Network protocol fuzz testing system based on enhanced context information

Abstract

The present invention relates to the technical field of software security detection, and specifically discloses a network protocol fuzz testing system based on enhanced context information. The system comprises: an enhanced context information module for acquiring state information and seed information, and enhancing the context information by instrumenting adjacent call instructions; a state selection module for selecting a target state for fuzz testing according to a LinUCB selection algorithm, wherein the LinUCB selection algorithm derives the target state based on the state's context vector and reward; and a seed selection module for selecting a target seed for fuzz testing according to a ternary seed selection algorithm. The ternary seed selection algorithm extracts a seed label, execution information, and session information from each seed in a seed pool to calculate a seed value, and then derives a target seed based on the seed value. The present invention can improve the coverage of fuzz testing.

Description

Technical Field

[0001] The present invention relates to the technical field of software security detection, and in particular to a network protocol fuzzy testing system based on enhanced context information. Background Art

[0002] With the development of the internet, network protocols have played a vital role, ensuring the integrity, reliability, and confidentiality of data during communication. However, as network protocols have become widely used, the programs that carry them have gradually become exposed. These vulnerabilities pose a serious threat to the security of data transmission. For example, in 2017, a vulnerability in the SMB protocol program led to the global spread of ransomware. Therefore, to prevent vulnerabilities in network protocol programs, we urgently need a technology that can effectively discover such programs. Today, network protocol fuzz testing has become a mainstream technology. Thanks to its lightweight, convenient, and efficient advantages, vulnerability discovery can reveal effective program vulnerabilities without high labor costs.

[0003] AFLNET, a currently popular network protocol fuzzing system, breaks down test cases into message sequences and sends them sequentially to the service under test (SUT) via a socket. The state response codes returned by the SUT are then converted into state sequences corresponding to the message sequences. Network protocol gray-box fuzzing combines the state response codes from all state sequences into a state union. The elements in this union and their relationships constitute a state machine. Each state in the state machine maintains a seed pool containing all seeds that can reach that state. The state machine and seed pool are updated online. Whenever an interesting test case is generated, the state machine and the corresponding seed pool are learned and updated in real time. A stateful network protocol gray-box fuzzing system differs from traditional gray-box fuzzing systems in that it first selects a target state from the state machine and then selects seeds from the seed pool for that state. AFLNET then uses the target state to determine the infix message sequence in the target seed to generate new variants as test cases, continuously exploring unknown branches of the SUT.

[0004] However, AFLNET has limitations in its state and seed selection process, specifically as follows: 1) The existing contextual information lacks metrics that intuitively predict new branches. This lack limits the system's ability to identify potential new paths in dynamic environments, reducing overall test coverage. The lack of effective predictive metrics makes it difficult for AFLNET to prioritize states and seeds that are likely to trigger new paths. 2) The state selection process fails to consider the exploration and exploitation of states. This deficiency leads to an over-focus on specific states during state space exploration, neglecting other potentially valuable states, thus compromising test comprehensiveness. The lack of a mechanism to balance exploration and exploitation can lead to the omission of critical paths, reducing the probability of discovering potential vulnerabilities. 3) The exclusive use of a single type of contextual information in seed selection results in a one-sided seed value. This simplistic approach fails to fully utilize diverse contextual information, limiting the effectiveness of seeds in triggering complex behaviors and boundary conditions. This one-sided seed value can lead to insufficient test coverage and an inability to fully assess the robustness and safety of the SUT under different scenarios. Summary of the Invention

[0005] The purpose of the present invention is to provide a network protocol fuzzy testing system based on enhanced context information to solve the above technical problems.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A network protocol fuzz testing system based on enhanced context information, including:

[0008] An enhanced context information module is used to obtain state information and seed information, and enhance context information by instrumenting adjacent call instructions in the trace. The context information refers to various feedback data and runtime information obtained by the network protocol fuzz testing system through continuous monitoring, collection, and analysis of the test program's behavior. The adjacent call instruction instrumentation refers to inserting call instruction analysis code during the network protocol program compilation phase to obtain the number of call instructions adjacent to the execution trace when the program is running;

