State-aware fuzzing system and method for 5g ngap protocol
By designing a state-aware fuzzy testing system, the problem of low testing efficiency of the 5G NGAP protocol in existing technologies is solved. It realizes efficient stateful fuzzy testing, which can comprehensively test core business logic and record anomaly logs, thereby improving test coverage and anomaly detection capabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANGHAI JIAOTONG UNIV
- Filing Date
- 2022-12-19
- Publication Date
- 2026-05-12
AI Technical Summary
Existing fuzz testing techniques cannot effectively test the state machine of the 5G NGAP protocol, resulting in low testing efficiency and extremely low coverage, making it impossible to fully test core business logic.
Design a state-aware fuzzy testing system, including test data generation, protocol state maintenance, field mutation, component under test monitoring, and log analysis and recording modules. By generating raw test data samples, specifying the location of the field to be tested, and monitoring and recording abnormal logs in the 5G core network, stateful fuzzy testing can be achieved.
It improves the efficiency and coverage of fuzz testing for the 5G NGAP protocol, enabling targeted testing of the protocol state machine, efficient detection of anomalies and recording of error information, and support for further analysis.
Smart Images
Figure CN115987605B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and more specifically, to a state-aware fuzzy testing system and method for the 5G NGAP protocol. Background Technology
[0002] Mobile communication networks see a new generation of technology emerge roughly every 10 years, achieving several-fold increases in network capacity through the introduction of key technologies and driving the continuous emergence of new service types. Since the 1980s, mobile communication technology has undergone five stages of development, each having a broad and profound impact on the digital development of the economy and society. Mobile communication networks at different stages have faced different security issues and risks. As protocol and standards-setting organizations continuously update and improve their concepts, protocol security is also iterating and improving.
[0003] First-generation (1G) mobile networks, as the earliest communication networks, had little consideration for security and were vulnerable to interception, replay, and spoofing attacks. Second-generation (2G) mobile networks were plagued by widespread and exploitable security issues related to fake base stations, spam messages, and SMS spoofing, with lasting impacts today. Third-generation (3G) mobile networks introduced IP-based communication protocols for the first time, allowing vulnerabilities and attack surfaces in internet security to shift to mobile networks. Fourth-generation (4G) mobile networks brought significant improvements in connection speed and network quality, expanding the use cases and applications of mobile networks, further amplifying and complicating security threats. From 1G to 4G, signaling exchange between mobile core network elements was based on fixed links, with the control plane and user plane increasingly separated and decoupled. Compared to 4G, 5G uses a completely new network architecture, offering at least 10 times the peak speed of 4G, millisecond-level transmission latency, and the ability to connect hundreds of billions of devices.
[0004] The 5G core network has restructured the traditional architecture, redefining network entities using Network Functions (NFs). Each NF provides application implementations with independent functions and enables mutual calls, meaning an NF entity can be further broken down into several self-contained, self-managed, and reusable NF services. NFs are decoupled from each other, possessing independent upgrade and elasticity capabilities, as well as the ability to interoperate with other NF services through standard interfaces. Furthermore, they can be orchestrated and instantiated according to different needs using orchestration tools. Compared to the traditional point-to-point network element architecture in the communications industry, the architectural improvements and transformations of the 5G core network are unprecedented.
[0005] TCP and SCTP protocols are commonly used within the 5G core network and between the user plane and control plane. The N2 communication interface between the RAN and AMF uses the NGAP protocol, which is carried by SCTP. The testing objective of this invention is to perform stateful fuzzy testing on internal network functions (NFs) such as the AMF using the NGAP protocol and the N1 and N2 protocol families.
[0006] Existing fuzzing techniques cannot maintain the state machine of 5G network protocols. Blindly generating test data packets leads to low testing efficiency, extremely low coverage, and an inability to test core business logic. Therefore, this invention proposes a state-aware fuzzing testing system for the 5G NGAP protocol, aiming to address the shortcomings of existing fuzzing techniques for 5G network protocols. Summary of the Invention
[0007] In view of the deficiencies in the prior art, the purpose of this invention is to provide a state-aware fuzzy testing system and method for the 5G NGAP protocol.
[0008] A state-aware fuzzy testing system for the 5G NGAP protocol provided by the present invention includes:
[0009] Test data generation module: Generates raw test data samples, specifying the location of the field to be tested and the protocol state machine stage;
[0010] Protocol state maintenance module: Maintains the component under test to the target state machine stage according to the specified protocol state machine stage;
[0011] Field Mutation Module: Mutates the specified field to be tested in the original test data sample, generates fuzzy test cases, and sends the generated fuzzy test cases to the component under test. Based on the returned data of the component under test, it determines whether the mutation has occurred and sends the mutation result to the log analysis module.
