Protocol fuzzing method and system based on syntax generation and coverage guidance

Abstract

The application introduces coverage feedback to guide the protocol fuzzing process on the basis of the protocol fuzzing technology based on syntax generation, aims to provide a method to solve the problem of blind variation when generating new test cases by the existing protocol fuzzing technology based on generation. Mainly includes the following stages: test preparation stage. The protocol entity program to be tested is deployed locally, and the data model set of the protocol to be tested is defined as the input of the fuzzing test stage. Fuzzing test stage. The relationship learning stage and the combination variation stage are included. The relationship learning stage: learning the correlation between the main variation field and other variable fields in the same data model. The combination variation stage: combination variation of the main variation field under the guidance of the relationship table. Result information feedback stage. The number of times of triggering the protocol entity program to crash and the coverage information are fed back in real time during the fuzzing test process. The application has the advantages of high test efficiency and high coverage.

Description

Technical Field

[0001] This invention belongs to the field of automated protocol security testing technology, specifically involving a protocol fuzzing test method and system based on syntax generation and coverage guidance. Background Technology

[0002] Protocol fuzzing monitors the abnormal behavior of the server under test, such as crashes or hangs, by sending mutated and abnormal inputs to the server implementing the protocol. This is crucial for the timely discovery of potential vulnerabilities in the protocol implementation. In recent years, research on protocol fuzzing both domestically and internationally has mainly focused on syntax-based fuzzing methods. Methods based on syntax generation and coverage guidance have been proposed. These methods utilize coverage feedback and other information to generate guided test cases, enabling more efficient and useful test case generation and maximizing fuzzing coverage.

[0003] Current work related to protocol fuzzing based on syntax generation and coverage includes the following:

[0004] 1. Z-Fuzzer is an improvement on the BooFuzz ​​fuzzer, introducing coverage feedback information to utilize test cases that trigger new coverage. If a generated test case triggers a new branch, the existing mutations of that test case remain unchanged, and subsequent fields are mutated sequentially. That is, the conditions triggering new coverage remain unchanged, while other conditions are changed to explore deeper code paths. EPF is a general fuzzy framework that uses coverage information to guide test case generation. It uses population-based simulated annealing to heuristically schedule test cases in a seed library during fuzzing, recombining and mutating them to generate new test cases. It combines this with a genetic algorithm that uses coverage metrics as the fitness function to guide generation towards maximizing coverage. However, neither Z-Fuzzer nor EPF considers potential correlations between different fields in the same data model.

[0005] 2. PAVFuzz, an improvement on the Peach fuzzer, introduces the idea of ​​dynamic learning. Based on coverage feedback information, it learns the correlations between different fields in adjacent data models and calculates the mutation weights of each field in the current data model according to these correlations and the previous test case. This heuristic approach uses the mutation weights to guide the generation of test cases for the current data model. ICS Protocol Fuzzing, based on the Peach fuzzer, proposes the protocol fuzzing framework Peach*, which introduces a coverage feedback module. During testing, it collects coverage information from test cases, saves valuable test cases that trigger new path coverage, and decomposes them into fragments. Based on this, it constructs higher-quality test cases for further testing.

[0006] In summary, existing protocol fuzzing methods based on syntax generation and coverage guidance fail to consider potential correlations between different fields within the same data model. If these correlations could be dynamically learned during fuzzing and used to guide combined mutations of related fields, fuzzing could achieve greater coverage. Therefore, this invention proposes a method for guiding test case generation based on syntax generation and coverage guidance. During testing, it learns the correlations between the primary mutation field and other fields within the same data model and uses these correlations to guide combined mutations of the data model to generate new test cases. This not only improves the coverage of protocol fuzzing but also enhances its efficiency. Summary of the Invention

[0007] To address the aforementioned problems, this invention proposes a protocol fuzzing method and system based on syntax generation and coverage guidance. During fuzzing, the relationships between different fields in the data model are learned, and these relationships are used to guide the generation of test cases. The method consists of three phases: test preparation, fuzzing, and result feedback. In the test preparation phase, the protocol entity program under test is deployed locally, and the data model set of the protocol under test is defined as the input for the fuzzing phase. The fuzzing phase includes a combination mutation phase and a relation learning phase. During fuzzing, the main function of the combination mutation phase is to perform guided combination mutations on the variable fields in the data model under the guidance of the relation table, so that the generation of test cases is directed towards increasing coverage. The main function of the relation learning phase is to learn the relationships between variable fields in real time and maintain and update the relation table recording these relationships in real time. In the result feedback phase, the number of times the protocol entity program under test crashes and coverage information are fed back in real time during fuzzing; and the test cases that trigger crashes are saved for later reproduction and analysis.

[0008] This invention proposes a protocol fuzzing method based on syntax generation and coverage guidance, which includes three main stages: test preparation stage, fuzzing stage, and result information feedback stage; wherein the fuzzing stage includes a relation learning stage and a combinatorial mutation stage.

