A Fuzzy Testing Method and System for Network Protocols Based on State and Message Awareness

Abstract

This invention relates to a state- and message-aware network protocol fuzzing method and system. The invention aims to provide a method that addresses the problem of existing mutation-based network protocol fuzzing techniques being insensitive to the order and structure of message sequences and exhibiting blindness. During protocol testing, a global message pool needs to be created and maintained for the target state of the protocol under test. Infix messages are extracted from interesting message sequences, and their value scores are calculated according to a given message value evaluation formula. Finally, these messages are added to the message pool maintained by the target state. Subsequently, messages with high value scores are selected from the state-specific message pool for mutation operations each time, thereby improving the efficiency of protocol fuzzing. This invention is applicable to all network protocol fuzzing tools based on AFLNET improvements and has advantages such as simple implementation principle and high efficiency in network protocol vulnerability detection.

Description

Technical Field

[0001] This invention belongs to the field of network protocol security testing technology, specifically involving a fuzzy testing method and system for network protocols based on state and message awareness. Background Technology

[0002] With the development of internet technology, network communication security has become an important research area. Using network protocols in internet services allows users to communicate with remote servers more efficiently and reliably. Therefore, discovering potential security vulnerabilities is crucial to ensuring the security of network protocol entities. Network protocols define the correct order and structure of messages that can be exchanged between two or more network participants. However, this ability to communicate with servers from anywhere in the world provides attackers with opportunities to compromise remote code. Attackers don't even need physical access to the server. OpenSSL is a protocol entity used to ensure secure communication within the SSL / TLS protocol, and the infamous "Heartbleed" vulnerability is a security flaw in OpenSSL.

[0003] Currently, mainstream network protocol (hereinafter referred to as "protocol") fuzzing techniques include mutation-based gray-box fuzzing and generation-based black-box fuzzing. Among them, the most advanced mutation-based gray-box fuzzing technique is AFLNET. The main idea of ​​this protocol fuzzing tool is to combine AFL's coverage guidance and mutation-generated gray-box fuzzing techniques with the state information in the self-learning protocol entities to guide the protocol fuzzing tool to continuously mutate and generate new message sequences, thereby improving the efficiency of network protocol fuzzing.

[0004] Protocol fuzzing sends message sequences that are sequential and structured. Protocol entities can easily reject subsequent messages due to the absence of specific ones, reducing the effectiveness and acceptance rate of the entire message sequence and making it difficult to cover deeper state and logic code of the protocol entity. Mutation-based protocol fuzzing methods primarily utilize bit-level, byte-level, and message-level mutation strategies to generate new message sequences. These mutation operations are insensitive to the sequential and structured nature of the message sequence and are somewhat indiscriminate. Therefore, they easily disrupt the sequential and structured nature of messages, leading to reduced effectiveness of the mutated message sequences and impacting the efficiency of protocol fuzzing.

[0005] Existing research on fuzz testing of mutation-based network protocols mainly includes the following open-source testing frameworks, patents, and papers:

[0006] AFLNET is a mutation-based network protocol fuzzing tool that primarily utilizes bit-level, byte-level, and message-level mutation strategies to generate new messages. Bit-level and byte-level mutation strategies are insensitive to message structure, easily disrupting it. Message-level mutation strategies randomly select a message from a corpus and perform random replacements, insertions, and deletions on previously proven interesting message sequences to generate new message sequences, which are then sent to the protocol entity for testing. This mutation strategy is insensitive to message order, easily disrupting message sequence. SNPSFuzzer proposes a snapshot-based approach to improve network protocol testing speed. It dumps context information when the protocol entity is in a specific protocol state and restores the context information when the protocol state needs to be fuzzed. Since it is an improvement on AFLNET, it suffers from the same problems when mutating messages as AFLNET.

