A feedback fuzz testing method and device for local simulation of IoT devices
Through machine learning, the network data parsing function of IoT devices is identified and local simulation is performed to generate high-quality seed samples, which solves the problem of low information acquisition and simulation efficiency in fuzz testing of IoT devices and achieves efficient vulnerability discovery.
Patent Information
- Application Number
- CN202110996599.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-08-27
- Publication Date
- 2025-10-10
- Estimated Expiration
- 2041-08-27
AI Technical Summary
Existing fuzz testing technology is difficult to be effectively applied to IoT devices, especially in terms of obtaining execution information and simulation efficiency, resulting in insufficient efficiency and depth in vulnerability mining.
Machine learning is used to predict network parsing functions combined with local simulation. By identifying the network data parsing functions of IoT devices, high-quality component-level seed samples are generated, and local simulation is performed to obtain dynamic information to achieve feedback fuzz testing.
It improves the efficiency and accuracy of fuzz testing, can effectively discover vulnerabilities in IoT devices, especially zero-day vulnerabilities, and is universal and efficient.
Smart Images
Figure CN115733638B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of vulnerability mining, and in particular to a feedback fuzz testing method and device for local simulation of Internet of Things devices, which uses machine learning to predict target functions in combination with feedback fuzz testing technology based on local simulation to mine vulnerabilities in Internet of Things devices. Background Art
[0002] The Internet of Things (IoT) is considered the next major revolution in the information technology industry, following computers and the internet. The number of IoT devices has grown rapidly in recent years. According to statistics, there were 7 billion IoT devices worldwide in 2018, with an annual growth rate of approximately 20%. By 2020, the number of IoT devices is expected to reach 10 billion, and by 2025, it will increase to 22 billion. With the widespread adoption of the IoT, the security challenges facing these devices are increasing. According to the Kaspersky IoT Security Report, the number of captured IoT malware samples has exploded in recent years.
[0003] Vulnerability mining for IoT devices and timely discovery of security vulnerabilities in IoT devices is one of the key approaches to addressing these security issues. Among the many attack surfaces of IoT devices, vulnerabilities in the network packet processing and parsing part of IoT devices account for the majority of IoT device vulnerabilities. According to our 2019 CVE vulnerability information for IoT devices, vulnerabilities occurring in the network packet parsing part accounted for approximately 52%. This paper primarily targets vulnerability mining in the network packet parsing part of IoT devices.
[0004] Fuzz testing is a well-known and effective vulnerability discovery method for software and systems. This method discovers potential vulnerabilities by sending a large number of unexpected inputs to the target and monitoring its status. Fuzz testing technology has gained widespread use among security researchers because it allows automated testing without detailed analysis of the target software. Fuzz testing is generally categorized as white-box, gray-box, and black-box, depending on how program execution information is obtained. Coverage-guided feedback-based gray-box fuzz testing is a representative type of fuzz testing technique and a current research hotspot. This technique primarily relies on dynamically acquired target program coverage information to determine new seed sample generation strategies. Representative works include American Fuzzy Lop (AFL), Honggfuzz, and LibFuzzer. These tools have detected hundreds of zero-day vulnerabilities in numerous real-world projects.
[0005] However, applying feedback-based fuzz testing to IoT devices still faces many challenges. First, it's difficult to effectively obtain dynamic program execution information, making coverage-guided testing impossible. Most IoT devices are custom, complete systems, lacking the means and tools to obtain execution information within their physical devices. Furthermore, even if dynamic information acquisition tools are developed, they are difficult to integrate into IoT devices due to the closed nature of these devices. Therefore, implementing feedback-based fuzz testing based on device emulation has become a potential technical approach for vulnerability discovery in IoT devices. While device emulation can potentially obtain relevant execution information, the heterogeneity and diversity of IoT devices make system-level emulation impossible for many devices. Specifically, system-level firmware emulation requires a series of specific hardware and peripheral conditions. Second, the efficiency and depth of fuzz testing remain limited. Initial test seed samples are obtained through network packet capture and then mutated. The blind nature of mutation leads to a large number of invalid or duplicate tests, which has a greater impact on device emulation-based fuzz testing and also makes it difficult to fully test programs with limited input counts. At the same time, most IoT devices have private protocols implemented independently by manufacturers in network communications. Without an understanding of the protocol logic, it is difficult to mutate seed samples that trigger deep code execution. All of these factors make fuzz testing inefficient. Summary of the Invention
[0006] In order to overcome the shortcomings of existing fuzz testing technology for IoT devices, the present invention proposes a feedback fuzz testing method and device for local simulation of IoT devices, which uses a combination of machine learning to predict network parsing functions and local simulation to improve the efficiency and accuracy of fuzz testing.
