Master-slave parallel grey box fuzzy test system and method for industrial control protocol

Abstract

The invention discloses a master-slave parallel grey box fuzzy test system and method for an industrial control protocol, and the system comprises a controller which comprises a global information collection and synchronization module and a centralized seed scheduling module. The global information collection and synchronization module is used for collecting information such as target state execution and seed operation when a plurality of fuzzy test examples run, and synchronizing the information to all the fuzzy test examples; the centralized seed scheduling module is used for calculating the skipping probability after seeds are selected during fuzzy testing and synchronizing the skipping probability to the global information collection and synchronization module; each fuzzy test instance selects a seed to perform fuzzy test on an object to be tested, and after the fuzzy test is completed, information such as a target state and seed operation during operation of the fuzzy test instance is sent to a global information collection and synchronization module; the monitor is used for monitoring whether the to-be-tested object crashes or is overtime, and sending information that the to-be-tested object crashes or is overtime to the global information collection and synchronization module for recording.

Description

Technical Field

[0001] The present invention relates to fuzzy testing technology, and in particular to a master-slave parallel gray box fuzzy testing system and method for industrial control protocols. Background Art

[0002] With the rapid development of information technology, ICS has been widely used around the world. According to the definition given by the National Institute of Standards and Technology of the United States, ICS is a general term covering various types of control systems, including monitoring and data acquisition systems, distributed control systems, and other control systems, such as programmable logic controllers, which are commonly used in industrial fields and control systems of critical infrastructure. Due to the advancement of smart sensor technology and wireless networks, ICS has reduced the maintenance costs of the industrial sector and critical infrastructure while increasing the speed of operation. As an important means of communication for ICS components, the ICS protocol has different types of vulnerabilities in its implementation, so the ICS protocol has always been one of the targets of hacker attacks.

[0003] At present, fuzz testing technology is the mainstream vulnerability discovery technology for industrial control protocols such as ICS protocols. Compared with other technologies, fuzz testing is easy to deploy, has good scalability and applicability, and can be performed with or without source code. In addition, since fuzz testing is performed in actual execution, its extremely high accuracy becomes another major advantage. More importantly, fuzz testing requires little knowledge of the target program and can be easily extended to large-scale applications. Therefore, fuzz testing is one of the most effective and advanced vulnerability discovery technologies currently.

[0004] At present, parallel strategies are widely used in the research on gray-box fuzz tester acceleration technology in academia and industry. Existing fuzz test parallel strategies are generally divided into two categories: homogeneous parallel and heterogeneous parallel. In the homogeneous parallel strategy, each fuzz test instance uses the same fuzz tester. Due to its simple implementation and strong system robustness, it has been widely used. However, its homogeneous characteristics lead to insufficient diversity of fuzz test strategies and no obvious improvement in overall efficiency. At the same time, there is very little information exchange between instances in the homogeneous parallel strategy, which may lead to a large amount of redundancy in the test and waste precious system resources. In order to solve the problems of the homogeneous parallel strategy, the heterogeneous parallel strategy integrates fuzzers with multiple different mechanisms and uses a master-slave structure to schedule seed information.

[0005] At the same time, fuzz testing tools for protocol programs are different from those for ordinary programs, such as Figure 1As shown in the figure, due to the large number of state transitions in protocol programs, fuzz testing for protocol programs is more complicated. However, the current advanced isomorphic parallel frameworks and heterogeneous parallel frameworks are only for ordinary programs, and have significant compatibility deficiencies for protocol programs with state information, which are mainly manifested in the following two aspects: the inability to identify and collect protocol program state information, and the inability to efficiently schedule all valid information. Therefore, how to solve the above problems has become an important challenge in the development of industrial control protocol parallel frameworks. Summary of the invention

[0006] In view of the above-mentioned deficiencies in the prior art, the master-slave parallel gray box fuzz testing system and method for industrial control protocols provided by the present invention solves the problems that the existing fuzz testing methods cannot identify and collect protocol program status information, and cannot efficiently schedule all valid information.

