A data modification method and apparatus
By acquiring and validating the XML configuration file, extracting tag parameter values and storing them in a two-dimensional list, and modifying the PCAP packet to generate a new packet, the problem of existing tools being unable to efficiently construct malformed messages is solved, enabling simple and efficient data modification and robustness testing.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2022-12-27
- Publication Date
- 2026-07-21
Smart Images
Figure CN116010262B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and more specifically, to a data modification method and apparatus. Background Technology
[0002] With the rapid development of internet and information technology, databases have been deployed and applied more widely. Currently, to ensure database security, enterprises typically introduce database auditing or database security systems. However, in practice, it has been found that database security auditing or systems have a prerequisite: system robustness. Therefore, if the system's robustness is insufficient, parsing malformed database packets may lead to abnormal system interruptions. Thus, before introducing database auditing or other database security systems, robustness testing and verification are usually performed by constructing malformed packets.
[0003] To construct the aforementioned malformed messages, numerous message modification tools have been released on the market. However, practical experience has shown that these tools all have their limitations, making it impossible to efficiently construct the required malformed messages. Consequently, the robustness testing and verification of database auditing and database security systems have not yet achieved sufficiently good results. Summary of the Invention
[0004] The purpose of this application is to provide a data modification method and apparatus that can more easily and conveniently modify batch messages (data) to obtain malformed messages, thereby improving the practicality and production efficiency of malformed message production, and thus enabling robustness testing and verification to achieve better results.
[0005] The first aspect of this application provides a data modification method, including:
[0006] Obtain the PCAP package and XML configuration file;
[0007] Verify whether the XML configuration file conforms to the preset default rules;
[0008] When the XML configuration file conforms to the default rule, extract the tag parameter values from the XML configuration file;
[0009] Store the label parameter values in a two-dimensional list;
[0010] The PCAP package is modified based on the two-dimensional list to obtain a new PCAP package.
[0011] In the above implementation process, this method prioritizes obtaining the PCAP packet and the corresponding XML configuration file. This allows testers familiar with database message protocols to guide subsequent data modifications, lowering the barrier for testers to modify data (constructing malformed messages) and making the method easier to implement, facilitating batch data modification. Next, the method verifies whether the XML configuration file conforms to preset default rules. This can be achieved by calling the ElementTree class to traverse the configuration file and determine if it meets the modification requirements, thus performing a preliminary screening of the PCAP packet and ensuring a high success rate for data modification. Finally, if the XML configuration file conforms to the default rules, the method extracts the tag parameter values from the XML configuration file and stores them in a two-dimensional list. This allows the method to obtain, categorize, and sort the tag parameter values from the XML configuration file before storing them in a two-dimensional list, facilitating subsequent automatic modification and meeting the needs of batch modification, thus achieving the effect of batch data modification. Finally, the method modifies the PCAP packet based on the two-dimensional list to obtain a new PCAP packet. It can be seen that the method can determine and modify the specified bytes in the PCAP packet based on the two-dimensional list, thereby generating a new PCAP packet and completing the purpose of data modification. At the same time, it is also convenient for batch and customized data modification.
[0012] Furthermore, the XML configuration file is an XML protocol template, which includes at least a general protocol template and a special protocol template.
[0013] In the above implementation process, this type of XML configuration file can clearly and concisely describe various complex processes, actions, and data dependencies, thereby ensuring that the protocol process description can be effectively identified by the tool, thus improving the convenience and stability of data modification.
[0014] Furthermore, the step of verifying whether the XML configuration file conforms to the preset default rules includes:
[0015] Verify whether the XML configuration file conforms to the preset default format rules; and verify whether the XML configuration file conforms to the preset default parameter rules;
[0016] When the XML configuration file conforms to the default format rules and the default parameter rules, the step of extracting the tag parameter values from the XML configuration file is triggered.
[0017] In the above implementation process, this method verifies whether the XML configuration file conforms to the preset default rules, including whether it conforms to the preset default format rules and whether it conforms to the preset default parameter rules. Therefore, this method considers both format and parameter validation when validating the XML configuration file, thus determining the feasibility and stability of data modification from multiple perspectives.
