5G layered multi-granularity variation fuzzy testing device and method

Abstract

The invention discloses a 5G hierarchical multi-granularity variation fuzzy test device and method, a protocol field intelligent variation module selects a variation strategy according to a basic data type field and a complex data type field, and a state transition module performs state transition on a target network element and sends variation data. The state monitoring module monitors the running state of a target application and records a variation data packet causing problems of the target application, and the protocol IE fine granularity fuzzy testing module performs fuzzy testing with a message element as a basic granularity aiming at a structure cell of a protocol. The protocol single-state fuzz testing module performs fuzz testing with a protocol single state as granularity aiming at a conversion state of a protocol to complete state security detection, and the protocol approximate full-interaction state fuzz testing module finds out potential vulnerabilities by traversing an approximate full-interaction state of a target protocol to complete state security detection. Omnibearing fuzzy testing is carried out on a mobile communication network protocol through a plurality of modules, so that the protocol security is checked, and protocol vulnerabilities are found in time.

Description

Technical Field

[0001] The present application relates to the field of mobile communication technology, and in particular to a 5G layered multi-granularity variation fuzzy testing device and method. Background Art

[0002] As the latest generation of cellular mobile communication technology, 5G has achieved unprecedented communication innovation through continuous standard evolution. The core concept of the design of 5G mobile communication networks is to assume that the system is in an open, non-trusted environment, and must address the challenges of building a trustworthy communication network and providing more secure services in this environment. In response to the security requirements of 5G services, although the 5G protocol has made efforts to design its security architecture, there are still cases of insecure protocols, which may provide operators with opportunities to implement denial of service or steal user sensitive information. In addition, 5G protocol specifications are often difficult to fully comply with actual conditions, resulting in potential security risks in network configuration. The detection and repair of security vulnerabilities in 5G protocols has become an urgent issue to be addressed in current 5G security research.

[0003] By comprehensively evaluating the security of 5G protocols, conducting specialized security tests and vulnerability scans, potential security weaknesses can be effectively discovered and addressed in a timely manner. Discovering and fixing security vulnerabilities in 5G protocols is crucial to ensuring the stable and secure operation of 5G communication networks. Researchers conducted vulnerability mining and security analysis on 5G protocols and found two main types of security flaws, namely protocol logic flaws and protocol implementation flaws:

[0004] Protocol logic flaws refer to vulnerabilities in the protocol itself. Previous studies have revealed some protocol logic flaws through vulnerability mining, such as 5G security context validity check vulnerabilities and 5G AKA protocol security vulnerabilities. These vulnerabilities may cause operators to disguise themselves as victims to access the 5G network or track target 5G users. In addition, with the widespread application of 5G, the industry has conducted formal analysis of 3GPP standard documents and found the lack of protocol security assumptions, the unlinkability of the protocol to active risks, and a series of privacy issues and design weaknesses.

[0005] Protocol implementation defects refer to errors that occur during the implementation of a protocol. In 5G, fuzz testing is often used to test the security of network protocols. In recent years, researchers have proposed some fuzz testing tools and used them to discover security vulnerabilities in multiple protocols. In addition, researchers have also proposed methods to use natural language processing (NLP) and machine learning technologies to parse protocol standards, automatically test, and detect vulnerabilities.

[0006] In recent years, with the development of 5G, research on mobile network protocol security testing has become a trend. Starting from fuzz testing, fuzz testing for protocols is mainly divided into three types: static analysis, dynamic analysis, and negative testing. Fuzz testing technology has played a huge role in many application scenarios, especially in baseband protocol testing. At the same time, the arrival of 5G and the introduction of new communication protocols and technologies have brought new challenges to fuzz testing. The significant increase in the complexity of 5G protocols has put forward higher requirements for testing methods. Relying solely on traditional fuzz testing may not effectively reveal all hidden problems.

[0007] Traditional fuzz testing technology has two main shortcomings: First, it does not realize vulnerability mining for target codes at different logical levels: it only considers the situation where a single protocol exists, ignoring the scenario where multiple protocols coexist; it only considers the defects in protocol flow processing, and does not consider field-level testing. Second, the test cases are random: it is usually difficult to fully cover the logical state of the communication protocol; the test results are also large in number and difficult to analyze. Summary of the invention

[0008] The purpose of this application is to provide a 5G layered multi-granularity variation fuzz testing device and method to overcome the existing technical defects. Through multiple modules, a comprehensive fuzz test is performed on the mobile communication network protocol, so as to check the protocol security and timely discover protocol vulnerabilities. It can solve the problem that the existing fuzz testing technology only considers the existence of a single protocol and ignores the scenario of coexistence of multiple protocols, resulting in incomplete coverage of fuzzy test case scenarios.