[0009] a state selection module for selecting a target state for fuzz testing according to a LinUCB selection algorithm, wherein the LinUCB selection algorithm derives the target state based on a context vector and a reward of the state;

[0010] The seed selection module is used to select the target seed for fuzz testing based on the ternary seed selection algorithm; the ternary seed selection algorithm extracts the seed label, execution information and session information from each seed in the seed pool to calculate the seed value, and then derives the target seed based on the seed value.

[0011] As a further solution of the present invention: in the enhanced context information module,

[0012] The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional successor basic block Call instruction analysis code; the conditional successor basic block Call instruction analysis code includes a basic block number, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the basic block number;

[0013] The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes;

[0014] The subsequent associated conditional basic block code includes the associated subsequent basic block number, the shared memory Succ_Map, and the number M of Call instructions that call non-system functions and library functions in the associated subsequent basic block; the subsequent associated conditional basic block code stores the number M in Succ_Map[m], where m represents the subsequent basic block number;

[0015] The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

[0016] As a further solution of the present invention: the context vector of the state refers to evaluating the exploration value of the state from the state branch prediction, the seed generation ability of the state, the quality of the seed pool of the state, the execution depth of the state and the degree of state correlation;

[0017] The reward of the state is to give a reward score for the performance of the state in the fuzzy test, which is used to evaluate the utilization value of the state; the performance of the state is determined by the state transfer ability of the state in the fuzzy test and the number of state discovery paths.

[0018] As a further solution of the present invention: the state branch prediction PP refers to the ability of the state to find a unique path when the state is selected, and its calculation formula is:

[0019] ;

[0020] Among them, C p Indicates the number of unique paths found in the past for a state, N st Indicates the number of times a state is selected, N p Indicates the number of seeds in the seed pool in the state, C (tac,y)An indicator representing the number of adjacent Call instructions in the execution trace of seed y;

[0021] The seed generation capacity SG of a state refers to the number of test cases that reach the state and are converted into seeds. Its calculation formula is:

[0022] ;

[0023] Among them, C p Indicates the number of unique paths found in the past for a state, N s Indicates the number of times the state is accessed during the fuzz testing process, N p The number of seeds in the seed pool at the current state;

[0024] The seed pool quality SQ of a state represents the ability of the seeds in the seed pool to find a unique path, and its calculation formula is:

[0025] ;

[0026] Among them, C p Indicates the number of unique paths found in the past for a state, C (tac,y) Indicates the number of adjacent Call instructions in the execution trace of seed y, N p The number of seeds in the seed pool at the current state;

[0027] The state execution depth ED represents the state depth inferred from the execution time during the SUT execution process, and its calculation formula is:

[0028] ;

[0029] Among them, T ae represents the average time it takes to execute a seed once, T ape represents the average execution time of the seed prefix message sequence;

[0030] The state association SA represents the number of state transitions and reflects the diversity of seeds in the state. Its calculation formula is:

[0031] ;

[0032] Among them, D i and D o represent the number of transitions from the other states to a state and the number of transitions from a state to the other states respectively;

[0033] The context vector v of the state is constructed as follows:

[0034] ;

[0035] Where T represents the transpose of the matrix;

[0036] The reward calculation formula is:

[0037] ;

[0038] Among them, r represents the reward of the state, δ represents the weight coefficient of the number of tendency paths or state transitions, and C tp Indicates the number of paths that trigger the test state, C op Indicates the number of paths that trigger other states, C tr Indicates the number of times the test state is triggered, C or Indicates the number of times other states are triggered; the test state refers to the next state triggered by the original seed that triggers the target state, and the other state refers to the next state of the target state triggered by the test case generated by the original seed and is not a test state.

