Soap protocol black box fuzzing method and system based on abstract syntax tree

Abstract

The application provides a SOAP protocol black box fuzzing test method and system based on an abstract syntax tree, the method and system convert the SOAP protocol into an abstract syntax tree to obtain a production, and utilize the production to guide variation in units of fields, and mainly include the following stages: an abstract syntax tree conversion stage: traffic during communication with a to-be-tested target is captured and converted into an abstract syntax tree; a production extraction stage: context-sensitive grammar is learned from the abstract syntax tree and a production is extracted, and a production pool is maintained; a fuzzing variation stage: the production pool guides variation, variation is divided into three stages and different variation strategies are configured; and a vulnerability detection stage: a variation message is sent, heartbeat monitoring listens to the state of the to-be-tested equipment, and detects and reports vulnerabilities in a timely manner. The application effectively improves the black box fuzzing test efficiency of the SOAP protocol, and is suitable for vulnerability mining of all communication targets using the SOAP protocol or high-level protocols based on the SOAP protocol.

Description

Technical Field

[0001] This invention belongs to the field of IoT protocol vulnerability mining, specifically involving a black-box fuzzing test method and system for SOAP protocol based on abstract syntax tree. Background Technology

[0002] The Simple Object Access Protocol (SOAP) is a lightweight, simple, XML-based protocol. A SOAP message is an XML document containing a required SOAP wrapper, an optional SOAP header, and a required SOAP body.

[0003] Currently, the existing papers related to XML format fuzz testing mainly include:

[0004] The paper "Skyfire: Data-driven seed generation for fuzzing" designs a seed generation method for XML data characteristics. It obtains production rules by learning probabilistic context-sensitive grammar, and then uses the learned production rules to recursively obtain seeds to guide mutation. The paper "Superion: Grammar-Aware GreyboxFuzzing" parses each test input into an abstract syntax tree and introduces a syntax-aware pruning strategy. In addition, it proposes two syntax-aware mutation strategies that can quickly extend fuzzy exploration beyond syntax parsing. The paper "FuzzingWith Optimized Grammar-Aware Mutation Strategies" uses power scheduling and subtree pooling to optimize the mutation strategy. It optimizes the power scheduling of abstract syntax tree nodes based on a probabilistic model, adaptively determines the time budget of mutation nodes, and replaces mutation nodes and their subtrees with nodes selected from the subtree pool.

[0005] Fuzzing methods for XML format encounter obstacles when extended to protocol fuzzing. Existing fuzzing methods for XML data, such as Skyfire, require collecting a large number of XML data samples before testing to learn production rules and enrich the corpus. When extending to the SOAP protocol, obtaining SOAP protocol messages is more difficult than obtaining XML format data, often requiring packet capture in a real-world environment, and the amount of data that can be obtained is far less than that of ordinary XML data. Furthermore, XML data is generally much larger than SOAP protocol messages, so methods for XML data have a coarse-grained mutation granularity, making it difficult to conduct in-depth exploration of specific fields. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and propose a black-box fuzzy testing method and system for SOAP protocol based on abstract syntax tree.

[0007] To achieve the above objectives, the technical solution specifically adopted by the present invention is as follows:

[0008] A black-box fuzzing method for SOAP protocol based on abstract syntax trees (ASTs) comprises four stages: AST generation, production rule extraction, fuzzing mutation, and vulnerability detection; wherein:

[0009] 1) Abstract Syntax Tree Generation Stage: Capture real SOAP protocol messages and parse them into an abstract syntax tree.

[0010] 2) Production Extraction Phase: Traverse all nodes of the abstract syntax tree. For the current node, use a tuple t = (context, production) to record the node's context information and production, and add it to the production pool. Here, context is a quadruple including the great-grandfather node, grandfather node, parent node, and first sibling node, and production is the production formed by combining the current node and its child nodes. By capturing a large number of communication messages, a production pool is constructed to generate high-quality seeds for the mutation phase.

[0011] 3) Fuzzy mutation stage: First, take a real SOAP protocol message as the initial seed, parse it into an abstract syntax tree, and use the production rules of the production rule pool as a guide to apply different mutation algorithms to the message in three stages.

[0012] 4) Vulnerability Detection Phase: The monitor is responsible for listening to the IP address and port of the object under test. When the device crashes, causing the port to close or the network connection to be interrupted, the crash information is promptly sent back to the fuzz processor. The fuzz processor will store the current sequence of sent messages when it receives the crash message. Testers can call it up at any time to analyze the cause of the crash.

[0013] Furthermore, the SOAP protocol black-box fuzz testing method based on abstract syntax trees described in this invention includes the following steps:

[0014] S1 Abstract Syntax Tree Generation Phase

[0015] Capture and convert the messages during communication with the target under test into an abstract syntax tree, which includes the following:

[0016] S1.1 Real Traffic Packet Capture

[0017] Collect the required SOAP protocol communication messages on the network, or use the Wireshark tool to capture packets and obtain the actual SOAP protocol traffic messages. Add the collected SOAP protocol messages to the collection Packet_SOAP, use Python's Scapy library to parse and extract the messages in Packet_SOAP, generate XML format message data, and add it to the XML data collection Packet_XML.

