Fuzzy test method and system based on network protocol format inference and program product

Abstract

The invention belongs to the technical field of network security, and particularly discloses a fuzzy testing method and system based on network protocol format inference and a program product. Based on the deduced protocol format characteristics, the final fuzzy test data is generated in the mode that a fixed value field, a control value field and a separator field in sample data are kept unchanged, and a variable-length field and a fixed-length field use multiple variation strategy dynamic combinations. According to the fuzzy test method based on the protocol format feature inference and the dynamic combination sample variation strategy, the difficulty of manually and reversely analyzing the protocol format and the fuzzy test data validity of an undisclosed and normative network protocol in the fuzzy test process is solved to a certain extent; a methodology and a basis of a protocol format automatic inference tool are formed, and the purpose of performing effective fuzzy testing on specific network protocol implementation is achieved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a fuzzy testing method, system and program product based on network protocol format inference. Background Art

[0002] With the development of the Internet era, the importance of network security issues is increasing day by day. As the standard for communication between different entities in the network, the security of network protocols will affect thousands of network devices. Fuzz testing technology is one of the most effective testing technologies at present, and it is also an important means to maintain network security, as it is highly efficient and easy to implement, and can detect potential security vulnerabilities in network communications in advance.

[0003] The main principle of fuzz testing based on network protocols is to simulate the communication between the client and the target under test, send mutated or error-containing data packets to the target under test, and monitor the target to find defects. The testing process can be divided into five steps: determine the input and output targets, generate fuzzy test data, execute test data, monitor target anomalies, and determine its exploitability. During the testing process, the key to effectively discovering defects is to comply with the specifications, standards and state mechanisms of various protocols and generate test cases with reasonable and effective fuzzy test data.

[0004] At present, the generation and mutation method is the basic methodology of fuzz testing. Testers usually use the generation and mutation method to generate test cases based on the publicly available network protocol format specifications of a target to be tested, and then based on the protocol specifications and the collected communication sample data, select sample data to generate test cases and perform fuzz testing on specific network protocol implementations. When the protocol format specifications of the target to be tested are known, the generation and mutation method has a high effectiveness in generating fuzzy test data. However, for network protocols with undisclosed protocol specifications, it takes a huge amount of manpower and time to manually reverse analyze the protocol format and state mechanism through the collected network data, which also reduces the efficiency of network protocol testing and defect analysis to a certain extent. Summary of the invention

[0005] The purpose of the present invention is to provide a fuzzy testing method, system and program product based on network protocol format inference to solve the above-mentioned problems existing in the prior art.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] In a first aspect, a fuzz testing method based on network protocol format inference is provided, including:

[0008] Collect communication message data between the client and the tested end;

[0009] Extracting message data sent from the client to the tested end from the communication message data as client data, and extracting message data sent from the tested end to the client from the communication message data as tested end data;

[0010] Inferring the network protocol format of the client data, determining the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data;

[0011] The fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data are used to perform mutation combination to generate fuzzy test data;

[0012] Sending the fuzzy test data to the tested end, so that the tested end uses the fuzzy test data to perform message processing, obtains test response data, and receives the test response data fed back by the tested end;

[0013] Compare and output the tested end data with the test response data.

[0014] In a possible design, the client data includes a plurality of protocol data, and the network protocol format inference of the client data includes:

[0015] Get a set separator set, the separator set includes a number of separators;

[0016] The delimiter set is used to match each protocol data in the client data. If the character of a field in the protocol data is the same as any delimiter in the delimiter set, the field in the protocol data is used as the delimiter field.

[0017] In a possible design, the inferring the network protocol format of the client data includes:

[0018] Segment the protocol data by its separator field to obtain a number of sequentially arranged unit fields;

[0019] Using the sequentially arranged unit fields to form a unit field row corresponding to the protocol data, and using the unit field rows corresponding to each piece of protocol data to form a unit field matrix, so that each row of the unit field matrix corresponds to a unit field row, and each column corresponds to the corresponding unit field column order;

[0020] Determine the field length of the unit fields contained in each column of the unit field matrix. If the field lengths of the unit fields in a column are the same, the unit fields corresponding to the column in each piece of protocol data are used as fixed-length fields. Otherwise, the unit fields corresponding to the column in each piece of protocol data are used as variable-length fields.

[0021] In a possible design, the inferring the network protocol format of the client data includes:

[0022] Segment the protocol data by its separator field to obtain a number of sequentially arranged unit fields;

[0023] The cell fields arranged in sequence are used to form the cell field rows corresponding to the protocol data, and the cell field rows corresponding to each piece of protocol data are used to form the cell field matrix R n,m , so that the unit field matrix R n,m Each row corresponds to a cell field row, and each column corresponds to the corresponding cell field column sorting. n represents the cell field matrix R n,m The number of rows, m represents the cell field matrix R n,m The number of columns;

[0024] Define the cumulative variable r, and the cumulative step length of the cumulative variable r is 1, so that r represents the unit field matrix R n,m The column number is 1≤r≤m, and the initial value of r is 1;

[0025] A. Extract the cell field matrix R n,m The rth column unit field, each byte contained in each unit field in the rth column is used as a matrix element to construct the rth column byte matrix, the byte matrix contains A1-A h Column, K'1-K' n row, n is the number of rows of the byte matrix, h is the number of columns of the byte matrix, and h is the maximum number of bytes of each cell field in the rth column;

[0026] B. A matrix element A of the byte matrix i,j Represents the jth byte of the byte unit in the i-th row, and the multiset A is j ={A 1,j ,A 2,j …A n,j}, 1≤i≤n, 1≤j≤h, let the multiset K'={K'1,K'2…K' n};

[0027] C. Add a matrix element A to the byte matrix i,j The probability B of the corresponding byte appearing in the jth column of the byte matrix i,j As the matrix element A i,j The corresponding occurrence probability elements are obtained, and the occurrence probability elements of each matrix element of the byte matrix are traversed, and the probability matrix B is constructed using the occurrence probability elements corresponding to each matrix element of the byte matrix n,h ,in

[0028]

[0029] When the probability matrix B n,h Medium B 1,j =B 2,j… = B n-1,j = B n,j = 1, and when 1 ≤ j ≤ h, it is determined that the j-th column byte in the byte matrix is a fixed-value byte. When multiple columns of fixed-value bytes in the byte matrix are adjacent, the adjacent multiple columns of fixed-value bytes are merged as the fixed-value field of each unit field in the r-th column. When there are no adjacent columns of fixed-value bytes in the byte matrix, each single-column fixed-value byte is used as the fixed-value field of each unit field in the r-th column, and the cumulative variable r is incremented and updated, and then the above steps A - C are iteratively executed to determine the unit field matrix R n,m The fixed-value fields of each column unit field in

