Industrial control protocol fuzz testing method and system based on paradigm grammar and reinforcement learning

Abstract

The present invention discloses a fuzzy testing method and system for an industrial control protocol based on paradigm grammar and reinforcement learning. The method comprises the following steps: using an extended Backus-Naur form (ABNF) to describe the structure of the industrial control protocol, identifying various fields in the industrial control protocol message, constructing a syntax tree for the industrial control protocol, instantiating the syntax tree to obtain a variant tree, and initializing the weight of each leaf node in the variant tree; selecting leaf nodes to be mutated based on the weights, mutating the variant tree, traversing the mutated variant tree to obtain test cases, and sending the test cases to the industrial control protocol for fuzzy testing; updating the weights of each leaf node based on the fuzzy test results, and obtaining new test cases using the above method; and repeating the above steps until a set number of iterations is reached. The present invention effectively improves the coverage of test cases and the ability to detect anomalies.

Description

Technical Field

[0001] The present invention belongs to the technical field of protocol security testing, and in particular relates to an industrial control protocol fuzzy testing method and system based on paradigm grammar and reinforcement learning. Background Art

[0002] Industrial Control Systems (ICS) are at the heart of modern industrial infrastructure, responsible for monitoring and controlling various industrial processes. ICS typically consist of multiple components that communicate using specific ICS protocols. These protocols define data formats and interaction rules to ensure stable system operation and efficient management. With the advancement of industrial automation and intelligentization, the security and reliability of ICS protocols have become increasingly important.

[0003] Fuzz testing technology has been widely used in software testing, particularly in ICS protocol testing. It sends mutated, non-normal packets to the protocol parser module to test whether the system can properly handle anomalous inputs, thereby identifying potential security vulnerabilities. Currently, there are two main methods for generating non-normal input data: data generation and data mutation. Generation-based methods rely on a deep understanding of the protocol format, while mutation-based methods explore more execution paths by modifying legitimate input samples. However, generation-based methods may not cover all possible input scenarios, and test cases generated by mutation-based methods may contain a large amount of randomness, resulting in unstable test results. Therefore, in recent years, technicians have increasingly adopted coverage-guided fuzz testing techniques. This method uses code coverage information to guide the generation and mutation of test inputs, thereby more effectively discovering vulnerabilities and defects in the protocol. These mainly include reinforcement learning-based protocol fuzz testing methods and coverage feedback-based fuzz testing methods.

[0004] Although existing technologies have made some progress in ICS protocol testing, some limitations still exist. Reinforcement learning-based protocol fuzz testing methods, while capable of adaptively selecting mutation strategies, may generate test cases that do not meet protocol specifications, impacting test effectiveness. Coverage feedback-based fuzz testing methods focus too much on collecting feedback information while ignoring the importance of data modeling. This can result in test cases failing to fully explore all potential behaviors of the protocol. Summary of the Invention

[0005] In response to the above-mentioned shortcomings of the existing technology, the present invention proposes an industrial control protocol fuzzy testing method and system based on paradigm grammar and reinforcement learning, which combines paradigm grammar and reinforcement learning methods to realize fuzzy testing of industrial control protocols.

[0006] To achieve the above objectives, the present invention provides an industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning, comprising the following steps:

[0007] Step S1: Use the extended Backus Naur Form (ABNF) to describe the structure of the industrial control protocol, identify the fields in the industrial control protocol message, construct a syntax tree of the industrial control protocol, instantiate the syntax tree to obtain a variant tree, and initialize the weight of each leaf node in the variant tree;

[0008] Step S2: selecting leaf nodes that need to be mutated according to the weight, mutating the mutation tree, traversing the mutated mutation tree to obtain test cases, and sending the test cases to the industrial control protocol for fuzz testing;

[0009] Step S3: Update the weight of each leaf node according to the fuzzy test results, and obtain a new test case using the method in step S2;

[0010] Step S4: Repeat steps S2 to S3 until the set number of iterations is reached.

[0011] Preferably, instantiating the syntax tree to obtain a variant tree in step S1 includes the following steps: taking the message of the industrial control protocol as the root node and each field in the message as a child node, calculating the byte length of each field according to the ABNF description of the industrial control protocol, dividing the child node into two intermediate child nodes with the middle byte of each field as the boundary, repeating the division operation until the intermediate child node contains only one byte, taking the single-byte intermediate child node as a leaf node, and constructing a variant tree of the industrial control protocol.

