Fuzz testing method and device for network server in embedded device

Abstract

The application relates to the technical field of software testing, in particular to a fuzzy testing method and device for a network server in an embedded device. The method comprises the following steps: after obtaining a network server program of firmware in a to-be-tested device, a function code control flow graph is constructed; based on the function code control flow graph, a communication interface function and a communication address are obtained; static data stream analysis is performed on each communication interface function, parameter keywords and constraint information corresponding to the parameter keywords are obtained; based on the communication address, the parameter keywords and the constraint information corresponding to the parameter keywords, fuzzy testing seeds are generated; each fuzzy testing seed is mutated to generate all test cases; and the to-be-tested device is tested by using all the test cases to obtain a test result. The application aims to solve the problem that the network server in the embedded device is not tested sufficiently in the prior art, and security defects existing in the network server cannot be effectively found.

Description

Technical Field

[0001] This invention relates to the field of software testing technology, and in particular to a fuzz testing method and apparatus for a network server in an embedded device. Background Technology

[0002] With the development of IoT technology, embedded devices have become a key component of modern life, widely used in consumer electronics, autonomous vehicles, and industrial control systems, such as smartphones, autonomous vehicles, and industrial robots. As embedded devices become increasingly networked, more and more are connected to the internet. Attackers can exploit vulnerabilities in embedded devices to remotely gain control, leading not only to user privacy breaches but also threatening infrastructure security. Embedded devices often use network servers to receive external data input from users and configure the devices accordingly. Insufficient validation of this external data allows malicious data crafted by attackers to trigger vulnerabilities in the embedded device. Therefore, network servers in embedded devices often have numerous security vulnerabilities and are more susceptible to attack.

[0003] Fuzzing is currently the most popular vulnerability discovery technique. It generates test cases by randomly mutating the target program and uses the runtime status of the target program as feedback information to further guide the fuzzing process. However, embedded devices typically rely on specific peripherals (such as sensors and actuators) and run on specific architectures (such as ARM and MIPS architectures). Therefore, embedded device firmware cannot be directly run on general-purpose platforms, and traditional software fuzzing techniques cannot be directly applied to the testing and analysis of embedded devices.

[0004] Currently, fuzzing methods for network servers in embedded devices can be divided into two categories: firmware emulation-based methods and real device-based methods. Firmware emulation-based fuzzing runs the firmware on an emulator, which can provide runtime information such as code coverage to guide fuzzing. However, due to the different peripheral dependencies of firmware from different manufacturers and models of embedded devices, manual configuration by experts is required for correct firmware emulation, making automated analysis difficult for the diverse range of embedded devices. Real device-based fuzzing directly sends test messages to the embedded device via network protocols. However, this method lacks effective fuzzing feedback metrics because it cannot directly obtain runtime information from the firmware in the remote device. Furthermore, the test messages generated by this method do not consider the semantic information of the firmware code, making randomly mutated test messages difficult to pass the data validity checks on the network server, ultimately leading to low fuzzing efficiency. Additionally, previous methods used web crawlers to collect communication interface functions from the front-end page. This approach misses communication interface functions that are only provided by the back-end network server but not visible on the front-end page, resulting in insufficient testing of the network server in the embedded device and an inability to effectively discover security vulnerabilities in the network server. Summary of the Invention

[0005] This invention provides a fuzz testing method and apparatus for network servers in embedded devices, which solves the problem that existing technologies do not provide sufficient testing for network servers in embedded devices and cannot effectively detect security defects in network servers.

[0006] This invention provides a fuzz testing method for a network server in an embedded device, comprising: after obtaining the network server program of the firmware in the device under test, constructing a function code control flow graph of the network server program;

[0007] Based on the function code control flow graph, obtain all communication interface functions and the corresponding communication address URL for each communication interface function;

[0008] Static data flow analysis is performed on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function.