[0007] 2. CN115238822A proposes a network protocol vulnerability mining method based on a hybrid mutation strategy. It improves the vulnerability trigger rate by using an improved generative adversarial network model and an offline vulnerability knowledge base to guide the generation of mutated sample data, thereby generating more effective test cases. CN114650163A proposes a fuzzing method for stateful network protocols. By analyzing dependencies between packets and constraining data in specific fields of the packets, it avoids program verification failures caused by mutations of these specific fields. This method requires extracting protocol rules and constructing a protocol rule set based on the format specification of the protocol under test. The rule set is then used to generate packet test templates, and mutable fields in the packet test templates are mutated to generate new test packets. CN113326194A designs a fuzzing method based on random sorting of mutated packets. Specifically, this method involves changing the sending order of mutated packets and performing traffic replay. However, this approach to changing the packet order easily disrupts the sequential and structural order of the packets, making the generated test packets highly susceptible to rejection by protocol entities, thus reducing the quality of the test packets.

[0008] In summary, mutation strategies in mutation-based network protocol fuzzing techniques are insensitive to the order and structure of message sequences and exhibit blindness, failing to consider the relationship between states and messages. This easily disrupts the order and structure of message sequences during mutation, leading to a decrease in the overall effectiveness of the message sequence. This invention proposes a state- and message-aware network protocol fuzzing method. By constructing a state-specific message pool and providing a formula for calculating message value, the method calculates the value score of each message. This allows the protocol fuzzing tool to prioritize messages that satisfy the order of the message sequence and have high value for message-level mutation, thereby generating more efficient message sequences to explore deeper state spaces and logic codes within network protocol entities. Summary of the Invention

[0009] One objective of this invention is to address the aforementioned problems by proposing a state- and message-aware network protocol fuzzing method. During protocol fuzzing, the fuzzing tool creates and dynamically maintains a global message pool for the target state of the protocol under test. It extracts infix messages from interesting message sequences generated within this state and then calculates a value score for each infix message based on factors such as whether it triggers a new code branch, generates a new state, produces a new state transition, and the execution time. Finally, the infix messages with the value score are added to the message pool maintained by the target state. Subsequently, selecting messages with high value scores from the state-specific message pool for message mutation ensures the correctness of the generated message sequences in terms of order and structure, thereby improving the efficiency of protocol fuzzing.

[0010] The method of this invention mainly includes four stages: test preparation stage, protocol fuzzing test stage, result information feedback stage, and state-specific message pool construction stage.

[0011] The test preparation phase specifically includes the following steps:

[0012] 1-1. Compiler instrumentation

[0013] The test protocol entity is compiled and instrumented using afl-clang-fast++, which comes with AFLNET, to generate the target code of the test protocol, making it easier to collect code coverage information at runtime of the protocol entity.

[0014] 1-2. Constructing the initial corpus

[0015] First, start the client and the target code of the protocol under test respectively, and start communication.

[0016] Then, the packet sniffing tool tcpdump is used to listen to all traffic on the port of the protocol entity, and all captured request packets and response packets are saved in the traffic.pcap file.

[0017] Finally, the traffic.pcap file was parsed using a message sequence parser (Wireshark) to extract all request message sequences (referred to as "message sequences"), which were then used as the initial corpus, InitialMessagePool. The initial corpus is a collection of message sequences, i.e., InitialMessagePool = {M1, ..., M...} i ,...,M d}, i = 1, ..., d, where d is the total number of message sequences, and the message sequence is a linked list of messages, i.e., M. i =m i,1 ->...->m i,k ->...->m i,q m i,k Let q represent the k-th message in the i-th message sequence, where k = 1, ..., q, and q is M. i Total number of messages.

[0018] The protocol fuzzing phase specifically includes the following steps:

[0019] 2-1. Initialization

[0020] The `preform_dry_run()` function of AFLNET is used to perform a protocol fuzz test on each message sequence in the initial corpus, collecting the generated protocol states and storing them in the global variable `state_ids` array, where `state_ids = {S1, ..., S...}`. i ,...,S n},S i Let i represent the i-th protocol state, where i = 1, ..., n, and n is the total number of protocol states. The collected state transitions are stored in a two-dimensional array called state_transition. state_transition[i][j] = 1 indicates that state_ids[i] can reach state_ids[j], and state_transition[i][j] = 0 indicates that state_ids[i] cannot reach state_ids[j].

