Internet of Things firmware fuzz testing method based on grey box technology

Abstract

The invention belongs to the technical field of fuzz testing, and discloses an internet of things firmware fuzz testing method based on a grey box technology, which comprises the following steps: S1, acquiring an external interface and a specification of internet of things firmware, and determining a protocol format of the internet of things firmware; s2, performing format analysis on the obtained Internet of Things firmware, and automatically identifying structural features in a protocol format; s3, automatically deducing a legal input sequence according to the structural features in the protocol format, and generating a test case covering the structural features of the protocol; and S4, based on a fuzzy tester, carrying out directional fuzzy testing on the generated test case according to a corresponding variation strategy. By the adoption of the internet of things firmware fuzzy testing method based on the grey box technology, the protocol format can be automatically recognized, a large number of reasonable test cases can be generated, hidden defects and vulnerabilities in a system can be found easily, the testing force application accuracy and the testing efficiency are improved, and the method has wide application value.

Description

Technical Field

[0001] The present invention relates to the technical field of fuzz testing, and in particular to a gray box technology-based fuzz testing method for Internet of Things firmware. Background Art

[0002] With the rapid development of computer technology, the Internet of Things (IoT) system has become an indispensable part of people's lives and work. However, due to the increase in the overall complexity of the system and the interaction between nodes in the distributed system, there may be many hidden defects and loopholes in the system, which may cause losses or even serious consequences to the system. Therefore, quality assurance of the IoT system is very important.

[0003] Software testing is one of the important means to ensure software quality. Gray box testing technology is a testing technology between black box testing (completely unaware of the internal structure) and white box testing (completely aware of the internal structure). It does not require an in-depth understanding of the internal structure of the system under test, but it does require an understanding of the external interface and specifications of the system under test. The test cases of gray box testing technology are generated based on deterministic algorithms, and the quality and defects of the system are evaluated through the coverage of test cases.

[0004] Traditional gray box testing methods are mainly based on random testing and manual testing. Random testing only focuses on input and output, ignoring the internal state changes of the system. The efficiency of test case generation is low and the accuracy of test cases is difficult to guarantee. Manual testing requires testers to have rich experience and knowledge, which is costly and inefficient. Therefore, an efficient, accurate and low-cost gray box testing technology is needed to ensure the quality of the system.

[0005] Therefore, the present invention proposes a gray box technology-based IoT firmware fuzz testing method, which is mainly used to test IoT network systems. This technology can automatically identify protocol formats and generate reasonable test cases, which helps to discover hidden defects and vulnerabilities in the system. Summary of the invention

[0006] The purpose of the present invention is to provide an IoT firmware fuzz testing method based on gray box technology, which can automatically identify the protocol format and generate a large number of reasonable test cases, help to discover hidden defects and loopholes in the system, improve the accuracy and efficiency of the test, and has wide application value.

[0007] To achieve the above object, the present invention provides an IoT firmware fuzz testing method based on gray box technology, comprising the following steps:

[0008] S1. Obtain the external interface and specification of the IoT firmware, and determine the protocol format of the IoT firmware;

[0009] S2. Performing format analysis on the IoT firmware obtained above to automatically identify structural features in the protocol format;

[0010] S3. According to the structural features in the above protocol format, automatically infer the legal input sequence and generate test cases covering the protocol structural features;

[0011] S4. Based on the fuzz tester, the test cases generated above are subjected to directed fuzz testing according to the corresponding mutation strategy.

[0012] Preferably, in step S1, the methods of obtaining the external interface and specification of the IoT firmware are divided into two categories: the first is to extract directly from the IoT device, and the second is to download from the manufacturer's official website.

[0013] Preferably, in step S2, the structural features in the protocol format include field information, value type, length constraint and data format.

[0014] Preferably, in step S2, the organization form and data content of the IoT firmware are analyzed, and the firmware is divided into two categories according to the organization form, namely, firmware containing an operating system and firmware not containing an operating system;

[0015] The operating system is one of a general operating system and an embedded operating system.

[0016] Preferably, in the firmware including the operating system, the device functions are performed by user programs; the system call operations, program loading process, and library function calls are all standardizedly defined.

[0017] Preferably, in a firmware that does not include an operating system, the firmware operates directly on the device and includes simple task scheduling-like operating system functions.

[0018] Preferably, in step S3, the operating system and file system of the IoT firmware including the operating system contain a feature code or feature string in the header, the operating system image and the file system are identified by signature matching, the file system is decompressed, and all files and programs are extracted.

[0019] Preferably, for all extracted programs and file sets, a target program to be analyzed is further extracted, the binary code is represented in an intermediate language or assembly form, and a test case that can cover the structural features of the protocol is generated.

[0020] Preferably, in step S4, fuzz testing technology is used, and the test sample generator generates corresponding inputs and delivers them to the target program by randomly transforming the original sample data;

[0021] Based on abnormal state detection technology, the target program anomalies are discovered, and the input that triggers the crash is further analyzed to verify the discovered vulnerabilities.

[0022] Therefore, the present invention adopts the above-mentioned IoT firmware fuzz testing method based on gray box technology, which can automatically identify the protocol format and generate a large number of reasonable test cases, which is helpful to discover hidden defects and loopholes in the system, improves the accuracy and efficiency of the test, and has wide application value.

[0023] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 The present invention is a flowchart of a gray box technology-based fuzzy testing method for IoT firmware. DETAILED DESCRIPTION

[0025] The technical solution of the present invention is further described below through the accompanying drawings and embodiments.