[0018] Furthermore, the step of storing the label parameter value into a two-dimensional list includes:
[0019] Create temporary lists and value lists;
[0020] The tag parameter values are categorized according to their type to obtain filter tag parameter values, result tag parameter values, szone tag parameter values, and dzone tag parameter values; wherein, the dzone tag parameter values include Variable sub-tag parameter values and random-number sub-tag parameter values;
[0021] Based on the temporary list, the filter tag parameter value, the result tag parameter value, the szone tag parameter value, and the dzone tag parameter value are cyclically stored in the storage list corresponding to the tag parameter type to obtain a two-dimensional list.
[0022] In the above implementation process, when storing label parameter values into a two-dimensional list, this method can first create a temporary list and a storage list to initialize them, facilitating their use in subsequent steps. Then, the method can classify the label parameter values according to their type, obtaining filter, result, szone, and dzone label parameter values. The dzone label parameter values include Variable and random-number sub-label parameter values. This demonstrates that the method can create different storage lists based on four classification results, achieving category-based storage and improving data distinguishability and queryability. Next, based on the temporary list, the method iteratively stores the filter, result, szone, and dzone label parameter values into the storage lists corresponding to their respective label parameter types, resulting in a two-dimensional list. This shows that the method can continuously transfer label parameter values from the temporary list to the storage lists, achieving automatic and efficient writing of label parameter values, thus facilitating batch processing.
[0023] Furthermore, the step of modifying the PCAP packet based on the two-dimensional list to obtain a new PCAP packet includes:
[0024] Based on the filter label parameter value in the two-dimensional list, the bytes to be modified are filtered out in the PCAP packet;
[0025] Based on the szone tag parameter value in the two-dimensional list, verify whether the MD5 value of the byte to be modified is correct;
[0026] When the MD5 value of the byte to be modified is correct, the replacement byte is determined according to the result tag parameter value in the two-dimensional list;
[0027] The replacement mode is determined based on the dzone label parameter values in the two-dimensional list;
[0028] Based on the replacement pattern and the replacement byte, the byte to be modified is modified to obtain a new PCAP packet.
[0029] In the above implementation process, this method, when modifying a PCAP packet based on a two-dimensional list to obtain a new PCAP packet, prioritizes filtering out the bytes to be modified in the PCAP packet based on the filter tag parameter value in the two-dimensional list. This demonstrates that the method can determine the bytes to be modified in the PCAP packet based on the two-dimensional list, preparing for subsequent replacement. Then, the method verifies the MD5 value of the bytes to be modified based on the szone tag parameter value in the two-dimensional list; this further ensures the accuracy of determining the bytes to be modified, thereby improving the precision of data modification. Next, if the MD5 value of the bytes to be modified is correct, the method determines the replacement byte based on the result tag parameter value in the two-dimensional list; this further determines the replacement byte after determining the bytes to be modified, thus providing sufficient data preparation for data modification. At this point, the method can determine the replacement mode based on the dzone tag parameter value in the two-dimensional list; this allows the method to determine the corresponding replacement mode based on the user's selection, making data modification controllable rather than completely random. Finally, the method modifies the bytes to be modified based on the replacement pattern and the replacement bytes to obtain a new PCAP packet. It can be seen that this method can modify the PCAP packet based on custom conditions and the obtained data before and after, so as to obtain an accurate new PCAP packet, which is convenient for using the new PCAP packet to perform other methods, such as robustness testing.
[0030] A second aspect of this application provides a data modification apparatus, the data modification apparatus comprising:
[0031] The acquisition unit is used to acquire PCAP packets and XML configuration files;
[0032] The verification unit is used to verify whether the XML configuration file conforms to the preset default rules;
[0033] An extraction unit is used to extract tag parameter values from the XML configuration file when the XML configuration file conforms to the default rules;
[0034] Storage unit, used to store the tag parameter values into a two-dimensional list;
[0035] The modification unit is used to modify the PCAP package based on the two-dimensional list to obtain a new PCAP package.
[0036] In the above implementation process, the device can acquire PCAP packets and XML configuration files through the acquisition unit; verify whether the XML configuration file conforms to preset default rules through the verification unit; extract the tag parameter values from the XML configuration file when it conforms to the default rules through the extraction unit; store the tag parameter values in a two-dimensional list through the storage unit; and modify the PCAP packets based on the two-dimensional list through the modification unit to obtain new PCAP packets. It is evident that this device can more easily and conveniently modify batch messages (data) to obtain malformed messages, thereby improving the practicality and efficiency of malformed message production, and ultimately enabling robustness testing and verification to achieve better results.