[0012] The monitored component under test module monitors the working status of the component under test. When an anomaly occurs, it collects the current crash log and sends it to the log analysis and recording module.
[0013] Log analysis and recording module: collects crash logs generated by abnormal components, determines the location of the exception, and stores the sent fuzz test cases and field mutation information.
[0014] Preferably, in the test data generation module, the original test data sample comes from user-input definitions and / or packet capture files obtained from network data packets;
[0015] The user input definition needs to use a programming language to describe the complete interaction process and the expected return result;
[0016] The original test data sample includes multi-stage data transmission and expected responses.
[0017] Preferably, in the field mutation module, the specified test field position of the original test data sample is mutated to generate a fuzzy test case. The generated fuzzy test case is sent to the component under test. The field mutation module receives the return data of the component under test and compares the return data with the expected return to determine whether the response of the current test data is in the normal protocol state machine. Otherwise, the log analysis and recording module is notified.
[0018] Preferably, the monitoring module of the component under test operates within the 5G core network and has control over the component under test.
[0019] Preferably, in the log analysis and recording module, the mutation results and abnormal situations are aggregated, and a decision is made as to whether the current abnormality is caused by the fuzzy test sample sent by the current field mutation module. If so, it is recorded.
[0020] A state-aware fuzzy testing method for the 5G NGAP protocol provided by the present invention includes:
[0021] Step S1: The test data generation module generates raw test data samples, specifying the location of the field to be tested and the protocol state machine stage;
[0022] Step S2: The protocol state maintenance module maintains the component under test to the target state machine stage according to the specified protocol state machine stage;
[0023] Step S3: The field mutation module mutates the specified field to be tested in the original test data sample to generate fuzzy test cases, and sends the generated fuzzy test cases to the component under test. Based on the returned data of the component under test, it determines whether mutation has occurred, and sends the mutation result to the log analysis module.
[0024] Step S4: The monitored module of the component under test monitors the working status of the component under test. When an anomaly occurs, it collects the current crash log and sends it to the log analysis and recording module.
[0025] Step S5: The log analysis and recording module collects crash logs generated by abnormal components, determines the location of the abnormality, and stores the sent fuzz test cases and field mutation information.
[0026] Preferably, in the test data generation module, the original test data sample comes from user-input definitions and / or packet capture files obtained from network data packets;
[0027] The user input definition needs to use a programming language to describe the complete interaction process and the expected return result;
[0028] The original test data sample includes multi-stage data transmission and expected responses.
[0029] Preferably, in the field mutation module, the specified test field position of the original test data sample is mutated to generate a fuzzy test case. The generated fuzzy test case is sent to the component under test. The field mutation module receives the return data of the component under test and compares the return data with the expected return to determine whether the response of the current test data is in the normal protocol state machine. Otherwise, the log analysis and recording module is notified.
[0030] Preferably, the monitoring module of the component under test operates within the 5G core network and has control over the component under test.
[0031] Preferably, in the log analysis and recording module, the mutation results and abnormal situations are aggregated, and a decision is made as to whether the current abnormality is caused by the fuzzy test sample sent by the current field mutation module. If so, it is recorded.
[0032] Compared with the prior art, the present invention has the following beneficial effects: The present invention provides a state-aware fuzzy testing system for the 5G NGAP protocol. This method can perform stateful fuzzy testing on the 5G network communication protocol NGAP, and has the ability to reproducibly maintain the state through the protocol state maintenance module. It can perform targeted fuzzy testing on each state inside the protocol state machine, and, combined with the log analysis and recording module deployed inside the core network, collect the working status and working logs of the network function (NF) under test, and efficiently provide error information for further analysis when anomalies occur. Attached Figure Description
[0033] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:
[0034] Figure 1 This is a schematic diagram of a state-aware fuzzy testing system for the 5G NGAP protocol.
[0035] Figure 2 This is a flowchart of a state-aware fuzzy testing method for the 5G NGAP protocol. Detailed Implementation
[0036] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.
[0037] To address the shortcomings of existing technologies, this invention proposes a state-aware fuzzy testing system and method for the 5G NGAP protocol, which solves the problem that traditional fuzzy testing systems for network protocols cannot test the complex 5G network control protocol NGAP.