[0012] Preferably, mutating the mutation tree in step S2 includes the following steps: taking leaf nodes with weights greater than a preset threshold as pre-selected mutation points, randomly selecting several pre-selected mutation points as mutation nodes, formulating multiple mutation strategies, and using a heuristic algorithm to select a mutation strategy for each mutation node, wherein the mutation strategies include type mutation, operation mutation, and combination field mutation.

[0013] Preferably, the type mutation selects a mutation strategy according to the character type of the leaf node of the mutation tree:

[0014] When the character type of the leaf node is a numeric value, the leaf node is mutated by taking the critical value at the boundary of the numeric value;

[0015] When the character type of the leaf node is a string, an overlong string or a string containing special characters is generated to mutate the leaf node;

[0016] When the character type of the leaf node is binary, a bit reversal operation is used to mutate the leaf node.

[0017] Preferably, the operational mutation randomly selects the following strategies to mutate the mutation tree:

[0018] A. Randomly select a leaf node to copy or delete;

[0019] B. Randomly select a leaf node with a numerical value and randomly increase or decrease its value;

[0020] C. Randomly select a leaf node and overwrite its value with randomly generated data;

[0021] D. Randomly shuffle the order of leaf nodes.

[0022] Preferably, the combined field mutation combines two leaf nodes with the closest weights into a new leaf node.

[0023] Preferably, in step S3, updating the weight of each leaf node according to the fuzzy test result includes the following steps:

[0024] Step S31: Calculate the reward score of the test case based on the fuzz testing results:

[0025] reward=coverage_reward+exception_reward

[0026] coverage_reward=coverage_gain×coverage_weight;

[0027] exception_reward=exception_gain×exception_weight

[0028] Among them, reward is the reward score of the test case; coverage_reward is the coverage score of the test case; exception_reward is the exception detection rate score of the test case; coverage_gain is the coverage of the test case; coverage_weight is the coverage weight; exception_gain is the exception detection rate of the test case, which is 1 when the test case causes an exception, otherwise it is 0; exception_weight is the exception detection rate weight of the test case;

[0029] Step S32: Adjust the values ​​of coverage weight and anomaly detection rate weight according to the test requirements. If the test attaches more importance to improving coverage, increase the coverage weight. If the test attaches more importance to discovering anomalies, increase the anomaly detection rate weight.

[0030] The present invention also provides an industrial control protocol fuzzy testing system based on paradigm grammar and reinforcement learning, which is implemented based on the above-mentioned industrial control protocol fuzzy testing method based on paradigm grammar and reinforcement learning, and includes a paradigm grammar description module, a mutation module, a use case generation module and a reinforcement learning module;

[0031] The paradigm grammar description module uses the extended Backus-Naur form (ABNF) to describe the industrial control protocol, constructs a syntax tree of the protocol, and instantiates the syntax tree to obtain a variant tree;

[0032] The mutation module adopts a heuristic algorithm to select a mutation strategy and mutate the mutation tree;

[0033] The use case generation module traverses the mutated mutation tree to generate test cases, and sends the test cases to the protocol to be tested for fuzz testing;

[0034] The reinforcement learning module calculates the reward function of the test case based on the test results, dynamically updates the field weights, and guides the generation and mutation of subsequent test cases.

[0035] The present invention also provides an electronic device comprising: a memory, a processor and a computer program, wherein the computer program is stored in the memory and is configured to be executed by the processor to implement the above-mentioned industrial control protocol fuzzy testing method based on paradigm grammar and reinforcement learning.

[0036] The present invention further provides a computer-readable storage medium, in which a computer program is stored. The computer program is executed by a processor to implement the above-mentioned industrial control protocol fuzzy testing method based on paradigm grammar and reinforcement learning.