[0009] The test preparation phase includes the following steps:

[0010] 1-1. By analyzing the request data packets corresponding to the protocol under test and combining them with the protocol specification, the data model set M of the protocol is defined using the data model definition function provided by the BooFuzz ​​fuzzing framework. set ={m1,...,m i ,...,m n}, i = 1,...,n, where n is the total number of protocol data models to be tested, and the defined set of data models is used as a protocol specification template for generating new test cases;

[0011] 1-2. Use the gcc compiler tool that comes with aflfast to instrument and compile the protocol entity program to be tested, and generate the corresponding binary executable file;

[0012] 1-3. Run the executable file generated in step 1-2, and allocate a 64KB shared memory space (ShareMem is an empirical value; 64KB can represent 65536 branches, which is greater than the number of branches of most protocol entity programs under test and can meet the branch coverage statistics requirements of most protocol entity programs under test) to collect real-time statistics on the coverage information of the protocol entity programs under test.

[0013] The fuzzing phase specifically includes the following steps:

[0014] 2-1. Data Model Selection

[0015] From the data model set M defined in step 1-1 Set Select a data model m in sequence i And initialize the potential value of the data model, modelPotential. i =MC (MC is an empirical value. The larger the value, the more mutations the data model will undergo. For balance, it is generally set to 10000). Next, in the combination mutation stage, new test cases are generated based on the data model.

[0016] 2-2. Combinatorial Variation Stage

[0017] The function of the combination mutation stage: for the data model m selected in step 2-1 i Guided by the relational tables, guided combinations and variations are performed on them to generate more effective test cases. This process includes the following steps:

[0018] 2-2-1. Selection of Main Variants

[0019] For the data model m selected in step 2-1 i Data model m i It contains multiple mutable fields, defined as a set of mutable fields M. i _Field set ={m i _field1,...,m i _field j ,...,m i _field x}, j = 1,...,x, where x is the data model m i The number of mutable fields included, from the set of mutable fields M i _Field set Randomly select one of the mutable fields m i _field j As the primary mutation field, initialize the primary mutation field m. i_field j The corresponding relational table is defined, and the potential value of the primary mutation field, fieldPotential, is initialized. i j =FC(fieldPotential) i j Representing data model m i The potential value when the j-th variable field is used as the primary mutation field. FC is an empirical value. The larger the value, the more mutations the primary mutation field will undergo, and the longer the testing time will be. For balance, it is generally set to 1000.

[0020] The relational table is a row x-1 (x is the data model m). i The structure is a two-dimensional array with two columns (the number of mutable fields included), and each major mutable field has a corresponding relation table. The field m... i _field j When used as a primary variant field, the relation table is: RelationTable i j =[(field_id1,value1),...,(field_id k ,value k ),...(field_id x ,value x )],k=1,...,x,k!=j,x is the data model m i The number of mutable fields included, field_id k Representing data model m i The unique ID of the Kth mutable field, value k This refers to the mutable field m corresponding to this ID. i _field k With the main mutation field m i _field j relational value k The initial value is 0.

[0021] Over the next period of time, guided by the relational tables, we will work on the primary mutation field m. i _field j The combined mutation work continues until the potential value of the field, fieldPotential, is reached. i j Exhausted;

[0022] 2-2-2. Relationship Tables Guide Combinatorial Variation

[0023] For the main mutation field m selected in step 2-2-1i _field j Combined with its corresponding RelationTable i j Sort the entries in the relation table from largest to smallest according to their relation values, and then randomly select two entries (field_id) according to the probability of an exponential distribution. a ,value a ),(field_id b ,value b Select the corresponding field m based on the ID in the table entry. i _field a m i _field b m, as the main mutation field i _field j The associated field is combined with the main mutation field for mutation, resulting in a three-field mutated data model m. i * This generates a Packet of test cases with three mutated fields. i * ;

[0024] 2-3. Inject test cases into the protocol entity program under test.

[0025] The test case packet generated in step 2-2-2 i * Inject into the system under test and collect the bitmap information of the shared memory ShareMem allocated in steps 1-3.

[0026] If no new branch coverage is generated, then the data model potential value initialized in step 2-1 will be used. i Decrease by 1, and set the potential value of the primary mutation field initialized in step 2-2-1 to fieldPotential. i j Decrease by 1; if modelPotential i If the value is 0, return to step 2-1 and execute. If fieldPotential is not specified... i j If the value is 0, then return to step 2-2-1 for execution.

[0027] If a new branch overlay is found when analyzing the bitmap information of ShareMem, then modelPotential will be... i Reassign the initial value MC, and set fieldPotential. i jReassign the initial value FC.

[0028] If the test case packet generated in step 2-2-2 i If the program of the protocol under test crashes, an exception log will be recorded and the test case packet will be saved. i * is used for vulnerability analysis after the test is completed.

