Industrial control protocol-oriented universal fuzzy test capability evaluation system and method thereof

Abstract

The invention discloses a universal fuzzy test capability evaluation system and method for an industrial control protocol. The evaluation system comprises a source code judgment module used for judging whether a source code of a to-be-tested industrial control protocol is open or not; the instrumentation module is used for inserting a monitoring code at a set position of the to-be-tested industrial control protocol when a source code of the to-be-tested industrial control protocol is open so as to collect sensitive information generated in a fuzzy test process; the monitor module is used for reading the sensitive information, monitoring the system environment of the to-be-tested industrial control protocol, capturing the communication flow between the to-be-tested industrial control protocol and the fuzzy test tool, and analyzing the operation state of the to-be-tested industrial control protocol; and the evaluation information processing module is used for collecting sensitive information, a running state and a system environment, storing the sensitive information, the running state and the system environment in a structured format, displaying the collected information, storing dynamically-changed data in a log file, and generating a change diagram changing along with time for each dynamically-changed data after the fuzz test is completed.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a universal fuzzy testing capability evaluation system and method for industrial control protocols. Background Art

[0002] With the rapid development of information technology, Industrial Control Systems (ICS) have been widely used around the world. ICS is an integrated system used to monitor, manage and control industrial processes. It is indispensable in critical infrastructure and industrial sectors, ensuring the efficient operation and safety of industrial processes. Fuzz testing technology has now become a mainstream vulnerability mining method for industrial control protocols. It inputs a large amount of random or pseudo-random illegal and abnormal data into the target system to observe the system's response when processing these inputs, thereby discovering potential vulnerabilities.

[0003] In 2018, Klees et al. proposed a set of guidelines for evaluating fuzz testing capabilities for common programs: First, it is recommended to select a representative benchmark fuzzer as a comparison object and use a variety of different benchmark programs for evaluation. Second, when measuring performance, considering the inherent randomness of the fuzz testing process, it is necessary to confirm the validity of the results by conducting a sufficient number of repeated experiments and applying statistical tests. In addition, all configuration parameters (such as seed files and timeout settings) should be recorded in detail to support subsequent analysis and result reproduction.

[0004] This set of fuzz testing capability assessment guidelines for common programs standardizes the specific execution steps of fuzz testing capability assessment, but still relies on traditional indicators such as code coverage and the number of vulnerabilities found when evaluating fuzz testing capabilities. This single assessment method may lead to inaccurate evaluation results when facing complex industrial control protocol scenarios.

[0005] In 2024, Kim et al. proposed a set of targeted fuzz testing evaluation methods. First, they suggested clarifying the evaluation goals, such as locating specific vulnerabilities or code paths. Second, during the evaluation process, it is recommended to use multiple targeted fuzz testing tools for comparison to ensure the comprehensiveness of the evaluation results. The key indicators of the evaluation include the ability of the test tool to successfully reproduce known vulnerabilities and its performance on specific targets. In addition, the authors emphasized the importance of transparency in the evaluation process and required detailed documentation of all configuration parameters and decision details used so that subsequent research can repeat and verify the results. Following these methods, the reliability of the targeted fuzz testing evaluation results can be significantly improved.

[0006] Although this systematic evaluation method provides certain guidelines for directed fuzz testing, it also has some shortcomings. First, this method is mainly applicable to directed fuzzers, which may not be fully applicable to fuzzers specifically used to test industrial control protocols. Second, this method has not yet solved the problem of strong coupling between the evaluation component and the fuzzer, which means that the evaluation process may still be too dependent on specific fuzz testing frameworks or tool features, thus limiting the versatility of the evaluation method. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the general fuzzy testing capability evaluation system and method for industrial control protocols provided by the present invention solves the problem that the current evaluation protocol fuzz tester has a single indicator, resulting in inaccurate evaluation results.

