A protocol fuzz testing method and device based on automatic generation of test cases

Abstract

The present invention provides a protocol fuzz testing method and device based on automated test case generation. The method comprises: step 1: capturing and filtering network traffic during normal protocol communication; step 2: aligning message sequences using a multiple sequence alignment method; step 3: determining protocol keywords, and performing cluster analysis on all message sequences based on the keywords to infer the protocol format and protocol state machine model; step 4: constructing a template based on the inferred protocol format, and automatically generating test cases based on the template; step 5: generating a test path based on the inferred protocol state machine model; and step 6: sending the test case to a target program according to the test path for fuzz testing, and monitoring the state of the target program.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a protocol fuzz testing method and device based on automatic generation of test cases. Background Art

[0002] Network protocols describe the specifications for exchanging data between two communicating entities and play a vital role in computer networks. However, during implementation, developers' misunderstandings can introduce vulnerabilities. Some hackers exploit these vulnerabilities to spread viruses, even launching remote attacks without physical host access, exposing thousands or even tens of thousands of network devices to catastrophic threats. According to the NVD database, high-risk vulnerabilities accounted for over 70% of protocol vulnerabilities in the first half of 2022. Therefore, timely identification and patching of security vulnerabilities in protocols is extremely important.

[0003] As a mainstream method for discovering protocol vulnerabilities, fuzz testing is characterized by its simplicity and high efficiency. Since its introduction in 1989, it has been widely used in security testing across multiple fields. Fuzz testing can be categorized into mutation-based and generation-based techniques based on the method used to generate test cases. Mutation-based fuzz testing requires no prior knowledge of the protocol, reducing the effort required to create a state machine. However, the test cases generated by this approach often fail format verification. Generation-based fuzz testing analyzes the protocol to obtain its format and state machine model, generating test cases that conform to the protocol specification as closely as possible. The test cases generated by this technique are more easily accepted by protocol implementers. However, this method requires extensive manual analysis and sufficient understanding of the protocol, and is difficult to extend to accommodate new protocol features. Furthermore, existing black-box fuzz testing tools lack information about protocol execution, making it difficult to explore the protocol's deep state space. Mutation-based protocol fuzz testing tools also struggle to reach deep states because they lack knowledge of the protocol's state transition relationships. Furthermore, gray-box protocol fuzz testing tools often select shorter state transition paths, ignoring other paths to reach the same state, resulting in incomplete testing. Summary of the Invention

[0004] In order to solve or partially solve the problems of traditional protocol fuzz testing methods such as high seed construction cost, difficulty in extending to new protocols, and difficulty in detecting deep-level protocol state space, the present invention provides a protocol fuzz testing method and device based on automatic generation of test cases.

[0005] In one aspect, the present invention provides a protocol fuzz testing method based on automatic generation of test cases, comprising:

[0006] Step 1: Capture network traffic during normal protocol communication and filter it;

[0007] Step 2: Align the message sequences using a multiple sequence alignment method;

[0008] Step 3: Determine the keywords of the protocol, and perform cluster analysis on all message sequences based on the keywords to infer the protocol format and protocol state machine model;

[0009] Step 4: Building a template based on the inferred protocol format, and automatically generating test cases based on the template;

[0010] Step 5: Generate test paths based on the inferred protocol state machine model;

[0011] Step 6: Send the test case to the target program for fuzz testing according to the test path, and monitor the status of the target program.

[0012] Furthermore, step 2 specifically includes:

[0013] Step 2.1: Calculate the longest message sequence length l among all initial message sequences max and the shortest message sequence length l min ; For each initial message sequence, execute steps 2.2 to 2.6;

[0014] Step 2.2: Divide the initial message sequence into static fields and dynamic fields in byte units;

[0015] Step 2.3: Initialize field offset;

[0016] Step 2.4: Under the current field offset value, determine whether two adjacent static fields are the same. If they are the same, merge the two adjacent static fields into one long static field;

[0017] Step 2.5: Update the field offset value and determine whether the field offset value exceeds the shortest message sequence length l min If not, go to step 2.4; if so, go to step 2.6;

[0018] Step 2.6: Set the field offset to (l min ,l max ) are defined as data fields, and alignment symbols are inserted in the data fields.