[0029] 2-4. Relationship Learning Stage

[0030] The relational learning phase is used to learn the data model m i Middle principal mutation field m i _field j With data model m i Other mutable fields {m i _field1,...,m i _field k ,...,m i _field x The correlation between x, k, k! = j reflects a trend where combined mutation of two fields can trigger branches that would not be triggered by mutation of the two fields individually. This correlation is quantitatively represented in the form of a relational table, specifically including the following steps:

[0031] 2-4-1. Data Model Decomposition

[0032] The data model m obtained in step 2-2-2 combines and mutates the three fields. i * The process involves disassembling the data and extracting the mutated values ​​from the three mutated fields, specifically the `mutated_field`. j Main variant field m i _field j The mutated value, mutated_field a mutated_field b The combined variation field m are respectively i _field a m i _field b The mutated value.

[0033] 2-4-2. Generate corresponding data packets using the decomposed data model.

[0034] Replace the selected data model m in step 2-1 with the mutated values ​​of the fields obtained in step 2-4-1. i The corresponding data packet is obtained by referring to the corresponding fields in the database. The specific process is as follows:

[0035] Using mutated_field j Replace data model m i The main mutation field m in i _field j This generates a packet that has only mutated the main mutated field. j .

[0036] Using mutated_field a Replace data model m i The combined variation field m in i _field a The generation only mutated m i _field a field data packet a .

[0037] Using mutated_field b Replace data model m i The combined variation field m in i _field b The generation only mutated m i _field b field data packet b .

[0038] Using mutated_field j and mutated_field a Replace data model m respectively i field m i _field j and field m i _field a The main mutation field m is obtained. i _field j With the first combined variation field m i _field a All data packets have been mutated j-a .

[0039] Using mutated_field j and mutated_field b Replace data model m respectively i field m i _field j and field m i _field b The main mutation field m is obtained. i _fieldj With the second combined variation field m i _field b All data packets have been mutated j-b .

[0040] 2-4-3. Update the relationship table

[0041] The data packet obtained in step 2-4-2 j packet a packet b packet j-a and packet j-b The data packets are injected into the protocol entity program under test, and a new temporary shared memory (TemShareMem) is allocated for each new data packet injected. The bitmap information of the temporary shared memory (TemShareMem) is collected, and the temporary shared memory is released after the collection is completed. The branch coverage (Cov) of the aforementioned data packets in the protocol entity program under test can then be obtained. j 、Cov a 、Cov b 、Cov j-a 、Cov j-b .

[0042] If Cov j-a -(Cov j ∪Cov a If )>0, then it proves that field m i _field j When used as the primary mutation field, it is related to field m. i _field a Combined mutations can cover branches that would not be covered by individual mutations, updating the main mutation field m. i _field j The corresponding relation table is RelationTable. i j Combine it with field m i _field a relation value a Increase by 1, i.e., RelationTable i j =[...,(field_id) a ,value a +1),...],a! =j.

[0043] If Cov j-b -(Cov j ∪Cov b If )>0, then it proves that field mi _field j When used as the primary mutation field, it is related to field m. i _field b Combined mutations can cover branches that would not be covered by individual mutations, updating the main mutation field m. i _field j The corresponding relation table is RelationTable. i j Combine it with field m i _field b relation value b Increase by 1, i.e., RelationTable i j =[...,(field_id) b ,value b +1),...],b! =j.

[0044] Return to step 2-2-2 and continue execution targeting the primary mutation field m. i _field j Combinatorial variation work.

[0045] The results feedback phase specifically includes:

[0046] The coverage information obtained from shared memory statistics in steps 2-3 will be displayed on the page in real time; the number of times the server crashes are triggered during fuzz testing will be displayed in real time; and the test cases that trigger server crashes will be saved for easy reproduction and analysis of the crashes later.

[0047] Another objective of this invention is to provide a protocol fuzzing system based on syntax generation and coverage guidance, such as... Figure 1 As shown, it includes:

[0048] Test Preparation Module. This module primarily provides the system's input and preprocesses some of it. By analyzing the request packets corresponding to the protocol under test and combining this with the protocol's specifications, the data model set M of the protocol is defined using the data model definition function provided by the BooFuzz ​​fuzzing framework. set This serves as a protocol specification template for generating new test cases; the gcc compiler tool included with Aflfast is used to instrument and compile the protocol entity program under test, generating the corresponding binary executable file; the generated executable file is run, and 64KB of shared memory is allocated for real-time coverage information statistics;

[0049] The fuzzing module uses the data model set M defined in the test preparation module. setData models m are selected sequentially. i Then, execute the combined mutation module and the relation learning module:

[0050] Combinatorial mutation module. This module is responsible for mutating data from the current data model m. i A randomly selected mutable field m i _field j As the primary mutation field, and each time the primary mutation field is mutated, guided by the relation table corresponding to that field, it is derived from the current data model m. i Two related mutation fields are selected and combined with the main mutation field to mutate, resulting in a three-field mutated data model m. i * This generates a Packet of test cases with three mutated fields. i * Packet test cases i * Input into the protocol entity program under test.

[0051] The relation learning module receives a mutated data model m with three fields from the combination and mutation module. i * The data is broken down into multiple combinations to obtain data packages that are used for real-time learning and updating of the current data model m. i Middle principal mutation field m i _field j The corresponding relation table is then used to guide the next combination mutation module in the selection of the principal mutation field m. i _field j The process of combined mutations.

