Stateful network protocol vulnerability testing method and system based on state selection optimization

Abstract

The application discloses a stateful network protocol vulnerability testing method and system based on state selection optimization, which firstly carries out some preprocessing operations before network protocol fuzz testing. Secondly, a state array is initialized, a target state to be tested is selected, a candidate message sequence set is generated, a message sequence is selected from the candidate message sequence set, and the message sequence is sent to a protocol entity for protocol testing after being mutated. Finally, code coverage information and state information generated by the tested protocol entity during running are collected, and whether the message sequence is an interesting message sequence is judged. The system comprises a test preparation module, a network protocol fuzz testing module and a result information feedback module. The application effectively solves problems of the stateful network protocol in the face of state selection and improves the efficiency of the fuzz testing, and more security vulnerabilities are found in the same testing time.

Description

Technical Field

[0001] This invention belongs to the field of network protocol security vulnerability detection technology, specifically involving a stateful network protocol vulnerability testing method and system based on state selection optimization. Background Technology

[0002] Currently, fuzzers for stateful network protocols are mainly divided into two categories: black-box fuzzers based on generation and gray-box fuzzers based on mutation. Both types of fuzzers utilize state machine models to divide the state space within the protocol entity and use state machine models to guide the fuzzer in fuzz testing. Since not all states are equally important, fuzzers need effective state selection algorithms to prioritize interesting states (that can increase code coverage, discover new states, or new state transitions, etc.) rather than other invalid states. However, they have the following problems when facing state selection: (1) they treat every protocol state equally, that is, they do not consider that the potential of different states is different; (2) the dimensional information for state evaluation is too singular, that is, they cannot accurately evaluate the potential of states; and (3) the frequent introduction of additional algorithms seriously reduces the execution efficiency of the fuzzer.

[0003] The mainstream gray-box fuzzer for mutation-based network protocols is the protocol fuzzing tool AFLNET. It considers the impact of protocol state selection on protocol testing and provides several heuristic state selection algorithms, including random RANDOM, round-robin, and preference-based FAVOR. RANDOM selects states randomly, and ROUND-ROBIN selects states in a round-robin manner, without considering the differences in state testing potential; while the FAVOR algorithm selects states according to an evaluation calculation formula, but uses only a single dimension of information for evaluating states. AFLNetLegion also uses a single dimension of information to evaluate each state. CN114650163A proposes a fuzzing method for stateful network protocols, using protocol rule sets to generate message test templates, and mutating the mutable fields in the message test templates to generate new test messages. CN104142888A proposes a regularized state machine model design method for stateful protocols, using state rule information and a state machine model to generate a regularized state machine model, and constructing a state spanning tree. The state spanning tree simplifies the relationship between states and messages, eliminating meaningless mutation combinations. None of the methods mentioned above take into account the differences in potential between different states. Summary of the Invention

[0004] This invention proposes a stateful network protocol vulnerability testing method and system based on state selection optimization. It treats protocol state selection as a probabilistic problem, models the optimal probability distribution of the state as an optimization problem, and then dynamically searches for the optimal state probability distribution by introducing a variant of the Particle Swarm Optimization (PSO) algorithm. The fuzzer then uses this optimal state probability distribution to select the state. Furthermore, by collecting multi-dimensional feedback information generated during the testing process (the number of inputs generated by the current state, the number of times the current state is selected, whether the current state has been fuzzed, etc.), a function for evaluating the state is constructed to more accurately assess the potential value of each state. A message sequence analysis method is also designed to help the fuzzer select message sequences that can better explore the deeper code of the protocol entity and the protocol state for further mutation testing.

[0005] The state selection-based optimization method for testing stateful network protocols mainly includes three stages: test preparation stage, network protocol fuzzing stage, and result information feedback stage.

[0006] 1. Test Preparation Phase

[0007] Preprocessing steps before performing network protocol fuzzing include compilation instrumentation and initial build.

[0008] remove

[0009] The steps, including information sequence set collection, specifically include the following:

[0010] 1.1 Compiler instrumentation

[0011] The protocol entity program under test is compiled and instrumented using the compiler instrumentation tool afl-clang-fast++ to generate the target code of the protocol under test, which facilitates the collection of code coverage information and state information during the runtime of the protocol entity.

