A network protocol fuzzing method based on fine-grained mutation probability learning

Abstract

The application discloses a network protocol fuzzy testing method based on fine variation probability learning, and the steps include: 1) creating a multi-armed bandit model based on the state transition edges in the state transition graph of the target network protocol, wherein each arm represents a selectable state transition path; 2) the fuzzy tester sends the fuzzy test case to the server program of the target network protocol through the target network protocol; based on the state transition graph and the feedback of the server program, the protocol state in the server program is subdivided by using the state transition edges to obtain a state transition edge set; 3) for each state transition edge, an arm is selected from the multi-armed bandit model as the state transition path of the edge; 4) according to the test result of each fuzzy test, the sampling probability of the corresponding arm in the multi-armed bandit model is updated: if the state transition path i successfully explores a new state or path, the sampling probability of the state transition path i is increased; otherwise, the sampling probability is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network protocol fuzz testing and relates to a network protocol fuzz testing method based on refined mutation probability learning. Background Art

[0002] AFLNET is the first stateful gray-box protocol fuzz testing tool based on AFL. It constructs a protocol state machine (IPSM) by extracting status codes from response messages and uses this state machine to guide testing. AFLNET includes modules such as a state learner, a target state selector, a sequence selector, and a sequence mutator.

[0003] AFLNET communicates with the server via sockets, supporting both sending and receiving messages. The input is a pcap file containing network traffic, and a request sequence parser is used to generate a message sequence corpus. The state learner extends the IPSM, the target state selector selects the test state based on the IPSM, the sequence selector selects message sequences from the corpus, and the sequence mutator mutates the message sequences.

[0004] The actual implementation process of AFLNET is as follows:

[0005] 1. AFLNET receives the pcap file and parses the message sequence.

[0006] 2. The state machine learner extracts the state code and constructs the IPSM.

[0007] 3. Target state selector Select the test target state.

[0008] 4. The sequence selector selects the appropriate message sequence, and the sequence mutator mutates it.

[0009] 5. Update the corpus and IPSM to record new states and state transitions.

[0010] Mutation probability learning is a key technology in the field of fuzz testing. Compared to traditional approaches that uniformly sample seeds and mutation operators, mutation probability learning assigns different probabilities to different seeds and mutation operators, and samples them based on these probabilities to select the seeds and mutation operators to be mutated. This technology adjusts the sampling probability values ​​based on feedback from the target program, increasing the probability of selecting valid seeds and mutation operators, thereby achieving better fuzz testing results. Compared to traditional approaches, mutation probability learning technology provides greater flexibility in fuzz testing scheduling strategies, adapting to different programs through an adaptive learning process.

[0011] The general process of mutation probability learning is introduced below using SeamFuzz as an example. SEAMFUZZ is a gray-box fuzzing tool that focuses on capturing the personalized characteristics of each seed input and applying different mutation strategies for different seed inputs. To achieve this goal, the main technical challenge is how to effectively learn and maintain multiple probability distributions associated with different seed inputs.

[0012] The execution process of SEAMFUZZ in the mutation probability learning process is as follows:

[0013] 1. Define the sampling space: First, SEAMFUZZ defines the sampling space for selecting the mutation method m, which includes the mutation location (loc) and the mutation way (op). The mutation way is usually predefined, so the sampling space for selecting the mutation operator can be determined. However, the mutation location is determined by the size of the given seed input, which is not fixed, so it is difficult to determine the sampling space of the mutation location. To solve this problem, SEAMFUZZ fixes the sampling space of the mutation location to p by dividing the length of the seed input according to the parameter p, thereby reducing the uncertainty when selecting the mutation location.

[0014] 2. Thompson sampling: To learn which mutation method is better for performance, SEAMFUZZ expresses the problem as a multi-armed bandit (MAB) problem. Each "bandit" represents a mutation operator op and a mutation partition p, and the goal is to maximize the reward by selecting "bandits" in each round. SEAMFUZZ uses the Thompson sampling algorithm to build a probability model learned from observed rewards, and samples according to the expected value of each "bandit" in the model to select the "bandit" for the next round. The more rewards observed, the higher the probability of selecting a certain "bandit".

