Cloud platform fuzzy test method and system based on protocol template

Abstract

The invention discloses a cloud platform fuzzy testing method and system based on a protocol template, and relates to the technical field of fuzzy testing. The method comprises the following steps: starting a fuzz test session on a host testboard system by using a fuzz test client; automatically generating a protocol template by capturing an initial communication exchange between the streaming client device and the cloud platform system to identify a plurality of primitives; starting a streaming client device; starting an online service session with the cloud platform system by using the fuzzy test client; an initial setup communication between a streaming client device and a cloud platform system is fuzz-tested. According to the method, the stability and the safety of the cloud platform service protocol under various abnormal conditions can be comprehensively evaluated through automatic generation and updating of the protocol template and mutation fuzzy testing of primitive sequences and contents, developers are helped to find and repair potential vulnerabilities in advance, and the development efficiency of the cloud platform service protocol is improved. It is ensured that the cloud platform can deal with various abnormal conditions in actual operation, and a safer and more reliable service environment is provided.

Description

Technical Field

[0001] The present invention relates to the technical field of fuzz testing, and in particular to a cloud platform fuzz testing method and system based on a protocol template. Background Art

[0002] Cloud platforms are provided by one or more hosting servers, and users access these services through client devices. Client devices connect to the cloud platform's hosting servers through local networks and the Internet. In cloud platforms, users rely on fast and accurate communication with the hosting servers to ensure efficient and timely service delivery and user experience. For example, if there is a delay or interruption in the communication of cloud services, it may cause service interruption or delayed response, which is often referred to as a "buffered" state. In the buffered state, the user's operation will be suspended, or the response time will increase significantly, and the user experience will be seriously affected. Buffering can be caused by interruptions in the network or data loss between the hosting server and the client device, especially when the network connection is unstable during data transmission. These communication errors and buffered states are situations that any cloud platform needs to avoid.

[0003] To prevent these problems, the cloud platform's services and communications must be thoroughly tested, especially in the face of network outages, data loss, or other anomalies. By simulating and identifying different communication errors, it is possible to ensure that the cloud platform can maintain reliability and stability in a real environment. However, conducting these tests is not simple, especially in a complex cloud platform architecture, and testing requires a lot of time and resources. To this end, we propose a cloud platform fuzz testing method and system based on protocol templates. Summary of the invention

[0004] The purpose of the present invention is to provide a cloud platform fuzzy testing method and system based on protocol templates, which can solve the communication stability and security problems between various service protocols in the cloud platform, especially when the protocol primitive sequence and protocol content are maliciously modified or interfered with, it can effectively identify potential vulnerabilities and communication errors, and ensure the stable operation of the system and data security.

[0005] According to the first aspect of the present invention, in order to achieve the above-mentioned purpose, the present invention provides the following technical solution: a cloud platform fuzzy testing method based on a protocol template, comprising the following steps:

[0006] Use the fuzz testing client to start a fuzz testing session on the host testbed system;

[0007] Automatically generate a protocol template by capturing the initial communication exchange between the streaming client device and the cloud platform system to identify multiple primitives;

[0008] Start the streaming client device;

[0009] Use the fuzz testing client to initiate an online service session with the cloud platform system;

[0010] Fuzz testing of initial setup communications between streaming client devices and cloud platform systems;

[0011] Perform mutation fuzz testing on the initial setup communication between the streaming client device and the cloud platform system, use the data stream interceptor to test the intercepted streaming data between the streaming client device and the cloud platform system, and identify and correct the root cause of the failure based on the test results;

[0012] Therein, a change in the network protocol coupling the streaming client device and the cloud platform system is received, resulting in restarting the automatically generated protocol template to make the change.

[0013] Furthermore, a protocol template is automatically generated by capturing the initial communication exchange between the streaming client device and the cloud platform system to identify multiple primitives, as follows:

[0014] (405) Activate streaming client device;

[0015] (410) initiating a session between the client device and the cloud platform system, wherein initiating the session includes a plurality of initiation processes, each initiation process including a portion of an initial communication exchange between the activated streaming client device and the cloud platform system;

[0016] (415) using a data stream interceptor to monitor and capture initial communication exchanges between a streaming client device and a cloud platform system;

[0017] (420) analyzing the captured initial communication exchange to identify primitives that can be used to generate a network protocol template;

[0018] (425) Generate a protocol template;

[0019] (430) saving the protocol template;

[0020] (435) Determine whether the protocol template has changed. If so, repeat steps (410) to (430).