[0007] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0008] In a first aspect, a master-slave parallel gray-box fuzz testing system for an industrial control protocol is provided, which includes a controller, a plurality of different fuzz testing instances and a monitor, wherein the controller includes a global information collection and synchronization module and a centralized seed scheduling module;

[0009] The global information collection and synchronization module is used to collect the target state operation status, coverage bitmaps, seed execution status and seeds for generating new seeds when multiple fuzz test instances are running, and after integrating all coverage bitmaps, synchronize them with the target state operation status and seeds for generating new seeds to each fuzz test instance;

[0010] The centralized seed scheduling module is used to calculate the skip probability of each seed after it is selected during fuzz testing according to the seed execution status, and associate it with the seed that generates the new seed;

[0011] Each fuzz test instance is used to select a seed to perform a fuzz test on the object to be tested according to the initial information stored therein, and the object to be tested is an industrial control protocol; when the number of fuzz tests is greater than the first preset number, the score of the target state is calculated according to the received target state operation status, and the target state with the highest score is selected;

[0012] According to the source of the seed, the skip probability after the seed is selected and the selected target state, the seed is selected to perform fuzz testing on the object to be tested; when the termination condition of the fuzz test is not met, the fuzz test is continued; after each round of fuzz testing is completed, the coverage bitmap, the target state operation status, the seed execution status and the seed that generates the new seed are sent to the global information collection and synchronization module;

[0013] The monitor is used to monitor whether the object under test crashes or times out, and send the crash or timeout information of the object under test to the global information collection and synchronization module for recording.

[0014] Furthermore, according to the selected target state, the source of the seed and the skip probability of the seed after being selected, the method of selecting the seed to perform fuzzy testing on the object to be tested includes:

[0015] A1. According to the selected target state, select all seeds in the seed list of the fuzzy test instance that have the same target state;

[0016] A2, determine whether the selected seed comes from the current fuzzy test instance, if so, go to step A3, otherwise go to step A4;

[0017] A3. Determine whether to skip the current seed according to the seed selection strategy built into the fuzz test instance;

[0018] A4. Determine whether to skip the current seed according to the skip probability after the seed is selected.

[0019] The beneficial effects of the above technical solution are: if the seed comes from itself, a strategy more suitable for itself is used for seed scheduling; if the seed comes from other instances, global information is used to schedule the seed at the macro level. This solution can take into account both the depth advantage of the instance's own algorithm and the breadth advantage of global information, give full play to the role of seeds, and improve the efficiency of fuzz testing.

[0020] Further, the target state operation status includes the number of times the target state performs fuzzy testing, the number of times the target state is selected, and the number of times the target state discovers a new path, which is stored in the state database;

[0021] The seed execution status is the seed information under different target states, which is stored in the seed database. The seed database uses a hash table to store information. The key in the hash table is the state name, the field is the md5 value of the seed, and the value is the three attributes of the target state-seed tuple: the number of new seeds generated by the seed, the number of seed executions, and the execution efficiency of the seed.

[0022] Furthermore, the expression of the skip probability after the seed is selected is:

[0023]

[0024] Among them, e j and t j are the number of executions and the number of paths found of seed j in the same target state; M is a constant; efficiency i is the execution efficiency of seed j; SP jis the skip probability after seed j is selected.

[0025] The beneficial effect of the above technical solution is that the fuzz test instance can preferentially select excellent seeds that discover more paths with fewer execution times. Fuzz testing based on the seeds can improve the efficiency of fuzz testing and cover more deep-level codes.

[0026] Furthermore, the expression for calculating the score of the target state is:

[0027]

[0028] Among them, score i is the score of target state i; K is a constant; f i The number of fuzz tests for target state i; s i is the number of times the target state i is selected, p i The number of paths found for goal state i; To round up.