[0030] In a possible design, the inferring of the network protocol format for the client data includes:

[0031] D. Define a recurrence variable M, set M = 1, and determine the probability matrix B n,h Each column B i,j The maximum value b = Max(B i,j ), and B i,j < M, the sequence numbers j' of the columns containing the maximum value b in the probability matrix B n,h are taken out to form a set J;

[0032] E. Sequentially take out the column sequence numbers j' from the set J, determine the column A of the byte matrix corresponding to j', j' and represent A j' as A j' = {p1 * a1, p2 * a2 … p t * a t}, where 1 ≤ t ≤ n, a1, a2 … a t respectively represent the byte elements of the column A of the byte matrix j' , and p1, p2 … p t are the multiplicities corresponding to the byte elements a1, a2 … a t respectively. Denote the multiset P = {p1, p2 … p t}, divide the multiset K' into t categories according to A j' , denoted as K” = {K″1, K″2 … K″ t}, determine the maximum value p v of the multiset P, and the classification corresponding to p v in K” is K″ v ;

[0033] F. Set a type of row element K' i ∈ K″ v , a second type of row element and K' i ∈ K', K' f ∈ K', 1 ≤ i ≤ n, 1 ≤ f ≤ n, when in K″v Each K' in the classification i When conditions 1, 2, and 3 are met, determine byte matrix column A j' The corresponding byte is the control value byte, where:

[0034] Condition 1 includes each type of row element K' e The average similarity between them is higher than that of each row element K' i and each second-class row element K' f The average similarity between any two row elements K' in K' i1 and K' i2 The similarity calculation formula between

[0035]

[0036] Among them, Fa represents the similarity between two row elements, 1≤i1≤n, 1≤i2≤n, 1≤j1≤h, x, x1 and x2 represent the corresponding variables, and null represents that the corresponding variable is empty.

[0037] Condition 2 includes each type of row element K' i The field structure similarity between them is in the set structure similarity range, and the field structure similarity calculation formula is:

[0038]

[0039] Among them, K v By p v K' i Composition, and i'={z|z=i,K' i ∈K″ v}, represents the maximum value function, Fs represents the field structure similarity,

[0040] Condition three includes K″1,K″2…K″ t There are t categories in total, and there is only one row element K' i The ratio of the number of categories to the total number of categories t is less than 0.5;

[0041] G. When there is a byte matrix column A j' When the corresponding byte is a control value byte, the recursive variable M=b is reset, and step DF is iteratively executed to determine the control value bytes of each column in the byte matrix. When multiple columns of control value bytes are adjacent in the byte matrix, the adjacent multiple columns of control value bytes are merged as the control value fields of each unit field in the rth column. When there are no adjacent column control value bytes in the byte matrix, the control value bytes of each single column are used as the control value fields of each unit field in the rth column.

[0042] H. When there is no byte matrix column A j'When the corresponding byte is a control value byte, the accumulated variable r is incremented by 1 and updated, and the above steps AG are iteratively executed to determine the unit field matrix R n,m The control value field for each column cell field in .

[0043] In a possible design, the inferring the network protocol format of the client data includes:

[0044] In determining the cell field matrix R n,m After the fixed value field and the control value field of each column unit field are merged, the fixed value field and the control value field of each column unit field are merged into the fixed-length field or the variable-length field of the corresponding column unit field, and the merged column unit fields are recombined with the corresponding separator field to obtain the secondary protocol data format;

[0045] The field between any two of the fixed value field, the control value field and the separator field in each secondary protocol data format is used as a secondary determination field;

[0046] When the byte lengths of the secondary determination fields at the same field position in each secondary protocol data format are the same, the secondary determination fields at the same field position in each secondary protocol data format are used as fixed-length fields; otherwise, the secondary determination fields at the same field position in each secondary protocol data format are used as indefinite-length fields;

[0047] When the last field of each secondary protocol data format is not a separator field, the last field of each secondary protocol data format is aligned. If the byte length of the last field of each secondary protocol data format after alignment is the same, the last field of each secondary protocol data format is used as a fixed-length field. Otherwise, the last field of each secondary protocol data format is used as an indefinite-length field.

[0048] In a possible design, the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data are used to perform mutation combination to generate fuzzy test data, including:

[0049] Based on the set mutation strategy, the fixed-length field and the variable-length field of the client data are mutated and replaced to obtain the replaced fixed-length field and the variable-length field, and the replaced fixed-length field and the variable-length field are combined with the separator field, the control value field and the fixed value field to obtain the fuzzy test data, wherein the mutation strategy includes:

[0050] A fixed-length field having a byte length of 1, 2, 4 or 8 bytes is replaced with a set value of 1, 2, 4 or 8 bytes, respectively, to obtain a fixed-length field after replacement;

[0051] For a fixed-length field and / or variable-length field with a byte length of u, a byte after replacement is randomly selected from a set of set replacement characters at intervals of v bytes to obtain a fixed-length field and / or variable-length field after replacement;

[0052] For a variable-length field whose byte length is w, its byte length is increased by a multiple to obtain a replaced variable-length field.

[0053] In a second aspect, a fuzzy testing system based on network protocol format inference is provided, including a data acquisition unit, a data extraction unit, a format inference unit, a data generation unit, a fuzzy testing unit and a comparison output unit, wherein:

[0054] A data collection unit, used to collect communication message data between the client and the tested end;

[0055] A data extraction unit, used to extract message data sent from the client to the tested end from the communication message data as client data, and to extract message data sent from the tested end to the client from the communication message data as tested end data;

[0056] A format inference unit, used to infer the network protocol format of the client data, and determine the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data;

[0057] A data generating unit, used for performing mutation combination using the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data to generate fuzzy test data;

[0058] The fuzzy test unit is used to send the fuzzy test data to the tested end, so that the tested end uses the fuzzy test data to perform message processing, obtain test response data, and receive the test response data fed back by the tested end;

[0059] The comparison output unit is used to compare and output the tested end data with the test response data.

[0060] Thirdly, a fuzz testing system based on network protocol format inference is provided, including:

[0061] A memory for storing instructions;

[0062] A processor is used to read the instructions stored in the memory and execute any one of the methods described in the first aspect according to the instructions.

[0063] In a fourth aspect, a computer-readable storage medium is provided, wherein instructions are stored on the computer-readable storage medium, and when the instructions are executed on a computer, the computer executes any one of the methods described in the first aspect. In addition, a computer program product is provided, and when the computer program product is executed on a computer, the computer executes any one of the methods described in the first aspect.

