulnerability, the user or the device can directly call the corresponding attack instruction according to the attack principle, and finally perform the attack verification of the attack program written by the user in the simulated 5G network environment, and observe whether the state of the system is abnormal during the process, so as to check whether the vulnerability is a false alarm. The instruction attack library is a complete C++ project implemented locally. The instruction attack library file contained in the project actually extracts the control flow messages sent and received by the server-side UE and gNB during execution, and provides a method for monitoring the current system state on this basis. The user can directly download the project to the local, introduce the header file in the library to conveniently call the pre-implemented attack method, and can also call the monitoring method, analyze the abnormal log of the vulnerability detection and the abnormal control flow sequence, and combine the current state of the system to determine the attack instruction to be called. After writing the attack program, use HttpURLConnection to upload the attack program to the server for execution.

[0125] Step S432: executing the attack instruction in the mobile communication network simulation model, and monitoring whether the communication of the mobile communication network simulation model is abnormal, to obtain a detection result.

[0126] In this embodiment, the device executes the attack instruction in the mobile communication network simulation model, and monitors whether the communication of the mobile communication network simulation model is abnormal to obtain a detection result.

[0127] In the present application, an instruction attack library is designed, which is used to verify the 5G vulnerabilities discovered by black-box fuzz testing, thereby providing evidence for black-box fuzz testing. The instruction attack library integrates and extracts the effective control flow messages sent and received during 5G network protocol communications. When verifying the vulnerability, the method in the instruction attack library is called according to the attack principle of the vulnerability, and an attack program is written. The vulnerability is verified by executing the attack program in a simulation environment, which improves the efficiency of vulnerability verification and forms a closed loop from vulnerability detection to vulnerability verification.

[0128] Specifically, refer to Figure 6 , the step S432 includes the following steps A100-A700 (corresponding to Figure 6 1-7):

[0129] Step A100, the user initiates a vulnerability verification command on the vulnerability verification page of the client, and the command includes information such as the attack program and the target machine UE identity;

[0130] Step A200, the vulnerability verification module of the client sends a command to the pseudo base station / pseudo terminal emulator of the server;

[0131] In step A300, the pseudo base station / pseudo terminal emulator starts its own vulnerability detector to monitor whether the target machine UE has any abnormality. The abnormality detector is a program embedded in the emulator source code. The implementation method is to use the underlying operating system kernel call to receive the control flow messages sent and received by the emulator, and then determine whether the system is abnormal based on the content of the control flow message. The abnormality detector detects whether the system has an abnormality based on the following three criteria: The first criterion is to determine whether the UE is disconnected from the core network. After the UE is disconnected from the core network, the gNB will directly send a UE lost message. If the bottom layer of the detector receives this message, it can be determined that the system has an abnormality; the second criterion is that if the bottom layer of the detector receives the abnormality handling message sent by the core network, it can be determined that the system is abnormal; the third criterion is that when the detector receives the same message multiple times within a period of time, it can be determined that the system is abnormal.

[0132] Step A400, the pseudo base station / pseudo terminal emulator receives the attack command and starts its own vulnerability verifier;

[0133] Step A500, the vulnerability verifier uses the attack program to attack the target machine UE;

[0134] Step A600, when the vulnerability detector finds that the target machine is abnormal, the abnormal log of the sniffed target machine UE is sent to the result parser for parsing;

[0135] Step A700, the result parser analyzes whether the vulnerability verification is successful based on the abnormal log of the target machine UE, and then returns the result to the client for display.

[0136] In this embodiment, after obtaining the vulnerability information, the attack principle of the vulnerability is analyzed; after analyzing the attack principle of the vulnerability, the command attack library designed by this proposal can be used to perform a vulnerability attack on the target machine. The command attack library here is essentially composed of a control flow message sequence recorded in the initialization phase of the fuzz test. After analyzing the attack principle of the vulnerability, the execution order of the message is usually obtained. According to the message execution order, the message is extracted from the command attack library, and assembled into an attack instruction to perform attack verification on the target machine in the server. By performing attack verification in this way using an instruction attack library, the efficiency of vulnerability verification can be greatly improved. For example, after performing vulnerability verification on vulnerability CV-1, the server's detection program will detect whether an abnormality occurs in the system (UE is disconnected from the core network). If an abnormality occurs, it proves that the vulnerability is not a false alarm. By performing vulnerability verification on the above detected vulnerabilities, it is proved that the above vulnerabilities are not false alarms, and at the same time, a closed loop from vulnerability detection to vulnerability verification is realized.

