Master-slave parallel gray-box fuzz testing system and method for industrial control protocols

Abstract

The present invention discloses a master-slave parallel gray box fuzz testing system and method for industrial control protocols. The testing system includes a controller, which includes a global information collection and synchronization module and a centralized seed scheduling module. The global information collection and synchronization module collects information such as target state execution and seed operation during the operation of multiple fuzz test instances, and synchronizes it to all fuzz test instances. The centralized seed scheduling module is used to calculate the skip probability after the seed is selected during the fuzz test, and synchronizes it to the global information collection and synchronization module. Each fuzz test instance selects a seed to perform a fuzz test on the object to be tested, and after the fuzz test is completed, the target state and seed operation information of the fuzz test instance during operation are sent to the global information collection and synchronization module. The monitor is used to monitor whether the object to be tested crashes or times out, and sends the crash or timeout information of the object to be tested to the global information collection and synchronization module for recording.

Description

Technical Field

[0001] The present invention relates to fuzzy testing technology, and in particular to a master-slave parallel gray box fuzzy testing system and method for industrial control protocols. Background Art

[0002] With the rapid development of information technology, ICS (Integrated Control Systems) (ICS) have been widely used worldwide. According to the definition provided by the National Institute of Standards and Technology (NIST), ICS is a general term encompassing various types of control systems, including supervisory control and data acquisition systems (SCADA), distributed control systems (DCS), and other control systems such as programmable logic controllers (PLCs). These systems are commonly used in industrial and critical infrastructure control systems. Advances in smart sensor technology and wireless networks have reduced maintenance costs for the industrial sector and critical infrastructure while increasing operational speed. However, as a key means of communication among ICS components, ICS protocols have various vulnerabilities in their implementation, making them a persistent target for hacker attacks.

[0003] Currently, fuzz testing is the mainstream vulnerability discovery technique for industrial control protocols such as ICS protocols. Compared to other techniques, fuzz testing is easy to deploy, has good scalability and applicability, and can be performed with or without source code. Furthermore, because fuzz testing is performed during actual execution, its high accuracy is another major advantage. More importantly, fuzz testing requires minimal knowledge of the target program and can be easily scaled to large-scale applications. Therefore, fuzz testing is one of the most effective and advanced vulnerability discovery techniques currently available.

[0004] Parallel strategies are currently widely used in research on gray-box fuzz tester acceleration technologies in academia and industry. Existing fuzz testing parallel strategies are generally categorized into homogeneous and heterogeneous parallel strategies. Homogeneous parallel strategies use the same fuzz tester for each fuzz test instance, and due to their simplicity of implementation and strong system robustness, they have been widely adopted. However, their homogeneous nature results in insufficient diversity in fuzz testing strategies and limited overall efficiency improvements. Furthermore, homogeneous parallel strategies involve minimal information exchange between instances, potentially leading to significant redundancy in testing and a waste of valuable system resources. To address the challenges of homogeneous parallel strategies, heterogeneous parallel strategies integrate fuzzers with different mechanisms and use a master-slave architecture to schedule seed information.

[0005] At the same time, fuzz testing tools for protocol programs are different from those for ordinary programs, such as Figure 1As shown in Figure 2, fuzz testing of protocol programs is significantly more complex due to the large number of state transitions. However, current advanced homogeneous and heterogeneous parallel frameworks target only standard programs and lack significant compatibility with protocol programs that contain state information. This is primarily manifested in two aspects: an inability to identify and collect protocol program state information, and an inability to efficiently schedule all valid information. Therefore, addressing these issues has become a key challenge in the development of parallel frameworks for industrial control protocols. Summary of the Invention

[0006] In response to the above-mentioned deficiencies in the prior art, the master-slave parallel gray-box fuzz testing system and method for industrial control protocols provided by the present invention solves the problems that the existing fuzz testing methods cannot identify and collect protocol program status information, and cannot efficiently schedule all valid information.