[0064] Beneficial effects: The present invention segments message data according to the common characteristics of the readability of existing network application layer protocols. In each segmented message data, the frequency characteristics of bytes are used to classify and hypothesize the sample message data. The three main characteristic analysis methods of structural similarity, data similarity and classification balance between fields in the same classification are used to recursively combine and derive the flag field. Based on the inferred protocol format characteristics, the fixed value field, control value field and separator field in the sample data remain unchanged, and the variable-length field and the fixed-length field are dynamically combined using a variety of mutation strategies to generate the final fuzzy test data. The fuzzy testing method based on protocol format feature inference and dynamic combination of sample mutation strategies solves the difficulties of manually reverse-analyzing the protocol format and the validity of fuzzy test data of unpublished network protocols in the fuzzy testing process to a certain extent, forms the methodology and foundation of the protocol format automatic inference tool, and achieves the purpose of effective fuzz testing of specific network protocol implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 This is a schematic diagram of the steps of the method in Example 1 of the present invention;

[0067] Figure 2 It is a schematic diagram of protocol data segmentation;

[0068] Figure 3 It is another schematic diagram of protocol data segmentation;

[0069] Figure 4 It is a schematic diagram of the principle of secondary inference of fixed-length fields and variable-length fields;

[0070] Figure 5 This is a schematic diagram of client data segmentation;

[0071] Figure 6 It is a schematic diagram of segmenting protocol data using a delimiter set;

[0072] Figure 7 A schematic diagram for extracting the composition of the first column of cell fields;

[0073] Figure 8 A schematic diagram for iteratively extracting the composition of the corresponding column unit fields;

[0074] Fig. 9 This is a schematic diagram of the actual secondary inference of the fixed-length field and the variable-length field in the example. DETAILED DESCRIPTION

[0075] It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. The specific structures and functional details disclosed herein are only used to describe the exemplary embodiments of the present invention. However, the present invention can be embodied in many alternative forms, and it should not be understood that the present invention is limited to the embodiments set forth herein.

[0076] It should be understood that unless otherwise clearly specified and limited, the corresponding terms should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be an electrical connection, a direct connection, an indirect connection through an intermediate medium, or the internal connection of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the embodiments can be understood according to specific circumstances.

[0077] In the following description, certain details are provided to facilitate a complete understanding of the example embodiments. However, it will be appreciated by those of ordinary skill in the art that the example embodiments may be implemented without these certain details. For example, devices may be shown in block diagrams to avoid obscuring the examples with unnecessary details. In other embodiments, well-known processes, structures, and techniques may not be shown in unnecessary detail to avoid obscuring the embodiments.

[0078] Embodiment 1:

[0079] This embodiment provides a fuzzy testing method based on network protocol format inference, which can be applied to corresponding fuzzy testing systems, such as Figure 1 As shown, the method comprises the following steps:

[0080] S1. Collect communication message data between the client and the tested end.

[0081] In specific implementation, a general network packet capture tool such as Wireshark can be used to capture the communication message data between the client and the tested end. The communication message data between the client and the tested end includes message data sent from the client to the tested end and message data sent from the tested end to the client.

[0082] S2. Extracting message data sent from the client to the tested end from the communication message data as client data, and extracting message data sent from the tested end to the client from the communication message data as tested end data.

[0083] In specific implementation, the communication message data is screened, and the message data sent from the client to the tested end is extracted from the communication message data as the client data, and the message data sent from the tested end to the client is extracted from the communication message data as the tested end data.

[0084] S3. Infer the network protocol format of the client data and determine the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data.

[0085] In specific implementation, a set separator set can be obtained, the separator set includes several separators, and the separator set is used to match each protocol data in the client data. If the character of a field in the protocol data is the same as any separator in the separator set, the field in the protocol data is used as the separator field. Then the protocol data is segmented by its separator field to obtain several sequentially arranged unit fields; the sequentially arranged unit fields are used to form a unit field row corresponding to the protocol data, and the unit field rows corresponding to each protocol data are used to form a unit field matrix, so that each row of the unit field matrix corresponds to a unit field row, and each column corresponds to the corresponding unit field column sorting; determine the field length of the unit field contained in each column of the unit field matrix, if the field length of each unit field in a column is the same, the unit field corresponding to the column in each protocol data is used as a fixed-length field, otherwise, the unit field corresponding to the column in each protocol data is used as an indefinite-length field.

[0086] Through the readability analysis of the existing network application layer protocol, the delimiters between protocol fields are usually 0x20, 0x0d0a, 0x3a, and the delimiter set G can be set to {0x20, 0x0d0a, 0x3a}; the client data is a multiple set K, which includes several protocol data K1, K2, K3, K4, K5...Kn; the set G can be used to segment the protocol data in the client data multiple set K, that is, to segment the data K1, K2, K3, K4, K5...Kn, such as Figure 2 The following is a schematic diagram of the corresponding protocol data segmentation. j Indicates the separator, g j ∈G, and j∈N, 1≤j≤m; R i,j represents the jth field of the i-th protocol data, and i∈N,1≤i≤n; let R n,m is the unit field matrix after segmentation, n represents the number of protocol data, and m represents the number of unit fields; determine R in the unit field matrix i,jThe length of the cell field. Based on the length of each cell field, we can get a length matrix L with n rows and m columns. n,m :

[0087]

[0088] When the length matrix L n,m Element L 1,j =L 2,j …=L n-1,j =L n,j , that is, the length of each unit field in the jth column is the same, and the jth field in the unit field matrix is ​​a fixed-length field, otherwise it is a variable-length field. When the set G cannot segment the protocol data in the multi-set K, the data format can be regarded as a field to enter the subsequent control value and fixed value field inference.

[0089] The protocol data is segmented by its delimiter field to obtain several sequentially arranged unit fields, such as Figure 3 The corresponding protocol data segmentation diagram is shown. Then, the unit fields arranged in sequence are used to form the unit field rows of the corresponding protocol data, and the unit field rows corresponding to each protocol data are used to form the unit field matrix R n,m , so that the unit field matrix R n,m Each row corresponds to a cell field row, and each column corresponds to the corresponding cell field column sorting. n represents the cell field matrix R n,m The number of rows, m represents the cell field matrix R n,m Define the cumulative variable r, and the cumulative step length of the cumulative variable r is 1, so that r represents the unit field matrix R n,m The column number is 1≤r≤m, and the initial value of r is 1; then:

[0090] A. Extract the cell field matrix R n,m The rth column unit field, each byte contained in each unit field in the rth column is used as a matrix element to construct the rth column byte matrix, the byte matrix contains A1-A h Column, K'1-K' n rows, n is the number of rows of the byte matrix, h is the number of columns of the byte matrix, and h is the maximum number of bytes in each cell field in the rth column.

[0091] B. A matrix element A of the byte matrix i,j Represents the jth byte of the byte unit in the i-th row, denoted by the multiset A j ={A 1,j ,A 2,j …A n,j}(When a cell field is empty, in A j(using null to represent null values in it), 1 ≤ i ≤ n, 1 ≤ j ≤ h, denote the multiset K' = {K'1, K'2 … K' n}.