[0037] The benefits of the present invention include at least:

[0038] 1. Use Extended Backus Narration Form (ABNF) to uniformly describe industrial control protocols, ensuring systematic and structured test case generation and ensuring that all protocol fields and combinations are correctly parsed and test cases are generated;

[0039] 2. By initializing and updating the weight of each leaf node in the mutation tree, the process can adaptively adjust the mutation strategy to improve the coverage of test cases and the probability of discovering vulnerabilities;

[0040] 3. Through iteration and weight update, limited testing resources can be used more effectively, focusing on testing those parts that are more likely to find problems. At the same time, test results are used to guide the generation of subsequent test cases, making the testing process more intelligent and goal-oriented. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1A schematic diagram of the structure of the Modus / TCP protocol selected for an embodiment of the present invention;

[0042] Figure 2 Schematic diagram of a method flow in an embodiment of the present invention;

[0043] Figure 3 ABNF description of the Modus / TCP protocol according to an embodiment of the present invention;

[0044] Figure 4 The ABNF syntax tree of the Modus / TCP protocol constructed for the embodiment of the present invention;

[0045] Figure 5 ABNF variant tree of the Modus / TCP protocol constructed for the embodiment of the present invention;

[0046] Figure 6 Schematic diagram of the system structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following is a clear and complete description of the technical solutions in the embodiments of the present invention, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts are within the scope of protection of the present invention.

[0048] like Figure 1 As shown, the industrial control protocol selected in the embodiment of the present invention is the Modbus / TCP protocol. The Modbus / TCP protocol message (modbus-tcp-frame) consists of an MBAP message header (mbap-header) and a protocol data unit (pdu). The MBAP message header includes a transaction identifier (transaction-id), a protocol identifier (protocol-id), a length (length), and a unit identifier (unit-id). The protocol data unit consists of a function code (function-code) and a data segment (data).

[0049] Example 1

[0050] like Figure 2 As shown, an embodiment of the present invention provides an industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning, comprising the following steps:

[0051] Step S1: Use Extended Backus-Naur Form (ABNF) to describe the structure of the industrial control protocol, identify the fields in the industrial control protocol message, and construct a syntax tree. To instantiate the abstract ABNF syntax description of the protocol, parse a sample of the industrial control protocol message, generate an ABNF variant tree of the protocol, and initialize the weight of each leaf node in the variant tree.

[0052] like Figure 3 As shown, ABNF is used to describe the specifications of the industrial control protocol to be tested. The ABNF syntax tree of the protocol is constructed with the non-terminal symbols of the ABNF description of the industrial control protocol as intermediate nodes and the terminal symbols as leaf nodes. The structure of the syntax tree is as follows Figure 4 shown.

[0053] Then, we obtain the actual message sample of the Modbus / TCP protocol and parse it using the ABNF syntax tree as a template. We take the message of the industrial control protocol as the root node and each field in the message as the child node. We calculate the byte length of each field according to the ABNF description of the industrial control protocol and divide the child node into two middle child nodes based on the middle byte of each field. We repeat the division operation until the middle child node contains only one byte. We take the single-byte middle child node as the leaf node and construct the ABNF variation tree of the industrial control protocol. Its structure is as follows: Figure 5 The mutation tree is generated based on the specific content of the message sample. It inherits the structure of the syntax tree but adds mutation capabilities and flexibility. The nodes in the mutation tree represent the parts of the message that can be mutated, including the internal bytes of the field.

[0054] Step S2: Select the leaf nodes that need to be mutated according to the size of the weight, mutate the mutation tree, perform depth-first traversal or hierarchical traversal on it to obtain mutation test cases, send the mutation test cases to the industrial control protocol to be tested for fuzz testing, and represent all leaf nodes in the mutation tree in the form of a vector. Input the vector into the reinforcement learning module to learn the weight.

[0055] Specifically, a variety of mutation strategies are formulated, and a heuristic algorithm is used to select the mutation strategy to mutate the mutation tree, where the mutation strategies include type mutation, operation mutation and combination field mutation.

[0056] Type mutation selects a mutation strategy based on the type of the field in the leaf node. For numeric fields, you can take the critical value at the boundary, etc. For string fields, you can generate an extra-long string or a string containing special characters, etc. For binary fields, you can use bit reversal operations to perform mutation.

[0057] Operational mutation can add or delete certain fields, randomly add or subtract a number from a field, or overwrite it with a random value. It can also shuffle leaf nodes and perform other operations to perform mutation.

[0058] Combined field mutation can guide mutation based on the weights learned by the reinforcement learning module. For example, if the weights of two fields are close, then these two fields will be combined and mutated.

[0059] The heuristic algorithm determines the probability of field mutation based on the weight of each field. Fields with higher weights are more likely to be selected for mutation. Weights define the priority of mutations. Given limited resources, heuristics allow testers to focus on test cases that are more likely to discover defects. During the heuristic mutation process, weights can be dynamically adjusted based on test results. If a mutated test case discovers a defect, the weight of the associated field may be increased to explore more relevant mutations.