[0007] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0008] In a first aspect, a master-slave parallel gray-box fuzz testing system for industrial control protocols is provided, which includes a controller, multiple different fuzz testing instances, and a monitor. The controller includes a global information collection and synchronization module and a centralized seed scheduling module.

[0009] The global information collection and synchronization module is used to collect the target state operation status, coverage bitmaps, seed execution status and seeds for generating new seeds when multiple fuzz test instances are running, and after integrating all coverage bitmaps, synchronize them with the target state operation status and seeds for generating new seeds to each fuzz test instance;

[0010] The centralized seed scheduling module is used to calculate the skip probability of each seed after it is selected during fuzz testing based on the seed execution status, and associate it with the seed that generates the new seed;

[0011] Each fuzz test instance is used to select a seed based on the initial information stored therein to perform fuzz testing on the object to be tested, where the object to be tested is an industrial control protocol; when the number of fuzz tests is greater than a first preset number, the score of the target state is calculated based on the received target state operation status, and the target state with the highest score is selected;

[0012] Based on the source of the seed, the skip probability after the seed is selected, and the selected target state, the seed is selected to perform fuzz testing on the object to be tested; if the termination condition of the fuzz test is not met, the fuzz test is continued; after each round of fuzz testing is completed, the coverage bitmap, target state operation status, seed execution status, and the seed that generated the new seed are sent to the global information collection and synchronization module;

[0013] The monitor is used to monitor whether the object under test crashes or times out, and sends the crash or timeout information of the object under test to the global information collection and synchronization module for recording.

[0014] Furthermore, according to the selected target state, the source of the seed, and the skip probability of the seed after being selected, the method of selecting the seed to perform fuzz testing on the object to be tested includes:

[0015] A1. Based on the selected target state, select all seeds in the seed list of the fuzz test instance that have the same target state;

[0016] A2. Determine whether the selected seed comes from the current fuzz test instance. If so, proceed to step A3; otherwise, proceed to step A4.

[0017] A3. Determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance;

[0018] A4. Determine whether to skip the current seed based on the skip probability after the seed is selected.

[0019] The beneficial effects of this technical solution are: if the seeds originate from the instance itself, a more appropriate strategy is used for seed scheduling; if the seeds originate from other instances, global information is used to schedule seeds at a macro level. This solution leverages both the depth of the instance's algorithm and the breadth of global information, fully leveraging the role of seeds and improving fuzz testing efficiency.

[0020] Furthermore, the target state operation status includes the number of times the target state performs fuzzy testing, the number of times the target state is selected, and the number of times the target state discovers a new path, which are stored in the state database;

[0021] The seed execution status is the seed information under different target states, which is stored in the seed database. The seed database uses a hash table to store information. The key in the hash table is the state name, the field is the MD5 value of the seed, and the value is the three attributes of the target state-seed tuple: the number of new seeds generated by the seed, the number of seed executions, and the execution efficiency of the seed.

[0022] Furthermore, the expression of the skip probability after the seed is selected is:

[0023]

[0024] Among them, e j and t j are the number of executions and the number of paths found by seed j in the same target state; M is a constant; efficiency i is the execution efficiency of seed j; SP jis the skip probability after seed j is selected.

[0025] The beneficial effect of the above technical solution is that the fuzz test instance can preferentially select excellent seeds that discover more paths with fewer execution times. Fuzz testing based on this seed can improve the efficiency of fuzz testing and cover more deep-level codes.

[0026] Furthermore, the expression for calculating the score of the target state is:

[0027]

[0028] Among them, score i is the score of target state i; K is a constant; f i The number of fuzz tests for target state i; s i is the number of times the target state i is selected, p i The number of paths found for goal state i; To round up.

[0029] The beneficial effect of the above technical solution is that the fuzz test instance can preferentially select a state that discovers more paths with fewer execution times. This state has greater exploration potential, and exploring it is more likely to cover more code, which helps to improve code coverage and discover vulnerabilities in this state.