[0009] Based on the communication address URL, parameter keywords, and constraint information corresponding to each of the communication interface functions, all fuzzy test seeds are generated;

[0010] Each of the fuzz test seeds is mutated to generate all test cases;

[0011] The device under test is tested using all the test cases to obtain test results.

[0012] According to the fuzzing method for a network server in an embedded device provided by the present invention, after obtaining the network server program of the firmware in the device under test, constructing the function code control flow graph of the network server program includes:

[0013] Decompress the firmware of the device under test to obtain the firmware file system;

[0014] Based on the firmware file system, obtain the firmware's network server program;

[0015] Based on the network server program, construct the function code control flow graph of the network server program.

[0016] According to the fuzzing method for a network server in an embedded device provided by the present invention, based on the function code control flow graph, all communication interface functions and the communication address URL corresponding to each of the communication interface functions are obtained, including:

[0017] Based on the function code control flow graph, and according to the characteristics of the communication interface functions, all communication interface functions and the corresponding communication address URL for each communication interface function are identified.

[0018] According to the present invention, a fuzzing method for a network server in an embedded device is provided, wherein the constraint information includes constraint type and constraint value, wherein the constraint type includes: string type, numeric type and network address type.

[0019] According to the fuzzing method for a network server in an embedded device provided by the present invention, static data flow analysis is performed on each of the communication interface functions to obtain parameter keywords and corresponding constraint information in each communication interface function, including:

[0020] Static data flow analysis is performed on each of the communication interface functions to identify parameter keywords in each communication interface function;

[0021] Static data flow analysis is performed on the position of each parameter keyword. If a condition comparison is identified in the data flow path of each parameter keyword, and the data used for condition comparison belongs to the constraint type, then the data of the condition comparison is collected as the constraint value of the parameter keyword candidate.

[0022] Based on the constraint type and constraint value of each parameter keyword, constraint information corresponding to each parameter keyword is generated.

[0023] According to the fuzzing method for a network server in an embedded device provided by the present invention, the format of each fuzzing seed is as follows:

[0024] For each of the communication interface functions, there is a corresponding communication address URL, a corresponding parameter keyword, and a corresponding constraint information. The parameter keyword and its corresponding data are combined in the form of key-value pairs. If the parameter keyword belongs to the constraint type, the data corresponding to the parameter keyword is generated according to the constraint information; otherwise, the randomly mutated value is used as the data corresponding to the parameter keyword.

[0025] According to the present invention, a fuzz testing method for a network server in an embedded device is provided, which uses all the test cases to test the device under test and obtain test results, including:

[0026] The device under test is tested using all the aforementioned test cases, and the test results are obtained, including:

[0027] Each test case is sent to the device under test in sequence for testing;

[0028] If the response status of the device under test is abnormal, the test result is that the device under test has a vulnerability, and the device under test is driven to reset.

[0029] After the device under test is reset, test cases that have not yet been used for testing the device under test will be sent to the device under test for testing in sequence.

[0030] Once all test cases have completed testing on the device under test, the test results of each test case are summarized to obtain the final test results.

[0031] According to the fuzzing method for a network server in an embedded device provided by the present invention, if the response status of the device under test is abnormal, a test result is obtained that the device under test has a vulnerability, including:

[0032] If the test device executes a specially crafted command from the test case, the test result indicates that the test device has a command execution vulnerability.

[0033] If the device under test does not respond or its response is inconsistent with normal behavior and is not a specially crafted request, then the test result indicates that the device under test has a memory crash vulnerability.

[0034] The present invention also provides a fuzz testing device for a network server in an embedded device, comprising:

[0035] The preprocessing module is used to obtain the network server program of the firmware in the device under test and then construct the function code control flow graph of the network server program.

[0036] The communication interface identification module is used to obtain all communication interface functions and the communication address URL string corresponding to each of the communication interface functions based on the function code control flow graph.

[0037] The constraint collection module is used to perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function.

[0038] The seed generation module is used to generate all fuzzy test seeds based on the communication address URL, parameter keywords, and constraint information corresponding to the parameter keywords for each of the communication interface functions.