[0008] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0009] In a first aspect, a general fuzzy testing capability evaluation system for industrial control protocols is provided, which includes:

[0010] A source code judgment module is used to judge whether the source code of the industrial control protocol to be tested is public, and send information on whether the source code is public to the plug-in module;

[0011] The stub module is used to insert monitoring code at a set position of the industrial control protocol to be tested when the source code of the industrial control protocol to be tested is made public, so as to collect sensitive information generated during the fuzz testing process, wherein the sensitive information includes at least code coverage, function call times, memory read and write times, and loop block number;

[0012] The monitor module is used to read the sensitive information collected by the plug-in module, monitor the system environment of the industrial control protocol to be tested, and use the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzz testing tool, and parse the running status of the industrial control protocol to be tested;

[0013] The evaluation information processing module is used to collect sensitive information, operating status and system environment, and save them in a structured format. The collected information is displayed on the terminal and the dynamically changing data is saved in a log file. After the fuzz test is completed, a change graph over time is generated for each dynamically changing data;

[0014] The source code judgment module is connected to the fuzz test tool and the plug-in module, the plug-in module is respectively connected to the fuzz test tool and the monitor module, and the monitor module is respectively connected to the fuzz test tool and the evaluation information processing module.

[0015] Furthermore, the monitoring code includes coverage-based stub code, function call-based stub code, memory read-write-based stub code and loop block-based stub code, which respectively obtain code coverage, function call times, memory read-write times and loop block number.

[0016] Furthermore, the method of obtaining the number of function calls using a stub code based on function calls includes:

[0017] According to the set of vulnerable functions, the entire compilation period of the industrial control protocol to be tested is traversed to identify the vulnerable functions in the set and mark them;

[0018] When the industrial control protocol under test calls a marked function during fuzz testing, the number of function calls is increased by one.

[0019] Furthermore, the method for obtaining the memory read and write times includes:

[0020] The LLVM framework is used to insert the stub code based on memory read and write into the basic block of the industrial control protocol to be tested;

[0021] A stub code based on memory read and write is used to traverse all instructions in the basic block, and the interface in the LLVM framework is used to determine whether each instruction involves memory read and write operations. When there is a read and write operation, the number of memory read and write operations is increased by one.

[0022] Furthermore, the method for obtaining the number of cycle blocks includes:

[0023] The LLVM framework is used to insert the loop block-based stub code into the CFG layer of the industrial control protocol to be tested;

[0024] A loop block-based stub code is used to traverse the control flow graph to detect all the back edges from one basic block to the previous basic block. When a back edge is detected, a counter is increased at the source basic block of the back edge.

[0025] During the fuzzy testing process, when the industrial control protocol to be tested is running, each time a cycle is performed, a counter is used to increase the number of cycle blocks by one.

[0026] Furthermore, the method of using the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzzy testing tool, and parsing the operating status of the industrial control protocol to be tested includes:

[0027] Use Wireshark or Pyshark to parse the industrial control protocol to be tested, and determine the specific location and structure of the status code in the industrial control protocol to be tested;

[0028] Design a regular expression based on the message format characteristics of the industrial control protocol to be tested;

[0029] The Scapy traffic library is used to capture real-time messages and parse the messages. Then, the status code is extracted through regular expression matching to obtain the running status of the industrial control protocol to be tested.

[0030] Furthermore, the regular expression is match=re.search(b'^.{1}(.{2}).

[0031] Furthermore, the system environment includes CPU usage and memory occupancy, and the CPU usage and memory occupancy of the industrial control protocol to be tested are collected by reading / proc / [pid] / stat and / proc / [pid] / status files provided by the operating system.

[0032] Furthermore, after the fuzzy test is completed, the evaluation information processing module also includes performing a comprehensive quantitative evaluation based on the collected information:

[0033] Select sensitive information, number of status codes and system environment from the collected information as evaluation indicators, where the system environment includes CPU occupancy and running memory occupancy;

[0034] Logarithmically normalize the branch coverage, function call count, memory read / write count, and loop block count:

[0035]

[0036] Where X is the number of branch coverage, function calls, memory reads and writes, or loop blocks; Z is M is the data after logarithmic normalization of X; min is a non-zero initial value of X; X max is the upper limit value that X can theoretically reach;

[0037] Normalize the number of status codes:

[0038]

[0039] Among them, Y z is the number of status codes; Z z For Y z Normalized data; Y zmin is the number of initial state codes; Y zmax The total number of status codes counted by program static analysis;

[0040] Normalize the CPU usage and running memory usage:

[0041]

[0042] Among them, Z XIt is the CPU usage or running memory usage; Z for the entire fuzz testing process X The average occupancy of Z Xmin and Z Xmax Z X The minimum and maximum values ​​of

[0043] The normalized evaluation index is marked as M i , and use weighted summation to obtain the final comprehensive quantitative evaluation result:

[0044]

[0045] Among them, Score is the comprehensive quantitative evaluation result; n is the total number of evaluation indicators; M i is the normalized evaluation index of the ith value; W i is the weight of the i-th normalized evaluation index.

