Stateful protocol fuzz testing method and system based on path and response code conversion

Abstract

The present invention relates to a stateful protocol fuzz testing method and system based on path and response code conversion, and the method comprises the following steps: S1: entering the test preparation phase, deploying the entity program of the protocol to be tested locally, and defining the state model set of the protocol to be tested as the input of the fuzz testing phase; S2: entering the fuzz testing phase, including the message analysis phase in the fuzz testing phase, and performing detection and analysis on the message; S3: entering the result information feedback phase, including the repair feedback phase in the result information feedback phase, and the repair feedback phase is responsible for processing the variation of the tested message and repairing it; the system comprises a pile compilation module, a byte detection module, a repair feedback module and a network IO execution module. The present invention detects and iteratively learns the structure of the tested message under an acceptable overhead, optimizes the dynamic energy adjustment of the seed variation bytes, thereby improving the overall fuzz testing efficiency.

Description

Technical Field

[0001] The present invention belongs to the technical field of protocol fuzz testing, and in particular relates to a stateful protocol fuzz testing method and system based on path and response code conversion. Background Art

[0002] A network protocol is a set of rules agreed upon by both parties in network communication. It defines details such as the data transmission format, method, and error verification, ensuring error-free transmission of data between different devices and even systems. However, the implementation of network protocols will inevitably have vulnerabilities, and attackers may exploit their vulnerabilities and defects to attack, resulting in data leakage, data tampering, denial of service, and remote code execution. In recent years, research on protocol fuzz testing at home and abroad has mainly focused on methods based on grammar generation. A protocol fuzz testing method based on grammar generation and coverage guidance is proposed, which uses information such as coverage feedback to guide the generation of test cases. This method can generate more valuable test cases more efficiently, thereby advancing fuzz testing work towards maximizing coverage.

[0003] Chinese patent CN117319271A discloses a method for stateful network protocol fuzz testing using API HOOK technology. This method implements API HOOK technology to monitor and track the behavior of the tested service program in receiving and processing input data packets in real time, paying special attention to its memory usage and related memory data content, as a key indicator reflecting the internal state of the tested program. Based on this indicator information, the researchers constructed a detailed protocol state model. In the subsequent test iteration process, this model will be used to evaluate the impact of each test case on the state change of the tested program, and guide the design and generation of new test cases that are more adaptable and more likely to expose potential vulnerabilities, but it does not consider the possible message structure of the tested protocol.

[0004] Chinese patent CN117478566A discloses an innovative field-aware gray-box text protocol fuzz testing technology and system, which is improved on the basis of the existing AFL-Net gray-box protocol fuzz testing tool. This invention first uses potential delimiters to split the seed message into multiple fields and records the different values ​​that may appear in each field. Furthermore, based on the diversity and rarity of each field value, a differentiated mutation strength strategy is customized for each field. Therefore, this method enhances the understanding of the protocol text message format and optimizes the random generation efficiency of effective test cases. However, this method requires the use of potential delimiters to assist the message structure, so it is not applicable to common binary protocols.

[0005] In summary, in the fuzz testing process of stateful protocols, the existing technology will lead to a large amount of meaningless search space due to the lack of understanding of the message structure of the protocol being tested. The efficiency of fuzz testing of stateful protocols needs to be further improved. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a stateful protocol fuzz testing method and system based on path and response code conversion, detect and iteratively learn the structure of the tested message under acceptable overhead, optimize the dynamic energy adjustment of seed variant bytes, thereby improving the overall fuzz testing efficiency.

[0007] The present invention provides a stateful protocol fuzz testing method based on path and response code conversion, comprising the following steps:

[0008] S1: Enter the test preparation phase, deploy the entity program of the protocol to be tested locally, and define the state model set of the protocol to be tested as the input of the fuzzy testing phase;

[0009] S2: Entering the fuzzy testing phase, which includes a message analysis phase, in which the message is detected and analyzed;

[0010] S3: Enter the result information feedback stage, which includes the repair feedback stage. The repair feedback stage is responsible for processing the mutation of the tested message, and after the mutation is completed, repairing the message that has been randomly mutated, and collecting path conversion information after the fuzzification is completed to appropriately feedback and adjust the weight of each byte of the current message body.

[0011] Preferably, the specific steps of step S1 include:

[0012] S1.1: Run the server of the protocol under test correctly on the computer, and run and debug the client to try to correctly connect to and interact with the server;

[0013] S1.2: Simulate real exchanges with a network protocol server, and use a tool such as Wireshark to capture network packets, and add several obtained packets to the seed pool as initial seeds;

[0014] S1.3: Use the afl-gcc function to insert and compile the entity program of the protocol to be tested to generate the corresponding binary executable file;

[0015] S1.4: Run the binary executable file to open a shared memory ShareMem of 64KB to collect real-time statistics on the coverage information of the protocol entity program to be tested.