[0039] The mutation module is used to mutate each of the fuzz test seeds to generate all test cases;

[0040] The testing module is used to test the device under test using all the test cases and obtain the test results.

[0041] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a fuzz testing method for a network server in any of the above-described embedded devices.

[0042] This invention provides a fuzzing method and apparatus for a network server in an embedded device. After obtaining the network server program of the firmware in the device under test, all communication interface functions and their corresponding communication URLs are acquired. Static data flow analysis is performed on each communication interface function to derive parameter keywords and corresponding constraint information. Based on the communication URLs, parameter keywords, and constraint information for each communication interface function, all fuzzing seeds are generated. Then, after analyzing the network server program, correctly formatted fuzzing seeds with constraint information are used as guidance for fuzzing. Simultaneously, each constrained fuzzing seed is mutated to generate test cases, thereby reducing the mutation space of the fuzzing seeds and improving the efficiency of fuzzing. All the test cases are used to test the device under test, obtaining test results. This achieves thorough fuzzing of the network server in the embedded device, effectively discovering security vulnerabilities in the network server. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0044] Figure 1 This is a flowchart illustrating the fuzz testing method for a network server in an embedded device provided by the present invention.

[0045] Figure 2 This is a diagram illustrating an HTTP request code snippet sent from a front-end page to a back-end web server.

[0046] Figure 3 This is a diagram showing the pseudocode snippet corresponding to the assembly code in the backend web server program.

[0047] Figure 4 This is a schematic diagram of the structure of the fuzz testing device for a network server in an embedded device provided by the present invention.

[0048] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0050] The following is combined with Figure 1 A fuzz testing method for a network server in an embedded device according to the present invention includes:

[0051] S1. After obtaining the network server program of the firmware in the device under test, construct the function code control flow graph of the network server program. In this embodiment, the constructed function code control flow graph of the network server program is a function code control flow graph.

[0052] S2. Based on the function code control flow graph, obtain all communication interface functions and the communication address URL corresponding to each of the communication interface functions.

[0053] S3. Perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords (PK) and the corresponding constraint information (CONST) in each communication interface function. Specifically, using a static data flow analysis algorithm, perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords and the corresponding constraint information in each communication interface function.

[0054] S4. Based on the communication address URL, parameter keywords, and constraint information corresponding to the parameter keywords for each of the communication interface functions, generate all fuzzy test seeds.

[0055] S5. Mutate each of the fuzz test seeds to generate all test cases.

[0056] S6. Test the device under test using all the test cases to obtain the test results. By analyzing the communication interface functions, the efficiency of fuzz testing is effectively improved.

[0057] This invention obtains the network server program of the firmware in the device under test, acquires all communication interface functions and the corresponding communication address URL for each function, performs static data flow analysis on each communication interface function to derive parameter keywords and corresponding constraint information, and generates all fuzz test seeds based on the communication address URL, parameter keywords, and constraint information for each communication interface function. This allows the analysis of the network server program to utilize the fuzz test seeds as guidance for fuzz testing. Simultaneously, each fuzz test seed is mutated to generate all test cases, thereby improving the efficiency of fuzz testing by narrowing the mutation space of the seeds. All test cases are then used to test the device under test, obtaining test results. This achieves thorough fuzz testing of the network server in the embedded device, effectively discovering security vulnerabilities in the network server of the embedded device.

[0058] Based on the above embodiments, after obtaining the network server program of the firmware in the device under test, constructing the function code control flow graph of the network server program includes:

[0059] Decompress the firmware of the device under test to obtain the firmware file system.

[0060] Based on the firmware file system, obtain the firmware's network server program.

[0061] Based on the network server program, construct the function code control flow graph of the network server program.

[0062] After decompressing the firmware of the device under test, the network server program of the firmware is obtained. The function code control flow graph of the network server program is constructed, and the function code control flow graph is used to facilitate the analysis of the network server program.