[0015] 3. Learning algorithm: Based on Thompson sampling, SEAMFUZZ defines the probability of selecting each mutation operator Pop_i. Where i represents the expected reward of the i-th "bandit" sampled from the Beta distribution. However, in general gray-box fuzzing techniques, if the success and failure conditions are simply defined, it may not be possible to learn the probability distribution of selecting effective mutation methods. To solve this problem, SEAMFUZZ introduces a special classification standard to more accurately define the success and failure conditions.

[0016] 4. Classification criteria: SEAMFUZZ defines two classification conditions to distinguish between success and failure cases. A successful test case needs to satisfy one of the following conditions: covering at least one path transition in the rare coverage path (Covrare) or covering more than 80% of path transitions in the common coverage path (Covcommon). Such definitions can effectively improve the success rate and reduce the failure rate, making the Thompson sampling algorithm work better in problem settings.

[0017] Through these steps, SEAMFUZZ can learn and optimize the selection of mutation methods for each seed group during the mutation probability learning process to improve the efficiency and coverage of fuzz testing. Although AFLNET has achieved good results in many protocols, it also has the following shortcomings:

[0018] 1) AFLNET uses coarse-grained response codes in response packets as the state of the protocol program, but the response code cannot fully reflect the real state of the protocol, which affects the efficiency of fuzz testing.

[0019] 2) In order to test for specific states, AFLNET needs to send long prefix messages and suffix messages, resulting in a large amount of time being used to send unmutated messages. In contrast, the proportion of infix messages that are actually used to explore and trigger new states or branches in test cases is very low, making the throughput of protocol fuzz testing extremely low.

[0020] 3) The low throughput of AFLNET leads to a tendency to select short message sequences that can reach the target state faster when selecting seeds. However, this selection makes it difficult to cover deeper states or branches.

[0021] 4) In some protocols, there are vulnerabilities that require multiple interrelated messages to be triggered in a specific order, and AFLNet only explores and tests for specific target states in each round of testing, which cannot achieve cross-state protocol testing.

[0022] 5) AFLNET lacks a synchronization mechanism between the System under Test (SUT) and the fuzz tester, which prevents the fuzz tester from accurately knowing whether the SUT has processed the test case. Therefore, AFLNET usually needs to set a time delay to wait for the response packet from the SUT, which affects the efficiency and speed of testing.

[0023] Currently, fuzzing schemes based on mutation probability learning, such as SEAMFUZZ, MOPT and FAIRFUZZ, have shown significant improvements in general programs, verifying the importance of mutation probability learning technology in software testing. However, these general mutation probability learning techniques do not fully consider the state and message-driven characteristics of network protocol programs, so there are some significant defects in network protocol testing, which are as follows:

[0024] First, the input seed in the network protocol testing process is usually a data packet, but the existing mutation operator definition does not consider the specific structural characteristics of the protocol data packet, and its mutation operation is usually limited to arbitrary mutation at any position of the input, which may lead to the generation of a large number of invalid mutations, thereby affecting the efficiency of fuzz testing.

[0025] Second, existing mutation probability learning schemes are mainly designed for general programs and fail to effectively integrate the unique state and message-driven characteristics of network protocols. Due to the inability to fully utilize the state information of network protocols, these schemes cannot exploit the potential of deep semantic network protocols, thus limiting their efficiency and coverage. In addition, the existing schemes lack effective integration with advanced network protocol testing tools such as AFLNET's state selection algorithm, further limiting their application in network protocol testing. SUMMARY

[0026] To solve the problems in the prior art, the purpose of the present application is to provide a network protocol fuzzing method based on refined mutation probability learning to more effectively perform network protocol fuzzing. The key technical problem is:

[0027] First, the input seed commonly used in network protocol testing is a data packet, and data packets of different protocols have unique structures and meanings. Common mutation operators, such as bit flipping, segment insertion or replacement at any position, can easily damage the structural integrity of data packets, resulting in the generation of a large number of invalid inputs and thus reducing the efficiency of fuzz testing. To solve this problem, the present application designs customized mutation operators for the structural characteristics of the target protocol data packet, clearly defines the mutation position and mutation operation, to achieve more accurate mutation probability learning.