[0092] C. Take the probability B that the byte corresponding to a certain matrix element A in the byte matrix appears in the j-th column of the byte matrix i,j as the occurrence probability element corresponding to the matrix element A i,j , B i,j = count(A i,j ) / n, when A i,j is a null value, the corresponding B i,j = 0, and traverse the occurrence probability elements of each matrix element in the byte matrix, and use the occurrence probability elements corresponding to each matrix element in the byte matrix to construct the probability matrix B i,j , where n,h when B

[0093]

[0094] in the probability matrix B n,h B 1,j = B 2,j … = B n-1,j = B n,j = 1, and 1 ≤ j ≤ h, determine that the j-th column byte in the byte matrix is a fixed-value byte. When multiple columns of fixed-value bytes in the byte matrix are adjacent, merge the adjacent multiple columns of fixed-value bytes as the fixed-value fields of each unit field in the r-th column. When there are no adjacent columns of fixed-value bytes in the byte matrix, use each single-column fixed-value byte as the fixed-value field of each unit field in the r-th column, and update the cumulative variable r by adding 1 and then iteratively execute the above steps A - C to determine the fixed-value fields of each column unit field in the unit field matrix R n,m .

[0095] D. Define the recurrence variable M, set M = 1, determine the maximum value b of each column B n,h in the probability matrix B i,j b = Max(B i,j ), and B i,j < M, take out the serial numbers j' of each column containing the maximum value b in the probability matrix B n,h to form the set J.

[0096] E. Take out the serial numbers j' of each column from the set J in turn, determine the column A j' in the byte matrix corresponding to j', and represent A j' as A j' = {p1 * a1, p2 * a2 … p t * a t}, where, 1 ≤ t ≤ n, a1, a2 … a t respectively represent the column A of the byte matrixj' Each byte element, p1, p2…p t They are byte elements a1, a2…a t The corresponding multiplicity is denoted by the multiset P = {p1, p2…p t}, multiset K' according to A j' Divided into t categories, denoted as k” = {K”1, K”2…K” t}, determine the maximum value p of the multiset P v , p v The corresponding category in K” is K″ v .

[0097] F. Set a type of row element K' i ∈K″ v , the second type of row elements And K' i ∈K',K' f ∈K', 1≤i≤n, 1≤f≤n, when in K″ v Each K' in the classification i When conditions 1, 2, and 3 are met, determine byte matrix column A j' The corresponding byte is the control value byte, where:

[0098] Condition 1 includes each type of row element K' i The average similarity between them is higher than that of each row element K' i and each second-class row element K' f The average similarity between any two row elements K' in K' i1 and K' i2 The similarity calculation formula between

[0099]

[0100]

[0101] Where Fa represents the similarity between two row elements, 1≤i1≤n, 1≤i2≤n, 1≤j1≤h, x, x1 and x2 represent the corresponding variables, and null represents that the corresponding variable is empty. Calculate each row element K' i The similarity between them gives a set of similarity values ​​(Fa)1, (Fa)2…(Fa) c1 , and c1=p v *(p v -1); a type of row element K' i The average similarity between Calculate each type of row element K' i and each second-class row element K' fThe similarity between them gives a set of similarity values ​​(Fa)1, (Fa)2…(Fa) c2 , and c2=p v *(np v ). Row element K' i With K' f The average similarity between When F' a ∈(0.5,1], and F' a >F″ a , then A j' As the control value byte, it meets the requirements of condition 1.

[0102] Condition 2 includes each type of row element K' i The field structure similarity between them is in the set structure similarity range, and the field structure similarity calculation formula is:

[0103]

[0104] Among them, K v By p v K' i Composition, and i'={z|z=i,K' i ∈K″ v}, represents the maximum value function, Fs represents the field structure similarity, and defines the structure similarity interval as (0.5, 1], if Fs∈(0.5,1], then A j' As a control value byte, it meets the requirements of condition 2.

[0105] Condition three includes K″1,K″2…K″ t There are t categories in total, and there is only one row element K' i The ratio of the number of categories to the total number of categories t is less than 0.5. There is only one row element K' i The formula for calculating the ratio of the number of categories to the total number of categories t is:

[0106]

[0107] When Ft∈[0,0.5), then A j' As the control value byte, it meets the requirements of condition three.

[0108] G. When there is a byte matrix column A j'When the corresponding byte is a control value byte, the recursive variable M=b is reset, and step DF is iteratively executed to determine the control value bytes of each column in the byte matrix. When multiple columns of control value bytes are adjacent in the byte matrix, the adjacent multiple columns of control value bytes are merged as the control value fields of each unit field in the rth column. When there are no adjacent column control value bytes in the byte matrix, the control value bytes of each single column are used as the control value fields of each unit field in the rth column.

[0109] H. When there is no byte matrix column A j' When the corresponding byte is a control value byte, the accumulated variable r is incremented by 1 and updated, and the above steps AG are iteratively executed to determine the unit field matrix R n,m The control value field for each column cell field in .

[0110] In determining the cell field matrix R n,m After the fixed value field and control value field of each column unit field are merged, the fixed value field and control value field of each column unit field are merged into the fixed-length field or variable-length field of the corresponding column unit field (after the fixed value field and control value field of each column unit field are merged into the fixed-length field or variable-length field of the corresponding column unit field, the original fixed-length field and variable-length field division result of the corresponding column unit field is eliminated, and the secondary inference division of the fixed-length field and the variable-length field needs to be re-performed later), and the merged column unit fields are recombined with the corresponding separator field to obtain the secondary protocol data format, such as Figure 4 The figure shows the secondary inference of fixed-length fields and variable-length fields. Format 1 corresponds to the first division of fixed-length fields and variable-length fields in each column unit field, and format 2 corresponds to the division of fixed value fields and control value fields in each column unit field, where the keyword field is the control value field, and format 3 is the secondary protocol data format field division result after merging and combining the separator field.

[0111] When performing secondary inference of fixed-length fields and variable-length fields, the field between any two of the fixed value field, the control value field, and the separator field in each secondary protocol data format is used as a secondary determination field. When the byte lengths of the secondary determination fields at the same field position in each secondary protocol data format are the same, the secondary determination fields at the same field position in each secondary protocol data format are used as fixed-length fields, otherwise, the secondary determination fields at the same field position in each secondary protocol data format are used as variable-length fields. When the last field of each secondary protocol data format is not a separator field, the last field of each secondary protocol data format is aligned. If the byte lengths of the last field of each secondary protocol data format after alignment are the same, the last field of each secondary protocol data format is used as a fixed-length field, otherwise, the last field of each secondary protocol data format is used as a variable-length field.