[0039] As a further solution of the present invention: in the state selection module, the process of determining the target state specifically includes:

[0040] Calculate the confidence upper bound of each state, the calculation formula is:

[0041] ;

[0042] Among them, p s Indicates the confidence upper bound when the state is s, A s represents the covariance matrix when the state is s, b s Represents the cumulative state reward vector when the state is s, v s Represents the context vector when the state is s, α represents the exploration weight factor, and T represents the transpose of the matrix;

[0043] The state corresponding to the highest confidence upper bound is taken as the target state s t , and its calculation formula is:

[0044] ;

[0045] Among them, S represents the set of states;

[0046] The covariance matrix A is initialized with a 5*5 identity matrix, and when the target state s t After being selected for testing, the context vector is used to calculate the updated covariance matrix A', which is calculated as follows:

[0047] ;

[0048] Indicates that the state is the target state s t The covariance matrix when , Indicates that the state is the target state s t The context vector at time ;

[0049] The cumulative state reward vector is initialized with a 5*1 zero vector, and when the target state s t After being selected for testing, the new cumulative state reward vector is calculated using the state reward and context vector , and its calculation formula is:

[0050] ;

[0051] in, Indicates that the state is the target state s t The cumulative state reward vector at time .

[0052] As a further solution of the present invention: the seed value is mainly exponentially calculated based on partial execution information and session information as the base and the seed label as the exponent, and decreases as resource consumption increases during fuzz testing. The seed value index is determined based on whether the seed in the seed label has been tested, whether it is liked, whether it is generated in the current state, and whether new edges have been discovered;

[0053] The base value of the seed is determined based on the feedback information generated during the execution of the seed protocol program and the information impact generated during the communication between the seed and the protocol program.

[0054] As a further solution of the present invention: in the seed selection module, the calculation formula of the seed value is:

[0055] ;

[0056] Among them, value represents the seed value, b represents the base of the seed value, p represents the exponent of the seed value, and ε represents the exponential weight of reducing the seed value. represents the mean execution time of all seeds in the seed pool, B lp 、N ss and T e They represent whether the seed is lost during transmission, the number of times the candidate subsequence of the seed is selected, and the execution time of the seed; when the seed is lost during transmission, B lp =1, when there is no packet loss during seed transmission, B lp =0;

[0057] The calculation formula of the base number b of the seed value is:

[0058] ;

[0059] Among them, C tacIndicates the number of adjacent Call instructions in the execution trace, N e represents the number of edges in the execution trace of the seed, C h Indicates the number of state transition hits of the seed; is the average number of state transition hits of all seeds, is the average number of edges in the execution traces of all seeds;

[0060] The formula for calculating the seed value index p is:

[0061] ;

[0062] Among them, the tag set composed of seed tags , li represents the i-th element in the tag set, n represents the total number of elements in the tag set, B cov 、B fr 、B sg 、B pd They respectively indicate whether the seed has found a unique edge, whether the seed has a favorite path in the current fuzz test round, whether the seed is generated in the current state, and whether the candidate subsequence of the seed is used for fuzz testing. k is the number of labels in the label set, μ and β are the minimum threshold and minimum index value of the label set respectively. When the seed has found a unique edge, then B cov =1, when the seed has not found a unique edge, then B cov = 0; when the seed has a favorite path in the current fuzzing round, B fr = 1, when the seed does not have a favorite path in the current fuzzing round, B fr =0; when the seed is generated in the current state, B sg =1, when the seed is not generated in the current state, B sg = 0; when the candidate subsequence of the seed is used for fuzz testing, B pd =1; when the candidate subsequence of the seed is not used for fuzz testing, B pd =0.

[0063] The present invention enhances the richness of contextual information by introducing a metric for the number of adjacent call instructions within a trajectory. It also employs the LinUCB state selection algorithm and a ternary feature seed selection algorithm to improve fuzz testing coverage. The state selection process uses the LinUCB state selection algorithm to address the exploration and utilization issues between states, improving the effectiveness of the target state. Seed selection uses a comprehensive calculation of seed value based on tags, execution information, and session information, exploring seed potential. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] The present invention will be further described below with reference to the accompanying drawings.