[0137] The vulnerability security detection method provided by the present application is compared with the prior art that can only detect the vulnerability passively after waiting for hacker attacks, cannot effectively evaluate it, and can only detect one type of air interface vulnerability in the mobile communication network, cannot detect more types of vulnerabilities, resulting in poor practicality and low efficiency of vulnerability detection. In the present application, the interactive messages between the components in the network protocol of the preset mobile communication network simulation model are obtained; based on the interactive messages, the control flow message state transition diagram of the network protocol is determined; based on the preset mutation algorithm, the control flow message in the control flow message state transition diagram is mutated, and whether the control flow message after mutation is abnormal is detected, and the corresponding test case is generated; the test case is executed and verified to obtain the detection result. That is, in the present application, the vulnerability test is performed on the pre-built mobile communication network simulation model, and the control flow message state transition diagram for testing is obtained by analyzing the message sequence of the interaction between the components of the model, and the comprehensive mining of the vulnerability is realized by mutating the control flow message, so that more types of vulnerabilities can be detected, and the practicality and efficiency of vulnerability detection are improved.

[0138] Based on the above first embodiment, the present application also provides another embodiment, referring to Figure 7 , the vulnerability security detection method comprises:

[0139] A 5G environment simulation model is preset. This model uses the open source software free5GC to simulate the 5G core network, and uses the open source software UERANSIM to simulate the 5G UE and gNB. Through certain configurations, the three can be interconnected. By simulating the interaction between UE, gNB and core network elements, an environmental foundation is provided for the subsequent black box fuzz testing process.

[0140] The control flow messages between the components in the network protocol of the 5G environment simulation model are analyzed, and a control flow message state transition diagram that can be used for black-box fuzz testing is extracted. By analyzing the message sequence of the interactions between the components in the protocol, a message state transition diagram for black-box fuzz testing is obtained. Based on the state diagram, the messages of each component state change can be clearly observed, which is convenient for recording and extracting messages. The overall process of the entire system changing with the state changes of each component can also be clearly observed, which is convenient for analyzing the vulnerability attack principle in the vulnerability verification stage.

[0141] 5G control flow extraction and mutation: extract the control flow messages from the control flow state transition diagram between 5G components obtained in the previous step, mutate the execution order and message value of the 5G control flow messages, and use the designed mutation algorithm to mutate the control flow messages based on the control flow state diagram to generate test cases for black box fuzz testing;

[0142] Fuzz test execution, execute all test cases obtained in the previous step in sequence, and observe whether the system status is abnormal;

[0143] Result evaluation: analyze the test cases that cause system abnormalities, and use the analyzed attack principles to verify vulnerabilities in a simulated 5G environment to evaluate whether they are false alarms and obtain detection results.

[0144] The present application also provides a vulnerability security detection device, referring to Figure 3 , the vulnerability security detection device comprises:

[0145] An acquisition module 10 is used to acquire interaction messages between components in a network protocol of a preset mobile communication network simulation model;

[0146] A determination module 20, configured to determine a control flow message state transition diagram of the network protocol based on the interaction message;

[0147] A mutation module 30, configured to mutate the control flow message in the control flow message state transition diagram based on a preset mutation algorithm, detect whether the mutated control flow message is abnormal, and generate a corresponding test case;

[0148] The verification module 40 is used to execute and verify the test case to obtain a test result.

[0149] Optionally, the determining module 20 includes:

[0150] A data packet determination module, used to determine an interactive data packet containing the interactive message in the network protocol;

[0151] The analysis module is used to perform graph attribute analysis on the interactive data packet to obtain a graph attribute vector, and determine the control flow message state transition graph of the network protocol based on the graph attribute vector.

[0152] Optionally, the vector information determination module includes:

[0153] A coarse-grained analysis module, used for performing coarse-grained analysis on the interactive data packet to obtain a control flow vector;

[0154] A fine-grained analysis module, used to perform fine-grained analysis on the interactive data packet to obtain the state vector of each component and the direction vector of message transmission between components;

[0155] A composition module is used to compose a control flow message state transition diagram of the network protocol based on the control flow vector, the state vector and the direction vector.

