Network protocol format reasoning method guided by protocol fuzz test
By capturing and separating the packet sequence of the target protocol in the reverse analysis of the protocol, combining multiple analysis tools and fuzzy testing guidance mechanisms, cyclically feedback optimization of segmentation results, the problem of low efficiency and accuracy of protocol field cutting in the existing technology is solved. Achieve more efficient and accurate protocol format inference.
Patent Information
- Application Number
- CN202411684676.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-02-18
AI Technical Summary
Existing protocol reverse analysis techniques have problems with efficiency and accuracy when cutting protocol fields, especially when facing unknown protocols and variable length fields, it is difficult to accurately judge field boundaries and semantic understanding.
By capturing the traffic of the target system, filtering and separating the message sequence of the target protocol, using multiple protocol reverse analysis tools and segmentation strategies for field segmentation, combining the fuzzy test boot mechanism, loop feedback to optimize the segmentation results until the optimal segmentation result is obtained.
It improves the accuracy of protocol reverse field cutting and the efficiency and accuracy of protocol format inference, overcomes the limitations of traditional one-way processes, and enhances the accuracy and depth of protocol parsing.
Smart Images
Figure CN119484367A_ABST
Abstract
Description
Technical Field
[0001] The disclosed embodiments relate to the field of data processing technology, and in particular to a network protocol format reasoning method guided by protocol fuzzy testing. Background Art
[0002] At present, protocol reverse engineering refers to the technology of extracting protocol grammar and interaction process from the network input and output, system behavior and instruction execution process of protocol entities in the absence of public protocol specifications. This technology originated in the 1950s and developed rapidly after 1990 with the development of software and network technology. Protocol reverse engineering is widely used in network intrusion detection systems, deep packet inspection, fuzz testing, botnet detection, software system integration and other fields.
[0003] However, there are some problems with protocol reverse analysis technology when cutting fields. First, the protocol contains multiple types of data, both binary data and text data, which makes it impossible for reverse engineers to simply rely on traditional text-based matching methods to identify fields. The designers of the protocol also cleverly use different byte sequences to represent the same information, thereby weakening the effectiveness of traditional matching techniques based on byte sequence similarity. Second, when trying to divide the field boundaries, it was found that there were no obvious delimiters between the fields of the protocol. This means that in the absence of contextual information, it is difficult to accurately determine when a field starts and ends. Especially in the face of completely unknown protocols, this uncertainty makes it extremely difficult to determine the cutting position. In addition, the messages of the protocol show great diversity in different scenarios, including changes in field length and the existence of optional options. This requires reverse tools to not only be able to adapt to these changes, but also to be able to distinguish between constant fields and variable fields in a dynamic environment. However, existing reverse tools generally have defects in dealing with these requirements. Even when the fields can be cut out correctly, there will be difficulties in semantic understanding. For example, the meaning of some fields is only reflected in specific application scenarios, and the lack of contextual information makes it difficult for the team to accurately infer the actual use of these fields. Finally, for those fields with variable lengths, existing methods often have difficulty in properly handling their changes. If used improperly, it may lead to errors in the cutting results, further affecting the accuracy and reliability of reverse analysis.
[0004] It can be seen that there is an urgent need for a network protocol format reasoning method guided by protocol fuzz testing with high reasoning efficiency and accuracy. Summary of the invention
[0005] In view of this, an embodiment of the present disclosure provides a network protocol format reasoning method guided by protocol fuzzy testing, which at least partially solves the problem of poor reasoning efficiency and accuracy in the prior art.
[0006] The present disclosure provides a network protocol format reasoning method guided by protocol fuzzy testing, including:
[0007] Step 1: Capture the traffic of the target system and filter it to identify and separate the message sequence of the target protocol;
[0008] Step 2, performing field segmentation on the message sequence to obtain a segmentation result;
[0009] Step 3, inferring the protocol format based on the segmentation results;
[0010] Step 4, construct an input data packet according to the inferred protocol format and send it to the server for format verification;
[0011] Step 5: When the format verification passes, a fuzzy test is guided by a loop feedback according to the segmentation result corresponding to the inferred protocol format until the optimal segmentation result is obtained.
[0012] According to a specific implementation of the embodiment of the present disclosure, step 1 specifically includes:
[0013] Step 1.1, use the preset tool to capture all traffic of the target system on the network;
[0014] Step 1.2, after the capture is completed, the data packets corresponding to all flows are filtered to identify and separate the message sequence of the target protocol.