[0016] Preferably, the specific steps of the message analysis phase in step S2 include:

[0017] S2.1: Pre-test the initial seed, execute all the initial seeds in the seed pool one by one, and regard each initial seed as a set of message segments accumulated by N messages , segment set The expression is:

[0018] ={ ,..., ,..., },

[0019] Collect the return code after each message is sent, create the return code as a new node in the current state transition diagram, analyze all new nodes and paths in the test according to the instrumentation information; mark all seeds that can reach different states, and display the message header length of the protocol entity program to be tested; when no input is made, the default message header length is 0;

[0020] S2.2: Start the formal test. Take a state X from all the states that have been learned so far, and randomly select a seed S recorded under state X. A complete seed consists of multiple segments, each of which corresponds to a state of the server under test. According to the current fuzzy state X, traverse each segment of the seed in turn, find the next segment T after state X, and use it as the current message that needs to be mutated in this fuzzy test. All subsequent work is carried out in segment T. Take the first HeadLen bytes of segment T as the message header, and the rest as the message body.

[0021] S2.3: When the length of the message header is not 0, the message header is analyzed; this process is only performed twice, and if it exceeds 2 times, it is skipped directly;

[0022] S2.4: Analyze all possible results of the variation of bytes at all positions in the message segment T, pay attention to the deviation difference of the corresponding bytes under specific values, and mark the characteristics of the bytes accordingly, and analyze all the bytes in the message header in turn;

[0023] S2.5: Set each byte of the message header to each value from 0x00 to 0x255 in sequence. Perform a fuzzy test every time the value of each byte of the message header is changed, and save all deviation differences when the byte changes from 0x00 to 0x255.

[0024] S2.6: Analyze the main part of the entire message segment T, flip the entire message segment T, execute the entity program of the protocol to be tested once, and record the special deviation at this time.

[0025] Preferably, the specific steps of step S2.3 include:

[0026] S2.3.1: Do not process the message to be analyzed first, and directly perform a fuzz test. Monitor the server status to obtain the instrumentation feedback information P and the return code feedback information return, record the current mutation data, and save it as the original path;

[0027] S2.3.2: Set the entire message header to 0, perform a fuzzy test, and use the difference between this mutation and the source path to calculate the deviation ρ. The calculation method of the deviation ρ is:

[0028]

[0029] Wherein, k1, k2, k3, k4 are constant parameters; P is the execution path of the original seed; P' is the execution path of the mutated seed; |P| is the total number of edges in the execution path; diffHit is the number of edges with different coverage in P and P', that is, the total number of edges when P[i]^P'[i]=1; diffFre is the number of edges with the same coverage but different frequencies in P and P', that is, the total number of edges when P[i]&&P'[i]&&P[i]!=P'[i]; diffreturn is used to determine whether the return codes received after sending the original seed P and the current seed P' are different, and different codes are counted as 1 and the same codes are counted as 0;

[0030] After the calculation is completed, record the deviation ρ1;

[0031] S2.3.3: Actively truncate the last 10 bytes of the message body, construct a message with an incorrect length field, perform fuzzy testing again, calculate the deviation ρ2 in the same way, and record the deviation ρ2.

[0032] Preferably, the specific steps of step S2.4 include:

[0033] The deviation of all bytes of segment T when they are set to X is analyzed as follows:

[0034] When the difference between the current deviation and the special deviation ρ1 saved in step S2.2 is less than 0.01, mark the bit X as an error value, and prohibit the bit from mutating to X in subsequent mutations;

[0035] When the difference between the current deviation and the special deviation ρ2 saved in step S2.2 is less than 0.01, mark the bit as a length-related bit;

[0036] Preferably, the specific steps of step S2.6 include:

[0037] S2.6.1: Flip the entire message, execute the tested program once, and record the special deviation Keerper_err_allBody of this time;

[0038] S2.6.2: The message body is calculated using a binary method. The calculated deviation is the approximate deviation segment. A recursive function is used. The recursive function includes four parameters: the left boundary Left, the right boundary Right, input, and Keerper_err_allBody. The following function steps are entered:

[0039] 1) Flip all bytes of the left and right boundaries of the original input, use the flipped message as input to execute the program under test, calculate the deviation this time, and exit the program when it is less than or equal to Keerper_err_allBody / 4;

[0040] 2) Otherwise, it recursively calls itself with left boundary - middle value and middle value - right boundary as parameters respectively;

[0041] S2.6.3: Insert the deviations of all bytes into the maximum heap q and enter the loop:

[0042] 1) Flip all bytes except the one in the mask, execute and record as Keerper_err1;

[0043] 2) Determine whether Keerper_err1 is less than or equal to Keerper_err_allBody*2 / 3. If yes, complete and exit;

[0044] 3) The loop pops the top element from the maximum heap q. Only when the difference between it and the current Keerper_err1 is less than 0.01, the byte affects the execution logic of the entire program. Insert it into the Mask, exit the loop, and return to step 1);

[0045] S2.6.4: After the loop is completed, the bytes included in the Mask are always prohibited from mutation with a probability of 70% in subsequent mutations. The bytes not included in the Mask are uniformly mapped to weights using an exponential function. The weight calculation formula is:

[0046]

[0047] Among them, x represents the value of deviation ρ;

[0048] S2.6.5: Traverse all weights of the message body obtained in step S2.6.4 and calculate their deviations. Classify the longest continuous sub-segments with a deviation difference less than 0.01 as synonymous fields, and associate the same fields with the seeds and save them.