[0021] 2-2. Select target state

[0022] 2-2-1. Initially, a state is selected from the state_ids array using a round-robin method as the target state S for the protocol fuzz test. p p = 1, ..., n, where n is the total number of protocol states. If the number of polling times is less than or equal to L (usually taken as 10 based on experience), proceed to step 2-3; otherwise, proceed to step 2-2-2.

[0023] 2-2-2. Use the update_scores_and_select_next_state() function in AFLNET to select the next fuzzy target state S. p p = 1, ..., n, where n is the total number of protocol states.

[0024] 2-3. Select message sequence

[0025] Based on the target state S selected in step 2-2 p Select from InitialMessagePool the entity that can bring the protocol under test to the target state S. p The message sequence M is used for further mutations of the message sequence.

[0026] 2-4. Mutation Message Sequence

[0027] Based on the message sequence M selected in steps 2-3, M is divided into three subsequences using the AFLNET partitioning method: prefix message sequence (M1), infix message sequence (M2), and suffix message sequence (M3), i.e., M =<M1,M2,M3> Where M1 is the state that enables the protocol entity to reach the target state S. p The message sequence is M1, M2 is the candidate message sequence waiting to be mutated, and M3 is the remaining message sequence.

[0028] Then, according to the target state S p Whether the corresponding message pool TargetMessagePool is empty determines the mutation strategy used for M2:

[0029] 1) If TargetMessagePool is empty, then a bit-level and byte-level mutation strategy is used to generate a new M2', i.e., M =<M1,M2’,M3> This is used for further protocol testing.

[0030] 2) Otherwise, if TargetMessagePool is not empty, then a message-level mutation strategy is applied to M2:

[0031] First, from TargetMessagePool = {M p,1 (value1),M p,2 (value2),...,Mp,j (value j ),...,M p,k (value k In )}, M p,j Represents the target state S p The j-th message in the corresponding message pool TargetMessagePool, value j Indicates message M p,j The value score is calculated based on the value of each message, where j = 1, 2, ..., k, and k represents the total number of messages in the TargetMessagePool. j The ratio of the value score to the sum of all message value scores is used as the probability that the message is selected.

[0032] Secondly, using the selected message, perform insertion, replacement, and repetition mutation operations on the M2 awaiting mutation to generate a new M2', i.e., M =<M1,M2’,M3> This is used for further protocol testing. The operations include: Insertion: inserting the selected message at the beginning or end of M2; Replacement: replacing each message in M2 with the selected message; Repetition: copying the selected message and then replacing the entire M2.

[0033] 2-5. Protocol Testing

[0034] Each message in M ​​generated in step 2-4 is sent sequentially to the protocol entity under test for testing. If a vulnerability is triggered during the test, M is saved in the crashes directory for vulnerability reproduction, and then the process proceeds to step 2-2.

[0035] The results feedback phase includes the following steps:

[0036] 3-1. Collect code coverage information and state sequences

[0037] Use AFLNET to collect code coverage information and state sequences of the protocol entity under test:

[0038] 1) If new code coverage is found during the collection of code coverage information, it means that M is interesting and is added to InitialMessagePool.

[0039] 2) When collecting the state sequence (consisting of multiple protocol states), if a new state `new_state_id` is found, it is saved in the `state_ids` array. If a new state transition is found, the value of the corresponding index in the `state_transition` two-dimensional array is set to 1. For example, if a new state transition occurs from S1 to S3, then `state_transition[1][3] = 1`. Similarly, M is added to the `InitialMessagePool`.

[0040] 3) Otherwise, if no new code overwrite is generated, no new state is generated, or no new state transition is generated, proceed to step 2-2.

[0041] The phase of building a state-specific message pool specifically includes the following steps:

[0042] 4-1. Build a state-specific message pool

[0043] 1) Obtain M from step 3-1 and the target state S from step 2-2. p .

[0044] 2) Obtain the infix message sequence of M using the AFLNET partitioning method, and add each message in the infix message sequence to the target state S. p The corresponding message pool is TargetMessagePool.

