A network protocol fuzz testing method and device based on state guidance and seed mutation

Abstract

A network protocol fuzz testing method and device based on state guidance and seed mutation, the method comprising: 1) manually constructing a high-quality basic seed based on official RFC protocol documents and mapping the seed to the corresponding state; 2) inputting a message sequence into a target program for fuzz testing, interacting with the target program while monitoring the program state and obtaining feedback; 3) selecting a seed with high coverage for information-preserving mutation based on the protocol state code and path coverage feedback, preserving the seed's state transition function to reduce the number of invalid seeds; 4) state-guided message sequence generation: selecting a target test state based on the current state and the returned protocol status code, prioritizing states that have not been reached or have been reached less frequently as targets, and then generating a message sequence that can reach or approach the target state based on the basic seed. The method proposed in the present invention fully utilizes the protocol state information and preserves the seed's state transition capability during the seed mutation process. Through state guidance and targeted message sequence generation, the efficiency and quality of network protocol fuzz testing are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network protocol vulnerability mining, and in particular to a network protocol fuzz testing method and device based on state guidance and seed mutation. Background Art

[0002] With the continuous development and application of modern networks, network architectures are becoming increasingly complex, with a wide variety of protocols covering a wide range of areas. As the foundation of data transmission and communication, the security of network protocols is directly related to the stability and security of the entire network system. However, malicious exploitation of vulnerabilities in network protocols can lead to serious consequences such as data leakage, service interruptions, and even system crashes. Therefore, detecting and remediating network protocol vulnerabilities has become a critical component of network security.

[0003] Currently, traditional network protocol vulnerability detection methods mainly include static analysis and dynamic analysis. Static analysis methods examine the code for potential vulnerabilities. Although they have wide coverage, they cannot detect runtime vulnerabilities. Dynamic analysis methods detect vulnerabilities by monitoring the program's running status. Although they can capture runtime anomalies, their detection costs are high and their efficiency is low. In addition, traditional vulnerability detection methods often rely on expert experience and manual operations, which are subject to high subjectivity and limitations, making them difficult to cope with complex and changing network protocol environments. Fuzz testing, as an effective vulnerability detection technology, triggers potential vulnerabilities by inputting random or semi-random data into the system under test. Compared with traditional methods, fuzz testing has the advantages of high automation and wide coverage, and can discover hidden vulnerabilities in programs in a relatively short time. However, existing fuzz testing technology still has some shortcomings in network protocol vulnerability detection.

[0004] Network protocols often have complex state machines and state transitions, and different states affect how the protocol processes input data. However, traditional fuzz testing techniques make poor use of this information, often relying solely on random or predefined test seeds while ignoring the impact of protocol state changes on vulnerability discovery. This approach results in an inability to effectively cover all protocol states during testing, particularly for deep-seated vulnerabilities that are only exposed in specific states. Furthermore, traditional fuzz testing methods often lack intelligent feedback mechanisms, making it impossible to adjust subsequent testing strategies based on abnormal behavior or partial results discovered during testing. This lack of goal-oriented testing not only wastes significant computing resources but can also miss important vulnerabilities. Especially when faced with complex network protocols and diverse attack surfaces, blind, random fuzz testing struggles to cover all potential vulnerability scenarios, resulting in low test coverage and vulnerability discovery rates. To address these issues, there is an urgent need for an efficient network protocol fuzz testing method. Summary of the Invention

[0005] In order to overcome the shortcomings of existing methods, the present invention proposes a network protocol fuzz testing method and device based on state guidance and seed mutation.

[0006] The technical solution adopted by the present invention to solve its technical problem is:

[0007] A first aspect of the present invention relates to a network protocol fuzz testing method based on state guidance and seed mutation, the method comprising the following steps:

[0008] 1) Constructing basic seeds: Based on the protocol message format in the official protocol RFC document, manually construct high-quality basic seeds for each state and map the seeds to each state.

[0009] 2) Fuzz testing: Input the message sequence into the target program for fuzz testing, interact with the target program and monitor the program status, obtain the protocol return status code and path coverage feedback.

[0010] 3) Seed mutation: Based on the protocol status code and path coverage feedback, seeds with high path coverage are selected for mutation to generate new seeds. The state transition function of the seeds is retained during the mutation process to reduce the number of invalid seeds.

