Protocol vulnerability mining test method and system based on fine-grained state guidance

Abstract

The application discloses a protocol vulnerability mining test method and system based on fine-grained state guidance. The application represents the state conversion of a protocol entity program in a fine-grained manner, and equivalent branch coverage snapshots of a to-be-tested protocol entity program to states of the protocol entity program. If a new branch coverage is triggered, it is considered that a new state of the protocol entity program is triggered. When the new state is triggered, a prefix message chain list corresponding to the new state is generated to save message sequence information reaching the state. After a state of the current stage test is selected by a fine-grained state selector, the protocol entity program is guided to the corresponding state while generating the message sequence through the corresponding prefix message chain row array, and sufficient fuzzy test work is carried out on the state to explore deeper branch paths. The fine-grained state is dynamically adjusted and updated in the fuzzy test process. The application improves the branch coverage rate of the protocol entity program and mines more protocol vulnerabilities.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of protocol automatic security detection, and particularly relates to a protocol vulnerability mining test method and system based on fine-grained state guidance. BACKGROUND

[0002] Protocol fuzzing is an automatic protocol vulnerability mining test technology, which inputs a large amount of random, illegal or unexpected data to a protocol entity program to be tested, so as to discover potential vulnerabilities or abnormalities. In order to make the test cases generated in the network protocol fuzzing process more in line with the requirements of the protocol specification, improve the acceptance rate of the test cases, and at the same time improve the coverage of the protocol entity program code, in recent years, related research work has proposed a fuzzing test method based on syntax generation and coverage information guidance, which solves the problem of a large number of message mutation operations destroying the structure and format of the message in the protocol test process, and the problem of lack of coverage information feedback guidance for the black-box protocol fuzzer based on syntax generation.

[0003] The protocol vulnerability mining test related work based on syntax generation and coverage information guidance includes Peach, PAVFuzz, Z-Fuzzer and EPF. Z-Fuzzer introduces coverage information feedback on the black-box protocol fuzzer BooFuzz based on syntax generation to guide subsequent message mutation. EPF uses group-based simulated annealing to heuristically schedule the test cases in the seed library during fuzzing, recombines and mutates the test cases in the seed library to generate new test cases. PAVFuzz calculates the mutation weight of each variable field by learning the relationship between two fields of different data models, and guides the fuzzing to maximize the coverage. Peach introduces a coverage feedback mechanism based on Peach, and uses the test cases that trigger new path coverage to construct higher-quality test cases.

[0004] The existing protocol fuzzing test method based on syntax generation and coverage information guidance uses the protocol specification to define the session model in advance to represent the condition of the state transition of the protocol entity program. However, since the protocol entity program is a complex system, the session model cannot accurately represent the internal state transition details of the protocol entity program, and the granularity is too coarse, which weakens the state exploration ability of the fuzzer to the protocol entity program, and further limits the code coverage ability and vulnerability mining ability of the fuzzer to the protocol entity program. SUMMARY

[0005] This invention proposes a protocol vulnerability mining and testing method based on fine-grained state guidance. It represents the state transitions of a protocol entity program in a fine-grained manner. When a new state is triggered, a corresponding prefix message chain list is generated to store the message sequence information arriving at this state. While generating the message sequence through the prefix message chain list, the protocol entity program can be guided to the corresponding fine-grained state. Furthermore, thorough fuzzing is performed on each fine-grained state to explore deeper branch paths.

[0006] This method is divided into a preprocessing stage, a fuzzing stage, and a result feedback stage. In the preprocessing stage, the protocol entity program under test is instrumented and compiled to obtain the corresponding binary executable program; a session model of the protocol under test is defined as the input for the fuzzing stage; and an execution engine is built based on the binary executable program. The fuzzing stage includes fine-grained state selection, prefix message sequence generation, seed selection, test case generation, and test case evaluation.

[0007] During the fuzzing phase, a prefix message chain list is used to store the sequence information of test cases that trigger new states. The prefix message chain list is used to generate an exception message sequence while accurately locating the state, and then sufficient fuzzing is performed on each state.

[0008] After selecting the state for the current stage test through a fine-grained state selection process, a corresponding prefix message sequence is generated. The protocol entity program is then located to that state using the prefix message sequence. Test cases are then generated using the seed template selected by the seed selection process to perform thorough fuzz testing on that state.

[0009] During the results feedback phase, the number of times the tested protocol entity program crashes and the coverage information are fed back in real time during the fuzzing process; and the test cases that trigger the crashes of the tested protocol entity program are saved to facilitate the reproduction and analysis of the crashes later.

[0010] This invention proposes a protocol vulnerability mining and testing method based on fine-grained state guidance, which includes three main stages: preprocessing stage, fuzzing stage, and result information feedback stage; wherein the fuzzing stage includes fine-grained state selection, prefix message sequence generation, seed selection, test case generation, and test case evaluation process.

[0011] Before describing this invention in detail, let's define the terms involved in this invention:

[0012] Fine-grained state: Unlike the traditional program state, the invention equates the branch coverage of the protocol entity program to be tested to the fine-grained state of the protocol entity program, and if a new branch coverage is triggered in the fuzz testing process, it is considered that a new fine-grained state of the protocol entity program is triggered. The state referred to in the invention is a fine-grained state.

[0013] 1. Preprocessing phase:

[0014] 1-1. Instrumented compilation of protocol entity program source code

[0015] In the fuzz testing process, in order to obtain the branch coverage of the protocol entity program to be tested, the aflfast self-provided gcc compilation tool is used to instrument and compile the protocol entity program source code, and a binary executable program is generated.

[0016] 1-2. Define data model set

[0017] By analyzing the request data packet corresponding to the protocol to be tested and combining the protocol specification to be tested, the data model definition function provided by the BooFuzz fuzz testing framework is used to define the data model set model set ={model1,...,model i ,...,model n}, i = 1,...,n, where n is the total number of data models of the protocol to be tested, and the defined data model is used as a protocol specification template for generating corresponding test cases.

[0018] 1-3. Define session model

[0019] According to the requirements of the session message sequence in the specification of the protocol to be tested, the session model definition function provided by the BooFuzz test framework is used to connect the data models in model set to form a session model sessionModels = {sessionSeq1,...,sessionSeq j ,...,sessionSeq m}, j = 1,...,m, where sessionSeq j represents a session sequence in the session model sessionModels, and the session sequence is composed of several data models in the data model set model set with a certain order relationship, and m is the number of session sequences in the session model.

[0020] 1-4. Build execution engine

[0021] Run the executable program generated in step 1-1, and allocate a shared memory shareMem of size XM bytes (XM is an empirical value, usually set to 64K bytes) to collect real-time statistics on the coverage information of the protocol entity program under test.

[0022] 2. Fuzz testing phase:

[0023] 2-1. System Warm-up. Based on the session sequence in the defined session model, generate unmutated raw message sequences sequentially and input them into the execution engine to complete the system warm-up.

[0024] 2-1-1. Iterate through the sessionModels and extract the session sequence sessionSeq in sequence. j If the session model has been traversed to the end, the system warm-up work is complete, and proceed to step 2-2.