[0065] Figure 1 It is a flow chart of the network protocol fuzzy testing system based on enhanced context information of the present invention;

[0066] Figure 2 It is a flow chart of extracting the number of adjacent Call instructions of a trajectory according to the present invention;

[0067] Figure 3 It is a schematic diagram of the experimental results of the present invention testing the branch coverage of PureFTPD over time. DETAILED DESCRIPTION

[0068] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0069] See also Figure 1-2 As shown, the present invention is a network protocol fuzz testing system based on enhanced context information, comprising:

[0070] An enhanced context information module is used to obtain state information and seed information, and enhance context information by instrumenting adjacent call instructions in the trace. The context information refers to various feedback data and runtime information obtained by the network protocol fuzz testing system through continuous monitoring, collection, and analysis of the test program's behavior. The adjacent call instruction instrumentation refers to inserting call instruction analysis code during the network protocol program compilation phase to obtain the number of call instructions adjacent to the execution trace when the program is running;

[0071] In a preferred embodiment of the present invention, in the enhanced context information module,

[0072] The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional successor basic block Call instruction analysis code; the conditional successor basic block Call instruction analysis code includes a basic block number, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the basic block number;

[0073] The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes;

[0074] The subsequent associated conditional basic block code includes the associated subsequent basic block number, the shared memory Succ_Map, and the number M of Call instructions that call non-system functions and library functions in the associated subsequent basic block; the subsequent associated conditional basic block code stores the number M in Succ_Map[m], where m represents the subsequent basic block number;

[0075] The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

[0076] It should be noted that, first, the system will pre-test the external initial seeds and pass the test feedback information to the enhanced information module;

[0077] The enhanced information module will process the feedback information and generate state information and seed information. Since the SUT has been instrumented in advance, the feedback information contains unprocessed runtime data. The enhanced information module will process these unprocessed runtime data and extract enhanced context information, which is mainly divided into two categories: state information and seed information. The information contained in the state information is not limited to the state itself, such as the number of times the state is accessed, the number of times the state is selected, etc., but also includes the seed pool information under the state, such as the number of seeds in the seed pool, etc. The seed information includes seed tags, seed execution information, and session information, etc., which are used to describe the characteristics of a single seed. The enhanced information module enhances the seed execution information and adds the number of adjacent Call instructions in the execution trace. The number of adjacent Call instructions in the execution trace is mainly extracted through the Call instruction instrumentation code;

[0078] The Call instruction stub code is divided into a conditional basic block Call instruction stub code and a conditional successor basic block Call instruction stub code; the conditional successor basic block Call instruction stub code includes a basic block number n, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction stub code forms a "[n,N]" stub in order to store the number N in Cur_Map[n]; the conditional basic block Call instruction stub code is composed of a plurality of successor associated conditional basic block codes; the successor associated conditional basic block code includes an associated successor basic block number m, a shared memory Succ_Map, and the number M of Call instructions that call non-system functions and library functions in the associated successor basic block; the successor associated conditional basic block code forms a "(m,M)" stub in order to store the number M in Succ_Map[m]; the number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map. The valuable elements in the Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in the Cur_Map is zero. After the stub is inserted in a certain protocol program, the control flow of the stub is partially inserted as follows Figure 2 As shown. Figure 2 In the example, when the execution trajectory is A->B->D->G, the corresponding shared memory Cur_Map and Succ_Map are updated in real time. Subsequently, by analyzing the value of the shared memory, the system can determine that the number of adjacent Call instructions in the execution trajectory A->B->D->G is 2 (Succ_Map[1] +Succ_Map[4]).