[0029] The beneficial effect of the above technical solution is that the fuzz test instance can give priority to the state that discovers more paths with fewer execution times. This state has greater exploration potential, and exploring it is more likely to cover more code, which helps to improve code coverage and discover vulnerabilities in this state.

[0030] Furthermore, the termination condition is that the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or the fuzzy test time reaches a preset test duration.

[0031] Furthermore, each fuzzy test instance includes initial state information and an initial seed according to the initial information stored therein, and a method for obtaining the initial seed includes:

[0032] The protocol messages of the object to be tested are divided into different types of messages using message status codes;

[0033] Different types of messages are put into different fuzz test instances as the initial seeds of the fuzz test instances.

[0034] Further, the seeds for generating new seeds are stored in a global seed pool, and when the number of fuzzy tests is greater than a first preset number, the fuzzy test instance adds the seeds in the global seed pool to its seed list.

[0035] In a second aspect, the present solution also provides a master-slave parallel gray box fuzz testing method for an industrial control protocol, which comprises the following steps:

[0036] S1, the fuzzy test instance selects a seed to perform fuzzy testing on the object to be tested according to its initial state information and seed information;

[0037] S2, sending the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds to the global information collection and synchronization module;

[0038] S3, determining whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a first preset number, if so, proceeding to S4, otherwise returning to S1;

[0039] S4, receiving the target state operation status, the integrated coverage bitmap and the seed for generating new seeds sent by the global information collection and synchronization module;

[0040] S5. Calculate the score of the target state according to the target state operation status, and select the target state with the highest score;

[0041] S6. Select a seed to perform fuzzy testing on the object to be tested according to the source of the seed, the skip probability after the seed is selected, and the selected target state;

[0042] S7, sending the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds to the global information collection and synchronization module;

[0043] S8. Determine whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or whether the fuzzy test time reaches a preset test duration. If so, terminate the fuzzy test, otherwise return to step S4.

[0044] Furthermore, according to the selected target state, the source of the seed and the skip probability of the seed after being selected, the method of selecting the seed to perform fuzzy testing on the object to be tested includes:

[0045] A1. According to the selected target state, select all seeds in the seed list of the fuzzy test instance that have the same target state;

[0046] A2, determine whether the selected seed comes from the current fuzzy test instance, if so, go to step A3, otherwise go to step A4;

[0047] A3. Determine whether to skip the current seed according to the seed selection strategy built into the fuzz test instance;

[0048] A4. Determine whether to skip the current seed according to the skip probability after the seed is selected.

[0049] The beneficial effect of the present invention is that different fuzz testing instances generate new seeds with great differences due to different input seeds and technical routes. This scheme uses multiple different fuzz testing instances to generate seeds in a very large coverage space with diversified strategies and inputs, thereby greatly improving the code coverage efficiency.

[0050] Through the cooperation of the global information collection and synchronization module and the centralized seed scheduling module, the target state operation status and seed execution status generated by multiple fuzz test instances can be collected, and these data can be synchronized to each fuzz test instance to guide their further testing, so that different fuzz test instances can exchange information efficiently, thereby improving the overall fuzz test efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A sample diagram for explaining network protocol fuzz testing.

[0052] Figure 2 Principle block diagram of the master-slave parallel gray-box fuzz testing system for industrial control protocols.

[0053] Figure 3 The flowchart of the master-slave parallel gray-box fuzz testing method for industrial control protocols.

[0054] Figure 4 The following is a comparison chart of the effects of different numbers of fuzzy test instances. DETAILED DESCRIPTION

[0055] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0056] like Figure 2 As shown, the master-slave parallel gray-box fuzz testing system for industrial control protocols provided by this solution includes a controller, multiple different fuzz testing instances and a monitor. The controller includes a global information collection and synchronization module and a centralized seed scheduling module. The monitor is used to monitor whether the object under test crashes or times out, and sends the crash or timeout information of the object under test to the global information collection and synchronization module for recording.