[0028] Secondly, existing network protocol fuzzing tools generally contain state selection schemes for selecting the next target state for mutation according to the learned state machine. However, the existing mutation probability learning technology and the state selection scheme of the network protocol fuzzing lack effective integration, and cannot fully utilize the semantic information of the network protocol. The present application is committed to solving the problem of how to integrate the unique state and message-driven characteristics of the network protocol into the mutation probability learning technology, thereby improving the efficiency and coverage of the fuzzing, which is one of the key technical problems to be solved by the present application.

[0029] In order to fully combine the advantages of the mutation probability learning technology in the network protocol fuzzing process, the present application proposes a refined mutation probability learning technology combining network protocol states and message sequences. The scheme applies the probability learning technology to the state selection algorithm of the protocol test, and automatically selects the protocol state with exploration potential for each seed group. For this purpose, the present scheme designs a more fine-grained protocol state division method, taking state transition instead of state itself as the division standard. After selecting the target protocol state, the present scheme designs a mutation probability learning scheme based on the data packet structure for the corresponding seed group, and refines the test feedback.

[0030] The key points of the present application are as follows:

[0031] The present application proposes a probability learning scheme for the state selection algorithm of the protocol test. The purpose of the scheme is to automatically learn the probability distribution of state selection to improve the efficiency of network protocol fuzzing. In the scheme, we use the state transition edge of the protocol instead of the state itself as the division standard, which refines the granularity of state division and enables the return of the fuzzing to be more accurately utilized. For each state transition path, we assign a certain sampling probability pi, and use the coverage of the seed selected after each state transition path to obtain the state selection as a reward, thereby obtaining a multi-armed bandit (MAB) model. For this model, we use the classic Thompson sampling algorithm to automatically learn the sampling probability. Unlike the fixed state selection algorithm used in traditional protocol fuzzing schemes, the scheme assigns a certain selection probability to each state transition path, and automatically learns the selection probability through the feedback of the fuzzing, thereby having better flexibility and adaptability.

[0032] After the state selection algorithm, the present application uses a mutation probability learning scheme for seed grouping. The scheme designs a mutation scheme for the network data packet structure. The improvement of the traditional scheme mainly lies in the following two points:

[0033] (1) In the experiments on a large number of network protocol programs, we found that the traditional scheme has low learning efficiency of the probability of the mutation position. The reason is that the network protocol test input is often organized in the format of a data packet, and the mutation at any position often destroys the structure of the data packet, which is easy to produce invalid input. Therefore, we designed a new learning scheme of mutation position, which makes the mutation position in a specific field of the data packet (the specific field is different for different test target protocols; for general network protocols, mainly make the mutation operator act in the content field of the data packet, such as port number, IP address, etc., to prevent the mutation operation from destroying the data packet structure and generating too many invalid inputs), to ensure the legality of input generation.

[0034] (2) We use more refined program feedback as the reward of the MAB model. The traditional network protocol fuzzing method generally uses state coverage and control flow coverage as feedback, which cannot distinguish the subtle differences of data packet input, so it is difficult to select data packets with sufficient potential. Therefore, we use protocol state transition coverage instead of protocol state coverage as the feedback standard. In this way, more sufficient feedback can be obtained during protocol execution, thereby improving the efficiency of the Thompson sampling process.

[0035] A network protocol fuzzing method based on refined mutation probability learning, comprising the following steps:

[0036] 1) Analyzing the target network protocol to construct its state transition graph; creating a multi-armed bandit model based on the state transition edges in the state transition graph, wherein each arm represents a selectable state transition path;

[0037] 2) The fuzzing tester sends the fuzzing test case to the server program of the target network protocol through the target network protocol; based on the state transition graph and the feedback of the server program, the protocol state in the server program is subdivided using state transition edges to obtain a set of state transition edges;

[0038] 3) For each state transition edge in the set of state transition edges, select an arm from the multi-armed bandit model as the state transition path of the state transition edge;

[0039] 4) According to the test result of each fuzzing test, update the sampling probability of the corresponding arm in the multi-armed bandit model: if the state transition path i successfully explores a new state or path, increase the sampling probability of the state transition path i; otherwise, decrease the sampling probability of the state transition path i.