[0052] Result feedback module. For test case packets... i * The results input into the protocol entity program under test are analyzed. The overall coverage information during fuzzing is provided in real time; the number of times the server crashes are triggered during fuzzing is also provided in real time, and the test cases that trigger server crashes are saved for later reproduction and analysis.

[0053] The beneficial effects of this invention are:

[0054] 1. This invention adopts a protocol fuzzing testing method based on syntax generation and coverage guidance, which introduces heuristic ideas and improves coverage and testing efficiency.

[0055] 2. Compared to existing protocol fuzzers based on syntax generation, such as BooFuzz, the coverage-guided heuristic fuzzing method proposed in this invention effectively solves the problem of random and blind mutation processes caused by the lack of guidance in traditional syntax-generation-based fuzzers. In this invention, coverage is used to guide the fuzzing process, combining mutations in directions more conducive to increasing coverage, discovering more uncovered paths, and thus improving the coverage of the fuzzing test.

[0056] 3. Using the method of this invention, the testing efficiency of protocol fuzzing can be improved, and more code can be explored within the same testing time. Attached Figure Description

[0057] Figure 1 This is a flowchart illustrating the heuristic protocol fuzzing method based on syntax generation and coverage guidance of the present invention.

[0058] Figure 2 This is a schematic diagram of the data model set defined in the present invention, which uses the RTSP protocol as an example, to illustrate the heuristic protocol fuzzing method based on syntax generation and coverage guidance.

[0059] Figure 3 The present invention provides a heuristic protocol fuzzing method based on syntax generation and coverage guidance, taking the RTSP protocol data model setup as an example, and the initial relation table when the mutable field Transport is used as the main mutable field.

[0060] Figure 4 This diagram illustrates how the potential value of the data model changes with the fuzzing process in the heuristic protocol fuzzing method based on syntax generation and coverage guidance of this invention.

[0061] Figure 5 This diagram illustrates how the potential value of the main mutation field changes during the fuzzing process in the heuristic protocol fuzzing method based on syntax generation and coverage guidance of this invention.

[0062] Figure 6 This is a schematic diagram illustrating the process of using relation tables to guide combinatorial mutation in the heuristic protocol fuzzing method based on syntax generation and coverage guidance of the present invention.

[0063] Figure 7 This is a flowchart illustrating the process of decomposing the data model of three-field combination mutation in the relation learning module of the heuristic protocol fuzzing method based on syntax generation and coverage guidance in this invention.

[0064] Figure 8 This diagram illustrates the beneficial effects of combined mutations in the heuristic protocol fuzzing method based on syntax generation and coverage guidance of the present invention.

[0065] Figure 9 This is a comparison chart of experimental results in the heuristic protocol fuzzing method based on syntax generation and coverage guidance of this invention. Detailed Implementation

[0066] The technical solutions of the present invention will now be fully described with reference to the accompanying drawings in the embodiments of the present invention.

[0067] like Figure 1 As shown, the heuristic protocol fuzzing method based on syntax generation and coverage guidance consists of three main stages: test preparation, fuzzing, and result feedback. The fuzzing stage includes a relation learning stage and a combinatorial mutation stage.

[0068] The test preparation phase includes the following steps:

[0069] 1-1. By analyzing the request data packets corresponding to the protocol under test and combining them with the protocol specification, the data model set M of the protocol is defined using the data model definition function provided by the BooFuzz ​​fuzzing framework. set ={m1,...,m i ,...,m n}, i = 1,...,n, where n is the total number of protocol data models to be tested, and the defined set of data models is used as a protocol specification template for generating new test cases;

[0070] like Figure 3 Taking the RTSP protocol as an example, the defined data model set M set ={options,describe,describe2,setup,play,pause,teardown,get_paramter,set_paramter,record,annouse}, such as Figure 2 As shown.

[0071] 1-2. Use the gcc compiler tool that comes with aflfast to instrument and compile the protocol entity program under test to generate the corresponding binary executable file;

[0072] 1-3. Run the executable file generated in step 1-2, and allocate a 64KB shared memory space (ShareMem is an empirical value; 64KB can represent 65,536 branches, which is greater than the number of branches of most protocol entity programs under test, and can meet the branch coverage statistics requirements of most protocol entity programs under test) to collect real-time statistics on the coverage information of the protocol entity programs under test.

[0073] 2. The fuzz testing phase mainly includes the following steps:

[0074] 2-1. Data Model Selection

[0075] From the data model set M defined in step 1-1 Set Select a data model m in sequence i And initialize the potential value of the data model, modelPotential. i =MC (MC is an empirical value. The larger the value, the more mutations the data model will undergo. For balance, it is generally set to 10000). Next, in the combination mutation stage, new test cases are generated based on the data model.