[0037] Furthermore, the XML configuration file is an XML protocol template, which includes at least a general protocol template and a special protocol template.
[0038] Furthermore, the verification unit is specifically used to verify whether the XML configuration file conforms to the preset default format rules; and to verify whether the XML configuration file conforms to the preset default parameter rules;
[0039] The verification unit is further configured to trigger the extraction unit to perform the operation of extracting tag parameter values from the XML configuration file when the XML configuration file conforms to the default format rules and the default parameter rules.
[0040] Furthermore, the storage unit includes:
[0041] Create sub-cells for creating temporary lists and value lists;
[0042] The classification subunit is used to classify the label parameter values according to the label parameter type to obtain filter label parameter values, result label parameter values, szone label parameter values and dzone label parameter values; wherein, the dzone label parameter values include Variable sub-label parameter values and random-number sub-label parameter values;
[0043] The storage subunit is used to cyclically store the filter label parameter value, the result label parameter value, the szone label parameter value, and the dzone label parameter value into the storage list corresponding to the label parameter type, based on the temporary list, to obtain a two-dimensional list.
[0044] Furthermore, the modification unit includes:
[0045] A filtering subunit is used to filter out bytes to be modified in the PCAP packet based on the filter label parameter value in the two-dimensional list.
[0046] The verification subunit is used to verify whether the MD5 value of the byte to be modified is correct based on the szone tag parameter value in the two-dimensional list.
[0047] A sub-unit is defined to determine the replacement byte based on the result tag parameter value in the two-dimensional list when the MD5 value of the byte to be modified is correct.
[0048] The determining subunit is further configured to determine the replacement mode based on the dzone tag parameter value in the two-dimensional list;
[0049] The modification subunit is used to modify the byte to be modified based on the replacement pattern and the replacement byte to obtain a new PCAP packet.
[0050] A third aspect of this application provides an electronic device, including a memory and a processor. The memory stores a computer program, and the processor runs the computer program to cause the electronic device to perform the data modification method described in any one of the first aspects of this application.
[0051] A fourth aspect of this application provides a computer-readable storage medium storing computer program instructions, which, when read and executed by a processor, perform the data modification method described in any one of the first aspects of this application. Attached Figure Description
[0052] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0053] Figure 1 A flowchart illustrating a data modification method provided in an embodiment of this application;
[0054] Figure 2 A flowchart illustrating another data modification method provided in an embodiment of this application;
[0055] Figure 3 This is a schematic diagram of the structure of a data modification device provided in an embodiment of this application;
[0056] Figure 4 This is a schematic diagram of another data modification device provided in an embodiment of this application;
[0057] Figure 5 This is a schematic diagram illustrating an example of a data modification method provided in an embodiment of this application;
[0058] Figure 6 This application provides a schematic diagram illustrating a specific tag value storage example.
[0059] Figure 7 This is a schematic diagram illustrating an example process for generating a new PCAP package, provided as an embodiment of this application. Detailed Implementation
[0060] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.
[0061] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.
[0062] Example 1
[0063] Please refer to Figure 1 , Figure 1 This embodiment provides a flowchart illustrating a data modification method. The data modification method includes:
[0064] S101. Obtain the PCAP package and XML configuration file.
[0065] In this embodiment, the XML configuration file is an XML protocol template, which includes at least a general protocol template and a special protocol template.
[0066] S102. Verify whether the XML configuration file conforms to the preset default rules. If yes, proceed to steps S103 to S105; otherwise, end the process.
[0067] S103. Extract tag parameter values from the XML configuration file.
[0068] S104. Store the label parameter values in a two-dimensional list.
[0069] S105. Modify the PCAP package based on the two-dimensional list to obtain a new PCAP package.
[0070] In this embodiment, the method is based on intelligent fuzz testing and developed using the Python language. It references the ElementTree class and the Scapy program, and provides users with parameter filtering and modification functions by reading XML configuration files. This allows the database messages to be rewritten, and ultimately, database protocol communication messages or malformed messages are constructed for developers and testers to perform message replay operations, thereby verifying the robustness of the relevant system.
