UDS protocol test case generation method based on grammar rules

Abstract

The present invention discloses a UDS protocol security test case generation method based on grammatical rules, collects data packets of the UDS protocol according to actual needs and divides the data packets into a single-frame data packet set and a continuous frame data packet set, generates a three-layer tree structure as a protocol tree for the single-frame data packet set, generates a chain tree as a protocol tree for the continuous frame data packet set, then performs mutation marking on the nodes in each protocol tree to obtain a grammar tree, performs several mutations on each protocol tree based on the grammar tree, and generates data packets as test cases according to the mutated protocol tree. The present invention generates a grammar tree based on an existing UDS data packet, generates a test case after mutating the grammar tree, so that the generated test case meets the grammar specification of the UDS protocol, and effectively improves the efficiency of fuzzy testing.

Description

Technical Field

[0001] The invention belongs to the technical field of vehicle-mounted bus communication safety testing, and more specifically, relates to a method for generating UDS protocol test cases based on grammatical rules. Background Art

[0002] The UDS (Unified Diagnostic Services) protocol is ISO14229. This protocol is applied to the on-board ECU (Electronic Control Unit) to define the instructions sent to it, and is applied to IOT (Internet of Things) equipment fault diagnosis to define related instructions for reading data streams. This protocol can be used to test the protocol communication security of the target device.

[0003] Currently, there are two existing fuzzing solutions for UDS protocol security:

[0004] Method 1: Randomly construct packages

[0005] For the UDS safety test of the vehicle-mounted CAN bus, the small data volume of a single UDS message on the CAN (Controller Area Network) bus is utilized (a single message is only 8 bytes or 64 bytes at most), and the method of randomly generating out-of-order bytes is used to construct the CAN message content for testing.

[0006] Method 2: Constructing a package by specifying random byte mutation

[0007] First, the ECU bus communication signal needs to be captured once or multiple times, and then the user specifies that the fixed bytes or fixed bits of the bus message remain unchanged, and the other bytes are randomly mutated to construct a new data packet.

[0008] The two methods adopted by the prior art have obvious advantages and disadvantages. The advantage of the random packet construction method in method one is that it does not require manual intervention at all. The disadvantage is that the generated data packets do not meet the specifications of the target protocol, and most data packets are rejected, causing the Fuzzer (fuzz tester) to waste a lot of time on invalid use case generation. The Fuzzer is inefficient and cannot quickly discover shallow problems, and cannot discover deep-seated problems in the CAN message data structure. The method of constructing packets by randomly mutating specified bytes in method two has the advantage of improving efficiency compared to the random packet construction method. When the specified bytes remain unchanged, the generated data packets are more directional. The disadvantage is that it has high requirements for users, requiring users to understand the bus message data structure, and cannot be used out of the box. In addition, for bus messages with verification, the correct verification value cannot be generated as required. Summary of the invention

[0009] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a UDS protocol test case generation method based on grammatical rules, generate a syntax tree based on an existing UDS data packet, and generate test cases after mutating the syntax tree, so that the generated test cases conform to the grammatical specifications of the UDS protocol, thereby effectively improving the efficiency of fuzzy testing.

[0010] In order to achieve the above-mentioned object of the invention, the UDS protocol test case generation method based on grammatical rules of the present invention comprises the following steps:

[0011] S1: collect the data packets of the UDS protocol according to actual needs, and divide the data packets into a single-frame data packet set and a continuous-frame data packet set according to whether the data packets are transmitted in a single-frame transmission or a continuous-frame transmission;

[0012] For a set of single-frame data packets, the single-frame data packets with the same length are divided into a set, and then the three-layer tree structure is constructed as the protocol tree with the length of the data packet as the root node, the service ID as the child node, and the data as the leaf node;

[0013] For a set of continuous frame data packets, first, according to the continuous frame construction rule, the data packet length is used as the root node and connected in sequence into a chain tree, and then the protocol tree of each root node is constructed based on the data packets with the same length, and the constructed chain tree is used as the protocol tree of the continuous frame data packets;

[0014] The protocol tree obtained by the above method is used as a syntax template;

[0015] S2: Construct a syntax tree according to each protocol tree in the syntax template obtained in step S1: for each protocol tree, traverse each node and mark the variation, so as to obtain a syntax tree; the specific method of marking the variation of the node is:

[0016] S2.1: Determine whether there are special characters defined by the developer in the node data. If so, proceed to step S2.2. If not, proceed to step S2.3.