[0025] 2-1-2. Based on the session sequence (sessionSeq) j The sequential relationship of the data model, traversing the session sequence sessionSeq j Get the data model i Proceed to step 2-1-3; if targeting the session sequence sessionSeq j The traversal work is complete. Reset the protocol entity program to the initial state and proceed to step 2-1-1.

[0026] 2-1-3. Based on the data model i Unmutated test cases are generated and input into the execution engine, serving as the data model. i Seed Bank i The initial seed in i 0 (represents seedbank) i Seed 0 in the current data model. i Not a session sequence (sessionSeq) j If the last data model is selected, then the current data model is created. i In the same session sequence sessionSeq j Next data model i+1 The initial prefix message chain list preChainsList i+1 =

[0027] {[seedNo1 0 ,…,seedNo i 0]}, where seedNo1 0 Represents the current session sequence (sessionSeq) j The initial seed seed1 of the first data model 0 The label, seedNo i 0 Represents the current session sequence (sessionSeq) j Chinese data model i initial seed i 0 The label is used. Proceed to step 2-1-2 to initialize the seed library for the next data model.

[0028] 2-2. Data Model Selection

[0029] 2-2-1. Traverse the session models (sessionModels) and extract the session sequences (sessionSeq) sequentially. j If the session model has been traversed to its end, then the fuzzing process ends.

[0030] 2-2-2. Based on the session sequence (sessionSeq) j The sequential relationship of the data model, traversing the session sequence sessionSeq j Get the data model i As the data model used in the current fuzzing phase, proceed to steps 2-3; if targeting the session sequence sessionSeq j If the traversal is complete, proceed to step 2-2-1.

[0031] 2-3. Selection of fine-grained state

[0032] If the data model i For the session sequence (sessionSeq) j The first data model in the process, then that data model is model i If there is no prefixed message chain list, proceed directly to step 2-5. The currently selected fine-grained state is the initial state. Perform fuzz testing on the data model in the initial state. Otherwise, proceed to step 2-3-1.

[0033] 2-3-1. Traversing the data model i The corresponding prefix message chain list preChainsList i =

[0034] {[seedNo1 0 ,…,seedNo i-1 0 ] 1,…,[seedNo1 ki ,…,seedNo i-1 ki ] a ,…,[seedNo1 ki ,…,seedNo i-1 ki ] b}(a = 1, ..., b, where b is the prefix message chain list preChainsList) i The number of rows; where ki represents the seed index in the corresponding seed), to obtain preChainsList. i The prefix message chain line array [seedNo1] ki ,…,seedNo i-1 ki ] a If the prefix message chain list preChainsList i If the iteration has ended, it means that the current data model has been fully traversed. i All corresponding states have undergone sufficient fuzz testing. Proceed to step 2-2-2 and select the session sequence sessionSeq. j The next data model in i+1 .

[0035] 2-3-2. Prefix message chain row array [seedNo1 ki ,…,seedNo i-1 ki ] a As a marker of the fine-grained state of the current test, let it be set as state. a =[seedNo1 ki ,…,seedNo i-1 ki ] a (where seedNo i-1 ki Representative data model i-1 Seed Bank i-1 medium seed i-1 ki (A unique identifier), continue execution downwards, generating fine-grained states. a The corresponding prefix message sequence.

[0036] 2-4. Prefix Message Sequence Generation

[0037] Initialize the prefix message sequence as preMessSeque a = [], based on the fine-grained state selected in steps 2-3a = [seedNo1 ki ,..., seedNo i-1 ] ki a , traversing the prefix message chain array corresponding to the state state a = [seedNo1 ki ,..., seedNo i-1 ki ] a , retrieving the seed seed1 ki from the seed bank seedBank1 ki of the data model model1 ki according to the seed number seedNo1 a , and adding the retrieved seed seed1 i-1 from the seed bank to the prefix message sequence preMessSeque ki ; finally, the seed number seedNo i-1 ki is reached, and the seed seed i-1 i-1 is retrieved from the seed bank seedBank i-1 ki of the data model model a according to the seed number seedNo a , and added to the prefix message sequence. After the traversal of the prefix message chain array corresponding to the state state a , the prefix message sequence preMessSeque ki = [seed1 i-1 ,..., seed ki ]

[0038] 2-5. Seed selection

[0039] 2-5-1. Traversing the seed bank seedBank i = {seed i i ,..., seed 0 i ,..., seed k i ,..., seed t} of the current data model model i , k = 1,..., t, where t is the number of seeds in the seed bank seedBank i , and selecting a seed seed kIf all seeds in the seed library have been traversed, then for the currently selected fine-grained state... a The fuzzing process is complete. The fine-grained state is now closed. a During fuzz testing, if the current data model... i For the session sequence sessionSeq j If the first data model is selected, proceed to step 2-2-2 to select a new data model; otherwise, proceed to step 2-3-1 to select a new data model. i Other corresponding fine-grained states.

[0040] 2-5-2. For seeds i k Initialize the seed's energy value (seedEnergy). i k =SC, where SC is set to 1, and is used to initialize the threshold of the seed. i k =0.0001.

[0041] 2-6. Test Case Generation

[0042] Without damaging the selected template seed i k New test cases are generated based on beneficial mutations, using a mutation strategy that maintains the seed. i k The beneficial mutation that triggers the new branch is then used to mutate other variable fields sequentially, aiming to ensure that the generated new test cases, while still triggering the original branch, explore the updated branch. The specific steps are as follows:

[0043] 2-6-1. Get the current seed i k Corresponding data model i All variable fields in the seed i k The values ​​in the field are: fields = {field1, ..., field2} p ,…,field q}, p = 1,...,q, where q is the data model. i The total number of mutable fields. And initialize the index of the field to which the mutation occurs. b =0.

[0044] 2-6-2. Iterate through all the values ​​of the variable fields in the seed, assuming the currently iterated field value is field. pIf, during the traversal of fields, the last field of the seed has been reached, then the index flag is reset. b If the value is 0, restart the traversal, and make the next round of mutation start from the first unmutated field.

[0045] 2-6-3. If the value of the field being iterated is field p It is a seed i k The value in the field has not undergone mutation, and the field is at the flag index. b The subsequent fields then utilize the EPF's mutation engine to modify that field. p Perform mutation to obtain the current field. p The result of mutation_field p And set the index as the marker. b Set it to p; otherwise, go to step 2-6-2 and continue traversing fields.

[0046] 2-6-4. Using the current field p The result of mutation_field p Replace seed i k The corresponding field values ​​yield the newly generated test case (testcase).

[0047] 2-6-5. Connect the newly generated test cases to the current state obtained in step 2-4. a The corresponding prefix message sequence preMessSeque a =[seed1 ki ,…,seed i-1 ki After that, the complete message sequence `messSeque = [seed1]` is obtained. ki ,…,seed i-1 ki [testcase]. And inject the message sequence `messSeque` into the execution engine.

[0048] 2-7. Test Case Evaluation

[0049] Based on the branch coverage feedback information `newBranch` from the execution engine, decide whether to add the new test cases generated in this round of fuzzing as seeds to the seed bank of the current data model. i In, and for the current seed i kthe energy value of the current test case is dynamically adjusted; according to the branch coverage feedback information newBranch of the execution engine, it is determined whether to update the next data model model j of the current test case i+1 . i+1 .