[0076] 2-2. Combinatorial Variation Stage

[0077] The function of the combination mutation stage: for the data model m selected in step 2-1 i Guided by the relational tables, guided combinations and variations are performed on them to generate more effective test cases. This process includes the following steps:

[0078] 2-2-1. Selection of Main Variants

[0079] For the data model m selected in step 2-1 i Data model m i It contains multiple mutable fields, defined as a set of mutable fields M. i _Field set ={m i _field1,...,m i _field j ,...,m i _field x}, j = 1,...,x, where x is the data model m i The number of mutable fields included, from the set of mutable fields M i _Field set Randomly select one of the mutable fields m i _field j As the primary mutation field, initialize the primary mutation field m. i _field j The corresponding relational table is defined, and the potential value of the primary mutation field, fieldPotential, is initialized. i j =FC(fieldPotential) i j Representing data model m iThe potential value when the j-th variable field is used as the primary mutation field. FC is an empirical value. The larger the value, the more mutations the primary mutation field will have and the longer the test time will be. For balance, it is generally set to 1000.

[0080] The relational table is a row x-1 (x is the data model m). i The structure is a two-dimensional array with two columns (the number of mutable fields included), and each major mutable field has a corresponding relation table. The field m... i _field j When used as a primary variant field, the relation table is: RelationTable i j =[(field_id1,value1),...,(field_id k ,value k ),...(field_id x ,value x )],k=1,...,x,k!=j,x is the data model m i The number of mutable fields included, field_id k Representing data model m i The unique ID of the Kth mutable field, value k This refers to the mutable field m corresponding to this ID. i _field k With the main mutation field m i _field j relational value k The initial value is 0.

[0081] Over the next period of time, guided by the relational tables, we will work on the primary mutation field m. i _field j The combined mutation work continues until the potential value of the field, fieldPotential, is reached. i j Exhausted;

[0082] 2-2-2. Using relational tables to guide combinational variation

[0083] For the main mutation field m selected in step 2-2-1 i _field j Combined with its corresponding RelationTable i j Sort the entries in the relation table from largest to smallest according to their relation values, and then randomly select two entries (field_id) according to the probability of an exponential distribution. a,value a ),(field_id b ,value b Select the corresponding field m based on the ID in the table entry. i _field a m i _field b m, as the main mutation field i _field j The associated fields are combined with the main mutated fields for mutation.

[0084] Based on the mutation library provided by BooFuzz, from the main mutation field m i _field j The main mutation field m is obtained by randomly selecting an element from the mutation library corresponding to the type. i _field j The mutated value of mutated_field j .

[0085] Similarly, the associated mutation field m is obtained. i _field a m i _field b The mutated value of mutated_field a mutated_field b .

[0086] This leads to the data model m of the three-field combination variation. i * This generates a Packet of test cases with three mutated fields. i * ; A flowchart using relational tables to guide combinational variation, such as Figure 6 As shown.

[0087] 2-3. Inject test cases into the protocol entity program under test.

[0088] The test case packet generated in step 2-2-2 i * Inject into the system under test and collect the bitmap information of the shared memory ShareMem allocated in steps 1-3.

[0089] If no new branch coverage is generated, the data model potential value initialized in step 2-1 will be used. i Decrease by 1, and set the potential value of the primary mutation field initialized in step 2-2-1 to fieldPotential. i jDecrease by 1; if modelPotential i If the value is 0, return to step 2-1 and execute. If fieldPotential is not specified... i j If the value is 0, then return to step 2-2-1 for execution.

[0090] If a new branch overlay is found when analyzing the bitmap information of ShareMem, then modelPotential will be... i Reassign the initial value MC, and set fieldPotential. i j Reassign the initial value FC.

[0091] The diagram illustrates the changes in the potential value of the data model during fuzz testing. Figure 4 As shown, if data model m i-1 If the potential value is exhausted, then from the data model set M set Select data model m in sequence i Conduct fuzz testing.

[0092] The diagram illustrates the changes in the potential values ​​of the primary mutation field. Figure 5 As shown, when dealing with data model m i When performing fuzz testing, if the primary mutation field m i _field j-1 If the potential value is exhausted, then from the data model m i The set of mutable fields M i _Field set Randomly select other mutable fields, such as m i _field j As a new primary mutation field, it is subjected to combined mutations.

[0093] If the test case packet generated in step 2-2-2 i If the program of the protocol under test crashes, an exception log will be recorded and the test case packet will be saved. i * is used for vulnerability analysis after the test is completed.

[0094] The pseudocode for the algorithm flow of combined mutation is as follows:

[0095]

[0096]

[0097] 2-4. Relationship Learning Stage

[0098] The relational learning phase is used to learn the data model mi Middle principal mutation field m i _field j With data model m i Other mutable fields {m i _field1,...,m i _field k ,...,m i _field x The correlation between k = 1, ..., x and k! = j reflects a trend where combined mutation of two fields can trigger branches that would not be triggered by mutation of the two fields individually. This correlation is quantitatively represented in the form of a relational table, specifically including the following steps:

[0099] 2-4-1. Data Model Decomposition

[0100] The data model m obtained in step 2-2-2 combines and mutates the three fields. i * The process involves disassembling the data and extracting the mutated values ​​from the three mutated fields, specifically the `mutated_field`. j Main variant field m i _field j The mutated value, mutated_field a mutated_field b For the combined variation field m i _field a m i _field b The mutated value. A data model m that undergoes combined mutation of three fields. i * The disassembly process diagram is as follows: Figure 7 As shown.