[0015] According to a specific implementation of the embodiment of the present disclosure, step 2 specifically includes:
[0016] A variety of protocol reverse analysis tools and different segmentation strategies are used to segment the message sequence into fields and generate multiple segmentation results.
[0017] According to a specific implementation of the embodiment of the present disclosure, step 3 specifically includes:
[0018] Based on the segmentation results, the protocol format is logically inferred and determined, and a variety of protocol format inferences are generated by combining the structural characteristics and communication rules of the target protocol.
[0019] According to a specific implementation of the embodiment of the present disclosure, step 4 specifically includes:
[0020] Step 4.1, construct the corresponding input data packet according to each inferred protocol format;
[0021] Step 4.2, use the fuzz testing tool as the client, send all input data packets to the server, and obtain the server's processing results as feedback information. If the processing result is that the server refuses to receive the input data packet, return to step 2 and re-segment the fields according to the feedback information. If the processing result is that the server receives the input data packet, execute the subsequent steps.
[0022] According to a specific implementation of the embodiment of the present disclosure, step 5 specifically includes:
[0023] The fuzz testing tool is used to mutate each field in the segmentation result corresponding to the inferred protocol format one by one, and then the mutated data packet is guided by the fuzz testing with loop feedback until the optimal segmentation result is obtained.
[0024] According to a specific implementation of the embodiment of the present disclosure, the step of guiding the fuzzy test of loop feedback on the mutated data packet until the optimal segmentation result is obtained includes:
[0025] Step 5.1, perform fuzzy testing on the mutated data packet to obtain the test result of the current round;
[0026] Step 5.2, determine whether the coverage between the test results of the current round and the test results of the previous round is improved, if so, execute step 5.3, if not, execute step 5.4;
[0027] Step 5.3, return to step 2 and re-segment the field according to the feedback information corresponding to the current round;
[0028] Step 5.4, take the segmentation result corresponding to the current round as the optimal segmentation result and stop the fuzzy test.
[0029] The network protocol format inference scheme guided by the protocol fuzzy test in the embodiment of the present disclosure includes: step 1, capturing the traffic of the target system and filtering it, identifying and separating the message sequence of the target protocol; step 2, field segmenting the message sequence to obtain the segmentation result; step 3, inferring the protocol format according to the segmentation result; step 4, constructing the input data packet according to the inferred protocol format and sending it to the server for format verification; step 5, when the format verification passes, performing a fuzzy test guidance with loop feedback according to the segmentation result corresponding to the inferred protocol format until the optimal segmentation result is obtained.
[0030] The beneficial effects of the embodiments of the present disclosure are as follows: through the scheme of the present disclosure, the fuzzy test input is generated through the protocol format inference result, and then the fuzzy test result is used to guide and improve the protocol format inference process, and a loop feedback optimization mechanism is introduced, that is, the result of each round of fuzzy testing can be used to correct the result of protocol format inference. This feedback loop can gradually improve the accuracy and depth of protocol parsing, overcome the limitations of traditional one-way processes, and this method can improve the accuracy of protocol reverse field cutting, thereby improving the efficiency and accuracy of protocol format inference. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0032] Figure 1 A flowchart of a network protocol format reasoning method guided by a protocol fuzzy test provided in an embodiment of the present disclosure;
[0033] Figure 2 A flowchart of an existing reasoning method provided in an embodiment of the present disclosure;
[0034] Figure 3 A schematic diagram of a specific implementation process of a network protocol format reasoning method guided by a protocol fuzzy test provided in an embodiment of the present disclosure;
[0035] Figure 4 An overall framework diagram of a network protocol format reasoning method guided by a protocol fuzzy test provided in an embodiment of the present disclosure;
[0036] Figure 5 A specific scheme framework diagram of a network protocol format reasoning method guided by a protocol fuzzy test provided in an embodiment of the present disclosure. DETAILED DESCRIPTION
[0037] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.
[0038] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.
[0039] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.
[0040] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.
[0041] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.
[0042] The embodiment of the present disclosure provides a network protocol format reasoning method guided by protocol fuzz testing, which can be applied to the fuzz testing process in Internet scenarios.