[0009] The purpose of this application is achieved through the following technical solutions:

[0010] In the first aspect, the present application proposes a 5G layered multi-granularity mutation fuzz testing device, which includes a protocol field intelligent mutation module, a state migration module, a state monitoring module, a protocol IE fine-grained fuzz testing module, a protocol single-state fuzz testing module, and a protocol approximate full-interaction state fuzz testing module;

[0011] A protocol field intelligent mutation module, used to select mutation strategies according to basic data type fields and / or complex data type fields;

[0012] The state migration module is used to transfer the state of the target network element and send the variation data to the state monitoring module;

[0013] A status monitoring module is used to monitor the running status of the target application and record the mutated data packets that cause problems in the target application. The mutated data packets are used for vulnerability analysis.

[0014] The protocol IE fine-grained fuzz testing module is used to perform fuzz testing on the structural information elements of the protocol with the message element as the basic granularity;

[0015] The protocol single-state fuzzy testing module is used to perform fuzzy testing on the protocol conversion state with the protocol single state as the granularity to complete state security detection;

[0016] The protocol approximate full interactive state fuzz testing module is used to find potential vulnerabilities in fuzz testing by traversing the approximate full interactive state of the target protocol with the granularity of approximate full interactive state message mutation.

[0017] In one possible implementation, the protocol field intelligent mutation module is also used to select a mutation strategy through data verification operations, wherein the data verification operations include one or more of bit reversal, byte reversal, assignment operation, special value replacement, special string overwrite, special string insertion, random processing, and intelligent field type selection mutation.

[0018] In a possible implementation, the state migration module is further used to construct corresponding protocol data packets through object-oriented programming, use the SCTP library to send and receive data, and perform protocol state jumps through the NGAP protocol.

[0019] In one possible implementation, the state migration module includes an NGAP protocol jump submodule, which is used to send an initial context establishment message request to establish a connection through the AMF core network based on a closed state in the user equipment context management function. If the connection establishment fails, it returns to the closed state. If the establishment is successful, the connection is successfully established through a related mechanism, and the connection is released after completing the user equipment context management procedure.

[0020] In a possible implementation, the state monitoring module is further used to detect the running state information of the target application when the Agent tool sends a data packet of a corresponding state to the target application;

[0021] In case the target application crashes, the current data packet is recorded and stored in the corresponding directory;

[0022] Restart the target application for the next round of fuzz testing.

[0023] In a possible implementation, the protocol IE fine-grained fuzz testing module is also used to specify the mutation object to a specific field to complete the compliance mutation of the sample;

[0024] The selected fields are mutated, and the mutated fields are repackaged with normal fields into data packets using a protocol interpreter, and the data packets are sent to the core network.

[0025] In one possible implementation, the protocol single-state fuzzy testing module is also used to dynamically adjust and control the execution path of the protocol, so that the protocol state machine enters the specific state that the user wants to check, thereby achieving complete security detection of the specific state.

[0026] In a possible implementation, the protocol approximates the full interactive state fuzz testing module, and is also used to completely encapsulate each business process to implement each business process;

[0027] A random number mutation seed is added to each business process, and the random number mutation seed is used to mutate the protocol state in the business process.

[0028] In the second aspect, the present application proposes a layered multi-granularity fuzz testing method, which is applied to a 5G layered multi-granularity variation fuzz testing device, including:

[0029] Step 1: Assist in developing the message format for fuzz testing by analyzing standard documents and data formats;

[0030] Step 2: Establish a mutation strategy through the captured samples and key data, and generate compliant samples through the mutation strategy and data format. Interact the compliant samples with the 5G core network to obtain the results generated by the core network.

[0031] Step 3: Analyze the results generated by the core network to determine the operating status of the core network;

[0032] Step 4: Analyze the test samples that produce abnormal conditions in the core network and optimize the mutation strategy through feedback;

[0033] Step 5: Find out the vulnerabilities of the protocol implementation by analyzing the output samples and monitor records.

[0034] The above-mentioned main scheme of the present application and its further options can be freely combined to form multiple schemes, all of which are schemes that can be adopted and claimed for protection in the present application; and in the present application, (non-conflicting options) options and other options can also be freely combined. After understanding the scheme of the present application, those skilled in the art can understand that there are multiple combinations based on the prior art and common knowledge, all of which are technical schemes to be protected by the present application, and they are not exhaustively listed here.

[0035] The present application discloses a 5G layered multi-granularity mutation fuzz testing device and method. The protocol field intelligent mutation module selects mutation strategies according to basic data type fields and complex data type fields. The state migration module performs state transfer on the target network element and sends mutation data. The state monitoring module monitors the running state of the target application and records the mutated data packets that cause problems in the target application. The protocol IE fine-grained fuzz testing module performs fuzzy testing on the structural information elements of the protocol with message elements as the basic granularity. The protocol single-state fuzz testing module performs fuzzy testing on the conversion state of the protocol with the single state of the protocol as the granularity to complete state security detection. The protocol approximate full-interaction state fuzz testing module finds potential vulnerabilities by traversing the approximate full-interaction state of the target protocol. Through multiple modules, a full range of fuzzy testing is performed on the mobile communication network protocol, thereby checking the security of the protocol and discovering protocol vulnerabilities in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A schematic diagram of a 5G layered multi-granularity variation fuzzy testing device in an embodiment of the present application is shown.