[0049] Preferably, the specific steps of step S3 include:

[0050] S3.1: Determine whether the unmutated message header complies with the specification. If it does not comply with the specification, mark it and do not make any repairs or restrictions on it in the future.

[0051] S3.2: Perform random mutation on the seed in the Havoc phase. After the random mutation is completed, for the unmarked message, enumerate each mutated byte through the message analysis phase, judge the byte, and further process it; when the processing strategy for the byte is recovery, the synonymous fields processed in S2.6.5 are further restored; after the processing is completed, use it as input to send to the server and execute;

[0052] S3.3: Perform feedback analysis; after the execution is completed, collect feedback information of this fuzz test and calculate the deviation; adjust the weight of the currently affected bytes according to the difference between the current deviation and the deviation obtained when the message body is completely flipped; when a new path is found in this fuzz test, report this discovery to all different messages in the same state;

[0053] Step S3.3 only acts on the main body of the message; the feedback analysis of each seed uses a simulated annealing strategy to obtain the optimal solution, and after complete cooling, the complete feedback analysis process is no longer executed.

[0054] Preferably, the step S3.2 includes a repair feedback stage, and the specific steps include:

[0055] S3.2.1: Perform random mutation of the seed in the Havoc phase, and randomly combine several mutation operators, including flipping, deletion, insertion, and splicing, to randomly mutate and obtain a new message after mutation;

[0056] S3.2.2: After the random mutation is completed, for the unmarked message, each mutated byte is enumerated in the message analysis phase, and the byte is judged. The judgment method includes the following steps:

[0057] When in the message header, check whether there is a valid value at that position; if the current value is in the set of valid values, do not change it, otherwise set it randomly to one of the valid values;

[0058] When marked as a length field, it is calculated and set to the correct length;

[0059] When in the main body of the message, a recovery range is set, and the recovery range value is (20%, 70%); and the weighted recovery rate is calculated, and the weighted recovery rate calculation formula is:

[0060] Weight recovery rate = (1-(maximum weight-current weight) / maximum weight)*100%,

[0061] When its weight rate is within the recovery range, it will be restored; when the adopted strategy is recovery, the synonymous fields processed in S2.6.5 will be further restored; at the same time, in the complete mutation process, the differential array is used to record the byte positions that are still affected as the basis for subsequent affected fields.

[0062] Preferably, the specific steps of step S3.3 include:

[0063] S3.3.1: After the execution is completed, collect the feedback information of this fuzz test and calculate the deviation; according to the difference between the current deviation and the deviation obtained when the message body is completely flipped in the record, adjust the weight of the currently affected bytes. The calculation formula for the weight to be adjusted and added is as follows:

[0064]

[0065] Among them, GreatchangeNum represents the deviation limit change when the xth byte is affected within a period of time; BePickNum represents the number of times the byte is affected within this period of time, and K represents the simulated annealing temperature variable, with a value of 1000; It is expressed as a constant offset value, and its value is 0.5;

[0066] S3.3.2: When a new path is found in this fuzzification, report this discovery to all different messages in the same state, increase the weight of the corresponding fields of all messages saved in this state and mutate them first;

[0067] S3.3.3: Only applies to the main body of the message; for each seed, the feedback analysis uses a simulated annealing strategy to obtain an optimal solution. After full cooling, the complete feedback analysis process is no longer performed. The specific method is as follows:

[0068] Set the initial temperature K=1000, K will execute K=K*0.95 in each round, and terminate the analysis when K<1 or the disturbance of two mutations is less than 1e-1, otherwise after each update of the byte weight of the message body, randomly perturb the current solution to obtain a new solution; then in the subsequent analysis, when the fuzzy new solution obtained by the perturbation is better than the previously generated solution, the fuzzy new solution obtained by the perturbation will be accepted, and a temperature coefficient threshold will be set. When the temperature coefficient exceeds the temperature coefficient threshold, the worst solution will be accepted. As the temperature K decreases, only the weight of the field with the best score will be increased; and after complete cooling, the complete feedback analysis process will no longer be executed.

[0069] A system of a stateful protocol fuzz testing method based on path and response code conversion, comprising an instrumentation compilation module, a byte detection module, a repair feedback module and a network IO execution module;

[0070] The instrumentation compilation module works at the beginning of the fuzz test and is used to perform instrumentation compilation on the software to be tested. It generates function call relationship diagrams and control flow charts through afl-gcc instrumentation compilation.

[0071] The byte detection module is responsible for analyzing the byte structure of the seed in each round of fuzz testing after the instrumentation compilation is completed. It uses the path conversion and return code difference information before and after the mutation to determine the structure of different byte positions.