[0057] The global information collection and synchronization module is used to collect the target state operation status, coverage bitmap, seed execution status and seeds for generating new seeds when multiple fuzz test instances are running, and after integrating all coverage bitmaps, synchronize them with the target state operation status and seeds for generating new seeds to each fuzz test instance.

[0058] The specific method of integrating all coverage bitmaps is to take the union of the coverage bitmap indexes sent by all collected fuzzy test instances, and take the minimum value corresponding to the index as the integrated coverage bitmap. During synchronization, this solution uses the integrated coverage bitmap to cover the coverage bitmap of each fuzzy test instance.

[0059] When implemented, the preferred target state operation of this scheme includes the number of times the target state is fuzzy tested, the number of times the target state is selected, and the number of times the target state finds a new path, which is stored in the state database;

[0060] The seed execution status is the seed information under different target states, which is stored in the seed database. The seed database uses a hash table to store information. The key in the hash table is the state name, the field is the MD5 value of the seed, and the value is the three attributes of the target state-seed tuple: the number of new seeds generated by the seed, the number of seed executions, and the execution efficiency of the seed.

[0061] In order to further explain the global information collection and synchronization module in detail, the global information collection and synchronization module preferably includes an information collector and an information synchronizer. The information collector mainly collects three types of information:

[0062] The first category is the protocol state execution status of the fuzz test instance test. This information requires the fuzz test instance to record the execution status of the currently selected target state into the state database when it is running. The information collector obtains the global target state execution status by collecting and organizing the state database (which can be simply understood as merging them together).

[0063] The second category is the seed execution status of the fuzz test instance. Since the same seed may correspond to different states, the execution status of the current state-seed tuple is recorded in the seed database after each seed execution is completed. The information collector obtains the global seed execution status by collecting and organizing the seed database (which can be simply understood as merging them together).

[0064] The third category is the seeds that need to be shared by the fuzz test instance. Specifically, the test sample generated by mutation based on this seed can discover new code coverage. The test sample will be added to the seed list as a new seed, and the original seed is called the seed that can discover new seeds, that is, the seed that needs to be shared. This type of seed will be saved in the shared seed directory in the form of a file. Then, the information collector scans the shared seed directory of each fuzz test instance and adds the seed files therein to the global seed pool. Each fuzz test instance regularly synchronizes all seeds in the global seed pool, and then tends to select seeds that have the potential to discover new code coverage for testing.

[0065] The information synchronizer is mainly used to synchronize the information collected by the information collector to all fuzz test instances and centralized seed scheduling modules.

[0066] The centralized seed scheduling module is used to calculate the skip probability of each seed after being selected during fuzz testing according to the seed execution status, and associate it with the seeds collected by the global information collection and synchronization module to generate new seeds.

[0067] Specifically, the centralized seed scheduling module includes a seed efficiency analyzer and a seed scheduler. The seed efficiency analyzer uses the ratio of the number of discovered paths to the number of seed execution times as the seed execution efficiency based on the seed execution status collected by the information collector.

[0068] The centralized seed scheduler calculates the skip probability of each seed after it is selected based on the seed execution efficiency and stores it in the seed database. After selecting a seed, the fuzzy test instance will decide whether to skip the execution of the current seed based on the skip probability of the seed in the seed database after it is selected.

[0069] Each fuzz test instance (the fuzz test instance of this scheme is actually a fuzz tester) is used to select seeds to perform fuzz testing on the object to be tested based on the initial information stored therein. The object to be tested is an industrial control protocol, and the initial information is the initial state information and the initial seed.

[0070] The method for selecting seeds to perform fuzz testing on the object to be tested based on the initial information stored is: select a state information in a traversal manner, and then select all seeds in the seed list of the fuzz test instance that are the same as the target state; determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance.

[0071] When the number of fuzzy tests is greater than the first preset number, the target state operation status, the integrated coverage bitmap and the seed for generating new seeds sent by the global information collection and synchronization module are received; based on the received target state operation status, the score of the target state is calculated, and the target state with the highest score is selected.