[0079] In another preferred embodiment of the present invention, the context vector of the state refers to evaluating the exploration value of the state from state branch prediction, state seed generation capability, state seed pool quality, state execution depth, and state correlation degree;

[0080] The reward for the state is to give a reward score to the state's performance in the fuzz test, which is used to evaluate the state's utilization value; the performance of the state is determined by the state's state transition ability and the number of state discovery paths in the fuzz test;

[0081] In a preferred embodiment of this invention, the state branch prediction PP refers to the ability of the state to find a unique path when the state is selected. The calculation formula is:

[0082] ;

[0083] Among them, C p Indicates the number of unique paths found in the past for a state, N st Indicates the number of times a state is selected, Np Indicates the number of seeds in the seed pool in the state, C (tac,y) An indicator representing the number of adjacent Call instructions in the execution trace of seed y;

[0084] The seed generation capacity SG of a state refers to the number of test cases that reach the state and are converted into seeds. Its calculation formula is:

[0085] ;

[0086] Among them, C p Indicates the number of unique paths found in the past for a state, N s Indicates the number of times the state is accessed during the fuzz testing process, N p The number of seeds in the seed pool at the current state;

[0087] The seed pool quality SQ of a state represents the ability of the seeds in the seed pool to find a unique path, and its calculation formula is:

[0088] ;

[0089] Among them, C p Indicates the number of unique paths found in the past for a state, C (tac,y) Indicates the number of adjacent Call instructions in the execution trace of seed y, N p The number of seeds in the seed pool at the current state;

[0090] The state execution depth ED represents the state depth inferred from the execution time during the SUT execution process, and its calculation formula is:

[0091] ;

[0092] Among them, T ae represents the average time it takes to execute a seed once, T ape represents the average execution time of the seed prefix message sequence;

[0093] The state association SA represents the number of state transitions and reflects the diversity of seeds in the state. Its calculation formula is:

[0094] ;

[0095] Among them, D i and D o represent the number of transitions from the other states to a state and the number of transitions from a state to the other states respectively;

[0096] The context vector v of the state is constructed as follows:

[0097] ;

[0098] Where T represents the transpose of the matrix;

[0099] The reward calculation formula is:

[0100] ;

[0101] Among them, r represents the reward of the state, δ represents the weight coefficient of the number of tendency paths or state transitions, and C tp Indicates the number of paths that trigger the test state, C op Indicates the number of paths that trigger other states, C tr Indicates the number of times the test state is triggered, C or Indicates the number of times other states are triggered; the test state refers to the next state triggered by the original seed that triggers the target state, and the other state refers to the next state of the target state triggered by the test case generated by the original seed and is not a test state;

[0102] It is worth noting that in the state selection module, the process of determining the target state specifically includes:

[0103] Calculate the confidence upper bound of each state, the calculation formula is:

[0104] ;

[0105] Among them, p s Indicates the confidence upper bound when the state is s, A s represents the covariance matrix when the state is s, b s Represents the cumulative state reward vector when the state is s, v s Represents the context vector when the state is s, α represents the exploration weight factor, and T represents the transpose of the matrix;

[0106] The state corresponding to the highest confidence upper bound is taken as the target state s t , and its calculation formula is:

[0107] ;

[0108] Among them, S represents the set of states;

[0109] The covariance matrix A is initialized with a 5*5 identity matrix, and when the target state s t After being selected for testing, the context vector is used to calculate the updated covariance matrix A', which is calculated as follows:

[0110] ;

[0111] Indicates that the state is the target state st The covariance matrix when , Indicates that the state is the target state s t The context vector at time ;

[0112] The cumulative state reward vector is initialized with a 5*1 zero vector, and when the target state s t After being selected for testing, the new cumulative state reward vector is calculated using the state reward and context vector , and its calculation formula is:

[0113] ;

[0114] in, Indicates that the state is the target state s t The cumulative state reward vector at time ;

[0115] In a preferred embodiment of the present invention, in the enhanced context information module,

[0116] The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional successor basic block Call instruction analysis code; the conditional successor basic block Call instruction analysis code includes a basic block number, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the basic block number;