[0045] 3) Based on the code coverage information and state sequence collected in step 3-1, calculate the message value score (value) using the message value evaluation formula, and store the value in the two-dimensional array state_message_value, where state_message_value[i][j] = value i,j Let 'value' represent the value score of the j-th message in the message pool corresponding to the i-th state. i,j .

[0046] The specific calculation formula is as follows:

[0047]

[0048] Where E represents whether a new branch is triggered, S represents whether a new state is generated, and T represents whether a new state transition is generated, E, S, T ∈ {0, 1}; t represents the execution time; in addition, a, b, c, d ∈ {x | 0 <= x <= 1}, and a + b + c + d = 1 (weights), usually empirically taken as a = 0.4, b = 0.3, c = 0.2, d = 0.1; e represents the natural exponent, which is a constant.

[0049] 4) Proceed to step 2-2.

[0050] Another objective of this invention is to provide a state- and message-aware network protocol fuzzing system, including a test preparation module, a protocol fuzzing module, a result information feedback module, and a module for constructing a state-specific message pool.

[0051] The test preparation module utilizes AFLNET's built-in afl-clang-fast++ to compile and instrument the protocol entity under test, facilitating the collection of runtime code coverage information for the protocol entity. It also employs two tools—a packet sniffing tool (tcpdump) and a request sequence parser (Wireshark)—to capture and parse data packets, ultimately generating an initial corpus.

[0052] The protocol fuzzing module is used to perform protocol fuzzing on protocol entities. From all discovered states, a state is selected as the target state for fuzzing. A message sequence that enables the protocol entity to reach the target state is then selected from the corpus. The infix messages in this message sequence are then mutated. Specifically, messages with high value scores are selected from a message pool specific to the target state, and infix messages are inserted, replaced, or repeated to generate new and more efficient message sequences.

[0053] The results feedback module collects code coverage information and state sequences. It uses whether a message sequence generates new code coverage information, a new state, or a new state transition as the criterion for determining its interestingness, and saves interesting message sequences for further protocol fuzzing. State sequences, on the other hand, help the protocol fuzzer explore deeper levels of protocol state within the protocol entity.

[0054] A state-specific message pool module is constructed to generate a message pool for each state. Specifically, a <state, message>-aware message classification algorithm and a message value assessment formula are used to generate the message pool. Then, each time a message-level mutation is performed, a message is selected from the state-specific message pool for the mutation operation, thereby ensuring the order and structure of the message sequence.

[0055] The beneficial effects of this invention are:

[0056] 1. This invention employs a state- and message-aware network protocol fuzzing method, generating a message pool specific to each state. This ensures the order and structure of the entire message sequence during message mutation, effectively improving the message quality of protocol fuzzing.

[0057] 2. Compared to existing network protocol fuzzing tools like AFLNET, which rely on coverage guidance and mutation, this invention proposes a state- and message-aware network protocol fuzzing method. This method effectively addresses the problem of disrupted message sequence order and structure caused by the blindness of mutation strategies during message mutation in protocol fuzzing. By constructing a state-specific message pool, the protocol fuzzing tool can consider the relationship between protocol states and messages while ensuring the order and structure of the message sequence during mutation, resulting in more efficient message sequences and thus improving the efficiency of protocol fuzzing.

[0058] 3. Using the method of the present invention, the detection efficiency of protocol entities can be improved. Within the same test time, deeper code parts and deeper protocol states can be explored in the protocol entity, and more vulnerabilities can be discovered. Attached Figure Description

[0059] Figure 1 This is a design framework diagram of the present invention;

[0060] Figure 2 This is an overall flowchart of the present invention;

[0061] Figure 3 for Figure 2 Flowchart of the protocol fuzz testing phase;

[0062] Figure 4 for Figure 2 Flowchart for building a state-specific message pool;

[0063] Figure 5 The experimental results of testing the DNS protocol are shown in the figure;

[0064] Figure 6 The experimental results of testing the DTLS protocol are shown in the figure. Detailed Implementation

[0065] The technical solutions of the present invention will now be fully described with reference to the accompanying drawings in the embodiments of the present invention.