[0063] Based on the above embodiments, and using the function code control flow graph, all communication interface functions and the corresponding communication address URL for each communication interface function are obtained, including:

[0064] Based on the function code control flow graph, and according to the characteristics of the communication interface functions, all communication interface functions and their corresponding communication address URLs are identified. Anomaly detection is performed using two effective preset communication interface function characteristics to determine whether the constructed fuzzy test seed triggers a vulnerability in the device under test.

[0065] In this embodiment, the characteristic of a communication interface function is that when a communication interface function is called, it searches for the corresponding function pointer based on the communication address URL string to implement the function call. By analyzing the cross-reference information of the function pointer data and combining it with fixed string characteristics, two types of communication interface functions can be identified: those registered by the registration function and those registered by the function table. Specifically:

[0066] (1) In the code segment of the network server program, a string and a function pointer are passed as function parameters to a function simultaneously. This indicates that the network server uses a unified registration function to bind the URL and the corresponding communication interface function. First, the registration function is filtered out based on frequency information, and then the communication interface function and the corresponding URL are identified.

[0067] (2) In the data segment of the network server program, there are multiple instances where strings and function pointers are stored consecutively. This indicates that the network server stores the communication interface functions and their corresponding URLs at different offsets in the function table based on different URLs. First, the data segment storing the communication interface functions is selected based on frequency information, and then the communication interface functions and their corresponding URLs are identified.

[0068] Specifically, in the code and data segments of the network server program, cross-referencing information is used to identify matching communication interface functions and their corresponding URLs. There is a one-to-one correspondence between URLs and communication interface functions; the network server program receives multiple URLs and calls the appropriate functions for processing. Please refer to [further details omitted]. Figure 3 Where fwSchedule.cgi is the URL, and sub_47550 is the communication interface function corresponding to that URL.

[0069] Based on the above embodiments, the types of constraint information include: string type, numeric type and network address type.

[0070] Among them, (1) string-type constraint information indicates that the data corresponding to the parameter keyword is used to compare with a fixed string in the conditional judgment. This type of constraint information is obtained by analyzing constraint functions such as strcmp. (2) numeric-type constraint information indicates that the data corresponding to the parameter keyword is used to compare with an immediate value in the conditional judgment. This type of constraint information is obtained by analyzing constraint functions such as atoi. (3) network address-type constraint information indicates that the data corresponding to the parameter keyword is used to compare with a network address in the conditional judgment. This type of constraint information is obtained by analyzing constraint functions such as inet_addr. When the data corresponding to the parameter keyword satisfies the constraint, the deeper code is triggered through the data validity check in the firmware.

[0071] Specifically, the constraint functions in C / C++ are: (1) String constraint functions: strcmp, strcasecmp, stricmp, strncasecmp, strncmp. (2) Numeric constraint functions: atoi, atof, atol, atll, strtol, strtoll, strtoul, strtod. (3) Network address constraint functions: inet_addr, inet_aton, inet_ntoa, inet_ntop, inet_pton, gethostbyname, gethostbyname2. Additionally, other constraint functions can be added based on the analysis of specific firmware and the description of this invention.

[0072] Based on the above embodiments, static data flow analysis is performed on each of the communication interface functions to obtain the parameter keywords and corresponding constraint information in each communication interface function, including:

[0073] Static data flow analysis is performed on each of the communication interface functions to identify parameter keywords in each function.

[0074] Static data flow analysis is performed on the position of each parameter keyword. If a condition comparison is identified in the data flow path of each parameter keyword, and the data used for condition comparison belongs to the constraint type, then the data of the condition comparison is collected as the constraint value of the parameter keyword candidate.

[0075] Based on the constraint type and constraint value of each parameter keyword, constraint information corresponding to each parameter keyword is generated.

[0076] refer to Figure 3The communication interface function sub_47550 includes three parameter keywords: result, length, and hostname. The string constraint corresponding to the parameter keyword result is ["cancel", "apply"], and the numeric constraint corresponding to the parameter keyword length is [[-∞,2],[3,+∞]]. Figure 2 When a network request in the context of the URL, parameter keywords, and constraint information meets the requirements, it can trigger [a certain action / feedback]. Figure 3 The buffer overflow vulnerability at the location allows for the discovery of hidden communication interface functions in the network server.