[0012] 1.2 Constructing the initial message sequence set

[0013] First, start the target code of the protocol under test and its corresponding communication terminal, and start communication.

[0014] Secondly, use the packet sniffing tool tcpdump to monitor all traffic on the ports corresponding to the protocol entities, collect and save this traffic.

[0015] Finally, the captured traffic was parsed using the packet analysis tool Wireshark, and all request message sequences were extracted as the initial message sequence set MSeqSet, where MSeqSet = {M1, ..., M...} g ,...,M d}, M g This refers to the g-th message sequence in MSeqSet, where g = 1, ..., d, and d is the total number of message sequences; a message sequence is a linked list of messages, i.e., M... g =m g,1 ->...->m g,k ->...->m g,a m g,k Let a represent the k-th message in the g-th message sequence, where k = 1, ..., a, and a is M. g Total number of messages.

[0016] 2. Network Protocol Fuzzy Testing Phase

[0017] The process in this phase is as follows: First, initialize the state array; second, select the target state to be tested according to different state selection methods; then, use the message sequence analyzer to generate a candidate message sequence set from the message sequence set MSeqSet; finally, select a message sequence from the candidate message sequence set, mutate it, and send it to the protocol entity for protocol testing. Specifically, it includes the following:

[0018] 2.1 Initialize the state array

[0019] Perform a protocol test once on each message sequence in the initial message sequence set MSeqSet generated in step 1.2, collect the generated protocol states and store them in the state array state_ids, where state_ids = {S1,...,S...} i ,...,S n},S i Let represent the i-th protocol state, where i = 1, ..., n, and n is the total number of protocol states. Initialize the probability distribution corresponding to the state array: state_probability = {p1, ..., p...} j ,...,p n},p j This represents the probability that the j-th protocol state is selected. n represents the total number of protocol states.

[0020] 2.2 Selecting the target state

[0021] Based on the state array state_ids, set the number of random selections f, and select a state from state_ids for fuzz testing as the target state S through random selection. p .

[0022] 2.2.1 Random selection

[0023] Before completing f random selections, one state is randomly selected from all states in the state_ids array in step 2.1 as the target state S for the protocol fuzz test. p p = 1, ..., n, where n is the total number of protocol states, and proceed to step 2.3.

[0024] 2.2.2 Introducing a variant of the particle swarm optimization algorithm

[0025] After f random selections, if no variant of the particle swarm optimization algorithm has been used before, or if a new protocol state was discovered during the previous test, or if the time since the last call to the variant of the particle swarm optimization algorithm exceeds a preset time t seconds, then the variant of the particle swarm optimization algorithm is used to solve for the optimal probability distribution of all states, and the target state to be tested is selected based on this optimal probability distribution.

[0026] 2.2.3 Use the optimal state probability distribution from the previous round

[0027] After f rounds of random selection, if no new protocol state is triggered and the time interval between two consecutive calls to the particle swarm optimization algorithm does not exceed a preset time t seconds, then the optimal state is selected as the target state S for the protocol fuzzy test based on the probability distribution state_probability obtained in the previous round. p p = 1, ..., n, where n is the total number of protocol states, and proceed to step 2.3.

[0028] 2.3 Message Sequence Analyzer

[0029] According to the target state S in step 2.2 p Then, from all the protocols that can make the entity program reach the target state S p From the message sequence, select the message sequence with the longest length and the fewest infix messages (the number of infix messages can be calculated using the AFLNET method), and generate a candidate message sequence set MSet = {M1,...,M...}. h ,...,M H}, h=1,...,H, where H is the total number of message sequences in the MSet set.

[0030] 2.4 Selecting a Message Sequence

[0031] Based on the candidate message sequence set MSet from step 2.3, a message sequence M is randomly selected from MSet.

[0032] 2.5 Mutation Message Sequence

[0033] Based on the message sequence M in step 2.4, a new message sequence M' is generated by mutating it using AFLNET's bit-level, byte-level, and message-level mutation strategies.

[0034] 2.6 Protocol Testing

[0035] Each message in M' generated in step 2.5 is sent sequentially to the protocol entity under test for testing. If a vulnerability is triggered during the test, M' is saved for vulnerability reproduction after the test is completed.