[0066] like Figure 1 The diagram shown illustrates the design framework of this invention, encompassing the specific implementation of the actual architecture of the entire protocol fuzzing tool. For example... Figure 2As shown, the state- and message-aware network protocol fuzzing method consists of four stages: test preparation, protocol fuzzing, result feedback, and building a state-specific message pool.

[0067] The test preparation phase includes the following steps:

[0068] 1-1 The protocol entity under test is compiled and instrumented using afl-clang-fast++, which comes with AFLNET, to generate the target code of the protocol under test, which facilitates the subsequent collection of code coverage information during the runtime of the protocol entity.

[0069] 1-2 Constructing the Initial Corpus

[0070] First, start the client and the target code of the protocol under test respectively, and start communication.

[0071] Then, the packet sniffing tool tcpdump is used to listen to all traffic on the port of the protocol entity, and all captured request packets and response packets are saved in the traffic.pcap file.

[0072] Finally, the traffic.pcap file was parsed using a message sequence parser (Wireshark) to extract all message sequences, which were then used as the initial corpus, InitialMessagePool. The initial corpus is a collection of message sequences, i.e., InitialMessagePool = {M1, ..., M...} i ,...,M d}, i = 1, ..., d, where d is the total number of message sequences, and the message sequence is a linked list of messages, i.e., M. i =m i，1 ->...->m i，k ->...->m i，q m i，k Let represent the k-th message in the i-th message sequence, where k = 1, ..., q, and q is the total number of messages.

[0073] 2 such as Figure 3 The protocol fuzzing phase shown mainly includes the following steps:

[0074] 2-1 Initialization

[0075] The `preform_dry_run()` function of AFLNET is used to perform a protocol fuzz test on each message sequence in the initial corpus, collecting the generated protocol states and storing them in the global variable `state_ids` array, where `state_ids = {S1, ..., S...}`. i ,...S n},Si Let i represent the i-th protocol state, where i = 1, ..., n, and n is the total number of protocol states. The collected state transitions are stored in a two-dimensional array called state_transition. state_transition[i][j] = 1 indicates that state_ids[i] can reach state_ids[j], and state_transition[i][j] = 0 indicates that state_ids[i] cannot reach state_ids[j].

[0076] 2-2 Selecting a Message Sequence

[0077] 2-2-1 Initially, a state is selected from the state_ids array using a round-robin method as the target state S for the protocol fuzz test. p p = 1, ..., n, where n is the total number of protocol states. If the number of polling attempts is less than or equal to L (usually taken as 10), proceed to step 2-3; otherwise, proceed to step 2-2-2.

[0078] 2-2-2 The next fuzzy target state S is selected using the update_scores_and_select_next_state() function in AFLNET. p .

[0079] 2-3 Select message sequence

[0080] Based on the target state S selected in step 2-2 p Select from the corpus the entities that enable the tested protocol entity to reach the target state S. p The message sequence M is used for further mutations of the message sequence.

[0081] 2-4 Mutation Message Sequence

[0082] Based on the message sequence M selected in steps 2-3, M is divided into three subsequences using the AFLNET partitioning method: prefix message sequence (M1), infix message sequence (M2), and suffix message sequence (M3), i.e., M =<M1,M2,M3> Where M1 is the state that enables the protocol entity to reach the target state S. p The message sequence is M1, M2 is the candidate message sequence waiting to be mutated, and M3 is the remaining message sequence.

[0083] Then, according to the target state S p Whether the corresponding message pool TargetMessagePool is empty determines the mutation strategy used for M2:

[0084] 1) If TargetMessagePool is empty, then a bit-level and byte-level mutation strategy is used to generate a new M2', i.e., M =<M1,M2’,M3> This is used for further protocol testing.