[0018] S1.2 Abstract Syntax Tree Transformation

[0019] Each XML message data in the Packet_XML set in step S1.1 is converted into an instance of the corresponding abstract syntax tree and added to the abstract syntax tree set AST_XML. The sum of the leaf nodes of all abstract syntax trees in AST_XML is the original corresponding XML message data.

[0020] S2 Production Extraction Stage

[0021] The abstract syntax tree set AST_XML from step S1.2 is processed through context-sensitive parsing to transform the tree structure into a production store and a production pool R. c Specifically, it includes the following:

[0022] S2.1 Context-Sensitive Syntax Definition

[0023] Similar to content-free grammar (CFG), context-sensitive grammar (CSG) defines a quadruple G = (N, T, R, S), where,

[0024] N is a finite set of nonterminal symbols.

[0025] T is a finite set of terminal symbols.

[0026] R is a finite set of context production rules, where a production rule follows the structure α→β, where α∈N and β∈N∪T.

[0027] S is the start symbol, used to indicate the starting point of the grammar. And S∈N.

[0028] The structure of the abstract syntax tree is transformed into a CSG, where N stores all non-leaf nodes of the tree, T stores all leaf nodes, R stores the parent-child relationships of the tree, and S is the root node of the tree.

[0029] S2.2 Production Extraction

[0030] S2.2.1 Initialize the production set R by taking the abstract syntax tree set AST_XML obtained in step S1.2 as input. cIf empty, for each Abstract Syntax Tree (AST) in the set AST_XML, starting from the root node, traverse all non-leaf nodes of the AST in level order to obtain the context information of each non-leaf node: context =<great-grandfather,grandfather,father,first-brother> The context stores the node's context information and consists of four attributes: great-grandfather node, grandfather node, parent node, and first sibling node.

[0031] S2.2.2 Define a production rule production = α → β, where production ∈ R, α is a non-leaf node of the abstract syntax tree AST, and β is a child node of α. For each distinct child node β, a production rule will be generated.

[0032] Taking the Abstract Syntax Tree (AST) and context information as input, a level-order traversal of all non-leaf nodes of the AST is performed. The context of the current node obtained in step S2.2.1 is combined with the production rule (production) and stored as a tuple t = (context, production) and added to the production pool R. c .

[0033] S2.2.3 Take all pairs t as input, if the production pool R c If there is no duplicate t in R, then add it to R. c This is used for the next stage of SOAP message fuzzing and mutation operations.

[0034] S3 Fuzzy Variation Stage

[0035] During the fuzzing process, the seed packet... i The data is stored in the fuzzer as fields, with each field being the Syntax Abstraction Tree (AST) corresponding to the message. i A leaf node; seed mutation is performed on a field-by-field basis. Device status is monitored after each round of test case delivery, and anomalies are recorded promptly. Mutation is divided into three phases, each configured with a different mutation algorithm strategy, specifically including the following:

[0036] S3.1 Initial Seed Acquisition

[0037] The initial seed for the mutation process comes from packet captures of real traffic. A packet from real SOAP protocol traffic that responds with a 200 OK message is selected as the initial seed packet. i Transform it into an AST (Syntax Tree) of the seed message. i traversing the AST iAll leaf nodes undergo three phases of mutation.

[0038] S3.2 First Stage Mutation

[0039] Generate pool R c With Abstract Syntax Tree (AST) i As input, perform complete matching and substitution operations on the production rules. Traverse all leaf nodes of the abstract syntax tree; for each leaf node, use the context information of its parent node in the production rule set R. c The system searches for matching production terms. If a production with the same context information is found, and the parent node of the production term matches the parent node of the current leaf node, and the child nodes of the production term are leaf nodes, then the current leaf node is replaced with the successor of that production term. This is then passed as a mutated message to the next stage and sent to the device under test.

[0040] The purpose of this stage of mutation is to conduct extensive testing, striving to cover more test cases in the test space. Replacing leaf nodes can easily cover more functional domains.

[0041] In the production pool R c After all matching nodes have been replaced, the mutation enters the second stage.

[0042] S3.3 Second Stage Mutation

[0043] Generate pool R c Abstract Syntax Tree (AST) i The mutation policy pool ST is used as input. ST contains four mutation policies for tree-like structures, used to detect whether the device can handle certain semantic issues. The main mutation policies in the policy pool are:

[0044] (1) Replacement operation of production rules in different contexts: For leaf nodes, replacement is no longer limited to the same context; as long as the antecedents of the production rules are the same, replacement will be performed. Search the production rule set R. c In the production rules, if the context is not equal and the predecessor of production is equal, the leaf node is replaced with the successor of production.

[0045] (2) Node deletion: randomly delete a leaf node of the tree. Traverse all non-leaf nodes of the tree. If there is a child node that is a leaf node, randomly delete a leaf node.

[0046] (3) Node addition: Add a new leaf node from any production pool under the same production rule, and search the production rule set R using the context of the leaf node's parent node as the index. cIn the production rules, if the context is equal and the predecessor of the production is equal, the production is added as a sibling node of the parent node.

[0047] (4) Node swapping: randomly swap the values ​​of several leaf nodes, traverse all non-leaf nodes, and if a node has multiple child nodes, swap the order of the child nodes.