[0072] The repair feedback module is responsible for guiding the mutation using the message template information obtained by the byte detection module after the byte detection module is run; and processing and repairing the message after random mutation in the Havoc stage; after the mutation is completed, the network IO execution module is called to request the execution of the tested server, and the weight of each byte of the message body is dynamically adjusted according to the deviation after the network IO execution module returns;

[0073] The network IO execution module listens to the requests of the repair feedback module and works, using the Forksever mechanism to process the message as a seed to connect and send messages to the server program under test, ensuring that the runtime path and return code are correctly written into the memory.

[0074] The present invention has the following technical effects:

[0075] 1. Dynamically learn in the fuzz testing stage, and use the difference in the conversion and return code of the execution path before and after mutation to perceive and distinguish the possible structures of different byte positions in different states. Continuously iterate during the fuzzing process to optimize the byte-level energy allocation strategy in the mutation stage, detect and iteratively learn the structure of the tested message at an acceptable overhead, optimize the dynamic energy adjustment of the seed mutation bytes, and improve the overall fuzz testing efficiency.

[0076] 2. Improve the efficiency of vulnerability detection by repairing the feedback phase, explore more branches of the tested program, trigger more program vulnerabilities, and improve the accuracy of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] Figure 1 It is a schematic diagram of the overall framework of the stateful protocol fuzz testing method based on path and response code conversion of the present invention;

[0078] Figure 2 It is a flow chart of the stateful protocol fuzzy testing method based on path and response code conversion of the present invention;

[0079] Figure 3This is a flow chart of the test preparation phase of the stateful protocol fuzz testing method based on path and response code conversion of the present invention. DETAILED DESCRIPTION

[0080] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings.

[0081] like Figure 1 As shown, the stateful protocol fuzz testing method based on path and response code conversion includes the following steps:

[0082] S1: Enter the test preparation phase, deploy the entity program of the protocol to be tested locally, and define the state model set of the protocol to be tested as the input of the fuzzy testing phase;

[0083] S2: Entering the fuzzy testing phase, which includes a message analysis phase, in which the message is detected and analyzed;

[0084] S3: Enter the result information feedback stage, which includes the repair feedback stage. The repair feedback stage is responsible for processing the mutation of the tested message, and after the mutation is completed, repairing the message that has been randomly mutated, and collecting path conversion information after the fuzzification is completed to appropriately feedback and adjust the weight of each byte of the current message body.

[0085] The specific steps of step S1 include:

[0086] S1.1: Run the server of the protocol under test correctly on the computer, and run and debug the client to try to correctly connect to and interact with the server;

[0087] S1.2: Simulate real exchanges with a network protocol server, and use a tool such as Wireshark to capture network packets, and add several obtained packets to the seed pool as initial seeds;

[0088] S1.3: Use the afl-gcc function to insert and compile the entity program of the protocol to be tested to generate the corresponding binary executable file;

[0089] S1.4: Run the binary executable file to open a shared memory ShareMem of 64KB to collect real-time statistics on the coverage information of the protocol entity program to be tested.

[0090] The specific steps of the message analysis phase in step S2 include:

[0091] S2.1: Pre-test the initial seed, execute all the initial seeds in the seed pool one by one, and regard each initial seed as a set of message segments accumulated by N messages , segment set The expression is:

[0092] ={ ,..., ,..., },

[0093] Collect the return code after each message is sent, create the return code as a new node in the current state transition diagram, analyze all new nodes and paths in the test according to the instrumentation information; mark all seeds that can reach different states, and display the message header length of the protocol entity program to be tested; when no input is made, the default message header length is 0;

[0094] S2.2: Start the formal test. Take a state X from all the states that have been learned so far, and randomly select a seed S recorded under state X. A complete seed consists of multiple segments, each of which corresponds to a state of the server under test. According to the current fuzzy state X, traverse each segment of the seed in turn, find the next segment T after state X, and use it as the current message that needs to be mutated in this fuzzy test. All subsequent work is carried out in segment T. Take the first HeadLen bytes of segment T as the message header, and the rest as the message body.

[0095] S2.3: When the length of the message header is not 0, the message header is analyzed; this process is only performed twice, and if it exceeds 2 times, it is skipped directly;

[0096] S2.4: Analyze all possible results of the variation of bytes at all positions in the message segment T, pay attention to the deviation difference of the corresponding bytes under specific values, and mark the characteristics of the bytes accordingly, and analyze all the bytes in the message header in turn;

[0097] S2.5: Set each byte of the message header to each value from 0x00 to 0x255 in sequence. Perform a fuzzy test every time the value of each byte of the message header is changed, and save all deviation differences when the byte changes from 0x00 to 0x255.

[0098] S2.6: Analyze the main part of the entire message segment T, flip the entire message segment T, execute the entity program of the protocol to be tested once, and record the special deviation at this time.