[0050] 2-7-1. Evaluate whether a new branch is triggered

[0051] Traverse the global shared memory shareMem to determine whether the current executed test case test case triggers a new branch. If a new non-zero byte appears in the global shared memory shareMem, it represents that a new branch is triggered. If a new branch is triggered, set the evaluation result result=true, and take the current test case as the new seed seed i x . i x Add the new seed seed i to the seed bank seedBank of the current data model model i selected in step 2-2-2.

[0052] 2-7-2. Update the prefix message chain list of the next data model

[0053] If the evaluation result result is true, it indicates that a new fine-grained state of the protocol entity program is triggered, and the message sequence seed number corresponding to the state is saved to the prefix message chain list preChainsList of the next data model model i+1 . i+1

[0054] Let the prefix message chain row array to be added to the prefix message chain list preChainsList i+1 be preMessLineArr=[]. Traverse the message sequence messSeque=[seed1 ki ,…,seed i-1 ki ,seed i x ] input to the execution engine in step 2-6-5, and sequentially add the seed number in the seed bank of the corresponding data model to the prefix message chain row array preMessLineArr, and after the traversal is completed, preMessLineArr=[seedNo1 ki ,…,seedNo i-1 ki ,seedNo i ​x The prefix message chain line array preMessLineArr represents a new fine-grained state, and finally the preMessLineArr is added to the prefix message chain list preChainsList i+1 .

[0055] 2-7-3. Update the seed energy value

[0056] If the evaluation result result is true, set the energy value seedEnergy i k to the initial value SC; otherwise, update the energy value seedEnergy i k of the seed seed i k to seedEnergy i k ×ɑ (ɑ is a decay factor, which is less than 1 and greater than 0, the smaller the value, the greater the seed energy value decay amplitude, in order to balance, the default value of this method is 0.92);

[0057] If the energy value seedEnergy i k of the template seed seed i k <threshold i k , it means that the performance of the seed seed i k is not good, go to step 2-5-1, select a new seed from the seed bank seedBank i as the template seed of the present stage; if the seed energy value seedEnergy i k >=threshold i k , go to step 2-6-2, continue to generate new test cases using the seed.

[0058] 3. Result information feedback stage:

[0059] The branch coverage information calculated according to the shared memory in step 2-7 is fed back in real time in the page; the number of times of triggering the protocol entity program crash in the fuzzy test process is fed back in real time; and the test cases triggering the protocol entity program crash are saved for the reproduction and analysis of the crash in the later stage.

[0060] Another object of the present application is to provide a protocol vulnerability mining test system FSGFuzz (Fine-grained State Guidance Fuzzer) based on fine-grained state guidance, as shown in Figure 1 , comprising:

[0061] a preprocessing module. The main function of the preprocessing module is to use the gcc compilation tool provided by aflfast to compile the program of the protocol entity to be tested, and obtain the corresponding binary executable program; use the data model definition function provided by the BooFuzz fuzzing framework to define a set of data models model set of the protocol, combine the requirements of the session message sequence of the protocol specification, connect the data models in the defined data model set model set sessionModels as the input of the fuzzing stage; finally, build an execution engine.

[0062] a fuzzing module. The fuzzing module first warms up the execution engine. In the warming-up process, an initial seed bank and an initial prefix message chain list corresponding to each data model are created. After the warming-up is completed, a session sequence is selected from the session model sessionModels defined by the preprocessing module, and then a data model model i in the session sequence is selected to obtain the data model for the current test, and finally the fine-grained state selector, the prefix message sequence generator, the seed selector, the test case generator and the test case evaluator are executed.

[0063] a fine-grained state selector. The main function is to select the state state i to be concentrated in the current stage of fuzzing according to the data model model i selected in the current fuzzing stage under the guidance of the prefix message chain list preChainsList a corresponding to the data model.

[0064] a prefix message sequence generator. After the fine-grained state selector selects the state to be fully tested in the current stage, a message sequence corresponding to the state is generated to guide the protocol entity program to the state.

[0065] a seed selector. It is responsible for selecting the seed seed used in the current stage from the seed bank seedBank i of the current data model model i , and initializing the energy value seedEnergy and the threshold threshold of the selected seed.

[0066] Test case generator. Responsible for mutating the seed selected by the seed selector, generating new test cases using the seed. The mutation strategy used by the test case generator is to keep the beneficial mutation of the seed triggering new branches, and then mutate other variable fields one by one, so that the generated new test cases can still trigger the original branches and explore new branches.

[0067] Test case evaluator. According to the branch coverage feedback information of the execution engine, it is decided whether to add the new test case generated in this round of fuzz testing as a seed to the seed bank seedBank of the current data model i , and update the energy value of the current seed selected by the seed selector; according to the branch coverage feedback information of the execution engine, it is decided whether to update the prefix message chain list of the next data model.

[0068] Result information feedback module. According to the branch coverage information counted by the shared memory, real-time feedback is carried out in the page; the number of times of triggering the protocol entity program crash in the fuzz testing process is fed back in real time; and the test case triggering the protocol entity program crash is saved for the reproduction and analysis of the crash in the later stage.

[0069] The beneficial effects of the present application are:

[0070] 1. The present application adopts a protocol vulnerability mining test method based on fine-grained state guidance, which represents the state transition of the protocol entity program in a fine-grained manner. When a new fine-grained state is triggered, a prefix message chain list corresponding to the new state is generated to save the abnormal or normal message sequence corresponding to the state. By generating an abnormal message sequence through the prefix message chain list, the protocol entity program can be guided to the corresponding state, and sufficient fuzz testing work can be carried out on each state to explore deeper branch paths.

[0071] 2. Compared with the existing protocol fuzz testing tool based on syntax generation and coverage information guidance, the protocol vulnerability mining test method based on fine-grained state guidance proposed by the present application can effectively solve the problem that the existing protocol fuzz testing method based on syntax generation and coverage information guidance cannot accurately represent the detailed state transition of the protocol entity program, and improve the exploration ability and vulnerability mining ability of the target program in the fuzz testing process. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 , the flowchart of the protocol vulnerability mining test method based on fine-grained state guidance;

[0073] Figure 2 , the schematic diagram of the defined session model taking the RTSP protocol as an example;

[0074] Figure 3, prefix message chain list and state correspondence relationship schematic diagram;

[0075] Figure 4 , fine-grained state update flow schematic diagram.

[0076] Figure 5 , branch coverage number change trend chart on target protocol entity program. DETAILED DESCRIPTION

[0077] The technical solutions in the present application will be described in detail below with reference to the drawings in the embodiments of the present application.

[0078] As shown in Figure 1 , the protocol fuzz testing method based on syntax generation and fine-grained coverage information guidance has three main stages: a preprocessing stage, a fuzz testing stage, and a result information feedback stage; the fuzz testing stage includes fine-grained state selection, prefix message sequence generation, seed selection, test case generation, and test case evaluation process.

[0079] 1. The preprocessing stage includes the following steps:

[0080] 1-1. Instrumented compilation of protocol entity program source code

[0081] In the fuzz testing process, in order to obtain the branch coverage of the protocol entity program to be tested, the aflfast self-provided gcc compilation tool is used to instrument and compile the protocol entity program source code to generate a binary executable program.