[0017] S2.2: Mark the node as an immutable node, set its mutation operation set to empty, and map the node to the corresponding processing function;

[0018] S2.3: Determine whether the node is a root node, if yes, proceed to step S2.4, otherwise proceed to step S2.7;

[0019] S2.4: Determine whether the node belongs to a chain tree. If yes, proceed to step S2.5; otherwise, proceed to step S2.6;

[0020] S2.5: Mark the node as a mutable node and add random mutation to its mutation operation set;

[0021] S2.6: Mark the node as an immutable node and set its mutation operation set to empty;

[0022] S2.7: Determine whether the node has child nodes. If yes, proceed to step S2.8; otherwise, proceed to step S2.9;

[0023] S2.8: Mark the node as a mutable node, add grafting mutation to its mutation operation set, and proceed to step S2.9;

[0024] S2.9: Determine whether the node has a brother node. If yes, proceed to step S2.10; otherwise, proceed to step S2.11.

[0025] S2.10: Mark the node as a mutable node, and add replacement mutation and deletion mutation to its mutation operation set;

[0026] S2.11: Mark the node as a mutable node, and add random replacement mutation, deletion mutation, and random filling mutation to its mutation operation set;

[0027] S3: For each protocol tree, several mutation operations are performed based on the corresponding syntax tree to obtain several mutated protocol trees. The specific method of performing mutation operations based on the syntax tree is:

[0028] Traverse each node in the protocol tree to determine whether the node is an immutable node. If so, do not perform any operation. If not, randomly select a mutation operation from its mutation operation set for mutation:

[0029] When the selected mutation operation is graft mutation, its child node is grafted to its parent node or sibling node;

[0030] When the selected mutation operation is deletion mutation, the subtree with the node as the root node is deleted;

[0031] When the selected mutation operation is replacement mutation, the sibling node of the node is copied and the node is replaced;

[0032] When the selected mutation operation is random filling mutation, the data of the node is randomly filled;

[0033] When the selected mutation operation is random replacement mutation, a byte is randomly generated or the value of any node is copied to replace the node;

[0034] When the selected mutation operation is random mutation, each protocol tree in the chain tree is mutated in random order;

[0035] S4: For each variant protocol tree obtained in step S3, recursively traverse the child nodes of the tree layer by layer, combine the values ​​of each node, and use the obtained data packets as test cases.

[0036] The UDS protocol security test case generation method based on grammatical rules of the present invention collects data packets of the UDS protocol according to actual needs and divides the data packets into a single-frame data packet set and a continuous frame data packet set, generates a three-layer tree structure as a protocol tree for the single-frame data packet set, generates a chain tree as a protocol tree for the continuous frame data packet set, then marks the nodes in each protocol tree for mutation to obtain a grammar tree, mutates each protocol tree several times based on the grammar tree, and generates data packets as test cases according to the mutated protocol tree.

[0037] The present invention has the following technical effects:

[0038] 1) The present invention generates a syntax tree based on an existing UDS data packet, and generates test cases after mutating the syntax tree, so that the generated test cases conform to the syntax specification of the UDS protocol, so that each test case can be received and parsed by the target protocol stack, avoiding the waste of invalid case generation, and effectively improving the efficiency of fuzzy testing;

[0039] 2) In terms of ease of use, the present invention only needs to write a configuration file that conforms to the syntax specification of the UDS protocol during the initialization phase. A one-time setting can facilitate subsequent out-of-the-box use. For bus UDS messages with special checks, the target can be quickly adapted by slightly changing the mutation method, thereby better adapting to various application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flowchart of a specific implementation method of a UDS protocol security test case generation method based on grammatical rules of the present invention;

[0041] Figure 2is an example diagram of the protocol tree in this embodiment;

[0042] Figure 3 is an example diagram of a protocol tree for continuous frame data packets in this embodiment;

[0043] Figure 4 It is a flow chart of performing mutation marking on nodes in the present invention;

[0044] Figure 5 2 is an example diagram of grafting variation in this embodiment. DETAILED DESCRIPTION

[0045] The specific implementation of the present invention is described below in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when the detailed description of known functions and designs may dilute the main content of the present invention, these descriptions will be omitted here.

[0046] Example

[0047] Figure 1 This is a flow chart of a specific implementation method of the UDS protocol security test case generation method based on grammatical rules of the present invention. Figure 1 As shown, the UDS protocol security test case generation method based on grammatical rules of the present invention includes the following steps:

[0048] S101: Constructing a grammar template:

[0049] The UDS protocol of the bus message has its own unique syntax structure. The first byte at the beginning indicates the length of the data packet, the second byte indicates the ID corresponding to the service, and the third byte indicates its sub-service or data area data. According to its syntax structure, a corresponding syntax template can be constructed. The specific method of constructing the syntax template in the present invention is as follows:

[0050] Data packets of the UDS protocol are collected according to actual needs, and divided into a single-frame data packet set and a continuous frame (multi-frame) data packet set according to whether single-frame transmission or continuous frame transmission is adopted during transmission.