[0038] Figure 2 A flowchart of the NGAP protocol TestRegistration proposed in an embodiment of the present application is shown.

[0039] Figure 3 A flow chart of a 5G layered multi-granularity fuzzy testing method proposed in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0040] The following describes the embodiments of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0041] Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of this application.

[0042] In the prior art, fuzz testing for protocols is mainly divided into three types: static analysis, dynamic analysis and negative testing.

[0043] Static analysis: As a traditional protocol analysis method, protocol vulnerabilities are often discovered through manual analysis of standards. Kim et al. proposed BASESPC to analyze basebands and standards. BASESPC systematically checks the message structure implemented in the baseband software by leveraging the standardized message structure in the specification. This requires a one-time manual analysis effort to determine how the information structure is embedded in the target firmware. BASESPC then compares the extracted information structure with the information structure in the specification in terms of syntax and semantics. Finally, mismatches are reported. These mismatches indicate that the developer made a mistake that caused the baseband to not comply with the specification, or that there are potential vulnerabilities.

[0044] Dynamic analysis: A more efficient semi-automatic / automatic testing tool was introduced based on static analysis. Kim et al. implemented a semi-automatic testing tool, LTEFuzz, by using open source LTE software. The authors systematically generated test cases by defining three basic security properties. Based on the security properties, LTEFuzz generates test cases and sends them to the target network, and classifies problematic behaviors only by monitoring device-side logs. The process of semi-automated dynamic testing includes three steps: 1) creating security properties based on specification analysis; 2) generating and executing test cases that violate security properties; and 3) classifying problematic use cases.

[0045] Most previous works analyze only a small number of firmware images for a few device models and often rely heavily on time-consuming manual static analysis or fuzzy analysis of single functions. To fill this gap, Hernandez et al. propose FIRMWIRE, the first full-system emulation platform for baseband processors that can execute unmodified baseband binary firmware.

[0046] Kim et al. believe that dynamic analysis of baseband has accessibility issues, which will lead to many errors being missed. Static analysis methods such as BaseSpec require a lot of manual analysis and are limited to information decoding, which cannot support the most critical integrity protection in mobile communications. The authors proposed a new semi-automatic baseband analysis method BASECOMP for analyzing integrity protection. In order to reduce the complexity of baseband firmware, BASECOMP uses probabilistic reasoning to identify integrity protection functions.

[0047] Negative testing: A fuzzy testing method that contains only invalid or prohibited messages in the test case. Since the 3GPP standard lacks negative testing content and previous studies have only considered limited states in the LTE network, Park et al. proposed a systematic testing framework DoLTEst to supplement the lack of negative testing in previous studies. DoLTEst generates test cases based on the specification, which contains every point of the negative test case. However, due to the large scale and complexity of the standard, it is almost impossible to fully understand the standard.

[0048] Therefore, traditional fuzz testing technology has two main shortcomings: First, it does not realize vulnerability mining for target codes at different logical levels: it only considers the situation where a single protocol exists, ignoring the scenario where multiple protocols coexist; it only considers the defects in protocol flow processing, and does not consider field-level testing. Second, the test cases are random: it is usually difficult to fully cover the logical state of the communication protocol, and the test results are also large in number and difficult to analyze.

[0049] In view of the problems that the existing fuzz testing technology only considers the existence of a single protocol and ignores the scenario of coexistence of multiple protocols, resulting in incomplete coverage of fuzzy test case scenarios and the randomness of test cases leading to a large number of fuzzy test packages, space explosion, and long testing time, the embodiment of the present application proposes a 5G layered multi-granularity variation fuzzy testing device and method, which is targeted at the 5G mobile communication network protocol and has the characteristics of targetedness, fine-grainedness, and wide coverage, so as to better discover 5G protocol vulnerabilities and maintain network security.

[0050] Please refer to Figure 1 , Figure 1 A schematic diagram of a 5G layered multi-granularity mutation fuzzy testing device in an embodiment of the present application is shown, the device comprising a protocol field intelligent mutation module, a state migration module, a state monitoring module, a protocol IE fine-grained fuzzy testing module, a protocol single-state fuzzy testing module, and a protocol approximate full-interaction state fuzzy testing module;

[0051] A protocol field intelligent mutation module, used to select mutation strategies according to basic data type fields and / or complex data type fields;

[0052] The protocol field intelligent mutation module selects mutation strategies based on basic data type fields of bits / bytes / strings, selects mutation strategies based on complex data type fields with granularity such as existence / structure, and intelligently selects mutation strategies that include the above two strategies.

[0053] The protocol field intelligent mutation module is an advanced testing technology used to improve the robustness and security of protocol parsing and data processing components. This module triggers and detects potential errors in the software by intelligently changing the field values ​​in the data packet.