[0071] For example, this method mainly includes the following steps:
[0072] (1) Read the XML configuration file; verify whether the configuration file conforms to the preset default rules;
[0073] (2) After the verification is successful, a two-dimensional list is automatically created to store the tag parameter values of each level in the XML file;
[0074] (3) Replace the corresponding parameters and bytes of the PCAP package according to the parameters and rules; generate a new PCAP package.
[0075] Please refer to Figure 5 , Figure 5 A schematic diagram illustrating an example of this method is shown.
[0076] Implementing this method allows for batch modifications and message construction as starting points, significantly improving the practicality and modification efficiency of the method.
[0077] Implementing this method also allows for the provision of template configuration files by personnel familiar with the database message protocol, which can serve as a modification example guide, thereby lowering the barrier to entry for testers to use the method and device.
[0078] This implementation method also allows for a focus on applications in scenarios involving replaying modified database messages. Specifically, it enables message deconstruction and reconstruction based on the significant differences between messages from different database protocols and according to usage requirements.
[0079] In this embodiment, the subject executing the method can be a computing device such as a computer or server, and no limitation is made in this embodiment.
[0080] In this embodiment, the subject executing the method can also be a smart device such as a smartphone or tablet, and no limitation is made in this embodiment.
[0081] As can be seen, the data modification method described in this embodiment supports batch modification of data (messages), thereby achieving the effect of batch production of malformed messages; it also enables modification of any field in database messages, thus solving the problem that traditional methods can only modify message header information at layers 2-4; it provides a rich GUI interface based on Python, solving the problem that traditional methods only support command-line operations; and it can further develop graphical interfaces according to actual needs, making it intuitive and convenient, thus greatly improving the usability of the method. On the other hand, this method uses commonly used database protocol templates built into the tool, so that the byte positions of the parameters to be modified can be understood simply by reading the configuration file, thereby reducing the usage and operation threshold of data modification, making data modification simpler and faster.
[0082] Example 2
[0083] Please refer to Figure 2 , Figure 2 This embodiment provides a flowchart illustrating a data modification method. The data modification method includes:
[0084] S201. Obtain the PCAP package and XML configuration file.
[0085] In this embodiment, the XML configuration file is an XML protocol template. The design of this XML protocol template is crucial to whether the protocol flow description can be effectively recognized by the corresponding tools; therefore, the design of the configuration template is key to this method.
[0086] In this embodiment, the general design principle of the XML protocol template is to clearly and concisely describe various complex processes, actions, and data dependencies. Specific key points are as follows:
[0087] (1) An XML protocol template defines the format of all data packet fields and the method of field generation for communication between one or more database protocols.
[0088] (2) For each data packet, there is a corresponding set of packet parsing templates. The field names of the two templates are the same, but the content definitions are different. The packet parsing template is used to define the data generation method and provide the expected value and actual value acquisition method of the field.
[0089] (3) By defining different XML keywords, describe the various key actions or elements in the protocol interaction process.
[0090] (4) For a single field or region entity, specify the data generation method by defining its different attributes.
[0091] (5) Define multiple “region” keywords to describe different data processing in different interaction scenarios.
[0092] In this embodiment, the XML protocol template includes at least a general protocol template and a special protocol template. The general protocol template primarily provides the functionality to modify header fields at layers 2-4 of the message, as detailed below:
[0093] (1) Modify the Layer 2 header of the message, including the source MAC address and the destination MAC address;
[0094] (2) Modify the three-layer header of the message, including the source IP address and the destination IP address;
[0095] (3) Modify the four-layer header of the message, including the source address port number and the destination address port number.
[0096] The special protocol template records the parameter byte positions of specific database protocols and modifies them according to the message payload. Therefore, messages that cannot be parsed by packet capture programs (such as DB2, DM databases, etc.) can have their parameters quickly identified and located using the special protocol template.
[0097] S202. Verify whether the XML configuration file conforms to the preset default format rules and preset default parameter rules. If yes, proceed to steps S203 to S208; otherwise, end this process.
[0098] In this embodiment, the method can achieve the validation effect by calling the ElementTree class in Python to traverse the configuration file. Specifically, this validation can be divided into format validation and parameter validation.
[0099] In this embodiment, format validation checks whether the configuration file conforms to preset default rules, which can be achieved by calling the ElementTree class to traverse the configuration file.
[0100] In this embodiment, parameter validation refers to calling a sub-method of the ElementTree class to retrieve tags, parameters, and values from the configuration file and then validating them. The parameter validation mainly consists of four parts:
[0101] (1) Verify that the tags in the file exist.