[0051] For a set of single-frame data packets, the single-frame data packets with the same length are divided into a set. Then, the data packet length is used as the root node, the service ID is used as the child node, and the data is used as the leaf node. The three-layer tree structure is constructed as the protocol tree. In the existing UDS protocol, there are four types of data packet lengths, namely 10, 20, 21, and 22, so four protocol trees can be obtained in the end. Assuming there are three single-frame data packets in the UDS protocol: 02 10 01, 02 10 02, and 02 27 01, then the obtained protocol tree is Figure 2 shown. Figure 2 This is an example diagram of the protocol tree in this embodiment.

[0052] For a set of continuous frame data packets, first use the data packet length as the root node and connect them in sequence into a chain tree according to the continuous frame construction rules. Then, based on the data packets with the same length, build a protocol tree for each root node, and use the constructed chain tree as the protocol tree for the continuous frame data packets. Figure 3 is an example diagram of the protocol tree of continuous frame data packets in this embodiment. Figure 3 As shown, in the existing UDS protocol, the continuous frame construction is that the data packet lengths are 10, 20, 21, and 22 respectively, so the chain tree is formed by connecting 4 protocol trees.

[0053] The protocol tree obtained by the above method is the syntax template.

[0054] S102: Construct syntax tree:

[0055] Next, it is necessary to construct a syntax tree according to each protocol tree in the syntax template obtained in step S101. For each protocol tree, each node thereof is traversed and mutated, thereby obtaining a syntax tree. Figure 4 This is a flow chart of marking nodes for mutation in the present invention. Figure 4 As shown, the specific method for marking a node for mutation in the present invention is:

[0056] S401: Determine whether there are special characters (such as checksum) customized by the developer in the node data. If so, proceed to step S402. If not, proceed to step S403. Due to the differences in the format and position of special characters in the algorithms written by different personnel based on the UDS protocol in specific engineering applications, when there are characteristic characters customized by the developer in the node data, the node cannot be mutated.

[0057] S402: Mark the node as an immutable node, set its mutation operation set to empty, and map the node to a corresponding processing function.

[0058] S403: Determine whether the node is a root node, if yes, proceed to step S404, otherwise proceed to step S407.

[0059] S404: Determine whether the node belongs to a chain tree (this embodiment uses whether the node value is less than 0x10 for determination). If so, proceed to step S405; otherwise, proceed to step S406.

[0060] S405: Mark the node as a mutable node, and add a random mutation to its mutation operation set.

[0061] S406: Mark the node as an immutable node, and set its mutation operation set to empty.

[0062] S407: Determine whether the node has child nodes, if yes, go to step S408, otherwise go to step S409.

[0063] S408: Mark the node as a mutable node, add grafting mutation to its mutation operation set, and proceed to step S409.

[0064] S409: Determine whether the node has a sibling node, if yes, proceed to step S410, otherwise proceed to step S411.

[0065] S410: Mark the node as a mutable node, and add replacement mutation and deletion mutation to its mutation operation set.

[0066] S411: Mark the node as a mutable node, and add random replacement mutation, deletion mutation, and random filling mutation to its mutation operation set.

[0067] S103: Mutation based on syntax tree:

[0068] According to the mutation operation of the node in step S102, the mutation strategy based on the syntax tree in the present invention includes disorder, grafting, deletion, replacement, random replacement and random filling, which ensures that the data packet conforming to the expected structure is generated without destroying the protocol tree structure, wherein the disorder mutation strategy is for the case of continuous frame data packets. In the present invention, for each protocol tree, several mutation operations are performed based on the corresponding syntax tree to obtain several variant protocol trees. The specific method for performing mutation operations based on the syntax tree is:

[0069] Traverse each node in the protocol tree to determine whether the node is an immutable node. If so, do not perform any operation. If not, randomly select a mutation operation from its mutation operation set for mutation:

[0070] When the selected mutation operation is graft mutation, its child node is grafted to its parent node or sibling node. Figure 5 is an example diagram of grafting variation in this embodiment. Figure 5 As shown, when node B undergoes grafting mutation, its child node D is grafted onto the parent node A or the brother node C of node B.

[0071] When the selected mutation operation is a delete mutation, the subtree with the node as the root node will be deleted.

[0072] When the selected mutation operation is replacement mutation, the sibling nodes of the node are copied and the node is replaced.

