A gray-box text protocol fuzz testing method and system based on field awareness

Abstract

The present invention discloses a field-aware gray-box text protocol fuzz testing method and system. This method is based on the classic gray-box protocol fuzzer AFLNET. It adds awareness of the protocol message format to AFLNET and maintains the message format with a higher probability when generating test cases. This alleviates the problem of AFLNET's low test case acceptance rate due to its lack of protocol message format information. Specifically, the present invention divides the message in the seed into fields based on possible delimiters and records the possible values ​​of each field. The present invention then assigns different mutation strengths to each field based on the diversity of each field's values ​​and the rarity of the current value. Furthermore, the present invention further subdivides the state in the state machine indicating that the protocol implementation has successfully accepted the message based on the content of the currently received message. This method can increase the probability that the mutated test cases will be accepted by the protocol implementation under test, thereby achieving the purpose of improving testing efficiency.

Description

Technical Field

[0001] The present invention relates to the field of protocol testing technology, and provides a field-aware grey-box text protocol fuzz testing method and system. This is a mutation-based grey-box protocol fuzz testing method that can perform simple inference on the input message format. Background Art

[0002] With the accelerating pace of global digitalization and informatization, computer networks have penetrated every industry and profession, significantly boosting social and economic prosperity. However, this has also brought new risks and challenges. Today, the potential harm posed by a single cybersecurity vulnerability is unprecedentedly severe, potentially affecting all major economies worldwide. Therefore, cybersecurity has become a major issue concerning the common interests of humanity.

[0003] Fuzz testing is a highly efficient automated testing method. Its core approach is to automatically generate a large number of random test cases, then run the target program using these test cases as input. During execution, the target program's state is monitored to identify test cases that could cause the target program to crash. Due to its significant advantages in efficiency and ease of use, fuzz testing has become a key tool for network protocol testing.

[0004] Based on the method of generating test cases, protocol fuzz testing can be divided into two categories: generation-based and mutation-based. Generation-based protocol fuzz testing, exemplified by Peach and BooFuzz, generates test cases based on manually specified state machines and message templates for the protocol under test. While the test cases generated by this approach closely match the requirements of the protocol under test, adding support for new protocols requires significant manual effort and poor scalability. Furthermore, this approach's testing efficiency relies heavily on the accuracy of the templates and state machines, placing high demands on the user. Mutation-based protocol fuzz testing, exemplified by AFLNET, proposed in "AFLNET: A Greybox Fuzzer for Network Protocols," generates new test cases by randomly mutating existing seeds. This approach requires no manual provision of the protocol templates and state machines under test; it only requires a few packets captured from real traffic as initial seeds, offering strong scalability. However, this approach randomly mutates the entire message as a string, which has a high probability of disrupting the message structure. The generated test cases are likely to be rejected, impacting test efficiency.

[0005] Previously, in the field of software testing, there was also a problem that most of the test cases generated by mutating inputs with fixed formats (such as image files) did not meet the requirements, resulting in rejection by the target program, thus affecting test efficiency. To address this issue, the first work proposed was "Smart greybox fuzzing". It borrowed the idea of ​​the generation-based protocol fuzzer Peach and added manually provided input templates to the grey-box fuzzer AFL, which maintained a high probability that the test cases generated by the mutation would still meet the format requirements of the input files, effectively improving the testing effect of software whose input is a formatted file. However, AFLsmart suffers from the same problem as generation-based protocol fuzz testing. Since it requires manually provided input templates, its scalability is poor and it has high requirements for testers.

[0006] To address this issue, researchers have proposed software fuzzers that automatically infer the approximate format of inputs based on byte inference. For example, "ProFuzzer: On-the-fly Input Type Probing for Better Zero-day Vulnerability Discovery" proposes a byte-based field guessing method. It first pre-tests the initial seed, mutating each bit of the initial seed sequentially so that it takes values ​​from 0 to 255. The branch coverage and branch execution frequency achieved by the protocol under test for each value are then collected. Based on the characteristics of the test results obtained for each byte, the likely field type is guessed. Adjacent bytes of the same type are then merged into a single field, where the field type is the type of the bytes it contains. However, these methods infer the input format based on byte position. If the length of the field required by the test object is not fixed, it is difficult to obtain a relatively accurate field division. Therefore, this method is not suitable for text protocols where field length is not strictly restricted.