[0038] Example 1
[0039] According to the present invention, a state-aware fuzzy testing system for the 5G NGAP protocol is provided, such as... Figure 1 As shown, it includes: a test data generation module, a protocol status maintenance module, a field mutation module, a tested component monitoring module, and a log analysis and recording module;
[0040] The test data generation module is used to generate raw test data samples, which are valid request samples. The data stored in this module is complete protocol stack data, derived from manual input definitions and network packet captures. By analyzing network data packets, complete process and data information in the protocol interaction is obtained. A complete protocol state transition is called a process. A process can include multiple requests, and the requests conform to the NGAP protocol format. A request can include multiple data fields to be tested, such as binary data streams, integers, floating-point numbers, strings, etc., and can also include process-specific data information, such as specific field data returned by a previous specific request in the same process, or constant information, such as the current time, random numbers, etc. A complete process constitutes a raw test data sample for fuzz testing.
[0041] The test data generation module initiates a test within a specific test process, providing raw process information, specifying the fields to be tested for a particular request and the target protocol status for that test, and its commands and status information can be accessed and obtained by other modules.
[0042] After the test data generation module initiates a test request, the protocol status maintenance module first reads the target protocol status information and complete process data from the test data generation module. After determining the status of the target request under test, it reads from the beginning of the process and communicates with the module under test to initiate protocol interaction. Before reaching the target status, it saves the return data of each request and determines whether the current status conforms to normal operating conditions until the target protocol status is reached. After reaching the target protocol status, it sends all return data and request information from the request process to the log analysis and recording module.
[0043] The protocol state maintenance module parses and uses the raw test data samples provided by the test data generation module to fill each request with the required protocol state flow data, thus completing the normal flow of the protocol state.
[0044] The field mutation module reads the test request and the field information from the test data generation module. After the protocol state maintenance module completes state maintenance, it mutates the specified field to be tested in the test cases from the test data generation module. The mutation should include different values that conform to the original data type requirements of the test field, including but not limited to extreme values and other values of different types from the original data type, to test the response of the module under test to unexpected behavior. After mutation, the value is inserted into the request, communication is established with the module under test, the returned data is recorded, and the data is delivered to the logging module.
[0045] The monitoring module of the component under test operates within the 5G core network and works independently of the testing process. This module is not controlled by the test data generation module, protocol status maintenance module, field mutation module, or log analysis and recording module.
[0046] The monitored module for the component under test has control permissions over the component under test and monitors its working status. This module has full control permissions over the component under test and can read the component's logs, obtain its running status, forcibly terminate its operation, and restart it.
[0047] The monitored component under test (DUT) module constantly monitors the DUT's operational status. When an anomaly occurs, this module collects the current operational logs, records the current time, and sends the notification to an external log analysis module. After notification, the DUT restarts. Anomalies include, but are not limited to, DUT crashes or generates high-level error logs.
[0048] After receiving the anomaly notification and crash log from the monitoring module of the component under test, the log analysis and recording module stores the anomaly information and crash log, marks the time of the anomaly, and reads the process information and request information sent from the protocol state maintenance module and the field mutation module, including the process steps, all original request data sent when the anomaly occurred, and the data returned by the request, for testers to perform further comparative analysis.
[0049] Example 2
[0050] According to the present invention, a state-aware fuzzy testing method for the 5G NGAP protocol is provided, such as... Figure 2 As shown, it includes:
[0051] Step S1: The test data generation module is used to generate raw test data samples. These samples are legitimate request samples, derived from manual input definitions and network packet captures. After selecting the raw test sample, this module specifies the location of the field to be tested and the protocol state machine stage, and delivers it to the field mutation module and the protocol state maintenance module for processing.
[0052] Step S2: The protocol status maintenance module receives the protocol status requirements from the test data generation module, communicates with the component under test first, and after the protocol reaches the test target status, it informs the field mutation module to proceed to the next stage of processing.
[0053] Step S3: After the protocol state maintenance module completes the state maintenance, the field mutation module mutates the test cases from the test data generation module at the specified test locations to generate new test cases, communicates with the module under test, sends fuzzy test data, and sends the mutation results to the log analysis module.
[0054] Step S4: The monitoring module of the component under test operates within the 5G core network, has control over the component under test, and monitors the working status of the component under test; when an anomaly occurs, it collects the current crash log, sends it to the external log analysis and recording module to inform it of the abnormal event and record it.
[0055] Step S5: After receiving the exception notification and crash log from the monitoring module of the component under test, the log analysis and recording module stores the exception information and crash log, collects the test cases and protocol status requirements currently being tested, and merges and saves them to the local storage device for testers to analyze.
[0056] Specifically, the raw test data that the test data generation module can accept can come from user input definitions and packet capture files of network packets; if user input definitions are used, the user needs to use a programming language to describe the complete interaction process and the expected return result; a raw test sample of fuzz testing consists of multi-stage data transmission and expected return, where the data transmission in each stage can be used as a specified mutation field.
[0057] Specifically, the field mutation module only mutates the fields specified by the test data generation module, and does not change other fields of the original test cases.