[0040] Further, a feedback mechanism based on protocol state transition coverage is used to obtain the test result of each fuzzing test.

[0041] Further, through an adaptive mechanism, the probability distribution of state selection is dynamically adjusted according to actual test feedback; the adaptive mechanism automatically adjusts the exploration probability of each state by monitoring the coverage and exploration effect during the fuzzy testing process, so as to optimize the test efficiency and coverage.

[0042] Further, the state transition graph is an Internet Protocol State Machine (IPSM).

[0043] Further, the Thompson sampling algorithm is used to select an arm from the multi-armed bandit model as the state transition path of the state transition edge.

[0044] A server, characterized by comprising a memory and a processor, the memory storing a computer program, the computer program being configured to be executed by the processor, the computer program comprising instructions for executing the above method.

[0045] A computer readable storage medium having a computer program stored thereon, characterized in that the computer program is executed by a processor to implement the above method.

[0046] The beneficial effects of the fine mutation probability learning method for network protocol fuzz testing proposed in this solution mainly lie in the following aspects:

[0047] 1. Improve test efficiency and accuracy:

[0048] Precise mutation position selection effectively reduces the generation of invalid test inputs by performing mutation within specific fields of data packets, improving test efficiency. It avoids the problem of data packet structure damage that may be caused by traditional random mutation methods, making the generated test data more consistent with protocol specifications, thereby enhancing the accuracy and effectiveness of the test.

[0049] 2. Optimize adaptive ability of mutation strategy:

[0050] Multi-armed bandit (MAB) model: using the Thompson sampling algorithm to dynamically learn the selection probability of each mutation operation, so that the test system can adjust the mutation strategy according to real-time test feedback. This adaptive ability enables the system to quickly respond to different protocol execution situations, optimize resource utilization and test path coverage during the test process, and further improve test efficiency and discovery potential.

[0051] 3. Enhance flexibility and adaptability:

[0052] Adaptability to different protocols and scenarios: Due to the adoption of fine-grained mutation based on packet structure and dynamic learning mutation strategy, the scheme has strong flexibility and adaptability. It can effectively cope with the specific testing needs of different network protocols, and performs well in different testing scenarios, providing a general and effective solution for extensive protocol testing.

[0053] 4. Fully integrate the state characteristics of network protocols:

[0054] Traditional protocol testing often uses fixed state selection algorithms, which cannot adapt to changes in state selection during protocol execution. The probability learning scheme dynamically learns the selection probability distribution of each protocol state, and can automatically adjust the exploration degree of each state during testing. This adaptive ability enables the testing system to more efficiently discover new test paths and boundary conditions, significantly improving the comprehensiveness and depth of testing.

[0055] In summary, this fine-grained mutation probability learning scheme not only improves the efficiency and accuracy of testing, but also optimizes the adaptive ability of the mutation strategy and enhances the test coverage, significantly enhancing the discovery potential and adaptability of the testing system, bringing substantial optimization and improvement to network protocol fuzz testing. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 A flowchart of the customized mutation probability learning method for protocol testing state selection algorithm.

[0057] Figure 2 A flowchart of the method of the present application.

[0058] Figure 3 A flowchart of the mutation probability learning process for seed packets. DETAILED DESCRIPTION

[0059] The present application will be further described in detail below with reference to the accompanying drawings, which are provided only to explain the present application and are not intended to limit the scope of the present application.