[0054] The mutation strategies for basic data type fields can include bit-level mutation, byte-level mutation, or string mutation. Bit-level mutation is for basic data types such as integers and floating-point types. The intelligent mutation module will make detailed changes at the bit level, such as bit flipping, increasing / decreasing bits, to generate new values, so as to test the software's ability to handle data precision and sign changes.

[0055] Byte-level mutation transforms data at the byte level, which may include reversing the byte order and randomly modifying the byte content. This helps detect compatibility and error handling mechanisms regarding byte order (big endian / little endian) in protocol implementations.

[0056] String mutation is to change the string field, including character replacement, special character insertion, length change, etc., to check whether the software's processing logic for illegal or boundary strings is correct.

[0057] Complex data type field selection mutation strategies can include existential mutation and structure mutation. Existential mutation changes the existence status of fields in complex structures, such as adding, deleting, or rearranging structure members, to explore the software's requirements for data structure flexibility. For structure mutation, for complex types such as structures, the module will intelligently apply the above basic type mutation strategies based on the field types inside the structure, while considering the dependencies between fields to ensure that the mutated structure is still legal.

[0058] The intelligent selection mutation strategy combines the above two strategies, dynamically adjusting the priority and strength of the mutation strategy based on the characteristics of the target protocol or data format, as well as the feedback of historical test results. For example, more attention is paid to fields or specific types of data that frequently have problems, or after discovering new types of errors, the relevant types of mutation tests are automatically strengthened. This is not only reflected in the flexible use of mutation strategies, but also in the ability to learn and predict which mutations are most likely to reveal new defects, thereby efficiently guiding the generation of test cases.

[0059] The state migration module is used to transfer the state of the target network element and send the variation data to the state monitoring module.

[0060] The state transition logic is to define and implement clear state transition rules. When the preset conditions are met (such as receiving a specific instruction, reaching a specific time point, detecting an error, etc.), the module will trigger the state migration, such as transferring from the running state to the maintenance state. The purpose of sending variant data is to test the network element's ability to handle abnormal or edge conditions in certain state transition scenarios. Variant data is different from normal business traffic and may contain error codes, non-standard formats, extreme values, etc., in order to induce system responses and expose potential stability and security issues.

[0061] A status monitoring module is used to monitor the running status of the target application and record the mutated data packets that cause problems in the target application. The mutated data packets are used for vulnerability analysis.

[0062] The status monitoring module conducts real-time monitoring and continuously collects the operating data of the target application, including but not limited to CPU usage, memory usage, network traffic, disk I / O, thread status, exception logs, etc., to ensure that the health status of the application can be understood immediately. It also performs anomaly detection, and by setting thresholds and rules, it can automatically identify indicators or patterns that deviate from normal behavior, such as sudden increases in resource consumption, prolonged response time, and increased error rates. These anomalies often indicate potential problems and record mutated data packets that may cause problems in the target application. Mutated data packets are used for subsequent vulnerability analysis, which are not only clues for troubleshooting, but also valuable information for security audits and vulnerability analysis. Use these data packets to reproduce attack scenarios, deeply explore the security weaknesses of the application, and then take measures to strengthen protection.

[0063] The protocol IE fine-grained fuzz testing module is used to perform fuzz testing on the structural information elements of the protocol with message elements as the basic granularity.

[0064] The protocol IE fine-grained fuzz testing module has structural information element recognition, which can deeply understand the internal structure of the tested protocol and identify all key and variable information elements in the protocol. These information elements can be fields in the protocol header, specific parts of the payload data, or control bits. The protocol IE fine-grained fuzz testing module greatly improves the efficiency and accuracy of discovering protocol implementation vulnerabilities by conducting precise tests at the micro level of protocol messages.

[0065] The protocol single-state fuzzy testing module is used to perform fuzzy testing on the protocol conversion state with the protocol single state as the granularity to complete state security detection;

[0066] The protocol single-state fuzz testing module performs fuzz testing on the protocol conversion state with the protocol single state as the granularity, which can perform a relatively complete security test on a certain state in a relatively short time. Among them, all variant samples are tested on the selected protocol state, thereby achieving complete security testing of the state.

[0067] The protocol approximate full interactive state fuzz testing module is used to find potential vulnerabilities in fuzz testing by traversing the approximate full interactive state of the target protocol with the granularity of approximate full interactive state message mutation.

[0068] The protocol approximate full interactive state fuzz testing module improves the code coverage of fuzz testing and discovers potential vulnerabilities more comprehensively by traversing the approximate full interactive state of the target protocol during the fuzz testing process and using the approximate full interactive state message mutation as the granularity.

[0069] exist Figure 1 In , the protocol field intelligent mutation module is used to generate ,compliant mutation samples before fuzz testing.

[0070] The protocol field intelligent mutation module inputs the generated mutation samples into three fuzzy test modules of different granularities (in parallel relationship), namely: protocol IE fine-grained fuzzy test module, protocol single-state fuzzy test module, and protocol approximate full-interaction state fuzzy test module.