[0082] 1-2. Define data model set

[0083] By analyzing the request data packet corresponding to the protocol to be tested and combining the protocol specification to be tested, the data model definition function provided by the BooFuzz fuzz testing framework is used to define the data model set model set ={model1,...,model i ,...,model n}, i = 1,...,n, where n is the total number of data models of the protocol to be tested, and the defined data model is used as a protocol specification template for generating corresponding test cases.

[0084] 1-3. Define session model

[0085] According to the requirements of the session message sequence in the protocol specification to be tested, the session model definition function provided by the BooFuzz fuzz testing framework is used to connect the data models in model set to form a session model sessionModels = {sessionSeq1,...,sessionSeq j,…,sessionSeq m}, j = 1,...,m, where sessionSeq j This represents a session sequence within the sessionModels collection of data models. set The data model consists of several data models arranged in a certain sequential order, where m is the number of session sequences in the session model.

[0086] Taking the RTSP protocol as an example, the defined session model structure diagram is as follows: Figure 2 As shown, the session model has a total of 5 session sequences, and each element in the session sequence is an independent data model.

[0087] 1-4. Building the Execution Engine

[0088] Run the executable program generated in step 1-1, and allocate a shared memory space of size XM bytes (shareMem is an empirical value, usually set to 64K bytes) to collect real-time statistics on the coverage information of the protocol entity program under test.

[0089] 2. The fuzz testing phase mainly includes the following steps:

[0090] 2-1. System Warm-up. Based on the session sequence in the defined session model, generate unmutated raw message sequences sequentially and input them into the execution engine to complete the system warm-up.

[0091] 2-1-1. Iterate through the sessionModels and extract the session sequence sessionSeq in sequence. j If the session model has been traversed to the end, the system warm-up work is complete, and proceed to step 2-2.

[0092] 2-1-2. Based on the session sequence (sessionSeq) j The sequential relationship of the data model, traversing the session sequence sessionSeq j Get the data model i If it's for the session sequence (sessionSeq) j The traversal work is complete. Reset the protocol entity program to the initial state and proceed to step 2-1-1.

[0093] 2-1-3. Based on the data model i Unmutated test cases are generated and input into the execution engine, serving as the data model. i Seed Bank i The initial seed in i0 (represents seedbank) i Seed 0 in the current data model. i Not a session sequence (sessionSeq) j If the last data model is selected, then the current data model is created. i In the same session sequence sessionSeq j Next data model i+1 The initial prefix message chain list preChainsList i+1 =

[0094] {[seedNo1 0 ,…,seedNo i 0 ]}, where seedNo1 0 Represents the current session sequence (sessionSeq) j The initial seed seed1 of the first data model 0 The label, seedNo i 0 Represents the current session sequence (sessionSeq) j Chinese data model i initial seed i 0 The label is used. Proceed to step 2-1-2 to initialize the seed library for the next data model.

[0095] 2-2. Data Model Selection

[0096] 2-2-1. Traverse the session models (sessionModels) and extract the session sequences (sessionSeq) sequentially. j If the session model has been traversed to its end, then the fuzzing process ends.

[0097] 2-2-2. Based on the session sequence (sessionSeq) j The sequential relationship of the data model, traversing the session sequence sessionSeq j Get the data model i This serves as the data model used in the current fuzzing phase; if it's for the session sequence sessionSeq j If the traversal is complete, proceed to step 2-2-1.

[0098] 2-3. Selection of fine-grained state

[0099] If the data model i For the session sequence sessionSeqj The first data model in the process, then that data model is model i If there is no prefixed message chain list, proceed directly to step 2-5. The currently selected fine-grained state is the initial state. Perform fuzz testing on the data model in the initial state. Otherwise, proceed to step 2-3-1.

[0100] 2-3-1. Traversing the data model i The corresponding prefix message chain list preChainsList i =

[0101] {[seedNo1 0 ,…,seedNo i-1 0 ] 1 ,…,[seedNo1 ki ,…,seedNo i-1 ki ] a ,…,[seedNo1 ki ,…,seedNo i-1 ki ] b}(a = 1, ..., b, where b is the prefix message chain list preChainsList) i The number of rows; where ki represents the seed index in the corresponding seed), to obtain preChainsList. i The prefix message chain line array [seedNo1] ki ,…,seedNo i-1 ki ] a Proceed to step 2-3-2. If the prefix message chain list is preChainsList i If the iteration has ended, it means that the current data model has been fully explored. i All corresponding states have undergone sufficient fuzz testing. Proceed to step 2-2-2 and select the session sequence sessionSeq. j The next data model in i+1 .

[0102] 2-3-2. Prefix message chain row array [seedNo1 ki ,…,seedNo i-1 ki ] a As a marker of the fine-grained state of the current test, let it be set as state. a =[seedNo1 ki ,…,seedNo i-1ki ] a (Where seedNo i-1 ki Represent the data model model i-1 The seed bank seedBank i-1 Seed seed i-1 ki The unique label), continue to execute down, generate fine-grained state state a The corresponding prefix message sequence.

[0103] The algorithm flow pseudo code of fine-grained state selection is as follows:

[0104]

[0105] Take a session sequence Setup->Play->Pause->Teardown of RTSP protocol as an example, its prefix message chain list and the corresponding relationship of state are shown in Figure 3 . When the data model Setup is mutated, assume that two test cases trigger new branches and new states, store the two test cases as seeds 1 and 2 in the seed bank of data model Setup, wherein the seed with label 0 is the initial seed without mutation. Similarly, when the data model Play is mutated, assume that four test cases trigger new states on the basis of the original state, store their labels 1, 2, 3 and 4 in the seed bank of data model Play, and dynamically update the prefix message chain list of the next data model Pause in the process, which is introduced in detail in step 2-7-2. When the data model Pause is mutated, through the row array [0,1] in the prefix message chain list, the seed bank of data model Setup and the seed bank of data model Play are indexed to obtain the seed with label 0 in the seed bank of Setup and the seed with label 1 in the seed bank of Play, and input the message sequence composed of them into the protocol entity program, which can be placed in state k in the figure; similarly, using row arrays [0,0] and [2,4] can place the protocol entity program in states Y and x in the figure.

[0106] 2-4. Prefix message sequence generation

[0107] Initialize the prefix message sequence as preMessSeque a = [], according to the fine-grained state state a = [seedNo1 ki ,…,seedNo i-1 ki ] a, traverse the state state a The prefix message chain row array corresponding to the state state ki ,…,seedNo i-1 ki ] a According to the seed number seedNo1 ki , retrieve the seed bank seedBank1 of the data model model1, and take out the seed seed1 ki from it ki , and add the seed seed1 a retrieved from the seed bank to the prefix message sequence preMessSeque i-1 ; the final seed number traversed is seedNo ki i-1 Similarly, according to the seed number seedNo ki i-1 , retrieve the seed bank seedBank i-1 of the data model model i-1 , and take out the seed seed ki from it a , and add it to the prefix message sequence. After the prefix message chain row array corresponding to the state state a is traversed, the prefix message sequence preMessSeque a corresponding to the state state ki =[seed1 i-1 ,…,seed ki ] is obtained.