[0048] Using the policies in the mutation policy pool, the seed is mutated through the production pool, and the mutated message is handed over to the next stage for transmission to the device under test. After all policies in the mutation policy pool have been processed, the mutation process enters the third stage.

[0049] S3.4 Stage 3 Mutation

[0050] S3.4.1 Mutation Energy Calculation

[0051] In the third stage of mutation, the generative pool R will be generated. c With Abstract Syntax Tree (AST) i As input, for AST i Leaf nodes undergo mutation, and the mutation energy of leaf nodes is calculated based on the number of leaf node productions. The mutation time for each leaf node in the third stage is allocated according to the following formula.

[0052]

[0053] Here, `Energy` is a pre-defined unit energy to ensure that the mutation time for each leaf node is not too short, thus preventing insufficient testing; it is typically 20,000 to 30,000 CPU time slices. `α` is the importance parameter of the current node, specified by the tester when writing the test configuration file; the default value is 1, indicating that all nodes have the same importance. `e` is the mutation energy allocated to the current leaf node; the fewer production rules the current leaf node has, the more random mutation time it is allocated.

[0054] S3.4.2 Random Mutation

[0055] The third stage of mutation will likely destroy the original structure of the field in order to test the device's ability to handle structurally abnormal messages. This stage of mutation includes the following methods: (1) excessively long strings (2) parsing interference (3) special ASCII codes (4) boundary values ​​(5) random mutation. The replacement characters for the first four mutation methods will be stored in the list lib. During the test time, they will be mutated in sequence. After all the characters in lib have been used, the remaining time will be used for random mutation, randomly generating characters to replace the original field.

[0056] S4 vulnerability detection phase

[0057] The fuzz processor receives the mutated seed and sends it to the device under test. It uses heartbeat monitoring to listen to the device status and feeds back to the fuzz processor. If the device crashes, it reports a vulnerability, including the following:

[0058] S4.1 Heart Rate Monitoring

[0059] Vulnerability detection primarily utilizes a heartbeat detection mechanism. During system operation, a detection message is sent to the device under test every 2 seconds. If there is no response, the device is deemed to have crashed. Simultaneously, the messages sent between the last heartbeat detection and the previous one are recorded to facilitate testers in locating vulnerabilities and conducting further analysis.

[0060] By sending different types of messages, the device can be monitored from various aspects as much as possible. These include ICMP protocol messages, ARP protocol messages, and normal SOAP protocol messages, and the device's status is determined by observing the responses.

[0061] S4.2 Fuzzy Processor

[0062] The processor is responsible for receiving the mutated message and sending it to the device under test (DUT), and receiving a response. For some messages whose structure is damaged, the DUT will not give a response. The processor will wait for a period of time and then determine that the device has refused to receive the message. It will then query the monitor to check the device's operating status. If the monitor replies that the device is offline, it is determined that the device has crashed. If the monitor replies that the device is online and operating normally, the message is determined to be an invalid message without a response.

[0063] Another objective of this invention is to provide a SOAP protocol fuzzing system based on an abstract syntax tree. This system, based on the aforementioned fuzzing method, discovers vulnerabilities in IoT protocols and mainly includes an abstract syntax tree generation module, a production rule extraction module, a fuzzy mutation module, and a vulnerability detection module; wherein:

[0064] The abstract syntax tree generation module uses Wireshark to capture real traffic during camera communication, and uses Python's Scapy library to perform preliminary extraction and parsing of SOAP messages, and then transforms the SOAP messages into an abstract syntax tree.

[0065] Production Extraction Module: Traverses all nodes of the abstract syntax tree (AST), records the context information and parent-child relationships of each node using context-sensitive syntax, abstracts these into production rules, and adds them to the production rule pool. The production rule pool is continuously expanded by capturing a large number of communication messages. Specifically, it initializes the production rule set R. cIf empty, for each Abstract Syntax Tree (AST) in the set AST_XML, starting from the root node, traverse all non-leaf nodes of the AST in level order to obtain the context information of each non-leaf node: context =<great-grandfather,grandfather,father,first-brother> The `context` stores the context information of a node, consisting of four attributes: great-grandfather node, grandfather node, parent node, and first sibling node. The production rule `production = α → β`, where α is a non-leaf node of the Abstract Syntax Tree (AST), and β is a child node of α. For each distinct child node β, a production rule is generated. A level-order traversal of all non-leaf nodes in the AST combines the current node's `context` with the production rule `production`, storing them as a tuple `t = (context, production)`. If the production pool R... c If there are no duplicate t values, add them to the production pool R. c ;

[0066] The fuzzy mutation module iterates through all fields of the initial packet, performs three stages of mutation on the fields using a production pool, and then hands the mutated packet over to the processor module. Specifically, it first takes a real traffic packet as the initial seed, parses it into an abstract syntax tree, and then in the first stage of mutation, for each leaf node, replaces all nodes in the production pool with the same context. After the seed pool is exhausted, the mutation enters the second stage, randomly using various methods for the abstract syntax tree from the policy pool. After the mutation strategy in the second stage is completed, the third stage of mutation is performed. The mutation energy of the corresponding leaf node is calculated based on the number of corresponding leaf nodes in the production pool. Nodes that were replaced less in the first stage are given more energy in the third stage. Then, the leaf nodes are subjected to structural mutations that destroy the packet.