[0072] According to the running status of the target state, the score of the target state is calculated:

[0073]

[0074] Among them, score i is the score of target state i; K is a constant; f i The number of fuzz tests for target state i; s i is the number of times the target state i is selected, p i The number of paths found for goal state i; To round up.

[0075] According to the source of the seed, the skip probability after the seed is selected and the selected target state, the seed is selected to perform fuzzy testing on the object to be tested. During implementation, the expression of the skip probability after the seed is selected in this scheme is:

[0076]

[0077] Among them, e j and t j are the number of executions and the number of paths found of seed j in the same target state; M is a constant; efficiency i is the execution efficiency of seed j; SP j is the skip probability after seed j is selected.

[0078] When the termination condition of the fuzz test is not met, the fuzz test continues to be performed; after each round of fuzz testing is completed, the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds are sent to the global information collection and synchronization module; the termination condition is that the total number of fuzz tests performed by all fuzz test instances is greater than the second preset number or the fuzz test time reaches the preset test duration.

[0079] In the fuzz testing instance of this scheme, it is necessary to obtain the md5 value of the seed when performing fuzz testing, and it will temporarily store the status data according to the status of the seed; after each round of fuzz testing, send instructions to let the global information collection and synchronization module update the status of the operation; after each round of fuzz testing, check the synchronization directory, and send the seeds that can find new seeds to the global information collection and synchronization module to update the global seed pool. When receiving the seed execution status synchronized by the global information collection and synchronization module, these seeds from other instances are marked with foreign tags to facilitate the subsequent identification of whether the seeds come from themselves when selecting seeds.

[0080] In one embodiment of the present invention, according to the selected target state, the source of the seed and the skip probability of the seed after being selected, the method of selecting the seed to perform fuzzy testing on the object to be tested includes:

[0081] A1. According to the selected target state, select all seeds in the seed list of the fuzzy test instance that have the same target state;

[0082] A2, determine whether the selected seed comes from the current fuzzy test instance, if so, go to step A3, otherwise go to step A4;

[0083] A3. Determine whether to skip the current seed according to the seed selection strategy built into the fuzz test instance;

[0084] A4. Determine whether to skip the current seed according to the skip probability after the seed is selected.

[0085] In order to ensure the smooth progress of fuzz testing, before fuzz testing the object under test, the afl-g++ tool needs to be used to perform compile-time instrumentation on the object under test to obtain its coverage information during fuzz testing. The object under test interacts with the fuzz test instance and the monitor through a network link.

[0086] During implementation, the method for obtaining the initial seed in each fuzzy test instance in this solution preferably includes:

[0087] The protocol messages of the object to be tested are divided into different types of messages using message status codes;

[0088] Different types of messages are put into different fuzz test instances as the initial seeds of the fuzz test instances.

[0089] In this solution, the seeds for generating new seeds are stored in a global seed pool, and when the number of fuzzy tests is greater than a first preset number, the fuzzy test instance adds the seeds in the global seed pool to the seed list.

[0090] refer to Figure 3 , Figure 3 A master-slave parallel gray box fuzz testing method for an industrial control protocol is shown. The method S comprises steps S1 to S8.

[0091] In step S1, the fuzzy test instance selects a seed to perform fuzzy testing on the object to be tested according to its initial state information and seed information:

[0092] A1. According to the selected target state, select all seeds in the seed list of the fuzzy test instance that have the same target state;

[0093] A2, determine whether the selected seed comes from the current fuzzy test instance, if so, go to step A3, otherwise go to step A4;

[0094] A3. Determine whether to skip the current seed according to the seed selection strategy built into the fuzz test instance;

[0095] A4. Determine whether to skip the current seed according to the skip probability after the seed is selected.