[0071] In addition, the state migration module is responsible for controlling the state transition of network elements during the fuzz testing process, such as disconnecting and sending compliant data packets to advance the protocol process.

[0072] The state migration module is responsible for monitoring the running status during the fuzz testing process and outputting mutated data packets that may have problems.

[0073] In one possible implementation, the protocol field intelligent mutation module is also used to select a mutation strategy through data verification operations, wherein the data verification operations include one or more of bit reversal, byte reversal, assignment operation, special value replacement, special string overwrite, special string insertion, random processing, and intelligent field type selection mutation.

[0074] The implementation steps of bit reversal are: invert a specific bit and use the inverted data as a test sample. For example, select bits 1, 2, and 4 to be inverted, traverse the test samples, and then generate mutation samples.

[0075] The implementation steps of byte reversal are: reverse a specific byte and use it as a mutation sample. For example, select 1, 2, and 4 bytes to be reversed at a time to construct a mutation sample.

[0076] The implementation steps of the assignment operation are: each time a value within a range is added or subtracted from the corresponding byte, and the new value is used to replace the old value as a test sample. For example, 1, 2, and 4 bytes are processed each time. It is worth noting that for the multi-byte method, that is, 2 and 4 bytes in the above example, this application also considers the big-endian and small-endian methods.

[0077] The implementation steps of special value replacement are as follows: select some special data for fuzzy replacement. Take 1 byte as an example, select special values ​​such as 127, -128, 0, 1, 4, etc. as the data to be fuzzy replaced.

[0078] The implementation steps of special string overwriting are: use some special strings to overwrite the values ​​in the data area. It is necessary to construct a dictionary library, including binary strings, command line command injection, etc. In the dictionary library, select the elements that keep the length of the data area unchanged for overwriting.

[0079] The implementation steps for special string insertion are: insert each string in the dictionary library in turn, without length detection.

[0080] The implementation steps of random processing are: using random methods to fuzzy process the data in the data area, such as random value replacement, insertion, deletion, copying, etc.

[0081] The implementation steps of the smart field type are as follows: for the five basic data types of the protocol, namely, Boolean value, integer, enumeration, bit string, and octet string, adopt mutation strategies targeting their characteristics. For the five complex data types of the protocol, namely, sequence, selection, optional, TLV structure, and integrity protection field, adopt mutation strategies targeting their characteristics.

[0082] In a possible implementation, the state migration module is used to construct corresponding protocol data packets through object-oriented programming, use the SCTP library to send and receive data, and perform protocol state jumps through the NGAP protocol.

[0083] The state transition module first clarifies the structure of each type of data packet and the state transition diagram of the protocol. In the state transition process of the network protocol, the transition from the current state to the next state depends on some stimulus. The stimulus can come from active behavior, such as shutting down or disconnecting the link, etc.; it can also come from passive behavior, such as receiving a data packet that meets the requirements to complete the state jump. In order to achieve the goal of state transition, the state machines of the two protocols NGAP and PFCP in 5G and the detailed structures of various types of data packets are studied in depth.

[0084] First, the corresponding protocol data packet is constructed through object-oriented programming. Secondly, since the NGAP protocol is based on SCTP, the data transmission and reception are realized by using the SCTP library, and finally the protocol state jump is performed.

[0085] The state migration module includes an NGAP protocol jump submodule, which is used to send an initial context establishment message request to establish a connection through the AMF core network based on the closed state in the user equipment context management function. If the connection establishment fails, it returns to the closed state. If the establishment is successful, the connection is successfully established through the relevant mechanism, and the connection is released after completing the user equipment context management procedure.

[0086] In the UE Context management function, starting from the closed state, the InitialContextSetup message (initial context establishment message) is sent through the AMF core network to request to establish a connection. If the connection establishment fails, it returns to the initial closed state; if the establishment is successful, the connection is successfully established through authentication and other related mechanisms, and the connection is released after the UEContext Management (user equipment context management) program is completed. Please refer to Table 1, which shows the complete state transition:

[0087] Table 1

[0088]

[0089] In a possible implementation, the state monitoring module is further used to detect the running state information of the target application when the Agent tool sends a data packet of a corresponding state to the target application;

[0090] In case the target application crashes, the current data packet is recorded and stored in the corresponding directory;

[0091] Restart the target application for the next round of fuzz testing.

[0092] The main responsibility of the Agent tool is to send specific data packets to the target application. These data packets are usually used to test the stability and security of the target application, which is part of fuzz testing. The Agent's job is to automatically perform this process, and each data packet sent is to trigger potential vulnerabilities or abnormal behaviors.

[0093] When the target application receives the data packet sent by the Agent, the status monitoring module will immediately check the running status of the application. If it is detected that the target application crashes or becomes abnormal due to receiving certain data packets, the status monitoring module will record the data packets that caused the problem and save them to a specific directory for subsequent security analysts to conduct vulnerability analysis and exploit research. In addition, the status monitoring module will automatically restart the target application to continue the next round of fuzz testing to ensure the consistency and efficiency of the test process.