[0112] To facilitate understanding of the entire network protocol format inference process of client data, an example of the corresponding client data network protocol format inference process is provided:

[0113] (1) Inference data screening

[0114] A group of message data is classified according to the client data and the tested end data, and the client data K = {K1, K2...K10}, such as Figure 5 As shown, A1-A17 represent bytes of protocol data.

[0115] (2) Delimiter, fixed-length, and variable-length field inference

[0116] The format of the protocol data segmented using set G is as follows Figure 6 As shown in the figure, to distinguish the first and second fields, the second field uses the identifier C1-C7 instead of A1-A7. The protocol data is divided into two fields by the delimiter set G, A1-A8 bytes are one field, C1-C7 bytes are one field, G1 and G2 are delimiter fields. 10,2 For the segmented matrix, calculate R i,j The length of the field, resulting in a matrix L with 10 rows and 2 columns 10,2 :

[0117]

[0118] Because L 1,1 ≠L 2,1 …≠L 10,1 , L 1,2 ≠L 2,2 …≠L 10,2 Therefore, the two fields of the message data are both indefinite length fields.

[0119] (3) Control value and fixed value inference

[0120] T1 first inference (r=1):

[0121] Inference step 1: Get segmented message data

[0122] The segmented protocol data is taken out by field, that is, R 10,2 In the matrix, take out the data in the first column of the matrix, such as Figure 7 As shown, the unit field (byte) composition of the corresponding column field is defined, where the maximum byte length h = 8, and the multi-set A is recorded j ={A 1,j ,A 2,j …A 10,j}, 1≤j≤8, represents the jth unit field of the first field; multiset K' i, represents the i-th data of the first field, and the multi-set K'={K'1,K'2…K' 10}.

[0123] Calculate the probability of each cell field value appearing in column j and get the matrix B 10,8 as follows:

[0124]

[0125] By B i,j The value of K' is used to classify the control value and fixed value of the field. The inference process is as follows:

[0126] Inference step 2: Fixed value field inference

[0127] B 10,8 Element B in the matrix 1,1 =B 2,1 …=B 10,1 =1, the first byte is defined as a fixed value unit field.

[0128] Inference Step 3: Control Value Field Inference

[0129] Inference step 3 - recursion 1:

[0130] Calculate B i,j The maximum value b = 0.6, the matrix B 10,8 All the column numbers containing the maximum value b are taken out to obtain a set J={6} containing only one element. Assuming that the multiset A6 is a control value unit field, the values ​​of the elements in A6 are used to classify the elements in the multiset K'.

[0131] Inference step 3 - recursion 2:

[0132] Take j'=6 from the set J. A6 is also expressed as A6={6*0x12,2*0xd9,1*0xf8,1*null}, then t=4, multiset P={6,2,1,1}, and the corresponding multiset K' is divided into 4 categories according to A6, denoted as K"={K"1,K"2,K"3,K"4}. Get the maximum value p1=6 of the set P, and the corresponding category in K" is denoted as K'1'={K'1,K'2,K'3,K'4}. 7, ,K'9,K' 10}.

[0133] Determine whether condition 1 is met:

[0134] Calculate the elements K'1, K'2, K'5, K' 7, ,K'9,K' 10 The similarity between them, and 30 similarity values ​​are obtained (Fa)1...(Fa)30 ,as follows:

[0135]

[0136] Elements K'1, K'2, K'5, K' 7, ,K'9,K' 10 The average similarity between a =0.45. Therefore, A6 does not meet the requirements of condition 1 and cannot be used as a control value unit field. The assumption is not established. Whether conditions 2 and 3 are met is no longer calculated.

[0137] Inference step 3 - recursion 3:

[0138] There is only one element in set J, and no control value unit field meets the three conditions in inference step 3-recursion 2. Therefore, the first field of the protocol data does not have a control value field, and inference step 1 needs to be repeated.

[0139] T2 iterative inference (r=r+1):

[0140] Inference step 1: Extract the segmented protocol data

[0141] Remove R 10,2 The data in the second column of the matrix is ​​as follows: Figure 8 The definition field consists of unit fields (bytes), where the maximum byte length h = 7, and the multi-set A j ={A 1,j ,A 2,j …A 10,j}, 1≤j≤7, represents the jth unit field of the second field; multiset K' i , represents the i-th data of the second field, and the multi-set K'={K'1,K'2…K' 10}.

[0142] Calculate the probability of each cell field value appearing in column j and get the matrix B 10,7 as follows:

[0143]

[0144] By B i,j The value of K' is used to classify the control value and fixed value of the field. The inference process is as follows:

[0145] Inference step 2: Fixed value field inference

[0146] B 10,7 Matrix elements in formula B 1,j =B 2,j …=B 10,j=1 does not hold (j∈N,1≤j≤7), so there is no fixed value unit field in the second field.

[0147] Inference Step 3: Control Value Field Inference

[0148] Define recursion variable M=1.

[0149] Inference step 3 - recursion 1:

[0150] Calculate B i,j The maximum value b = 0.6, the matrix B 10,7 All the column numbers containing the maximum value b are taken out to obtain the set J = {1,4}. Assuming that the multisets A1 and A4 are control value unit fields, the values ​​of the elements in A1 and A4 are used to classify the elements in the multiset K'.

[0151] Inference step 3 - recursion 2:

[0152] Take the first element j'=1 from the set J. A1 is also represented by A1={4*0x00,6*0xff}, then t=2, the set P={4,6}, and the corresponding multiset K' is divided into 2 categories according to A1, denoted as K"={K"1,K"2}. Get the maximum value p2=6 of the set P, and the corresponding category in K" is denoted as K"2={K'2,K'4,K'6,K' 8, ,K'9,K' 10}.

[0153] Determine whether condition 1 is met:

[0154] Calculate elements K'2, K'4, K'6, K' 8, ,K'9,K' 10 The similarity between them, and 30 similarity values ​​are obtained (Fa)1...(Fa) 30 ,as follows:

[0155]

[0156] Elements K'2, K'4, K'6, K' 8, ,K'9,K' 10 The average similarity between a = 0.57. Calculate elements K'2, K'4, K'6, K' 8, ,K'9,K' 10 With K'1, K'3, K'5, K' 7, The similarity of , and 24 similarity values ​​are obtained, as follows:

[0157]

[0158] K'2,K'4,K'6,K'8, ,K'9,K' 10 With K'1, K'3, K'5, K' 7, The average similarity F″ a =0.08. Since F' a ∈(0.5,1], and F' a >F″ a , so A1 meets the requirements of condition 1.

[0159] Determine whether condition 2 is met:

[0160] The field structure similarity Fs≈0.92, Fs∈(0.5,1], so A1 meets the requirements of condition 2.