[0007] The technical solution of the present invention includes:
[0008] A feedback fuzz testing method for local simulation of IoT devices, comprising the following steps:
[0009] 1) Receive network data packets and identify network data parsing functions from the network service program in the firmware;
[0010] 2) Using the network data parsing function and the corresponding network data packet to identify the component, generate the target network service component, and generate a seed sample set for the target network service component;
[0011] 3) Perform local simulation on the target network service component to obtain dynamic information during the execution process;
[0012] 4) Based on the dynamic information during the execution process, the target network service component is fuzz tested using a seed sample set to obtain the fuzz testing results.
[0013] Furthermore, the network data parsing function is identified by the following steps:
[0014] 1) Extract the features of the analytical functions of several sample network data and generate corresponding feature vectors;
[0015] 2) performing machine learning training based on the feature vector to generate an objective function prediction model;
[0016] 3) Input the feature vector of the function to be identified in the network service program into the target function prediction model to obtain the network data analysis function.
[0017] Furthermore, the features include: memory copy operations, data formatting operations, character and string positioning operations, standard output operations, character and string comparison operations, the number of basic blocks and the number of callers.
[0018] Furthermore, the feature vector of the function to be identified is generated by the following steps:
[0019] 1) Reading a field type or keyword corresponding to a function to be identified in the network service program: If the field type or keyword meets the set requirements, go to step 2); otherwise, discard the function to be identified;
[0020] 2) extracting features related to the field length and features related to the actual value of the field respectively to generate features of the function to be identified;
[0021] 3) Generate the feature vector of the function to be identified.
[0022] Furthermore, the machine learning method includes: a decision tree algorithm.
[0023] Furthermore, a seed sample set is generated through the following steps:
[0024] 1) Read the content of the network data packet of the target network service program character by character, and use the content to determine the protocol type;
[0025] 2) If the protocol type is a text format protocol, a seed sample set is generated by constructing the key in the corresponding network data packet; if the protocol type is a binary format protocol, symbolic execution is performed on the target network service component, and the seed sample set is obtained by constraint solving the obtained constraints.
[0026] Furthermore, dynamic information during execution is obtained through the following steps:
[0027] 1) By modifying the loading order of dynamic link libraries defined in the environment variables, preferentially loading the dynamic link library containing the test bed program, and using the execution control program in the test bed program, the original calling process is changed;
[0028] 2) Hand over control to the network data parsing function;
[0029] 3) By loading the original device file system, correctly build the target component execution environment and obtain dynamic information during the execution process.
[0030] Furthermore, the fuzz testing results of the target network service component are obtained through the following steps:
[0031] 1) Construct the context and input environment of the target function based on the dynamic information during execution;
[0032] 2) Instrument the target network service component in local simulation mode;
[0033] 3) Take a sub-sample i from the seed sample set and mutate the seed sample i;
[0034] 4) Use the mutated seed sample i to execute the instrumented program and obtain the coverage path of the program;
[0035] 5) If a crash occurs in the coverage path, the seed sample i is used as the fuzz testing result.
[0036] An electronic device includes a memory and a processor, wherein the memory stores a program for executing the above method.
[0037] An electronic device includes a memory and a processor, wherein the memory stores a program for executing the above method.
[0038] The feedback fuzz testing method for local simulation of IoT devices proposed in this invention has the following advantages and beneficial effects:
[0039] (1) This method achieves execution information acquisition by performing local simulation on IoT devices. It is universal and the efficiency of local simulation is greatly improved compared with global simulation.
[0040] (2) This method uses machine learning-based network data parsing function identification, which is applicable to signed and unsigned device codes. It uses the identified functions as the entry point to obtain network service components and generate high-quality component-level seed samples, which can further improve the efficiency and depth of fuzz testing.
[0041] (3) This method implements a fuzz testing system prototype. Experiments show that this method has improved the number of supported devices and vulnerability discovery capabilities compared to current representative tools, and has discovered zero-day vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Figure 1 This is an implementation flow chart of a feedback fuzz testing method for local simulation of IoT devices.
[0043] Figure 2 This is an example diagram of TLD feature vectorization.