[0046] In a second aspect, a method for a general fuzzy testing capability evaluation system for an industrial control protocol is provided, comprising the steps of:

[0047] S1. Obtain the industrial control protocol to be tested, and determine whether the source code of the industrial control protocol to be tested is public. If so, proceed to step S2, otherwise proceed to step S3;

[0048] S2, inserting the monitoring code for collecting sensitive information generated during the fuzzy test into the set position of the industrial control protocol to be tested, and then entering step S3;

[0049] S3, after the industrial control protocol to be tested is started, the monitor module connects to the industrial control protocol to be tested, and enters S4 when the industrial control protocol to be tested has a monitoring code inserted, and enters S5 when no monitoring code is inserted;

[0050] S4, collecting sensitive information generated during the fuzz test through monitoring code and writing it into shared memory; the monitor module reads the sub-table containing sensitive information records in the shared memory in real time, and summarizes the contents of the sub-table into the total table through comparison, and then enters step S5;

[0051] S5. Monitor the system environment of the industrial control protocol to be tested and use the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzzy testing tool, and parse the operating status of the industrial control protocol to be tested;

[0052] S6. Collect sensitive information, operating status and system environment, and save them in a structured format. Display the collected information on the terminal and save the dynamically changing data in a log file. After the fuzz test is completed, generate a time-varying change graph for each dynamically changing data.

[0053] Compared with the existing evaluation methods, the present invention has the following beneficial effects:

[0054] 1) Comprehensiveness of evaluation indicators is enhanced: Traditional fuzz testing capability evaluation mainly relies on single indicators such as coverage and number of vulnerabilities. This invention introduces more dimensional evaluation criteria, including security sensitive information (such as the number of function calls, memory read and write times), protocol state coverage, and system resource usage, making the evaluation process more comprehensive and accurate. This multi-dimensional evaluation system can better reflect fuzz testing capabilities.

[0055] 2) Improved versatility of the evaluation system: The evaluation system of the present invention is decoupled from the specific fuzzer and supports the unified evaluation of multiple fuzz testing tools, which makes the evaluation system have good scalability and versatility. Whether it is a black box fuzzer (such as Peach, BooFuzz) or a gray box fuzzer (such as AFLNET, AFLNWE), the system can adapt to it, avoiding the limitations brought by the tight coupling of the traditional evaluation system and the fuzzer. This design significantly improves the versatility of the system and can adapt to the needs of different protocols and fuzz testing tools.

[0056] 3) Improved accuracy of evaluation results: The present invention introduces a comprehensive quantitative evaluation strategy, combining multi-dimensional evaluation indicators such as branch coverage, number of security-sensitive function calls, number of memory reads and writes, number of loop blocks, number of state codes, CPU occupancy, and running memory occupancy to comprehensively reflect the performance of the fuzzifier. By performing differentiated standardization on each indicator and using a weighted summation method to calculate the final comprehensive score, the evaluation results can not only reflect the performance of the fuzzifier in all aspects, but also effectively avoid the one-sidedness caused by a single indicator. This comprehensive scoring mechanism significantly improves the accuracy of the evaluation results, allowing the performance of the fuzz testing tool to be quantified more accurately and objectively. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is the principle block diagram of the general fuzz testing capability evaluation system for industrial control protocols.

[0058] Figure 2 This is an example diagram of a loop block.

[0059] Figure 3 Flowchart of a general fuzz testing capability evaluation method for industrial control protocols. DETAILED DESCRIPTION

[0060] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0061] like Figure 1 As shown, the general fuzzy testing capability evaluation system for industrial control protocols provided by this solution includes a source code judgment module, a plug-in module, a monitor module and an evaluation information processing module; wherein the source code judgment module is used to judge whether the source code of the industrial control protocol to be tested is public, and send the information of whether the source code is public to the plug-in module.