[0007] In summary, mutation-based protocol fuzzers offer good scalability and ease of use, but they generally lack information about the protocol message format. Most of the test cases they generate fail to meet the protocol's basic requirements and are directly rejected by the protocol implementation being tested, impacting the testing of the relevant code implementing the protocol's core logic. Existing fuzzers that consider input format either require extensive manual effort or are only suitable for binary inputs with a relatively fixed field length. Therefore, the present invention proposes a field-aware gray-box text protocol fuzz testing method to address the input format inference problem for text protocols with variable field lengths. This method segments text protocol messages and identifies fields with a high probability of restricted values, thereby deriving an approximate message format. To leverage this information, the present invention incorporates a field-level mutation strategy. While maintaining the message format essentially unchanged, this strategy reduces random mutations to restricted fields, increasing the probability that a test case will be accepted by the protocol implementation being tested. This allows more time to be spent exploring the protocol implementation's core processing logic rather than rejection conditions, ultimately achieving the goal of improving testing efficiency. Summary of the Invention

[0008] This paper proposes a field-aware gray-box text protocol fuzz testing method. This method is based on the existing mutation-based gray-box protocol fuzzer AFLNET. It incorporates inferences about message fields and their possible values, guiding the mutation-generated test case generation process to increase the probability that test cases conform to protocol specifications. This method adds functions such as field segmentation, field dictionary construction, and field-based mutation energy setting to AFLNET's test preparation phase; and adds functions such as actual field mutation energy calculation and field-level mutation strategy to AFLNET's fuzz testing phase. Furthermore, to more deeply test the protocol's core logic, this paper partially enhances AFLNET's state machine by further subdividing the states that indicate when the protocol accepts an incoming message.

[0009] Specifically, the functions added in the test preparation stage and the fuzzy testing stage of the present invention are as follows:

[0010] Ⅰ. Test preparation stage

[0011] like Figure 1 As shown, during the test preparation phase, the fuzzer needs to read in the initial seed and save it to the seed queue. When saving the seed, the method of the present invention divides the possible fields of each message in the seed and saves the division results in the seed. In addition, the value of each field of all messages in each seed is saved in the corresponding field dictionary as the possible values ​​of the corresponding field. Finally, based on the diversity of the possible values ​​of each field, the basic mutation energy of each field is calculated.

[0012] Specifically, the methods of the above three functions are as follows:

[0013] 1-1. Field Division

[0014] Divide each message in the currently read seed into fields and store the division results in the structure corresponding to the current seed in the seed queue. The specific steps are as follows:

[0015] 1-1-1. Read each message of the current seed in turn (AFLNET has divided the message of the seed);

[0016] 1-1-2. Sequentially match each byte of the current message with all delimiters used by the protocol under test until the message ends, and then go to step 1-1-4;

[0017] 1-1-3. If the current byte is one of the delimiters used by the protocol being tested, save the portion from the next byte of the last segmented field to the byte before the current byte (if any) as a non-delimited field, and save the current byte as a delimited field. Then, return to step 1-1-2;

[0018] 1-1-4. All fields of the entire message and whether they belong to the separation field are saved in sequence in the structure storing the corresponding message in the current seed structure in the seed queue, and the total number of fields contained in the current message is saved.

[0019] 1-2 Build a field dictionary

[0020] Store the values ​​of each field in each message in the initial seed in the corresponding dictionary and record the number of times each value appears. The specific steps are as follows:

[0021] 1-2-1 1-2-1. Traverse all initial seeds. Once the traversal is completed, the field dictionary is initialized.

[0022] 1-2-2 1-2-2. Traverse each message structure in the structure representing the current initial seed, and return to step 1-2-1 after traversal is completed;

[0023] 1-2-3 1-2-3. Traverse each necessary field in the current message (the number of fields contained in the message with the least fields in the initial seed is regarded as the number of necessary fields, and the first necessary fields of each message are regarded as necessary fields), check whether the current value exists in the field dictionary corresponding to the field, if so, add 1 to the count; otherwise, add the current value and set the count to 1;

[0024] 1-2-4 1-2-4. Traverse the remaining fields of the current message and check whether the current value exists in the field dictionary corresponding to the non-essential fields (all use the same field dictionary). If so, add 1 to the count; otherwise, add the current value and set the count to 1. Then, return to step 1-2-2.