[0077] Specifically, the static data flow analysis algorithm for collecting parameter keywords and corresponding constraint information in communication interface functions is described as follows:

[0078] First, the value retrieval function is identified within the communication interface function as the starting point for data flow analysis. Initial def-use analysis is performed from the data corresponding to the parameter keywords, determining whether all relevant data in the def-use chain is used as parameters by constraint functions. If so, the constraint information for that parameter keyword is collected. The data flow analysis ends after the algorithm has traversed the communication interface function and all its sub-functions. The value retrieval function is the function used to extract corresponding data from the network request based on specific parameter keywords.

[0079] Based on the above embodiments, the format of each fuzz test seed is as follows:

[0080] Each of the aforementioned communication interface functions includes a corresponding communication address URL, a corresponding parameter keyword, and corresponding constraint information. The parameter keyword and its corresponding data are combined in key-value pairs. If the parameter keyword belongs to the constraint type, data corresponding to the parameter keyword is generated based on the constraint information; otherwise, a randomly mutated value is used as the data corresponding to the parameter keyword (i.e., if the parameter keyword does not conform to the constraint type, a randomly mutated value is used as the data corresponding to the parameter keyword). For example, the format of a fuzzy test seed is {URL:{PK1,CONST_PK1},{PK2,CONST_PK2},…,{PK n CONST_PK n The expression `}}` indicates that when initiating a network request to the URL corresponding to a communication interface function, the parameter key `PK` and its corresponding data need to be assembled in key-value pair format. The data corresponding to the parameter key is obtained by mutating the seed based on constraint information. If the parameter key does not have corresponding constraint information, it is considered an unconstrained type, and the randomly mutated value is used as the data corresponding to the parameter key.

[0081] Based on the above embodiments, each fuzzy test seed is mutated according to constraint information to generate test cases:

[0082] If the parameter keyword constraint type is string, then a value is randomly selected from the constraint candidate list collected in the previous data flow analysis as the variant data, for reference. Figure 3 The string constraint for the parameter keyword result is ["cancel", "apply"], randomly selecting "cancel" or "apply" as the constraint value;

[0083] If the parameter keyword constraint type is numeric, then based on the constraint range collected in the previous data flow analysis, the original constraint range and the inverted constraint range are used as variation data, for reference. Figure 3 The numeric constraint corresponding to the parameter keyword length is [[-∞,2],[3,+∞]], randomly selecting any integer from [-∞,2] or any integer from [3,+∞] as the constraint value;

[0084] If the parameter keyword constraint type is network address type, then a value is randomly selected from the predefined network data list as the variant data, such as "192.168.0.1 / 24" or "255.255.254.0".

[0085] If the parameter keywords lack constraint information, they are randomly mutated according to the principles of fuzz testing. Specifically, considering the data processing characteristics of the web server, the following three mutation strategies are used:

[0086] To trigger a memory corruption vulnerability, a random string is used with a certain probability and its length is modified as the mutation value;

[0087] To trigger a command execution vulnerability, an attack payload is randomly selected from a predefined database as a mutation value with a certain probability, such as "telnetd -l / bin / sh -p 8888 -b 0.0.0.0";

[0088] To bypass potential numerical verification, random integers 0 or 1 are used as mutation values ​​with a certain probability.

[0089] Based on the above embodiments, the device under test is tested using all the test cases to obtain test results, including:

[0090] Each test case is sent to the device under test in sequence for testing.

[0091] If the response status of the device under test is abnormal, a test result indicating a vulnerability is obtained, and the device under test is reset. Resetting the device under test prevents it from entering a deadlock state due to the vulnerability. Alternatively, the device under test can be reset by controlling the power-off and power-on of a smart socket connected to the device's power supply.