[0060] Heuristics help optimize the use of test resources, improving test efficiency and defect detection rates by focusing on potentially riskier areas. By prioritizing high-weighted fields, heuristics can effectively reduce the search space that needs to be explored, avoiding wasting resources on areas unlikely to find problems.

[0061] At the same time, all leaf nodes in the variant tree are represented in the form of vectors, that is, each leaf node is combined with its corresponding weight to obtain a vector. For example, the modbus / TCP message is "00 01 00 00 00 06 01 03 00 6B00 03". Assuming that the weights are all initialized to 0, the vectorized data with weights is "00 01 00 00 00 00 00 0600 0100 03 00 006B 00 03 00".

[0062] Step S3: Send the unweighted mutation test case to the protocol to be tested for testing. The monitoring module inserts the program to be tested and monitors whether its running status is abnormal. The weight of each leaf node is updated according to the fuzzy test results. A new test case is obtained using the method in step S2, including the following steps:

[0063] Step S31: Calculate the reward score of the mutation test case based on the fuzz testing results:

[0064] reward=coverage_reward+exception_reward

[0065] coverage_reward=coverage_gain×coverage_weight;

[0066] exception_reward=exception_gain×exception_weight

[0067] Among them, reward is the reward score of the test case; coverage_reward is the coverage score of the test case; exception_reward is the exception detection rate score of the test case; coverage_gain is the coverage of the test case; coverage_weight is the coverage weight, which is initialized to 0.7 in this embodiment; exception_gain is the exception detection rate of the test case, which is 1 when the test case causes an exception and 0 otherwise; exception_weight is the exception detection rate weight of the test case, which is initialized to 0.3 in this embodiment;

[0068] Step S32: Use the back-propagation algorithm to adjust the values ​​of the coverage weight and the anomaly discovery rate weight according to the test requirements. If the test attaches more importance to improving the coverage, then increase the coverage weight. If the test attaches more importance to discovering anomalies, then increase the anomaly discovery rate weight, thereby guiding the generation of the next round of test cases.

[0069] Step S4: Repeat steps S2 to S3 until the expected effect is achieved or the test program is manually terminated and exited. At the same time, the mapping relationship between the fields and the weights is recorded, which can be used for the weight initialization setting when testing other protocols.

[0070] Specifically, after updating the field weights according to the feedback information of step S3, the mutation strategy in step S2 is reused to mutate the mutation tree to generate new test cases, and then the mutated test cases are sent to the protocol to be tested for testing. At the same time, the vectorized data with weight information is sent to the reinforcement learning module, and then the monitoring module monitors the execution coverage and the occurrence of anomalies, that is, enters the loop from step S2 to step S3.

[0071] After achieving the expected effect or manual termination, exit the test program and record the mapping relationship between fields and weights, which can be used for weight initialization settings when testing other protocols.

[0072] The industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning proposed in the present invention combines paradigm grammar, reinforcement learning and protocol fuzz testing. It uses paradigm grammar to uniformly describe the industrial control protocol, reduces the generation of redundant test cases, and controls the mutation strategy in a more fine-grained manner. It uses reinforcement learning to use the feedback information brought by the two indicators of coverage and anomaly detection rate to update the weights of the tree leaf nodes of the mutation tree. Through this combination, it is beneficial to improve the coverage and efficiency of protocol fuzz testing.

[0073] The traditional fuzz testing tool peach randomly generates a large number of test cases to test the protocol to be tested based on the protocol template described by the data model. Its biggest disadvantage is that it will generate a large number of redundant test cases. Many research works have focused on improving the efficiency of fuzz testing, and different protocol fuzz testing methods have been proposed from different perspectives. However, some of these methods focus on the description of the protocol data format and do not use the feedback information brought by indicators such as coverage. Some focus on mutating the seeds, which may cause the generated test cases to not meet the protocol specifications. Others focus on the collection of feedback information and ignore the importance of data model modeling itself. The present invention provides an industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning, which combines paradigm grammar with reinforcement learning and feedback guidance and is applied to fuzz testing of protocol models, and has at least the following technical effects:

[0074] 1. Improve test coverage

[0075] Using the ABNF formal grammar to accurately describe the structure and rules of industrial control protocols ensures that all protocol fields and combinations are correctly parsed and test cases are generated. Furthermore, a reinforcement learning algorithm intelligently explores the protocol state space, prioritizing test cases that increase coverage and rapidly identifying and covering edge cases and special paths in protocol implementations. When testing the Modbus / TCP protocol, ABNF was used to describe the protocol structure, and a reinforcement learning algorithm optimized the test case generation strategy based on coverage feedback. Results showed that compared to traditional random fuzz testing, this method covered more protocol states and paths in a shorter time and discovered multiple potential edge case handling errors.