[0025] 1-3 field initial mutation energy setting

[0026] 1-3-1 Calculate the initial mutation energy for each field based on the value diversity of each field in the initial seed. Generally, fields with low value diversity are more likely to have restricted values, so a lower initial mutation energy is set. The specific steps are as follows:

[0027] 1-3-2 1-3-1. Traverse the field dictionary corresponding to each necessary field. After traversal is completed, go to step 1-3-3;

[0028] 1-3-3 1-3-2. Calculate the value diversity of the current field based on the number of possible values ​​that have been saved for the current field. Then, map the value diversity onto a smooth curve as the initial mutation energy of the current field. Then, return to step 1-3-1;

[0029] 1-3-4 1-3-3. Based on the number of remaining fields (the maximum number of fields in the message minus the number of necessary fields) and the number of possible values ​​that have been saved, calculate the diversity of non-essential fields and map it to a smooth curve as the initial mutation energy shared by all non-essential fields.

[0030] II. Fuzz Testing Phase

[0031] like Figure 2 As shown, after entering the fuzz testing phase (the main loop of the fuzzifier), the fuzzifier first selects a target state each time, and then selects a seed corresponding to the target state. Afterwards, a series of mutations are performed on the selected seeds to generate a large number of test cases, and these test cases are sent to the target server to detect whether there is new coverage or new state transitions. Finally, the test cases that can trigger new coverage or new state transitions are saved as seeds. The present invention adds a field-level deterministic mutation strategy and a field-level non-deterministic mutation strategy to the original mutation strategy, and calculates an actual mutation energy for each field to control the number of field-level non-deterministic mutations for each field. In addition, after discovering a new seed, it is also necessary to use the same method as the test preparation phase to divide it into fields, and update the field dictionary and field initial energy.

[0032] Specifically, the added mutation strategy and the actual mutation energy of the field are calculated as follows:

[0033] 2-1 Field-level deterministic mutation strategy

[0034] For each seed, the deterministic mutation strategy is used at most once. Once the deterministic mutation strategy is determined, it will be applied sequentially to each field of the message used for mutation by the current seed. The number of test cases generated by the deterministic mutation strategy is not affected by the mutation energy. Two deterministic mutation strategies are provided for delimiter fields and non-delimiter fields respectively. The specific strategies are as follows:

[0035] 2-1-1. Deterministic mutation strategy for delimiter fields:

[0036] Field dictionary replacement: replace the current field with each value in the corresponding field dictionary in turn;

[0037] Special character replacement: Replace the current field with the special character value provided by BooFuzz ​​in sequence.

[0038] 2-1-2. Deterministic mutation strategy for non-delimiter fields:

[0039] Unit flip: flip each bit of the current field value in sequence;

[0040] Dictionary value replacement / insertion: Replace the current field with each dictionary value (including the input dictionary and the automatically constructed field dictionary) in turn, and then insert these dictionary values ​​before / after the current field in turn.

[0041] 2-2 Field-level non-deterministic mutation strategy

[0042] Only non-delimiter fields are used for field-level non-deterministic mutation strategies. The number of times it is used is determined by the actual mutation energy of each field, and a minimum value is set (the value used in the evaluation of this invention is 16). There are three field-level non-deterministic mutation strategies (the recommended mutation energy distribution ratio is 1:1:3), namely:

[0043] Extra-long special characters: Randomly use a large number of repetitions (random length) of special characters that are prone to crashes provided by BooFuzz ​​to replace the current field; for example, if the special character that is prone to crashes is %, and the current random length is 1024, then replace the current field with 1024 %.

[0044] Field duplication: randomly copy a field from the current message and randomly splice it before or after the current field;

[0045] Field-level corruption: Randomly mutate a number of times based on the field length, and perform cumulative mutations. Single mutation methods include: ① flipping a bit; ② randomly setting the value of a byte; ③ randomly deleting some consecutive bytes (random length); ④ randomly inserting some consecutive bytes (random length); ⑤ randomly replacing some consecutive bytes.

[0046] Calculation of actual variation energy of 2-3 fields

[0047] Based on the basic mutation energy of the current seed (provided by AFLENT), the rarity of the values ​​of each field in the message to be mutated, and the initial mutation energy of the field, the actual mutation energy is calculated to indicate how many field-level non-deterministic mutations to perform on each field. The specific steps are as follows:

[0048] 2-3-1. Traverse each field of the message to be mutated, and end the calculation process after traversal is completed;

[0049] 2-3-2. If the current field is a delimiter field, the mutation energy is not calculated (no field-level non-deterministic mutation is performed on the delimiter field), and the process returns directly to step 2-3-1; otherwise, the process goes to step 2-3-3;

[0050] 2-3-3. Calculate the ratio of the current field value to the total number of occurrences of all values ​​in the corresponding field dictionary, and use this as the rarity of the current field value;

[0051] 2-3-4. Calculate the actual mutation energy of the current field based on the seed's base mutation energy, the field's rarity, and the current field's base mutation energy. Then, return to step 2-3-1.