[0099] The specific steps of step S2.3 include:

[0100] S2.3.1: Do not process the message to be analyzed first, and directly perform a fuzz test. Monitor the server status to obtain the instrumentation feedback information P and the return code feedback information return, record the current mutation data, and save it as the original path;

[0101] S2.3.2: Set the entire message header to 0, perform a fuzzy test, and use the difference between this mutation and the source path to calculate the deviation ρ. The calculation method of the deviation ρ is:

[0102]

[0103] Wherein, k1, k2, k3, k4 are constant parameters; P is the execution path of the original seed; P' is the execution path of the mutated seed; |P| is the total number of edges in the execution path; diffHit is the number of edges with different coverage in P and P', that is, the total number of edges when P[i]^P'[i]=1; diffFre is the number of edges with the same coverage but different frequencies in P and P', that is, the total number of edges when P[i]&&P'[i]&&P[i]!=P'[i]; diffreturn is used to determine whether the return codes received after sending the original seed P and the current seed P' are different, and different codes are counted as 1 and the same codes are counted as 0;

[0104] After the calculation is completed, record the deviation ρ1;

[0105] S2.3.3: Actively truncate the last 10 bytes of the message body, construct a message with an incorrect length field, perform fuzzy testing again, calculate the deviation ρ2 in the same way, and record the deviation ρ2.

[0106] The specific steps of step S2.4 include:

[0107] The deviation of all bytes of segment T when they are set to X is analyzed as follows:

[0108] When the difference between the current deviation and the special deviation ρ1 saved in step S2.2 is less than 0.01, mark the bit X as an error value, and prohibit the bit from mutating to X in subsequent mutations;

[0109] When the difference between the current deviation and the special deviation ρ2 saved in step S2.2 is less than 0.01, mark the bit as a length-related bit;

[0110] The specific steps of step S2.6 include:

[0111] S2.6.1: Flip the entire message, execute the tested program once, and record the special deviation Keerper_err_allBody of this time;

[0112] S2.6.2: The message body is calculated using a binary method. The calculated deviation is the approximate deviation segment. A recursive function is used. The recursive function includes four parameters: the left boundary Left, the right boundary Right, input, and Keerper_err_allBody. The following function steps are entered:

[0113] 3) Flip all bytes of the left and right boundaries of the original input, use the flipped message as input to execute the program under test, calculate the deviation this time, and exit the program when it is less than or equal to Keerper_err_allBody / 4;

[0114] 4) Otherwise, recursively call itself with left boundary - middle value and middle value - right boundary as parameters respectively;

[0115] S2.6.3: Insert the deviations of all bytes into the maximum heap q and enter the loop:

[0116] 4) Flip all bytes except the mask, execute and record as Keerper_err1;

[0117] 5) Determine whether Keerper_err1 is less than or equal to Keerper_err_allBody*2 / 3. If yes, complete and exit;

[0118] 6) Pop the top element from the maximum heap q in a loop. Only when the difference between it and the current Keerper_err1 is less than 0.01, the byte affects the execution logic of the entire program. Insert it into Mask, exit the loop, and return to step 1);

[0119] S2.6.4: The bytes included in the Mask after the cycle is completed are always prohibited from mutation with a probability of 70% in subsequent mutations. The bytes not included in the Mask after the cycle is completed are uniformly mapped to weights using an exponential function. The weight calculation formula is:

[0120]

[0121] Among them, x represents the value of deviation ρ;

[0122] S2.6.5: Traverse all weights of the message body obtained in step S2.6.4 and calculate their deviations. Classify the longest continuous sub-segments with a deviation difference less than 0.01 as synonymous fields, and associate the same fields with the seeds and save them.

[0123] The specific steps of step S3 include:

[0124] S3.1: Determine whether the unmutated message header complies with the specification. If it does not comply with the specification, mark it and do not make any repairs or restrictions on it in the future.

[0125] S3.2: Perform random mutation on the seed in the Havoc phase. After the random mutation is completed, for the unmarked message, enumerate each mutated byte through the message analysis phase, judge the byte, and further process it; when the processing strategy for the byte is recovery, the synonymous fields processed in S2.6.5 are further restored; after the processing is completed, use it as input to send to the server and execute;

[0126] S3.3: Perform feedback analysis; after the execution is completed, collect feedback information of this fuzz test and calculate the deviation; adjust the weight of the currently affected bytes according to the difference between the current deviation and the deviation obtained when the message body is completely flipped; when a new path is found in this fuzz test, report this discovery to all different messages in the same state;

[0127] Step S3.3 only acts on the main body of the message; the feedback analysis of each seed uses a simulated annealing strategy to obtain the optimal solution, and after complete cooling, the complete feedback analysis process is no longer executed.

[0128] Preferably, the step S3.2 includes a repair feedback stage, and the specific steps include:

[0129] S3.2.1: Perform random mutation of the seed in the Havoc phase, and randomly combine several mutation operators, including flipping, deletion, insertion, and splicing, to randomly mutate and obtain a new message after mutation;

[0130] S3.2.2: After the random mutation is completed, for the unmarked message, each mutated byte is enumerated in the message analysis phase, and the byte is judged. The judgment method includes the following steps:

[0131] When in the message header, check whether there is a valid value at that position; if the current value is in the set of valid values, do not change it, otherwise set it randomly to one of the valid values;

[0132] When marked as a length field, it is calculated and set to the correct length;

[0133] When in the main body of the message, a recovery range is set, and the recovery range value is (20%, 70%); and the weighted recovery rate is calculated, and the weighted recovery rate calculation formula is:

[0134] Weight recovery rate = (1-(maximum weight-current weight) / maximum weight)*100%,

[0135] When its weight rate is within the recovery range, it will be restored; when the adopted strategy is recovery, the synonymous fields processed in S2.6.5 will be further restored; at the same time, in the complete mutation process, the differential array is used to record the byte positions that are still affected as the basis for subsequent affected fields.