[0019] Furthermore, step 3 specifically includes:

[0020] For each candidate keyword, set it to be clustered to obtain N clusters;

[0021] For each candidate keyword, calculate the message similarity score and the structural similarity score between messages in the cluster based on its corresponding clustering results;

[0022] Select the keywords with the highest message similarity score and the highest score for structural similarity between messages in the cluster, and calculate the keyword position field score corresponding to the selected keywords;

[0023] For each candidate keyword, calculate the product of the message similarity score, the structure similarity score between messages in the cluster, and the keyword position field score. The candidate keyword with the highest product value is selected as the final keyword.

[0024] The protocol format and state machine model are inferred based on the final keyword clustering results.

[0025] Furthermore, the message similarity score P1 is calculated according to formula (1):

[0026]

[0027] Among them, edit_distance(m k ,m t ) means that any two message sequences m k and m t The minimum number of operations required to transform into two identical message sequences, where the operations are one or more of addition, deletion, and replacement; max_len(m k ,m t ) represents two message sequences m k and m t The length of the longer message sequence.

[0028] Furthermore, the structural similarity score P2 between messages in the cluster is calculated according to formula (2):

[0029]

[0030] Among them, number_gap i Indicates the number of alignment symbols inserted during the alignment of all packets in the i-th cluster.

[0031] Furthermore, the keyword position field score P3 is calculated according to formula (3):

[0032]

[0033] Among them, d c d s Indicates the offset value of the candidate keyword field on the client and server. c 、l s Indicates the length of the candidate keyword field.

[0034] Furthermore, step 4 specifically includes:

[0035] Divide the fields in the template into static fields and dynamic fields;

[0036] When generating test cases, the generation rules include:

[0037] Rule 1: Keep static fields unchanged while ensuring that they are not parsed abnormally.

[0038] Rule 2: Different dynamic fields are generated using different methods. Specifically, for text-type dynamic fields, one or more of the following operations are performed on the delimiters: replacement, expansion, and reduction. Replacement refers to replacing delimiters with other special characters, expansion refers to repeating delimiters n times, and reduction refers to randomly deleting delimiters.

[0039] For binary type dynamic fields, a bit-by-bit inversion operation is performed on a shorter binary field; and one or more operations of byte-level inversion, right shift, and interchange with other dynamic fields are performed on a longer binary field.

[0040] Furthermore, step 5 specifically includes:

[0041] Define the initial and final states of the protocol;

[0042] The initial state is stored in the state transition path, and then all the protocol states in the protocol state diagram are traversed from the initial state. Specifically: determine whether the current state has been traversed. If not, mark the state as a new state and put it in the state transition path, and then continue to traverse the successor state of the current state; if so, skip the current state and continue to traverse the next state; until the traversal completes the terminal state or there is no successor state, the traversal is completed, and the complete state transition path is obtained.

[0043] Furthermore, step 6 specifically includes:

[0044] Set a timeout threshold and then send test cases to the target program according to the instructions of the test path;

[0045] After sending the test case, if no return message from the target program is received after reaching the timeout threshold, the test case is sent repeatedly t times. If no return message from the target program is received after reaching the timeout threshold t times, the target program is restarted and the test case is sent again. If no return message from the target program is received after reaching the timeout threshold, the crash and the test case are recorded, and the next test case is sent.

[0046] On the other hand, the present invention provides a protocol fuzz testing device based on automatic generation of test cases, comprising:

[0047] Capture module, used to capture network traffic during normal protocol communication and filter it;

[0048] A message alignment module, used to align message sequences using a multiple sequence alignment method;

[0049] A protocol format and state machine inference module, configured to determine the keywords of the protocol and perform cluster analysis on all message sequences based on the keywords to infer the protocol format and protocol state machine model;

[0050] A test case generation module, configured to construct a template according to the inferred protocol format and automatically generate test cases according to the template;

[0051] A test path generation module, used to generate a test path based on the inferred protocol state machine model;

[0052] The network monitoring module is used to send the test case to the target program for fuzz testing according to the test path and monitor the status of the target program.

[0053] Beneficial effects of the present invention:

[0054] This method captures network traffic during normal protocol program communication, reverse-engineers the protocol format and state model, and then automatically generates test cases that meet the protocol specifications by defining generation rules in a template based on the protocol format. This allows the generation of test cases that meet protocol specifications without prior knowledge of the protocol. This increases the speed at which the fuzzer generates valid test cases, allowing for a rapid start of a fuzz testing process and improved scalability. Furthermore, by using a state machine to guide the generation of test paths and the sending of message chains, the deep state space is explored, achieving deep coverage of protocol states and all paths to those states, resulting in enhanced vulnerability discovery capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flowchart of a protocol fuzz testing method based on automatic generation of test cases provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0057] Example 1

[0058] like Figure 1 As shown, an embodiment of the present invention provides a protocol fuzz testing method based on automatic generation of test cases, comprising the following steps:

[0059] S101: Capture network traffic during normal protocol communication and filter it;

[0060] Specifically, the network traffic is captured by a protocol sniffing tool (such as Wireshark); the network traffic is then filtered according to the IP address and port number to obtain the desired network traffic.