[0085] 3) Otherwise, if TargetMessagePool is not empty, then a message-level mutation strategy is applied to M2:

[0086] First, from TargetMessagePool = {M p,1 (value1),M p,2 (value2),...,M p,j (value j ),...,M p,k (value k In )}, M p,j Represents the target state S p The j-th message in the corresponding message pool TargetMessagePool, value j Indicates message M p，j The value score is calculated based on the value of each message, where j = 1, 2, ..., k, and k represents the total number of messages in the TargetMessagePool. j The ratio of the value score to the sum of all message value scores is used as the probability that the message is selected.

[0087] Secondly, using the selected message, perform insertion, replacement, and repetition mutation operations on the M2 awaiting mutation to generate a new M2', i.e., M =<M1,M2’,M3> This is used for further protocol testing. The operations include: Insertion: inserting the selected message at the beginning or end of M2; Replacement: replacing each message in M2 with the selected message; Repetition: copying the selected message and then replacing the entire M2.

[0088] The pseudocode corresponding to the above process is as follows:

[0089]

[0090]

[0091] 2-5 Protocol Testing

[0092] Each message in M ​​generated in step 2-4 is sent sequentially to the protocol entity under test for testing. If a vulnerability is triggered during the test, M is saved in the crashes directory for vulnerability reproduction, and then the process proceeds to step 2-2.

[0093] 3. The results feedback stage mainly includes the following steps:

[0094] 3-1 Collect code coverage information and state sequences

[0095] Use AFLNET to collect code coverage information and state sequences of the protocol entity under test:

[0096] 1) If new code coverage is found during the collection of code coverage information, it means that M is interesting and is added to InitialMessagePool.

[0097] 2) When collecting state sequences (state_sequence), if a new state (new_state_id) is found, it is saved in the state_ids array. If a new state transition is found, the value of the corresponding index in the state_transition two-dimensional array is set to 1. For example, if the new state transition is S1->S3, then state_transition[1][3] = 1. Similarly, M is added to InitialMessagePool.

[0098] 3) Otherwise, if no new code overwrite is generated, no new state is generated, or no new state transition is generated, proceed to step 2-2.

[0099] The 4.5 phase of building a state-specific message pool mainly includes the following steps:

[0100] 4-1 Constructing a state-specific message pool (e.g.) Figure 4 (As shown)

[0101] 1) Obtain M from step 3-1 and the target state S from step 2-2. p .

[0102] 2) Obtain the infix message sequence of M using the AFLNET partitioning method, and add each message in the infix message sequence to the target state S. p The corresponding message pool is TargetMessagePool.

[0103] 3) Based on the code coverage information and state sequence collected in step 3-1, calculate the message value score (value) using the message value evaluation formula, and store the value in the two-dimensional array state_message_value, where state_message_value[i][j] = value i,j Let 'value' represent the value score of the j-th message in the message pool corresponding to the i-th state. i,j .

[0104] The specific calculation formula is as follows:

[0105]

[0106] Where E represents whether a new branch is triggered, S represents whether a new state is generated, and T represents whether a new state transition occurs, E, S, T ∈ {0, 1}; t represents the execution time. Furthermore, a, b, c, d ∈ {x | 0 <= x <= 1}, and a + b + c + d = 1 (weights), typically taken as a = 0.4, b = 0.3, c = 0.2, d = 0.1; e represents the natural exponent, which is a constant.

[0107] 4) Proceed to step 2-2.

[0108] The pseudocode described above is as follows:

[0109]

[0110]

[0111] In summary, this invention proposes a state- and message-aware network protocol fuzzing method. By constructing a state-specific message pool and providing a message value evaluation formula, the protocol fuzzing tool can prioritize messages that satisfy the sequentiality of the message sequence and have high value to participate in message-level mutation without destroying the order and structure of the messages. This generates a more efficient message sequence to explore deeper state spaces and logic codes in network protocol entities.

[0112] To verify the effectiveness of the method of this invention, experiments were conducted on protocol entity programs such as dnsmasq (DNS protocol) and tinydtls (DTLS protocol). The experiment lasted for 24 hours, and the control group used AFLNET, a network protocol fuzzing tool based on mutation. In the experiment, we chose two indicators to measure the effectiveness of the method: the number of paths covered and the number of vulnerabilities. The first indicator measures the vulnerability discovery capability of the fuzzing tool, while the second indicator represents the code coverage capability. The results from the 24-hour experiment show that the method of this invention outperforms AFLNET in both the number of vulnerabilities and the code coverage capability. The final experimental data results are as follows: Figure 5 , Figure 6 As shown.