[0067] Vulnerability detection module: The monitor is responsible for listening to the IP address and port of the object under test. When the device crashes, causing the port to close or the network connection to be interrupted, the crash information is promptly sent back to the fuzz processor. When the fuzz processor receives the crash message, it stores the current sequence of sent messages, which testers can access at any time to analyze the cause of the crash. Specifically, a heartbeat detection mechanism is used to detect vulnerabilities. During system operation, a detection message is sent to the device under test (DUT) every 2 seconds. If there is no response, the device is considered to have crashed. At the same time, the messages sent in the previous heartbeat detection interval are recorded. By sending different types of messages, the device is monitored from various aspects, including ICMP protocol messages, ARP protocol messages, and normal SOAP protocol messages. The device status is determined by observing the responses. The fuzzy processor is responsible for receiving the mutated messages and sending them to the DUT, and receiving responses. For some messages with corrupted structures, the DUT will not respond. The processor will wait for a period of time and determine that the device refuses to receive the message. It will then query the monitor to check the device's operating status. If the monitor replies that the device is offline, the device is considered to have crashed. If the monitor replies that the device is online and operating normally, the message is considered an invalid message without a response.

[0068] This invention transforms the SOAP protocol into an abstract syntax tree to obtain production rules, and uses production rules to guide mutation on a field-by-field basis. Compared with other generation-based black-box fuzzing methods, it can greatly improve the efficiency of SOAP protocol fuzzing, and has the following characteristics and beneficial effects:

[0069] 1) Compared to other XML format fuzzing methods, this invention adopts more fine-grained production rules, which can obtain more production rules in real traffic. In the mutation phase, three-stage mutation is performed on the leaf nodes of the abstract syntax tree, which can effectively explore each field of the SOAP protocol, better adapt to the background of protocol fuzzing, and achieve higher fuzzing efficiency.

[0070] 2) Compared to traditional black-box protocol fuzzing tools such as boofuzz, this invention learns syntax and production rules from real traffic. During the mutation phase, it continuously generates high-quality seeds through methods such as subtree replacement and energy allocation. It can automatically parse SOAP message formats and reduce the problem of high manual overhead in field partitioning.

[0071] 3) The testing method and system of this invention can significantly improve the efficiency of vulnerability discovery in the SOAP protocol. Under the same testing environment, compared with the existing black-box fuzzing testing framework, it can perform testing more efficiently and discover more vulnerabilities. Attached Figure Description

[0072] Figure 1This is a system flowchart of the SOAP protocol black-box fuzz testing method based on abstract syntax tree according to the present invention.

[0073] Figure 2 This invention relates to the SOAP protocol abstract syntax tree in the SOAP protocol black-box fuzz testing method based on abstract syntax trees.

[0074] In the diagram: (a) XML format message data; (b) corresponding abstract syntax tree.

[0075] Figure 3 This is a partial example of production rule generation for the SOAP protocol black-box fuzz testing method based on abstract syntax trees in this invention;

[0076] In the diagram: (a) the original abstract syntax tree; (b) production rules and context; (c) the production rule pool.

[0077] Figure 4 This describes the fuzzy mutation stage operation flow of the SOAP protocol black-box fuzzy testing method based on abstract syntax trees according to the present invention.

[0078] Figure 5 This is a fuzzy variation example of the SOAP protocol black-box fuzz testing method based on abstract syntax tree in this invention;

[0079] In the diagram: (a) Original message; (b) Replacement with the same context; (c) Replacement with a different context; (d) Node deletion; (e) Node addition; (f) Node swapping.

[0080] Figure 6 This invention relates to the message sending and crash monitoring process of the SOAP protocol black-box fuzz testing method based on abstract syntax trees. Detailed Implementation

[0081] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0082] like Figure 1 As shown, a black-box fuzzing method for SOAP protocol based on abstract syntax tree is presented. The overall steps are divided into four stages: abstract syntax tree generation stage, production rule extraction stage, fuzzing mutation stage, and vulnerability detection stage.

[0083] 1. Abstract Syntax Tree Generation Stage:

[0084] 1.1 Real Traffic Scraping

[0085] First, collect the required SOAP protocol communication messages on the network, or use the Wireshark tool to capture packets, obtain the actual SOAP protocol traffic, and store it as a pcap format file.

[0086] Install Python 3, use pip install to install the scapy library, read pcap format files, and extract application layer protocol messages.

[0087] 1.2 Protocol Division

[0088] The application layer protocol message obtained in 1.1 is divided into an HTTP part and a SOAP part by the last escape character '\r\n'. The first half is the HTTP protocol and the second half is the SOAP protocol. The obtained SOAP protocol is added to the set Packet_SOAP.

[0089] 1.3 Abstract Syntax Tree Generation

[0090] The SOAP protocol is based on XML data format. The crawled SOAP protocol data is parsed into an XML document using Python 3's dom library, added to the XML data collection Packet_XML, and then... Figure 2 The result is converted into an abstract syntax tree and added to the abstract syntax tree set AST_XML. The sum of the leaf nodes of all abstract syntax trees in AST_XML is the original corresponding XML message data.