[0061] S102: Aligning message sequences using a multiple sequence alignment method;

[0062] Specifically, the improved multiple sequence alignment method is used to align all message sequences by inserting a custom alignment symbol. In this embodiment, the "-" symbol is used as the alignment symbol.

[0063] The improved multiple sequence alignment method specifically comprises the following steps:

[0064] S1021: Calculate the longest message sequence length l among all initial message sequences max and the shortest message sequence length l min ; For each initial message sequence, execute steps S1022 to S1026;

[0065] S1022: Divide the initial message sequence into static fields and dynamic fields in byte units;

[0066] S1023: Initialize field offset;

[0067] S1024: Under the current field offset value, determine whether two adjacent static fields are the same. If they are the same, merge the two adjacent static fields into a long static field.

[0068] S1025: Update the field offset value and determine whether the field offset value exceeds the shortest message sequence length l min If not, execute step S1024; if yes, execute step S1026;

[0069] S1026: offset the field at (l min ,l max ) are defined as data fields, and an alignment symbol, i.e., the “-” symbol, is inserted into the data fields.

[0070] After aligning the message using the improved multiple sequence alignment method, the message is divided into different fields, and multiple consecutive static fields are merged into a long static field. Compared with the traditional Needleman-Wunsch algorithm, the improved multiple sequence alignment method provided in this embodiment is simpler and more efficient.

[0071] S103: Determine the keywords of the protocol, and perform cluster analysis on all message sequences based on the keywords to infer the protocol format and protocol state machine model;

[0072] Specifically, as the basis for message clustering, the inference of keywords is particularly important. Keywords are usually generated in dynamic fields in message sequences. For simple protocols, the message formats have the same structure, and the offset positions of the keywords are also the same; for complex protocols, the messages have different lengths, and the offset positions of the keywords will have deviations. Considering that keywords must be generated in dynamic fields, the dynamic fields after message alignment are used as candidate keywords. This embodiment mainly measures candidate keywords based on the following three aspects, and further determines the probability of these fields as keywords. The fields with the highest probability are determined as keywords of the protocol: 1) After keyword clustering, the message sequences in the same cluster should have high similarity, corresponding to the message similarity score; 2) The messages within the same cluster should have the same structure, corresponding to the structural similarity score between messages within the cluster; 3) The keywords appear simultaneously in all message sequences and have a fixed length, corresponding to the keyword position field score. Based on the above content, this step specifically includes the following sub-steps:

[0073] For each candidate keyword, set it to be clustered to obtain N clusters;

[0074] For each candidate keyword, calculate the message similarity score and the structural similarity score between messages in the cluster based on its corresponding clustering results;

[0075] Select the keywords with the highest message similarity score and the highest score for structural similarity between messages in the cluster, and calculate the keyword position field score corresponding to the selected keywords;

[0076] For each candidate keyword, calculate the product of the message similarity score, the structure similarity score between messages in the cluster, and the keyword position field score. The candidate keyword with the highest product value is selected as the final keyword.

[0077] The protocol format and state machine model are inferred based on the final keyword clustering results.

[0078] For complex protocols containing many fields, using a simple message sequence comparison may incorrectly obtain the similarity between messages. Therefore, in this embodiment, the edit distance edit_distance is introduced to determine the similarity between messages, that is, the message similarity score P1 is calculated according to formula (1):

[0079]

[0080] Among them, edit_distance(m k ,m t ) means that any two message sequences m k and m t The minimum number of operations required to transform into two identical message sequences, where the operations are one or more of addition, deletion, and replacement; max_len(m k ,m t ) represents two message sequences m k and m t The length of the longer message sequence.

[0081] In the same cluster, all messages should have the same structure, and the “-” symbol will be used as little as possible during the message alignment phase. In addition, the total number of clusters should not be too large. Therefore, this embodiment uses the average number of alignment symbols (in this embodiment, the “-” symbol) in each cluster to determine the structural similarity, that is, the structural similarity score P2 between messages in the cluster is calculated according to formula (2):

[0082]

[0083] Among them, number_gap i Indicates the number of alignment symbols inserted during the alignment of all packets in the i-th cluster.