[0052] Furthermore, the present invention also partially enhances the state machine. For the state where the return code represents that the protocol has successfully accepted the current message, the state is further subdivided by using the return code + the key field (manually specified key field number) value of the currently sent message.

[0053] Based on the above method, the present invention implements a field-aware gray-box text protocol fuzz testing system. This system is implemented based on AFLNET, and the following modules are added to the AFLNET framework:

[0054] Field Division Module: This module is used to divide each message in the seed into fields based on the delimiter and identify each field as a delimiter field. In addition, this module also counts the number of fields contained in each message.

[0055] Field Dictionary Construction and Update Module: This module maintains a dictionary for each required field and all non-required fields in the test protocol message. It stores the values ​​of each field that have appeared in the existing seed and the number of occurrences of each value. During fuzz testing, this module is used to update all field dictionaries whenever a new seed is discovered.

[0056] Field Mutation Energy Calculation Module: During the test preparation phase, this module sets a base mutation energy for each field based on the diversity of its values ​​in the initial seed. During the fuzz testing phase, it calculates an actual mutation energy for each field, used to control the number of non-deterministic field-level mutations, based on the rarity of each field's value in the current mutated message, the seed's mutation energy, and the field's base mutation energy.

[0057] Field-level mutation module: This module contains operators for field-level deterministic and non-deterministic mutations. Different mutation operators are provided depending on whether the field is a delimiter field.

[0058] State machine enhancement module: This module is used to subdivide the response code indicating that the protocol has successfully accepted the message (i.e., the state in the AFLNET state machine) after obtaining the response code sequence obtained by sending each test case.

[0059] The main advantages of the present invention are:

[0060] The present invention can infer the message format of the protocol and the possible values ​​of the value-restricted fields therein without manually providing a protocol template, thereby increasing the possibility that the generated test cases comply with the specifications of the protocol being tested and further increasing the number of branches that can be covered.

[0061] The present invention can adjust the mutation weight of each field in real time according to statistical information during the test process, thereby spending more time on fields whose mutation may have a greater impact on the execution path, thereby improving test efficiency.

[0062] The present invention further subdivides the state indicating that the protocol correctly accepts the message, reducing the possibility of classifying a large number of actually different protocol states into the same state, thereby enabling a more in-depth exploration of the main logic of the protocol implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 Schematic diagram of the process of the present invention in the test preparation stage.

[0064] Figure 2 This is a flow chart of the present invention in the fuzzy testing stage.

[0065] Figure 3 This is an example of field division using the RTSP protocol as an example.

[0066] Figure 4 This example shows how to construct a field dictionary using the RTSP protocol as an example.

[0067] Figure 5 This is an example of enhancing the state machine using the RTSP protocol as an example.

[0068] Figure 6 This is the result of evaluating the implementation of the present invention. DETAILED DESCRIPTION

[0069] A possible embodiment of the present invention will be described in detail below in conjunction with the accompanying drawings of the present invention. The following embodiment is only used to further illustrate the present invention and is not the only implementation of the present invention.

[0070] The present invention proposes a gray-box text protocol fuzz testing method based on field perception, which is used to solve the input format inference problem of text protocols with non-fixed field lengths. This method segments the text protocol message and identifies the fields with a high probability of restricted values, thereby obtaining an approximate message format. In order to utilize the obtained message format information, the present invention adds a field-level mutation strategy. While keeping the message format basically unchanged, it reduces the random mutation of the value-restricted fields and increases the probability that the test case is accepted by the protocol being tested. This allows more time to be spent on exploring the main processing logic of the protocol implementation rather than the rejection conditions, and ultimately achieves the goal of improving test efficiency.

[0071] As described in the Summary of the Invention, the present invention is implemented based on AFLNET. Therefore, similar to AFLNET, the present invention can be divided into two phases at a high level: test preparation phase and fuzzy testing phase.