[0096] In step S2, the coverage bitmap, target state operation status, seed execution status, and the seed for generating new seeds are sent to the global information collection and synchronization module;

[0097] In step S3, it is determined whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a first preset number, if so, proceed to S4, otherwise return to S1;

[0098] In step S4, receiving the target state operation status, the integrated coverage bitmap and the seed for generating the new seed sent by the global information collection and synchronization module;

[0099] In step S5, the score of the target state is calculated according to the target state operation status, and the target state with the highest score is selected;

[0100] In step S6, a seed is selected to perform a fuzzy test on the object to be tested according to the source of the seed, the skip probability after the seed is selected, and the selected target state;

[0101] In step S7, the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds are sent to the global information collection and synchronization module;

[0102] In step S8, determine whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or whether the fuzzy test time reaches a preset test duration. If so, terminate the fuzzy test, otherwise return to step S4.

[0103] In order to facilitate the understanding of the master-slave parallel gray-box fuzz testing method for industrial control protocols provided by this solution, the following is an explanation with specific examples:

[0104] The operating environment of this embodiment: it can be directly deployed and run on a host.

[0105] AFLNet (Gray-box Fuzz Testing Tool for Network Protocols) is an advanced gray-box fuzz testing tool for protocols. It generates an initial corpus by parsing network traffic, learns the server state machine, and uses coverage feedback to select and mutate message sequences to effectively explore the state space. The CIP protocol is a communication protocol widely used in the field of industrial automation. It is built on a single, media-independent platform and provides seamless communication for different scenarios, allowing users to integrate information on safety, control, synchronization, motion, messages, and configuration across different networks.

[0106] The following is a detailed description of how this solution uses AFLNet as a fuzz testing instance to test the CIP protocol, thereby obtaining and analyzing the path coverage:

[0107] (1) Run the open source implementation of the CIP protocol, OpENer, and use Wireshark to capture packets on the corresponding port to obtain CIP protocol messages. These messages are then classified into different types according to the message status codes.

[0108] (2) Analyze the obtained CIP protocol message and modify the aflnet.c file code according to the relevant documents of AFLNet to expand the CIP protocol of AFLNet.

[0109] (3) Construct a fuzz test instance: Perform parallel framework compatibility processing on AFLNet. Specifically, update the following six parts of the code: connect to the master controller database and initialize, select the target state, select the initial seed, update the state-seed database, update the global seed pool, and update the state database. Install the updated AFLNet into docker as a fuzz test instance, and construct a total of 4 fuzz test instances according to the requirements. Put different types of messages in step (1) (different types of messages can be NoOperation type messages, RegisterSession type messages) into different fuzz test instances as the initial seeds of the fuzz test instances.

[0110] (4) Construct the object to be tested: Use afl-g++ to compile-time instrument the OpENer program as the object to be tested, and then connect it to the fuzz test instance through a network link.

[0111] The above steps (1) to (4) are the preparations before fuzz testing.

[0112] (5) Run the master-slave parallel architecture (a master controller controls the execution of multiple fuzz test instances at the same time) to accelerate the gray box fuzz testing of industrial control protocols: start the master controller through the command line. After a series of processes such as reading the command line, registering the exit signal, initializing two databases, and starting the fuzz test instance, the master controller controls the fuzz test instance to start the fuzz test. Then the master controller enters the information collection and synchronization process.

[0113] (6) State selection algorithm: In the early stage of testing, due to the lack of prior knowledge, each fuzz tester (fuzz test instance) will poll all discovered states as the target state for each round of testing. After three rounds of fuzz testing (three rounds of testing means fuzz testing three target states), a certain amount of data is accumulated in the seed database, state database and global seed pool, and the target state with the highest score is selected for testing.

[0114] (7) Seed selection algorithm: After selecting a state, a seed is selected for testing in the corresponding state of the state-seed database. The fuzzy test instance first determines whether the selected seed comes from itself. If so, the original logic of the fuzzy test instance (built-in seed selection strategy) is used to determine whether to skip the seed; otherwise, the skip probability after the seed is selected is used to determine whether to skip the seed.