[0113] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. All equivalent changes and modifications made within the scope of the present invention are within the scope of protection of the present invention.

Claims

1. A fuzzy testing method for network protocols based on state and message awareness, characterized in that, It includes four phases: test preparation phase, protocol fuzzing phase, result information feedback phase, and state-specific message pool construction phase. The test preparation phase includes the following sub-steps: Step 1-1, Compilation and Instrumentation: Use AFLNET's built-in afl-clang-fast++ to compile and instrument the protocol entity under test, generating the target code of the protocol under test, which facilitates the collection of code coverage information during the runtime of the protocol entity; Step 1-2, Building the Initial Corpus: First, start the client and the target code of the protocol under test respectively, and establish communication; Then, the packet sniffing tool tcpdump is used to listen to all traffic on the port of the protocol entity, and all captured request packets and response packets are saved in the traffic.pcap file; Finally, the traffic.pcap file was parsed using a message sequence parser to extract all request message sequences, which were then used as the initial corpus, InitialMessagePool. The initial corpus is a collection of message sequences, i.e., InitialMessagePool={M1,..,Mi,...,Md},i=1,...,d,where d is the total number of message sequences. The message sequence is a linked list of messages, i.e., Mi=mi,1->...->mi,k->...->mi,q,mi,k represents the kth message of the i-th message sequence, k=1,...,q,where q is the total number of messages in Mi; The results feedback phase includes the following sub-steps: Step 3-1. Collect code coverage information and state sequences. Use AFLNET to collect code coverage information and state sequences of the protocol entity under test: 1) If new code coverage is found during the collection of code coverage information, it means that M is interesting and is added to the InitialMessagePool; 2) When collecting state sequences, if a new state ne w_state_id is found, it is saved in the state_ids array; if a new state transition is found, the value of the corresponding index in the state_transition two-dimensional array is set to 1. 3) Otherwise, if no new code overwrite is generated, and no new state or new state transition is generated, proceed to step 2-2; The phase of building a state-specific message pool includes the following sub-steps: Step 4-1. Build a state-specific message pool 1) Obtain M of step 3-1, and target state S of step 2-2 p ; 2) Using the partitioning method of AFLNET to get the infix message sequence of M, and adding each message in the infix message sequence to the target state S p the corresponding message pool TargetMessagePool; 3) Based on the code coverage information and state sequence collected in step 3-1, calculate the message value score (value) using the message value assessment formula, and store the value in a two-dimensional array `state_message_value`. state_message_value[i][j]=value i,j Let 'value' represent the value score of the j-th message in the message pool corresponding to the i-th state. i,j The specific calculation formula is as follows: ； Where E represents whether a new branch is triggered, S represents whether a new state is generated, and T represents whether a new state transition is generated, E, S, T ∈ {0, 1}; t represents the execution time; in addition, a, b, c, d ∈ {x|0<=x<=1}, and the weight a+b+c+d=1, taking values ​​of a=0.4, b=0.3, c=0.2, d=0.1; e represents the natural exponent, which is a constant. 4) Proceed to step 2-2.