[0084] Calculate the keyword position field score P3 according to formula (3):

[0085]

[0086] Among them, d c d s Indicates the offset value of the candidate keyword field on the client and server. c 、l s Indicates the length of the candidate keyword field.

[0087] S104: Building a template according to the inferred protocol format, and automatically generating test cases according to the template;

[0088] Specifically, the quality of test cases directly impacts the final fuzz testing results. High-quality test cases have a greater chance of triggering vulnerabilities in the target program. Protocol programs often have strict input validation. When a protocol program receives external input, it first parses the input and matches it against the rules. If the parsing fails, the input is rejected. If a match is successful, the program then matches the executed function based on the input data fields and sends a corresponding response to the client after execution.

[0089] The purpose of this step is to construct a template based on the inferred protocol format and semantics, dividing the fields in the template into static and dynamic fields. Furthermore, the length of the dynamic fields is defined based on the semantic information. When generating test cases, the protocol format and static fields are left unchanged or minimally modified. This prevents the test cases sent by the fuzzer from being rejected by the target program at the initial stage, preventing them from being able to discover vulnerabilities. This step specifically includes the following substeps:

[0090] Divide the fields in the template into static fields and dynamic fields;

[0091] When generating test cases, the generation rules include:

[0092] Rule 1: Keep static fields unchanged while ensuring that they are not parsed abnormally.

[0093] Specifically, for static fields, the original value is almost maintained during the communication process, but there is still a possibility of triggering the vulnerability when the field is parsed abnormally. Therefore, boundary values ​​such as -1, 0, and 2 are used for them. n -1, -2 n Fill it.

[0094] Rule 2: Different types of dynamic fields are generated using different methods.

[0095] Specifically, the dynamic field generation methods are relatively rich, so as to construct a large number of test messages for fuzz testing and enhance the vulnerability triggering ability. Specifically including:

[0096] For text-type dynamic fields, perform one or more of the following operations: replacement, expansion, and reduction on delimiters. Replacement replaces delimiters with special characters (for example, " / " or "r / n" with "%" or " / n"). Expansion repeats delimiters n times, which may detect out-of-bounds errors. Reduction randomly deletes delimiters. Additionally, you can set a dictionary to replace delimiters with predefined strings such as "true," "play," and "%d" to expand test data coverage.

[0097] For binary dynamic fields, shorter binary fields are bit-wise inverted. For longer binary fields, one or more of the following operations are performed: byte-level inversion, right shift, and swapping with other dynamic fields. This approach can detect potential vulnerabilities in the target program's parser and functional code.

[0098] It should be noted that a flexible method can be used to randomly fill data in variable-length fields.

[0099] The above content mainly uses the generation rules of a single field as an example, involving only generating one field at a time. However, in actual applications, due to the complex triggering conditions of the vulnerability, it may be necessary to fill multiple different data fields simultaneously. Therefore, multi-field mutation can be used as needed. That is, multiple dynamic fields are randomly selected in the message sequence and each selected field is generated according to the above generation rules. It is understood that the multi-field mutation will continue until a new response is received or the target protocol program crashes.

[0100] Traditional test case generation methods require researchers to have prior knowledge of the protocol and define the message format based on manual analysis. This method of generating test cases is inefficient and difficult to extend to new protocols. However, this embodiment is based on protocol traffic and infers the message format based on keywords. This method is highly applicable and easy to expand. In addition, during actual communication, when the client or server receives a message, it determines the type of message through keywords, thereby also being able to obtain accurate reverse engineering results. Based on the inferred format, different generation rules are defined for different fields in the template. In this way, test cases that conform to the protocol specifications as closely as possible can be generated without prior knowledge of the protocol.

[0101] S105: Generate a test path based on the inferred protocol state machine model;

[0102] Specifically, existing protocol fuzz testing tools have difficulty testing deep-level protocol states and will ignore longer protocol state migration paths. The longer the state migration path, the more time overhead is required to send and receive messages. Most fuzzers prefer message sequences that can reach the target state faster to reduce the time it takes to send and receive messages. Therefore, it is difficult for fuzzers to cover deep states and ultimately fail to find bugs in deep paths. On the other hand, the execution time of fuzz testing is usually limited, and the main time and energy should be spent on state migration paths that are more likely to find vulnerabilities. Therefore, this embodiment prunes the protocol state migration paths based on the inferred protocol state machine model, and deletes state migration paths where it is almost impossible for vulnerabilities to exist. The deleted paths mainly include the following two types: paths that directly migrate to the terminal state; and paths that fall back to the initial state.