[0156] Optionally, the variation module 30 includes:

[0157] The sequence mutation and message value mutation module is used to perform execution sequence mutation and message value mutation on the control flow messages in the control flow message state transition diagram based on a preset mutation algorithm, and detect whether the control flow messages after mutation are abnormal to obtain a first mutation result;

[0158] A screening module is used to screen the first mutation results and determine abnormal results in the first mutation results as test cases.

[0159] Optionally, the sequence mutation and message value mutation module includes:

[0160] An execution order mutation module is used to randomize the execution order of the control flow messages in the control flow message state transition diagram based on a preset mutation algorithm, and detect whether the control flow messages after mutation are abnormal to obtain a second mutation result;

[0161] A message value mutation module, used for randomizing the message value of the control flow message in the control flow message state transition diagram, and detecting whether the control flow message after mutation is abnormal, to obtain a third mutation result;

[0162] Multiple mutation modules are used to randomize the execution order and message value of the control flow messages in the control flow message state transition diagram at the same time, and detect whether the control flow messages after mutation are abnormal, so as to obtain a fourth mutation result;

[0163] The first variation result composition module is used to compose a first variation result based on the second variation result, the third variation result and the fourth variation result.

[0164] Optionally, the verification module 40 includes:

[0165] An execution module, used for executing the test case and obtaining an abnormal test result;

[0166] A result analysis module is used to analyze the abnormal test results to obtain the vulnerability attack principle information that caused the abnormality;

[0167] The attack detection module is used to determine the attack instruction based on the vulnerability attack principle information, and execute the attack instruction in the mobile communication network simulation model to obtain the detection result.

[0168] Optionally, the attack detection module includes:

[0169] An instruction attack library calling module is used to call corresponding attack instructions in a preset instruction attack library based on the vulnerability attack principle;

[0170] The monitoring detection module is used to execute the attack instruction in the mobile communication network simulation model, and monitor whether the communication of the mobile communication network simulation model is abnormal to obtain the detection result.

[0171] The specific implementation of the vulnerability security detection device of the present application is basically the same as the various embodiments of the vulnerability security detection method described above, and will not be repeated here.

[0172] Reference Figure 1 , Figure 1 It is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiment of the present application.

[0173] like Figure 1 As shown, the terminal may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0174] Optionally, the vulnerability security detection device may also include a rectangular user interface, a network interface, a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, etc. The rectangular user interface may include a display screen (Display), an input submodule such as a keyboard (Keyboard), and the optional rectangular user interface may also include a standard wired interface and a wireless interface. The network interface may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0175] Those skilled in the art will understand that Figure 1 The vulnerability security detection device structure shown in the figure does not constitute a limitation on the vulnerability security detection device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0176] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module and a vulnerability security detection program. The operating system is a program that manages and controls the hardware and software resources of the vulnerability security detection device, and supports the operation of the vulnerability security detection program and other software and / or programs. The network communication module is used to realize the communication between the components inside the memory 1005, and the communication with other hardware and software in the vulnerability security detection system.

[0177] exist Figure 1 In the vulnerability security detection device shown, the processor 1001 is used to execute the vulnerability security detection program stored in the memory 1005 to implement the steps of any of the vulnerability security detection methods described above.

[0178] The specific implementation methods of the vulnerability security detection device of the present application are basically the same as the above-mentioned vulnerability security detection method embodiments, and will not be repeated here.

[0179] The present application also provides a storage medium, on which is stored a program for implementing a vulnerability security detection method, and the program for implementing a vulnerability security detection method is executed by a processor to implement the following vulnerability security detection method:

[0180] Obtaining interaction messages between components in a network protocol of a preset mobile communication network simulation model;

[0181] Based on the interaction message, determining a control flow message state transition diagram of the network protocol;

[0182] Based on a preset mutation algorithm, the control flow message in the control flow message state transition diagram is mutated, and whether the mutated control flow message is abnormal is detected, and a corresponding test case is generated;

[0183] Execute and verify the test case to obtain the test result.