[0062] The stub module is used to insert monitoring code at a set position of the industrial control protocol to be tested when the source code of the industrial control protocol to be tested is made public, so as to collect sensitive information generated during the fuzz testing process, wherein the sensitive information includes at least code coverage, number of function calls, number of memory reads and writes, and number of loop blocks.

[0063] The monitor module is used to read the sensitive information collected by the plug-in module, monitor the system environment of the industrial control protocol to be tested, use the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzz testing tool, and parse the running status of the industrial control protocol to be tested.

[0064] The evaluation information processing module is one of the core components of the entire architecture. It is responsible for summarizing all evaluation information collected from the plug-in module and the monitor module, and performing relevant processing on them. Specifically, it collects sensitive information, operating status and system environment, and saves them in a structured format. The collected information is displayed on the terminal, allowing the tester to understand the specific status of the program under test during the fuzz test at any time. In addition, this module can not only display the indicator changes of the evaluation information in real time, but also save the dynamically changing data in the relevant log files. After the fuzz test is completed, a time-varying change graph is generated for each dynamically changing data. Specifically, the built-in drawing widget of this module can draw a graph based on the log file that records the data with one click, and then generate a graph of the changes in various evaluation indicators over time that can reflect the capabilities of the protocol fuzzer.

[0065] The source code judgment module is connected to the fuzz test tool and the plug-in module, the plug-in module is respectively connected to the fuzz test tool and the monitor module, and the monitor module is respectively connected to the fuzz test tool and the evaluation information processing module.

[0066] During implementation, the monitoring code preferably includes coverage-based stub code, function call-based stub code, memory read-write-based stub code, and loop block-based stub code, which respectively obtain code coverage, function call times, memory read-write times, and loop block number.

[0067] The method of obtaining the number of function calls by using a stub code based on function calls includes: according to a set of vulnerable functions, traversing the program of the entire compilation period of the industrial control protocol to be tested to identify the vulnerable functions in the set and mark them; when the industrial control protocol to be tested calls the marked function during fuzz testing, the number of function calls is increased by one.

[0068] Vulnerable functions include memcpy (for memory copying), malloc (dynamic memory allocation), socket (interface for network communication), etc. By tracking the calls of these functions, the instrumentation module can help detect whether there are excessive or abnormal function calls, thereby evaluating their potential security issues. For example, if the memcpy function is called multiple times, it may indicate that the program has a buffer overflow risk.

[0069] During implementation, the method for obtaining the number of memory read and write times in this scheme preferably includes: using the LLVM framework to insert a stub code based on memory read and write into the basic block of the industrial control protocol to be tested; using the stub code based on memory read and write to traverse all instructions in the basic block, and using the interface in the LLVM framework to determine whether each instruction involves a memory read and write operation, and when a read and write operation exists, the number of memory read and write times is increased by one.

[0070] Monitoring memory read and write counts can help developers identify memory usage when a program processes complex protocol data and detect potential vulnerabilities, such as buffer overflows or out-of-bounds accesses.

[0071] In one embodiment of the present invention, the method for obtaining the number of cyclic blocks includes:

[0072] The LLVM framework is used to insert the loop block-based stub code into the CFG layer of the industrial control protocol to be tested;

[0073] A loop block-based stub code is used to traverse the control flow graph to detect all the back edges from one basic block to the previous basic block. When a back edge is detected, a counter is increased at the source basic block of the back edge.

[0074] During the fuzzy testing process, when the industrial control protocol to be tested is running, each time a cycle is performed, a counter is used to increase the number of cycle blocks by one.

[0075] By counting the number of loop blocks, we can count the complexity of the loop structure in the program and then evaluate whether the program is susceptible to vulnerabilities caused by improper control of loop conditions, such as dead loops, resource exhaustion, etc. Complex loop structures may increase the attack surface of the program, so tracking the number of loop blocks is crucial for security assessment.

[0076] In order to facilitate the understanding of the loop block, this solution gives a schematic diagram of a loop block. For details, please refer to Figure 2 ,exist Figure 2 Each number in the figure represents a basic block. There is a back edge from basic block 4 to 1, thus forming a loop block, which is the structure in the dotted box on the left.