[0101] 2-4-2. Generate corresponding data packets using the decomposed data model.

[0102] Replace the selected data model m in step 2-1 with the mutated values ​​of the fields obtained in step 2-4-1. i The corresponding data packet is obtained by referring to the corresponding fields in the database. The specific process is as follows:

[0103] Using mutated_field j Replace data model m i The main mutation field m in i _field j This generates a packet that has only mutated the main mutated field. j .

[0104] Using mutated_field a Replace data model m i The combined variation field m in i _field a The generation only mutated m i _field a field data packet a .

[0105] Using mutated_field b Replace data model m i The combined variation field m in i _field b The generation only mutated m i _field b field data packet b .

[0106] Using mutated_field j and mutated_field a Replace data model m respectively i field m i _field j and field m i _field a The main mutation field m is obtained. i _field j With the first combined variation field m i _field a All data packets have been mutated j-a .

[0107] Using mutated_field j and mutated_field b Replace data model m respectively i field m i _field j and field m i _field b The main mutation field m is obtained. i _field j With the second combined variation field m i _field b All data packets have been mutated j-b .

[0108] 2-4-3. Update the relationship table

[0109] The data packet obtained in step 2-4-2 j packet a packet b packet j-a and packet j-b The data packets are injected into the protocol entity program under test, and a new temporary shared memory (TemShareMem) is allocated for each new data packet injected. The bitmap information of the temporary shared memory (TemShareMem) is collected, and the temporary shared memory is released after the collection is completed. The branch coverage (Cov) of the aforementioned data packets in the protocol entity program under test can then be obtained. j 、Cov a 、Cov b 、Cov j-a 、Cov j-b .

[0110] If Cov j-a -(Cov j ∪Cov a If )>0, then it proves that field m i _field j When used as the primary mutation field, it is related to field m. i _field a A combined mutation that can cover branches that would not be covered by their individual mutations indicates that the main mutation field m is... i _field j With field m i _field a Combinatorial mutation is effective, as illustrated in the diagram below. Figure 8 As shown, the primary mutation field m needs to be updated. i _field j The corresponding relation table is RelationTable. i j Combine it with field m i _field a relation value a Increase by 1, i.e., RelationTable i j =[...,(field_id) a ,value a +1),...],a! =j.

[0111] If Cov j-b -(Cov j ∪Cov b If )>0, then it proves that field m i _field jWhen used as the primary mutation field, it is related to field m. i _field b If a combined mutation can cover branches that it could not cover when mutated individually, then the primary mutation field m needs to be updated. i _field j The corresponding relation table is RelationTable. i j Combine it with field m i _field b relation value b Increase by 1, i.e., RelationTable i j =[...,(field_id) b ,value b +1),...],b! =j.

[0112] Return to step 2-2-2 and continue execution targeting the primary mutation field m. i _field j Combinatorial variation work.

[0113] The pseudocode for the relation learning algorithm is as follows:

[0114]

[0115]

[0116] The results feedback phase specifically includes:

[0117] The coverage information obtained from shared memory statistics in steps 2-3 will be displayed on the page in real time; the number of times the server crashes are triggered during fuzz testing will be displayed in real time; and the test cases that trigger server crashes will be saved for easy reproduction and analysis of the crashes later.

[0118] To verify the effectiveness of the method, experiments were conducted on the RTSP protocol, with the black-box fuzzer BooFuzz ​​used as the control group. In the experiments, we selected two metrics to measure the effectiveness of the method: branch coverage and test efficiency. The first metric is typically used to measure the effectiveness of a fuzzing program, while the second metric represents the ability to cover more branch paths with fewer test cases. The final experimental data results are as follows: Figure 9 As shown.

[0119] The experimental data shows that, after using the method of this invention, the implemented system GFuzz achieves the same branch coverage at a speed 1.3-1.5 times faster than the original syntax-based protocol fuzzer BooFuzz. Compared with the original BooFuzz, the branch coverage of this method is improved by 3.25%.

[0120] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. All equivalent changes and modifications made within the scope of the present invention are within the scope of protection of the present invention.