[0021] Furthermore, the initial setup communication between the streaming client device and the cloud platform system is fuzz tested as follows:

[0022] (505) The streaming client device sends a first message to the streaming server, and fills the data of the first message into the protocol template byte by byte from left to right;

[0023] (510) The streaming client device receives a second message from the streaming server, the second message including the first Cookie;

[0024] (515) The streaming client device sends the first cookie back to the streaming server, performing the exchange of the first cookie to verify whether the streaming client device is actively communicating with the streaming server and listening for a response from the streaming server;

[0025] (520) Select a test primitive;

[0026] (525) defining the arrangement of primitives based on primitive types;

[0027] (536) The streaming server receives the ambiguous message;

[0028] (537) Capture the stream server's response to the ambiguous message;

[0029] (538) determining the current state of the streaming server, and storing the fuzzy message generated corresponding to the state in a fuzzy test result database;

[0030] (540) selecting a subsequent permutation of the primitive and issuing a subsequent fuzzy test message, and repeating steps (520) to (538) to iterate until all permutations of the primitive are exhausted;

[0031] (545) Select the next primitive and repeat steps (520) to (540) until all primitives of the message have been fuzz tested and sent;

[0032] (550) receiving subsequent messages, and repeating steps (520) to (545) to perform iterative fuzzy testing on the subsequent messages until all messages have been subjected to the generated fuzzy test;

[0033] (560) Reporting generated fuzz testing results for identifying vulnerabilities and errors in the cloud platform system;

[0034] (565) Analyze a generation of fuzz test failures to determine the root cause;

[0035] (570)Correct identified root causes.

[0036] Furthermore, mutation fuzz testing is performed on the initial setup communication between the streaming client device and the cloud platform system, and the intercepted streaming data between the streaming client device and the cloud platform system is tested using a data stream interceptor. The root cause of the failure is identified and corrected based on the test results, as follows:

[0037] (605) Start the streaming client device;

[0038] (610) initiating a session between the client device and the cloud platform system, which also includes establishing a bidirectional streaming data session between the client device and the streaming server;

[0039] (615) starting a data stream interceptor and inserting the data stream interceptor between the client device and the streaming server;

[0040] (620) a data stream interceptor intercepts a portion of the stream data from one of the client devices or one of the stream servers;

[0041] (625) analyzing the first captured message to identify a corresponding primitive contained in the first captured message, and selecting a test primitive;

[0042] (630) Select mutations of primitives;

[0043] (635) Create a modified obscured portion of the stream data;

[0044] (640) sending the modified obfuscated portion of the streaming data to a target receiver, the target receiver being a client device or a streaming server;

[0045] (645) The target receiver receives;

[0046] (650) The target receiver responds to the stream data captured by the mutation and determines the current state of the client device;

[0047] (655) determining the current state of the target receiver, and storing the flow data captured by the mutation corresponding to the state in the generated mutation fuzzy test result database;

[0048] (670) using the data stream interceptor to capture subsequent messages from the stream data, and repeating steps (620) to (655) to test the subsequent messages until all captured stream data have been subjected to the modification fuzz test;

[0049] (680) Report mutation fuzz testing results to identify vulnerabilities and errors in cloud platform systems;

[0050] (685) Analyze mutational fuzz testing failures on streaming data to determine the root cause and correct the identified root cause.

[0051] According to a second aspect of the present invention, the present invention provides a cloud platform fuzzy testing system based on a protocol template, which is used to implement the above-mentioned cloud platform fuzzy testing method based on a protocol template, including:

[0052] A cloud platform system including one or more cloud servers for providing cloud services, one or more hosting servers for hosting online service sessions, a streaming server for streaming data to client devices, and a storage server for storing cloud platform data;

[0053] Host test bench system, including:

[0054] Fuzz testing client, used to automate testing sessions on cloud platform systems;

[0055] A decoding library to identify primitives describing the current protocol of the test session;

[0056] A fuzz testing module, for building a protocol template using primitives identified by the decoding library, generating fuzz testing data for the current protocol for the cloud platform system and performing fuzz testing on the primitives;

[0057] A data flow interceptor, used to intercept cloud platform data packets of data flows during a session;

[0058] The mutation fuzzy test module is used to generate mutation fuzzy test data from the intercepted cloud platform data packets. The generated mutation fuzzy data is based on the data obtained by the decoding library and mutated according to the test requirements;

[0059] a data communication network, coupling the host testbed system with the cloud platform system through a fuzz testing API, and a data stream interceptor intercepting cloud platform data packets from data communications between the cloud platform system and a streaming client device of the host testbed system;

[0060] Among them, changing the current protocol to another protocol will cause the generated fuzzy test module to automatically update the protocol template to another protocol template.

[0061] Furthermore, the hosting server includes a plurality of virtual machines and one or more virtual machine managers, and the virtual machine managers are connected to the virtual machines using a network connection to activate power supplies of the virtual machines.

[0062] Furthermore, the storage server includes one or more storage devices, and the storage device is configured as a hard disk drive, a solid state drive or an optical drive.

[0063] Further, during the fuzz testing, the streaming client device is connected with the streaming server and the cloud server to automate the data streaming process;

[0064] The fuzz testing client connects with the streaming server and the cloud server to obtain user credentials before conducting fuzz testing.