[0011] 4) Generate a state-guided message sequence: Based on the current state and the returned protocol status code, select the target test state, prioritizing states that have never been reached or have been reached less frequently. After selecting a state, generate a message sequence that can reach or approach the target state based on the basic seed.

[0012] Furthermore, in step 1), constructing the basic seed includes the following steps:

[0013] Step 101: Based on the RFC documents and related technical specifications of the target protocol, the target protocol's message structure is thoroughly studied to understand the specific meaning of each protocol field, such as source IP, destination IP, checksum, etc. Each interaction process and state transition rules of the protocol are analyzed in detail.

[0014] In step 102, based on the information obtained from the protocol, a set of high-quality basic test seeds that meet the protocol specifications are manually constructed. These seeds should cover the main functions and common operation processes of the protocol to ensure their diversity and representativeness.

[0015] Step 103 maps each constructed basic test seed to its corresponding protocol state. In the specific code implementation, each seed's information is stored in a structure in the corresponding protocol message format. This structure also contains the protocol state code corresponding to the seed, recording the seed's current state and the next state that can be triggered in the current state. This step provides data support for subsequent state selection and message sequence generation.

[0016] Furthermore, in step 2), the fuzzy test includes the following steps:

[0017] Step 201: During the initial test, a number of base seeds are randomly selected and ordered to form a message sequence. The target program is executed, and the generated message sequence is input into the target program to initiate the fuzz testing process. For non-initial tests, a number of mutated seeds are used to form a message sequence for testing.

[0018] Step 202 monitors the protocol's state transitions and code coverage in real time during the fuzz test, recording the number of times each state is reached, as well as exceptions, errors, and crashes. The fuzz tester can determine the current protocol state through the returned status code for state transitions and state arrivals. Furthermore, before fuzz testing, the target program's source code is instrumented and compiled, with instrumentation performed at each node branch of the code. During the fuzz test, the instrumented code writes the target program's code coverage to shared memory, from which the fuzz tester continuously retrieves code coverage.

[0019] Step 203 records the results of each test in detail, including the input message sequence, the target program's response, and state transition information. These data provide a basis for subsequent feedback analysis and seed mutation.

[0020] In step 3, seed mutation includes the following steps:

[0021] Step 301: Analyze the paths covered by each seed during the test and select high-quality seeds based on the path coverage. A seed with a high coverage rate indicates that it can trigger more protocol states and code paths and has higher test value.

[0022] Step 302 mutates the selected seed to generate new test cases. Mutation operations include bit flipping, field replacement, random insertion, and deletion. The mutation process should preserve the seed's state transition capabilities to ensure continued state transitions and reduce invalid seed generation. When performing seed mutation, the fuzz tester divides the seed into a control segment and a data segment. The control segment retains the seed's state information and is not mutated; only the data segment is mutated. The bit flip mutation algorithm is specifically implemented as follows: Bit flipping operations include selecting from six flipping methods: 1-bit, 2-bit, 4-bit, 8-bit, 16-bit, and 32-bit. During mutation, one of these methods is randomly selected. A bit flip is then performed at a random location within the data segment address, changing the selected bit from 0 to 1 or from 1 to 0. The field replacement mutation algorithm is specifically implemented as follows: First, a replacement field is randomly generated. A replacement field is randomly selected from the data portion of the seed that triggers a crash or generates the highest code coverage, or a random value is generated as the replacement field. The original value of the target field is replaced with the selected replacement value, ensuring that the replaced seed retains protocol state information. The random insertion mutation algorithm is implemented as follows: First, a data field position in the target seed is randomly selected as the insertion address. A random data value is generated, or a field is selected using the same method as above. The data is inserted into the selected position, and the message format is adjusted to conform to the protocol specification. The deletion mutation algorithm is implemented as follows: First, a deletion position is selected. Based on the message format, one or more data segment addresses are selected as the deletion position. Next, a deletion range is selected. The size of the deleted data segment is randomly selected, ensuring that the message conforms to the protocol specification after deletion. Finally, the data is deleted and the message structure is adjusted. In practice, fuzz testers combine multiple mutation algorithms to increase the diversity and coverage of test cases. For example, bit flipping can be performed first, followed by field replacement, and then random data insertion. Each mutation strategy has a unique number, and several of these numbers are randomly selected as the mutation combination during the mutation process. By combining multiple mutation strategies, a more diverse range of test cases can be generated, further improving the coverage and vulnerability discovery capabilities of fuzz testing.