[0108] The algorithm flow pseudo code of the prefix message sequence generation is as follows:

[0109]

[0110]

[0111] 2-5. Seed selection

[0112] 2-5-1. Traverse the seed bank seedBank i of the current data model model i ={seed i 0 ,…,seed i k ,…,seed i t}, k = 1,...,t, where t is the number of seeds in the seed bank seedBank i , and select a seed seed i from it in turnk If all seeds in the seed library have been traversed, then for the currently selected fine-grained state... a The fuzzing process is complete. The fine-grained state is now closed. a During fuzz testing, if the current data model... i For the session sequence sessionSeq j If the first data model is selected, proceed to step 2-2-2 to select a new data model; otherwise, proceed to step 2-3-1 to select a new data model. i Other corresponding fine-grained states.

[0113] 2-5-2. For seeds i k Initialize the seed's energy value (seedEnergy). i k =SC, where SC is set to 1, and is used to initialize the threshold of the seed. i k =0.0001.

[0114] 2-6. Test Case Generation

[0115] Without damaging the selected template seed i k New test cases are generated based on beneficial mutations, using a mutation strategy that maintains the seed. i k The beneficial mutation that triggers the new branch is then used to mutate other variable fields in sequence, aiming to ensure that the generated new test cases explore the updated branch while still triggering the original branch. The specific steps are as follows:

[0116] 2-6-1. Get the current seed i k Corresponding data model i All variable fields in the seed i k The values ​​in the field are: fields = {field1, ..., field2} p ,…,field q}, p = 1,...,q, where q is the data model. i The total number of mutable fields. And initialize the index of the field to which the mutation occurs. b =0.

[0117] 2-6-2. Iterate through all the values ​​of the variable fields in the seed, assuming the currently iterated field value is field.p If, during the traversal of fields, the last field of the seed has been reached, then the index flag is reset. b If the value is 0, restart the traversal, and make the next round of mutation start from the first unmutated field.

[0118] 2-6-3. If the value of the field being iterated is field p It is a seed i k The value in the field has not undergone mutation, and the field is at the flag index. b The subsequent fields then utilize the EPF's mutation engine to modify that field. p Perform mutation to obtain the current field. p The result of mutation_field p And set the index as the marker. b Set it to p; otherwise, go to step 2-6-2 and continue traversing fields.

[0119] 2-6-4. Using the current field p The result of mutation_field p Replace seed i k The corresponding field values ​​yield the newly generated test case (testcase).

[0120] 2-6-5. Connect the newly generated test cases to the current state obtained in step 2-4. a The corresponding prefix message sequence preMessSeque a =[seed1 ki ,…,seed i-1 ki After that, the complete message sequence `messSeque = [seed1]` is obtained. ki ,…,seed i-1 ki [testcase]. The message sequence `messSeque` is then injected into the execution engine.

[0121] The pseudocode for the algorithm flow of test case generation is as follows:

[0122]

[0123] 2-7. Test Case Evaluation

[0124] Based on the branch coverage feedback information `newBranch` from the execution engine, decide whether to add the new test cases generated in this round of fuzzing as seeds to the seed bank of the current data model. i In, and for the current seed i k The energy value is dynamically adjusted; based on the branch coverage feedback information newBranch from the execution engine, it is determined whether to adjust the session sequence sessionSeq. j The next data model i+1 preChainsList i+1 Update.

[0125] 2-7-1. Evaluate whether a new branch has been triggered.

[0126] Iterate through the global shared memory `shareMem` and check if the currently executed test case has triggered a new branch. If a new non-zero byte appears in `shareMem`, it means a new branch has been triggered. If a new branch has been triggered, set the evaluation result `result` to `true` and use the current test case as the new seed. i x , plant new seed i x Add to the current data model selected in step 2-2-2 i Seed Bank i middle.

[0127] 2-7-2. Fine-grained state update

[0128] If the evaluation result is true, it indicates that a new fine-grained state of the protocol entity program has been triggered. The seed number of the message sequence corresponding to this state is then saved to the next data model. i+1 preChainsList i+1 middle.

[0129] Suppose that the message chains to be added are preChainsList i+1 The prefix message chain array in the code is preMessLineArr = []. It iterates through the message sequence messageSeque = [seed1] input to the execution engine in step 2-6-5. ki ,…,seed i-1 ki ,seed i x], sequentially add the index of the seed in the corresponding data model seed library to the prefix message chain line array preMessLineArr, and after traversal, get preMessLineArr = [seedNo1 ki ,…,seedNo i-1 ki ,seedNo i x The prefix message chain array `preMessLineArr` represents the new fine-grained state, and finally, `preMessLineArr` is added to the prefix message chain list `preChainsList`. i+1 middle.

[0130] The pseudocode for the fine-grained state update algorithm is as follows:

[0131]

[0132] Taking the RTSP protocol as an example, the execution flow for updating the prefix message chain list of the next data model is as follows: Figure 4 As shown in the diagram, assuming the system is currently performing mutation work on the data model Pause, when fuzzing the state k corresponding to the row array [0, i] in the prefix message chain list of the data model Pause, a new test case generated from the data model Pause triggers a new branch of the protocol entity program, which is defined as state x. First, as shown in Step 1 of the diagram, the test case number is set to j and added to the seed library of the data model Pause; then, based on the message sequence input to the execution engine, the number of each message in its data model seed library is obtained, which are 0, i, and j respectively, and the prefix message chain row array [0, i, j] is formed according to its number (steps 2 and 3 in the diagram). Finally, the prefix message chain row array [0, i, j] is added to the prefix message chain list of the next data model, namely the data model Teardown (step 4 in the diagram), where the prefix message chain row array [0, 0, 0] is added during the initialization of the prefix message chain list, the purpose of which is to place the protocol entity program in the corresponding state when fuzzing the next data model.

[0133] 2-7-3. Update and check seed energy value

[0134] If the evaluation result is true, then set the energy value seedEnergy. i k Set the initial value to SC; otherwise, set the seed to SC. i k Seed Energy i k Updated to seedEnergyi k Xa (a is an attenuation factor, the value is less than 1 and greater than 0, the smaller the value, the greater the seed energy value attenuation amplitude, in order to balance, the default value of the method is 0.92);

[0135] If the template seed seed i k at the present stage has an energy value seedEnergy i k < threshold i k , it represents that the performance of the seed seed i k is not good, and step 2-5-1 is turned to, a new seed is selected from the seed bank seedBank i as the template seed at the present stage; if the seed energy value seedEnergy i k >= threshold i k , step 2-6-2 is turned to, and the seed is continued to be used to generate a new test case.

[0136] The embodiments of the application are described in detail above in combination with the drawings, and any equivalent changes and modifications made within the scope of the application are all within the protection scope of the application.