[0161] Determine whether condition 3 is met

[0162] In the classification K″1, K″2, there is only one element whose number is 0. According to the formula, Ft=0, Ft∈[0,0.5), so A1 meets the requirements of condition 3.

[0163] A1 meets all three conditions and can be used as a control value cell field.

[0164] Take the second element j'=4 from the set J. A4 is also represented as A4={4*0x00,6*0xff}, then t=2, the set P={4,6}, and the corresponding multiset K' is divided into 2 categories according to A4, denoted as K"={K"1,K"2}. Get the maximum value p2=6 of the set P, and the corresponding category in K" is denoted as K"2={K'2,K'4,K'6,K' 8, ,K'9,K' 10}.

[0165] Since the classification K" formed by A1 and A4 is exactly the same, it can be directly concluded that A4 meets the three conditions at the same time and can be used as a control value unit field. Combining the inference process of inference step 3-recursion 2, the inference conclusion is obtained: A1 and A4 can be used as control value unit fields.

[0166] Inference step 3 - recursion 3:

[0167] When all elements in set J are taken out and inference is completed, there are A1 and A4 as control value unit fields, which all meet the three conditions in inference step 3-recursion 2, so set the recursive variable M=0.6 and repeat the inference step 3 in the second inference.

[0168] Repeat - Inference Step 3: Control Value Field Inference

[0169] Inference step 3 - recursion 1:

[0170] Calculate B i,jThe maximum value b = 0.5, the matrix B 10,7 All the column numbers containing the maximum value b are taken out to obtain a set J={5} containing only one element. Assuming that the multiset A5 is a control value unit field, the values ​​of the elements in A5 are used to classify the elements in the multiset K'.

[0171] Inference step 3 - recursion 2:

[0172] Take j'=5 from the set J. A5 can also be expressed as A5={5*0x93,1*0xe3,1*0x92,1*0x43,1*0xf1,1*null}, then t=6, the multiset P={5,1,1,1,1,1}, and the corresponding multiset K' is divided into 6 categories according to A5, denoted as K"={K"1,K"2…K"6}. Get the maximum value p1=5 of the set P, and the corresponding category in K" is denoted as K"1={K'2,K'4,K'5,K' 6, ,K'8}.

[0173] Determine whether condition 1 is met:

[0174] The elements K'2, K'4, K'5, K' are calculated by the formula 6, , the average similarity between K'8 is F' a =0.59. K'2, K'4, K'5, K' 6, ,K'8 and K'1,K'3,K'7,K' 9, ,K' 10 The average similarity F″ a =0.16. Since F' a ∈(0.5,1], and F' a >F″ a , so A5 meets the requirements of condition 1.

[0175] Determine whether condition 2 is met:

[0176] The field structure similarity Fs≈0.86 is calculated by the formula, Fs∈(0.5,1], so A5 meets the requirements of condition 2.

[0177] Determine whether condition 3 is met

[0178] According to the formula, Ft = 5 / 6 ≈ 0.83, Therefore, A5 does not meet the requirement of condition 3.

[0179] Based on the inference process of the above inference step 3-recursion 2, the inference conclusion is obtained: A5 cannot be used as a control value unit field.

[0180] Inference step 3 - recursion 3:

[0181] All elements in set J have been taken out and inference has been completed. No cell field meets the three conditions in inference step 3-recursion 2. At the same time, R 10,2 All fields in the segmented matrix are also taken out to complete the inference, so the control value and fixed value field inference is completed.

[0182] Inference step 4: Merge adjacent control value cell fields

[0183] According to the above-mentioned inference process of T1 and T2, there are two control value unit fields in the protocol data, but their positions are not adjacent, so they do not need to be merged.

[0184] (4) Secondary inference of fixed-length and variable-length fields

[0185] By inferring the delimiter, fixed-length, and variable-length fields in the previous steps, the message format of the protocol data K1, K2, K3, K4, K5...K10 can determine its delimiter, fixed-length, and variable-length fields as follows: Fig. 9 The format 1 shown in FIG. 1, the control value and the fixed value field can be inferred to determine the fixed value and the control value field. Fig. 9 The format 2 shown in the figure, where the keyword field is the control value field. Combining format 1 and format 2, it can be inferred that the rough format of K1-K10 is as follows Fig. 9 Format 3 shown has a total of 8 fields: the 1st byte is a fixed value field, the 2nd to 8th bytes are variable-length fields, the 9th byte is a separator field, the 10th byte is a control value field, the 11th and 12th bytes are fixed-length fields, the 13th byte is a control value field, the 14th to 16th bytes are variable-length fields, and the 17th and 18th bytes are a separator field.

[0186] S4. Use the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data to perform mutation combinations to generate fuzzy test data.

[0187] In specific implementation, the fixed-length field and the variable-length field of the client data can be mutated and replaced based on the set mutation strategy to obtain the replaced fixed-length field and the variable-length field, and the replaced fixed-length field and the variable-length field are combined with the separator field, the control value field and the fixed value field to obtain the fuzzy test data, and the mutation strategy includes:

[0188] A fixed-length field with a byte length of 1, 2, 4 or 8 bytes is replaced with a set value of 1, 2, 4 or 8 bytes (such as the maximum and minimum values ​​of signed and unsigned numbers) to obtain a replaced fixed-length field.

[0189] For a fixed-length field and / or variable-length field with a byte length of u, every v bytes, a replacement character is randomly selected from a set of predefined replacement characters to replace the next byte, resulting in a replaced fixed-length field and / or variable-length field. That is, a replacement character is randomly selected from a set of predefined replacement characters to replace the s-th byte, resulting in a replaced fixed-length field and / or variable-length field, where s = i * (n ÷ v) + 1, i ∈ N, i < n ÷ v. Among them, the replacement characters should be representative special characters, which are converted to binary numbers through ASCII code and then used for replacement.

[0190] For a variable-length field with a byte length of w, its byte length is multiplied, that is, it is increased to p * w bytes, resulting in a replaced variable-length field.

[0191] The above three strategies can be combined and used on the same field according to the applicable conditions. By changing the values of p and v multiple times, multiple sets of fuzz test data are generated. When combining and using, control the number of values of variables p and v to avoid generating a large amount of fuzz test data, which may cause the fuzz test to be unexecutable.

[0192] S5. Send the fuzz test data to the device under test, so that the device under test uses the fuzz test data for message processing, obtains test response data, and receives the test response data fed back by the device under test.

[0193] In specific implementation, after generating the fuzz test data, the fuzz test data can be sent to the device under test, so that the device under test uses the fuzz test data for message processing, obtains test response data, and receives the test response data fed back by the device under test.

[0194] S6. Compare and output the data of the device under test and the test response data.