[0065] Furthermore, the data stream interceptor is coupled to the stream server via a data communication network.

[0066] Furthermore, the streaming client device is a virtual streaming client device instantiated on a host test bed system, and is used to simulate a cloud platform user terminal device.

[0067] The present invention has at least the following beneficial effects:

[0068] The present invention can comprehensively evaluate the stability and security of cloud platform service protocols under various abnormal situations through automatic generation and updating of protocol templates and mutation fuzzy testing of primitive order and content, help developers discover and fix potential vulnerabilities in advance, ensure that the cloud platform can cope with various abnormal situations in actual operation, and provide a safer and more reliable service environment.

[0069] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 is a flow chart of a fuzzy testing process of a fuzzy testing system according to an embodiment of the present invention;

[0071] Figure 2 is a flow chart of a fuzzy testing system generating a protocol template according to an embodiment of the present invention;

[0072] Figure 3 is a flow chart of a fuzzy testing method of a fuzzy testing system according to an embodiment of the present invention;

[0073] Figure 4 is a flow chart of a method for mutation fuzzy testing of a fuzzy testing system according to an embodiment of the present invention;

[0074] Figure 5 It is a simplified cloud platform system described in an embodiment of the present invention;

[0075] Figure 6 It is a simplified fuzzy testing system framework described in an embodiment of the present invention. DETAILED DESCRIPTION

[0076] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0077] The present invention can automatically generate and update protocol templates, evaluate the protocol parsing capabilities of cloud platform servers and clients through fuzzy testing, and detect the response performance of the system when encountering abnormal data flows, specifically including the following steps:

[0078] 1. Generate an agreement template

[0079] By capturing the initial communication exchange between the cloud platform server and the client, a protocol template of the current service protocol is automatically generated. The protocol template includes a description of each primitive in the service protocol (such as data packet header, command field, data segment, etc.) and their arrangement order. The protocol template can identify each primitive in the communication process and its correct arrangement order as the basis for subsequent fuzz testing.

[0080] 2. Primitive order detection and protocol changes

[0081] Based on the protocol template, the test system can identify and record the order of arrangement of protocol primitives. The test tool will simulate changes in the order of primitives in the protocol, such as incorrectly swapping the positions of primitives or losing certain primitives, to check whether the system can identify and correctly handle these changes. The test system can also automatically update the protocol template according to protocol changes to ensure the adaptability and correctness of the protocol template when the cloud platform service agreement changes.

[0082] 3. Generate fuzz test data

[0083] According to the primitive information identified in the protocol template, fuzzy test data is used to perform mutation fuzz testing on the protocol primitives through the fuzzy test module. The test tool can simulate malicious or erroneous data input, such as modifying the primitive content, changing the primitive order, adding redundant fields, etc., to detect the robustness of the cloud platform in processing abnormal data. The generated fuzzy test data can be used to test the stability and security of the cloud platform under different network conditions.

[0084] 4. Data flow interception and data flow mutation

[0085] The cloud platform stream data interceptor is used to intercept the data stream between the cloud platform client and the server. After the stream data is captured, the test system performs mutation operations on the data, changes the primitive order and data content in the data packet, and simulates various communication abnormalities. Through the mutation fuzzy test module 214, the test system can verify the system's processing ability when encountering abnormal stream data, ensuring that it can remain stable and secure under malicious attacks or network failures.

[0086] 5. Fuzz testing results analysis and feedback

[0087] During the fuzz testing process, the system monitors and analyzes the test results in real time, capturing error information when the system processes abnormal data, such as protocol parsing failure, crash, or data leakage. By analyzing the current fuzz testing status, the system can identify the root cause of the failure and provide feedback to help developers fix related vulnerabilities.

[0088] 6. Automated fuzz testing loop

[0089] This system supports automated fuzz testing cycles. After each protocol template update or protocol change, the test system will automatically adjust the fuzz testing module, regenerate new fuzz testing data and perform continuous testing. This process ensures that when any changes occur in the cloud platform service protocol, the system can automatically adapt and perform corresponding security verification.

[0090] Embodiment 1:

[0091] See also Figure 1 The present invention provides a technical solution: a cloud platform fuzzy testing method based on a protocol template, comprising the following steps:

[0092] 305. Start a fuzz testing session on the host test bed system 201 using the fuzz testing client CLI 201A202;

[0093] 310. Automatically generate a protocol template by capturing the initial communication exchange between the streaming client device 222A and the cloud platform system 100 to identify multiple primitives, such as Figure 2 As shown, the details are as follows:

[0094] (405) Activate streaming client device 222A;

[0095] (410) initiating a session between the client device and the cloud platform system 100, wherein initiating the session includes a plurality of initiation processes, each of which includes a portion of an initial communication exchange between the activated streaming client device 222A and the cloud platform system 100, such initial communication exchange is bidirectional between the activated client device and the cloud platform system 100, and such initial handshake exchange may also be performed between multiple parts of the cloud platform system 100, for example, between the activated client device and the cloud server 130, and between the cloud server 130 and the hosting server 114;