[0103] In order to obtain a complete state transition path, all states in the state machine are traversed based on the depth-first algorithm, which includes the following steps:

[0104] Define the initial and final states of the protocol;

[0105] The initial state is stored in the state transition path, and then all the protocol states in the protocol state diagram are traversed from the initial state. Specifically: determine whether the current state has been traversed. If not, mark the state as a new state and put it in the state transition path, and then continue to traverse the successor state of the current state; if so, skip the current state and continue to traverse the next state; until the traversal completes the terminal state or there is no successor state, the traversal is completed, and the complete state transition path is obtained.

[0106] S106: Send the test case to the target program according to the test path to perform fuzz testing, and monitor the status of the target program.

[0107] Specifically, a timeout threshold is set, and then a test case is sent to the target program according to the instructions of the test path; after the test case is sent, if no return message from the target program is received after the timeout threshold is reached, the test case is repeatedly sent t times (for example, t = 3); if no return message from the target program is received after the timeout threshold is reached t times, the target program is restarted and the test case is sent again; if no return message from the target program is received after the timeout threshold is reached, the crash and the test case are recorded, and the next test case is sent.

[0108] Traditional protocol fuzz testing methods only probe deep states by sending continuous message sequences. This approach is difficult to implement and often overlooks longer state transition paths leading to deeper states, resulting in incomplete testing. However, this embodiment uses a depth-first algorithm based on the inferred state machine model to traverse all protocol states and state transition paths, generating a test path. Test cases are then sent according to the instructions of this test path, allowing testing to cover deeper states and longer test paths.

[0109] Example 2

[0110] Corresponding to the above method, an embodiment of the present invention provides a protocol fuzz testing device based on automatic generation of test cases, comprising: a capture module, a message alignment module, a protocol format and state machine inference module, a test case generation module, a test path generation module and a network monitoring module;

[0111] Among them, the capture module is used to capture network traffic during normal protocol communication and filter it; the message alignment module is used to align message sequences using a multiple sequence alignment method; the protocol format and state machine inference module is used to determine the keywords of the protocol, and perform cluster analysis on all message sequences based on the keywords to infer the protocol format and protocol state machine model; the test case generation module is used to construct a template according to the inferred protocol format, and automatically generate test cases according to the template; the test path generation module is used to generate a test path according to the inferred protocol state machine model; the network monitoring module is used to send the test case to the target program for fuzz testing according to the test path, and monitor the status of the target program.

[0112] It should be noted that the device provided in the embodiment of the present invention is for implementing the above method embodiment. Its specific functions can be referred to the above method embodiment and will not be described in detail here.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A protocol fuzz testing method based on automatic generation of test cases, characterized in that: include: Step 1: Capture network traffic during normal protocol communication and filter it; Step 2: Align the message sequences using a multiple sequence alignment method; Step 3: Determine the keywords of the protocol and perform cluster analysis on all message sequences based on the keywords to infer the protocol format and protocol state machine model; specifically, the following steps are involved: For each candidate keyword, set it to be clustered to obtain N clusters; For each candidate keyword, calculate the message similarity score and the structural similarity score between messages in the cluster based on its corresponding clustering results; Select the keywords with the highest message similarity score and the highest score for structural similarity between messages in the cluster, and calculate the keyword position field score corresponding to the selected keywords; For each candidate keyword, calculate the product of the message similarity score, the structure similarity score between messages in the cluster, and the keyword position field score. The candidate keyword with the highest product value is selected as the final keyword. Based on the final keyword clustering results, the protocol format and state machine model are inferred; Step 4: Building a template based on the inferred protocol format, and automatically generating test cases based on the template; Step 5: Generate test paths based on the inferred protocol state machine model; Step 6: Send the test case to the target program for fuzz testing according to the test path, and monitor the status of the target program.