[0023] In step 4), the state guidance message sequence generation includes the following steps:

[0024] During the fuzz testing process, the code automatically constructs a state transition graph. Each node in the graph represents a unique state. Each node maintains a counter that records the number of times that state has been reached. The graph also records all possible state transitions. Based on the state monitoring results, states that have not been reached are prioritized for fuzz testing, followed by states with the fewest number of reaches. If all states of the current protocol have been reached, and the number of states with the fewest reaches is greater than one, a state with the fewest reaches is randomly selected as the next target state.

[0025] Step 402 divides the state into the current state, the intermediate state, and the target state. The current state is the protocol state returned by the fuzz tester during the previous test. The intermediate state is the state to be experienced from the current state to the target state, and the target state is the state selected for testing. After the target state is selected, a new test case is generated through a mutation algorithm based on the seed mapping information and the current protocol state information. The test cases are combined into a message sequence that can reach or approach the target state. The message sequence consists of a series of seeds that can reach the intermediate state and a seed that can reach or approach the target state. After the message sequence is generated, the sequence is handed over to the fuzz tester for testing.

[0026] The second aspect of the present invention relates to a network protocol fuzz testing device based on state guidance and seed mutation, comprising a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement a network protocol fuzz testing method based on state guidance and seed mutation of the present invention.

[0027] A third aspect of the present invention relates to a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the network protocol fuzz testing method based on state guidance and seed mutation of the present invention is implemented.

[0028] The technical concept of the present invention is to use the protocol status code feedback to obtain the current protocol status information, select more valuable states for fuzzy testing based on the current protocol status information, and then adopt an information-preserving mutation algorithm that retains the seed state conversion capability to generate higher quality test cases and reduce the generation of useless test cases.

[0029] The beneficial effects of the present invention are mainly manifested in: making full use of the protocol status information, selecting more valuable protocol states for testing, reducing the generation of invalid test cases, improving testing efficiency, and achieving higher detection speed and more crashes compared to previous more traditional fuzz testing methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1It is a flow chart of the method of the present invention.

[0031] Figure 2 It is an illustration of the state information retention variation method of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described below with reference to the accompanying drawings.

[0033] Example 1

[0034] Reference Figure 1 A network protocol fuzz testing method based on state guidance and seed mutation includes the following steps:

[0035] 1) Basic seed construction: Based on the protocol message format in the official protocol RFC document, manually construct high-quality basic seeds for each state and map the seeds to each state.

[0036] 2) Fuzz testing: Input the message sequence into the target program for fuzz testing, interact with the target program and monitor the program status, obtain the protocol return status code and path coverage feedback.

[0037] 3) Seed mutation: Based on the protocol status code and path coverage feedback, seeds with high path coverage are selected for mutation to generate new seeds. The state transition function of the seeds is retained during the mutation process to reduce the number of invalid seeds.

[0038] 4) State-guided message sequence generation: Based on the current state and the returned protocol status code, a target test state is selected, with preference given to states that have never been reached or have been reached less frequently. After a state is selected, a message sequence is generated based on the base seed to reach or approach the target state.

[0039] Furthermore, in step 1), the basic seed construction includes the following steps:

[0040] Step 101: Based on the RFC documents and related technical specifications of the target protocol, the target protocol's message structure is thoroughly studied to understand the specific meaning of each protocol field, such as source IP, destination IP, checksum, etc. Each interaction process and state transition rules of the protocol are analyzed in detail.

[0041] In step 102, based on the information obtained from the protocol, a set of high-quality basic test seeds that meet the protocol specifications are manually constructed. These seeds should cover the main functions and common operation processes of the protocol to ensure their diversity and representativeness.

[0042] Step 103 maps each constructed basic test seed to its corresponding protocol state. In the specific code implementation, each seed's information is stored in a structure in the corresponding protocol message format. This structure also contains the protocol state code corresponding to the seed, recording the seed's current state and the next state that can be triggered in the current state. This step provides data support for subsequent state selection and message sequence generation.