[0072] I. Test preparation stage

[0073] The present invention adds functions such as field partitioning, field dictionary construction, and field basic variation energy setting to the initial seed reading step in the test preparation phase of AFLNET. Specifically, one implementation of the above functions is as follows:

[0074] 1-1. Field Division

[0075] Divide each message in the currently read initial seed into fields, and store the division results in the structure representing the current seed in the seed queue. Taking the RTSP protocol as an example, the division results are as follows Figure 3 The specific steps are as follows:

[0076] 1-1-1. Read the structure representing the current seed in the seed queue;

[0077] 1-1-2. Traverse the structure corresponding to each message in the structure corresponding to the current seed in turn, and exit when the traversal is completed;

[0078] 1-1-3. Read the complete value of the current message from the seed file based on the message start byte and end byte given in the current message structure;

[0079] 1-1-4. Traverse each byte of the current message from the beginning. If the current byte is one of the delimiters (manually given) used by the current protocol under test, check whether the end byte of the last delimited field is the byte before the current byte. If so, go to step 1-1-5; otherwise, go to step 1-1-6. After all bytes have been read, return to step 1-1-2;

[0080] 1-1-5. Treat the current byte as an independent field and set the type to delimiter. Add the field to the field list of the current message, and then increase the field count of the current message by 1. Then, return to step 1-1-4;

[0081] 1-1-6. Treat the entire field from the end byte of the previous segment to the byte before the current segment as a single segment, setting its type to non-delimiter. Then, treat the current segment as a separate segment, setting its type to delimiter. Add these two segments to the current message's field list, then increase the current message's field count by 2. Then, return to step 1-1-4.

[0082] The pseudo code of the above process is as follows:

[0083]

[0084]

[0085] As shown in the pseudocode above, each message of the current seed is first read in sequence (lines 1 to 23); then, all bytes of each message are traversed in sequence (lines 8 to 22); if a delimiter byte is encountered, whether one or two fields should be added is determined based on whether there are any undivided bytes before the current byte (lines 10 to 18).

[0086] 1-2. Field dictionary construction

[0087] Create a dictionary for each necessary field of the message (determined by the number of fields in the message with the least number of fields in the initial seed), and create a common dictionary for the remaining fields, saving the values ​​of each field that appeared in the seed and counting them. Taking the first field of the RTSP protocol as an example, the process of constructing the field dictionary is as follows: Figure 4 The specific steps are as follows:

[0088] 1-2-1. Read the minimum number of fields contained in a single message in the initial seed, and initialize the minimum number of fields + 1 field dictionary. Except for the last field dictionary, each field dictionary corresponds to one field (as a required field); the last field dictionary corresponds to all remaining fields. The key of the dictionary is the field value, and the value is the number of times the key value appears in the seed;

[0089] 1-2-2. Traverse all initial seeds (structures stored in the queue) and complete the construction of the end field dictionary;

[0090] 1-2-3. Traverse each message (structure) of the current seed, and return to step 1-2-2 after traversal is completed;

[0091] 1-2-4. Traverse each field of the current message and add its value to the corresponding field dictionary. If the current value already exists, increase the count by 1. Then return to step 1-2-3.

[0092] The pseudo code of the above process is as follows:

[0093]

[0094] As shown in the above pseudocode, first create the necessary number of fields + 1 field dictionary (line 1); then traverse all seeds in the seed queue (lines 2 to 12); for each seed, traverse all the messages it contains (lines 4 to 11); for each message, add the fields it contains to the corresponding field dictionary (lines 6 to 10).

[0095] 1-3. Field basic variation energy setting

[0096] The basic variation energy of each sub-segment is calculated based on the diversity of each field's values, where all non-essential fields share a common variation energy. The specific calculation steps are as follows:

[0097] 1-3-1. First, calculate the value diversity of each field. The formula is as follows:

[0098]

[0099] Where diversity(x) indicates that the diversity of the x-th field is currently being calculated; field_values_count(x) indicates the number of values ​​that the x-th field has appeared in all initial seeds; total_regions indicates the total number of messages in all initial seeds; min_fields indicates the number of fields contained in the message with the least number of fields in the initial seed; and max_fields indicates the number of fields contained in the message with the largest number of fields in the initial seed.