[0094] Since fuzz testing of 5G network protocols often has a more complex mechanism than traditional software fuzz testing, the difference is mainly reflected in the characteristics of the data. A certain type of data in the protocol often contains a large number of fields. Protocol analysis based on traditional fuzz testing technology often mutates each data in turn to generate deformed data packets. The disadvantages of this method are also obvious, that is, it consumes time and brings a lot of unnecessary load to the network. If a field is a protocol-specific identifier, performing blind mutation modification on it will cause all data packets under the mutation of the field to be invalid, which will consume a lot of time and result in extremely low test efficiency.

[0095] In the process of mutating a sample, it is necessary not only to mutate it effectively, but also to pay attention to not destroying the format of the data packet itself as much as possible to avoid direct network discard.

[0096] Taking the NGAP protocol as an example, although the data packets of the protocol contain a large number of fields, the meanings and functions of different fields are different. The difference in these functions means that the weights (priorities) of different fields are different. Some fields can easily cause security problems in the network. For example, for the field representing the length in the protocol data, if the protocol processing module of the target entity handles it improperly (there is no security check on this part of the field), there will be potential security issues such as integer overflow, buffer overflow, and null pointer.

[0097] Therefore, according to the principle of efficient fuzz testing, such fields have higher priority and cost-effectiveness, and the mutation strategy should be given priority. For some fields where mutation is not very meaningful, such as specific identifiers, the protocol processing module of the target entity determines whether this field is data of the corresponding protocol. If this field is mutated, it will be meaningless and will cause subsequent data packets to be directly discarded. For some fields with perfect error handling mechanisms, even if the value corresponding to the field is modified to deformed data, a good error handling mechanism can handle the data packet error, and it is difficult to have security problems. Therefore, this application designs a protocol IE fine-grained fuzzy testing module.

[0098] In a possible implementation, the protocol IE fine-grained fuzz testing module is also used to specify the mutation object to a specific field to complete the compliance mutation of the sample;

[0099] The selected fields are mutated, and the mutated fields are repackaged with normal fields into data packets using a protocol interpreter, and the data packets are sent to the core network.

[0100] The mutation object is specified to a specific field, and these fields are used as objects to complete the compliance mutation of the sample without destroying the basic protocol format of the sample. In this way, the present application implements the selection of a specific field and performs mutation on the selected field. Then, the protocol interpreter is used to re-encapsulate the mutated field with the normal field, and the data packet is sent to the core network after the encapsulation is completed. At the same time, the monitor monitors the status of the core network, thus completing a sample test and improving the granularity of the overall fuzz test.

[0101] In the face of multi-state protocols, there is a continuous relationship between protocol states, and the realization of a complete protocol process requires the completion of multi-step protocol message interactions. By conducting fuzz testing for a specific state, the security of the protocol stack under a specific protocol state can be detected. However, if only the protocol message corresponding to the target state is sent, the test will not be completed due to the lack of protocol interaction before the state, so this application designs a protocol single-state fuzz testing module.

[0102] In one possible implementation, the protocol single-state fuzzy testing module is also used to dynamically adjust and control the execution path of the protocol, so that the protocol state machine enters the specific state that the user wants to check, thereby achieving complete security detection of the specific state.

[0103] The protocol single-state fuzz testing module can specify a complete security check on a certain state. Users can perform a relatively complete security check on a certain state in a relatively short period of time, in which all variant samples are tested against the selected protocol state, thereby achieving complete security testing of this state.

[0104] If you want to test a specified state, the protocol state machine must reach that state to perform effective testing. You can choose to reach a single state to perform a comprehensive test on all single states.

[0105] Since the above-mentioned state transition module reflects the processing logic of the protocol entity program, in the process of fuzz testing a stateful protocol, if the fuzz test covers each state of the protocol, it is considered that the fuzz test covers the main processing logic in the protocol entity program and can achieve relatively sufficient coverage of the test target.

[0106] In order to test the ability of the protocol to process packets in a certain state, the protocol single-state fuzz test module needs to send a packet pre-sequence and then perform fuzz testing on the target state. However, there are situations where it is necessary to send special packets in the state before or before the target state to trigger the vulnerability of the target test state. For this situation, the traditional packet test sequence method cannot meet the requirements.

[0107] In addition, some vulnerabilities are not only vulnerabilities in the protocol itself, but also some logical defects in the business process. For example, in the a field, a user_id is specified as 10001, but in the subsequent connection establishment process, the user_id is assigned to 10002, so the user_id is inconsistent. At this time, if there is no reasonable processing mechanism, it will lead to illegal connection establishment, and some serious vulnerabilities in business logic may cause null pointers and cause the core network to crash. However, the previous module cannot detect these vulnerabilities. In order to solve this problem, a protocol approximate full interactive state fuzz test module is designed.