[0091] 2 Production Formula Extraction Stage

[0092] The abstract syntax tree obtained during the real traffic conversion phase learns the context abstract syntax and uses production rules to store the context information and parent-child node relationships of the syntax tree.

[0093] The pseudocode for the production rule extraction part is as follows:

[0094]

[0095] It mainly includes the following processes:

[0096] Initialize the production pool R c If empty, for each Abstract Syntax Tree (AST) in the AST_XML set, starting from the root node, traverse all non-leaf nodes of the AST in level order, storing the information of the current node as a tuple t = (context, production), such as... Figure 3 As shown, and add it to set R. cWhere context =<great-grandfather,grandfather,father,first-brother> This stores the context information of a node, consisting of four attributes: great-grandfather node, grandfather node, parent node, and first sibling node. `production = α → β` records all production rules existing at the current node, where `production ∈ R`, α is a non-leaf node of the Abstract Syntax Tree (AST), and β is a child node of α. For each distinct child node β, a `production` is generated. Figure 2 After extracting production rules from the abstract syntax tree, R c Some of the production rules are shown in Table 1.

[0097] Table 1. Generation Pool R c Partial seed records

[0098]

[0099] 3. Fuzzy Variation Stage

[0100] The pseudocode for the strategy used in fuzzy mutation is shown below. It adopts a three-stage mutation strategy based on the structural characteristics of the SOAP protocol.

[0101]

[0102]

[0103] The process of the fuzzy mutation stage is as follows: Figure 4 As shown, it includes the following process:

[0104] 3.1 Obtaining the Initial Seed

[0105] The initial seed for the mutation process also comes from packet captures of real traffic. A packet from real SOAP protocol traffic that responded with a 200 OK message was selected as the initial seed packet. i Transform it into an AST (Syntax Tree) of the seed message. i .

[0106] 3.2 First-stage variation

[0107] Generate pool R c With Abstract Syntax Tree (AST) i As input, perform complete matching and substitution operations on the production rules. Traverse all leaf nodes of the abstract syntax tree; for each leaf node, use the context information of its parent node in the production rule set R. cThe system searches for matching production terms. If a production with the same context information is found, and the parent node of the production term matches the parent node of the current leaf node, and the child nodes of this production term are leaf nodes, then the current leaf node is replaced with the successor of this production term. Figure 5 As shown in (b), this is used as the mutated message. It is then handed over to the next stage and sent to the device under test.

[0108] 3.3 Second-stage variation

[0109] The second phase prepared a mutation policy pool (ST), which includes four mutation policies for tree-like structures, used to test whether the device can handle certain semantic issues. The mutation policies in the pool are mainly:

[0110] (1) Replacement operations for productions in different contexts: For leaf nodes, replacement is no longer limited to the same context; as long as the predecessors of the productions are the same, replacement will occur. Figure 5 As shown in (c), the search production set R c In the production rules, if the context is not equal and the predecessor of production is equal, the leaf node is replaced with the successor of production.

[0111] (2) Node deletion: Randomly delete a leaf node from the tree, such as... Figure 5 As shown in (d), traverse all non-leaf nodes of the tree. If there is a leaf node as a child node, randomly delete one leaf node.

[0112] (3) Node addition: Add a new leaf node from any production pool under the same production rule, such as... Figure 5 As shown in (e), the production set R is searched using the context of the parent node of the leaf node as the index. c In the production rules, if the context is equal and the predecessor of the production is equal, the production is added as a sibling node of the parent node.

[0113] (4) Node swapping: Randomly swap the values ​​of several leaf nodes, such as... Figure 5 As shown in (f), traverse all non-leaf nodes. If a node has multiple child nodes, swap the order of the child nodes.

[0114] Generate pool R c Abstract Syntax Tree (AST) i Using the mutation policy pool ST as input, obtain the mutated message. It is then handed over to the next stage and sent to the device under test.

[0115] 3.4 Third-stage variation

[0116] The third stage involves byte-level mutation at the leaf node level, and the mutation methods include the following:

[0117] (1) Extremely long strings

[0118] Repeat the value of the leaf node several times or construct an extremely long string like "aaaaaaaa..." to replace the leaf node, and observe whether the tested object can parse the protocol normally.

[0119] (2) Analysis of interference

[0120] Add strings with special meanings, such as "\x00" or "\r\n", before or after the fields in leaf nodes to interfere with the device's parsing of XML format.

[0121] (3) Special ASCII codes

[0122] Replacing or adding special ASCII codes to leaf nodes can help prevent errors in the test object. Many devices have specific meanings for certain ASCII codes, such as "!", "@", "￥", "&", and "(", when parsing strings.

[0123] (4) Boundary values

[0124] Many function statements specify that different fields of different objects have value boundaries, and taking values ​​near these boundaries may cause protocol parsing failures.

[0125] (5) Random variation

[0126] Perform byte-level mutations on a leaf node basis, such as bit flipping, byte flipping, and random character generation.

[0127] During the third stage of mutation, the mutation time will be allocated to each leaf node according to the following formula.