[0102] (2) Whether the default tag is based on the XML configuration file.
[0103] (3) The existence of the required label parameter must be verified. For example, if you want to use the batch replace and generate function, the label parameter must exist and have a fixed value.
[0104] (4) Whether the label parameter value is compliant. For example, the batch replacement parameter mentioned above cannot be negative. If the parameter verification fails, the process will be exited directly.
[0105] S203. Extract tag parameter values from the XML configuration file.
[0106] S204. Create a temporary list and a value list.
[0107] S205. Classify the label parameter values according to the label parameter type to obtain filter label parameter values, result label parameter values, szone label parameter values and dzone label parameter values; among them, dzone label parameter values include Variable sub-label parameter values and random-number sub-label parameter values.
[0108] In this embodiment, the method can preferentially create a temporary list and a value list. The temporary list is used to store the tag parameter value and sub-tag parameter value for each loop, while the value list is used to store the total loop tag parameter value and sub-tag parameter value.
[0109] In this embodiment, the method can classify and store values according to parameter type, which can be mainly divided into four categories: filter, result, szone, and dzone. Each category is stored in a loop without interfering with each other, and the temporary list is cleared each time.
[0110] In this embodiment, the framer tag mainly records the source MAC address, destination MAC address, source IP, destination IP, source port number, destination port number, and protocol type of the packet;
[0111] In this embodiment, the parameter types recorded in the result tag are completely consistent with those in the filter tag. Data packets that fully meet the filtering criteria of the filter tag will be modified and replaced according to the various parameters of the result tag.
[0112] In this embodiment, the szone tag is used to filter out raw packets that meet the parameter conditions. It consists of a start byte, an end byte, and an MD5 value. The MD5 parameter needs to be filled in by the user; here, the MD5 value should be the MD5 hash of the raw packet calculated from the start byte to the end byte. The test program locates the byte position of the filtered packet based on the start and end bytes in the szone, calculates the MD5 value, and compares it with the MD5 value input by the user. If they match, the verification passes; otherwise, the verification fails and the program exits.
[0113] In this embodiment, the dzone tag is used to modify the packets filtered by the szone tag according to parameters. It consists of a start byte, an end byte, a type (replacement type), and a value (specified replacement value). Multiple dzone tags are allowed, so during iteration, packets are modified and generated in batches based on different dzone tags. The type can only be 0 or 1. When it is 0, it specifies the byte replacement mode, in which the user needs to edit the value to replace the difference between the end byte and the start byte. When it is 1, it uses a random byte replacement mode, where the test program randomly generates bytes to replace the specified area of data. The value refers to the value the user wants to replace; its length must be the same as the difference between the end byte and the start byte.
[0114] In this embodiment, the dzone tag may also include two parameters: Variable and random-number. Variable is a variable type, and its configuration options include: enable and disable (enable: enable the dzone structure to replace the specified byte; disable: disable this structure to replace the specified byte). random-number specifies the random byte filling method, and its configuration option includes: 1-2-4-8, indicating the number of random bytes to fill when the user enables the random byte replacement mode (e.g., if the user enables the random byte replacement mode and sets random-number to 4, then the test program will randomly generate 4 bytes each time to fill the difference between the ending byte and the starting byte).
[0115] Please refer to Figure 6 , Figure 6 A schematic diagram illustrating a specific tag value storage process is shown.
[0116] For example, after the loop, before clearing the temporary list, the contents of the temporary list are appended to the value lists of various types to generate a two-dimensional list. For example, a dzone value list [['85', '88', '0', 'ff-ff-ff-ff'], ['7', '10', '0', 'ff-ff-ff-ff']], where '85' represents the starting position of the load, '88' represents the ending position, '0' represents the specified byte replacement pattern, and 'ff-ff-ff-ff' represents the replaced byte. The replacement module only needs to traverse the list index to get the desired list and corresponding value.
[0117] S206. Based on the temporary list, iteratively store the filter label parameter value, result label parameter value, szone label parameter value, and dzone label parameter value into the storage list corresponding to the label parameter type to obtain a two-dimensional list.
[0118] S207. Based on the filter label parameter value in the two-dimensional list, filter out the bytes to be modified in the PCAP packet.