[0096] (415) using the data stream interceptor 212 to monitor and capture the initial communication exchange between the streaming client device 222A and the cloud platform system 100;

[0097] (420) analyzing the captured initial communications to identify primitives that can be used to generate a network protocol template;

[0098] (425) Generate a protocol template;

[0099] (430) saving the protocol template;

[0100] (435) determining whether the protocol template has changed, and if so, repeating steps (410) to (430);

[0101] Specifically, for each protocol, message information is collected. This information may include a tag indicating the type of protocol message, the amount of original, unmodified message data, and state information associated with the message, including source / destination address / port and timestamp information. This data is collected, serialized, and then written to the protocol template file.

[0102] However, when the network protocol changes as identified in operation 435, a new protocol template is required, and as described above, the operation is returned to 410 and continued downward. If the network protocol has never changed, the operation can end;

[0103] And obtaining the data flow template may include one or more of a plurality of operations. In one implementation, the data flow template may be manually generated, or the data flow template may be retrieved from a previous record;

[0104] 315. Start the streaming client device 222A;

[0105] 320. Use the fuzz testing client CLI 201A202 to start an online service session with the cloud platform system 100;

[0106] 325. Perform fuzz testing on initial setup communication between streaming client device 222A and cloud platform system 100: The streaming client device 222A and / or other client devices 122A, 122B and the cloud platform system (e.g., cloud service 130, hosting server 114, and streaming server 118) are fuzz tested using fuzz testing module 204 of fuzz testing client 202, using the initial setup communication as the generated fuzz testing data, which is tested by fuzz testing module, such as Figure 3 As shown, the details are as follows:

[0107] (505) The client device 222A, 122A, 122B sends a first message to the streaming server 118, where the first message is an initialization message of the streaming protocol, and fills the data of the first message into the protocol template byte by byte from left to right;

[0108] (510) The client device 222A, 122A, 122B receives a second message from the streaming server 118, the second message including the first cookie;

[0109] (515) The client device 222A, 122A, 122B sends the first cookie back to the streaming server 118, performing an exchange of the first cookie for verifying that the client device 222A, 122A, 122B is actively communicating with the streaming server and listening to the response of the streaming server; a portion of the streaming data between the streaming server 118 and the client device is captured as a captured portion of the streaming data, and mutation fuzz testing can be performed on the captured portion of the streaming data;

[0110] (520) Selecting a test primitive. The fuzz testing engine reads the protocol template and begins iterating over the primitives. In one implementation, the selection criteria for the permutations to be used are sorted and determined by a permutation list defined in the fuzzing library. The permutations used will vary depending on the type of primitive. In one implementation, the permutation list includes approximately 140 integer permutations and over 1000 string permutations. Permutations can be selected to cause anomalous behavior. For example, the selected permutations can focus on boundary conditions based on primitive length or other aspects of the primitive.

[0111] (525) defining the arrangement of primitives based on primitive types. For byte types, the fuzz testing engine 205 selects values ​​that may trigger boundary conditions in the tested software and hardware, including 0, 1, 2, 254, 255, etc. For example, if the fuzz testing engine 205 iterates and selects "254" as the arrangement;

[0112] (536) Streaming server 118 receives the ambiguous message;

[0113] (537) capturing the response of the stream server 118 to the fuzzy message and generating a fuzzy test to detect parsing errors in the stream protocol module, which will cause instability in the services provided by the cloud platform;

[0114] (538) determining the current state of the streaming server 118, and storing the generated fuzzy message corresponding to the state in the generated fuzzy test result database for future reference and analysis;

[0115] (540) selecting a subsequent permutation of the primitive and issuing a subsequent fuzzy test message, and repeating steps (520) to (538) to iterate until all permutations of the primitive are exhausted;

[0116] (545) Select the next primitive and repeat steps (520) to (540) until all primitives of the message have been fuzz tested and sent;

[0117] (550) receiving subsequent messages, and repeating steps (520) to (545) to perform iterative fuzzy testing on the subsequent messages until all messages have been subjected to the generated fuzzy test;

[0118] (560) The results of generating the fuzz testing results database may be reported to one or more users or test automation frameworks to identify vulnerabilities and errors in the cloud platform system 100;

[0119] (565) Analyze a generation of fuzz test failures to determine the root cause;

[0120] (570) Correct identified root causes;

[0121] 330. Perform mutation fuzz testing on the initial setup communication between the streaming client device 222A and the cloud platform system 100, using the data stream interceptor 212 to intercept the streaming data between one of the client devices 122A, 122B, 222A and the streaming server 118, and the mutation fuzz testing module 214 to modify the data stream data, and identify and correct the root cause of the failure based on the test results, such as Figure 4 As shown, the details are as follows:

[0122] wherein a change in the network protocol coupling the streaming client device 222A and the cloud platform system 100 is received, resulting in restarting the automatically generated protocol template to make the change;

[0123] Figure 4 The method 310 performed by the fuzz testing system 200 when automatically generating the protocol template 204A is described. In operation 405, the client device is activated. In operation 410, a session between the client device and the cloud platform system is initiated. Starting a session can include multiple startup processes. Each startup process includes a portion of an initial communication exchange between the activated client device and the cloud platform system. This initial communication exchange is bidirectional between the activated client device and the cloud platform system. This initial handshake exchange can also be performed between multiple parts of the cloud platform system. For example, between the activated client device and the cloud service 130, and between the cloud service 130 and the hosting server 114.