[0044] Figure 3 It is a flowchart of local feedback fuzz testing.
[0045] Figure 4 It is a schematic diagram of local simulation technology.
[0046] Figure 5 This is proved by the experimental results of this method. DETAILED DESCRIPTION
[0047] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described below with reference to specific embodiments and drawings.
[0048] As IoT devices become more functional and operate in increasingly diverse network environments, they require complex interactive operations and management configurations during use. These include using HTTP and UPnP services for daily management and parameter configuration, as well as sharing operating system information and IP addresses between devices through Cisco's proprietary protocol, CDP. Consequently, these devices contain numerous public and private protocol handlers. The majority of vulnerabilities disclosed in IoT devices reside in network packet handlers. Network packet handlers are programs that provide external network services and receive and parse incoming network packets (referred to as network service programs, or target programs). Typically, network service programs can be simulated relatively easily because they don't directly interact with hardware. Therefore, implementing feedback fuzz testing on these programs can both cover the critical attack surface of IoT devices and avoid system-level simulation failures due to factors such as device hardware dependencies.
[0049] The present invention identifies the network data parsing function (also referred to herein as the target function) in the firmware code of the IoT device and uses this function as the entry point to perform local simulation of the network service component, supporting the acquisition of dynamic information. A high-quality component-level seed sample set is then generated for the target component. Finally, the generated seed samples are used to perform fuzz testing on the target component, and control flow coverage information of the target program is obtained based on the local simulation, thus implementing feedback fuzz testing for the target component. This method needs to solve two main problems:
[0050] Question 1: How to identify the objective function.
[0051] On the one hand, there is no unified naming convention for network data parsing functions, and on the other hand, there are a large number of unsigned functions in the actual device code, so they cannot be simply identified by the function name. By analyzing the network data parsing functions of actual IoT devices, the present invention found that most of the function processing flows follow basically the same processing flow: reading the relevant field type and length from the network data packet, and reading the data value of the field after the length check. In the present invention, the TLD model (functions are represented by three types of features: Type, Length, and Data) is used to characterize the above process, and the characteristics of the TLD model are established. TLD features are extracted for 2022 network data parsing functions and a training set is constructed. Based on the decision tree algorithm, a target function prediction model is generated for the identification of the target function.
[0052] Question 2: How to perform deep feedback fuzz testing on target network service components.
[0053] In order to conduct in-depth testing on network service components, the present invention adopts the currently widely used feedback fuzz testing technology. In order to obtain the dynamic execution information of the component, this paper simulates and executes the network service program where the target component is located based on Qemu, and by controlling the execution process, on the basis of constructing the target function context and input environment, takes this type of function as the entry, and only simulates and executes the target component. In order to effectively trigger the deep code in the target component, on the one hand, it is necessary to construct a seed sample that meets the network data parsing function, that is, the input parameter requirements of the entry function, and on the other hand, it is also necessary to use high-quality seed samples. Therefore, the present invention uses symbolic execution and other technologies to generate high-quality seed samples for the target component. Using the generated seed samples, the component-level fuzz testing engine mutates the seed samples, and accepts the dynamic execution information of the local simulation feedback to complete the feedback fuzz testing.
[0054] The feedback fuzzy testing method of the present invention is specifically implemented as follows Figure 1 The specific description is as follows:
[0055] Step 1: Identify network data parsing functions in the IoT device firmware code using machine learning
[0056] (1) The TLD model is used to characterize the network parsing function process, and the characteristics of the TLD model are established. The three letters in TLD mean: T—Type (type), L—Length (length), and D—Data (actual data value). T represents the field type or keyword of the received data, L represents the length of the field in the data, and D represents the actual value of the field in the data. The memory copy operation, data formatting operation, character and string positioning operation, standard output operation, character and string comparison operation, the number of basic blocks, and the number of callers in the function are determined as the characteristics of the target function identification. The process of TLD feature vectorization is as follows: Figure 2 shown.
[0057] The TLD model can be abstracted into the following three steps:
[0058] a) Read the field type or keyword T and determine whether it meets the requirements. If so, continue execution;
[0059] b) Read the length L of the field and perform length-related data operations based on L, such as length check, value assignment, copy length, etc.
[0060] c) Read the actual value D (tainted data) of the field and write the tainted data to the previously allocated related memory.
[0061] (2) Based on the network data parsing function of actual IoT devices, TLD features are extracted and a training set is constructed. Based on the decision tree algorithm, a target function prediction model is generated.