[0137] 3. Experimental verification

[0138] In order to verify the effectiveness of the system FSGFuzz, comparative experiments are carried out on the RTSP protocol and the DNS protocol with the fuzzer EPF and Z-Fuzzer, and the number of branch coverage, the number of triggered crashes and the number of triggered fine-grained states are used as evaluation indexes. Each group of experiments is carried out for 24 hours, in order to avoid the influence of randomness in the experiment, each group of experiments is repeated three times, and all the evaluation indexes are averaged. The results show that, whether in the number of branch coverage, the number of triggered crashes or the number of triggered fine-grained states, the fuzzer FSGFuzz based on the method is better than EPF and Z-Fuzzer.

[0139] 3-1. Experimental design

[0140] Experimental group control group selection. The fuzzer FSGFuzz based on the method is used as the experimental group, and the fuzzer EPF and Z-Fuzzer based on syntax generation and coverage information guidance are used as the control group.

[0141] Test target selection. As shown in Table 1, the RTSP protocol and the DNS protocol are selected for the experiment in this paper. The RTSP protocol is a real-time media stream protocol, and for this protocol, the Live555 protocol entity program is selected as the target program. The DNS protocol is a domain name resolution protocol, and for this protocol, the Dnsmasq protocol entity program is selected as the target program. These protocol entity programs are open source servers frequently used in reality and have actual evaluation value.

[0142] Table 1 Test target

[0143] Target program Protocol Description Live555 RTSP Real-time media streaming protocol Dnsmasq DNS Domain name resolution protocol

[0144] Experimental evaluation index. In order to evaluate the effect of the method, the following three evaluation indexes are adopted in this paper:

[0145] (1) Branch coverage number. The number of branches of the protocol entity program that the fuzzer can cover within a specified time, this index can reflect the exploration degree of the fuzzer to the target protocol entity program code, only more program branches are covered, it is possible to dig out more potential vulnerabilities.

[0146] (2) Number of triggered crashes. The number of times the fuzzer causes the protocol entity program to crash within a specified time, this index can directly reflect the vulnerability mining ability of the fuzzer.

[0147] (3) Number of triggered fine-grained states. The number of fine-grained states that the fuzzer can trigger within a specified time, this index can reflect the exploration ability of the fuzzer to the deep branches of the target program.

[0148] Experimental environment setting. The system environment of the experiment is Ubuntu 20.04.4LTS operating system, 4GB memory, 2-core Intel(R) Core(TM) i5-9300HF CPU@2.40GHz 2.40GHz, and the experimental time of each group is 24 hours. In order to avoid the influence of randomness in the experiment, each group of experiments is repeated three times, and the subsequent chart data uses the average value of the results of three experiments.

[0149] 3-2. Experimental results

[0150] 3-2-1. Branch coverage number comparison

[0151] Table 2 Branch coverage number results

[0152]

[0153] The branch coverage quantity results of the experimental group FSGFuzz and the control groups EPF and Z-Fuzzer on the target programs Dnsmasq and Live555 are shown in Table 2. As can be seen from the table, the number of branches covered by the experimental group FSGFuzz is higher than that of the control groups EPF and Z-Fuzzer on the target programs Dnsmasq and Live555. On the target program Dnsmasq, FSGFuzz improves the branch coverage quantity index by 9.83% compared with EPF and by 6.99% compared with the control group Z-Fuzzer. On the target program Live555, FSGFuzz improves the branch coverage quantity index by 12.75% compared with EPF and by 7.51% compared with the control group Z-Fuzzer. In terms of the total number of covered branches, FSGFuzz improves by 12.18% compared with EPF and by 7.41% compared with the control group Z-Fuzzer. The improvement in the number of covered branches is due to the full exploration of new branches in fine-grained states by the method, which proves the effectiveness of the method.

[0154] The branch coverage quantity change trend of the experimental group and the control group in the test process of the target program is shown in FIG. 3. Figure 5 As can be seen from the figure, the number of branches covered by the fuzzer FSGFuzz implemented by the method is more than that of the control groups EPF and Z-Fuzzer at the beginning of the test, which is due to the warm-up phase of the method. By sending the original packet sequence conforming to the protocol specification to the target program, the branches corresponding to the partial fine-grained states of the target program are covered in advance. Moreover, the growth of the number of branches covered by the control groups EPF and Z-Fuzzer in the test process presents an obvious step growth phenomenon. The reason for this phenomenon is that EPF and Z-Fuzzer switch to the next data model after fully testing a certain data model, and the next data model may not have been used before, resulting in test packets of a new category, which will cover the branches corresponding to new fine-grained states, i.e., a large number of branches will be covered in a short time, causing the step growth phenomenon.

[0155] 3-2-2. Triggered crash quantity comparison

[0156] Table 3 Triggered crash quantity results

[0157]

[0158] The number of crashes triggered by FSGFuzz on target programs Dnsmasq and Live555 compared with EPF and Z-Fuzzer is shown in Table 3. As shown in the table, on target program Dnsmasq, the method triggers 24.3 and 18 more target program crashes than EPF and Z-Fuzzer, respectively, on average; on target program Live555, the method triggers 42.4 and 17.7 more target program crashes than EPF and Z-Fuzzer, respectively, on average. In terms of the total number of target program crashes triggered, the fuzzer FSGFuzz implemented based on the method improves EPF by 66.7 times on average and Z-Fuzzer by 35.7 times on average. Therefore, in terms of the number of crashes triggered, the effectiveness of the fuzzing method based on syntax generation and fine-grained state guidance can be proved.

[0159] 3-2-3. Comparison of the number of triggered fine-grained states

[0160] The number of fine-grained states triggered by FSGFuzz on target programs Dnsmasq and Live555 compared with EPF and Z-Fuzzer is shown in Table 4. As shown in the table, on target program Dnsmasq, FSGFuzz improves the number of fine-grained states triggered by 21.79% and 14.54% compared with EPF and Z-Fuzzer, respectively. On target program Live555, FSGFuzz triggers 104.7 more fine-grained states than EPF, which improves by 29.55%; for the fuzzer Z-Fuzzer, FSGFuzz triggers 78 more fine-grained states than Z-Fuzzer, which improves by 20.47%. In terms of the total number of fine-grained states triggered, the fuzzer FSGFuzz implemented based on the method improves EPF by 27.21% and Z-Fuzzer by 18.69%. This indicator can reflect the exploration ability of the fuzzer to the protocol entity program code branches, and therefore, in terms of the number of fine-grained states triggered, the effectiveness of the method can be proved.

[0161] Table 4 Number of fine-grained states triggered

[0162]

[0163] 3-2-4. Experimental summary

[0164] In this paper, the number of branch coverage, the number of triggered crashes and the number of triggered fine-grained states are used as evaluation indexes to compare the FSGFuzz with EPF and Z-Fuzzer. The experimental results show that, in the total number of branch coverage, FSGFuzz is 376.9 more than EPF, which increases by 12.18%, and 239.6 more than Z-Fuzzer, which increases by 7.41%. In the total number of triggered crashes, FSGFuzz triggers 66.7 more crashes than EPF on average, and 35.7 more crashes than Z-Fuzzer on average. In the total number of triggered fine-grained states, FSGFuzz triggers 138.1 more fine-grained states than EPF on average, which increases by 27.21%, and 101.7 more fine-grained states than Z-Fuzzer on average, which increases by 18.69%. Therefore, the effectiveness of the method is proved in the three indexes of branch coverage, the number of triggered crashes and the number of triggered fine-grained states.