[0124] In operation 415, the initial communication is monitored and captured by the data flow interceptor 212. In operation 420, the captured initial communication is analyzed to identify primitives that can be used to generate the network protocol template 204A. In operation 425, the protocol template 204A is generated and then saved or stored in operation 430. Once the protocol template 204A is available, the above Figure 3 The method operations described in . For each protocol, message information is collected. This information can include a tag indicating the type of protocol message, the amount of original, unmodified message data, and state information associated with the message, including source / destination address / port and timestamp information. This data is collected, serialized, and then written to the protocol template file.

[0125] However, when the network protocol changes as identified in operation 435, a new protocol template 204A is needed, and the operation is continued downwards back to 410 as described above. If the network protocol has never changed, the operation can end;

[0126] (605) Start the streaming client device 222A;

[0127] (610) initiating a session between the client device and the cloud platform system 100, which also includes establishing a bidirectional streaming data session between the client device and the streaming server 118;

[0128] (615) starting the data stream interceptor 212 and inserting the data stream interceptor 212 between the client device and the stream server 118, so that the stream data flowing bidirectionally between the client device and the stream server 118 passes through the data stream interceptor 212;

[0129] (620) the data stream interceptor 212 intercepts a portion of the stream data from one of the client devices or one of the stream servers 118, the intercepted message may contain any number of stream data packets;

[0130] (625) analyzing the first captured message to identify a corresponding primitive contained in the first captured message, and selecting a test primitive;

[0131] (630) Selecting a mutation of a primitive, the mutation fuzz testing module 214 selects a primitive to be tested using mutation fuzz testing, the mutation fuzz testing module 214 will test the captured message to determine whether the captured message is to be changed, and if the captured message is to be changed, the change fuzz testing module will create a mutated captured message in operation 635;

[0132] (635) Create a modified obscured portion of the stream data;

[0133] (640) sending the modified obfuscated portion of the streaming data to a target receiver, which is either a client device or a streaming server 118: sending the mutated captured message to the originally intended recipient, the modified message to be forwarded by the data stream interceptor 212 to the client device if the captured message was sent by the streaming server to the client device; or, if the captured message was sent by the client device to the streaming server, the modified captured message to be forwarded by the data stream interceptor 212 to the streaming server;

[0134] (645) The target receiver receives;

[0135] (650) the target receiver responds to the stream data captured by the mutation and determines the current state of the client device: the mutation fuzz testing detects vulnerabilities that may cause instability of cloud platform services by querying the intended receiver using a stream client application programming interface to capture the intended receiver's response to the stream data captured by the mutation and respectively determine the current state of the client device;

[0136] (655) determining the current state of the target receiver, and storing the flow data captured by the mutation corresponding to the state in the generated mutation fuzzy test result database;

[0137] (670) using the data stream interceptor 212 to capture subsequent messages from the stream data, and repeating steps (620) to (655) to test the subsequent messages until all captured stream data have been subjected to the modification fuzz test;

[0138] (680) Reporting mutation fuzz testing results: reporting the results of the mutation fuzz testing results database to one or more users or test automation frameworks to identify vulnerabilities and errors in the cloud platform system 100;

[0139] (685) Analyze mutational fuzz testing failures on streaming data to determine the root cause and correct the identified root cause.

[0140] Embodiment 2:

[0141] This embodiment provides a cloud platform fuzzy testing system based on a protocol template, which is used to implement the cloud platform fuzzy testing method based on a protocol template described in the first embodiment, including:

[0142] The cloud platform system 100 includes one or more cloud servers 130 for providing cloud services, one or more hosting servers 114 for hosting online service sessions, a streaming server 118 for streaming data to client devices, and a storage server 110 for storing cloud platform data;

[0143] The host test bench system 201 includes:

[0144] A fuzz testing client 202 for automating a test session of the cloud platform system 100;

[0145] Decode library 216 for identifying primitives describing the current protocol of the test session;

[0146] A fuzz testing module 204 for constructing a protocol template 204A using primitives identified by a decoding library 216, generating fuzz testing data for the current protocol for the cloud platform system 100 and performing fuzz testing on the primitives;

[0147] A data flow interceptor 212, for intercepting cloud platform data packets of the data flow during the session;

[0148] The mutation fuzzy test module 214 is used to generate mutation fuzzy test data from the intercepted cloud platform data packets, and the generated mutation fuzzy data is based on the data obtained by the decoding library 216 and mutated according to the test requirements;

[0149] The data communication network 208A couples the host test bed system 201 with the cloud platform system 100 via a fuzz testing API, and the data stream interceptor 212 intercepts cloud platform data packets from data communications between the cloud platform system 100 and a streaming client device 222A of the host test bed system 201;

[0150] Among them, changing the current protocol to another protocol will cause the generated fuzzy test module to automatically update the protocol template to another protocol template.