[0030] Furthermore, the termination condition is that the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or the fuzzy test time reaches a preset test duration.

[0031] Furthermore, each fuzz test instance stores initial information including initial state information and an initial seed. The method for obtaining the initial seed includes:

[0032] The protocol messages of the object to be tested are divided into different types of messages using message status codes;

[0033] Different types of messages are put into different fuzz test instances as the initial seeds of the fuzz test instances.

[0034] Furthermore, the seeds for generating new seeds are stored in a global seed pool, and when the number of fuzzy tests is greater than a first preset number, the fuzzy test instance adds the seeds in the global seed pool to its seed list.

[0035] In a second aspect, this solution also provides a master-slave parallel gray-box fuzz testing method for industrial control protocols, which includes the following steps:

[0036] S1, the fuzzy test instance selects a seed to perform fuzz testing on the object to be tested based on its initial state information and seed information;

[0037] S2. Send the coverage bitmap, target state operation status, seed execution status and the seed that generates the new seed to the global information collection and synchronization module;

[0038] S3, determining whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a first preset number, if so, proceeding to S4, otherwise returning to S1;

[0039] S4, receiving the target state operation status, the integrated coverage bitmap and the seed for generating new seeds sent by the global information collection and synchronization module;

[0040] S5. Calculate the score of the target state according to the target state operation status, and select the target state with the highest score;

[0041] S6. Select a seed to perform fuzz testing on the object to be tested based on the source of the seed, the skip probability after the seed is selected, and the selected target state;

[0042] S7, sending the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds to the global information collection and synchronization module;

[0043] S8. Determine whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or whether the fuzzy test time reaches a preset test duration. If so, terminate the fuzzy test, otherwise return to step S4.

[0044] Furthermore, according to the selected target state, the source of the seed, and the skip probability of the seed after being selected, the method of selecting the seed to perform fuzz testing on the object to be tested includes:

[0045] A1. Based on the selected target state, select all seeds in the seed list of the fuzz test instance that have the same target state;

[0046] A2. Determine whether the selected seed comes from the current fuzz test instance. If so, proceed to step A3; otherwise, proceed to step A4.

[0047] A3. Determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance;

[0048] A4. Determine whether to skip the current seed based on the skip probability after the seed is selected.

[0049] The beneficial effects of the present invention are as follows: different fuzz testing instances generate new seeds with great differences due to different input seeds and technical routes. This solution uses multiple different fuzz testing instances to generate seeds in a very large coverage space with diverse strategies and inputs, thereby greatly improving code coverage efficiency.

[0050] Through the cooperation of the global information collection and synchronization module and the centralized seed scheduling module, the target state operation status and seed execution status generated by multiple fuzz test instances can be collected, and these data can be synchronized to each fuzz test instance to guide their further testing. This allows different fuzz test instances to exchange information efficiently, thereby improving the overall fuzz test efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A sample diagram used to explain network protocol fuzz testing.

[0052] Figure 2 Principle block diagram of the master-slave parallel gray-box fuzz testing system for industrial control protocols.

[0053] Figure 3 Flowchart of the master-slave parallel gray-box fuzz testing method for industrial control protocols.

[0054] Figure 4 A comparison chart of the effects of different numbers of fuzz testing instances. DETAILED DESCRIPTION

[0055] The specific embodiments of the present invention are described below to facilitate understanding of the present invention by those skilled in the art. However, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the appended claims, these changes are obvious, and all inventions and creations utilizing the concepts of the present invention are protected.

[0056] like Figure 2 As shown in the figure, the master-slave parallel gray-box fuzz testing system for industrial control protocols provided by this solution includes a controller, multiple different fuzz testing instances, and a monitor. The controller includes a global information collection and synchronization module and a centralized seed scheduling module. The monitor is used to monitor whether the test object crashes or timeouts, and sends the crash or timeout information to the global information collection and synchronization module for recording.