[0136] The specific steps of step S3.3 include:

[0137] S3.3.1: After the execution is completed, collect the feedback information of this fuzz test and calculate the deviation; according to the difference between the current deviation and the deviation obtained when the message body is completely flipped in the record, adjust the weight of the currently affected bytes. The calculation formula for the weight to be adjusted and added is as follows:

[0138]

[0139] Among them, GreatchangeNum represents the deviation limit change when the xth byte is affected within a period of time; BePickNum represents the number of times the byte is affected within this period of time, and K represents the simulated annealing temperature variable, with a value of 1000; It is expressed as a constant offset value, and its value is 0.5;

[0140] S3.3.2: When a new path is found in this fuzzification, report this discovery to all different messages in the same state, increase the weight of the corresponding fields of all messages saved in this state and mutate them first;

[0141] S3.3.3: Only applies to the main body of the message; for each seed, the feedback analysis uses a simulated annealing strategy to obtain an optimal solution. After full cooling, the complete feedback analysis process is no longer performed. The specific method is as follows:

[0142] Set the initial temperature K=1000, K will execute K=K*0.95 in each round, and terminate the analysis when K<1 or the disturbance of two mutations is less than 1e-1, otherwise after each update of the byte weight of the message body, randomly perturb the current solution to obtain a new solution; then in the subsequent analysis, when the fuzzy new solution obtained by the perturbation is better than the previously generated solution, the fuzzy new solution obtained by the perturbation will be accepted, and a temperature coefficient threshold will be set. When the temperature coefficient exceeds the temperature coefficient threshold, the worst solution will be accepted. As the temperature K decreases, only the weight of the field with the best score will be increased; and after complete cooling, the complete feedback analysis process will no longer be executed.

[0143] For this embodiment (referred to as ESFuzzer in the table), in order to verify the effectiveness of the method of the present invention, experimental verification was carried out on RTSP and DTLS protocols, wherein the control group selected the most advanced fuzzer AFL-Net, and the test set selected the widely used protocols RTSP and DTLS, and tested the same protocol entity program to be tested, wherein each group of experiments lasted for 24 hours. In order to reduce the impact of randomness in fuzz testing, all experiments were repeated three times, and the results were averaged.

[0144] The experimental results are shown in the following table:

[0145] Target Protocol Fuzzer Number of paths / branch Number of vulnerabilities RTSP ESFuzzerAFL-Net 11791055 3522 DTLS ESFuzzerAFL-Net 63586202 165132

[0146] It can be seen from the above table that in the RTSP protocol, the number of paths in this embodiment is 124 more than the number of paths covered by AFL-Net, and the number of vulnerabilities is 13 more; in the DTLS protocol, the number of paths in this embodiment is 146 more than the number of paths covered by AFL-Net, and the number of vulnerabilities is 33 more; the number of detected paths and the number of vulnerabilities in this embodiment are significantly improved compared with the prior art AFL-Net.

[0147] Any of the methods or steps described above may be stored as computer instructions or programs in various types of computer memories, and the computer instructions or programs may be recognized by various types of computer processors to implement any of the methods or steps described above.