[0117] The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes;

[0118] The subsequent associated conditional basic block code includes the associated subsequent basic block number, the shared memory Succ_Map, and the number M of Call instructions that call non-system functions and library functions in the associated subsequent basic block; the subsequent associated conditional basic block code stores the number M in Succ_Map[m], where m represents the subsequent basic block number;

[0119] The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

[0120] a state selection module for selecting a target state for fuzz testing according to a LinUCB selection algorithm, wherein the LinUCB selection algorithm derives the target state based on a context vector and a reward of the state;

[0121] The seed selection module is used to select the target seed for fuzz testing based on the ternary seed selection algorithm; the ternary seed selection algorithm extracts the seed label, execution information and session information from each seed in the seed pool to calculate the seed value, and then derives the target seed based on the seed value.

[0122] In a preferred embodiment of the present invention, the seed value is mainly exponentially calculated using partial execution information and session information as a base and the seed label as an exponent. The value decreases as resource consumption increases during fuzz testing. The seed value index is determined based on whether the seed in the seed label has been tested, whether it is liked, whether it is generated in the current state, and whether new edges have been discovered.

[0123] The base value of the seed is determined based on the feedback information generated during the execution of the seed protocol program and the information generated during the communication between the seed and the protocol program;

[0124] In a preferred embodiment of this invention, in the seed selection module, the calculation formula of the seed value is:

[0125] ;

[0126] Among them, value represents the seed value, b represents the base of the seed value, p represents the exponent of the seed value, and ε represents the exponential weight of reducing the seed value. represents the mean execution time of all seeds in the seed pool, B lp 、N ss and T e They represent whether the seed is lost during transmission, the number of times the candidate subsequence of the seed is selected, and the execution time of the seed; when the seed is lost during transmission, B lp =1, when there is no packet loss during seed transmission, B lp =0;

[0127] The calculation formula of the base number b of the seed value is:

[0128] ;

[0129] Among them, C tac Indicates the number of adjacent Call instructions in the execution trace, N e represents the number of edges in the execution trace of the seed, C h Indicates the number of state transition hits of the seed; is the average number of state transition hits of all seeds, is the average number of edges in the execution traces of all seeds;

[0130] The formula for calculating the seed value index p is:

[0131] ;

[0132] Among them, the tag set composed of seed tags , li represents the i-th element in the tag set, n represents the total number of elements in the tag set, B cov 、B fr 、B sg 、B pd They respectively indicate whether the seed has found a unique edge, whether the seed has a favorite path in the current fuzz test round, whether the seed is generated in the current state, and whether the candidate subsequence of the seed is used for fuzz testing. k is the number of labels in the label set, μ and β are the minimum threshold and minimum index value of the label set respectively. When the seed has found a unique edge, then B cov =1, when the seed has not found a unique edge, then B cov = 0; when the seed has a favorite path in the current fuzzing round, B fr = 1, when the seed does not have a favorite path in the current fuzzing round, B fr =0; when the seed is generated in the current state, B sg =1, when the seed is not generated in the current state, B sg = 0; when the candidate subsequence of the seed is used for fuzz testing, B pd =1; when the candidate subsequence of the seed is not used for fuzz testing, B pd =0.

[0133] It's worth noting that after the target state and target seed are fully selected, the system uses the target state to define the target seed's range for mutation and performs fuzz testing, saving interesting test cases after mutation. If the system is not finished, it passes feedback about the new interesting test cases to the enhanced context information module, which then updates the state and seed information for use by subsequent modules. This then initiates a new round of fuzz testing, and this cycle continues until the user terminates the system.

[0134] See also Figure 3 As shown in the figure, the system tests the PureFTPD protocol program and compares it with the state-of-the-art network protocol fuzz testing system AFLNET. The system and AFLNET conduct a 24-hour experiment on PureFTPD and repeat it 10 times, and the results are as follows: Figure 3 Experimental results of branch coverage changing over time. Figure 3 In

[15] , the system is represented by caflnet, and its experimental results far exceed AFLNET.