Claims

1. A protocol fuzzing method based on syntax generation and coverage guidance, characterized in that, include: Test preparation phase, fuzz testing phase, and results feedback phase; The fuzz testing phase includes a relation learning phase and a combinatorial variation phase. The fuzzing phase includes the following steps: 3-1. Data Model Selection; The set of data models M defined in the test preparation phase. Set Select a data model m in sequence i And initialize the potential value of the data model, modelPotential. i =MC; Where MC is an empirical value. The larger the value, the more mutations the data model will undergo. With a value of 10000, new test cases will be generated based on the data model in the next stage of combination mutation. 3-2. Combinatorial Variation Stage; Function of the Combinatorial Variation Stage: For the data model m selected in step 3-1... i Guided by the relational table, it can be used to perform guided combination and variation, thereby generating more effective test cases; 3-2-1. Selection of primary variant fields; for the data model m selected in step 3-1 i Data model m i It contains multiple mutable fields, defined as a set of mutable fields M. i _Field set = {m i _field1, ... , m i _field j , ... ,m i _field x }, j = 1, ..., x, where x is the data model m i The number of mutable fields included, from the set of mutable fields M i _Field set Randomly select one of the mutable fields m i _field j As the primary mutation field, initialize the primary mutation field m. i _field j The corresponding relational table is defined, and the potential value of the primary mutation field, fieldPotential, is initialized. i j =FC; Among them, fieldPotential i j Representing data model m i The potential value when the j-th mutable field is used as the primary mutation field. FC is an empirical value. The larger the value, the more mutations the primary mutation field will have and the longer the test time will be. The value of FC is 1000. The relational table is a two-dimensional array structure with x-1 rows and 2 columns, where x is the data model m. i The number of mutable fields included, with each major mutable field having a corresponding relation table, field m. i _field j When used as a primary variant field, the relation table is: RelationTable i j = [(field_id1, value1), ... , (field_id k value k ), ... (field_id x value x )], k=1, ..., x, k!=j, where x is the data model m i The number of mutable fields included, field_id k Representing data model m i The unique ID of the Kth mutable field, value k This refers to the mutable field m corresponding to this ID. i _field k With the main mutation field m i _field j relational value k The initial value is 0; Over the next period of time, guided by the relational tables, we will work on the primary mutation field m. i _field j The combined mutation work continues until the potential value of the field, fieldPotential, is reached. i j Exhausted; 3-2-2. Relationship Tables Guide Combinatorial Variation For the main mutation field m selected in step 3-2-1 i _field j Combined with its corresponding RelationTable i j Sort the entries in the relation table from largest to smallest according to their relation values, and then randomly select two entries (field_id) according to the probability of an exponential distribution. a value a ), (field_id b value b Select the corresponding field m based on the ID in the table entry. i _field a m i _field b m, as the main mutation field i _field j The associated field is combined with the main mutation field for mutation, resulting in a three-field mutated data model m. i * This generates a Packet of test cases with three mutated fields. i * ; 3-4. Relationship Learning Stage The relational learning phase is used to learn the data model m i Middle principal mutation field m i _field j With data model m i Other mutable fields {m i _field1, ... , m i _field k , ... , m i _field x The correlation between}, k = 1, ..., x, k != j reflects a trend that the combined mutation of two fields can trigger branches that cannot be triggered when the two fields are mutated individually. This correlation is quantitatively represented in the form of a relational table.

2. The protocol fuzzing method based on syntax generation and coverage guidance according to claim 1, characterized in that, The test preparation phase includes the following sub-steps: 2-1. By analyzing the request data packets corresponding to the protocol under test and combining them with the protocol specification, the data model set M of the protocol is defined using the data model definition function provided by the BooFuzz ​​fuzzing framework. set = {m1, ..., m i , ..., m n }, i=1, ..., n, where n is the total number of protocol data models to be tested, and the defined set of data models is used as a protocol specification template for generating new test cases; 2-2. Use the gcc compiler tool that comes with aflfast to instrument and compile the protocol entity program to be tested, and generate the corresponding binary executable file; 2-3. Run the executable file generated in step 2-2, and allocate a 64KB shared memory space (ShareMem) to collect real-time statistics on the coverage information of the protocol entity program under test.