[0036] 3. Results Feedback Stage

[0037] This phase is used to collect code coverage and state information generated during the runtime of the protocol entity under test, and to determine whether message sequence M' is an interesting message sequence. Specifically, it includes the following:

[0038] 3.1 Collect code coverage information and state sequences

[0039] Using AFLNET to collect code coverage information and state sequences of the protocol entity under test:

[0040] (1) If new code coverage or a new state new_state_id is generated, it means that M' is interesting and the new state new_state_id is saved to the state_ids array. Then M' is added to MSeqSet for further mutation testing.

[0041] (2) Otherwise, if no new code overwrite is generated, no new state is generated, or no new state transition is generated, then M' is discarded.

[0042] (3) Proceed to step 2.2 to conduct the next round of network protocol fuzz testing.

[0043] Based on the above method, the present invention further provides a stateful network protocol vulnerability testing system based on state selection optimization, including a test preparation module, a network protocol fuzzing module, and a result information feedback module.

[0044] The test preparation module uses the compilation and instrumentation tool afl-clang-fast++ to compile and instrument the protocol entity under test, and uses tcpdump and Wireshark to capture and parse data packets, finally generating an initial message sequence set.

[0045] The network protocol fuzzing module performs fuzzing loops to test the protocol entity under test.

[0046] The results feedback module collects code coverage information and state sequences generated by the protocol entity under test during network protocol testing. It determines whether a message sequence is interesting and saves interesting message sequences.

[0047] The beneficial effects of this invention are:

[0048] 1. This invention employs a state-selection optimization-based vulnerability testing method for stateful network protocols. By solving for the optimal state probability distribution, it helps the network protocol fuzzer select more promising states for network protocol testing. Simultaneously, it designs multiple different algorithm triggering mechanisms, allowing the introduced particle swarm optimization algorithm to adaptively choose appropriate times for invocation, avoiding the frequent introduction of additional algorithms that would reduce fuzzing efficiency. Furthermore, by collecting multi-dimensional feedback information generated during the testing process, a function for evaluating states is constructed to more accurately assess the potential value of each state. Finally, a novel message sequence analysis algorithm is designed to help the network protocol fuzzer explore deeper protocol states and logic code, effectively solving the problems existing in stateful network protocols when facing state selection and improving the efficiency of fuzzing.

[0049] 2. Using the method of the present invention, the efficiency of network protocol testing can be improved. Within the same testing time, more and deeper levels of code logic and protocol states can be explored in the network protocol entity program, and more security vulnerabilities can be discovered. Attached Figure Description

[0050] Figure 1 This is a design framework diagram of the present invention;

[0051] Figure 2 This is an overall flowchart of the present invention;

[0052] Figure 3 Flowchart for the fuzz testing phase of a network protocol;

[0053] Figure 4 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0054] The technical solutions of the present invention will now be fully described with reference to the accompanying drawings in the embodiments of the present invention.

[0055] like Figure 1 The diagram shown illustrates the design framework of this invention, encompassing the specific implementation of the actual architecture of the entire network protocol fuzzy method. For example... Figure 2 As shown, the stateful network protocol vulnerability testing method and system based on state selection optimization consists of three stages: test preparation stage, network protocol fuzzing stage, and result information feedback stage.

[0056] 1. Test Preparation Phase

[0057] This stage involves preprocessing steps before performing network protocol fuzzing tests, including compilation and insertion.

[0058] Piles, initial construction

[0059] The steps, including information sequence set collection, specifically include the following:

[0060] 1.1 Compiler instrumentation

[0061] The protocol entity program under test is compiled and instrumented using the compiler instrumentation tool afl-clang-fast++ to generate the target code of the protocol under test, which facilitates the collection of code coverage information and state information during the runtime of the protocol entity.

[0062] 1.2 Constructing the initial message sequence set

[0063] First, start the target code of the protocol under test and its corresponding communication terminal, and start communication.

[0064] Then, the packet sniffing tool tcpdump is used to listen to all traffic on the port corresponding to the protocol entity, and this traffic is collected and saved.

[0065] Finally, the captured traffic was parsed using the packet analysis tool Wireshark, and all request message sequences were extracted as the initial message sequence set MSeqSet, where MSeqSet = {M1, ..., M...} g ,...,M d}, M g This refers to the g-th message sequence in MSeqSet, where g = 1, ..., d, and d is the total number of message sequences. A message sequence is a linked list of messages, i.e., M... g =m g,1 ->...->m g,k ->...->m g,a m g,k Let a represent the k-th message in the g-th message sequence, where k = 1, ..., a, and a is M. g Total number of messages.