[0062] (3) Extract the feature vector of the function to be identified from the network service program of the firmware, and use the trained target function prediction model to identify the target function.
[0063] The main processing flow of the network service program is as follows: the program will first perform initialization configuration work, then use the socket to establish a network connection, and then distribute the received network data packets to different actions for processing, such as parsing external input data to build internal data structures, converting them into token streams, executing specific functions, etc. The code that implements the above functions is called a network service component. The network service component usually has an entry function, called the network data parsing function. In the call graph of the network service program, the code composed of the network data parsing function and the functions on the subtree node with this function as the root is the network service component, which is the object of the fuzzy test in this invention.
[0064] Step 2: Generate a high-quality component-level seed sample set for the target network service component
[0065] (1) Input the target function Func and the real network packet Packet corresponding to the network service program, and identify the target function and its called sub-functions as target network service components according to the function call relationship of the target function.
[0066] (2) Read the content in the real network packet of the target network service program in the firmware by characters, and judge whether the read characters are printable ASCII characters or carriage return characters, line feed characters to judge the protocol type processed by the target network service program as a text protocol or a binary protocol. If it is a text protocol, otherwise it is a binary protocol.
[0067] (3) For text format protocol, because the network parsing program performs multiple key value operations on text protocol data to obtain key value information, the key in the network data is constructed to generate seed samples. According to the traversal assembly instructions of the target network service component, the address pointing to the constant string is obtained, the string composed of continuous characters of numbers, letters and underscores is extracted, and all the keywords key processed by the target component are obtained. The obtained key is combined in the order of acquisition and constructed into a legal request in the form of "key_1=value&key_2=value&…&key_n=value", and a high-quality seed sample is obtained.
[0068] (4) For binary format protocol, perform symbolic execution on the network service component to obtain constraints, and perform constraint solving on the constraints to obtain high-quality seed samples. To perform symbolic execution, first, the identified target network service component is taken as the entry of symbolic execution, the parameters are symbolized, and the constraints of all symbolized parameter variables are set to empty as an initial state, and then it is added to the state set. Start symbolic execution from the initial state. After the symbolic execution traverses the relevant path, a large number of constraints will be generated. With the help of constraint solving engine, the inputs satisfying these constraints are calculated to form high-quality seed samples.
[0069] Step 3: Perform local simulation of the network service component with the function as the entry to support execution of dynamic information acquisition
[0070] Only the target component is simulated, not the entire firmware, such as Figure 3As shown, the dynamic link library hijacking technology is used to achieve execution control. By modifying the loading order of the dynamic link libraries defined in the environment variables, the dynamic link library containing the test bed program is loaded first. The execution control program is used in the test bed program to change the original calling process. After completing the construction of the target function calling environment, the control is handed over to the test entry function, that is, the network data parsing function, thereby completing the local simulation. During the execution of the target component, it is necessary to rely on the library files in the original system. By loading the original device file system, the target component execution environment is correctly constructed to ensure the normal execution of the target component in the subsequent fuzz test and the smooth acquisition of dynamic information during the execution process.
[0071] Step 4: Use the local feedback fuzz testing algorithm to test the target program
[0072] Use the generated seed samples to perform fuzz testing on the target component, and obtain the target program control flow coverage information based on local simulation to implement feedback fuzz testing on the target component, such as Figure 4 shown.
[0073] (1) Input the target function identified in step 1, i.e., the seed input port. Component identification is performed based on the function call relationship of the target function. The target function and its called sub-functions are identified as network service components. Input the high-quality seed samples generated in step 2 to form a seed queue.
[0074] (2) Construct the target function context and input environment, insert the target component in the local simulation mode, take a seed sample from the seed queue and mutate it.
[0075] (3) Use each mutated seed sample to execute the instrumented program to obtain the program coverage path and whether a crash occurs. If a crash occurs during program execution, the seed sample is considered an abnormal sample, saved, and output. If a new execution path is triggered during the execution of the current seed sample, the program execution path is added to the target program control flow coverage information set, and the seed sample is added to the seed queue.
[0076] (4) If no new path is triggered, the next seed sample is executed until the user manually interrupts the fuzz test.