[0100] 1-3-2. Map the diversity of each field onto a smooth curve as the basic variation energy of each field. The formula is as follows:

[0101]

[0102] in, The basic mutation energy calculation formula maps the diversity of [0,1] to the basic mutation energy of [1,100]. The specific calculation formula is as follows:

[0103]

[0104] Among them, f(d) is the deformation of the sigmoid function, and its formula is as follows:

[0105]

[0106] II. Fuzz Testing Phase

[0107] The present invention adds the calculation of the actual field variation energy during the fuzzy testing phase of AFLNET and incorporates a field-level variation strategy. After discovering a new seed, the present invention will perform field division on the new seed and update the field dictionary and field basic variation energy set in the preparation phase. The field-level variation strategy has been described in the invention content, and the methods used for field division of the message and updating the field dictionary and basic variation energy are the same as those used in the test preparation phase, so they will not be repeated here. Specifically, the method for calculating the actual field variation energy is as follows:

[0108] 2-1 Calculation of actual field variation energy

[0109] Based on the mutation energy of the current seed (the original mutation energy of AFLNET), the rarity of each field value in the mutation message, and the corresponding field initial energy, the actual mutation energy of each field is calculated. The specific formula is as follows:

[0110] 2-1-1. First, calculate the rarity of each field value. The formula is as follows:

[0111]

[0112] Among them, repeated_times(field_value(x)) is the number of times the value of the xth field of the current message appears in the dictionary; total_regions' is the total number of messages used to generate the dictionary;

[0113] 2-1-2. Further calculate the actual variation energy of each field, the formula is as follows:

[0114]

[0115] Among them, seed_energy is the overall mutation energy of the current seed provided by AFLNET; base_energy(x) is the base mutation energy of the x-th field; min_fields' is the number of fields of the message with the least number of fields in the seed used to generate the dictionary. The first min_fields' fields are mapped one-to-one to the dictionary and the base mutation energy, while all subsequent fields are merged into one field in the dictionary and the base mutation energy; max_fields' is the number of fields of the message with the largest number of fields in the seed used to generate the dictionary.

[0116] In addition, the present invention also partially enhances the state machine used by AFLNET, and subdivides the state of the protocol to correctly accept the current message. Taking the RTSP protocol as an example, the enhancement of the state machine is as follows: Figure 5 Specifically, to indicate that the protocol implementation has correctly accepted the current message, the return code and the value of the key field of the current message (the key field number is specified by the protocol under test) are combined into a string. This combined string is then hashed into a 32-bit unsigned integer, which is used as the segmented state.

[0117] To verify the effectiveness of the present invention, we first compared the acceptance rates of the test cases generated by the present invention with those generated by AFLNET. Specifically, we allocated one CPU core to each tool, tested for one hour each time, repeated the experiment three times, and took the average of the results. The specific results are shown in the following table and Figure 6 As shown in (a), our method can indeed significantly improve the acceptance rate of test cases as expected.

[0118]

[0119] To further verify that the present invention can improve the final effect of fuzz testing, we also compared the number of branches that the present invention can cover with that of AFLNET. Specifically, we allocated 1 CPU core to each tool, and each test lasted 10 hours. We repeated the experiment 3 times and took the average of the results. The specific results are shown in the following table and Figure 6 As shown in part (b), it can be seen that the present invention can indeed cover more branches than the original AFLNET on the basis of improving the acceptance rate of test cases, indicating that the method of the present invention is effective.

[0120]

[0121] It should be noted that the above specific embodiments are only used to illustrate the present invention and are not intended to limit the present invention. The various specific numerical values ​​used in the examples are only used as examples. The accompanying drawings take the RTSP protocol as an example for convenience of explanation only and do not mean that this method is only applicable to the RTSP protocol. Those skilled in the art can design other embodiments to replace the above specific embodiments without departing from the scope of the appended claims, which should not be understood as new methods. All equivalent changes and modifications made according to the scope of the invention of the present invention are within the scope of protection of the present invention.