[0076] 2. Improve the anomaly detection rate

[0077] Reinforcement learning continuously adjusts and optimizes field weights to generate more challenging inputs, identifying and focusing attacks on the most error-prone parts of protocol implementations, such as boundary values ​​and abnormal inputs. This improves the probability of anomaly detection and uncovers deep-seated vulnerabilities that are difficult to detect with traditional fuzz testing. Reinforcement learning algorithms identify the most vulnerable fields in the Modbus / TCP protocol, such as function codes and data fields, and focus on mutating these fields, generating a large number of valid test cases. These tests uncovered several anomalous vulnerabilities, including buffer overflows and improperly handled inputs.

[0078] Example 2

[0079] like Figure 6 As shown, an embodiment of the present invention provides an industrial control protocol fuzzy testing system based on paradigm grammar and reinforcement learning, including a paradigm grammar description module, a mutation module, a use case generation module and a reinforcement learning module.

[0080] The paradigm grammar description module uses Extended Backus-Naur Form (ABNF) to describe industrial control protocols, constructing a syntax tree for the protocol and instantiating the syntax tree to obtain a variant tree. ABNF is a standardized form for describing language or protocol syntax, commonly used to describe Internet protocols such as HTTP and SMTP. Compared to EBNF, ABNF is more structured and consistent, making it suitable for describing complex protocols. Furthermore, ABNF uses simple and intuitive grammatical rules, making the languages ​​and protocols it describes easy to understand and implement. In short, ABNF provides a hierarchical and structured approach to describing syntax, facilitating the definition of complex language structures.

[0081] The present invention uses ABNF to uniformly describe industrial control protocols and adds a weight attribute to nodes. This attribute is mainly used to record the importance of fields learned in reinforcement learning. The higher the reward function score, the greater the weight of the field.

[0082] The mutation module uses a heuristic algorithm to select a mutation strategy and mutate the mutation tree. The mutation strategies include type mutation, operation mutation, and combination field mutation.

[0083] The use case generation module traverses the mutated mutation tree, generates test cases, and sends the test cases to the protocol to be tested for fuzz testing.

[0084] The reinforcement learning module adopts the reinforcement learning algorithm to calculate the reward function of the test results to evaluate the effectiveness of the test case, and uses the backpropagation algorithm to update the weight information of the input vector to guide the generation and mutation of subsequent test cases.

[0085] At the same time, a monitoring module can also be set up to monitor the system's operating status in real time during the process of generating test cases.

[0086] Example 3

[0087] An embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program. The computer program is stored in the memory and is configured to be executed by the processor to implement the above-mentioned industrial control protocol fuzzy testing method based on paradigm grammar and reinforcement learning.

[0088] Example 4

[0089] An embodiment of the present invention provides a computer-readable storage medium, in which a computer program is stored. The computer program is executed by a processor to implement the above-mentioned industrial control protocol fuzzy testing method based on paradigm grammar and reinforcement learning.

[0090] The technical features of the above embodiments may be combined in any manner. To simplify the description, not all possible combinations of the technical features in the above embodiments are described. Only preferred embodiments of the present invention are presented. While the description is relatively specific and detailed, it should not be construed as limiting the scope of the present invention. As long as there are no contradictions in the combination of these technical features, they should be considered to be within the scope of this specification.

[0091] It should be noted that those skilled in the art may make various modifications and improvements without departing from the scope of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the appended claims.

Claims

1. A fuzz testing method for industrial control protocols based on paradigm grammar and reinforcement learning, characterized by: The following steps are involved: Step S1: Use the extended Backus Naur Form (ABNF) to describe the structure of the industrial control protocol, identify the fields in the industrial control protocol message, construct a syntax tree of the industrial control protocol, instantiate the syntax tree to obtain a variant tree, and initialize the weight of each leaf node in the variant tree; Step S2: selecting leaf nodes that need to be mutated according to the weight, mutating the mutation tree, traversing the mutated mutation tree to obtain test cases, and sending the test cases to the industrial control protocol for fuzz testing; Step S3: Update the weight of each leaf node according to the fuzzy test results, and obtain a new test case using the method in step S2; Step S4: Repeat steps S2 to S3 until the set number of iterations is reached.