[0066] 2. Network Protocol Fuzzy Testing Phase

[0067] like Figure 3The flowchart shown illustrates the fuzzing phase of a network protocol. First, the state array is initialized; second, the target state to be tested is selected according to different state selection methods; then, a candidate message sequence set is generated using a message sequence analyzer; finally, a message sequence is selected from the candidate message sequence set, mutated, and sent to the protocol entity for protocol testing. Specifically, it includes the following:

[0068] 2.1 Initialize the state array

[0069] Perform a protocol test on each message sequence in the initial message sequence set MSeqSet generated in step 1.2, collect the generated protocol states and store them in the state array state_ids, where state_ids = {S1,...,S...} i ,...,S n},S i Let represent the i-th protocol state, where i = 1, ..., n, and n is the total number of protocol states. Initialize the probability distribution corresponding to the state array: state_probability = {p1, ..., p...} j ,...,p n},p j This represents the probability that the j-th protocol state is selected. n represents the total number of protocol states.

[0070] 2.2 Selecting the target state

[0071] like Figure 1 The target state selector shown in this step, based on the state array state_ids generated in step 2.1, sets the number of random selections f, and selects a state from state_ids for fuzz testing as the target state S through random selection. p Specifically, it includes the following:

[0072] 2.2.1 Random selection

[0073] Before completing f random selections (f is usually empirically taken as 10), one state is randomly selected from all states in the state array state_ids in step 2.1 as the target state S for the protocol fuzz test. p p = 1, ..., n, where n is the total number of protocol states, and proceed to step 2.3.

[0074] 2.2.2 Introducing a variant of the particle swarm optimization algorithm

[0075] After f random selections, if no variant of the Particle Swarm Optimization (PSO) algorithm has been used before, or a new protocol state was discovered during the previous test, or the time since the last call to the PSO variant exceeds a preset time t seconds (usually empirically taken as 60 seconds), then the variant of the PSO algorithm is used to solve for the optimal probability distribution of all states, and the target state to be tested is selected based on this optimal probability distribution. For example... Figure 1 The PSO algorithm initialization and PSO algorithm start analyzer startup are shown below:

[0076] First, extract all states from the state array `state_ids` in step 2.1 and model them as an n-dimensional particle, where each dimension is independent of the others, and the value of each dimension represents the probability of a state being selected. Furthermore, the sum of all dimension values ​​of a particle is 1; in other words, a particle corresponds to a probability distribution of a state.

[0077] Then, initialize the key parameter of the particle swarm optimization algorithm variant: the particle's position X. q The velocity V of the particle q The search space range, the fitness function FitnessValue, and the velocity and position update formulas are defined. Specific parameter settings are as follows:

[0078] (1) The position X of the q-th particle q for:

[0079] X q =(x(q,S1),x(q,S2),...,x(q,S) n ))

[0080] Constraints:

[0081] (2) The velocity V of the q-th particle q The representation method is as follows:

[0082] V q =(v(q,S1),v(q,S2),...,v(q,S) n ))

[0083] Constraints: v(q,S) p )∈[0,1],p=1,...,n

[0084] Where q represents the q-th particle, p represents the p-th dimension, and S p Let x(q,S) represent the p-th state. i () refers to the particle's position X q The value of the i-th dimension, v(q,S)i (V) refers to the particle's velocity. q The value of the i-th dimension.

[0085] (3) Range of search space. In this invention, the search space range of particles is set to an n-dimensional space, and the range of each dimension is between 0 and 1.

[0086] (4) Fitness Function. The fitness function used in this invention is calculated by multiplying the value of each dimension of the current particle with the evaluation value score of the state corresponding to the same index in the state array `state_ids`. The specific calculation is as follows:

[0087] The m-th state S m The evaluation function calculation method represents a trade-off between profitable states and states that are rarely ambiguous, as follows:

[0088]

[0089] The specific method for calculating the fitness function of the q-th particle is as follows:

[0090]

[0091] Here, fuzzs is the number of inputs generated by the current state, selected_times is the number of times the current state has been selected in history, paths_discovered is the number of new state transitions generated by the current state, and is_covered indicates whether the current state has been fuzzed.