[0128]

[0129] Here, `Energy` is a pre-defined unit energy to ensure that the mutation time for each leaf node is not too short, thus preventing insufficient testing; it is typically 20,000 to 30,000 CPU time slices. `α` is the importance parameter of the current node, specified by the tester when writing the test configuration file; the default value is 1, indicating that all nodes have the same importance. `e` is the mutation energy allocated to the current leaf node; the fewer production rules the current leaf node has, the more random mutation time it is allocated.

[0130] 4. Vulnerability Detection Phase

[0131] The specific process of the vulnerability detection phase is as follows: Figure 6 As shown, the device under test (DUT) crash monitoring employs a heartbeat test method. The device's status is determined by observing the responses to ICMP, ARP, and normal SOAP protocol messages. Device status is monitored simultaneously at both the network and application layers.

[0132] Vulnerability detection primarily utilizes a heartbeat detection mechanism. During system operation, a detection message is sent to the device under test every 2 seconds. If there is no response, the device is deemed to have crashed. Simultaneously, the messages sent between the last heartbeat detection and the previous one are recorded to facilitate testers in locating vulnerabilities and conducting further analysis.

[0133] In summary, this invention proposes a black-box fuzzing method for SOAP protocols based on abstract syntax trees. By capturing real traffic to construct a production set, it guides the mutation process of fuzzing and adopts a three-stage mutation strategy to improve the overall efficiency of fuzzing.

[0134] To verify the effectiveness of this invention, the inventors conducted fuzz testing and vulnerability discovery on the ONVIF protocol, a high-level protocol based on SOAP. ONVIF is the most important protocol in the camera industry, and most camera manufacturers support it. ONVIF requires users to update their user token information in real time to ensure secure communication. First, a timestamp and a random number are generated, and then a new token is generated for the device according to the official ONVIF protocol specifications. Seed mutation occurs in the message containing the new token. This ensures the validity of the token and allows for effective fuzz testing of the token's fields. Tests were conducted based on this approach.

[0135] In the experiment, two real smart camera devices were tested, and the specific information of the cameras is shown in Table 2.

[0136] Table 2 Basic Information of the Device Under Test

[0137]

[0138] The experiment revealed that the two cameras have highly consistent implementations of the ONVIF protocol and can trigger the same crash vulnerability. This vulnerability causes the device to crash and automatically restart. Attackers can repeatedly send messages that trigger the vulnerability, rendering the device inoperable and causing security issues. This zero-day vulnerability has been reported to the CNNVD vulnerability database and has obtained vulnerability ID CNVD-2023-43801 and an original vulnerability certificate. Additionally, several connection interruption vulnerabilities were also found in the devices, causing the device to interrupt the socket connection, rendering this round of testing invalid.

[0139] Boofuzz, a classic black-box fuzz testing tool, was used as a control group in the comparative experiment. To more comprehensively reflect the characteristics of the ONVIF protocol, two Boofuzz ​​control groups were used:

[0140] Boofuzz-default: This control group does not require any other settings, captures the actual traffic of the communication, and has the testers manually segment the fields and write test scripts.

[0141] Boofuzz-adjusted: In addition to the basic functions of Boofuzz, this control group also implements special field processing and user token update functions to improve the acceptance rate of test cases. The fields are manually divided and test scripts are written by testers.

[0142] Experimental group: OnvifFuzzer, Boofuzz-default, and Boofuzz-adjusted were tested on two different cameras for 4 hours each, repeated 3 times, and the average value was taken. The results are shown in Tables 3 and 4.

[0143] Table 3 TP-LINK Camera Test Performance

[0144] Number of messages sent 28654 11453 23650 Number of replies received 25310 863 18356 Acceptance rate 88.3％ 7.5％ 77.6％ Types of replies received 83 18 43 Number of vulnerabilities discovered 2 0 1

[0145] Table 4 MERCURY camera test performance

[0146] Number of messages sent 26324 10356 21356 Number of replies received 22245 806 15398 Acceptance rate 84.5％ 7.8％ 72.1％ Types of replies received 79 16 41 Number of vulnerabilities discovered 3 0 1

[0147] As shown in Tables 3 and 4, if the Content-Length field and user token of the HTTP protocol are not adjusted, the acceptance rate of the fuzz test will be very low. However, even with the adjustment, the present invention can receive more types of responses and far exceeds Boofuzz ​​in terms of its ability to cover more functional spaces. At the same time, it is also easier to trigger vulnerabilities.