[0195] In specific implementation, the data of the device under test and the test response data can be compared and output to observe and compare the differences between the test response data returned by the device under test and the data of the device under test, so as to judge the impact of the fuzz test data on the device under test. When it is found that the test response data of the device under test is abnormal, the fuzz test data that causes the abnormality can be sent to the device under test again, and at the same time, open-source debugging tools such as WinDbg and GDB can be used to locate the problem location.

[0196] This method collects and screens the communication data of the target to be tested, and uses the method of gradually inferring the rough protocol format specification of the target to be tested at the application layer by recursively inferring and combining the features of each byte and each field, forming the methodology and basis of the protocol format automatic inference tool. To a certain extent, it solves the difficulties in manually reverse-analyzing the protocol format specification of unpublicized network protocols, and improves the efficiency of fuzz testing; at the same time, using the conclusion of the protocol format specification inference, determine the strategy of sample data mutation, generate fuzz test data, and achieve the purpose of effectively fuzz testing the specific network protocol implementation.

[0197] Embodiment 2:

[0198] This embodiment provides a fuzzy testing system based on network protocol format inference, including a data acquisition unit, a data extraction unit, a format inference unit, a data generation unit, a fuzzy testing unit and a comparison output unit, wherein:

[0199] A data collection unit, used to collect communication message data between the client and the tested end;

[0200] A data extraction unit, used to extract message data sent from the client to the tested end from the communication message data as client data, and to extract message data sent from the tested end to the client from the communication message data as tested end data;

[0201] A format inference unit, used to infer the network protocol format of the client data, and determine the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data;

[0202] A data generating unit, used for performing mutation combination using the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data to generate fuzzy test data;

[0203] The fuzzy test unit is used to send the fuzzy test data to the tested end, so that the tested end uses the fuzzy test data to perform message processing, obtain test response data, and receive the test response data fed back by the tested end;

[0204] The comparison output unit is used to compare and output the tested end data with the test response data.

[0205] Embodiment 3:

[0206] This embodiment provides a fuzzy testing system based on network protocol format inference, which includes:

[0207] Data interface, used to establish data connection between the processor and the client and the tested end;

[0208] A memory for storing instructions;

[0209] A processor is used to read the instructions stored in the memory and execute the fuzzy testing method based on network protocol format inference in Example 1 according to the instructions.

[0210] Optionally, the system further includes an internal bus, through which the processor, the memory and the data interface can be interconnected, and the internal bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0211] The memory may include, but is not limited to, random access memory (RAM), read only memory (ROM), flash memory, first input first output (FIFO) and / or first in last out (FILO) memory, etc. The processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0212] Embodiment 4:

[0213] This embodiment provides a computer-readable storage medium, on which instructions are stored, and when the instructions are executed on a computer, the computer executes the fuzzy testing method based on network protocol format inference in Embodiment 1. The computer-readable storage medium refers to a carrier for storing data, which may include but is not limited to a floppy disk, an optical disk, a hard disk, a flash memory, a USB flash drive and / or a memory stick, etc., and the computer may be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices.

[0214] This embodiment also provides a computer program product, which, when running on a computer, executes the fuzzy testing method based on network protocol format inference in Embodiment 1. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0215] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A fuzzy testing method based on network protocol format inference, characterized in that: include: Collect communication message data between the client and the tested end; Extracting message data sent from the client to the tested end from the communication message data as client data, and extracting message data sent from the tested end to the client from the communication message data as tested end data; Inferring the network protocol format of the client data, determining the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data; The fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data are used to perform mutation combination to generate fuzzy test data; Sending the fuzzy test data to the tested end, so that the tested end uses the fuzzy test data to perform message processing, obtains test response data, and receives the test response data fed back by the tested end; Compare and output the tested end data with the test response data.

2. The fuzz testing method based on network protocol format inference according to claim 1 is characterized in that: The client data includes a plurality of protocol data, and the network protocol format inference of the client data includes: Get a set separator set, the separator set includes a number of separators; The delimiter set is used to match each protocol data in the client data. If the character of a field in the protocol data is the same as any delimiter in the delimiter set, the field in the protocol data is used as the delimiter field.

3. The fuzzy testing method based on network protocol format inference according to claim 2 is characterized in that: The network protocol format inference of the client data includes: Segment the protocol data by its separator field to obtain a number of sequentially arranged unit fields; Using the sequentially arranged unit fields to form a unit field row corresponding to the protocol data, and using the unit field rows corresponding to each piece of protocol data to form a unit field matrix, so that each row of the unit field matrix corresponds to a unit field row, and each column corresponds to the corresponding unit field column order; Determine the field length of the unit fields contained in each column of the unit field matrix. If the field lengths of the unit fields in a column are the same, the unit fields corresponding to the column in each piece of protocol data are used as fixed-length fields. Otherwise, the unit fields corresponding to the column in each piece of protocol data are used as variable-length fields.

4. The fuzzy testing method based on network protocol format inference according to claim 2 is characterized in that: The network protocol format inference of the client data includes: Segment the protocol data by its separator field to obtain a number of sequentially arranged unit fields; The cell fields arranged in sequence are used to form the cell field rows corresponding to the protocol data, and the cell field rows corresponding to each piece of protocol data are used to form the cell field matrix R n,m , so that the unit field matrix R n,m Each row corresponds to a cell field row, and each column corresponds to the corresponding cell field column sorting. n represents the cell field matrix R n,m The number of rows, m represents the cell field matrix R n,m The number of columns; Define the cumulative variable r, and the cumulative step of the cumulative variable r is 1, so that r represents the unit field matrix R n,m The column number is 1≤r≤m, and the initial value of r is 1; A. Extract the cell field matrix R n,m The rth column unit field, each byte contained in each unit field in the rth column is used as a matrix element to construct the rth column byte matrix, the byte matrix contains A1-A h Column, K'1-K' n row, n is the number of rows of the byte matrix, h is the number of columns of the byte matrix, and h is the maximum number of bytes of each cell field in the rth column; B. A matrix element A of the byte matrix i,j Represents the jth byte of the byte unit in the i-th row, denoted by the multiset A j ={A 1,j ,A 2,j …A n,j }, 1≤i≤n, 1≤j≤h, let the multiset K'={K'1,K'2…K' n }; C. Add a matrix element A to the byte matrix i,j The probability B of the corresponding byte appearing in the jth column of the byte matrix i,j As the matrix element A i,j The corresponding occurrence probability elements are obtained, and the occurrence probability elements of each matrix element of the byte matrix are traversed, and the probability matrix B is constructed using the occurrence probability elements corresponding to each matrix element of the byte matrix n,h ,in When the probability matrix B n,h Medium B 1,j =B 2,j …=B n-1,j =B n,j =1, and 1≤j≤h, the j-th column byte in the byte matrix is ​​determined to be a fixed value byte. When multiple columns of fixed value bytes are adjacent in the byte matrix, the adjacent multiple columns of fixed value bytes are merged as the fixed value fields of each unit field in the r-th column. When there are no adjacent columns of fixed value bytes in the byte matrix, the fixed value bytes of each single column are used as the fixed value fields of each unit field in the r-th column, and the accumulated variable r is updated by 1 and the above steps AC are iteratively executed to determine the unit field matrix R n,m Fixed value field for each column cell field in .