[0092] (5) Velocity update formula and position update formula. The specific update formulas for the velocity and position of the i1th particle in the j1st dimension are as follows:

[0093] Speed ​​update formula

[0094] v k+1 (i1,j1)=ω×v k (i1,j1)+c1×r1×(pbest k (i1,j1)-x k (i1,j1))

[0095] +c2×r2×(gbest k -x k (i1,j1))

[0096] Position update formula:

[0097] x k+1 (i1,j1)=x k (i1,j1)+vk (i1,j1)

[0098] Where ω is the inertia weight, r1 and r2 are random numbers between 0 and 1, and c1 and c2 are learning factors, both of which are generally set to 2. k (i1,j1) represents the local optimal position reached in the j1st dimension of the i1th particle in the past, while gbest k This represents the optimal position found by all particles. The particle swarm is guided towards this optimal position using the known local and global optimal positions, and all particles move synchronously to avoid getting trapped in local optima. To satisfy the most basic range condition of probability, all dimensions of the updated particle positions need to be normalized to ensure that each dimension is within the range of 0 to 1.

[0099] The parameters of the particle swarm optimization (PSO) variant are initialized using the above method. Then, the PSO algorithm is iterated T times (typically empirically taken as 60) to obtain an optimal probability distribution `state_probability` for all states. Finally, the optimal state is selected based on `state_probability` as the target state `S` for the protocol fuzzy test. p p = 1, ..., n, where n is the total number of protocol states, and proceed to step 2.3.

[0100] 2.2.3 Use the optimal state probability distribution from the previous round

[0101] After f rounds of random selection, if no new protocol state is triggered and the time interval between two consecutive calls to the particle swarm optimization algorithm does not exceed a preset time t seconds, then the optimal state is selected as the target state S for the protocol fuzzy test based on the probability distribution state_probability obtained in the previous round. p p = 1, ..., n, where n is the total number of protocol states, and proceed to step 2.3.

[0102] 2.3 Message Sequence Analyzer

[0103] like Figure 1 The message sequence analyzer shown, based on the target state S in step 2.2 p Then, from all the protocols that can make the entity program reach the target state S p From the message sequence, select the message sequence with the longest length and the fewest infix messages (the number of infix messages can be calculated using the AFLNET method), and generate a candidate message sequence set MSet = {M1,...,M...}. h ,...,M H}, h = 1,...,H, where H is the total number of message sequences in the MSet set. The pseudocode for the message sequence analysis algorithm is as follows:

[0104]

[0105]

[0106] 2.4 Selecting a Message Sequence

[0107] like Figure 1 The message sequence selector shown randomly selects a message sequence M from the candidate message sequence set MSet in step 2.3.

[0108] 2.5 Mutation Message Sequence

[0109] like Figure 1 The message sequence mutant shown mutates the message sequence M from step 2.4 using AFLNET's bit-level, byte-level, and message-level mutation strategies to generate a new message sequence M'.

[0110] 2.6 Protocol Testing

[0111] Each message in M' generated in step 2.5 is sent sequentially to the protocol entity under test for testing. If a vulnerability is triggered during the test, M' is saved for vulnerability reproduction after the test is completed.

[0112] 3. Results Feedback Stage

[0113] This phase is used to collect code coverage and state information generated during the runtime of the protocol entity under test, and to determine whether the message sequence M' is interesting. Specifically, it includes the following:

[0114] 3.1 Collect code coverage information and state sequences

[0115] Using AFLNET to collect code coverage information and state sequences of the protocol entity under test:

[0116] If new code coverage or a new state new_state_id is generated, it indicates that M' is interesting, and the new state new_state_id is saved to the state_ids array. Then, M' is added to MSeqSet for further mutation testing.

[0117] Otherwise, if no new code overwrite is generated, nor a new state or a new state transition is generated, then M' is discarded.

[0118] Finally, proceed to step 2.2 to conduct the next round of network protocol fuzz testing.