[0148] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A black-box fuzzing method for SOAP protocol based on abstract syntax trees, characterized in that, include: In the abstract syntax tree conversion stage, the captured real SOAP protocol traffic is parsed into an abstract syntax tree; In the production extraction phase, all nodes of the abstract syntax tree are traversed. Context-sensitive syntax is used to record the context information of each node in the abstract syntax tree and the parent-child relationship of the nodes. This information is then abstracted into production rules and added to the production rule pool. The production rule pool is continuously expanded by capturing a large number of communication messages. In the fuzzy mutation phase, a real traffic packet is first taken as the initial seed and parsed into an abstract syntax tree. Then, in the first stage of mutation, for each leaf node, all nodes with the same context in the production pool are replaced. After the seed pool is exhausted, the mutation enters the second stage, where multiple methods for the abstract syntax tree are randomly used from the policy pool for mutation. After the mutation policies in the second stage are executed, the third stage of mutation is carried out. The mutation energy of the leaf node is calculated based on the number of corresponding leaf nodes in the production pool. Nodes that were replaced less in the first stage are given more energy in the third stage. Then, the leaf nodes are subjected to structural mutations that destroy the packet. During the vulnerability detection phase, a monitor is responsible for listening to the IP address and port of the object under test. When the device crashes, causing the port to close or the network connection to be interrupted, the crash information is promptly sent back to the fuzz processor. When the fuzz processor receives the crash message, it stores the current sequence of messages sent, which testers can access at any time to analyze the cause of the crash.

2. The SOAP protocol black-box fuzz testing method based on abstract syntax tree according to claim 1, characterized in that: During the abstract syntax tree (AST) transformation phase, the required SOAP protocol communication packets are collected from the network, or packets are captured using Wireshark to obtain real SOAP protocol traffic packets. The collected SOAP protocol packets are added to the Packet_SOAP set. The packets in Packet_SOAP are parsed and extracted using Python's Scapy library to generate XML format packet data, which is then added to the XML data set Packet_XML. Each XML packet data in the Packet_XML set is converted into an instance of the corresponding abstract syntax tree and added to the abstract syntax tree set AST_XML. The sum of the leaf nodes of all abstract syntax trees in AST_XML is the original corresponding XML packet data.

3. The SOAP protocol black-box fuzzing method based on abstract syntax tree according to claim 1, characterized in that: During the production extraction phase, the production set Rc is initialized to be empty. For each abstract syntax tree AST in the set AST_XML, starting from the root node, all non-leaf nodes of the AST are traversed in level order to obtain the context information context= for each non-leaf node. The context information stores the context information of the node and consists of four attributes, including the great-grandfather node, the grandfather node, the parent node, and the first sibling node. The production rule production = α → β, where α is a non-leaf node of the Abstract Syntax Tree (AST) and β is a child node of α. For each distinct child node β, a production rule is generated. The AST is traversed in level order, and the context of the current node is combined with the production rule production and stored as a tuple t = (context, production). If there is no identical t in the production pool Rc, it is added to the production pool Rc.

4. The SOAP protocol black-box fuzzing method based on abstract syntax tree according to claim 1, characterized in that: The fuzzy mutation stage specifically includes the following steps: 1.1 The first stage of mutation takes the production pool Rc and the abstract syntax tree ASTi of the initial seed as input and performs a complete matching and replacement operation of the productions. It traverses all leaf nodes of the abstract syntax tree. For each leaf node, it searches for a matching production item in the production set using the context information of its parent node. If there is a production with the same context information, and the parent node of the production is the same as the parent node of the current leaf node, and the child node of the production is a leaf node, then the current leaf node is replaced with the successor of the production. 1.2 The second stage of mutation uses the mutation strategy pool ST to mutate the seed. The mutation strategy pool includes four mutation strategies for tree structures:

1. Replacement of production rules in different contexts: the replacement of leaf nodes is no longer limited to the same context background, as long as the antecedent of the production rule is the same, it will be replaced; 2. Node deletion: randomly delete a leaf node of the tree; 3. Node addition: add a new leaf node from the seed pool under the same production rule; 4. Node swapping: randomly swap the values ​​of several leaf nodes. 1.3 Third-Stage Mutation In the third-stage mutation, mutation energy is allocated to each leaf node. The mutation energy of each leaf node is calculated based on the number of production rules it contains. The mutation energy is allocated to each leaf node according to the following formula: ； Where Energy is the unit energy given in advance; α is the importance parameter of the current node, which is given by the tester when writing the test configuration file, and the default value is 1, indicating that all nodes have the same importance; e is the mutation energy assigned to the current leaf node.

5. The SOAP protocol black-box fuzzing method based on abstract syntax tree according to claim 1, characterized in that, During the vulnerability detection phase, the fuzzing processor receives the mutated seed and sends it to the device under test. It uses heartbeat monitoring to listen to the device's status and sends feedback back to the fuzzing processor. If the device crashes, a vulnerability is reported. The process includes the following steps: The vulnerability detection uses a heartbeat detection mechanism. During system operation, a detection message is sent to the device under test every 2 seconds. If there is no response, the device is judged to have crashed. At the same time, the messages sent in the interval between the last heartbeat detection are recorded. By sending different types of messages, the device can be monitored from various aspects, including ICMP protocol messages, ARP protocol messages, and normal SOAP protocol messages. The status of the device can be determined by observing the responses. The fuzz processor is responsible for receiving the mutated message and sending it to the device under test (DUT), and receiving a response. For some messages whose structure is damaged, the DUT will not give a response. The processor will wait for a period of time and then determine that the device has refused to receive the message. It will then query the monitor to check the device's operating status. If the monitor replies that the device is offline, it will determine that the device has crashed. If the monitor replies that the device is online and operating normally, the message will be determined as an invalid message without a response.

