Network protocol fuzz testing method based on refined mutation probability learning

Abstract

The invention discloses a network protocol fuzzy test method based on refined mutation probability learning, which comprises the following steps: 1) a multi-arm machine model is created based on a state transition edge in a state transition diagram of a target network protocol, and each arm represents an optional state transition path; 2) the fuzz tester sends the fuzz test case to a server program of a target network protocol through the target network protocol; based on the state transition diagram and the feedback of the server-side program, utilizing state transition edges to subdivide the protocol state in the server-side program to obtain a state transition edge set; 3) aiming at each state transition edge, selecting one arm from the multi-arm tiger machine model as a state transition path of the edge; 4) according to the test result of each fuzzy test, updating the sampling probability of a corresponding arm in the multi-arm machine model: if the state transition path i successfully explores a new state or path, increasing the sampling probability of the state transition path i; otherwise, the sampling probability is reduced.

Description

Technical Field

[0001] The invention belongs to the technical field of network protocol fuzzy testing and relates to a network protocol fuzzy testing method based on refined mutation probability learning. Background Art

[0002] AFLNET is the first stateful gray-box protocol fuzz testing tool based on AFL. It constructs a protocol state machine (IPSM) by extracting the state code in the response message and uses this state machine to guide the test. AFLNET includes modules such as state learner, target state selector, sequence selector and sequence mutator.

[0003] AFLNET implements network communication with the server through sockets and supports sending and receiving messages. The input is a pcap file containing network traffic, and a request sequence parser is used to generate a message sequence corpus. The state learner extends IPSM, the target state selector selects the test state according to IPSM, the sequence selector selects the message sequence from the corpus, and the sequence mutator mutates the message sequence.

[0004] The actual implementation process of AFLNET is as follows:

[0005] 1.AFLNET receives the pcap file and parses the message sequence.

[0006] 2. The state machine learner extracts the state code and builds the IPSM.

[0007] 3. Target state selector Select the test target state.

[0008] 4. The sequence selector selects the appropriate message sequence, and the sequence mutator mutates it.

[0009] 5. Update the corpus and IPSM, recording new states and state transitions.

[0010] Mutation probability learning is a key technology in the field of fuzz testing. Compared with the traditional scheme of uniformly sampling seeds and mutation operators, mutation probability learning technology assigns different probability values ​​to different seeds and mutation operators, and samples according to these probability values ​​to select the mutated seeds and mutation operators. This technology adjusts the sampling probability value through feedback from the target program, making the probability of selecting effective seeds and mutation operators higher, thereby achieving better fuzz testing results. Compared with traditional schemes, mutation probability learning technology gives fuzz testing scheduling strategies greater flexibility and adapts to different programs through an adaptive learning process.

[0011] The following uses SeamFuzz as an example to introduce the general process of mutation probability learning technology. SEAMFUZZ is a gray-box fuzz testing tool, the core of which is to capture the personalized characteristics of each seed input and apply different mutation strategies to different seed inputs. To achieve this goal, the main technical challenge is how to effectively learn and maintain multiple probability distributions associated with different seed inputs.

[0012] The execution flow of SEAMFUZZ during the mutation probability learning process is as follows:

[0013] 1. Define the sampling space: First, SEAMFUZZ defines the sampling space for selecting the mutation method m, which includes the mutation location (loc) and the mutation mode (op). The mutation mode is usually predefined, so the sampling space for selecting the mutation operator can be determined. However, the mutation location is determined by the given seed input size, which is not fixed, so it is difficult to determine the sampling space of the mutation location. To solve this problem, SEAMFUZZ reduces the uncertainty in selecting the mutation location by dividing the length of the seed input according to the parameter p and fixing the sampling space of the mutation location to p.

[0014] 2. Thompson sampling: In order to learn which mutation methods are better for performance, SEAMFUZZ expresses the problem as a multi-armed bandit (MAB) problem. Each "slot machine" represents a mutation operator op and a mutation partition p, and the goal is to maximize the reward by selecting a "slot machine" each round. SEAMFUZZ uses the Thompson sampling algorithm to build a probability model learned from the observed rewards, and samples according to the expected value of each "slot machine" in the model to select the "slot machine" for the next round. The more rewards observed, the higher the probability of selecting a certain "slot machine".