[0119] In summary, this invention proposes a stateful network protocol vulnerability testing method and system based on state selection optimization. The main approach is to treat state selection as a probabilistic problem, then model the optimal probability distribution of the states as an optimization problem. Next, a variant of the particle swarm optimization algorithm is introduced to dynamically find the optimal state probability distribution. This optimal state probability distribution is then used to assist the fuzzer in selecting states. Furthermore, various algorithm triggering mechanisms are designed to allow the introduced particle swarm optimization algorithm to adaptively choose appropriate times for invocation. In addition, a state evaluation function is constructed by collecting multi-dimensional feedback information generated during the testing process to more accurately assess the potential value of each state. A novel message sequence analysis method is also designed to guide the fuzzer to explore deeper network protocol states and logic code.

[0120] To verify the effectiveness of the method of this invention, an SSOFuzzer prototype was implemented on AFLNET, and experimental verification was conducted on protocol entity programs such as dnsmasq (DNS protocol), tinydtls (DTLS protocol), and Live555 (RTSP protocol). The experimental test lasted for 24 hours, and the control group used three mainstream blurrs: AFLNET, AFLNetLegion, and AFLNWE. In the experiment, two metrics were selected to measure the effectiveness of the method: the number of vulnerabilities discovered and the number of paths covered. The first metric represents the number of vulnerabilities discovered by the protocol blurr within a specified time, indicating the blurr's vulnerability discovery capability. The second metric represents the number of paths in the target program that the test input generated by the blurr can cover within a specified time, reflecting the blurr's ability to explore code. The final experimental results are shown in Tables 1 and 2. The results show that the method of this invention outperforms the other blurrs in both the number of vulnerabilities discovered and the code coverage capability.

[0121] Table 1 Comparison of Experimental Results Regarding the Number of Vulnerabilities Discovered

[0122]

[0123] Table 2 Comparison of Experimental Results for Path Coverage Quantity

[0124]

[0125] Based on the above method, this invention further provides a stateful network protocol vulnerability testing system based on state selection optimization, including a test preparation module, a network protocol fuzzing module, and a result information feedback module, such as... Figure 4 As shown.

[0126] The test preparation module uses afl-clang-fast++ to compile and instrument the protocol entity under test, facilitating the collection of runtime code coverage information. It also utilizes tcpdump and Wireshark to capture and parse data packets, ultimately generating an initial message sequence set.

[0127] The network protocol fuzzing module mainly contains the entire fuzzing loop for testing protocol entities. First, it initializes the state array and state probability distribution parameters using message sequences from the initial message sequence set in the test preparation module. Second, it selects a state as the target state for testing based on state selection strategies such as random selection and incorporating a variant of the particle swarm optimization algorithm. Next, it uses a message sequence analyzer to select all message sequences that satisfy the constraints of having the longest message sequence length and the fewest infix messages as a candidate message sequence set. Finally, it randomly selects a message sequence from the candidate message sequence set, mutates it, and sends the mutated message sequence to the protocol entity under test for testing.

[0128] The results feedback module collects code coverage information and state sequences generated by the protocol entity under test during network protocol testing. Whether a message sequence generates new code coverage information, a new state, or a new state transition is used as a criterion for determining its interestingness, and interesting message sequences are saved for further protocol fuzzing. State sequences, on the other hand, help the protocol fuzzer explore deeper protocol states within the protocol entity and serve as a decision on whether to activate a variant of the particle swarm optimization algorithm.

[0129] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A vulnerability testing method for stateful network protocols based on state selection optimization, characterized in that, Includes the following steps: S1. Preprocessing operations before performing network protocol fuzzing, including compiling instrumentation and building the initial message sequence set MSeqSet; S2. Perform fuzz testing on network protocols; S2.

1. Perform a protocol test once for each message sequence in the initial message sequence set MSeqSet, collect the generated protocol states and store them in the state array state_ids, state_ids={S1,...,S i ,...,S n },S i Let i represent the i-th protocol state, i = 1, ..., n, where n is the total number of protocol states. The initial state array is initialized with the probability distribution state_probability = {p1, ..., p...}. j ,...,p n }, p j This represents the probability that the j-th protocol state is selected. S2.

2. Based on the state array state_ids, set the number of random selections f, and select a state from state_ids for fuzz testing as the target state S through random selection. p ; S2.3, Based on the target state S p Then from all the protocol entity procedures that make the protocol reach the target state S p From the message sequences, select the message sequence with the longest length and the fewest infix messages to generate a candidate message sequence set MSet = {M1,...,M...} h ,...,M H }, h=1,...,H, where H is the total number of message sequences in the MSet set; S2.