[0057] The global information collection and synchronization module is used to collect the target state operation status, coverage bitmap, seed execution status and seeds for generating new seeds when multiple fuzz test instances are running, and after integrating all coverage bitmaps, synchronize them with the target state operation status and seeds for generating new seeds to each fuzz test instance.

[0058] The integration of all coverage bitmaps is accomplished by taking the union of the coverage bitmap indices sent by all collected fuzz test instances and taking the minimum value of the corresponding index as the integrated coverage bitmap. During synchronization, this solution uses the integrated coverage bitmap to overwrite the coverage bitmap of each fuzz test instance.

[0059] During implementation, the preferred target state operation status of this scheme includes the number of times the target state undergoes fuzz testing, the number of times the target state is selected, and the number of times the target state discovers a new path, which is stored in the state database;

[0060] The seed execution status is the seed information under different target states, which is stored in the seed database. The seed database uses a hash table to store information. The key in the hash table is the state name, the field is the MD5 value of the seed, and the value is the three attributes of the target state-seed tuple: the number of new seeds generated by the seed, the number of seed executions, and the execution efficiency of the seed.

[0061] To further explain the global information collection and synchronization module in detail, this solution preferably includes an information collector and an information synchronizer. The information collector mainly collects three types of information:

[0062] The first category is the protocol state execution status tested by the fuzz test instance. This information requires the fuzz test instance to record the execution status of the currently selected target state into the state database when it is running. The information collector obtains the global target state execution status by collecting and organizing the state database (which can be simply understood as merging them together).

[0063] The second category is the seed execution status of the fuzz test instance. Since the same seed may correspond to different states, the execution status of the current state-seed tuple is recorded in the seed database after each seed execution is completed. The information collector obtains the global seed execution status by collecting and organizing the seed database (which can be simply understood as merging them together).

[0064] The third category is seeds discovered by fuzz testing instances that need to be shared. Specifically, if a test sample generated by mutation based on this seed can discover new code coverage, this test sample will be added to the seed list as a new seed, and the original seed is called a seed that can discover new seeds, that is, a seed that needs to be shared. This type of seed is saved as a file in the shared seed directory. The information collector then scans the shared seed directory of each fuzz testing instance and adds the seed files therein to the global seed pool. Each fuzz testing instance regularly synchronizes all seeds in the global seed pool and then tends to select seeds with the potential to discover new code coverage for testing.

[0065] The information synchronizer is mainly used to synchronize the information collected by the information collector to all fuzz testing instances and the centralized seed scheduling module.

[0066] The centralized seed scheduling module is used to calculate the skip probability of each seed after being selected during fuzz testing based on the seed execution status, and associate it with the seeds collected by the global information collection and synchronization module to generate new seeds.

[0067] Specifically, the centralized seed scheduling module includes a seed efficiency analyzer and a seed scheduler. The seed efficiency analyzer uses the ratio of the number of paths found and the number of seed executions as the seed execution efficiency based on the seed execution status collected by the information collector.

[0068] The centralized seed scheduler calculates the skip probability of each seed after it is selected based on the seed execution efficiency and stores it in the seed database. After selecting a seed, the fuzz test instance will decide whether to skip the execution of the current seed based on the skip probability of the seed after it is selected in the seed database.

[0069] Each fuzz test instance (the fuzz test instance in this scheme is actually a fuzz tester) is used to select seeds based on the initial information stored in it to perform fuzz testing on the object to be tested. The object to be tested is an industrial control protocol, and the initial information is the initial state information and the initial seed.

[0070] The method for selecting seeds to perform fuzz testing on the object to be tested based on the initial information stored is: select a state information in a traversal manner, and then select all seeds with the same target state in the seed list of the fuzz test instance; determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance.

[0071] When the number of fuzzy tests is greater than the first preset number, the target state operation status, the integrated coverage bitmap and the seed for generating new seeds sent by the global information collection and synchronization module are received; based on the received target state operation status, the score of the target state is calculated, and the target state with the highest score is selected.