[0015] 3. Learning algorithm: Based on Thompson sampling, SEAMFUZZ defines the probability of selecting each mutation operator Pop_i. Among them, i represents the expected reward of the i-th "slot machine" sampled from the Beta distribution. However, in general gray-box fuzz testing techniques, if success and failure are simply defined, it may not be possible to learn the probability distribution of selecting effective mutation methods. To solve this problem, SEAMFUZZ introduces a dedicated classification standard to more precisely define success and failure.

[0016] 4. Classification criteria: SEAMFUZZ defines two classification criteria to distinguish between success and failure. A successful test case needs to meet one of the following conditions: covering at least one path transition in the rare coverage path (Covrare), or covering more than 80% of the path transitions in the common coverage path (Covcommon). Such a definition can effectively improve the success rate and reduce the failure rate, making the Thompson sampling algorithm work better in the problem setting.

[0017] Through these steps, SEAMFUZZ can learn and optimize the selection of mutation methods for each seed group during the mutation probability learning process to improve the efficiency and coverage of fuzz testing. Although AFLNET has achieved good results in many protocols, it also has the following shortcomings:

[0018] 1) AFLNET uses the coarse-grained response code in the response message as the status of the protocol program, but the response code cannot fully reflect the real status of the protocol, which affects the efficiency of fuzz testing.

[0019] 2) In order to test a specific state, AFLNET needs to send long prefix and suffix messages, resulting in a large amount of time spent sending unmutated messages. In contrast, the proportion of infix messages that are truly used to explore and trigger new states or branches in the test cases is very low, making the throughput of protocol fuzz testing extremely low.

[0020] 3) The low throughput of AFLNET leads to a tendency to choose short message sequences that can reach the target state faster when selecting seeds. However, this choice makes it difficult to cover deeper states or branches.

[0021] 4) In some protocols, there are some vulnerabilities that need to be triggered by multiple interrelated messages in a specific order. However, AFLNet only explores and tests a specific target state in each round of testing, and cannot achieve cross-state protocol testing.

[0022] 5) There is a lack of synchronization mechanism between AFLNET and System under Test (SUT), which makes it impossible for the fuzzer to accurately know whether the SUT has processed the test case. Therefore, AFLNET usually needs to set a time delay to wait for the response message from the SUT, which affects the efficiency and speed of the test.

[0023] Currently, fuzz testing solutions based on mutation probability learning, such as SEAMFUZZ, MOPT, and FAIRFUZZ, have shown significant improvement in general programs, verifying the importance of mutation probability learning technology in software testing. However, these general mutation probability learning technologies do not fully consider the statefulness and message-driven characteristics of network protocol programs, so there are some significant defects in network protocol testing, as shown below:

[0024] First, the input seeds in the network protocol testing process are usually data packets. However, the existing mutation operator definitions do not take into account the specific structural characteristics of the protocol data packets. Their mutation operations are usually limited to arbitrary mutations at any position of the input. This practice may lead to a large number of invalid mutations, thus affecting the efficiency of fuzz testing.

[0025] Secondly, the existing probabilistic mutation learning schemes are mainly aimed at general program design, and fail to effectively integrate the unique state and message-driven features of network protocols. Since they cannot fully utilize the state information of network protocols, these schemes cannot give full play to the potential of the deep semantics of network protocols, and therefore have great limitations in efficiency and coverage. In addition, the lack of effective integration between the existing schemes and the state selection algorithm of advanced network protocol testing tools such as AFLNET further limits their application in network protocol testing. Summary of the invention

[0026] In view of the problems existing in the prior art, the purpose of the present invention is to provide a network protocol fuzz testing method based on refined mutation probability learning to more effectively perform fuzz testing of network protocols. The key technical problems are:

[0027] First, the commonly used input seeds in network protocol testing are data packets, and data packets of different protocols have unique structures and meanings. Common mutation operators, such as bit flipping, segment insertion or replacement at arbitrary positions, easily destroy the structural integrity of data packets, resulting in the generation of a large number of invalid inputs, thereby reducing the efficiency of fuzz testing. To solve this problem, the present invention designs a customized mutation operator for the structural characteristics of the target protocol data packet, clarifies the mutation position and mutation operation, and realizes more accurate mutation probability learning.