Claims

1. A protocol vulnerability mining test method based on fine-grained state guidance, characterized in that, Comprise: a preprocessing phase, a fuzz testing phase and a result information feedback phase; wherein the fuzz testing phase comprises a fine-grained state selection, a prefix message sequence generation, a seed selection, a test case generation and a test case evaluation process; in the preprocessing phase, the program of the protocol entity to be tested is compiled by inserting a plug-in to obtain a corresponding binary executable program; a session model of the protocol to be tested is defined as an input of the fuzz testing phase; an execution engine is constructed according to the binary executable program; in the fuzz testing phase, a test case sequence information triggering a new state is saved by using a prefix message chain list, and the state is accurately located while the prefix message chain list is used to generate an abnormal message sequence; after the state to be tested in the fuzz testing phase is selected by the fine-grained state selection process, a prefix message sequence corresponding to the state is generated, and then the protocol entity to be tested is located to the state by the prefix message sequence, and a test case is generated by using the seed template selected by the seed selection process to perform the fuzz testing on the state; in the result information feedback phase, the number of times of triggering the protocol entity to be tested to crash and the coverage information are fed back in real time; and the test case triggering the protocol entity to be tested to crash is saved for facilitating the reproduction and analysis of the crash in the later stage.

2. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 1, characterized in that The preprocessing phase comprises the following sub-steps: 1-1. In the fuzz testing process, in order to obtain the branch coverage of the protocol entity to be tested, the source code of the protocol entity to be tested is compiled by inserting a plug-in by using the gcc compiling tool provided by aflfast to generate a binary executable program; 1-2. Define a data model set By analyzing the request data packet corresponding to the to-be-tested protocol and combining the to-be-tested protocol specification, a data model set model of the protocol is defined using a data model definition function provided by a BooFuzz fuzzing framework set = {model1,...,model i , ..., model n},i=1,..., n, wherein n is a total number of data models of the to-be-tested protocol, and the defined data model is used as a protocol specification template for generating a corresponding test case; 1-3. Define a session model Based on the session sequence requirements of the protocol under test specification, the session model definition function provided by the BooFuzz ​​fuzzing framework was used to define the model. set The data models in the data model are connected to form a session model: sessionModels = {sessionSeq1,…,sessionSeq} j ,…, sessionSeq m }, j=1, ..., m, where sessionSeq j A session sequence represents a session in a session model, consisting of several data models with sequential relationships, where m is the number of session sequences in the session model; 1-4. Construct an execution engine Run the executable program generated in step 1-1, and open a shared memory shareMem with a size of XM bytes to real-time statistics of the branch coverage of the protocol entity to be tested.

3. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 2, characterized in that The fuzz testing phase comprises the following sub-steps: 2-1. System preheating; 2-2. Data model selection; 2-3. Fine-grained state selection; 2-4. Prefix message sequence generation; 2-5. Seed selection; 2-6. Test case generation; 2-7. Test case evaluation process.

4. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 3, characterized in that Steps 2-1 and 2-2 are implemented as follows: 2-1. System preheating; according to the session sequence in the defined session model, an original message sequence not subjected to mutation is generated in sequence and input into the execution engine to complete the preheating of the system; the specific implementation is as follows: 2-1-1. Traverse the session model sessionModels, and sequentially traverse and take out the session sequence sessionSeq in it j If the session model has been traversed to the end, the system preheating work has been completed, and turn to step 2-2; 2-1-2. Take out the session sequence sessionSeq j After that, according to the order relation of the data model in the session sequence sessionSeq j , traverse the session sequence sessionSeq j , and get the data model model i ; if the traversal work for the session sequence sessionSeq j has been completed, reset the protocol entity program to the initial state and turn to step 2-1-1 to traverse the next session sequence; 2-1-3. The obtained data model i The protocol specification template is used to generate corresponding test cases, and these test cases are then used as the data model. i Seed Bank i The initial seed in i 0 If the current data model is... i Not a session sequence (sessionSeq) j If the last data model is selected, then the current data model is created. i In the same session sequence sessionSeq j Next data model i+1 The initial prefix message chain list preChainsList i+1 ={[seedNo1 0 , … , seedNo i 0 ]}, where seedNo1 0 Represents the current session sequence (sessionSeq) j The initial seed seed1 of the first data model 0 The label, seedNo i 0 Represents the current session sequence (sessionSeq) j Chinese data model i initial seed i 0 The label; proceed to step 2-1-2 to obtain the next data model; Step 2-2 data model selection, the specific implementation is as follows: 2-2-1. Traverse the session model sessionModels, and sequentially traverse and take out the session sequence sessionSeq in it j ; if the session model has been traversed to the end, end the fuzz test; 2-2-2. Take out the session sequence sessionSeq j After that, according to the order relationship of the data model in the session sequence sessionSeq j , traverse the session sequence sessionSeq j Get the data model model i , as the data model used in the current fuzzy test stage; if the traversal of the session sequence sessionSeq j has been completed, go to step 2-2-1.

5. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 4, characterized in that Step 2-3 fine-grained state selection, the specific implementation is as follows: If the data model model i is the first data model in the session sequence sessionSeq j , the data model model i does not have a prefix message chain list, directly go to step 2-5, the current selected fine-grained state is the initial state, and the fuzzy test is performed on the data model in the initial state; otherwise, go to step 2-3-1; 2-3-1. Traverse the data model model i The corresponding prefix message chain list preChainsList i = {[seedNo1 0 ,…, seedNo i-1 0 ] 1 ,…, [seedNo1 ki , …, seedNo i-1 ki ] a ,…, [seedNo1 ki , …,seedNo i-1 ki ] b}, a=1,..., b, where b is the number of rows of the prefix message chain list preChainsList i ; where ki represents the seed number in the corresponding seed pool, obtaining the prefix message chain row array [seedNo1 ki , …,seedNo i-1 ki ] a in preChainsList i , turn to step 2-3-2; if the prefix message chain list preChainsList i has been traversed to the end, it means that sufficient fuzz testing has been completed for all states corresponding to the current data model model i , turn to step 2-2-2 to select the next data model model j in the session sequence sessionSeq i+1 ; 2-3-2. With the prefix message chain row array [seedNo1 ki , …, seedNo i-1 ki ] a As a mark of the fine-grained state of the current fuzz test, let state a = [seedNo1 ki , …, seedNo i-1 ki ] ki , …, seedNo i-1 i-1 Represent the unique identifier of the seed seed i-1 ki in the seed bank seedBank a of the data model model a .

6. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 5, characterized in that Step 2-4 prefix message sequence generation, the specific implementation is as follows: The initialization prefix message sequence is preMessSeque a = [], according to the selected fine-grained state state a = [seedNo1 ki , …,seedNo i-1 ki ] a , traversing the prefix message chain row array corresponding to the state state a [seedNo1 ki , …, seedNo i-1 ki ] a , retrieving the seed seed1 ki from the seed bank seedBank1 of the data model model1 according to the seed number seedNo1 ki , and taking out the seed seed1 ki from the seed bank, and adding the seed seed1 a retrieved from the seed bank to the prefix message sequence preMessSeque i-1 ; the final seed number is seedNo ki ; According to seed number seedNo i-1 ki Retrieve data model model i-1 of seed bank seedBank i-1 , take out seed seed i-1 ki from it, and add it to the prefix message sequence; state state a After the end of the array traversal of the prefix message chain corresponding to the state state a , the prefix message sequence preMessSeque a corresponding to the state state ki = [seed1 i-1 , …,seed ki ].

7. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 6, characterized in that Step 2-5 seed selection, the specific implementation is as follows: 2-5-1. Traverse the current data model model i seedBank i ={seed i 0 ,…, seed i k ,…,seed i t}, k = 1,..., t, where t is the number of seeds in the seed bank seedBank i from which a seed seed i k is sequentially selected. If all the seeds in the seed pool have been exhausted, the fuzzing test for the current selected fine-grained state state a is ended; the fuzzing test for the fine-grained state state a is ended, if the current data model model i is the first data model in the session sequence sessionSeq j , go to step 2-2-2 to select a new data model; otherwise, go to step 2-3-1 to select other fine-grained state corresponding to the data model model i . 2-5-2. For seed seed i k , the energy value of the seed is initialized as seedEnergy i k = SC, the threshold of the seed is threshold i k .

8. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 7, characterized in that Step 2-6 test case generation, the specific implementation is as follows: 2-6-1. Obtain the current seed seed i k The corresponding data model model i All variable fields in the seed seed i k The value fields={field1,…,field p ,…,field q} in the seed seed, p=1, …, q, where q is the total number of variable fields in the data model model i , and set the mark bit index b to the mutated field position, and initialize the mark bit index b =0; 2-6-2. Traverse fields, take out the field value field currently traversed p ; if the last field of the seed has been traversed during the traversal of fields, reset the index flag index to 0 and start the traversal again, so that the next round of mutation starts from the first unmutated field b ; 2-6-3. If the field value field p is a value that has not been mutated in the seed seed i k and the field is a field that is followed by a marker bit index b , then mutate the field field p using the mutation engine of the EPF to obtain a mutated result mutated_ field p for the current field field p and set the marker bit index b to p; otherwise go to step 2-6-2 to continue traversing fields; 2-6-4. With the mutated_ field p Replace the seed seed i k The corresponding field value, resulting in a new test case testcase; 2-6-5. Connect the new test case testcase to the current state state resulting from step 2-4 a The corresponding prefix message sequence preMessSeque a = [seed1 ki ,..., seed i-1 ki ] is prepended to get the complete message sequence messSeque = [seed1 ki ,..., seed i-1 ki , testcase]; and the message sequence messSeque is injected into the execution engine.

9. The protocol vulnerability mining test method based on fine-grained state guidance according to claim 8, characterized in that Step 2-7 test case evaluation, the specific implementation is as follows: 2-7-1. Evaluate whether a new branch is triggered Traverse the global shared memory shareMem to determine whether the currently executed test case testcase triggers a new branch; If a new non-zero byte appears in the global shared memory shareMem, it represents a trigger for a new branch, setting the evaluation result result = true and the current test case as the new seed i x The new seed seed i x is added to the seed bank seedBank i of the current data model model i selected in step 2-2-2. 2-7-2. Update the prefix message chain list of the next data model If the evaluation result result is true, indicating that a new fine-grained state of the protocol entity program is triggered, the message sequence seed label corresponding to the state is saved to the next data model model i+1 the prefix message chain list preChainsList i+1 In this case, the specific operation is as follows: Let the prefix message chain row array to be added to the prefix message chain list preChainsList i+1 be preMessLineArr = [];traverse the message sequence messSeque = [seed1 ki , …,seed i-1 ki , seed i x ], and add the index of the seed in the seed library of the corresponding data model to the prefix message chain row array preMessLineArr in turn. After the traversal ends, the prefix message chain row array preMessLineArr = [seedNo1 ki , …,seedNo i-1 ki ,seedNo i x ] is obtained. preMessLineArr represents a new fine-grained state. preMessLineArr is added to the prefix message chain list preChainsList i+1 . 2-7-3. Update the seed energy value If the evaluation result result is true, the energy value seedEnergy i k is the initial value SC; Otherwise, the seed seed i k is updated to seedEnergy i k i k a, where a is an attenuation factor, less than 1 and greater than 0, the smaller the value, the greater the attenuation of the seed energy value.​ If the seed energy value seedEnergy i k at the present stage is less than a threshold value threshold i k <threshold i k , it means that the performance of the seed seed i k at the present stage is not good, and the process goes to step 2-5-1 to select a new seed from the seed bank seedBank i as the seed at the present stage; if the seed energy value seedEnergy i k >=threshold i k , the process goes to step 2-6-2 to continue generating new test cases using the seed.

10. A protocol vulnerability mining test system based on fine-grained state guidance, characterized by, Comprise: Preprocessing module; The function of the preprocessing module is to use the gcc compiling tool provided by aflfast to compile the program of the protocol entity to be tested, so as to obtain a corresponding binary executable program; and to use the data model definition function provided by the BooFuzz fuzz testing framework to define a data model set model of the protocol set , in combination with the requirements of the protocol specification to be tested on the session sequence, connect the data models in the defined data model set model set into a session model sessionModels as input of the fuzz testing stage; Finally, build execution engine; Fuzzing module; The fuzzing module first warms up the execution engine, in the warming up process, an initial seed library and an initial prefix message chain list corresponding to each data model are created; after the warming up is completed, a session sequence is selected from the session models defined by the preprocessing module in turn, and then a data model in the session sequence is selected in turn to obtain a data model model in the fuzzing stage i , and finally the fine-grained state selector, the prefix message sequence generator, the seed selector, the test case generator and the test case evaluator therein are executed: Fine-grained state selector; function is according to the current fuzzy test stage selected data model model i , under the guidance of the data model corresponding prefix message chain list preChainsList i Select the state state to be tested by the fuzzy test stage of fuzzy test a ; Prefix message sequence generator; After the fine-grained state selector selects the state that needs to be fuzzed in the fuzzing phase, the message sequence corresponding to the state is generated to guide the protocol entity program to be tested to the state; Seed selector; is responsible for selecting seeds used in the fuzzing phase from the current data model model i 's seed bank seedBank i and initializing the energy value seedEnergy of the selected seed and the threshold threshold. Test case generator; responsible for mutating the seed selected by the seed selector, and generating new test cases using the seed; the mutation strategy used by the test case generator is beneficial mutation that keeps the seed triggering a new branch, and on this basis, other variable fields are mutated in turn, so that the generated new test cases explore updated branches on the basis of still triggering the original branch; test case evaluator; according to the branch coverage of the execution engine, deciding whether to add the new test case generated in the current round of fuzz testing as a seed to the seed bank of the current data model i the energy value of the current seed selected by the seed selector is updated, and according to the branch coverage of the execution engine, it is decided whether to update the prefix message chain list of the next data model; Result information feedback module; Real-time feedback in the page according to the branch coverage statistics of the shared memory; Real-time feedback of the number of times of triggering the protocol entity program to be tested to crash during the fuzzing process; And the test cases that trigger the protocol entity program to crash are saved, which is convenient for the reproduction and analysis of the crash in the later stage.

Images