[0072] According to the running status of the target state, the score of the target state is calculated:

[0073]

[0074] Among them, score i is the score of target state i; K is a constant; f i The number of fuzz tests for target state i; s i is the number of times the target state i is selected, p i The number of paths found for goal state i; To round up.

[0075] According to the source of the seed, the skip probability after the seed is selected, and the selected target state, the seed is selected to perform fuzzy testing on the object to be tested. During implementation, the expression of the skip probability after the seed is selected is:

[0076]

[0077] Among them, e j and t j are the number of executions and the number of paths found of seed j in the same target state; M is a constant; efficiency i is the execution efficiency of seed j; SP j is the skip probability after seed j is selected.

[0078] When the termination condition of the fuzz test is not met, the fuzz test continues to be performed; after each round of fuzz testing is completed, the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds are sent to the global information collection and synchronization module; the termination condition is that the total number of fuzz tests performed by all fuzz test instances is greater than the second preset number or the fuzz test time reaches the preset test duration.

[0079] In the fuzz testing instance of this solution, it is necessary to obtain the md5 value of the seed when performing fuzz testing, and it will temporarily store the status data according to the status of the seed; after each round of fuzz testing, it sends instructions to the global information collection and synchronization module to update the status of the operation; after each round of fuzz testing, it checks the synchronization directory and sends the seeds that can find new seeds to the global information collection and synchronization module to update the global seed pool. When receiving the seed execution status synchronized by the global information collection and synchronization module, these seeds from other instances are marked with foreign tags to facilitate identification of whether the seeds come from themselves when selecting seeds later.

[0080] In one embodiment of the present invention, a method for selecting a seed to perform a fuzzy test on an object to be tested based on a selected target state, a source of the seed, and a skip probability of the seed after the seed is selected includes:

[0081] A1. Based on the selected target state, select all seeds in the seed list of the fuzz test instance that have the same target state;

[0082] A2. Determine whether the selected seed comes from the current fuzz test instance. If so, proceed to step A3; otherwise, proceed to step A4.

[0083] A3. Determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance;

[0084] A4. Determine whether to skip the current seed based on the skip probability after the seed is selected.

[0085] To ensure smooth fuzz testing, the afl-g++ tool is used to instrument the object at compile time before fuzz testing to obtain coverage information during fuzz testing. The object interacts with the fuzz test instance and monitor via a network link.

[0086] During implementation, the method for obtaining the initial seed in each fuzzy test instance preferably includes:

[0087] The protocol messages of the object to be tested are divided into different types of messages using message status codes;

[0088] Different types of messages are put into different fuzz test instances as the initial seeds of the fuzz test instances.

[0089] In this solution, the seeds for generating new seeds are stored in a global seed pool, and when the number of fuzzy tests is greater than a first preset number, the fuzzy test instance adds the seeds in the global seed pool to the seed list.

[0090] refer to Figure 3 , Figure 3 A master-slave parallel gray-box fuzz testing method for an industrial control protocol is shown. The method S includes steps S1 to S8.

[0091] In step S1, the fuzz test instance selects a seed to perform fuzz testing on the object to be tested based on its initial state information and seed information:

[0092] A1. Based on the selected target state, select all seeds in the seed list of the fuzz test instance that have the same target state;

[0093] A2. Determine whether the selected seed comes from the current fuzz test instance. If so, proceed to step A3; otherwise, proceed to step A4.

[0094] A3. Determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance;

[0095] A4. Determine whether to skip the current seed based on the skip probability after the seed is selected.