[0077] During implementation, the present solution preferably uses the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzzy testing tool, and the method for parsing the operating status of the industrial control protocol to be tested includes:

[0078] Use Wireshark or Pyshark to parse the industrial control protocol to be tested, and determine the specific location and structure of the status code in the industrial control protocol to be tested;

[0079] According to the message format characteristics of the industrial control protocol to be tested, a regular expression is designed; the regular expression is match=re.search(b'^.{1}(.{2}).

[0080] The Scapy traffic library is used to capture real-time messages and parse the messages. Then, the status code is extracted through regular expression matching to obtain the running status of the industrial control protocol to be tested.

[0081] The system environment includes CPU usage and memory usage. The CPU usage and memory usage of the industrial control protocol to be tested are collected by reading the / proc / [pid] / stat and / proc / [pid] / status files provided by the operating system. Since the industrial control protocol program can directly control the real industrial control equipment, it is possible to determine whether the program is abnormal by monitoring the environmental information.

[0082] After the fuzz test is completed, the evaluation information processing module of this solution can also complete a comprehensive quantitative evaluation based on several recorded evaluation indicators through a set evaluation strategy, and then produce a specific fuzzy capability evaluation report to help users gain a deeper understanding of the testing capabilities of the protocol fuzzer.

[0083] During implementation, the detailed implementation method for comprehensive quantitative evaluation based on the collected information is as follows:

[0084] Select sensitive information, number of status codes and system environment from the collected information as evaluation indicators, where the system environment includes CPU occupancy and running memory occupancy;

[0085] Logarithmically normalize the branch coverage, function call count, memory read / write count, and loop block count:

[0086]

[0087] Where X is the number of branch coverage, function calls, memory reads and writes, or loop blocks; Z is M is the data after logarithmic normalization of X; min is a non-zero initial value of X; X max is the upper limit value that X can theoretically reach;

[0088] Normalize the number of status codes:

[0089]

[0090] Among them, Y z is the number of status codes; Z z For Y z Normalized data; Y zmin is the number of initial state codes; Y zmax The total number of status codes counted by program static analysis;

[0091] Normalize the CPU usage and running memory usage:

[0092]

[0093] Among them, Z X It is the CPU usage or running memory usage; Z for the entire fuzz testing process X The average occupancy of Z Xmin and Z Xmax Z X The minimum and maximum values ​​of

[0094] The normalized evaluation index is marked as M i , and use weighted summation to obtain the final comprehensive quantitative evaluation result:

[0095]

[0096] Among them, Score is the comprehensive quantitative evaluation result; n is the total number of evaluation indicators; M i is the normalized evaluation index of the ith value; W i is the weight of the i-th normalized evaluation index.

[0097] The industrial control protocol to be tested mentioned in this solution is the target of fuzz testing. Before fuzz testing, the industrial control protocol to be tested needs to be instrumented during compilation to ensure that sufficient coverage information can be collected during the fuzz testing process. The industrial control protocol to be tested interacts with the monitor module through a network link, and feeds back its execution status, crash information, system resource usage and other information to the monitor module. In addition, the status code and state transition information of the program to be tested will be captured by the monitor module and transmitted to the evaluation information processing module to evaluate the fuzzer's coverage of the protocol status.

[0098] This solution achieves a comprehensive evaluation of industrial control protocol fuzz testing tools through the collaborative work of various modules of the evaluation system. The evaluation system can not only provide traditional coverage and vulnerability number evaluation, but also provide more detailed evaluation dimensions by monitoring protocol status and system resources. The independence and versatility of the system enable it to adapt to different types of fuzzers and protocols, providing strong support for the selection and optimization of fuzz testing tools.

[0099] refer to Figure 3 , which shows a flowchart of a general fuzzy testing capability evaluation method for industrial control protocols; Figure 3 Said method S comprises steps S1 to S6.

[0100] In step S1, the industrial control protocol to be tested is obtained, and it is determined whether the source code of the industrial control protocol to be tested is public. If so, step S2 is performed, otherwise, step S3 is performed;

[0101] In step S2, a monitoring code for collecting sensitive information generated during the fuzz test is inserted at a set position of the industrial control protocol to be tested. Specifically, the stub module inserts monitoring codes in the basic blocks or specific positions of the program during the compilation of the source code. These monitoring codes will be used to collect security-sensitive information during program runtime, such as the number of function calls, memory read and write operations, and the number of loop block triggers, etc., and then proceed to step S3;