[0148] The embodiments described above are only descriptions of the preferred modes of the present invention, and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A stateful protocol fuzz testing method based on path and response code conversion, characterized by: The steps include: S1: Enter the test preparation phase, deploy the entity program of the protocol to be tested locally, and define the state model set of the protocol to be tested as the input of the fuzzy testing phase; S2: Entering the fuzzy testing phase, which includes a message analysis phase, in which the message is detected and analyzed; The specific steps of the message analysis phase in step S2 include: S2.1: Pre-test the initial seeds, execute all the initial seeds in the seed pool one by one, and regard each initial seed as a segment set S of N accumulated messages. i , segment set S i The expression is: S i ={S i _field1,...,S i _field j ,...,S i _field m }, Collect the return code after each message is sent, create the return code as a new node in the current state transition diagram, analyze all new nodes and paths in the test according to the instrumentation information; mark all seeds that can reach different states, and display the message header length of the protocol entity program to be tested; when no input is made, the default message header length is 0; S2.2: Start the formal test. Take a state X from all the states that have been learned so far, and randomly select a seed S recorded under state X. A complete seed consists of multiple segments, each of which corresponds to a state of the server under test. According to the current fuzzy state X, traverse each segment of the seed in turn, find the next segment T after state X, and use it as the current message that needs to be mutated in this fuzzy test. All subsequent work is carried out in segment T. Take the first HeadLen bytes of segment T as the message header, and the rest as the message body. S2.3: When the length of the message header is not 0, the message header is analyzed; this process is only performed twice, and if it exceeds 2 times, it is skipped directly; S2.4: Analyze all possible results of the variation of bytes at all positions in the message segment T, pay attention to the deviation difference of the corresponding bytes under specific values, and mark the characteristics of the bytes accordingly, and analyze all the bytes in the message header in turn; S2.5: Set each byte of the message header to each value from 0x00 to 0x255 in sequence. Perform a fuzzy test every time the value of each byte of the message header is changed, and save all deviation differences when the byte changes from 0x00 to 0x255. S2.6: Analyze the main part of the entire message segment T, flip the entire message segment T, execute the entity program of the protocol to be tested once, and record the special deviation at this time; The specific steps of step S2.3 include: S2.3.1: Do not process the message to be analyzed first, and directly perform a fuzz test. Monitor the server status to obtain the instrumentation feedback information P and the return code feedback information return, record the current mutation data, and save it as the original path; S2.3.2: Set the entire message header to 0, perform a fuzzy test, and use the difference between this mutation and the source path to calculate the deviation ρ. The calculation method of the deviation ρ is: , Wherein, k1, k2, k3, k4 are constant parameters; P is the execution path of the original seed; P' is the execution path of the mutated seed; |P| is the total number of edges in the execution path; diffHit is the number of edges with different coverage in P and P', that is, the total number of edges when P[i]^P'[i]=1; diffFre is the number of edges with the same coverage but different frequencies in P and P', that is, the total number of edges when P[i]&&P'[i]&&P[i]!=P'[i]; diffreturn is used to determine whether the return codes received after sending the original seed P and the current seed P' are different, and different codes are counted as 1 and the same codes are counted as 0; After the calculation is completed, record the deviation ρ1; S2.3.3: Actively truncate the last 10 bytes of the message body, construct a message with an incorrect length field, perform fuzzy testing again, calculate the deviation ρ2 in the same way, and record the deviation ρ2; The specific steps of step S2.4 include: The deviation of all bytes of segment T when they are set to X is analyzed as follows: When the difference between the current deviation and the special deviation ρ1 saved in step S2.2 is less than 0.01, mark the bit X as an error value, and prohibit the bit from mutating to X in subsequent mutations; When the difference between the current deviation and the special deviation ρ2 saved in step S2.2 is less than 0.01, mark the bit as a length-related bit; The specific steps of step S2.6 include: S2.6.1: Flip the entire message, execute the tested program once, and record the special deviation Keerper_err_allBody of this time; S2.6.2: The message body is calculated using a binary method. The calculated deviation is the approximate deviation segment. A recursive function is used. The recursive function includes four parameters: the left boundary Left, the right boundary Right, input, and Keerper_err_allBody. The following function steps are entered: Flip all bytes of the left and right boundaries of the original input, use the flipped message as input to execute the program under test, calculate the deviation this time, and exit the program when it is less than or equal to Keerper_err_allBody / 4; Otherwise, it recursively calls itself with left boundary - middle value and middle value - right boundary as parameters respectively; S2.6.3: Insert the deviations of all bytes into the maximum heap q and enter the loop: Flip all bytes except the one in the mask, execute and record as Keerper_err1; Determine whether Keerper_err1 is less than or equal to Keerper_err_allBody*2 / 3. If yes, complete and exit; The loop pops the top element from the maximum heap q. Only when the difference between it and the current Keerper_err1 is less than 0.01, the byte affects the execution logic of the entire program. Insert it into the Mask, exit the loop, and return to step 1); S2.6.4: The bytes included in the Mask after the cycle is completed are always prohibited from mutation with a probability of 70% in subsequent mutations. The bytes not included in the Mask after the cycle is completed are uniformly mapped to weights using an exponential function. The weight calculation formula is: f(x)=x 2.5 , Among them, x represents the value of deviation ρ; S2.6.5: traverse all weights of the message body obtained in step S2.6.4, calculate their deviation, classify the longest continuous sub-segments with a deviation difference less than 0.01 as synonymous fields, associate the same fields with the seeds and save them; S3: Enter the result information feedback stage, which includes the repair feedback stage. The repair feedback stage is responsible for processing the mutation of the tested message, and after the mutation is completed, repairing the message that has been randomly mutated, and collecting path conversion information after the fuzzification is completed to appropriately feedback and adjust the weight of each byte of the current message body.

2. The stateful protocol fuzz testing method based on path and response code conversion according to claim 1 is characterized in that: The specific steps of step S1 include: S1.1: Run the server of the protocol under test correctly on the computer, and run and debug the client to try to correctly connect to and interact with the server; S1.2: Simulate the real exchange with the network protocol server, use the Wireshark tool to capture network packets, and add the obtained packets to the seed pool as the initial seeds; S1.3: Use the afl-gcc function to insert and compile the entity program of the protocol to be tested to generate the corresponding binary executable file; S1.4: Run the binary executable file to open a shared memory ShareMem of 64KB to collect real-time statistics on the coverage information of the protocol entity program to be tested.