[0119] S208. Based on the szone tag parameter value in the two-dimensional list, verify whether the MD5 value of the byte to be modified is correct. If yes, proceed to steps S209 to S211; otherwise, end the process.
[0120] S209. Determine the replacement byte based on the result label parameter value in the two-dimensional list.
[0121] S210. Determine the replacement mode based on the dzone label parameter value in the two-dimensional list.
[0122] S211. Modify the bytes to be modified based on the replacement pattern and replacement bytes to obtain a new PCAP packet.
[0123] In this embodiment, the method can be simply understood as automatically replacing the corresponding parameters in the PCAP package according to the result list values after the verification is passed.
[0124] Please refer to Figure 7 , Figure 7 A schematic diagram illustrating an example process for generating a new PCAP package is shown.
[0125] For example, this method can be applied to database security within firewalls. Specifically, by using this method in database security applications within a firewall, it becomes easier to construct database packets in batches for redirection and replay, thereby improving the robustness of the database protocol parser. The specific process is as follows:
[0126] (1) The database firewall device is deployed between the database client and the server to intercept communication data packets;
[0127] (2) Obtain database communication packets from the firewall application;
[0128] (3) Modify the data packet according to this method;
[0129] (4) Organize and modify the generated message packets;
[0130] (5) The firewall, in conjunction with the parsing results and the configured security policy, replays the modified data packets to test and verify their robustness.
[0131] The application process of this method is as follows:
[0132] (1) Use tcpdump to capture a complete SQL request and response packet of the DM database.
[0133] (2) According to the SQL statement parsing rules of the DM database, use the corresponding tool to quickly filter out the messages that need to be modified according to the szone tag parameter in the xml configuration file, and modify the query statement length of the SQL request message packet and the result set length of the response message in batches according to the dzone tag parameter, affecting the number of rows / returned rows, constructing malformed messages, and generating modified message packets. The generated messages are in a new file, and the default path for generating pcap files needs to be specified using the scapy class.
[0134] (3) The generated packets are redirected and replayed on the firewall. The firewall's security module will check whether it will report an error or be abnormally interrupted after matching the parsed data according to the configured security policy, thereby verifying the robustness of the device.
[0135] In this example, the method first requires configuring a special protocol template for the database XML file. Alternatively, developers can configure default templates for common databases such as Oracle and MySQL, which is more convenient for use and testing. During configuration, the source and destination IP addresses, MAC addresses, port numbers, protocol type, and the positions (start and end bytes) of the login message parameters, along with their replacement method (random generation or manual filling), should be recorded in the special protocol template.
[0136] Then, use a packet capture tool such as tcpdump to capture a complete login request and response packet from the DM database. Use a packet modification tool to read the XML configuration file parameters to modify the login request and response packets.
[0137] Finally, after configuring the database security module policy of the firewall, replay the modified packets on the firewall and observe whether there are any errors or abnormal interruptions after parsing and matching the data, thus verifying the robustness of the device.
[0138] In this embodiment, the subject executing the method can be a computing device such as a computer or server, and no limitation is made in this embodiment.
[0139] In this embodiment, the subject executing the method can also be a smart device such as a smartphone or tablet, and no limitation is made in this embodiment.
[0140] As can be seen, the data modification method described in this embodiment supports batch modification of data (messages), thereby achieving the effect of batch production of malformed messages; it also enables modification of any field in database messages, thus solving the problem that traditional methods can only modify message header information at layers 2-4; it provides a rich GUI interface based on Python, solving the problem that traditional methods only support command-line operations; and it can further develop graphical interfaces according to actual needs, making it intuitive and convenient, thus greatly improving the usability of the method. On the other hand, this method uses commonly used database protocol templates built into the tool, so that the byte positions of the parameters to be modified can be understood simply by reading the configuration file, thereby reducing the usage and operation threshold of data modification, making data modification simpler and faster.
[0141] Example 3
[0142] Please refer to Figure 3 , Figure 3 This is a schematic diagram of a data modification device provided in this embodiment. Figure 3 As shown, the data modification device includes:
[0143] Acquisition unit 310 is used to acquire the PCAP package and XML configuration file;
[0144] Verification unit 320 is used to verify whether the XML configuration file conforms to the preset default rules;
[0145] Extraction unit 330 is used to extract tag parameter values from the XML configuration file when the XML configuration file conforms to the default rules;
[0146] Storage unit 340 is used to store label parameter values into a two-dimensional list;
[0147] Modification unit 350 is used to modify the PCAP package based on a two-dimensional list to obtain a new PCAP package.