[0043] See also Figure 1 , is a flowchart of a network protocol format inference method guided by a protocol fuzzy test provided by an embodiment of the present disclosure. Figure 1 As shown, the method mainly comprises the following steps:
[0044] Step 1: Capture the traffic of the target system and filter it to identify and separate the message sequence of the target protocol;
[0045] Furthermore, the step 1 specifically includes:
[0046] Step 1.1, use the preset tool to capture all traffic of the target system on the network;
[0047] Step 1.2, after the capture is completed, the data packets corresponding to all flows are filtered to identify and separate the message sequence of the target protocol.
[0048] like Figure 2 As shown in the figure, traditional protocol format inference relies more on static analysis, that is, extracting protocol structures from known packets or implementations. Traditional flow-based protocol reverse segmentation of fields relies on references to known protocols. There are many uncertainties in segmenting fields for unknown protocols, resulting in low field parsing accuracy and inaccurate inferred protocol formats.
[0049] Fuzz testing provides a dynamic analysis perspective, that is, observing the real response of the protocol through runtime behavior. Combining the two makes the protocol format inference process not only limited to surface information, but also deep into the behavioral logic level of the protocol.
[0050] When implementing it, Figure 3 , Figure 4 and Figure 5 As shown, the specific process of the method disclosed in the present invention can be as follows:
[0051] In the traffic capture phase, use tools such as Wi reshark to capture all relevant traffic of the target system on the network, and ensure that the captured traffic covers all operation conditions of the protocol, including normal requests and responses, etc. After the capture is completed, filter all data packets to identify and separate the message sequence of the target protocol.
[0052] Step 2, performing field segmentation on the message sequence to obtain a segmentation result;
[0053] Based on the above embodiment, step 2 specifically includes:
[0054] A variety of protocol reverse analysis tools and different segmentation strategies are used to segment the message sequence into fields and generate multiple segmentation results.
[0055] In the specific implementation, at the field segmentation stage, the method disclosed in the present invention uses a variety of protocol reverse analysis tools to achieve fine segmentation of data fields. Different analysis tools implement different field processing technologies based on their unique algorithms and subdivisions, resulting in different field segmentation strategies. Through this process, each tool splits the field in a unique way, and finally produces diversified segmentation results.
[0056] Step 3, inferring the protocol format based on the segmentation results;
[0057] Furthermore, the step 3 specifically includes:
[0058] Based on the segmentation results, the protocol format is logically inferred and determined, and a variety of protocol format inferences are generated by combining the structural characteristics and communication rules of the target protocol.
[0059] In the specific implementation, the protocol format inference stage. Based on the results of field segmentation, the protocol format is logically inferred and determined. Through a detailed analysis of the segmented fields, combined with the structural characteristics and communication rules of the protocol, this solution achieves a systematic inference of the protocol format. This process involves an in-depth understanding of the relationship between fields and an accurate interpretation of the protocol semantics, which in turn generates a variety of possible protocol format hypotheses.
[0060] Step 4, construct an input data packet according to the inferred protocol format and send it to the server for format verification;
[0061] Based on the above embodiment, step 4 specifically includes:
[0062] Step 4.1, construct the corresponding input data packet according to each inferred protocol format;
[0063] Step 4.2, use the fuzz testing tool as the client, send all input data packets to the server, and obtain the server's processing results as feedback information. If the processing result is that the server refuses to receive the input data packet, return to step 2 and re-segment the fields according to the feedback information. If the processing result is that the server receives the input data packet, execute the subsequent steps.
[0064] In the specific implementation, the protocol format verification phase. Based on the previously inferred protocol format, an input data packet dedicated to protocol fuzz testing is constructed. In this phase, the fuzz testing tool acts as a client and sends these constructed data packets to the target server. The server's processing results of these data packets will serve as key feedback information.
[0065] If the server refuses to receive the data packet, it indicates that there is an error in the field segmentation position of the reverse tool. Then you can return to step 2 and use this feedback information to guide the field segmentation and make necessary adjustments and optimizations to the field segmentation position.
[0066] If the server successfully receives the data packet, it indicates that the reverse tool field segmentation position is correct, and then the subsequent steps are executed.
[0067] Step 5: When the format verification passes, a fuzzy test is guided by a loop feedback according to the segmentation result corresponding to the inferred protocol format until the optimal segmentation result is obtained.
[0068] Based on the above embodiment, step 5 specifically includes:
[0069] The fuzz testing tool is used to mutate each field in the segmentation result corresponding to the inferred protocol format one by one, and then the mutated data packet is guided by the fuzz testing with loop feedback until the optimal segmentation result is obtained.