[0102] In step S3, after the industrial control protocol to be tested is started, the monitor module connects to the industrial control protocol to be tested, and after using the selected fuzzer BooFuzz ​​to perform fuzz testing on the program to be tested (the industrial control protocol to be tested after being inserted), it starts to monitor the fuzz capability evaluation indicators of each protocol of the program to be tested, and enters S4 when the industrial control protocol to be tested has a monitoring code inserted, and enters S5 when the monitoring code is not inserted;

[0103] In step S4, the sensitive information generated during the fuzz test is collected by monitoring the code and written into the shared memory; the monitor module reads the sub-table containing sensitive information records in the shared memory in real time, and summarizes the contents of the sub-table into the total table by comparison, and then enters step S5;

[0104] In step S5, the system environment of the industrial control protocol to be tested is monitored, and the communication traffic between the industrial control protocol to be tested and the fuzzy testing tool is captured using the SCAPY traffic library, and the running status of the industrial control protocol to be tested is parsed;

[0105] In step S6, sensitive information, operating status, and system environment are collected and saved in a structured format to ensure that they can be quickly called and analyzed in subsequent fuzzer comparison and analysis. The collected information is displayed on the terminal and the dynamically changing data is saved in the log file. After the fuzz test is completed, the user can use the built-in drawing widget in the evaluation information processing module to convert these process data into a visual evaluation result chart through one-click operation.

[0106] To sum up, the evaluation system of this solution uses the monitoring code inserted by the plug-in module and the information obtained by the monitor module as evaluation indicators, which solves the problem of inaccurate evaluation due to the single evaluation indicator in the existing evaluation system, comprehensively improves the evaluation capability of fuzz testing, and fills the shortcomings of the existing technology.

[0107] The evaluation system of this scheme realizes the decoupling of the evaluation component and the fuzzer through an independent monitor module. It has good scalability and can adapt to the evaluation needs of different fuzzers and protocols.

Claims

1. A general fuzz testing capability evaluation system for industrial control protocols, characterized by: include: A source code judgment module is used to judge whether the source code of the industrial control protocol to be tested is public, and send information on whether the source code is public to the plug-in module; The stub module is used to insert monitoring code at a set position of the industrial control protocol to be tested when the source code of the industrial control protocol to be tested is made public, so as to collect sensitive information generated during the fuzz testing process, wherein the sensitive information includes at least code coverage, function call times, memory read and write times, and loop block number; The monitor module is used to read the sensitive information collected by the plug-in module, monitor the system environment of the industrial control protocol to be tested, and use the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzz testing tool, and parse the running status of the industrial control protocol to be tested; The evaluation information processing module is used to collect sensitive information, operating status and system environment, and save them in a structured format. The collected information is displayed on the terminal and the dynamically changing data is saved in a log file. After the fuzz test is completed, a change graph over time is generated for each dynamically changing data; The source code judgment module is connected to the fuzz test tool and the plug-in module, the plug-in module is respectively connected to the fuzz test tool and the monitor module, and the monitor module is respectively connected to the fuzz test tool and the evaluation information processing module.

2. The general fuzz testing capability evaluation system for industrial control protocols according to claim 1 is characterized in that: The monitoring code includes coverage-based pile code, function call-based pile code, memory read-write-based pile code and loop block-based pile code, which respectively obtain code coverage, function call times, memory read-write times and loop block number.

3. The general fuzz testing capability evaluation system for industrial control protocols according to claim 2 is characterized in that: Methods for obtaining the number of function calls using stub codes based on function calls include: According to the set of vulnerable functions, the entire compilation period of the industrial control protocol to be tested is traversed to identify the vulnerable functions in the set and mark them; When the industrial control protocol under test calls a marked function during fuzz testing, the number of function calls is increased by one.

4. The general fuzz testing capability evaluation system for industrial control protocols according to claim 2 is characterized in that: The method for obtaining the memory read and write times includes: The LLVM framework is used to insert the stub code based on memory read and write into the basic block of the industrial control protocol to be tested; A stub code based on memory read and write is used to traverse all instructions in the basic block, and the interface in the LLVM framework is used to determine whether each instruction involves memory read and write operations. When there is a read and write operation, the number of memory read and write operations is increased by one.