[0092] After the device under test is reset, test cases that have not yet been used for testing the device under test will be sent to the device under test for testing in sequence.

[0093] After all test cases have completed testing on the device under test, the test results for each test case are summarized to obtain the final test result. Simultaneously, all test cases that caused abnormal states in the device under test can be recorded as vulnerability warning information. The final test result is generated based on all vulnerability warning information.

[0094] Based on the above embodiments, if the response status of the device under test is abnormal, a test result is obtained that the device under test has a vulnerability, including:

[0095] If the device under test sends a specially crafted request response status, then the test result indicates that the device under test has a command execution vulnerability.

[0096] If the device under test does not respond or its response is inconsistent with normal behavior and it is not sending a specially crafted request, then the test result indicates that the device under test has a memory crash vulnerability.

[0097] At the same time, when a test result with a command execution vulnerability or a memory crash vulnerability appears, an early warning message is generated to effectively discover security flaws in the network server.

[0098] The following describes the fuzz testing apparatus for a network server in an embedded device provided by the present invention. The fuzz testing apparatus for a network server in an embedded device described below can be referred to in correspondence with the fuzz testing method for a network server in an embedded device described above.

[0099] Please refer to the following: Figure 4 A fuzz testing device for a network server in an embedded device includes a preprocessing module 410, a communication interface identification module 420, a constraint module 430, a seed generation module 440, a mutation module 450, and a testing module 460.

[0100] The preprocessing module 410 is used to obtain the network server program of the firmware in the device under test and then construct the function code control flow graph of the network server program.

[0101] The communication interface identification module 420 is used to obtain all communication interface functions and the communication address URL corresponding to each of the communication interface functions based on the function code control flow graph.

[0102] The constraint collection module 430 is used to perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function.

[0103] The seed generation module 440 is used to generate all fuzzy test seeds based on the communication address URL, parameter keywords, and constraint information corresponding to the parameter keywords for each of the communication interface functions.

[0104] The mutation module 450 is used to mutate each of the fuzz test seeds to generate all test cases.

[0105] The test module 460 is used to test the device under test using all the test cases and obtain test results.

[0106] This invention constructs a function code control flow graph of a network server program through a preprocessing module 410, obtains all communication interface functions and the corresponding communication address URL for each communication interface function through a communication interface identification module 420, obtains parameter keywords and corresponding constraint information for each communication interface function through a constraint collection module 430, generates all fuzz test seeds through a seed generation module 440, generates all test cases through a mutation module 450, and improves the efficiency of fuzz testing by narrowing the mutation space of the seeds, and uses a testing module 460 to test the device under test using all test cases to obtain test results, thereby realizing fuzz testing of embedded devices and effectively discovering security vulnerabilities in the network server of embedded devices.

[0107] The preprocessing module 410 is used to obtain the network server program of the firmware in the device under test, and then construct the function code control flow graph of the network server program, including:

[0108] Decompress the firmware of the device under test to obtain the firmware file system.

[0109] Based on the firmware file system, obtain the firmware's network server program.

[0110] Based on the network server program, construct the function code control flow graph of the network server program.

[0111] The communication interface identification 420 is used to obtain all communication interface functions and the communication address URL corresponding to each of the communication interface functions based on the function code control flow graph, including:

[0112] Based on the function code control flow graph, and according to the characteristics of the communication interface functions, all communication interface functions and the corresponding communication address URL for each communication interface function are identified.

[0113] The constraint collection module 430 is used to perform static data flow analysis on each of the communication interface functions to obtain parameter keywords and corresponding constraint information for each communication interface function, including:

[0114] Static data flow analysis is performed on each of the communication interface functions to identify parameter keywords in each function.

[0115] Static data flow analysis is performed on the position of each parameter keyword. If a condition comparison is identified in the data flow path of each parameter keyword, and the data used for condition comparison belongs to the constraint type, then the data of the condition comparison is collected as the constraint value of the parameter keyword candidate.