[0073] When the selected mutation operation is random fill mutation, the data of the node is randomly filled. This mutation operation can be used to discover developer-defined services.

[0074] When the selected mutation operation is random replacement mutation, a byte is randomly generated or the value of any node is copied to replace the node.

[0075] When the selected mutation operation is a random mutation, each protocol tree in the chain tree is mutated in a random order.

[0076] In actual applications, you can also set custom mutation operations as needed, set data segments (such as check characters) according to actual needs, and when the data segment exists in the node data, perform a preset mutation operation (such as changing the check character to another character). Custom mutation operations can be defined by the user, which facilitates the expansion of mutation operations and adapts to more application scenarios of the UDS protocol.

[0077] S104: Generate test cases based on the variant protocol tree:

[0078] For each variant protocol tree obtained in step S103, the child nodes of the tree are recursively traversed layer by layer, the values ​​of each node are combined, and the obtained data packets are used as test cases.

[0079] Although the above describes the illustrative specific embodiments of the present invention to facilitate those skilled in the art to understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations using the concept of the present invention are protected.

Claims

1. A method for generating UDS protocol security test cases based on grammatical rules, characterized in that: The following steps are involved: S1: collect the data packets of the UDS protocol according to actual needs, and divide the data packets into a single-frame data packet set and a continuous-frame data packet set according to whether the data packets are transmitted in a single-frame transmission or a continuous-frame transmission; For a set of single-frame data packets, the single-frame data packets with the same length are divided into a set, and then the three-layer tree structure is constructed as the protocol tree with the length of the data packet as the root node, the service ID as the child node, and the data as the leaf node; For a set of continuous frame data packets, first, according to the continuous frame construction rule, the data packet length is used as the root node and connected in sequence into a chain tree, and then the protocol tree of each root node is constructed based on the data packets with the same length, and the constructed chain tree is used as the protocol tree of the continuous frame data packets; The protocol tree obtained by the above method is used as a syntax template; S2: Construct a syntax tree according to each protocol tree in the syntax template obtained in step S1: for each protocol tree, traverse each node and mark the variation, so as to obtain a syntax tree; the specific method of marking the variation of the node is: S2.1: Determine whether there are special characters defined by the developer in the node data. If so, proceed to step S2.

2. If not, proceed to step S2.

3. S2.2: Mark the node as an immutable node, set its mutation operation set to empty, and map the node to the corresponding processing function; S2.3: Determine whether the node is a root node, if yes, proceed to step S2.4, otherwise proceed to step S2.7; S2.4: Determine whether the node belongs to a chain tree. If yes, proceed to step S2.5; otherwise, proceed to step S2.6; S2.5: Mark the node as a mutable node and add random mutation to its mutation operation set; S2.6: Mark the node as an immutable node and set its mutation operation set to empty; S2.7: Determine whether the node has child nodes. If yes, proceed to step S2.8; otherwise, proceed to step S2.9; S2.8: Mark the node as a mutable node, add grafting mutation to its mutation operation set, and proceed to step S2.9; S2.9: Determine whether the node has a brother node. If yes, proceed to step S2.10; otherwise, proceed to step S2.

11. S2.10: Mark the node as a mutable node, and add replacement mutation and deletion mutation to its mutation operation set; S2.11: Mark the node as a mutable node, and add random replacement mutation, deletion mutation, and random filling mutation to its mutation operation set; S3: For each protocol tree, several mutation operations are performed based on the corresponding syntax tree to obtain several mutated protocol trees. The specific method of performing mutation operations based on the syntax tree is: Traverse each node in the protocol tree to determine whether the node is an immutable node. If so, do not perform any operation. If not, randomly select a mutation operation from its mutation operation set for mutation: When the selected mutation operation is graft mutation, its child node is grafted to its parent node or sibling node; When the selected mutation operation is deletion mutation, the subtree with the node as the root node is deleted; When the selected mutation operation is replacement mutation, the sibling node of the node is copied and the node is replaced; When the selected mutation operation is random filling mutation, the data of the node is randomly filled; When the selected mutation operation is random replacement mutation, a byte is randomly generated or the value of any node is copied to replace the node; When the selected mutation operation is random mutation, each protocol tree in the chain tree is mutated in random order; S4: For each variant protocol tree obtained in step S3, recursively traverse the child nodes of the tree layer by layer, combine the values ​​of each node, and use the obtained data packets as test cases.

2. The UDS protocol security test case generation method according to claim 1, characterized in that: The mutation operation in step S3 also includes a custom mutation operation, in which a data segment is set according to actual needs. When the data segment exists in the node data, a preset mutation operation is performed.

Images