[0070] Furthermore, the step of guiding the fuzzy test of loop feedback on the mutated data packet until the optimal segmentation result is obtained includes:
[0071] Step 5.1, perform fuzzy testing on the mutated data packet to obtain the test result of the current round;
[0072] Step 5.2, determine whether the coverage between the test results of the current round and the test results of the previous round is improved, if so, execute step 5.3, if not, execute step 5.4;
[0073] Step 5.3, return to step 2 and re-segment the field according to the feedback information corresponding to the current round;
[0074] Step 5.4, take the segmentation result corresponding to the current round as the optimal segmentation result and stop the fuzzy test.
[0075] In the specific implementation, the fuzz test boot phase. Our solution uses the engine of the fuzz test tool to perform mutation tests on each field after the protocol is reversely split. Specifically, the fuzz test tool mutates each field of the protocol one by one. Then the mutated data packets are iterated for fuzz testing.
[0076] If the coverage of the fuzz test results is improved, it indicates that the current field segmentation strategy is effective. At this time, the feedback information will be used to further optimize the field segmentation. Return to step 2.
[0077] If the coverage does not improve, it means that the mutation utility of the current mutation strategy in the current field has reached its upper limit, and the fuzz testing process will terminate.
[0078] The network protocol format inference method guided by the protocol fuzz test provided in this embodiment generates a fuzz test input through the protocol format inference result, and then uses the fuzz test result to guide and improve the protocol format inference process, introducing a loop feedback optimization mechanism, that is, the result of each round of fuzz testing can be used to correct the result of protocol format inference. This feedback loop can gradually improve the accuracy and depth of protocol parsing, overcome the limitations of the traditional one-way process, and this method can improve the accuracy of protocol reverse field cutting, thereby improving the efficiency and accuracy of protocol format inference.
[0079] It should be understood that various parts of the present disclosure may be implemented in hardware, software, firmware, or a combination thereof.
[0080] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.
Claims
1. A network protocol format reasoning method guided by protocol fuzz testing, characterized in that: include: Step 1: Capture the traffic of the target system and filter it to identify and separate the message sequence of the target protocol; Step 2, performing field segmentation on the message sequence to obtain a segmentation result; Step 3, inferring the protocol format based on the segmentation results; Step 4, construct an input data packet according to the inferred protocol format and send it to the server for format verification; Step 5: When the format verification passes, a fuzzy test is guided by a loop feedback according to the segmentation result corresponding to the inferred protocol format until the optimal segmentation result is obtained.
2. The method according to claim 1, characterized in that: The step 1 specifically includes: Step 1.1, use the preset tool to capture all traffic of the target system on the network; Step 1.2, after the capture is completed, the data packets corresponding to all flows are filtered to identify and separate the message sequence of the target protocol.
3. The method according to claim 2, characterized in that The step 2 specifically includes: A variety of protocol reverse analysis tools and different segmentation strategies are used to segment the message sequence into fields and generate multiple segmentation results.
4. The method according to claim 3, characterized in that The step 3 specifically includes: Based on the segmentation results, the protocol format is logically inferred and determined, and a variety of protocol format inferences are generated by combining the structural characteristics and communication rules of the target protocol.
5. The method according to claim 4, characterized in that The step 4 specifically includes: Step 4.1, construct the corresponding input data packet according to each inferred protocol format; Step 4.2, use the fuzz testing tool as the client, send all input data packets to the server, and obtain the server's processing results as feedback information. If the processing result is that the server refuses to receive the input data packet, return to step 2 and re-segment the fields according to the feedback information. If the processing result is that the server receives the input data packet, execute the subsequent steps.
6. The method according to claim 5, characterized in that The step 5 specifically includes: The fuzz testing tool is used to mutate each field in the segmentation result corresponding to the inferred protocol format one by one, and then the mutated data packet is guided by the fuzz testing with loop feedback until the optimal segmentation result is obtained.
7. The method according to claim 6, characterized in that The step of guiding the fuzzy test of loop feedback on the mutated data packet until the optimal segmentation result is obtained includes: Step 5.1, perform fuzzy testing on the mutated data packet to obtain the test result of the current round; Step 5.2, determine whether the coverage between the test results of the current round and the test results of the previous round is improved, if so, execute step 5.3, if not, execute step 5.4; Step 5.3, return to step 2 and re-segment the field according to the feedback information corresponding to the current round; Step 5.4, take the segmentation result corresponding to the current round as the optimal segmentation result and stop the fuzzy test.