[0028] Secondly, existing network protocol fuzz testing tools generally include a state selection scheme, which is used to select the next target state for mutation based on the learned state machine. However, the existing mutation probability learning technology lacks effective integration with the state selection scheme of network protocol fuzz testing, and cannot fully utilize the semantic information of the network protocol. The present invention is committed to solving how to integrate the unique statefulness and message-driven characteristics of network protocols into the mutation probability learning technology, thereby improving the efficiency and coverage of fuzz testing. This is one of the key technical problems to be solved by the present invention.

[0029] In order to fully combine the advantages of mutation probability learning technology in the process of network protocol fuzz testing, the present invention proposes a refined mutation probability learning technology that combines network protocol states and message sequences. This scheme applies probabilistic learning technology to the state selection algorithm of protocol testing, and automatically selects protocol states with exploration potential for each seed group. To this end, this scheme designs a more fine-grained protocol state division method, using state transition rather than the state itself as the division criterion. After selecting the target protocol state, this scheme designs a mutation probability learning scheme based on the data packet structure for the corresponding seed grouping, and refines the test feedback.

[0030] The key points of the present invention are as follows:

[0031] The present invention proposes a probabilistic learning scheme for a protocol test state selection algorithm. The purpose of this scheme is to automatically learn the probability distribution of state selection to improve the efficiency of network protocol fuzz testing. In this scheme, we use the state transition edge of the protocol rather than the state itself as the division standard. This method refines the granularity of state division so that the return of fuzz testing can be used more accurately. For each state transition path, we assign a certain sampling probability pi, and use the coverage of the state selection seed obtained after each state transition path as a reward, thereby obtaining a multi-armed bandit (MAB) model. For this model, we use the classic Thompson sampling algorithm to automatically learn the sampling probability. Different from the fixed state selection algorithm used in traditional protocol fuzz testing schemes, this scheme assigns a certain selection probability to each state transition path, and automatically learns the selection probability through the feedback of fuzz testing, so as to have better flexibility and adaptability.

[0032] After the state selection algorithm, the present invention uses a variation probability learning scheme for seed grouping. This scheme designs a variation scheme for the network data packet structure. Its improvement over the traditional scheme mainly lies in the following two points:

[0033] (1) In experiments conducted on a large number of network protocol programs, we found that the traditional scheme has low efficiency in probabilistic learning of mutation positions. The reason is that network protocol test inputs are often organized in the format of data packets, and mutations at any position often destroy the structure of the data packet and easily generate invalid inputs. Therefore, we designed a new mutation position learning scheme to make the mutation position in a specific field of the data packet (the specific field varies with the test target protocol; for general network protocols, the mutation operator is mainly used to act on the content field of the data packet, such as port number, IP address, etc., to prevent the mutation operation from destroying the data packet structure and generating too many invalid inputs) to ensure the legality of input generation.

[0034] (2) We use more refined program feedback as a reward for the MAB model. Traditional network protocol fuzz testing methods generally use state coverage and control flow coverage as feedback. This method cannot distinguish the subtle differences in packet input, making it difficult to select packets with full potential. Therefore, we use protocol state transition coverage rather than protocol state coverage as the feedback standard. In this way, more sufficient feedback can be obtained during the protocol execution process, thereby improving the efficiency of the Thompson sampling process.