[0116] Based on the constraint type and constraint value of each parameter keyword, constraint information corresponding to each parameter keyword is generated.

[0117] Test module 460 is used to test the device under test using all the test cases and obtain test results, including:

[0118] Each test case is sent to the device under test in sequence for testing.

[0119] If the response status of the device under test is abnormal, the test result is that the device under test has a vulnerability, and the device under test is reset.

[0120] After the device under test is reset, test cases that have not yet been used for testing the device under test will be sent to the device under test for testing in sequence.

[0121] After all test cases have completed testing on the device under test, the test results for each test case are summarized to obtain the final test results. This achieves fuzz testing of embedded devices, effectively discovering security vulnerabilities in the network servers within embedded devices.

[0122] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a fuzzing method of a network server in the embedded device, the method including:

[0123] S1. After obtaining the network server program of the firmware in the device under test, construct the function code control flow graph of the network server program.

[0124] S2. Based on the function code control flow graph, obtain all communication interface functions and the communication address URL corresponding to each of the communication interface functions.

[0125] S3. Perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function.

[0126] S4. Based on the communication address URL, parameter keywords, and constraint information corresponding to the parameter keywords for each of the communication interface functions, generate all fuzzy test seeds.

[0127] S5. Mutate each of the fuzz test seeds to generate all test cases.

[0128] S6. Use all the test cases to test the device under test and obtain the test results.

[0129] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0130] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is able to execute the fuzzing method for a network server in an embedded device provided by the above methods, the method comprising:

[0131] S1. After obtaining the network server program of the firmware in the device under test, construct the function code control flow graph of the network server program.

[0132] S2. Based on the function code control flow graph, obtain all communication interface functions and the communication address URL corresponding to each of the communication interface functions.

[0133] S3. Perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function.

[0134] S4. Based on the communication address URL, parameter keywords, and constraint information corresponding to the parameter keywords for each of the communication interface functions, generate all fuzzy test seeds.

[0135] S5. Mutate each of the fuzz test seeds to generate all test cases.

[0136] S6. Use all the test cases to test the device under test and obtain the test results.

[0137] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the fuzzing method for a network server in an embedded device provided by the methods described above, the method comprising:

[0138] S1. After obtaining the network server program of the firmware in the device under test, construct the function code control flow graph of the network server program.

[0139] S2. Based on the function code control flow graph, obtain all communication interface functions and the communication address URL corresponding to each of the communication interface functions.

[0140] S3. Perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function.

[0141] S4. Based on the communication address URL, parameter keywords, and constraint information corresponding to the parameter keywords for each of the communication interface functions, generate all fuzzy test seeds.

[0142] S5. Mutate each of the fuzz test seeds to generate all test cases.

[0143] S6. Use all the test cases to test the device under test and obtain the test results.

[0144] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A fuzz testing method for a network server in an embedded device, characterized in that, include: After obtaining the network server program of the firmware in the device under test, construct the function code control flow graph of the network server program; Based on the function code control flow graph, obtain all communication interface functions and the corresponding communication address URL for each communication interface function; Static data flow analysis is performed on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function. The constraint information includes constraint type and constraint value, wherein the constraint type includes: string type, numeric type and network address type. Based on the communication address URL, parameter keywords, and constraint information corresponding to each of the communication interface functions, all fuzzy test seeds are generated; Each of the fuzz test seeds is mutated to generate all test cases; The device under test is tested using all the test cases to obtain test results; The process involves performing static data flow analysis on each communication interface function to derive parameter keywords and corresponding constraint information. This includes: performing static data flow analysis on each communication interface function to identify parameter keywords; performing static data flow analysis from the position of each parameter keyword; if a condition comparison is identified in the data flow path of each parameter keyword, and the data used for condition comparison belongs to the constraint type, then collecting the condition comparison data as candidate constraint values ​​for the parameter keyword; and generating constraint information corresponding to each parameter keyword based on the constraint type and constraint value. The format of each fuzz test seed is as follows: the communication address URL corresponding to each communication interface function, the parameter keyword corresponding to the communication address URL, and the constraint information corresponding to the parameter keyword. The parameter keyword and its corresponding data are combined in the form of key-value pairs. If the parameter keyword belongs to the constraint type, the data corresponding to the parameter keyword is generated according to the constraint information. Otherwise, the value of random mutation is used as the data corresponding to the parameter keyword.