2. The fuzzy testing method for network protocols based on state and message awareness according to claim 1, characterized in that, The aforementioned protocol fuzzing phase includes the following sub-steps: Step 2-1. Initialization The `preform_dry_run()` function of AFLNET is used to perform a protocol fuzz test on each message sequence in the initial corpus. The generated protocol states are collected and stored in the global variable `state_ids` array, where `state_ids = {S1,...,Si,...,Sn}`, `Si` represents the i-th protocol state, `i = 1,...,n`, and `n` is the total number of protocol states. The generated state transitions are stored in the two-dimensional array `state_transition`, where `state_transition[i][j] = 1` indicates that state `state_ids[i]` can reach state `state_ids[j]`, and `state_transition[i][j] = 0` indicates that state `state_ids[i]` cannot reach state `state_ids[j]`, where `i,j = 1,...,n`, and `n` is the total number of protocol states. Step 2-2. Select target state Step 2-2-1. Initially, select a state from the state_ids array as the target state Sp for protocol fuzzing, p = 1,...,n, where n is the total number of protocol states; if the number of polls is less than or equal to L, where L is 10, then proceed to step 2-3; otherwise, proceed to step 2-2-2. Step 2-2-2. Use the update_scores_and_select_next_state() function in AFLNET to select the next fuzzy target state Sp, where p = 1,...,n, and n is the total number of protocol states; Step 2-3. Select the message sequence. Based on the target state Sp selected in step 2-2, select the message sequence M from the InitialMessagePool that enables the protocol entity under test to reach the target state Sp, for further message sequence mutation; Step 2-4. Mutate the message sequence Based on the message sequence M selected in steps 2-3, M is divided into three subsequences using the AFLNET partitioning method: prefix message sequence (M1), infix message sequence (M2), and suffix message sequence (M3), i.e., M =<M1,M2,M3> M1 is the message sequence that enables the protocol entity to reach the target state Sp. M2 is the candidate message sequence waiting to be mutated, and M3 is the remaining message sequence; Then, depending on whether the message pool TargetMessagePool corresponding to the target state Sp is empty, [the following is done]: M2 employs a different mutation strategy.

3. The fuzzy testing method for network protocols based on state and message awareness according to claim 2, characterized in that: Steps 2-4 in the protocol fuzzing phase include: applying different mutation strategies to M2, including: 1) If TargetMessagePool is empty, then a bit-level and byte-level mutation strategy is used to generate a new M2', i.e., M =<M1,M2’,M3> , for further protocol testing; 2) Otherwise, if TargetMessagePool is not empty, then a message-level mutation strategy is applied to M2: First, from TargetMessagePool = {M p,1 (value1),M p,2 (value2),...,M p,j (value j ),...,M p,k (value k In )}, M p,j Represents the target state S p The j-th message in the corresponding message pool TargetMessagePool, value j Indicates message M p,j The value score is calculated based on the value of each message, where j = 1, 2, ..., k, and k represents the total number of messages in the TargetMessagePool. j The ratio of the value score to the sum of all message value scores is used as the probability that the message is selected. Secondly, using the selected message, insert, replace, and repeat mutation operations are performed on the M2 awaiting mutation to generate a new M2', i.e., M =<M1,M2’,M3> This is used for further protocol testing; among them, the insertion operation: inserts the selected message into the beginning or end of M2; the replacement operation: replaces each message in M2 with the selected message once; the repetition operation: copies the selected message once and then replaces the entire M2.

4. A state- and message-aware network protocol fuzzing system applicable to the state- and message-aware network protocol fuzzing method described in claim 1, characterized in that: It includes a test preparation module, a protocol fuzzing module, a result information feedback module, and a module for building a state-specific message pool; The test preparation module uses afl-clang-fast++, which comes with AFLNET, to compile and instrument the protocol entity under test, making it easier to collect code coverage information at runtime. It also uses two tools, tcpdump (a packet sniffing tool) and Wireshark (a request sequence parser), to capture and parse data packets, and finally generate an initial corpus. The protocol fuzzing module is used to perform protocol fuzzing on protocol entities. From all discovered states, a state is selected as the target state for fuzzing, and a message sequence that can make the protocol entity reach the target state is selected from the corpus. Then, the infix messages of the message sequence are mutated. The results feedback module is used to collect code coverage information and state sequences; it uses whether the message sequence generates new code coverage information as the criterion for judging whether the message sequence is interesting, and saves interesting message sequences for further protocol fuzz testing. A state-specific message pool module is constructed to generate a state-specific message pool for each state. Specifically, a <state, message>-aware message classification algorithm and a message value evaluation calculation formula are used to generate the message pool. Then, each time a message-level mutation is performed, a message is selected from the specific message pool for mutation operation, thereby ensuring the order and structure of the message sequence.

Images