[0096] In step S2, the coverage bitmap, target state operation status, seed execution status, and the seed for generating new seeds are sent to the global information collection and synchronization module;

[0097] In step S3, it is determined whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a first preset number. If so, the process proceeds to S4, otherwise it returns to S1;

[0098] In step S4, the target state operation status, the integrated coverage bitmap and the seed for generating the new seed are received from the global information collection and synchronization module;

[0099] In step S5, the scores of the target states are calculated according to the target state operation status, and the target state with the highest score is selected;

[0100] In step S6, a seed is selected to perform fuzzy testing on the object to be tested based on the source of the seed, the skip probability after the seed is selected, and the selected target state;

[0101] In step S7, the coverage bitmap, target state operation status, seed execution status, and the seed for generating new seeds are sent to the global information collection and synchronization module;

[0102] In step S8, it is determined whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or whether the fuzzy test time reaches a preset test duration. If so, the fuzzy test is terminated, otherwise it returns to step S4.

[0103] To facilitate understanding of the master-slave parallel gray-box fuzz testing method for industrial control protocols provided by this solution, the following is an illustration with specific examples:

[0104] The operating environment of this embodiment: it can be directly deployed and run on a host.

[0105] AFLNet (A Grey-Box Fuzz Testing Tool for Network Protocols) is an advanced grey-box fuzz testing tool for protocols. It generates an initial corpus by parsing network traffic, learns the server state machine, and uses coverage feedback to select and mutate message sequences to efficiently explore the state space. CIP is a widely used communication protocol in industrial automation. Built on a single, media-independent platform, it provides seamless communication for diverse scenarios, allowing users to integrate information related to safety, control, synchronization, motion, messaging, and configuration across different networks.

[0106] The following details how this solution uses AFLNet as a fuzz testing instance to test the CIP protocol, thereby obtaining and analyzing path coverage:

[0107] (1) Run the open source implementation of the CIP protocol, OpENer, and use Wireshark to capture packets on the corresponding port to obtain CIP protocol messages. These messages are then classified into different types according to their status codes.

[0108] (2) Analyze the obtained CIP protocol message and modify the aflnet.c file code according to the relevant AFLNet documents to expand the CIP protocol of AFLNet.

[0109] (3) Constructing a fuzz test instance: AFLNet is processed for parallel framework compatibility. Specifically, the following six parts of the code are updated: connecting to the master controller database and initializing, selecting the target state, selecting the initial seed, updating the state-seed database, updating the global seed pool, and updating the state database. The updated AFLNet is installed in docker as a fuzz test instance. A total of 4 fuzz test instances are constructed according to the requirements. Different types of messages in step (1) (different types of messages can be NoOperation type messages, RegisterSession type messages) are placed in different fuzz test instances as the initial seeds of the fuzz test instances.

[0110] (4) Construct the object to be tested: Use afl-g++ to compile the OpENer program as the object to be tested, and then connect it to the fuzz test instance through a network link.

[0111] The above steps (1) to (4) are the preparations before fuzz testing.

[0112] (5) Run the master-slave parallel architecture (a master controller controls the execution of multiple fuzz test instances at the same time) to accelerate the gray box fuzz testing of industrial control protocols: start the master controller through the command line, and after a series of processes such as reading the command line, registering the exit signal, initializing two databases, and starting the fuzz test instance, the master controller controls the fuzz test instance to start fuzz testing, and then the master controller enters information collection and synchronization.

[0113] (6) State selection algorithm: In the early stages of testing, due to the lack of prior knowledge, each fuzz tester (fuzz test instance) will poll all discovered states as the target state for each round of testing. After three rounds of fuzz testing (three rounds of fuzz testing means fuzz testing three target states), a certain amount of data is accumulated in the seed database, state database, and global seed pool, and the target state with the highest score is selected for testing.

[0114] (7) Seed selection algorithm: After selecting a state, a seed is selected for testing in the corresponding state of the state-seed database. The fuzz test instance first determines whether the selected seed comes from itself. If so, the original logic of the fuzz test instance (built-in seed selection strategy) is used to determine whether to skip the seed. Otherwise, the skip probability after the seed is selected is used to determine whether to skip the seed.

[0115] (8) Status - Seed database update: During the fuzz test instance test, every time a seed is executed, its execution count is updated in the database; every time a seed discovers a new path, its number of discovered paths is updated in the seed database.