[0148] In this embodiment, the explanation of the data modification device can be referred to the description in Embodiment 1 or Embodiment 2, and will not be repeated here.
[0149] As can be seen, the data modification device described in this embodiment can support batch modification of data (messages), thereby achieving the effect of batch production of malformed messages; it can also modify any field of database messages, thus solving the problem that traditional methods can only modify message header information at layers 2-4; it can also provide a rich GUI interface based on Python, solving the problem that traditional methods only support command-line operations; and it can further develop graphical interfaces according to actual needs, which are intuitive and convenient, thus greatly improving the usability of the method. On the other hand, the method adopts the method of embedding commonly used database protocol templates in the tool, so that the byte position of the parameter to be modified can be understood simply by reading the configuration file, thereby reducing the usage and operation threshold of data modification, and making data modification simpler and faster.
[0150] Example 4
[0151] Please refer to Figure 4 , Figure 4 This is a schematic diagram of a data modification device provided in this embodiment. Figure 4 As shown, the data modification device includes:
[0152] Acquisition unit 310 is used to acquire the PCAP package and XML configuration file;
[0153] Verification unit 320 is used to verify whether the XML configuration file conforms to the preset default rules;
[0154] Extraction unit 330 is used to extract tag parameter values from the XML configuration file when the XML configuration file conforms to the default rules;
[0155] Storage unit 340 is used to store label parameter values into a two-dimensional list;
[0156] Modification unit 350 is used to modify the PCAP package based on a two-dimensional list to obtain a new PCAP package.
[0157] In this embodiment, the XML configuration file is an XML protocol template, which includes at least a general protocol template and a special protocol template.
[0158] As an optional implementation, the verification unit 320 is specifically used to verify whether the XML configuration file conforms to the preset default format rules; and to verify whether the XML configuration file conforms to the preset default parameter rules;
[0159] The validation unit 320 is also used to trigger the extraction unit to extract the tag parameter values in the XML configuration file when the XML configuration file conforms to the default format rules and default parameter rules.
[0160] As an optional implementation, the storage unit 340 includes:
[0161] Create sub-unit 341 to create temporary lists and value lists;
[0162] The classification subunit 342 is used to classify the label parameter values according to the label parameter type to obtain filter label parameter values, result label parameter values, szone label parameter values and dzone label parameter values; among which, the dzone label parameter values include Variable sub-label parameter values and random-number sub-label parameter values;
[0163] Storage subunit 343 is used to store the filter label parameter value, result label parameter value, szone label parameter value and dzone label parameter value into a storage list corresponding to the label parameter type based on a temporary list, thus obtaining a two-dimensional list.
[0164] As an optional implementation, the modified unit 350 includes:
[0165] The filtering subunit 351 is used to filter out the bytes to be modified in the PCAP packet based on the filter label parameter value in the two-dimensional list;
[0166] Verification subunit 352 is used to verify whether the MD5 value of the byte to be modified is correct based on the szone tag parameter value in the two-dimensional list.
[0167] Determine subunit 353, which is used to determine the replacement byte based on the result label parameter value in the two-dimensional list when the MD5 value of the byte to be modified is correct;
[0168] Subunit 353 is also used to determine the replacement mode based on the dzone label parameter value in the two-dimensional list;
[0169] Modify subunit 354 to modify the byte to be modified based on the replacement pattern and the replacement byte, and obtain a new PCAP packet.
[0170] In this embodiment, the explanation of the data modification device can be referred to the description in Embodiment 1 or Embodiment 2, and will not be repeated here.
[0171] As can be seen, the data modification device described in this embodiment can support batch modification of data (messages), thereby achieving the effect of batch production of malformed messages; it can also modify any field of database messages, thus solving the problem that traditional methods can only modify message header information at layers 2-4; it can also provide a rich GUI interface based on Python, solving the problem that traditional methods only support command-line operations; and it can further develop graphical interfaces according to actual needs, which are intuitive and convenient, thus greatly improving the usability of the method. On the other hand, the method adopts the method of embedding commonly used database protocol templates in the tool, so that the byte position of the parameter to be modified can be understood simply by reading the configuration file, thereby reducing the usage and operation threshold of data modification, and making data modification simpler and faster.