[0060] In order to fully integrate the advantages of mutation probability learning technology in network protocol fuzz testing, the present application proposes a fine-grained mutation probability learning technology that combines the state and message sequence of network protocols. This scheme applies probability learning technology to the state selection algorithm of protocol testing, and automatically selects protocol states with exploration potential for each seed group. For this purpose, the present scheme designs a more detailed protocol state division method, taking state transition rather than a single state itself as the division standard. After determining the target protocol state, the present scheme designs a customized mutation probability learning scheme based on packet structure for the corresponding seed group, and optimizes the test feedback mechanism. The probability learning scheme for protocol testing state selection algorithm is as follows:Figure 1 as shown.

[0061] The method flow of the present application is shown as Figure 2 The specific implementation steps are as follows:

[0062] 1) State transition analysis:

[0063] First, the target network protocol needs to be analyzed to construct its state transition graph. The state transition graph describes the transition relationship between various states in the protocol execution process, including state transition conditions and possible transition paths. We use the scheme of AFLNET to constantly update the state and state transition in response to the server in the fuzz testing, thereby automatically constructing the protocol state machine IPSM.

[0064] 2) State division:

[0065] Based on the constructed state transition graph and the feedback of the network protocol server program to subdivide the protocol state, we use state transition edges rather than states themselves as the division unit. This step can be adjusted according to the execution logic and security requirements of the protocol to ensure the rationality and practicality of state division. In the process of fuzz testing, the client (fuzz tester) sends messages (i.e. fuzz test cases) to the target network protocol server program through the target network protocol; then according to the constructed state transition graph IPSM and the feedback (state code, etc.) of the server program to the message, the protocol state in the program is subdivided, which specifically refers to using state transition edges rather than states themselves as the division unit.

[0066] 3) Probability learning model design:

[0067] Multi-armed Bandit (MAB) model: a multi-armed bandit model is designed for state transition edges, where each arm represents a possible state transition path selection. Each time the fuzz testing is performed, the Thompson sampling algorithm is used to automatically learn the probability distribution and select the state transition path. This step uses historical data and feedback information to automatically update the selection probability of each state transition path.

[0068] 4) Dynamic probability update strategy: according to the results of each fuzz testing, the sampling probability of each arm in the MAB model is updated. Specifically, if a certain state transition path i successfully explores a new state or path, the sampling probability of the state transition path i is increased; otherwise, the sampling probability of the state transition path i is reduced to optimize the probability of the next selection.

[0069] 5) Optimized Test Feedback Mechanism: Traditional feedback mechanisms may only rely on state coverage and control flow coverage. To optimize testing more finely, we use a feedback mechanism based on protocol state transition coverage. This means not only paying attention to whether a certain state is reached, but also analyzing the integrity and coverage of the state transition path to evaluate the effectiveness and coverage of the test.

[0070] The customized state transition probability learning scheme combines the state selection algorithm of protocol testing and the characteristics of message sequence, through refined state transition analysis, application of multi-armed bandit model and optimized feedback mechanism, to realize significant improvement of network protocol fuzzing efficiency and coverage. This scheme not only can explore protocol execution path more accurately, but also can dynamically adapt to changes in protocol and changes in test requirements, providing important technical support for network protocol security evaluation and improvement.

[0071] The mutation probability learning process for seed packets is shown in Figure 3 The specific implementation steps are as follows:

[0072] 1) Network protocol packet structure analysis and parsing:

[0073] Packet characteristic analysis: Detailed analysis of the data packets of the target network protocol, including protocol header, data field, data type and syntax structure. This step is to deeply understand the organization of the data packet, determine which parts are crucial to the protocol function, and which parts can be mutated without destroying the validity of the data packet.

[0074] Precise selection of mutation positions:

[0075] Mutation position based on field constraints: Traditional random mutation methods may destroy the structure of the data packet and generate a large number of invalid test inputs. To solve this problem, this scheme designs a mutation position learning method based on data packet field constraints. For example, according to the data type and length limit of the field, the mutation position is selected to ensure that the mutation operation does not cause the generated data packet to violate the protocol specification, ensuring the legality and effectiveness of the test input.