Claims

1. A field-aware grey-box textual protocol fuzz testing method based on the existing mutation-based grey-box protocol fuzzer AFLNET, characterized by: Based on AFLNET, we add speculation on message fields and their possible values, and use this to guide the process of mutation generation of test cases, thereby increasing the probability that the test cases comply with the protocol specifications; Added functions for field division, field dictionary construction, and field basic variation energy setting in the test preparation phase of AFLENT; In the fuzz testing phase of AFLNET, we added the actual mutation energy calculation and field-level mutation strategy functions. In addition, to further test the main logic of the protocol, we also partially enhanced the state machine used by AFLNET to subdivide the state indicating the protocol accepting the sent message. Field division: Divide each seed message into fields according to the delimiter, and identify each field as a delimiter field; in addition, the number of fields contained in each message is counted; Field dictionary construction: maintain a dictionary for each required field and all non-essential fields of the current test protocol message, which is used to store the values ​​of each field that have appeared in the existing seed and the number of times each value appears; During fuzz testing, all field dictionaries are updated whenever a new seed is found; Setting the basic mutation energy of fields and calculating the actual mutation energy: During the test preparation phase, a basic mutation energy is set for each field based on the diversity of its values ​​in the initial seed. During the fuzz testing phase, an actual mutation energy is calculated for each field to control the number of field-level non-deterministic mutations based on the rarity of the value of each field in the current mutated message, the overall mutation energy of the seed itself, and the basic mutation energy of the field. Field-level mutation strategy: includes field-level deterministic mutation strategy and field-level non-deterministic mutation strategy; Different mutation strategies are provided depending on whether the field is a delimiter field. Field-level mutation strategies are divided into two categories: field-level deterministic mutation strategies and field-level non-deterministic strategies. Different mutation strategies are used for delimiter fields and non-delimiter fields. State machine enhancement: After obtaining the response code sequence obtained from sending each test case, it is used to subdivide the response code indicating that the protocol implementation successfully accepted the message. In other words, the state is subdivided using the "return code + key field value of the currently sent message" method.

2. A field-aware gray-box text protocol fuzz testing method according to claim 1, characterized in that The following functions are available during the test preparation phase: 1-1-1. Field division: Divide each message in the currently read initial seed into fields, and store the division results in the structure corresponding to the current seed in the seed queue; 1-1-2. Build a field dictionary: Store the values ​​of each field of each message in the initial seed in the corresponding dictionary, and record the number of times each value appears; 1-1-3. Calculate the basic mutation energy of the field: Calculate the basic mutation energy of each field based on the value diversity of each field in the initial seed.

3. A field-aware gray-box text protocol fuzz testing method according to claim 1 or 2, characterized in that The following functions are provided during the fuzz testing phase: 1-2-1 Calculate the actual mutation energy of the field: Based on the basic mutation energy of the current seed, the rarity of the values ​​of each field in the message that needs to be mutated, and the basic mutation energy of the field, calculate the actual mutation energy used to indicate how many field-level non-deterministic mutations to perform on each field.

4. The field-aware gray-box text protocol fuzz testing method according to claim 3, characterized in that: The basic variation energy of each field is calculated during the test preparation phase as follows: 2-1 Calculation of field-based variation energy: 2-1-1 First, calculate the value diversity of each field. The formula is as follows: Where, diversity(x) indicates that the diversity of the xth field is currently being calculated; field_values_count(x) indicates the number of different values ​​that the xth field has appeared in all initial seeds; total_regions indicates the total number of messages in all initial seeds; min_fields indicates the number of fields contained in the message with the least number of fields in the initial seed; max_fields indicates the number of fields contained in the message with the most fields in the initial seed; 2-1-2 maps the diversity of each field to a smooth curve as the basic variation energy of each field. The formula is as follows: in, The basic mutation energy calculation formula maps the diversity of [0,1] to the basic mutation energy of [1,100]. The specific calculation formula is as follows: Among them, f(d) is the deformation of the sigmoid function, and its formula is as follows:

5. The field-aware gray-box text protocol fuzz testing method according to claim 3, characterized in that: The actual mutation energy of each field is calculated during the actual fuzz testing. The calculation method is as follows: 2-2-1 First calculate the rarity of each field value. The formula is as follows: Among them, repeated_times(field_value(x)) is the number of times the value of the xth field of the current message appears in the dictionary; total_regions' is the total number of messages used to generate the dictionary; 2-2-2 Calculate the actual variation energy of each field using the following formula: Among them, seed_energy is the overall mutation energy of the current seed provided by AFLNET; base_energy(x) is the base mutation energy of the x-th field; min_fields' is the number of fields of the message with the least number of fields in the seed used to generate the dictionary. The first min_fields' fields are mapped one-to-one to the dictionary and the base mutation energy, while all subsequent fields are merged into one field in the dictionary and the base mutation energy; max_fields' is the number of fields of the message with the largest number of fields in the seed used to generate the dictionary.