[0043] Furthermore, in step 2), the fuzzy test includes the following steps:

[0044] Step 201: During the initial test, a number of base seeds are randomly selected and ordered to form a message sequence. The target program is executed, and the generated message sequence is input into the target program to initiate the fuzz testing process. For non-initial tests, a number of mutated seeds are used to form a message sequence for testing.

[0045] Step 202 monitors the protocol's state transitions and code coverage in real time during the fuzz test, recording the number of times each state is reached, as well as exceptions, errors, and crashes. The fuzz tester can determine the current protocol state through the returned status code for state transitions and state arrivals. Furthermore, before fuzz testing, the target program's source code is instrumented and compiled, with instrumentation performed at each node branch of the code. During the fuzz test, the instrumented code writes the target program's code coverage to shared memory, from which the fuzz tester continuously retrieves code coverage.

[0046] Step 203 records the results of each test in detail, including the input message sequence, the target program's response, and state transition information. These data provide a basis for subsequent feedback analysis and seed mutation.

[0047] In step 3, seed mutation includes the following steps:

[0048] Step 301: Analyze the paths covered by each seed during the test and select high-quality seeds based on the path coverage. A seed with a high coverage rate indicates that it can trigger more protocol states and code paths and has higher test value.

[0049] Step 302: Mutate the selected seed to generate a new test case. Mutation operations include bit flipping, field replacement, random insertion and deletion, etc., and the state transition capability of the seed should be retained during the mutation process to ensure that the state transition can continue and reduce invalid seed generation. When performing seed mutation, the fuzz tester divides the seed into a control segment and a data segment. The control segment retains the state information of the seed and does not perform mutation operations. Only the data segment is mutated. Figure 2The bit-flip mutation algorithm is implemented as follows: The bit-flip operation includes six different flipping methods: 1-bit, 2-bit, 4-bit, 8-bit, 16-bit, and 32-bit. During mutation, one of these methods is randomly selected. A bit flip is then performed at a randomly selected location within the data segment address, changing the selected bit from 0 to 1 or 1 to 0. The field-replacement mutation algorithm is implemented as follows: First, a replacement field is randomly generated. A replacement field is randomly selected from the data portion of the seed that triggers a crash or generates the highest code coverage, or a random value is generated as the replacement field. The original value of the target field is replaced with the selected replacement value, ensuring that the replaced seed retains protocol state information. The random insertion mutation algorithm is implemented as follows: First, a data field location in the target seed is randomly selected as the insertion address. A random data value is generated, or a field is selected using the same method as above. The data is inserted into the selected location, and the message format is adjusted to conform to the protocol specification. The deletion mutation algorithm is implemented as follows: First, a deletion location is selected. Based on the message format, one or more data segment addresses are selected as deletion locations. Next, a deletion range is selected. The size of the deleted data segment is randomly selected, ensuring that the deleted message conforms to the protocol specification. Finally, the data is deleted and the message structure is adjusted. In practice, the fuzz tester will combine multiple mutation algorithms to increase the diversity and coverage of test cases. For example, it can first perform bit flipping, then field replacement, and then insert random data. Each mutation strategy has a unique number, and several of these numbers are randomly selected as the mutation combination during the mutation process. By combining multiple mutation strategies, a more diverse range of test cases can be generated, further improving the coverage and vulnerability discovery capabilities of fuzz testing.

[0050] In step 4), the state guidance message sequence generation includes the following steps:

[0051] During the fuzz testing process, the code automatically constructs a state transition graph. Each node in the graph represents a unique state. Each node maintains a counter that records the number of times that state has been reached. The graph also records all possible state transitions. Based on the state monitoring results, states that have not been reached are prioritized for fuzz testing, followed by states with the fewest number of reaches. If all states of the current protocol have been reached, and the number of states with the fewest reaches is greater than one, a state with the fewest reaches is randomly selected as the next target state.

[0052] Step 402: Divide the states into the current state M0, intermediate states Mi (where i = 1, 2, 3,..., and 0 < i < n), and the target state Mn. The current state is the protocol state returned by the last test on the fuzzer. The intermediate states are the states to be experienced from the current state to reach the target state, and the target state is the state selected for testing. After selecting the target state Mn, based on the mapping information of the seeds and the current protocol state information, new test cases are generated through a mutation algorithm, and the test cases are combined into a message sequence that can reach or approach the target state. The message sequence consists of a series of seeds that can reach the intermediate states and seeds that can reach or approach the target state. After generating the message sequence, the sequence is handed over to the fuzzer for testing.