[0076] Multi-armed Bandit (MAB) model:

[0077] For seed packets, a MAB model is established, where each "arm" represents a selectable state transition path. The Thompson sampling algorithm is used to dynamically learn the sampling probability of each "arm", which reflects the expected return of selecting a particular state transition path in the current state. The algorithm updates the model parameters according to real-time test feedback, allowing it to adaptively optimize the selection strategy and improve the efficiency and accuracy of fuzz testing.

[0078] State transition coverage as feedback criteria:

[0079] Traditional testing methods usually use state coverage or control flow coverage as feedback indicators, but these methods have difficulty distinguishing subtle differences in packet inputs. To more accurately assess the effectiveness of testing, the present scheme uses protocol state transition coverage as the main feedback criteria. Specifically, it analyzes whether the state transition paths during protocol execution cover all expected cases, and adjusts the priority and selection probability of each "arm" in the MAB model based on these coverage cases.

[0080] The innovation of the present scheme lies in the combination of packet structure analysis of network protocols, fine-grained mutation position selection, and real-time feedback mechanism based on protocol state transition coverage. By limiting mutation operations within specific fields of the data packet, the legality and effectiveness of the test input are guaranteed; at the same time, the MAB model and Thompson sampling algorithm are used to dynamically learn the optimal mutation strategy, thereby improving the efficiency and adaptability of the fuzz testing. These innovative designs enable the present scheme to more accurately explore the execution paths of network protocols, enhance the test coverage and discovery potential, and further optimize the overall effectiveness of network protocol fuzz testing.

[0081] Possible variations of the scheme are:

[0082] 1. Adaptive probability learning adjustment:

[0083] Through an adaptive mechanism, the probability distribution of state selection is dynamically adjusted according to actual test feedback. The present scheme can monitor the coverage and exploration effect during testing, automatically adjust the exploration probability of each state, and optimize the test efficiency and coverage. This method can combine statistical analysis and machine learning techniques to achieve dynamic adjustment.

[0084] 2. Application of reinforcement learning in probability learning:

[0085] Use other reinforcement learning algorithms in the probability learning process to replace Thompson sampling for state selection strategy optimization and mutation probability learning.

[0086] Although specific embodiments of the present invention are disclosed for illustrative purposes, the purpose is to help understand the content of the present invention and to implement it, and those skilled in the art can understand that various substitutions, changes and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosed content of the best embodiment, and the scope of the invention claimed is defined by the scope of the claims.

Claims

1. A network protocol fuzzing method based on fine-grained mutation probability learning, comprising the steps of: 1) analyzing a target network protocol and constructing a state transition graph thereof; creating a multi-armed bandit model based on state transition edges in the state transition graph, wherein each arm represents a selectable state transition path; 2) sending a fuzzing test case to a server program of the target network protocol by a fuzzing tester through the target network protocol; subdividing protocol states in the server program based on the state transition graph and feedback from the server program using state transition edges to obtain a state transition edge set; 3) selecting an arm from the multi-armed bandit model as a state transition path of each state transition edge in the state transition edge set; 4) updating a sampling probability of the corresponding arm in the multi-armed bandit model according to a test result of each fuzzing test: if a state transition path i successfully explores a new state or path, the sampling probability of the state transition path i is increased; otherwise, the sampling probability of the state transition path i is decreased.

2. The method of claim 1, wherein, A feedback mechanism based on protocol state transition coverage is used to obtain a test result of each fuzzing test.

3. The method of claim 1, wherein, An adaptive mechanism is used to dynamically adjust a probability distribution of state selection according to actual test feedback; the adaptive mechanism automatically adjusts an exploration probability of each state by monitoring coverage and exploration effects in the fuzzing test process to optimize test efficiency and coverage.

4. The method according to claim 1 or 2 or 3, characterized in that, The state transition graph is a protocol state machine IPSM.

5. The method according to claim 1 or 2 or 3, characterized in that, A Thompson sampling algorithm is used to select an arm from the multi-armed bandit model as a state transition path of the state transition edge.

6. A server, characterized by A computer program is stored in a memory and executed by a processor, and the computer program comprises instructions for executing the method of any one of claims 1 to 5.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1 to 5.

Images