[0115] (8) Status - Seed database update: During the fuzz test instance testing process, every time a seed is executed, its execution count is updated in the database; every time a seed discovers a new path, its number of discovered paths is updated in the seed database.

[0116] (9) State database update: In order to prevent different fuzz test instances from competing in reading and writing the state database, each fuzz test instance sends a signal to the master controller after a round of fuzz test cycle ends, and the master controller updates the target state operation data of the fuzz test instance in this round.

[0117] (10) Global seed pool update: After a round of fuzz testing, each fuzz testing instance updates the seeds discovered in this round to the global seed pool. The master controller periodically distributes the seeds in the global seed pool to other fuzz testing instances.

[0118] The above steps (5) to (10) are related steps of the simulation test operation.

[0119] (11) System monitoring and report generation: System evaluation is performed based on the seeds generated by the fuzz test instance, such as performance evaluation and exception reporting. When a seed that triggers a vulnerability appears, the potential vulnerability and the corresponding seed are output as an output report for vulnerability reproduction and analysis. A detailed test report is generated, including vulnerability description, seed information, and coverage change curve, etc., to analyze tool performance.

[0120] Step (11) is implemented using a monitor during the fuzz testing process.

[0121] This solution uses a master-slave parallel architecture to modularize the master controller and fuzz test instance functions, making the fuzz test instance selection more flexible. Fuzz test instances with different strategies can be selected according to the characteristics of different industrial control protocols. Compared with existing tools that can only use a single fuzz test instance, this solution can be integrated in advanced protocol fuzz test tools such as AFLNet, StateAFL, and SNPSFuzzer to perform fuzz testing on industrial control protocols.

[0122] In order to illustrate the test efficiency of this scheme, this scheme uses 2, 3, and 4 fuzzy test instances (represented by design_2, design_3, and design_4 respectively) to run fuzzy tests on the CIP protocol with AFLNet at the same time. The test results are shown in the figure. Figure 4 shown.

[0123] like Figure 4 As shown in the figure, the fuzz testing efficiency increases with the number of fuzz testing instances, indicating the effectiveness of the scheme running multiple fuzz testing instances simultaneously. When there are 4 fuzz testing instances, it takes 296 seconds to find 68 paths, while AFLNet takes 900 seconds to find the same number of paths. The test efficiency of this scheme is 3.04 times that of AFLNet, which greatly improves the test efficiency.

Claims

1. A master-slave parallel gray-box fuzz testing system for industrial control protocols, characterized by: It includes a controller, a plurality of different fuzz testing instances and a monitor, wherein the controller includes a global information collection and synchronization module and a centralized seed scheduling module; The global information collection and synchronization module is used to collect the target state operation status, coverage bitmaps, seed execution status and seeds for generating new seeds when multiple fuzz test instances are running, and after integrating all coverage bitmaps, synchronize them with the target state operation status and seeds for generating new seeds to each fuzz test instance; The centralized seed scheduling module is used to calculate the skip probability of each seed after it is selected during fuzz testing according to the seed execution status, and associate it with the seed that generates the new seed; Each fuzz test instance is used to select a seed to perform fuzz testing on the object to be tested according to the initial information stored therein, and the object to be tested is an industrial control protocol; When the number of fuzzy tests is greater than the first preset number, the score of the target state is calculated according to the received target state operation status, and the target state with the highest score is selected; According to the source of the seed, the skip probability after the seed is selected and the selected target state, the seed is selected to perform fuzz testing on the object to be tested; when the termination condition of the fuzz test is not met, the fuzz test is continued; after each round of fuzz testing is completed, the coverage bitmap, the target state operation status, the seed execution status and the seed that generates the new seed are sent to the global information collection and synchronization module; The monitor is used to monitor whether the object under test crashes or times out, and send the crash or timeout information of the object under test to the global information collection and synchronization module for recording.