3. The protocol fuzzing method based on syntax generation and coverage guidance according to claim 2, characterized in that, The fuzzing phase also includes the following steps: 3-3. Inject test cases into the protocol entity program under test. The test case packet generated in step 3-2-2 i * Inject into the system under test and collect the bitmap information of the shared memory ShareMem allocated in steps 2-3; If no new branch coverage is generated, the data model potential value initialized in step 3-1 will be used. i Decrease by 1, and set the potential value of the primary mutation field initialized in step 3-2-1 to fieldPotential. i j Decrease by 1; if modelPotential i If the value is 0, return to step 3-1 and execute. If fieldPotential is not specified... i j If the value is 0, then return to step 3-2-1 for execution; If a new branch overlay is found when analyzing the bitmap information of ShareMem, then modelPotential will be... i Reassign the initial value MC, and set fieldPotential. i j Reassign initial value FC; If the test case packet generated in step 3-2-2 i If the program of the protocol under test crashes, an exception log will be recorded and the test case packet will be saved. i * is used for vulnerability analysis after the test is completed; 3-4. The relationship learning phase also includes the following sub-steps: 3-4-1. Data Model Decomposition The data model m obtained in step 3-2-2 is a combination of three fields with variations. i * The process involves disassembling the data and extracting the mutated values ​​from the three mutated fields, specifically the `mutated_field`. j Main variant field m i _field j The mutated value, mutated_field a mutated_field b The combined variation field m are respectively i _field a m i _field b The mutated value; 3-4-2. Generate corresponding data packets using the decomposed data model. Replace the selected data model m in step 3-1 with the mutated values ​​of the fields obtained in step 3-4-1. i The corresponding data packet is obtained by referring to the corresponding fields in the database. 3-4-3. Update the relationship table The data packets obtained in step 3-4-2 are injected into the protocol entity program under test, and a new temporary shared memory (TemShareMem) is allocated each time a new data packet is injected. The bitmap information of the temporary shared memory (TemShareMem) is counted, and the temporary shared memory is released after the count is completed. The branch coverage of the above data packets in the protocol entity program under test (Cov) is obtained respectively. j 、Cov a 、Cov b 、Cov j-a 、Cov j-b； If Cov j-a -(Cov j ∪Cov a If ) > 0, then it proves that field m i _field j When used as the primary mutation field, it is related to field m. i _field a Combined mutations can cover branches that would not be covered by individual mutations, updating the main mutation field m. i _field j The corresponding relation table is RelationTable. i j Combine it with field m i _field a relation value a Increase by 1, i.e., RelationTable i j = [ ... , (field_id a value a +1), ... ], a!=j; If Cov j-b -(Cov j ∪Cov b If ) > 0, then it proves that field m i _field j When used as the primary mutation field, it is related to field m. i _field b Combined mutations can cover branches that would not be covered by individual mutations, updating the main mutation field m. i _field j The corresponding relation table is RelationTable. i j Combine it with field m i _field b relation value b Increase by 1, i.e., RelationTable i j = [..., (field_id) b value b +1), ... ], b!=j; Return to step 3-2-2 and continue execution targeting the primary mutation field m. i _field j Combinatorial variation work; The results feedback phase specifically includes: The coverage information obtained from shared memory statistics in step 3-3 will be displayed on the page in real time; the number of times the server crashes are triggered during fuzz testing will be displayed in real time; and the test cases that trigger server crashes will be saved for easy reproduction and analysis of the crashes later.

4. The protocol fuzzing method based on syntax generation and coverage guidance according to claim 3, characterized in that, Step 3-4-2 includes the following sub-steps: Using mutated_field j Replace data model m i The main mutation field m in i _field j This generates a packet that has only mutated the main mutated field. j； Using mutated_field a Replace data model m i The combined variation field m in i _field a The generation only mutated m i _field a field data packet a； Using mutated_field b Replace data model m i The combined variation field m in i _field b The generation only mutated m i _field b field data packet b； Using mutated_field j and mutated_field a Replace data model m respectively i field m i _field j and field m i _field a The main mutation field m is obtained. i _field j With the first combined variation field m i _field a All data packets have been mutated j-a； Using mutated_field j and mutated_field b Replace data model m respectively i field m i _field j and field m i _field b The main mutation field m is obtained. i _field j With the second combined variation field m i _field b All data packets have been mutated j-b ; In step 3-4-2, the data packet is injected into the protocol entity program under test: packet j packet a packet b packet j-a and packet j-b Injected into the protocol entity program under test respectively.

5. A protocol fuzz testing system based on syntax generation and coverage guidance, characterized in that, include: Test preparation module; The test preparation module provides the input for this system and preprocesses some of the input; By analyzing the request data packets corresponding to the protocol under test and combining them with the protocol specification, the data model set M of the protocol is defined using the data model definition function provided by the BooFuzz ​​fuzzing framework. set This serves as a protocol specification template for generating new test cases; the gcc compiler tool included with Aflfast is used to instrument and compile the protocol entity program under test, generating the corresponding binary executable file; the generated executable file is run, and 64KB of shared memory is allocated for real-time coverage information statistics; The fuzzing module uses the data model set M defined in the test preparation module. set Data models m are selected sequentially. i Then, the combined mutation module and the relation learning module are executed: Combinatorial mutation module; this module is responsible for mutating data from the current data model m. i A randomly selected mutable field m i _field j As the primary mutation field, and each time the primary mutation field is mutated, guided by the relation table corresponding to that field, it is derived from the current data model m. i Two related mutation fields are selected and combined with the main mutation field to mutate, resulting in a three-field mutated data model m. i * This generates a Packet of test cases with three mutated fields. i * Packet test cases i * Input into the protocol entity program under test; Relationship learning module; The relation learning module receives a mutated data model m with three fields from the combination and mutation module. i * The data is broken down into multiple combinations to obtain data packages that are used for real-time learning and updating of the current data model m. i Middle principal mutation field m i _field j The corresponding relation table is then used to guide the next combination mutation module in the selection of the principal mutation field m. i _field j The combined mutation process; Result information feedback module; for test case packets i * The results input into the protocol entity program under test are analyzed; the overall coverage information during the fuzzing process is fed back in real time. The system provides real-time feedback on the number of times the server crashes are triggered during fuzz testing, and saves the test cases that trigger server crashes for easy reproduction and analysis later.

Images