[0035] A network protocol fuzz testing method based on refined mutation probability learning, the steps of which include:

[0036] 1) Analyze the target network protocol and construct its state transition graph; create a multi-armed slot machine model based on the state transition edges in the state transition graph, where each arm represents an optional state transition path;

[0037] 2) The fuzz tester sends the fuzz test case to the server program of the target network protocol through the target network protocol; based on the state transition diagram and the server program feedback, the protocol state in the server program is subdivided using the state transition edge to obtain a state transition edge set;

[0038] 3) for each state transition edge in the state transition edge set, selecting an arm from the multi-armed bandit model as a state transition path of the state transition edge;

[0039] 4) According to the test results of each fuzzy test, the sampling probability of the corresponding arm in the multi-armed bandit model is updated: if the state transition path i successfully explores a new state or path, the sampling probability of the state transition path i is increased; otherwise, the sampling probability of the state transition path i is reduced.

[0040] Furthermore, a feedback mechanism based on protocol state transition coverage is used to obtain the test results of each fuzz test.

[0041] Furthermore, an adaptive mechanism is used to dynamically adjust the probability distribution of state selection according to actual test feedback; the adaptive mechanism automatically adjusts the exploration probability of each state by monitoring the coverage and exploration effect during the fuzz testing process to optimize test efficiency and coverage.

[0042] Furthermore, the state transition diagram is a protocol state machine IPSM.

[0043] Furthermore, a Thompson sampling algorithm is used to select an arm from the multi-armed bandit model as the state transition path of the state transition edge.

[0044] A server, characterized in that it comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the above method.

[0045] A computer-readable storage medium stores a computer program, wherein the computer program implements the above method when executed by a processor.

[0046] The beneficial effects of the refined mutation probability learning method for network protocol fuzz testing proposed in this scheme are mainly reflected in the following aspects:

[0047] 1. Improve test efficiency and accuracy:

[0048] Precise mutation location selection effectively reduces the generation of invalid test inputs and improves test efficiency by performing mutations in specific fields of the data packet. It avoids the problem of data packet structure destruction that may be caused by traditional random mutation methods, making the generated test data more compliant with protocol specifications, thereby enhancing the accuracy and effectiveness of the test.

[0049] 2. Optimize the adaptive ability of mutation strategy:

[0050] Multi-armed bandit (MAB) model: The Thompson sampling algorithm is used to dynamically learn the selection probability of each mutation operation, so that the test system can adjust the mutation strategy according to real-time test feedback. This adaptive capability enables the system to quickly respond to different protocol execution conditions, optimize resource utilization and test path coverage during the test process, and further improve test efficiency and discovery potential.

[0051] 3. Enhance flexibility and adaptability:

[0052] Adaptability to different protocols and scenarios: Due to the adoption of refined mutation based on packet structure and dynamic learning mutation strategy, the solution has strong flexibility and adaptability. It can effectively respond to the specific testing requirements of different network protocols and perform well in different test scenarios, providing a universal and effective solution for a wide range of protocol tests.

[0053] 4. Fully integrate the state characteristics of the network protocol:

[0054] Traditional protocol testing often uses a fixed state selection algorithm that cannot adapt to changes in state selection when different protocols are executed. The probabilistic learning scheme can automatically adjust the degree of exploration of each state during the test by dynamically learning the selection probability distribution of each protocol state. This adaptive capability enables the test system to more efficiently discover new test paths and boundary conditions, significantly improving the comprehensiveness and depth of the test.

[0055] In summary, this refined mutation probability learning scheme not only improves the efficiency and accuracy of testing, but also significantly enhances the discovery potential and adaptability of the test system by optimizing the adaptive ability of the mutation strategy and enhancing test coverage, bringing substantial optimization and improvement to network protocol fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 Flowchart of the customized mutation probability learning method for the protocol test state selection algorithm.

[0057] Figure 2 The figure is a flow chart of the method of the present invention.

[0058] Figure 3 Flowchart for learning mutation probabilities for seed groups. DETAILED DESCRIPTION

[0059] The present invention is further described in detail below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention but not to limit the scope of the present invention.