2. The master-slave parallel gray box fuzz testing system according to claim 1, characterized in that: According to the selected target state, the source of the seed and the skip probability after the seed is selected, the method of selecting the seed for fuzz testing of the object to be tested includes: A1. According to the selected target state, select all seeds in the seed list of the fuzzy test instance that have the same target state; A2, determine whether the selected seed comes from the current fuzzy test instance, if so, go to step A3, otherwise go to step A4; A3. Determine whether to skip the current seed according to the seed selection strategy built into the fuzz test instance; A4. Determine whether to skip the current seed according to the skip probability after the seed is selected.

3. The master-slave parallel gray box fuzz testing system according to claim 1, characterized in that: The target state operation status includes the number of times the target state performs fuzzy testing, the number of times the target state is selected, and the number of times the target state discovers a new path, which is stored in a state database; The seed execution status is the seed information under different target states, which is stored in the seed database. The seed database uses a hash table to store information. The key in the hash table is the state name, the field is the md5 value of the seed, and the value is the three attributes of the target state-seed tuple: the number of new seeds generated by the seed, the number of seed executions, and the execution efficiency of the seed.

4. The master-slave parallel gray box fuzz testing system according to claim 3, characterized in that: The expression for calculating the skip probability after a seed is selected is: Among them, e j and t j are the number of executions and the number of paths found of seed j in the same target state; M is a constant; efficiency i is the execution efficiency of seed j; SP j is the skip probability after seed j is selected.

5. The master-slave parallel gray box fuzz testing system according to claim 3, characterized in that: The expression for calculating the score of the target state is: Among them, score i is the score of target state i; K is a constant; f i The number of fuzz tests for target state i; s i is the number of times the target state i is selected, p i The number of paths found for goal state i; To round up.

6. The master-slave parallel gray box fuzz testing system according to claim 1, characterized in that: The termination condition is that the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or the fuzzy test time reaches a preset test duration.

7. The master-slave parallel gray box fuzz testing system according to claim 1, characterized in that: Each fuzz test instance includes initial state information and initial seed according to the initial information stored therein. The method for obtaining the initial seed includes: The protocol messages of the object to be tested are divided into different types of messages using message status codes; Different types of messages are put into different fuzz test instances as the initial seeds of the fuzz test instances.

8. The master-slave parallel gray box fuzz testing system according to claim 1, characterized in that: The seeds for generating new seeds are stored in a global seed pool, and when the number of fuzzy tests is greater than a first preset number, the fuzzy test instance adds the seeds in the global seed pool to its seed list.

9. A master-slave parallel gray-box fuzz testing method for industrial control protocols, characterized by: Includes steps: S1, the fuzzy test instance selects a seed to perform fuzzy testing on the object to be tested according to its initial state information and seed information; S2, sending the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds to the global information collection and synchronization module; S3, determining whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a first preset number, if so, proceeding to S4, otherwise returning to S1; S4, receiving the target state operation status, the integrated coverage bitmap and the seed for generating new seeds sent by the global information collection and synchronization module; S5. Calculate the score of the target state according to the target state operation status, and select the target state with the highest score; S6. Select a seed to perform fuzzy testing on the object to be tested according to the source of the seed, the skip probability after the seed is selected, and the selected target state; S7, sending the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds to the global information collection and synchronization module; S8. Determine whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or whether the fuzzy test time reaches a preset test duration. If so, terminate the fuzzy test, otherwise return to step S4.

10. The master-slave parallel gray box fuzz testing method according to claim 9, characterized in that: According to the selected target state, the source of the seed and the skip probability after the seed is selected, the method of selecting the seed for fuzz testing of the object to be tested includes: A1. According to the selected target state, select all seeds in the seed list of the fuzzy test instance that have the same target state; A2, determine whether the selected seed comes from the current fuzzy test instance, if so, go to step A3, otherwise go to step A4; A3. Determine whether to skip the current seed according to the seed selection strategy built into the fuzz test instance; A4. Determine whether to skip the current seed according to the skip probability after the seed is selected.

Images