[0184] Optionally, the step of determining a control flow message state transition diagram of the network protocol based on the interaction message includes:

[0185] Determining an interactive data packet containing the interactive message in the network protocol;

[0186] A graph attribute analysis is performed on the interactive data packet to obtain a graph attribute vector, and based on the graph attribute vector, a control flow message state transition graph of the network protocol is determined.

[0187] Optionally, the step of performing graph attribute analysis on the interactive data packet to obtain a graph attribute vector, and determining a control flow message state transition graph of the network protocol based on the graph attribute vector includes:

[0188] Performing coarse-grained analysis on the interactive data packet to obtain a control flow vector;

[0189] Performing fine-grained analysis on the interactive data packets to obtain the state vector of each component and the direction vector of message transmission between the components;

[0190] Based on the control flow vector, the state vector and the direction vector, a control flow message state transition diagram of the network protocol is composed.

[0191] Optionally, the step of mutating the control flow message in the control flow message state transition diagram based on a preset mutation algorithm, detecting whether the mutated control flow message is abnormal, and generating a corresponding test case includes:

[0192] Based on a preset mutation algorithm, the control flow messages in the control flow message state transition diagram are mutated in execution order and message value, and whether the mutated control flow messages are abnormal is detected to obtain a first mutation result;

[0193] The first mutation results are screened, and abnormal results in the first mutation results are determined as test cases.

[0194] Optionally, the step of performing execution order mutation and message value mutation on the control flow messages in the control flow message state transition diagram based on a preset mutation algorithm, and detecting whether the control flow messages after mutation are abnormal, to obtain a first mutation result includes:

[0195] Based on a preset mutation algorithm, the execution order of the control flow messages in the control flow message state transition diagram is fully randomized, and whether the control flow messages after mutation are abnormal is detected to obtain a second mutation result;

[0196] Randomizing the message value of the control flow message in the control flow message state transition diagram, and detecting whether the mutated control flow message is abnormal, to obtain a third mutation result;

[0197] Randomizing the execution order and message values ​​of the control flow messages in the control flow message state transition diagram at the same time, and detecting whether the mutated control flow messages are abnormal, to obtain a fourth mutation result;

[0198] Based on the second variation result, the third variation result and the fourth variation result, a first variation result is composed.

[0199] Optionally, the step of executing and verifying the test case to obtain a test result includes:

[0200] Execute the test case and obtain an abnormal test result;

[0201] Analyze the abnormal test results to obtain information on the vulnerability attack principle that caused the abnormality;

[0202] Based on the vulnerability attack principle information, an attack instruction is determined, and the attack instruction is executed in the mobile communication network simulation model to obtain a detection result.

[0203] Optionally, the step of determining corresponding attack instructions based on the vulnerability attack principle, and executing the attack instructions in the mobile communication network simulation model to obtain a detection result includes:

[0204] Based on the vulnerability attack principle, call the corresponding attack instruction in the preset instruction attack library;

[0205] The attack instruction is executed in the mobile communication network simulation model, and the communication of the mobile communication network simulation model is monitored to see whether it is abnormal, so as to obtain a detection result.

[0206] The specific implementation method of the storage medium of the present application is basically the same as the embodiments of the above-mentioned vulnerability security detection method, and will not be repeated here.

[0207] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned vulnerability security detection method when executed by a processor.

[0208] The specific implementation of the computer program product of the present application is basically the same as the various embodiments of the above-mentioned vulnerability security detection method, and will not be repeated here.

[0209] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0210] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0211] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0212] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A vulnerability security detection method, characterized in that: The vulnerability security detection method comprises: Obtaining interaction messages between components in a network protocol of a preset mobile communication network simulation model; Based on the interaction message, determining a control flow message state transition diagram of the network protocol; Based on a preset mutation algorithm, mutate the control flow message in the control flow message state transition diagram, detect whether the mutated control flow message is abnormal, and generate a corresponding test case based on a first mutation result obtained by the abnormality detection, wherein the first mutation result includes a second mutation result obtained after the execution order of the control flow information is mutated; Execute and verify the test case to obtain the test result.