[0116] (9) State database update: To prevent different fuzz test instances from competing in reading and writing the state database, each fuzz test instance sends a signal to the master controller after a round of fuzz test cycle ends. The master controller then updates the target state operation data of the fuzz test instance in this round.

[0117] (10) Global seed pool update: After a round of fuzz testing, each fuzz testing instance updates the seeds of the new seeds discovered in this round to the global seed pool. The master controller regularly distributes the seeds in the global seed pool to other fuzz testing instances.

[0118] The above steps (5) to (10) are related steps of the simulation test operation.

[0119] (11) System monitoring and report generation: System evaluation is performed based on the seeds generated by the fuzz test instances, such as performance evaluation and exception reporting. When a seed that triggers a vulnerability appears, the potential vulnerability and the corresponding seed are output as a report for vulnerability reproduction and analysis. A detailed test report is generated, including vulnerability description, seed information, and coverage change curve, etc., to facilitate tool performance analysis.

[0120] Step (11) is implemented using a monitor during the fuzz testing process.

[0121] This solution uses a master-slave parallel architecture to modularize the master controller and fuzz test instance functionality, making fuzz test instance selection more flexible. Fuzz test instances with different strategies can be selected based on the characteristics of different industrial control protocols. Compared to existing tools that can only use a single fuzz test instance, this solution can be integrated with advanced protocol fuzz testing tools such as AFLNet, StateAFL, and SNPSFuzzer to fuzz industrial control protocols.

[0122] In order to illustrate the test efficiency of this scheme, this scheme uses 2, 3, and 4 fuzz test instances (represented by design_2, design_3, and design_4 respectively) to run fuzz tests on the CIP protocol with AFLNet at the same time. The test results are as follows: Figure 4 shown.

[0123] like Figure 4 As shown, fuzz testing efficiency increases with the number of fuzz test instances, demonstrating the effectiveness of our solution when running multiple fuzz test instances simultaneously. When there are four fuzz test instances, it takes 296 seconds to discover 68 paths, while AFLNet takes 900 seconds to discover the same number of paths. This significantly improves the testing efficiency of our solution by 3.04 times that of AFLNet.

Claims

1. A master-slave parallel gray-box fuzz testing system for industrial control protocols, characterized by: The invention comprises a controller, a plurality of different fuzz testing instances and a monitor, wherein the controller comprises a global information collection and synchronization module and a centralized seed scheduling module; The global information collection and synchronization module is used to collect the target state operation status, coverage bitmaps, seed execution status and seeds for generating new seeds when multiple fuzz test instances are running, and after integrating all coverage bitmaps, synchronize them with the target state operation status and seeds for generating new seeds to each fuzz test instance; The centralized seed scheduling module is used to calculate the skip probability of each seed after it is selected during fuzz testing based on the seed execution status, and associate it with the seed that generates the new seed; Each fuzz test instance is used to select a seed based on the initial information stored therein to perform fuzz testing on the object to be tested, where the object to be tested is an industrial control protocol; When the number of fuzzy tests is greater than the first preset number, the score of the target state is calculated according to the received target state operation status, and the target state with the highest score is selected; Based on the source of the seed, the skip probability after the seed is selected, and the selected target state, the seed is selected to perform fuzz testing on the object to be tested; if the termination condition of the fuzz test is not met, the fuzz test is continued; after each round of fuzz testing is completed, the coverage bitmap, target state operation status, seed execution status, and the seed that generated the new seed are sent to the global information collection and synchronization module; The monitor is used to monitor whether the object under test crashes or times out, and sends the crash or timeout information of the object under test to the global information collection and synchronization module for recording.

2. The master-slave parallel gray-box fuzz testing system according to claim 1, characterized in that: Based on the selected target state, the source of the seed, and the skip probability after the seed is selected, the method of selecting the seed for fuzz testing of the object to be tested includes: A1. Based on the selected target state, select all seeds in the seed list of the fuzz test instance that have the same target state; A2. Determine whether the selected seed comes from the current fuzz test instance. If so, proceed to step A3; otherwise, proceed to step A4. A3. Determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance; A4. Determine whether to skip the current seed based on the skip probability after the seed is selected.