[0135] The above is a detailed description of an embodiment of the present invention. However, the content described is only a preferred embodiment of the present invention and should not be considered to limit the scope of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A network protocol fuzz testing system based on enhanced context information, characterized in that: include: An enhanced context information module is used to obtain state information and seed information, and enhance context information by instrumenting adjacent call instructions in the trace. The context information refers to various feedback data and runtime information obtained by the network protocol fuzz testing system through continuous monitoring, collection, and analysis of the test program's behavior. The adjacent call instruction instrumentation refers to inserting call instruction analysis code during the network protocol program compilation phase to obtain the number of call instructions adjacent to the execution trace when the program is running; a state selection module for selecting a target state for fuzz testing according to a LinUCB selection algorithm, wherein the LinUCB selection algorithm derives the target state based on a context vector and a reward of the state; A seed selection module, configured to select target seeds for fuzz testing based on a ternary seed selection algorithm; The ternary seed selection algorithm extracts the seed tag, execution information and session information from each seed in the seed pool to calculate the seed value, and then obtains the target seed based on the seed value; The seed value is mainly calculated based on the partial execution information and session information as the base and the seed label as the exponent. It decreases as the resource consumption increases during fuzz testing. The seed value index is determined based on whether the seed in the seed label has been tested, whether it is liked, whether it is generated in the current state, and whether new edges have been discovered. The base value of the seed is determined based on the feedback information generated during the execution of the seed protocol program and the information generated during the communication between the seed and the protocol program; In the seed selection module, the calculation formula of the seed value is: ； Among them, value represents the seed value, b represents the base of the seed value, p represents the exponent of the seed value, and ε represents the exponential weight of reducing the seed value. represents the mean execution time of all seeds in the seed pool, B lp 、N ss and T e They represent whether the seed is lost during transmission, the number of times the candidate subsequence of the seed is selected, and the execution time of the seed; when the seed is lost during transmission, B lp =1, when there is no packet loss during seed transmission, B lp =0; The calculation formula of the base number b of the seed value is: ； Among them, C tac Indicates the number of adjacent Call instructions in the execution trace, N e represents the number of edges in the execution trace of the seed, C h Indicates the number of state transition hits of the seed; is the average number of state transition hits of all seeds, is the average number of edges in the execution traces of all seeds; The formula for calculating the seed value index p is: ； Among them, l i represents the i-th element in the tag set, k represents the number of tags in the tag set, μ and β represent the minimum threshold and minimum index value of the tag set respectively, and n represents the total number of elements in the tag set.

2. The network protocol fuzz testing system based on enhanced context information according to claim 1, characterized in that: In the enhanced context information module, The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional subsequent basic block Call instruction analysis code; The conditional subsequent basic block Call instruction analysis code includes the basic block number, the shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional subsequent basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the basic block number; The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes; The subsequent associated conditional basic block code includes the associated subsequent basic block number, the shared memory Succ_Map, and the number M of Call instructions that call non-system functions and library functions in the associated subsequent basic block; the subsequent associated conditional basic block code stores the number M in Succ_Map[m], where m represents the subsequent basic block number; The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

3. The network protocol fuzz testing system based on enhanced context information according to claim 1, characterized in that: The context vector of the state refers to the evaluation of the exploration value of the state from the state branch prediction, the seed generation ability of the state, the quality of the seed pool of the state, the execution depth of the state and the degree of state correlation; The reward of the state is to give a reward score for the performance of the state in the fuzzy test, which is used to evaluate the utilization value of the state; the performance of the state is determined by the state transfer ability of the state in the fuzzy test and the number of state discovery paths.