[0108] In a possible implementation, the protocol approximates the full interactive state fuzz testing module, and is also used to completely encapsulate each business process to implement each business process;

[0109] A random number mutation seed is added to each business process, and the random number mutation seed is used to mutate the protocol state in the business process.

[0110] The protocol approximate full interactive state fuzz testing module fully encapsulates each business process in advance, requiring that each business process can be fully implemented. After implementing this function, a random number mutation seed is added to each business process. The purpose of this mutation seed is to randomly mutate two or three protocol states in a certain business process. This can solve the above problems and comprehensively detect possible security defects in the business process.

[0111] Taking NGAP communication protocol as an example, Figure 2 The flowchart of the NGAP protocol TestRegistration proposed in the embodiment of the present application is shown. The protocol mainly has 9 business processes, namely TestServiceRequest, TestRegistration, TestDeregistration, TestGUTIRegistration, TestN2Handover, TestPaging, TestPDUSessionReleaseRequest, TestReSynchronisation, and TestXnHandover. Each state has a different number of protocol interaction processes, and these interaction processes are also data interactions in business logic. For example, TestRegistration is a test registration process.

[0112] In summary, the 5G layered multi-granularity mutation fuzz testing device proposed in this application can guide the layered multi-granularity test sample mutation, complete fuzz testing at three granularities: message element, protocol single state, and approximate full interactive state message mutation, and realize vulnerability mining for target codes at different logical levels.

[0113] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0114] First, the protocol single-state fuzzy testing module and the protocol IE fine-grained fuzzy testing module are used to achieve the effect of automatic detection of 5G core network protocol vulnerabilities, and to explore the vulnerabilities in the 5G system protocol as much as possible, avoiding the problems of high false alarm rate and low protocol state coverage of traditional static and dynamic analysis vulnerability mining methods.

[0115] Second, the efficiency of protocol fuzz testing is improved by using the protocol approximate full-interaction state fuzz testing module, and fuzz testing is performed on each state of the protocol, solving the problem of incomplete test coverage caused by high interaction and multiple states of the protocol.

[0116] Since the protocol only accepts data packets suitable for a certain state, if the mutated data packets are directly used for testing, only defects in the protocol in that state may be found, which will be relatively inefficient. Fuzzy testing of all states of the protocol can be implemented to effectively improve vulnerability detection efficiency.

[0117] Second, please refer to Figure 3 , Figure 3 A flow chart of a 5G layered multi-granularity fuzzy testing method proposed in an embodiment of the present application is shown. The method is based on the 5G Next Generation Application Protocol (NGAP) and the Packet Forwarding Control Protocol (PFCP). The method is applied to a 5G layered multi-granularity variation fuzzy testing device, including:

[0118] Step S100: Assisting in formulating the message format of the fuzz test by analyzing standard documents and data formats;

[0119] Step S200: Establish a mutation strategy through the captured samples and key data, generate a compliant sample through the mutation strategy and data format, and interact the compliant sample with the 5G core network to obtain the result generated by the core network;

[0120] Step S300: Analyze the results generated by the core network to determine the operating status of the core network;

[0121] Step S400: Analyze the test samples that produce abnormal conditions in the core network, and optimize the mutation strategy through feedback;

[0122] Step S500: Find out the loopholes in the protocol implementation by analyzing the output samples and monitor records.

[0123] First, we analyze the standard documents and data formats, and through in-depth analysis of the standard documents of the 5G communication protocol, we understand the various message types, formats, and interaction processes specified in them. At the same time, we use packet capture tools to capture data packets circulating in the actual network, analyze the real data format and structure of these "wild" samples, and ensure that the test samples are close to the actual situation.

[0124] Secondly, the fuzz testing message format is formulated. Using the information obtained from standard documents and packet capture analysis, the initial message format for fuzz testing is defined, including determining which fields will be used for mutation strategies and the legal value range.

[0125] Construct mutation strategies and generate compliant samples: Based on the above analysis, a set of mutation algorithms or strategies are designed, focusing on changing key data fields while ensuring that the generated samples still comply with the 5G protocol specifications, i.e., "compliant samples". Using these strategies, the system automatically generates a series of mutation samples in preparation for interaction testing with the 5G core network.

[0126] Interaction testing and status monitoring: Compliant variant samples are sent to the 5G core network for interaction. At this time, the monitor continuously tracks the response and status of the core network and records any abnormal behavior or crashes. If an abnormality is detected, the system automatically collects relevant information and feeds it back to the variant strategy for strategy optimization, so as to test the weaknesses more accurately and improve test efficiency.

[0127] Vulnerability analysis and strategy iteration: Analyze test samples that lead to abnormal results, and based on the analysis results, continuously iterate and optimize mutation strategies to ensure wider test coverage, thereby effectively improving the accuracy and efficiency of the entire fuzz testing system.