[0053] The present invention utilizes the status code feedback of the protocol to obtain the status information of the current protocol, selects more valuable states for fuzz testing according to the current protocol status information, and secondly adopts an information-preserving mutation algorithm that retains the state transition ability of the seeds to generate higher-quality test cases and reduce the generation of useless test cases.

[0054] Embodiment 2

[0055] This embodiment relates to a network protocol fuzz testing device based on state guidance and seed mutation, including a memory and one or more processors. The memory stores executable code. When the one or more processors execute the executable code, it is used to implement the network protocol fuzz testing method of Embodiment 1 based on state guidance and seed mutation.

[0056] Embodiment 3

[0057] This embodiment relates to a computer-readable storage medium with a program stored thereon. When the program is executed by a processor, it implements the network protocol fuzz testing method of Embodiment 1 based on state guidance and seed mutation.

[0058] The method proposed by the present invention makes full use of the status information of the protocol and retains the state transition ability of the seeds during the seed mutation process. Through state guidance and targeted message sequence generation, the efficiency and quality of network protocol fuzz testing are improved.

[0059] The content described in the embodiments of this specification is only an enumeration of the implementation forms of the inventive concept. The protection scope of the present invention should not be regarded as limited to the specific forms stated in the embodiments. The protection scope of the present invention also extends to equivalent technical means that can be想到 by those skilled in the art based on the inventive concept of the present invention.

Claims

1. A network protocol fuzz testing method based on state guidance and seed mutation, characterized by: The specific steps are as follows: 1) Building the basic seeds: Manually build high-quality basic seeds for each state based on the protocol message format in the official protocol RFC document, and map the seeds to each state. 2) Fuzz testing: Input message sequences into the target program for fuzz testing, interact with the target program and monitor program status, obtain protocol return status codes and path coverage feedback; 3) Seed mutation: Based on the protocol status code and path coverage feedback, seeds with high path coverage are selected for mutation to generate new seeds. During the mutation process, the seed state transition function is retained to reduce the number of invalid seeds. When performing seed mutation, the fuzz tester divides the seed into a control segment and a data segment. The control segment retains the seed state information and does not undergo mutation operations. Only the data segment is mutated. Mutation operations include bit flipping, field replacement, random insertion, and deletion. 4) Generate state-guided message sequence: Select the target test state based on the current state and the returned protocol status code, giving priority to states that have not been reached or have been reached less frequently as the target. If all states of the current protocol have been reached, and the number of states with the least number of reaches is greater than 1, then randomly select a state with the least number of reaches as the next target state. After the state is selected, generate a message sequence that can reach or approach the target state based on the basic seed.

2. A network protocol fuzz testing method based on state guidance and seed mutation according to claim 1, characterized in that: The construction of the basic seed in step 1) specifically includes: Step 101: Based on the RFC document and related technical specifications of the target protocol, the message structure of the target protocol is studied in depth to understand the specific meaning of each field of the protocol; and each interaction process and state transition rules of the protocol are analyzed in detail. Step 102: Based on the information obtained from the protocol, manually construct a set of high-quality basic seeds that comply with the protocol specifications. These seeds should cover the main functions and common operation processes of the protocol to ensure their diversity and representativeness. Step 103 maps each constructed basic seed to the corresponding protocol state. In the specific code implementation, the information of each seed is stored in a structure in the corresponding protocol message format. The structure also contains the protocol state code corresponding to the seed, recording the current state of the seed and the next state that can be triggered in the current state. This step provides data support for subsequent state selection and message sequence generation.