4. The network protocol fuzz testing system based on enhanced context information according to claim 3 is characterized in that: State branch prediction PP refers to the ability of a state to find a unique path when the state is selected. Its calculation formula is: ； Among them, C p Indicates the number of unique paths found in the past for a state, N st Indicates the number of times a state is selected, N p Indicates the number of seeds in the seed pool in the state, C (tac,y) An indicator representing the number of adjacent Call instructions in the execution trace of seed y; The seed generation capacity SG of a state refers to the number of test cases that reach the state and are converted into seeds. Its calculation formula is: ； Among them, C p Indicates the number of unique paths found in the past for a state, N s Indicates the number of times the state is accessed during the fuzz testing process, N p The number of seeds in the seed pool at the current state; The seed pool quality SQ of a state represents the ability of the seeds in the seed pool to find a unique path, and its calculation formula is: ； Among them, C p Indicates the number of unique paths found in the past for a state, C (tac,y) Indicates the number of adjacent Call instructions in the execution trace of seed y, N p The number of seeds in the seed pool at the current state; The state execution depth ED represents the state depth inferred from the execution time during the SUT execution process, and its calculation formula is: ； Among them, T ae represents the average time it takes to execute a seed once, T ape represents the average execution time of the seed prefix message sequence; The state association SA represents the number of state transitions and reflects the diversity of seeds in the state. Its calculation formula is: ； Among them, D i and D o They represent the number of transitions from other states to a state and the number of transitions from a state to the other states respectively; The context vector v of the state is constructed as follows: ； Where T represents the transpose of the matrix; The reward calculation formula is: ； Among them, r represents the reward of the state, δ represents the weight coefficient of the number of tendency paths or state transitions, and C tp Indicates the number of paths that trigger the test state, C op Indicates the number of paths that trigger other states, C tr Indicates the number of times the test state is triggered, C or Indicates the number of times other states are triggered; the test state refers to the next state triggered by the original seed that triggers the target state, and the other state refers to the next state of the target state triggered by the test case generated by the original seed and is not a test state.

5. The network protocol fuzz testing system based on enhanced context information according to claim 4 is characterized in that: In the state selection module, the process of determining the target state specifically includes: Calculate the confidence upper bound of each state, the calculation formula is: ； Among them, p s Indicates the confidence upper bound when the state is s, A s represents the covariance matrix when the state is s, b s Represents the cumulative state reward vector when the state is s, v s Represents the context vector when the state is s, α represents the weight factor of exploration, and T represents the transpose of the matrix; The state corresponding to the highest confidence upper bound is taken as the target state s t , and its calculation formula is: ； Among them, S represents the set of states; The covariance matrix A is initialized with a 5*5 identity matrix, and when the target state s t After being selected for testing, the context vector is used to calculate the updated covariance matrix A', which is calculated as follows: ； Indicates that the state is the target state s t The covariance matrix when , Indicates that the state is the target state s t The context vector at time ; The cumulative state reward vector is initialized with a 5*1 zero vector, and when the target state s t After being selected for testing, the new cumulative state reward vector is calculated using the state reward and context vector , and its calculation formula is: ； in, Indicates that the state is the target state s t The cumulative state reward vector at time .

6. The network protocol fuzz testing system based on enhanced context information according to claim 1, characterized in that: In the seed selection module, the tag set composed of seed tags , B cov 、B fr 、B sg 、B pd Indicates whether the seed has found a unique edge, whether the seed has a favorite path in the current fuzz test round, whether the seed is generated in the current state, and whether the candidate subsequence of the seed is used for fuzz testing; when the seed has found a unique edge, then B cov =1, when the seed has not found a unique edge, then B cov = 0; when the seed has a favorite path in the current fuzzing round, B fr = 1, when the seed does not have a favorite path in the current fuzzing round, B fr =0; When the seed is generated in the current state, B sg =1, when the seed is not generated in the current state, B sg = 0; when the candidate subsequence of the seed is used for fuzz testing, B pd =1; when the candidate subsequence of the seed is not used for fuzz testing, B pd =0.

Images