2. The fuzz testing method for a network server in an embedded device according to claim 1, characterized in that, After obtaining the network server program of the firmware in the device under test, the function code control flow graph of the network server program is constructed, including: Decompress the firmware of the device under test to obtain the firmware file system; Based on the firmware file system, obtain the firmware's network server program; Based on the network server program, construct the function code control flow graph of the network server program.

3. The fuzz testing method for a network server in an embedded device according to claim 1, characterized in that, Based on the function code control flow graph, obtain all communication interface functions and the corresponding communication address URL for each communication interface function, including: Based on the function code control flow graph, and according to the characteristics of the communication interface functions, all communication interface functions and the corresponding communication address URL for each communication interface function are identified.

4. The fuzzing method for a network server in an embedded device according to any one of claims 1 to 3, characterized in that, The device under test is tested using all the aforementioned test cases, and the test results are obtained, including: Each test case is sent to the device under test in sequence for testing; If the response status of the device under test is abnormal, the test result is that the device under test has a vulnerability, and the device under test is driven to reset. After the device under test is reset, test cases that have not yet been used for testing the device under test will be sent to the device under test for testing in sequence. Once all test cases have completed testing on the device under test, the test results of each test case are summarized to obtain the final test results.

5. The fuzz testing method for a network server in an embedded device according to claim 4, characterized in that, If the response status of the device under test is abnormal, the test result is that the device under test has a vulnerability, including: If the test device executes a specially crafted command from the test case, the test result indicates that the test device has a command execution vulnerability. If the device under test does not respond or its response is inconsistent with normal behavior and is not a specially crafted request, then the test result indicates that the device under test has a memory crash vulnerability.

6. A fuzz testing device for a network server in an embedded device, characterized in that, include: The preprocessing module is used to obtain the network server program of the firmware in the device under test and then construct the function code control flow graph of the network server program. The communication interface identification module is used to obtain all communication interface functions and the communication address URL corresponding to each of the communication interface functions based on the function code control flow graph. The constraint collection module is used to perform static data flow analysis on each of the communication interface functions to obtain the parameter keywords and the constraint information corresponding to the parameter keywords in each communication interface function. The constraint information includes constraint type and constraint value, wherein the constraint type includes: string type, numeric type and network address type. The seed generation module is used to generate all fuzzy test seeds based on the communication address URL, parameter keywords, and constraint information corresponding to the parameter keywords for each of the communication interface functions. The mutation module is used to mutate each of the fuzz test seeds to generate all test cases; The testing module is used to test the device under test using all the test cases and obtain test results; The process involves performing static data flow analysis on each communication interface function to derive parameter keywords and corresponding constraint information. This includes: performing static data flow analysis on each communication interface function to identify parameter keywords; performing static data flow analysis from the position of each parameter keyword; if a condition comparison is identified in the data flow path of each parameter keyword, and the data used for condition comparison belongs to the constraint type, then collecting the condition comparison data as candidate constraint values ​​for the parameter keyword; and generating constraint information corresponding to each parameter keyword based on the constraint type and constraint value. The format of each fuzz test seed is as follows: the communication address URL corresponding to each communication interface function, the parameter keyword corresponding to the communication address URL, and the constraint information corresponding to the parameter keyword. The parameter keyword and its corresponding data are combined in the form of key-value pairs. If the parameter keyword belongs to the constraint type, the data corresponding to the parameter keyword is generated according to the constraint information. Otherwise, the value of random mutation is used as the data corresponding to the parameter keyword.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the fuzzing method for a network server in an embedded device as described in any one of claims 1 to 5.

Images