[0026] like Figure 1 As shown, the present invention provides a gray box technology-based IoT firmware fuzz testing method, comprising the following steps:

[0027] S1. Obtain the external interface and specification of the IoT firmware, and determine the protocol format of the IoT firmware. There are two ways to obtain it: the first is to extract it directly from the IoT device, and the second is to download it from the manufacturer's official website.

[0028] S2. Perform format analysis on the IoT firmware obtained above, and automatically identify structural features in the protocol format; wherein the structural features include field information, value type, length constraint, data format, etc.

[0029] Analyzing the organizational form and data content of IoT firmware, firmware is divided into two categories according to its organizational form: firmware that includes an operating system and firmware that does not include an operating system. The operating system is either a general operating system or an embedded operating system.

[0030] In the firmware that includes the operating system, device functions are completed by user programs; system call operations, program loading processes, and library function calls are all standardizedly defined.

[0031] In firmware that does not include an operating system, the firmware works directly on the device and includes simple task scheduling and other operating system functions.

[0032] S3. According to the structural features in the above protocol format, legal input sequences are automatically inferred, and a large number of test cases that can cover the protocol structural features are generated to cover various states of the firmware.

[0033] Extract all files and programs from the IoT firmware containing the operating system. For the firmware containing the operating system, since the operating system and the file system usually contain feature codes or feature strings in the header, the operating system image and the file system are identified through signature matching, the file system is decompressed, and all files and programs are extracted.

[0034] For all extracted programs and file sets, further extract the target program to be analyzed, express the binary code in the form of intermediate language or assembly, and generate test cases that can cover the protocol structure features. Whether it is firmware without an operating system or the target service program to be analyzed, it is necessary to convert the binary into assembly code.

[0035] S4. Based on the fuzz tester, the test cases generated above are subjected to directed fuzz testing according to the corresponding mutation strategy, the operation of the IoT firmware is analyzed, and the relevant errors of the program are detected by the detector to see if they are vulnerabilities.

[0036] Using fuzz testing technology, the test sample generator generates corresponding inputs by randomly transforming the original sample data and delivers them to the target program. The abnormal state detection technology detects abnormalities in the target program, usually detecting a program crash, and further analyzes the input that triggers the crash, thereby verifying the discovered vulnerability.

[0037] Example

[0038] In order to verify the effectiveness of the method proposed in the present invention, a distributed system is selected as a test object, and random testing, manual testing and the testing method proposed in the present invention are used for testing. The experimental results are shown in Table 1.

[0039] Table 1 Experimental results

[0040] Test Method Generated test cases Accuracy Random Testing 100 20％ Manual Testing 50 60％ Testing method of the present invention 50 90％

[0041] It can be seen from the experimental results that the testing method proposed in the present invention significantly improves the accuracy and testing efficiency of test cases compared with traditional random testing and manual testing, and can discover more defects and vulnerabilities.

[0042] Therefore, the present invention adopts the above-mentioned IoT firmware fuzz testing method based on gray box technology, which can automatically identify the protocol format and generate a large number of reasonable test cases, which is helpful to discover hidden defects and loopholes in the system, improves the accuracy and efficiency of the test, and has wide application value.

[0043] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A gray box technology-based IoT firmware fuzz testing method, characterized in that: The following steps are involved: S1. Obtain the external interface and specification of the IoT firmware, and determine the protocol format of the IoT firmware; S2. Performing format analysis on the IoT firmware obtained above to automatically identify structural features in the protocol format; S3. According to the structural features in the above protocol format, automatically infer the legal input sequence and generate test cases covering the protocol structural features; S4. Based on the fuzz tester, the test cases generated above are subjected to directed fuzz testing according to the corresponding mutation strategy.

2. According to claim 1, a gray box technology-based IoT firmware fuzz testing method is characterized in that: In step S1, there are two ways to obtain the external interface and specifications of the IoT firmware: the first is to extract them directly from the IoT device, and the second is to download them from the manufacturer's official website.

3. According to claim 1, a gray box technology-based IoT firmware fuzz testing method is characterized in that: In step S2, the structural features in the protocol format include field information, value type, length constraint and data format.

4. According to claim 1, a gray box technology-based IoT firmware fuzz testing method is characterized in that: In step S2, the organization form and data content of the IoT firmware are analyzed. The firmware is divided into two categories according to the organization form: firmware containing an operating system and firmware not containing an operating system; The operating system is one of a general operating system and an embedded operating system.

5. The IoT firmware fuzz testing method based on gray box technology according to claim 4 is characterized in that: In the firmware that includes the operating system, device functions are completed by user programs; system call operations, program loading processes, and library function calls are all standardizedly defined.

6. The IoT firmware fuzz testing method based on gray box technology according to claim 4 is characterized in that: In firmware that does not include an operating system, the firmware works directly on the device and includes simple task scheduling-like operating system functions.

7. The IoT firmware fuzz testing method based on gray box technology according to claim 1 is characterized in that: In step S3, the operating system and file system of the IoT firmware including the operating system contain a feature code or feature string in the header, and the operating system image and file system are identified by signature matching, the file system is decompressed, and all files and programs are extracted.

8. The IoT firmware fuzz testing method based on gray box technology according to claim 7 is characterized in that: For all extracted programs and file sets, the target program to be analyzed is further extracted, the binary code is represented in an intermediate language or assembly form, and test cases that can cover the structural features of the protocol are generated.

9. The IoT firmware fuzz testing method based on gray box technology according to claim 1 is characterized in that: In step S4, using fuzz testing technology, the test sample generator generates corresponding inputs and delivers them to the target program by randomly transforming the original sample data; Based on abnormal state detection technology, the target program anomalies are discovered, and the input that triggers the crash is further analyzed to verify the discovered vulnerabilities.

Images