5. The general fuzz testing capability evaluation system for industrial control protocols according to claim 2 is characterized in that: Methods for obtaining the number of loop blocks include: The LLVM framework is used to insert the loop block-based stub code into the CFG layer of the industrial control protocol to be tested; A loop block-based stub code is used to traverse the control flow graph to detect all the back edges from one basic block to the previous basic block. When a back edge is detected, a counter is increased at the source basic block of the back edge. During the fuzzy testing process, when the industrial control protocol to be tested is running, each time a cycle is performed, a counter is used to increase the number of cycle blocks by one.

6. The general fuzzy testing capability evaluation system for industrial control protocols according to claim 1, characterized in that: The method of using the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzz testing tool, and parsing the operating status of the industrial control protocol to be tested includes: Use Wireshark or Pyshark to parse the industrial control protocol to be tested, and determine the specific location and structure of the status code in the industrial control protocol to be tested; Design a regular expression based on the message format characteristics of the industrial control protocol to be tested; The Scapy traffic library is used to capture real-time messages and parse the messages. Then, the status code is extracted through regular expression matching to obtain the running status of the industrial control protocol to be tested.

7. The general fuzz testing capability evaluation system for industrial control protocols according to claim 6 is characterized in that: The regular expression is match=re.search(b'^.{1}(.{2}).

8. The general fuzz testing capability evaluation system for industrial control protocols according to claim 7 is characterized in that: The system environment includes CPU usage and memory occupancy, and the CPU usage and memory occupancy of the industrial control protocol to be tested are collected by reading the / proc / [pid] / stat and / proc / [pid] / status files provided by the operating system.

9. The general fuzzy testing capability evaluation system for industrial control protocols according to any one of claims 1 to 7, characterized in that: After the fuzz test is completed, the evaluation information processing module also includes performing a comprehensive quantitative evaluation based on the collected information: Select sensitive information, number of status codes and system environment from the collected information as evaluation indicators, where the system environment includes CPU occupancy and running memory occupancy; Logarithmically normalize the branch coverage, function call count, memory read / write count, and loop block count: Where X is the number of branch coverage, function calls, memory reads and writes, or loop blocks; Z is M is the data after logarithmic normalization of X; min is a non-zero initial value of X; X max is the upper limit value that X can theoretically reach; Normalize the number of status codes: Among them, Y z is the number of status codes; Z z For Y z Normalized data; Y zmin is the number of initial state codes; Y zmax The total number of status codes counted by program static analysis; Normalize the CPU usage and running memory usage: Among them, Z X It is the CPU usage or running memory usage; Z for the entire fuzz testing process X The average occupancy of Z Xmin and Z Xmax Z X The minimum and maximum values ​​of The normalized evaluation index is marked as M i , and use weighted summation to obtain the final comprehensive quantitative evaluation result: Among them, Score is the comprehensive quantitative evaluation result; n is the total number of evaluation indicators; M i is the normalized evaluation index of the ith value; W i is the weight of the i-th normalized evaluation index.

10. A method for applying the universal fuzzy testing capability evaluation system for industrial control protocols as described in any one of claims 1 to 9, characterized in that: Includes steps: S1. Obtain the industrial control protocol to be tested, and determine whether the source code of the industrial control protocol to be tested is public. If so, proceed to step S2, otherwise proceed to step S3; S2, inserting the monitoring code for collecting sensitive information generated during the fuzzy test into the set position of the industrial control protocol to be tested, and then entering step S3; S3, after the industrial control protocol to be tested is started, the monitor module connects to the industrial control protocol to be tested, and enters S4 when the industrial control protocol to be tested has a monitoring code inserted, and enters S5 when no monitoring code is inserted; S4, collecting sensitive information generated during the fuzz test through monitoring code and writing it into shared memory; the monitor module reads the sub-table containing sensitive information records in the shared memory in real time, and summarizes the contents of the sub-table into the total table through comparison, and then enters step S5; S5. Monitor the system environment of the industrial control protocol to be tested and use the SCAPY traffic library to capture the communication traffic between the industrial control protocol to be tested and the fuzzy testing tool, and parse the operating status of the industrial control protocol to be tested; S6. Collect sensitive information, operating status and system environment, and save them in a structured format. Display the collected information on the terminal and save the dynamically changing data in a log file. After the fuzz test is completed, generate a time-varying change graph for each dynamically changing data.

Images