3. The network protocol fuzz testing method based on state guidance and seed mutation according to claim 1, characterized in that: The fuzz testing in step 2) specifically includes: Step 201: During the first test, a number of base seeds are randomly selected to form a message sequence in a random order, the target program is executed, the generated message sequence is input into the target program, and the fuzz testing process is started; during non-first tests, a number of mutated seeds are used to form a message sequence for testing; Step 202: monitor the state transitions and code coverage of the protocol in real time during the fuzz test, and record the number of times each state is reached, the number of exceptions reported, and the crash. The fuzz tester uses the returned status code to learn the current protocol state for the state transitions and the number of times each state is reached. Before the fuzz test, the target program source code is instrumented and compiled, and instrumented at each node branch of the code. During the fuzz test, the instrumented code writes the target program code coverage to the shared memory, and the fuzz tester continuously obtains the code coverage from the shared memory. Step 203, record the results of each test in detail, including the input message sequence, the target program's response, and state transition information; these data provide a basis for subsequent feedback analysis and seed mutation.

4. The network protocol fuzz testing method based on state guidance and seed mutation according to claim 1, characterized in that: The seed mutation in step 3) specifically includes: Step 301: Analyze the paths covered by each seed during the test and select high-quality seeds based on the path coverage rate. A seed with a high coverage rate indicates that it can trigger more protocol states and code paths and has higher test value. Step 302, mutate the selected seed to generate a new test case; mutation operations include bit flipping, field replacement, random insertion and deletion, and the state transition capability of the seed should be retained during the mutation process to ensure that the state transition can continue and reduce invalid seed generation; when mutating the seed, the fuzz tester divides the seed into a control segment and a data segment, the control segment retains the state information of the seed and does not perform mutation operations, only the data segment is mutated; the specific implementation of the bit flip mutation algorithm is as follows: the bit flip operation includes selecting 1bit, 2bit, 4bit, 8bit, 16bit and 32bit 6 flipping methods, randomly selecting a flipping method during mutation, and then randomly selecting a position that does not exceed the data segment address for bit flipping, changing the selected bit from 0 to 1 or from 1 to 0; the field replacement mutation algorithm is specifically implemented as follows: first, randomly generate a replacement field, randomly select a replacement word from the data part of the seed that triggers the crash or causes the highest code coverage Segment, or generate a random value as the replacement field; replace the original value of the target field with the selected replacement value, ensuring that the replaced seed retains the protocol state information; the random insertion mutation algorithm is specifically implemented as follows: first, randomly select the data field position in the target seed as the insertion address, generate a random data value or use the same method to select a field as the insertion data, insert the data into the selected position, and adjust the message format to comply with the protocol specification; the deletion mutation algorithm is specifically implemented as follows: first, select the deletion position, and select one or more data segment addresses as the deletion position according to the message format; second, select the deletion range, and randomly select the size of the deleted data segment, but ensure that the message complies with the protocol specification after deletion; finally, delete the data and adjust the message structure; the fuzz tester combines the above-mentioned multiple mutation algorithms for combined mutation to increase the diversity and coverage of test cases; each mutation strategy has its own unique number, and several of the numbers will be randomly selected as the mutation combination during mutation; more diverse test cases are generated by combining multiple mutation strategies.

5. The network protocol fuzz testing method based on state guidance and seed mutation according to claim 1, characterized in that: The state guidance message sequence generation in step 4) includes: Step 401: During the fuzz testing process, the code automatically constructs a state transition graph. Each node in the graph represents a unique state. Each node maintains a counter that records the number of times the state has been reached. The graph also records all possible state transitions. Based on the state monitoring results, the state that has not been reached is prioritized for fuzz testing, followed by the state with the least number of times reached. If all states of the current protocol have been reached, and the number of states with the least number of times reached is greater than 1, a state with the least number of times reached is randomly selected as the next target state. Step 402, divide the state into the current state, the intermediate state and the target state; the current state is the protocol state returned by the fuzz tester in the last test, the intermediate state is the state to be experienced from the current state to the target state, and the target state is the state selected to be tested; after the target state is selected, a new test case is generated through a mutation algorithm based on the mapping information of the seed and the current protocol state information, and the test cases are combined into a message sequence that can reach or approach the target state; the message sequence consists of a series of seeds that can reach the intermediate state and a seed that can reach or approach the target state; after the message sequence is generated, the sequence is handed over to the fuzz tester for testing.

6. A network protocol fuzz testing device based on state guidance and seed mutation, characterized in that: It includes a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement a network protocol fuzz testing method based on state guidance and seed mutation as described in any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that A program is stored thereon, and when the program is executed by a processor, a network protocol fuzz testing method based on state guidance and seed mutation according to any one of claims 1 to 5 is implemented.

Images