[0060] In order to fully combine the advantages of mutation probability learning technology in network protocol fuzz testing, the present invention proposes a refined mutation probability learning technology that combines the state and message sequence of the network protocol. This scheme applies probabilistic learning technology to the state selection algorithm of the protocol test, and automatically selects protocol states with exploration potential for each seed group. To this end, this scheme designs a more detailed protocol state division method, using state transition rather than a single state itself as the division criterion. After determining the target protocol state, this scheme designs a customized mutation probability learning scheme based on the data packet structure for the corresponding seed group, and optimizes the test feedback mechanism. The probabilistic learning scheme for the protocol test state selection algorithm is as follows: Figure 1 shown.

[0061] The method flow of the present invention is as follows Figure 2 As shown, the specific implementation steps are as follows:

[0062] 1) State transfer analysis:

[0063] First, we need to analyze the target network protocol and construct its state transition diagram. The state transition diagram describes the transition relationship between various states during the protocol execution process, including state transition conditions and possible transition paths. We adopt the AFLNET solution to continuously update the state and state transition by receiving the server's response during fuzz testing, thereby automatically constructing the protocol state machine IPSM.

[0064] 2) Status division:

[0065] Based on the constructed state transition graph and the feedback from the network protocol server program, the protocol state is subdivided. We use the state transition edge rather than the state itself as the division unit. This step can be adjusted according to the execution logic and security requirements of the protocol to ensure the rationality and practicality of the state division. During the fuzz testing process, the client (fuzz tester) sends messages (i.e., fuzz test cases) to the server program of the target network protocol through the target network protocol; then, based on the constructed state transition graph IPSM and the feedback from the server program on the message (status code, etc.), the protocol state in the program is subdivided. This subdivision specifically refers to using the state transition edge rather than the state itself as the division unit.

[0066] 3) Probabilistic learning model design:

[0067] Multi-armed bandit (MAB) model: A multi-armed bandit model is designed for the state transition edge, where each arm represents a possible state transition path selection. Each time fuzz testing is performed, the Thompson sampling algorithm is used to automatically learn the probability distribution and select the state transition path. This step uses historical data and feedback information to automatically update the selection probability of each state transition path.

[0068] 4) Dynamic probability update strategy: According to the results of each fuzzy test, the sampling probability of each arm in the MAB model is updated. Specifically, if a state transition path i successfully explores a new state or path, the sampling probability of the state transition path i is increased; otherwise, the sampling probability of the state transition path i is reduced to optimize the probability of the next selection.

[0069] 5) Optimize the test feedback mechanism: Traditional feedback mechanisms may only rely on state coverage and control flow coverage. In order to optimize the test more finely, we adopt a feedback mechanism based on protocol state transition coverage. This means that we not only focus on whether a certain state has been reached, but also analyze the integrity and coverage of the state transition path to evaluate the effectiveness and coverage of the test.

[0070] The customized state transition probability learning scheme combines the state selection algorithm and message sequence characteristics of protocol testing. Through refined state transition analysis, the application of multi-armed bandit models and optimized feedback mechanisms, it has achieved significant improvements in the efficiency and coverage of network protocol fuzz testing. This scheme can not only explore the protocol execution path more accurately, but also dynamically adapt to changes in protocols and test requirements, providing important technical support for network protocol security assessment and improvement.

[0071] The mutation probability learning process for seed grouping is as follows: Figure 3 As shown, the specific implementation steps are as follows:

[0072] 1) Analysis and parsing of network protocol data packet structure:

[0073] Packet feature analysis: Detailed analysis of the target network protocol’s packets, including protocol headers, data fields, data types, and syntax structures. This step is to gain a deep understanding of how packets are organized, determine which parts are critical to protocol functionality, and which parts can be mutated without destroying the validity of the packet.

[0074] Precise selection of mutation positions:

[0075] Mutation location based on field constraints: Traditional random mutation methods may destroy the structure of data packets and generate a large number of invalid test inputs. To solve this problem, this solution designs a mutation location learning method based on data packet field constraints. For example, according to the data type and length limit of the field, the mutation location is selected to ensure that the mutation operation does not cause the generated data packet to violate the protocol regulations, ensuring the legitimacy and validity of the test input.