[0151] Figure 5 It is a simplified cloud platform system 100, including one or more servers 130 providing cloud services, one or more hosting servers 114 (for hosting online service sessions), a streaming server 118 (for streaming data to client devices 122A, 122B) and a storage server 110 for storing cloud platform data. The hosting server 114 includes multiple virtual machines 112A-n and one or more virtual machine managers 113.

[0152] The cloud server 130, the hosting server 114, the streaming server 118, and the storage server 110 may be located in one or more data centers 111, 115, 117 and connected via local networks 104A, 104B, 104C and / or the Internet 102, and combinations thereof, and the virtual machine manager 113 connects to the virtual machines 112A-n using a network connection 115A for activating power to the virtual machines.

[0153] The local storage server 116 may store online data 116A for use or receipt by the plurality of virtual machines 112A-n and / or the cloud server 130 and / or the streaming server 118 .

[0154] The cloud server 130 also includes an authorization manager 135, which determines whether a user has a valid account and access to the cloud platform system 100. The user's account information is contained in the user account database 133. The authorization manager 135 accesses the user account database 133 to retrieve and store user account data as needed to determine the current account status and authorization of a given user.

[0155] The storage server 110 is a storage facility of the cloud platform system 100. The storage server 110 includes one or more storage devices 110A and 110B for storing data. The one or more storage devices 110A and 110B may be any suitable storage medium, such as a hard disk drive, a solid state drive, or an optical drive.

[0156] The client devices 122A, 122B provide users with access to the cloud platform system 100 via the Internet 102 and / or local networks 104A-C.

[0157] Figure 6 It is a simplified fuzz testing system framework, including a fuzz testing client 202, a data stream interceptor 212 and a streaming client device 222A. The fuzz testing client 202, the data stream interceptor 212 and the streaming client device 222A are included in the host test bed system 201. In one implementation, the fuzz testing client 202 can be instantiated through the fuzz testing client CLI 201A.

[0158] During fuzz testing, a virtualized streaming client device 222A may be used to interface with the streaming server 118 and the cloud server 130 to automate the data streaming process, with the cloud server 130 responsible for the operation and management of the streaming server 118, including user authorization, hosting, and streaming server assignment for a given client device.

[0159] The streaming client device 222A is coupled to the data stream interceptor 212 via the data communications network 208A, and the data stream interceptor 212 is coupled to the streaming server 118 via the data communications network 208B.

[0160] The fuzz testing client 202 connects with the cloud server 130 and the streaming server 118 to obtain appropriate user credentials before conducting fuzz testing. For mutation testing, the fuzz testing client 202 starts the streaming client device 222A and connects with the data stream interceptor 212 to set up each mutation fuzz testing case. The cloud server 130 provides account management for the cloud platform system. A user registers an account to uniquely identify himself to the cloud platform system. The user's credentials can identify the user and the cloud services that the user is authorized to use. In one implementation, after authorizing the user by verifying that the user credentials correspond to a valid user account, the user can select the cloud service they want to use. The cloud server 130 then determines whether the user is allowed to use the selected cloud service. Next, the cloud server 130 performs server locking to assign the identified streaming server to the selected cloud service and user account. The server lock is synchronized between the cloud service 130 authorization of the streaming session and the client device actually starting the streaming session with the streaming server.

[0161] The cloud server 130 provides an authorization token for starting a new streaming session. The streaming client device 222A is a client device of the data streaming protocol and is one of the components tested by the fuzz test. The streaming server 118 is also tested by the fuzz test system 200.

[0162] The fuzz testing engine 205 uses the protocol template 204A to generate test data, which is modified from the data expected under normal operation. This modified test data is called generated fuzzy input, and the generated fuzzy input is then applied to the cloud platform system under test (e.g., cloud server 130, hosting server 114, and streaming server 118).

[0163] Typically, the protocol template 204A is generated manually, for example by an operator of the host test bench system 201 by manually analyzing the network protocol under test and manually identifying all individual building blocks of the network protocol as separate fuzz testing primitives, such as strings, integers, Boolean values, etc., and their groups. When the network protocol changes, the operator of the host test bench system 201 typically manually recreates a new protocol template or template 204A.