3. The master-slave parallel gray-box fuzz testing system according to claim 1, characterized in that: The target state operation status includes the number of times the target state performs fuzzy testing, the number of times the target state is selected, and the number of times the target state discovers new paths, which are stored in the state database; The seed execution status is the seed information under different target states, which is stored in the seed database. The seed database uses a hash table to store information. The key in the hash table is the state name, the field is the MD5 value of the seed, and the value is the three attributes of the target state-seed tuple: the number of new seeds generated by the seed, the number of seed executions, and the execution efficiency of the seed.

4. The master-slave parallel gray-box fuzz testing system according to claim 3, characterized in that: The expression for calculating the skip probability after a seed is selected is: Among them, e j and t j are the number of executions and the number of paths found by seed j in the same target state; M is a constant; efficiency i is the execution efficiency of seed j; SP j is the skip probability after seed j is selected.

5. The master-slave parallel gray-box fuzz testing system according to claim 3, characterized in that: The expression for calculating the score of the target state is: Among them, score i is the score of target state i; K is a constant; f i The number of fuzz tests for target state i; s i is the number of times the target state i is selected, p i The number of paths found for goal state i; To round up.

6. The master-slave parallel gray-box fuzz testing system according to claim 1, characterized in that: The termination condition is that the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or the fuzzy test time reaches a preset test duration.

7. The master-slave parallel gray-box fuzz testing system according to claim 1, characterized in that: Each fuzz test instance stores initial information including initial state information and initial seed. The method for obtaining the initial seed includes: The protocol messages of the object to be tested are divided into different types of messages using message status codes; Different types of messages are put into different fuzz test instances as the initial seeds of the fuzz test instances.

8. The master-slave parallel gray-box fuzz testing system according to claim 1, characterized in that: The seeds for generating new seeds are stored in a global seed pool, and when the number of fuzzy tests is greater than a first preset number, the fuzzy test instance adds the seeds in the global seed pool to its seed list.

9. A master-slave parallel gray-box fuzz testing method for industrial control protocols, characterized by: Including steps: S1, the fuzzy test instance selects a seed to perform fuzz testing on the object to be tested based on its initial state information and seed information; S2. Send the coverage bitmap, target state operation status, seed execution status and the seed that generates the new seed to the global information collection and synchronization module; S3, determining whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a first preset number, if so, proceeding to S4, otherwise returning to S1; S4, receiving the target state operation status, the integrated coverage bitmap and the seed for generating new seeds sent by the global information collection and synchronization module; S5. Calculate the score of the target state according to the target state operation status, and select the target state with the highest score; S6. Select a seed to perform fuzz testing on the object to be tested based on the source of the seed, the skip probability after the seed is selected, and the selected target state; S7, sending the coverage bitmap, target state operation status, seed execution status and the seed for generating new seeds to the global information collection and synchronization module; S8. Determine whether the total number of fuzzy tests performed by all fuzzy test instances is greater than a second preset number or whether the fuzzy test time reaches a preset test duration. If so, terminate the fuzzy test, otherwise return to step S4.

10. The master-slave parallel gray-box fuzz testing method according to claim 9, characterized in that: Based on the selected target state, the source of the seed, and the skip probability after the seed is selected, the method of selecting the seed for fuzz testing of the object to be tested includes: A1. Based on the selected target state, select all seeds in the seed list of the fuzz test instance that have the same target state; A2. Determine whether the selected seed comes from the current fuzz test instance. If so, proceed to step A3; otherwise, proceed to step A4. A3. Determine whether to skip the current seed based on the seed selection strategy built into the fuzz test instance; A4. Determine whether to skip the current seed based on the skip probability after the seed is selected.

Images