[0172] This application provides an electronic device, including a memory and a processor. The memory stores a computer program, and the processor runs the computer program to enable the electronic device to perform the data modification method in embodiment 1 or embodiment 2 of this application.
[0173] This application provides a computer-readable storage medium storing computer program instructions. When these computer program instructions are read and executed by a processor, they perform the data modification method described in embodiment 1 or embodiment 2 of this application.
[0174] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
[0175] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.
[0176] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0177] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0178] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
[0179] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
Claims
1. A data modification method, characterized in that, include: Obtain the PCAP package and XML configuration file; Verify whether the XML configuration file conforms to the preset default rules; the default rules include default format rules and default parameter rules; When the XML configuration file conforms to the default rule, extract the tag parameter values from the XML configuration file; The label parameter values are categorized and stored in a two-dimensional list; the label parameter types corresponding to the label parameter values include filter label parameter values, result label parameter values, szone label parameter values, and dzone label parameter values; wherein, the dzone label parameter values include Variable sub-label parameter values and random-number sub-label parameter values; The PCAP packet is modified based on the two-dimensional list to obtain a new PCAP packet; The step of modifying the PCAP packet based on the two-dimensional list to obtain a new PCAP packet includes: Based on the filter label parameter value in the two-dimensional list, the bytes to be modified are filtered out in the PCAP packet; Based on the szone tag parameter value in the two-dimensional list, verify whether the MD5 value of the byte to be modified is correct; When the MD5 value of the byte to be modified is correct, the replacement byte is determined according to the result tag parameter value in the two-dimensional list; The replacement mode is determined based on the dzone label parameter values in the two-dimensional list; Based on the replacement pattern and the replacement byte, the byte to be modified is modified to obtain a new PCAP packet.
2. The data modification method according to claim 1, characterized in that, The XML configuration file is an XML protocol template, which includes at least a general protocol template and a special protocol template.
3. The data modification method according to claim 1, characterized in that, The step of classifying and storing the label parameter values into a two-dimensional list includes: Create temporary lists and value lists; The tag parameter values are categorized according to their type to obtain filter tag parameter values, result tag parameter values, szone tag parameter values, and dzone tag parameter values; wherein, the dzone tag parameter values include Variable sub-tag parameter values and random-number sub-tag parameter values; Based on the temporary list, the filter tag parameter value, the result tag parameter value, the szone tag parameter value, and the dzone tag parameter value are cyclically stored in the storage list corresponding to the tag parameter type to obtain a two-dimensional list.
4. A data modification device, characterized in that, The data modification device includes: The acquisition unit is used to acquire PCAP packets and XML configuration files; The validation unit is used to validate whether the XML configuration file conforms to preset default rules; the default rules include default format rules and default parameter rules. An extraction unit is used to extract tag parameter values from the XML configuration file when the XML configuration file conforms to the default rules; A storage unit is used to classify and store the label parameter values into a two-dimensional list; the label parameter types corresponding to the label parameter values include filter label parameter values, result label parameter values, szone label parameter values, and dzone label parameter values; wherein, the dzone label parameter values include Variable sub-label parameter values and random-number sub-label parameter values; The modification unit is used to modify the PCAP packet based on the two-dimensional list to obtain a new PCAP packet; The modification units include: The filtering sub-unit is used to filter out bytes to be modified in the PCAP packet based on the filter label parameter value in the two-dimensional list; The verification subunit is used to verify whether the MD5 value of the byte to be modified is correct based on the szone tag parameter value in the two-dimensional list. The determined sub-unit is used to determine the replacement byte based on the result label parameter value in the two-dimensional list when the MD5 value of the byte to be modified is correct; Determining sub-units is also used to determine the replacement pattern based on the dzone label parameter value in the two-dimensional list; The modified sub-unit is used to modify the bytes to be modified based on the replacement pattern and the replacement bytes, thereby obtaining a new PCAP packet.
5. The data modification device according to claim 4, characterized in that, The XML configuration file is an XML protocol template, which includes at least a general protocol template and a special protocol template.
6. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform the data modification method according to any one of claims 1 to 3.
7. A readable storage medium, characterized in that, The readable storage medium stores computer program instructions, which, when read and executed by a processor, perform the data modification method according to any one of claims 1 to 3.