[0164] The decoding library 206 describes the network protocol according to the fuzz testing primitives, and then calls the decoding library 206 for decoding on the real-time data stream session between the streaming server 118, the cloud server 130 and the client devices 222A, 122A, 122B. The decoding fuzz testing engine 207 automatically generates a protocol template 204A, which includes fuzz testing primitives, data packet sorting and status information. The fuzz testing module 204 receives the generated protocol template 204A and uses the fuzz testing engine 205 to generate fuzz testing input for fuzz testing the streaming server 118, the cloud server 130 and the client devices 222A, 122A, 122B.

[0165] Mutation-based fuzz testing provides an intermediate agent that can intercept session packets and change the intercepted packets according to specific fuzz testing requirements. The data stream interceptor 212 provides the intermediate agent. Bidirectional messages from the client device 222A or the actual client devices 122A, 122B and the server 118 are intercepted and processed by the data stream interceptor. The processing may include other fuzz testing modules, including the data stream decoding library 216 and the mutation fuzz testing module 214. Then, the intercepted and possibly modified packets are sent to their original destination, for example, the streaming client device 222A and / or the streaming server 118. The data stream interceptor 212 is a protocol-aware transparent proxy that can intercept the session, modify selected bytes of the protocol and pass the modified packets to the original destination, thereby providing fuzz testing capabilities for the client device 222A and the hosting server 118.

[0166] The data stream decoding library 216 parses and re-encodes the protocol messages intercepted by the data stream interceptor from the two-way communication between the streaming client device 222A and the streaming server 118. The protocol messages are decomposed into a set of building blocks and primitives, such as strings, integers, Boolean values, etc., and their groups, which can be accessed, modified or used for mutation by the mutation fuzz testing module 214 individually. The data stream decoding library 216 includes a data stream decoding fuzz testing engine 217. The data stream decoding library 216 decodes the protocol messages and decomposes the protocol messages into fuzz testing primitives. The fuzz testing primitives are defined in the data stream decoding fuzz testing engine 217. The mutation fuzz testing module 214 provides logic on how to change the intercepted data packets, and defines rules on which parts of the data packets are changed and how to perform these changes.

[0167] The mutation fuzz testing module 214 provides a variety of test cases for the streaming client device 222A and the streaming server 118 , and the mutation fuzz testing module 214 also provides a packet mutation function for the data stream interceptor 212 .

[0168] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0169] For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to the specific circumstances. When an element is referred to as being "assembled on", "installed on", "fixed on" or "set on" another element, it can be directly on the other element or there can also be a centered element. When an element is considered to be "connected" to another element, it can be directly connected to the other element or there may be a centered element at the same time. The terms "vertical", "horizontal", "up", "down", "left", "right" and similar expressions used herein are only for illustrative purposes and are not intended to be the only implementation method.

[0170] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

[0171] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

Claims

1. A cloud platform fuzz testing method based on a protocol template, characterized in that: The following steps are involved: Use the fuzz testing client to start a fuzz testing session on the host testbed system; Automatically generate a protocol template by capturing the initial communication exchange between the streaming client device and the cloud platform system to identify multiple primitives; Start the streaming client device; Use the fuzz testing client to initiate an online service session with the cloud platform system; Fuzz testing of initial setup communications between streaming client devices and cloud platform systems; Perform mutation fuzz testing on the initial setup communication between the streaming client device and the cloud platform system, use the data stream interceptor to test the intercepted streaming data between the streaming client device and the cloud platform system, and identify and correct the root cause of the failure based on the test results; Therein, a change in the network protocol coupling the streaming client device and the cloud platform system is received, resulting in restarting the automatically generated protocol template to make the change.

2. The cloud platform fuzzy testing method based on protocol template according to claim 1 is characterized in that: The protocol template is automatically generated by capturing the initial communication exchange between the streaming client device and the cloud platform system to identify multiple primitives, as follows: (405) Activate streaming client device; (410) initiating a session between the client device and the cloud platform system, wherein initiating the session includes a plurality of initiation processes, each initiation process including a portion of an initial communication exchange between the activated streaming client device and the cloud platform system; (415) using a data stream interceptor to monitor and capture initial communication exchanges between a streaming client device and a cloud platform system; (420) analyzing the captured initial communication exchange to identify primitives that can be used to generate a network protocol template; (425) Generate a protocol template; (430) saving the protocol template; (435) Determine whether the protocol template has changed. If so, repeat steps (410) to (430).