4. Randomly select a message sequence M from MSet; S2.

5. Based on the message sequence M, mutate it using the bit-level, byte-level, and message-level mutation strategies of the protocol fuzzing tool AFLNET to generate a new message sequence M'. S2.

6. Send each message in M' to the protocol entity under test in sequence for testing; if a vulnerability is triggered during the test, save M' and use it for vulnerability reproduction after the test is completed. S3. Collect code coverage information and state information generated during the runtime of the protocol entity under test, determine whether the message sequence M' is an interesting message sequence, and then perform the next round of network protocol fuzz testing.

2. The stateful network protocol vulnerability testing method based on state selection optimization according to claim 1, characterized in that, In S1, the specific process of compilation instrumentation is as follows: The compiler instrumentation tool afl-clang-fast++ is used to compile and instrument the entity program of the protocol under test to generate the target code of the protocol under test. The specific process for constructing the initial message sequence set is as follows: First, start the target code of the protocol under test and its corresponding communication terminal, and start communication. Secondly, use the packet sniffing tool tcpdump to listen to all traffic on the port corresponding to the protocol entity, collect and save this traffic; Finally, the captured traffic was parsed using the packet analysis tool Wireshark, and all request message sequences were extracted as the initial message sequence set MSeqSet = {M1, ..., M...} g ,...,M d }, M g This refers to the g-th message sequence in MSeqSet, where g = 1, ..., d, and d is the total number of message sequences; a message sequence is a linked list of messages, i.e., M... g =m g,1 ->...->m g,k ->...->m g,a m g,k Let a represent the k-th message in the g-th message sequence, where k = 1, ..., a, and a is M. g Total number of messages.

3. The stateful network protocol vulnerability testing method based on state selection optimization according to claim 2, characterized in that, Step S2.2 specifically includes the following situations: (1) Before completing f random selections, randomly select one state from all states in the state_ids array in step 2.1 as the target state S for the protocol fuzz test. p p = 1, ..., n; (2) After f random selections, if no variant of the particle swarm optimization algorithm has been used before, or a new protocol state was discovered during the previous test, or the time since the last call to the variant of the particle swarm optimization algorithm exceeds a preset time t seconds, the variant of the particle swarm optimization algorithm is used to solve for the optimal probability distribution of all states, and the optimal state is selected as the target state S for protocol fuzzing based on this optimal probability distribution. p ; (3) After f random selections, if no new protocol state is triggered and the time interval between two consecutive calls to the particle swarm optimization algorithm does not exceed the preset time t seconds, then the optimal state is selected as the target state S for the protocol fuzzy test based on the probability distribution state_probability obtained in the previous round. p .

4. The stateful network protocol vulnerability testing method based on state selection optimization according to claim 2, characterized in that, The number of infix messages mentioned in step S2.3 is calculated by the protocol fuzzing tool AFLNET.

5. The stateful network protocol vulnerability testing method based on state selection optimization according to claim 4, characterized in that, The specific process of determining whether message sequence M' is an interesting message sequence in step S3 is as follows: AFLNET is used to collect code coverage information and state sequences of the protocol entity under test. If new code coverage or a new state new_state_id is generated, then M' is interesting and the new state new_state_id is saved to the state_ids array. Then M' is added to MSeqSet for mutation testing. Otherwise, if no new code overwrite is generated, nor a new state or a new state transition is generated, then M' is discarded.

6. A stateful network protocol vulnerability testing system based on state selection optimization, used to implement the testing method described in any one of claims 1 to 5, characterized in that, It includes a test preparation module, a network protocol fuzz testing module, and a result information feedback module; The test preparation module uses the compilation and instrumentation tool afl-clang-fast++ to compile and instrument the protocol entity under test, and uses the tools tcpdump and Wireshark to capture and parse data packets to generate an initial message sequence set. The network protocol fuzz testing module performs a fuzz testing loop to perform protocol testing on the protocol entity under test. The result information feedback module collects the code coverage information and state sequence generated by the protocol entity under test during the network protocol test, and determines whether the message sequence is interesting and saves the interesting message sequence.

Images