[0058] Specifically, during the test, two modules communicate with the component under test sequentially. The protocol state maintenance module first completes the maintenance and arrival of the specified protocol state. The field mutation module communicates with the component under test after the protocol state arrives at the test stage, sends the generated fuzzy test sample, and receives the return data from the component under test. It compares the data with the expected state to determine whether the response of the current test data is still in the normal protocol state machine. Otherwise, it informs the log analysis and recording module.
[0059] Specifically, the 5G core network contains the monitoring components required for this method's testing. The monitored module of the component under test monitors the working status of the core network components internally and is responsible for collecting abnormal information and crash logs.
[0060] Specifically, the log analysis and recording module aggregates mutation results and abnormal situations, determines whether the current abnormality is caused by the fuzzy test sample sent by the current field mutation module, and records it if so.
[0061] Those skilled in the art will understand that, in addition to implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.
[0062] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.
Claims
1. A state-aware fuzzy testing system for the 5G NGAP protocol, characterized in that, include: Test data generation module: Generates raw test data samples, specifying the location of the field to be tested and the protocol state machine stage; Protocol state maintenance module: Maintains the component under test to the target state machine stage according to the specified protocol state machine stage; Field Mutation Module: Mutates the specified field to be tested in the original test data sample, generates fuzzy test cases, and sends the generated fuzzy test cases to the component under test. Based on the returned data of the component under test, it determines whether the mutation has occurred and sends the mutation result to the log analysis and recording module. The monitored component under test module monitors the working status of the component under test. When an anomaly occurs, it collects the current crash log and sends it to the log analysis and recording module. Log analysis and recording module: collects crash logs generated by abnormal components, determines the location of the abnormality, and stores the sent fuzz test cases and field mutation information; The monitoring module of the component under test operates within the 5G core network and has control over the component under test. In the log analysis and recording module, the mutation results and abnormal situations are aggregated, and a decision is made as to whether the current abnormality is caused by the fuzzy test sample sent by the current field mutation module. If so, it is recorded.
2. The state-aware fuzzy testing system for the 5G NGAP protocol according to claim 1, characterized in that, In the test data generation module, the original test data sample comes from user input definitions and / or packet capture files obtained from network data packets; The user input definition needs to use a programming language to describe the complete interaction process and the expected return result; The original test data sample includes multi-stage data transmission and expected responses.
3. The state-aware fuzzy testing system for the 5G NGAP protocol according to claim 1, characterized in that, In the field mutation module, the specified test field position of the original test data sample is mutated to generate a fuzzy test case. The generated fuzzy test case is sent to the component under test. The field mutation module receives the return data of the component under test and compares the return data with the expected return to determine whether the response of the current test data is in the normal protocol state machine. Otherwise, the log analysis and recording module is notified.
4. A state-aware fuzzy testing method for the 5G NGAP protocol, characterized in that, include: Step S1: The test data generation module generates raw test data samples, specifying the location of the field to be tested and the protocol state machine stage; Step S2: The protocol state maintenance module maintains the component under test to the target state machine stage according to the specified protocol state machine stage; Step S3: The field mutation module mutates the specified field to be tested in the original test data sample to generate fuzzy test cases, and sends the generated fuzzy test cases to the component under test. Based on the returned data of the component under test, it determines whether mutation has occurred, and sends the mutation result to the log analysis and recording module. Step S4: The monitored module of the component under test monitors the working status of the component under test. When an anomaly occurs, it collects the current crash log and sends it to the log analysis and recording module. Step S5: The log analysis and recording module collects crash logs generated by abnormal components, determines the location of the abnormality, and stores the sent fuzz test cases and field mutation information; The monitoring module of the component under test operates within the 5G core network and has control over the component under test. In the log analysis and recording module, the mutation results and abnormal situations are aggregated, and a decision is made as to whether the current abnormality is caused by the fuzzy test sample sent by the current field mutation module. If so, it is recorded.
5. The state-aware fuzzy testing method for the 5G NGAP protocol according to claim 4, characterized in that, In the test data generation module, the original test data sample comes from user input definitions and / or packet capture files obtained from network data packets; The user input definition needs to use a programming language to describe the complete interaction process and the expected return result; The original test data sample includes multi-stage data transmission and expected responses.
6. The state-aware fuzzy testing method for the 5G NGAP protocol according to claim 4, characterized in that, In the field mutation module, the specified test field position of the original test data sample is mutated to generate a fuzzy test case. The generated fuzzy test case is sent to the component under test. The field mutation module receives the return data of the component under test and compares the return data with the expected return to determine whether the response of the current test data is in the normal protocol state machine. Otherwise, the log analysis and recording module is notified.