[0128] Therefore, the present application discloses a 5G layered multi-granularity mutation fuzz testing device and method. The protocol field intelligent mutation module selects mutation strategies according to basic data type fields and complex data type fields. The state migration module performs state transfer on the target network element and sends mutation data. The state monitoring module monitors the running state of the target application and records the mutated data packets that cause problems in the target application. The protocol IE fine-grained fuzzy testing module performs fuzzy testing on the structural information elements of the protocol with message elements as the basic granularity. The protocol single-state fuzzy testing module performs fuzzy testing on the conversion state of the protocol with the single state of the protocol as the granularity to complete state security detection. The protocol approximate full-interaction state fuzzy testing module finds potential vulnerabilities by traversing the approximate full-interaction state of the target protocol. Through multiple modules, a comprehensive fuzzy test is performed on the mobile communication network protocol, thereby checking the security of the protocol and discovering protocol vulnerabilities in a timely manner.

[0129] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A 5G layered multi-granularity variation fuzzy testing device, characterized in that: The device includes a protocol field intelligent mutation module, a state migration module, a state monitoring module, a protocol IE fine-grained fuzzy testing module, a protocol single-state fuzzy testing module, and a protocol approximate full-interaction state fuzzy testing module; A protocol field intelligent mutation module, used to select mutation strategies according to basic data type fields and / or complex data type fields; A state migration module is used to transfer the state of the target network element and send the variation data to the state monitoring module; A status monitoring module is used to monitor the running status of the target application and record the mutated data packets that cause problems in the target application. The mutated data packets are used for vulnerability analysis. The protocol IE fine-grained fuzz testing module is used to perform fuzz testing on the structural information elements of the protocol with the message element as the basic granularity; The protocol single-state fuzzy testing module is used to perform fuzzy testing on the protocol conversion state with the protocol single state as the granularity to complete state security detection; The protocol approximate full interactive state fuzz testing module is used to find potential vulnerabilities in fuzz testing by traversing the approximate full interactive state of the target protocol with the granularity of approximate full interactive state message mutation.

2. The 5G layered multi-granularity variation fuzzy testing device according to claim 1, characterized in that: The protocol field intelligent mutation module is also used to select a mutation strategy through data verification operations, and the data verification operations include one or more of bit reversal, byte reversal, assignment operation, special value replacement, special string overwriting, special string insertion, random processing, and intelligent field type selection mutation.

3. The 5G layered multi-granularity variation fuzzy testing device according to claim 1, characterized in that: The state migration module is also used to construct corresponding protocol data packets through object-oriented programming, use the SCTP library to send and receive data, and perform protocol state jumps through the NGAP protocol.

4. The 5G layered multi-granularity variation fuzzy testing device according to claim 3 is characterized in that: The state migration module includes an NGAP protocol jump submodule, which is used to send an initial context establishment message request to establish a connection through the AMF core network based on the closed state in the user equipment context management function. If the connection establishment fails, it returns to the closed state. If the establishment is successful, the connection is successfully established through the relevant mechanism, and the connection is released after completing the user equipment context management procedure.

5. The 5G layered multi-granularity variation fuzzy testing device according to claim 1, characterized in that: The status monitoring module is also used to detect the running status information of the target application when the Agent tool sends a data packet of the corresponding status to the target application; In case the target application crashes, the current data packet is recorded and stored in the corresponding directory; Restart the target application for the next round of fuzz testing.

6. The 5G layered multi-granularity variation fuzzy testing device according to claim 1, characterized in that: The protocol IE fine-grained fuzz testing module is also used to specify the mutation object to the field and complete the compliance mutation of the sample; The selected fields are mutated, and the mutated fields are repackaged with normal fields into data packets using a protocol interpreter, and the data packets are sent to the core network.

7. The 5G layered multi-granularity variation fuzzy testing device according to claim 1, characterized in that: The protocol single-state fuzz testing module is also used to dynamically adjust and control the execution path of the protocol, so that the protocol state machine enters the state that the user wants to check, achieving complete security detection of the state.

8. The 5G layered multi-granularity variation fuzzy testing device according to claim 1, characterized in that: The protocol approximate full interactive state fuzz testing module is also used to fully encapsulate each business process and implement each business process; A random number mutation seed is added to each business process, and the random number mutation seed is used to mutate the protocol state in the business process.

9. A hierarchical multi-granularity fuzz testing method, characterized in that: The method is applied to a 5G layered multi-granularity variation fuzzy testing device, including: Step 1: Assist in developing the message format for fuzz testing by analyzing standard documents and data formats; Step 2: Establish a mutation strategy through the captured samples and key data, and generate compliant samples through the mutation strategy and data format. Interact the compliant samples with the 5G core network to obtain the results generated by the core network. Step 3: Analyze the results generated by the core network to determine the operating status of the core network; Step 4: Analyze the test samples that produce abnormal conditions in the core network and optimize the mutation strategy through feedback; Step 5: Find out the vulnerabilities of the protocol implementation by analyzing the output samples and monitor records.

Images