6. The field-aware gray-box text protocol fuzz testing method according to claim 1, characterized in that: Field-level mutation strategies are divided into two categories: field-level deterministic mutation strategies and field-level non-deterministic strategies. The mutation strategies used for delimiter fields and non-delimiter fields are different.

7. The field-aware gray-box text protocol fuzz testing method according to claim 6, characterized in that: The field-level deterministic mutation strategy is as follows: For each seed, the deterministic mutation strategy is used at most once. Once the deterministic mutation strategy is determined, it will be used in turn for each field of the message used for mutation by the current seed. The number of test cases generated by the deterministic mutation strategy is not affected by the actual mutation energy. Two deterministic mutation strategies are provided for delimiter fields and non-delimiter fields respectively. The two strategies are as follows: 3-1-1 Deterministic mutation strategy for delimiter fields: Field dictionary replacement: replace the current field with each value in the corresponding field dictionary in turn; Special character replacement: replace the current field with the special character value provided by BooFuzz ​​in sequence; 3-1-2 Deterministic mutation strategy for non-delimiter fields: Unit flip: flip each bit of the current field value in sequence; Dictionary value replacement / insertion: Replace the current field with each dictionary value in turn, and insert these dictionary values ​​before / after the current field in turn; the dictionary includes the input dictionary and the automatically constructed field dictionary.

8. The field-aware gray-box text protocol fuzz testing method according to claim 6, characterized in that: The field-level non-deterministic mutation strategy is as follows: Only non-delimiter fields are used for field-level non-deterministic mutation strategies. The number of times it is used is determined by the actual mutation energy of each field, and a minimum value is set. There are three types of field-level non-deterministic mutation strategies: Extra-long special characters: Randomly replace the current field with a large number of repetitions of special characters that are prone to crashes provided by BooFuzz; Field duplication: randomly copy a field from the current message and randomly splice it before or after the current field; Field-level destruction: Randomly mutate a number of times according to the field length, and perform cumulative mutations of this number; among them, the single mutation methods include: ①. 1-bit flip; ②. Randomly set the value of one of the bytes; ③. Randomly delete some consecutive bytes; ④. Randomly insert some consecutive bytes; ⑤. Randomly replace some consecutive bytes.

9. A field-aware grey-box text protocol fuzz testing system, characterized by: Inferring the protocol format and possible values ​​of each field without manually providing a protocol template. This module includes the following: Field division module: This module is used to divide each seed message into fields according to the delimiter, and identify whether each field is a delimiter field; in addition, this module also counts the number of fields contained in each message; Field dictionary construction and update module: This module maintains a dictionary for each required field and all non-essential fields of the current test protocol message, which is used to store the values ​​of each field that have appeared in the existing seed and the number of times each value appears; During fuzz testing, every time a new seed is found, all field dictionaries will be updated using this module; Field mutation energy calculation module: During the test preparation phase, this module sets a basic mutation energy for each field based on the diversity of its values ​​in the initial seed. During the fuzz testing phase, an actual mutation energy is calculated for each field to control the number of field-level non-deterministic mutations based on the rarity of the value of each field in the current mutated message, the overall mutation energy of the seed itself, and the basic mutation energy of the field. Field-level mutation module: This module includes field-level deterministic mutation strategies and field-level non-deterministic mutation strategies. Different mutation strategies are provided based on whether the field is a delimiter field. Field-level mutation strategies are divided into two categories: field-level deterministic mutation strategies and field-level non-deterministic strategies. Different mutation strategies are used for delimiter fields and non-delimiter fields. State machine enhancement module: After obtaining the response code sequence obtained by sending each test case, this module is used to subdivide the response code indicating that the protocol has successfully accepted the message; that is, the state is subdivided by using the return code + the key field value of the currently sent message.

10. The field-aware gray-box text protocol fuzz testing system according to claim 9, characterized in that: The field-level deterministic mutation strategy is as follows: For each seed, the deterministic mutation strategy is used at most once; once the deterministic mutation strategy is determined, it will be used in turn for each field of the message used for mutation by the current seed, and the number of test cases generated by the deterministic mutation strategy is not affected by the actual mutation energy; two deterministic mutation strategies are provided for delimiter fields and non-delimiter fields respectively. The field-level non-deterministic mutation strategy is as follows: The field-level non-deterministic mutation strategy is only used for non-delimiter fields. The number of times it is used is determined by the actual mutation energy of each field, and a minimum value is set. There are three types of field-level non-deterministic mutation strategies.

Images