2. The industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning according to claim 1 is characterized by: Instantiating the syntax tree to obtain a variant tree in step S1 includes the following steps: taking the message of the industrial control protocol as the root node and each field in the message as a child node, calculating the byte length of each field according to the ABNF description of the industrial control protocol, dividing the child node into two intermediate child nodes with the middle byte of each field as the boundary, repeating the division operation until the intermediate child node contains only one byte, taking the single-byte intermediate child node as a leaf node, and constructing a variant tree of the industrial control protocol.

3. The industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning according to claim 1 is characterized by: In step S2, the mutation tree is mutated, including the following steps: taking leaf nodes with weights greater than a preset threshold as pre-selected mutation points, randomly selecting several pre-selected mutation points as mutation nodes, formulating multiple mutation strategies, and using a heuristic algorithm to select a mutation strategy for each mutation node. The mutation strategies include type mutation, operation mutation, and combination field mutation.

4. The industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning according to claim 3 is characterized by: The type mutation selects a mutation strategy based on the character type of the leaf node of the mutation tree: When the character type of the leaf node is a numeric value, the leaf node is mutated by taking the critical value at the boundary of the numeric value; When the character type of the leaf node is a string, an overlong string or a string containing special characters is generated to mutate the leaf node; When the character type of the leaf node is binary, a bit reversal operation is used to mutate the leaf node.

5. The industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning according to claim 3 is characterized by: The operational mutation randomly selects the following strategies to mutate the mutation tree: A. Randomly select a leaf node to copy or delete; B. Randomly select a leaf node with a numerical value and randomly increase or decrease its value; C. Randomly select a leaf node and overwrite its value with randomly generated data; D. Randomly shuffle the order of leaf nodes.

6. The industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning according to claim 3 is characterized by: The combined field mutation combines the two leaf nodes with the closest weights into a new leaf node.

7. The industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning according to claim 1 is characterized in that: In step S3, the weight of each leaf node is updated according to the fuzzy test result, including the following steps: Step S31: Calculate the reward score of the test case based on the fuzz testing results: reward=coverage_reward+exception_reward coverage_reward=coverage_gain×coverage_weight; exception_reward=exception_gain×exception_weight Among them, reward is the reward score of the test case; coverage_reward is the coverage score of the test case; exception_reward is the exception detection rate score of the test case; coverage_gain is the coverage of the test case; coverage_weight is the coverage weight; exception_gain is the exception detection rate of the test case, which is 1 when the test case causes an exception, otherwise it is 0; exception_weight is the exception detection rate weight of the test case; Step S32: Adjust the values ​​of coverage weight and anomaly detection rate weight according to the test requirements. If the test attaches more importance to improving coverage, increase the coverage weight. If the test attaches more importance to discovering anomalies, increase the anomaly detection rate weight.

8. A fuzzy testing system for industrial control protocols based on paradigm grammar and reinforcement learning, implemented based on the fuzzy testing method for industrial control protocols based on paradigm grammar and reinforcement learning as claimed in any one of claims 1 to 7, characterized in that: It includes paradigm grammar description module, mutation module, use case generation module and reinforcement learning module; The paradigm grammar description module uses the extended Backus-Naur form (ABNF) to describe the industrial control protocol, constructs a syntax tree of the protocol, and instantiates the syntax tree to obtain a variant tree; The mutation module adopts a heuristic algorithm to select a mutation strategy and mutate the mutation tree; The use case generation module traverses the mutated mutation tree to generate test cases, and sends the test cases to the protocol to be tested for fuzz testing; The reinforcement learning module calculates the reward function of the test case based on the test results, dynamically updates the field weights, and guides the generation and mutation of subsequent test cases.

9. An electronic device comprising: A memory, a processor and a computer program, characterized in that: the computer program is stored in the memory and is configured to be executed by the processor to implement the industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the industrial control protocol fuzz testing method based on paradigm grammar and reinforcement learning as described in any one of claims 1 to 7.

Images