2. The vulnerability security detection method according to claim 1, characterized in that: The step of determining the control flow message state transition diagram of the network protocol based on the interaction message includes: Determining an interactive data packet containing the interactive message in the network protocol; A graph attribute analysis is performed on the interactive data packet to obtain a graph attribute vector, and based on the graph attribute vector, a control flow message state transition graph of the network protocol is determined.

3. The vulnerability security detection method according to claim 2, characterized in that: The step of performing graph attribute analysis on the interactive data packet to obtain a graph attribute vector, and determining a control flow message state transition graph of the network protocol based on the graph attribute vector includes: Performing coarse-grained analysis on the interactive data packet to obtain a control flow vector; Performing fine-grained analysis on the interactive data packets to obtain the state vector of each component and the direction vector of message transmission between the components; Based on the control flow vector, the state vector and the direction vector, a control flow message state transition diagram of the network protocol is composed.

4. The vulnerability security detection method according to claim 1, characterized in that: The step of mutating the control flow message in the control flow message state transition diagram based on a preset mutation algorithm, detecting whether the mutated control flow message is abnormal, and generating a corresponding test case includes: Based on a preset mutation algorithm, the control flow messages in the control flow message state transition diagram are mutated in execution order and message value, and whether the mutated control flow messages are abnormal is detected to obtain a first mutation result; The first mutation results are screened, and abnormal results in the first mutation results are determined as test cases.

5. The vulnerability security detection method according to claim 4, characterized in that: The step of performing execution order mutation and message value mutation on the control flow messages in the control flow message state transition diagram based on a preset mutation algorithm, and detecting whether the control flow messages after mutation are abnormal, to obtain a first mutation result, comprises: Based on a preset mutation algorithm, the execution order of the control flow messages in the control flow message state transition diagram is fully randomized, and whether the control flow messages after mutation are abnormal is detected to obtain a second mutation result; Randomizing the message value of the control flow message in the control flow message state transition diagram, and detecting whether the mutated control flow message is abnormal, to obtain a third mutation result; Randomizing the execution order and message values ​​of the control flow messages in the control flow message state transition diagram at the same time, and detecting whether the mutated control flow messages are abnormal, to obtain a fourth mutation result; Based on the second variation result, the third variation result and the fourth variation result, a first variation result is composed.

6. The vulnerability security detection method according to claim 1, characterized in that: The step of executing and verifying the test case to obtain the test result includes: Execute the test case and obtain an abnormal test result; Analyze the abnormal test results to obtain information on the vulnerability attack principle that caused the abnormality; Based on the vulnerability attack principle information, an attack instruction is determined, and the attack instruction is executed in the mobile communication network simulation model to obtain a detection result.

7. The vulnerability security detection method according to claim 6, characterized in that: The step of determining corresponding attack instructions based on the vulnerability attack principle information, and executing the attack instructions in the mobile communication network simulation model to obtain the detection result includes: Based on the vulnerability attack principle information, call the corresponding attack instruction in the preset instruction attack library; The attack instruction is executed in the mobile communication network simulation model, and the communication of the mobile communication network simulation model is monitored to see whether it is abnormal, so as to obtain a detection result.

8. A vulnerability security detection device, characterized in that: The vulnerability security detection device comprises: An acquisition module, used to acquire interaction messages between components in a network protocol of a preset mobile communication network simulation model; A determination module, configured to determine a control flow message state transition diagram of the network protocol based on the interaction message; A mutation module, configured to mutate the control flow message in the control flow message state transition diagram based on a preset mutation algorithm, detect whether the mutated control flow message is abnormal, and generate a corresponding test case based on a first mutation result obtained by the abnormality detection, wherein the first mutation result includes a second mutation result obtained after the execution order of the control flow information is mutated; The verification module is used to execute and verify the test case to obtain the test result.

9. A vulnerability security detection device, characterized in that: The vulnerability security detection device comprises: a memory, a processor, and a program stored in the memory for implementing the vulnerability security detection method. The memory is used to store a program for implementing a vulnerability security detection method; The processor is used to execute a program for implementing the vulnerability security detection method to implement the steps of the vulnerability security detection method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a program for implementing a vulnerability security detection method, and the program for implementing a vulnerability security detection method is executed by a processor to implement the steps of the vulnerability security detection method as described in any one of claims 1 to 7.

Images