5. The fuzzy testing method based on network protocol format inference according to claim 4 is characterized in that: The network protocol format inference of the client data includes: D. Define the recurrence variable M, set M = 1, and determine the probability matrix B n,h Each column of B i,j The maximum value b = Max(B i,j ), and B i,j < M, extract the sequence numbers j' of the columns in the probability matrix B n,h that contain the maximum value b, and form a set J; E. Take out the column numbers j' from the set J in turn and determine the byte matrix column A corresponding to j' j' , A j' Indicated as A j' ={p1*a1,p2*a2…p t *a t }, where 1≤t≤n, a1, a2…a t Respectively represent the byte matrix column A j' Each byte element, p1, p2…p t They are byte elements a1, a2…a t The corresponding multiplicity is denoted by the multiset P = {p1, p2…p t }, multiset K' according to A j' Divided into t categories, denoted by K” = {K″1, K″2…K″ t }, determine the maximum value p of the multiset P v , p v The corresponding category in K” is K″ v ; F. Set a type of row element K' i ∈K″ v , the second type of row elements And K' i ∈K',K' f ∈K', 1≤i≤n, 1≤f≤n, when in K″ v Each K' in the classification i When conditions 1, 2, and 3 are met, determine byte matrix column A j' The corresponding byte is the control value byte, where: Condition 1 includes each type of row element K' e The average similarity between them is higher than that of each row element K' i and each second-class row element K' f The average similarity between any two row elements K' in K' i1 and K' i2 The similarity calculation formula between Among them, Fa represents the similarity between two row elements, 1≤i1≤n, 1≤i2≤n, 1≤j1≤h, x, x1 and x2 represent the corresponding variables, and null represents that the corresponding variable is empty. Condition 2 includes each type of row element K' i The field structure similarity between them is in the set structure similarity range, and the field structure similarity calculation formula is: Among them, K v By p v K' i Composition, and i'={z|z=i,K' i ∈K″ v }, represents the maximum value function, Fs represents the field structure similarity, Condition 3 includes K'1', K'2'...K' t 'There are t categories in total, and there is only one row element K' i The ratio of the number of categories to the total number of categories t is less than 0.5; G. When there is a byte matrix column A j' When the corresponding byte is a control value byte, the recursive variable M=b is reset, and step DF is iteratively executed to determine the control value bytes of each column in the byte matrix. When multiple columns of control value bytes are adjacent in the byte matrix, the adjacent multiple columns of control value bytes are merged as the control value fields of each unit field in the rth column. When there are no adjacent column control value bytes in the byte matrix, the control value bytes of each single column are used as the control value fields of each unit field in the rth column. H. When there is no byte matrix column A j' When the corresponding byte is a control value byte, the accumulated variable r is incremented by 1 and updated, and the above steps AG are iteratively executed to determine the unit field matrix R n,m The control value field for each column cell field in .

6. The fuzzy testing method based on network protocol format inference according to claim 5 is characterized in that: The network protocol format inference of the client data includes: In determining the cell field matrix R n,m After the fixed value field and the control value field of each column unit field are merged, the fixed value field and the control value field of each column unit field are merged into the fixed-length field or the variable-length field of the corresponding column unit field, and the merged column unit fields are recombined with the corresponding separator field to obtain the secondary protocol data format; The field between any two of the fixed value field, the control value field and the separator field in each secondary protocol data format is used as a secondary determination field; When the byte lengths of the secondary determination fields at the same field position in each secondary protocol data format are the same, the secondary determination fields at the same field position in each secondary protocol data format are used as fixed-length fields; otherwise, the secondary determination fields at the same field position in each secondary protocol data format are used as indefinite-length fields; When the last field of each secondary protocol data format is not a separator field, the last field of each secondary protocol data format is aligned. If the byte length of the last field of each secondary protocol data format after alignment is the same, the last field of each secondary protocol data format is used as a fixed-length field. Otherwise, the last field of each secondary protocol data format is used as an indefinite-length field.

7. The fuzzy testing method based on network protocol format inference according to claim 6 is characterized in that: The method of utilizing the fixed-length field, the variable-length field, the separator field, the control value field and the fixed value field of the client data to perform mutation combination to generate fuzzy test data includes: Based on the set mutation strategy, the fixed-length field and the variable-length field of the client data are mutated and replaced to obtain the replaced fixed-length field and the variable-length field, and the replaced fixed-length field and the variable-length field are combined with the separator field, the control value field and the fixed value field to obtain the fuzzy test data, wherein the mutation strategy includes: A fixed-length field having a byte length of 1, 2, 4 or 8 bytes is replaced with a set value of 1, 2, 4 or 8 bytes, respectively, to obtain a fixed-length field after replacement; For a fixed-length field and / or variable-length field with a byte length of u, a byte after replacement is randomly selected from a set of set replacement characters at intervals of v bytes to obtain a fixed-length field and / or variable-length field after replacement; For a variable-length field whose byte length is w, its byte length is increased by a multiple to obtain a replaced variable-length field.

8. A fuzzy testing system based on network protocol format inference, characterized in that: It includes a data acquisition unit, a data extraction unit, a format inference unit, a data generation unit, a fuzzy test unit and a comparison output unit, wherein: A data collection unit, used to collect communication message data between the client and the tested end; A data extraction unit, used to extract message data sent from the client to the tested end from the communication message data as client data, and to extract message data sent from the tested end to the client from the communication message data as tested end data; A format inference unit, used to infer the network protocol format of the client data, and determine the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data; A data generating unit, used for performing mutation combination using the fixed-length field, variable-length field, separator field, control value field and fixed value field of the client data to generate fuzzy test data; The fuzzy test unit is used to send the fuzzy test data to the tested end, so that the tested end uses the fuzzy test data to perform message processing, obtain test response data, and receive the test response data fed back by the tested end; The comparison output unit is used to compare and output the tested end data with the test response data.

9. A fuzzy testing system based on network protocol format inference, characterized in that: include: A memory for storing instructions; A processor is used to read the instructions stored in the memory and execute the fuzz testing method based on network protocol format inference described in any one of claims 1-7 according to the instructions.

10. A computer program product, characterized in that When the computer program product runs on a computer, the fuzz testing method based on network protocol format inference described in any one of claims 1 to 7 is executed.

Images