[0077] Finally, under experimental conditions, the present invention identified a total of 364 target functions from 9 test programs, and used these functions as entry points to perform fuzz testing on network service components for 1 hour (according to experimental results, the growth of the number of ENTRYs in nearly 90% of the test programs tends to slow down after 300 seconds, so fuzz testing for each target component for 1 hour is relatively sufficient). A total of 294 crashes were found, with an average of 32.7 crashes per test program. In addition, we verified the effectiveness of the present invention's method by comparing the TLDFuzzer, a feedback fuzz testing solution based on local simulation for IoT devices, and FirmAFL, the latest achievement in gray-box fuzz testing for IoT devices, to trigger known vulnerabilities through fuzz testing. In the experiment, the vulnerability triggering time of the present invention was the longest 248 seconds, the shortest was only 8 seconds, and the average time was 80.6 seconds. Since the present invention is a component-level fuzz test, its average vulnerability triggering time is in the order of minutes, while FirmAFL is a system-level fuzz test, and its average vulnerability triggering time in the experiment is in the order of hours, the present invention has a greater advantage in terms of vulnerability triggering time overhead. Figure 5 TLDFuzzer represents our invention. The 14 vulnerabilities in the figure exist in eight different programs, four of which are not fuzz tested by FirmAFL. However, our invention supports fuzz testing for all tested programs. Therefore, our invention is not only highly efficient but also universally applicable in exploiting IoT device vulnerabilities.
[0078] While the specific details, implementation algorithms, and drawings of the present invention are disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. The present invention should not be limited to the preferred embodiments disclosed in this specification and the accompanying drawings; the scope of protection claimed by the present invention shall be determined by the scope defined in the claims.
Claims
1. A feedback fuzz testing method for local simulation of IoT devices, comprising the following steps: 1) Receive a network data packet and identify a network data parsing function from a network service program in the firmware; wherein the network data parsing function is identified by the following steps: Extract the features of analytical functions of several sample network data and generate corresponding feature vectors; Perform machine learning training based on the feature vector to generate an objective function prediction model; Input the feature vector of the function to be identified in the network service program into the target function prediction model to obtain the network data parsing function; 2) Component identification is performed using the network data parsing function and the corresponding network data packet to generate the target network service component, and a seed sample set is generated for the target network service component; wherein the seed sample set is generated by the following steps: Read the content of the network data packet of the target network service program character by character, and use the content to determine the protocol type; If the protocol type is a text format protocol, a seed sample set is generated by constructing the key in the corresponding network data packet; if the protocol type is a binary format protocol, symbolic execution is performed on the target network service component, and the seed sample set is obtained by constraint solving the obtained constraints; 3) Perform local simulation on the target network service component to obtain dynamic information during execution; 4) Based on the dynamic information during the execution process, the target network service component is fuzz tested using a seed sample set to obtain the fuzz testing results.
2. The method according to claim 1, wherein The features include: memory copy operations, data formatting operations, character and string positioning operations, standard output operations, character and string comparison operations, the number of basic blocks and the number of callers.
3. The method according to claim 1, wherein Generate the feature vector of the function to be identified by the following steps: 1-1) Reading a field type or keyword corresponding to a function to be identified in a network service program: If the field type or keyword meets the set requirements, go to step 1-2); otherwise, discard the function to be identified; 1-2) Extract features related to the field length and features related to the actual value of the field to generate features of the function to be identified; 1-3) Generate the feature vector of the function to be identified.
4. The method according to claim 1, wherein Machine learning methods include: decision tree algorithm.
5. The method according to claim 1, wherein To obtain dynamic information during execution, perform the following steps: 3-1) By modifying the loading order of dynamic link libraries defined in the environment variables, preferentially loading the dynamic link libraries containing the testbed program, and using the execution control program in the testbed program, the original calling process is changed; 3-2) Hand over control to the network data parsing function; 3-3) By loading the original device file system, correctly build the target network service component execution environment and obtain dynamic information during the execution process.
6. The method according to claim 1, wherein Obtain the fuzz testing results of the target network service component by following these steps: 4-1) Construct the context and input environment of the network data parsing function based on the dynamic information during execution; 4-2) Instrument the target network service component in local simulation mode; 4-3) Take a sub-sample from the seed sample set and mutate the seed sample; 4-4) Use the mutated seed sample to execute the instrumented network service program to obtain the coverage path of the network service program; 4-5) If a crash occurs in the coverage path, the seed sample is used as the fuzz testing result.
7. A storage medium storing a computer program, wherein: The computer program is configured to execute the method according to any one of claims 1 to 6 when executed.
8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 6.