2. A protocol fuzz testing method based on automatic generation of test cases according to claim 1, characterized in that: Step 2 specifically includes: Step 2.1: Calculate the longest message sequence length l among all initial message sequences max and the shortest message sequence length l min ; For each initial message sequence, execute steps 2.2 to 2.6; Step 2.2: Divide the initial message sequence into static fields and dynamic fields in byte units; Step 2.3: Initialize field offset; Step 2.4: Under the current field offset value, determine whether two adjacent static fields are the same. If they are the same, merge the two adjacent static fields into one long static field; Step 2.5: Update the field offset value and determine whether the field offset value exceeds the shortest message sequence length l min If not, go to step 2.4; if so, go to step 2.6; Step 2.6: Set the field offset to (l min ,l max ) are defined as data fields, and alignment symbols are inserted in the data fields.

3. A protocol fuzz testing method based on automatic generation of test cases according to claim 1, characterized in that: Calculate the message similarity score P1 according to formula (1): Among them, edit_distance(m k ,m t ) means that any two message sequences m k and m t The minimum number of operations required to transform into two identical message sequences, where the operations are one or more of addition, deletion, and replacement; max_len(m k ,m t ) represents two message sequences m k and m t The length of the longer message sequence.

4. A protocol fuzz testing method based on automatic generation of test cases according to claim 1, characterized in that: The structural similarity score P2 between messages in the cluster is calculated according to formula (2): Among them, number_gap i Indicates the number of alignment symbols inserted during the alignment of all packets in the i-th cluster.

5. A protocol fuzz testing method based on automatic generation of test cases according to claim 1, characterized in that: Calculate the keyword position field score P3 according to formula (3): Among them, d c d s Indicates the offset value of the candidate keyword field on the client and server. c 、l s Indicates the length of the candidate keyword field.

6. A protocol fuzz testing method based on automatic generation of test cases according to claim 1, characterized in that: Step 4 specifically includes: Divide the fields in the template into static fields and dynamic fields; When generating test cases, the generation rules include: Rule 1: Keep static fields unchanged while ensuring that they are not parsed abnormally. Rule 2: Different dynamic fields are generated using different methods. Specifically, for text-type dynamic fields, one or more of the following operations are performed on the delimiters: replacement, expansion, and reduction. Replacement refers to replacing delimiters with other special characters, expansion refers to repeating delimiters n times, and reduction refers to randomly deleting delimiters. For binary type dynamic fields, a bit-by-bit inversion operation is performed on a shorter binary field; and one or more operations of byte-level inversion, right shift, and interchange with other dynamic fields are performed on a longer binary field.

7. A protocol fuzz testing method based on automatic test case generation according to claim 1, characterized in that: Step 5 specifically includes: Define the initial and final states of the protocol; The initial state is stored in the state transition path, and then all the protocol states in the protocol state diagram are traversed from the initial state. Specifically: determine whether the current state has been traversed. If not, mark the state as a new state and put it in the state transition path, and then continue to traverse the successor state of the current state; if so, skip the current state and continue to traverse the next state; until the traversal completes the terminal state or there is no successor state, the traversal is completed, and the complete state transition path is obtained.

8. A protocol fuzz testing method based on automatic test case generation according to claim 1, characterized in that: Step 6 specifically includes: Set a timeout threshold and then send test cases to the target program according to the instructions of the test path; After sending the test case, if no return message from the target program is received after reaching the timeout threshold, the test case is sent repeatedly t times. If no return message from the target program is received after reaching the timeout threshold t times, the target program is restarted and the test case is sent again. If no return message from the target program is received after reaching the timeout threshold, the crash and the test case are recorded, and the next test case is sent.

9. A protocol fuzz testing device based on automatic generation of test cases, characterized in that: include: Capture module, used to capture network traffic during normal protocol communication and filter it; A message alignment module, used to align message sequences using a multiple sequence alignment method; The protocol format and state machine inference module is used to determine the keywords of the protocol and perform cluster analysis on all message sequences based on the keywords to infer the protocol format and protocol state machine model. Specifically, for each candidate keyword, set the N clusters obtained by clustering it, and calculate the message similarity score and the structural similarity score between messages in the cluster based on the corresponding clustering results; Select the keyword with the highest message similarity score and the highest intra-cluster message structure similarity score, and calculate the keyword position field score corresponding to the selected keyword; for each candidate keyword, calculate the product of the message similarity score, the intra-cluster message structure similarity score, and the keyword position field score, and select the candidate keyword with the highest product value as the final keyword; Based on the final keyword clustering results, the protocol format and state machine model are inferred; A test case generation module, configured to construct a template according to the inferred protocol format and automatically generate test cases according to the template; A test path generation module, used to generate a test path based on the inferred protocol state machine model; The network monitoring module is used to send the test case to the target program for fuzz testing according to the test path and monitor the status of the target program.

Images