3. The cloud platform fuzzy testing method based on protocol template according to claim 2 is characterized in that: Fuzz testing of the initial setup communications between the streaming client device and the cloud platform system, as follows: (505) The streaming client device sends a first message to the streaming server, and fills the data of the first message into the protocol template byte by byte from left to right; (510) the streaming client device receives a second message from the streaming server, the second message including the first cookie; (515) The streaming client device sends the first Cookie back to the streaming server, performing an exchange of the first Cookie for verifying that the streaming client device is actively communicating with the streaming server and listening for a response from the streaming server; (520) Select a test primitive; (525) defining the arrangement of primitives based on primitive types; (536) The streaming server receives the ambiguous message; (537) Capture the stream server's response to the ambiguous message; (538) determining the current state of the streaming server, and storing the fuzzy message generated corresponding to the state in a fuzzy test result database; (540) selecting a subsequent permutation of the primitive and issuing a subsequent fuzzy test message, and repeating steps (520) to (538) to iterate until all permutations of the primitive are exhausted; (545) Select the next primitive and repeat steps (520) to (540) until all primitives of the message have been fuzz tested and sent; (550) receiving subsequent messages, and repeating steps (520) to (545) to perform iterative fuzzy testing on the subsequent messages until all messages have been subjected to the generated fuzzy test; (560) Reporting generated fuzz testing results for identifying vulnerabilities and errors in the cloud platform system; (565) Analyze a generation of fuzz test failures to determine the root cause; (570)Correct identified root causes.

4. The cloud platform fuzzy testing method based on protocol template according to claim 3 is characterized in that: Perform mutation fuzz testing on the initial setup communication between the streaming client device and the cloud platform system. Use the data stream interceptor to test the intercepted streaming data between the streaming client device and the cloud platform system. Identify and correct the root cause of the failure based on the test results, as follows: (605) Start the streaming client device; (610) initiating a session between the client device and the cloud platform system, which also includes establishing a bidirectional streaming data session between the client device and the streaming server; (615) starting a data stream interceptor and inserting the data stream interceptor between the client device and the streaming server; (620) a data stream interceptor intercepts a portion of the stream data from one of the client devices or one of the stream servers; (625) analyzing the first captured message to identify a corresponding primitive contained in the first captured message, and selecting a test primitive; (630) Select mutations of primitives; (635) Create a modified obscured portion of the stream data; (640) sending the modified obfuscated portion of the streaming data to a target receiver, the target receiver being a client device or a streaming server; (645) The target receiver receives; (650) The target receiver responds to the stream data captured by the mutation and determines the current state of the client device; (655) determining the current state of the target receiver, and storing the flow data captured by the mutation corresponding to the state in the generated mutation fuzzy test result database; (670) using the data stream interceptor to capture subsequent messages from the stream data, and repeating steps (620) to (655) to test the subsequent messages until all captured stream data have been subjected to the modification fuzz test; (680) Report mutation fuzz testing results to identify vulnerabilities and errors in cloud platform systems; (685) Analyze mutational fuzz testing failures on streaming data to determine the root cause and correct the identified root cause.

5. A cloud platform fuzzy testing system based on a protocol template, used to implement the cloud platform fuzzy testing method based on a protocol template as described in any one of claims 1 to 4, characterized in that: include: A cloud platform system including one or more cloud servers for providing cloud services, one or more hosting servers for hosting online service sessions, a streaming server for streaming data to client devices, and a storage server for storing cloud platform data; Host test bench system, including: Fuzz testing client, used to automate testing sessions on cloud platform systems; A decoding library to identify primitives describing the current protocol of the test session; A fuzz testing module, for building a protocol template using primitives identified by the decoding library, generating fuzz testing data for the current protocol for the cloud platform system and performing fuzz testing on the primitives; A data flow interceptor, used to intercept cloud platform data packets of data flows during a session; The mutation fuzzy test module is used to generate mutation fuzzy test data from the intercepted cloud platform data packets. The generated mutation fuzzy data is based on the data obtained by the decoding library and mutated according to the test requirements; a data communication network, coupling the host testbed system with the cloud platform system through a fuzz testing API, and a data stream interceptor intercepting cloud platform data packets from data communications between the cloud platform system and a streaming client device of the host testbed system; Among them, changing the current protocol to another protocol will cause the generated fuzzy test module to automatically update the protocol template to another protocol template.

6. The cloud platform fuzzy testing system based on protocol template according to claim 5 is characterized in that: The hosting server includes a plurality of virtual machines and one or more virtual machine managers. The virtual machine managers are connected to the virtual machines using a network connection to activate power supplies of the virtual machines.

7. The cloud platform fuzzy testing system based on protocol template according to claim 6 is characterized in that: The storage server includes one or more storage devices, and the storage device is configured as a hard disk drive, a solid state drive or an optical drive.

8. The cloud platform fuzzy testing system based on protocol template according to claim 7 is characterized in that: The streaming client device is connected with the streaming server and the cloud server during the fuzz testing to automate the data streaming process; The fuzz testing client connects with the streaming server and the cloud server to obtain user credentials before conducting fuzz testing.

9. The cloud platform fuzzy testing system based on protocol template according to claim 8, characterized in that: The data stream interceptor is coupled to the stream server via a data communication network.

10. The cloud platform fuzzy testing method based on protocol template according to claim 9 is characterized in that: The streaming client device is a virtual streaming client device instantiated on a host test bed system, and is used to simulate a cloud platform user terminal device.

Images