3. The stateful protocol fuzz testing method based on path and response code conversion according to claim 2 is characterized in that: The specific steps of step S3 include: S3.1: Determine whether the unmutated message header complies with the specification. If it does not comply with the specification, mark it and do not make any repairs or restrictions on it in the future. S3.2: Perform random mutation on the seed in the Havoc phase. After the random mutation is completed, for the unmarked message, enumerate each mutated byte through the message analysis phase, judge the byte, and further process it; when the processing strategy for the byte is recovery, the synonymous fields processed in S2.6.5 are further restored; after the processing is completed, use it as input to send to the server and execute; S3.3: Perform feedback analysis; after the execution is completed, collect feedback information of this fuzz test and calculate the deviation; adjust the weight of the currently affected bytes according to the difference between the current deviation and the deviation obtained when the message body is completely flipped; when a new path is found in this fuzz test, report this discovery to all different messages in the same state; Step S3.3 only acts on the main body of the message; the feedback analysis of each seed uses a simulated annealing strategy to obtain the optimal solution, and after complete cooling, the complete feedback analysis process is no longer executed.

4. The stateful protocol fuzz testing method based on path and response code conversion according to claim 3 is characterized in that: The step S3.2 includes a repair feedback phase, and the specific steps include: S3.2.1: Perform random mutation of the seed in the Havoc phase, and randomly combine several mutation operators, including flipping, deletion, insertion, and splicing, to randomly mutate and obtain a new message after mutation; S3.2.2: After the random mutation is completed, for the unmarked message, each mutated byte is enumerated in the message analysis phase, and the byte is judged. The judgment method includes the following steps: When in the message header, check whether there is a valid value at that position; if the current value is in the set of valid values, do not change it, otherwise set it randomly to one of the valid values; When marked as a length field, it is calculated and set to the correct length; When in the main body of the message, a recovery range is set, and the recovery range value is (20%, 70%); and the weighted recovery rate is calculated, and the weighted recovery rate calculation formula is: Weight recovery rate = (1-(maximum weight-current weight) / maximum weight)*100%, When its weight rate is within the recovery range, it will be restored; when the adopted strategy is recovery, the synonymous fields processed in S2.6.5 will be further restored; at the same time, in the complete mutation process, the differential array is used to record the byte positions that are still affected as the basis for subsequent affected fields.

5. The stateful protocol fuzz testing method based on path and response code conversion according to claim 4 is characterized in that: The specific steps of step S3.3 include: S3.3.1: After the execution is completed, collect the feedback information of this fuzz test and calculate the deviation; according to the difference between the current deviation and the deviation obtained when the message body is completely flipped in the record, adjust the weight of the currently affected bytes. The calculation formula for the weight to be adjusted and added is as follows: ， Among them, GreatchangeNum represents the deviation limit change when the xth byte is affected within a period of time; BePickNum represents the number of times the byte is affected within this period of time, and K represents the simulated annealing temperature variable, with a value of 1000; It is expressed as a constant offset value, and its value is 0.5; S3.3.2: When a new path is found in this fuzzification, report this discovery to all different messages in the same state, increase the weight of the corresponding fields of all messages saved in this state and mutate them first; S3.3.3: Only applies to the main body of the message; for each seed, the feedback analysis uses a simulated annealing strategy to obtain an optimal solution. After full cooling, the complete feedback analysis process is no longer performed. The specific method is as follows: Set the initial temperature K=1000, K will execute K=K*0.95 in each round, and terminate the analysis when K<1 or the disturbance of two mutations is less than 1e-1, otherwise after each update of the byte weight of the message body, randomly perturb the current solution to obtain a new solution; then in the subsequent analysis, when the fuzzy new solution obtained by the perturbation is better than the previously generated solution, the fuzzy new solution obtained by the perturbation will be accepted, and a temperature coefficient threshold will be set. When the temperature coefficient exceeds the temperature coefficient threshold, the worst solution will be accepted. As the temperature K decreases, only the weight of the field with the best score will be increased; and after complete cooling, the complete feedback analysis process will no longer be executed.

6. A system for the stateful protocol fuzz testing method based on path and response code conversion according to claim 1, characterized in that: It includes the instrumentation compilation module, byte detection module, repair feedback module and network IO execution module; The instrumentation compilation module works at the beginning of the fuzz test and is used to perform instrumentation compilation on the software to be tested. It generates function call relationship diagrams and control flow charts through afl-gcc instrumentation compilation. The byte detection module is responsible for analyzing the byte structure of the seed in each round of fuzz testing after the instrumentation is completed. It uses the path conversion and return code difference information before and after the mutation to determine the structure of different byte positions; The repair feedback module is responsible for guiding mutation using the message template information obtained by the byte detection module after the byte detection module is run; and processing and repairing the message after random mutation in the Havoc stage; After the mutation is completed, the network IO execution module is called to request the execution of the tested server, and the weight of each byte of the message body is dynamically adjusted according to the deviation after the network IO execution module returns; The network IO execution module listens to the requests of the repair feedback module and works, using the Forksever mechanism to process the message as a seed to connect and send messages to the server program under test, ensuring that the runtime path and return code are correctly written into the memory.

Images