6. The SOAP protocol black-box fuzzing method based on abstract syntax tree according to claim 4, characterized in that: The third stage of mutation includes the following methods:

1. Extremely long strings; 2. Parsing interference; 3. Special ASCII codes; 4. Boundary values; 5. Random mutation. The replacement characters for the first four mutation methods will be stored in the list lib. During the test time, they will be mutated in sequence. After all the characters in lib have been used, the remaining time will be used for random mutation, randomly generating characters to replace the original field.

7. A SOAP protocol black-box fuzz testing system based on abstract syntax trees, characterized in that: include: The abstract syntax tree generation module is used to: parse captured real SOAP protocol traffic into an abstract syntax tree; The production extraction module is used to: traverse all nodes of the abstract syntax tree, record the context information of each node in the abstract syntax tree and the parent-child relationship of the nodes using context-sensitive syntax, abstract them into production rules, and add them to the production rule pool. By capturing a large number of communication messages, the production rule pool is continuously expanded. The fuzzy mutation module is used to: first, take a real traffic packet as the initial seed, parse it into an abstract syntax tree, and then in the first stage of mutation, replace all nodes with the same context in the production pool for each leaf node; after the seed pool is exhausted, the mutation enters the second stage, randomly using multiple methods for the abstract syntax tree in the policy pool for mutation; after the mutation policy in the second stage is completed, the third stage of mutation is carried out, calculating the mutation energy of the leaf node according to the number of corresponding leaf nodes in the production pool. Nodes that are replaced less times in the first stage will be given more energy in the third stage. Then, the leaf node is subjected to structural mutation that destroys the packet. The vulnerability detection module is used to monitor the IP address and port of the object under test. When the device crashes, causing the port to close or the network connection to be interrupted, the crash information is promptly sent back to the fuzz processor. When the fuzz processor receives the crash message, it stores the current sequence of sent messages, which testers can access at any time to analyze the cause of the crash.

8. The SOAP protocol black-box fuzz testing system based on abstract syntax tree as described in claim 7, characterized in that: When the production extraction module is in operation, it includes the following steps: The production set Rc is initialized to be empty. For each abstract syntax tree AST in the set AST_XML, starting from the root node, all non-leaf nodes of the AST are traversed in level order to obtain the context information context= for each non-leaf node. The context information stores the context information of the node and consists of 4 attributes, including the great-grandfather node, the grandfather node, the parent node, and the first sibling node. The production rule production = α → β, where α is a non-leaf node of the Abstract Syntax Tree (AST) and β is a child node of α. For each distinct child node β, a production rule is generated. The AST is traversed in level order, and the context of the current node is combined with the production rule production and stored as a tuple t = (context, production). If there is no identical t in the production pool Rc, it is added to the production pool Rc.

9. The SOAP protocol black-box fuzz testing system based on abstract syntax tree as described in claim 7, characterized in that: The fuzzy mutation stage includes the following steps: 1.1 The first stage of mutation takes the production pool Rc and the abstract syntax tree ASTi of the initial seed as input and performs a complete matching and replacement operation of the productions. It traverses all leaf nodes of the abstract syntax tree. For each leaf node, it searches for a matching production item in the production set using the context information of its parent node. If there is a production with the same context information, and the parent node of the production is the same as the parent node of the current leaf node, and the child node of the production is a leaf node, then the current leaf node is replaced with the successor of the production. 1.2 The second stage of mutation uses the mutation strategy pool ST to mutate the seed. The mutation strategy pool includes four mutation strategies for tree structures:

1. Replacement of production rules in different contexts: the replacement of leaf nodes is no longer limited to the same context background, as long as the antecedent of the production rule is the same, it will be replaced; 2. Node deletion: randomly delete a leaf node of the tree; 3. Node addition: add a new leaf node from the seed pool under the same production rule; 4. Node swapping: randomly swap the values ​​of several leaf nodes. 1.3 Third-Stage Mutation In the third-stage mutation, mutation energy is allocated to each leaf node. The mutation energy of each leaf node is calculated based on the number of production rules it contains. The mutation energy is allocated to each leaf node according to the following formula: ； Where Energy is the unit energy given in advance; α is the importance parameter of the current node, which is given by the tester when writing the test configuration file, and the default value is 1, indicating that all nodes have the same importance; e is the mutation energy assigned to the current leaf node.

10. The SOAP protocol black-box fuzz testing system based on abstract syntax tree as described in claim 7, characterized in that: In the aforementioned vulnerability detection module: A heartbeat detection mechanism is used to detect vulnerabilities. During system operation, a detection message is sent to the device under test every 2 seconds. If there is no response, the device is judged to have crashed. At the same time, the messages sent in the previous heartbeat detection interval are recorded. By sending different types of messages, the device can be monitored from various aspects, including ICMP protocol messages, ARP protocol messages, and normal SOAP protocol messages. The status of the device can be determined by observing the responses. The fuzz processor is responsible for receiving the mutated message and sending it to the device under test (DUT), and receiving a response. For some messages whose structure is damaged, the DUT will not give a response. The processor will wait for a period of time and then determine that the device has refused to receive the message. It will then query the monitor to check the device's operating status. If the monitor replies that the device is offline, it will determine that the device has crashed. If the monitor replies that the device is online and operating normally, the message will be determined as an invalid message without a response.

Images