[0076] Multi-Armed Bandit (MAB) Model:

[0077] For seed grouping, a MAB model is established, in which each "arm" represents an optional state transition path. The Thompson sampling algorithm is used to dynamically learn the sampling probability of each "arm", which reflects the expected benefit of selecting a specific state transition path in the current state. The algorithm updates the model parameters based on real-time test feedback, enabling it to adaptively optimize the selection strategy and improve the efficiency and accuracy of fuzz testing.

[0078] State transition coverage as feedback criteria:

[0079] Traditional testing methods usually use state coverage or control flow coverage as feedback indicators, but these methods have difficulty distinguishing subtle differences in packet input. In order to more accurately evaluate the test effect, this solution uses protocol state transition coverage as the main feedback criterion. Specifically, it analyzes whether the state transition path during protocol execution covers all expected situations, and adjusts the priority and selection probability of each "arm" in the MAB model based on these coverage conditions.

[0080] The innovation of this solution lies in the combination of data packet structure analysis of network protocols, refined mutation location selection, and a real-time feedback mechanism based on protocol state transition coverage. By limiting mutation operations to specific fields of data packets, the legality and effectiveness of test inputs are guaranteed; at the same time, the MAB model and Thompson sampling algorithm are used to dynamically learn the optimal mutation strategy, thereby improving the efficiency and adaptability of fuzz testing. These innovative designs enable this solution to more accurately explore network protocol execution paths, enhance test coverage and discovery potential, and further optimize the overall effect of network protocol fuzz testing.

[0081] Possible variations of this scheme include:

[0082] 1. Adaptive Probabilistic Learning Adjustment:

[0083] Through the adaptive mechanism, the probability distribution of state selection is dynamically adjusted according to the actual test feedback. This solution can automatically adjust the exploration probability of each state to optimize test efficiency and coverage by monitoring the coverage and exploration effect during the test process. This method can combine statistical analysis and machine learning techniques to achieve dynamic adjustment.

[0084] 2. Application of reinforcement learning in probabilistic learning:

[0085] Use other reinforcement learning algorithms in the probability learning process to replace Thompson sampling for state selection strategy optimization and mutation probability learning.

[0086] Although the specific embodiments of the present invention are disclosed for the purpose of illustration, the purpose is to help understand the content of the present invention and implement it accordingly, those skilled in the art will understand that various substitutions, changes and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the content disclosed in the best embodiment, and the scope of the present invention is subject to the scope defined in the claims.

Claims

1. A network protocol fuzz testing method based on refined mutation probability learning, the steps of which include: 1) Analyze the target network protocol and construct its state transition diagram; Creating a multi-armed bandit model based on the state transition edges in the state transition graph, wherein each arm represents an optional state transition path; 2) The fuzz tester sends the fuzz test case to the server program of the target network protocol through the target network protocol; Based on the state transition diagram and the server program feedback, the protocol state in the server program is subdivided using the state transition edge to obtain a state transition edge set; 3) for each state transition edge in the state transition edge set, selecting an arm from the multi-armed bandit model as a state transition path of the state transition edge; 4) According to the test results of each fuzzy test, the sampling probability of the corresponding arm in the multi-armed bandit model is updated: if the state transition path i successfully explores a new state or path, the sampling probability of the state transition path i is increased; otherwise, the sampling probability of the state transition path i is reduced.

2. The method according to claim 1, characterized in that A feedback mechanism based on protocol state transition coverage is used to obtain the test results of each fuzz test.

3. The method according to claim 1, characterized in that Through an adaptive mechanism, the probability distribution of state selection is dynamically adjusted according to actual test feedback; the adaptive mechanism automatically adjusts the exploration probability of each state by monitoring the coverage and exploration effect during the fuzz testing process to optimize test efficiency and coverage.

4. The method according to claim 1, 2 or 3, characterized in that: The state transition diagram is a protocol state machine IPSM.

5. The method according to claim 1, 2 or 3, characterized in that: An arm is selected from the multi-armed bandit model as the state transition path of the state transition edge using the Thompson sampling algorithm.

6. A server, characterized in that: The invention comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images