Fuzzy testing method and device based on genetic variation algorithm

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a fuzzy testing method and device based on a genetic variation algorithm. According to the deep analysis result of the private communication protocol of the DCS, the data packet is constructed, the test cases which are continuously varied are automatically generated, a plurality of alternative variation strategies are provided for the generator, and a large amount of effective test data reaching a certain contract variation sufficiency is generated. Protocol malformation data input which is elaborately designed in advance is sent to an upper computer and a controller of a tested protocol, a test process and returned abnormal results are monitored, and possible security holes and vulnerabilities of a system are mined through analysis of the abnormal results. The functions of generation, variation, monitoring, problem positioning and the like of the fuzzy test case are realized.

Description

Technical Field

[0001] The invention belongs to the field of information technology, and in particular relates to a fuzzy testing method and device based on a genetic mutation algorithm. Background Art

[0002] Vulnerability testing technology is a method of discovering and patching vulnerabilities before they are exploited. It is used to assess the amount of risk involved in the system to reduce the possibility of security incidents. The following is an introduction to vulnerability testing technology.

[0003] Vulnerability testing is divided into detection of known vulnerabilities and detection of unknown vulnerabilities. The former uses security scanning technology to detect whether the system has published security vulnerabilities, while the latter aims to discover possible unknown vulnerabilities. This verifies the password strength, access control, system takeover difficulty, data security level, etc. of the target to be tested to ensure the security of the system.

[0004] Vulnerability testing technology is an important means to ensure system security Summary of the invention

[0005] In order to overcome the problems existing in the related art, a fuzzy testing method and device based on a genetic mutation algorithm are provided.

[0006] According to one aspect of an embodiment of the present disclosure, a fuzzy testing system based on a genetic mutation algorithm is provided, the method comprising: the system comprising a data model, a generator and a mutator;

[0007] The data model is used to set the protocol type, protocol field and input parameters, and construct the data message according to the set protocol type, protocol field and input parameters combined with the built-in data construction rules; the mutator is used to store multiple preset mutation strategies;

[0008] The generator is used to generate test cases by using the generated data message as a seed and performing multiple rounds of iterative mutation processing using a genetic mutation algorithm according to the set data type and the mutation strategy selected from the mutator, and send the generated test cases to the corresponding target under test; each round of mutation includes flipping random bytes of the seed to be mutated, inserting special symbols, and deleting any one or more operations in part of the input, and after each round of mutation, the test cases that meet the screening conditions are selected as the seeds for the next round of mutation;

[0009] Each test case maintains a monitor. After each monitor sends the maintained test case to the target under test, it monitors whether the test case causes anomalies to the target under test. When an abnormality occurs in the target under test, the system obtains the abnormal result returned by the target under test, and displays the potential security holes and vulnerabilities of the system through the analysis of the abnormal result, and provides the test case that caused the abnormal result.

[0010] In one possible implementation, when the abnormal result is a system crash, the corresponding potential vulnerability is a buffer overflow, a memory leak, or a segmentation fault;

[0011] When the abnormal result is service suspension, the corresponding potential vulnerabilities are infinite loop, resource exhaustion, and memory exhaustion;

[0012] When the abnormal result is resource leakage, the corresponding potential vulnerability is resource leakage vulnerability.

[0013] In a possible implementation, the types of monitors include Pcap monitors, Ping monitors, and process monitors;

[0014] The Pcap monitor sets up a network capturer during iteration. If an abnormality occurs in the target under test, the captured data is recorded as a pcap file. The pcap file is compatible with wireshark and tcpdump. If an abnormal result is found, the specific situation of the test case is reproduced through the pcap file to verify whether the abnormal behavior can be reproduced stably.

[0015] Ping monitor is used to verify that the target is still up and wait for the target to reboot;

[0016] The process monitor is used to control a process during fuzzing to see if the target process exists.

[0017] In one possible implementation, the system supports fuzz testing of protocols such as ARP, IP, ICMP, ModbusTCP, and Modbus RTU.

[0018] According to another aspect of an embodiment of the present disclosure, a fuzzy testing method based on a genetic mutation algorithm is provided, the method comprising:

[0019] Step 101, constructing a data message according to the set protocol type, protocol field and input parameters combined with the built-in data construction rules;

[0020] Step 102: according to the set data type and the mutation strategy selected from the mutator, the formed data message is used as a seed to perform multiple rounds of iterative mutation processing using a genetic mutation algorithm to generate test cases, and the generated test cases are sent to the corresponding target under test; each round of mutation includes flipping random bytes, inserting special symbols, and deleting any one or more operations in the partial input of the seed to be mutated, and after each round of mutation, the test cases that meet the screening conditions are selected as seeds for the next round of mutation;

[0021] Step 103, after each monitor sends the maintained test case to the target under test, it monitors whether the test case causes an exception to the target under test; when an exception occurs to the target under test, the method obtains the abnormal result returned by the target under test, displays the potential security holes and vulnerabilities of the method through the analysis of the abnormal result, and provides the test case that caused the abnormal result.

[0022] In one possible implementation, when the abnormal result is a method crash, the corresponding potential vulnerability is a buffer overflow, a memory leak, or a segmentation fault;

[0023] When the abnormal result is service suspension, the corresponding potential vulnerabilities are infinite loop, resource exhaustion, and memory exhaustion;

[0024] When the abnormal result is resource leakage, the corresponding potential vulnerability is resource leakage vulnerability.

[0025] In a possible implementation, the types of monitors include Pcap monitors, Ping monitors, and process monitors;

[0026] The Pcap monitor sets up a network capturer during iteration. If an abnormality occurs in the target under test, the captured data is recorded as a pcap file. The pcap file is compatible with wireshark and tcpdump. If an abnormal result is found, the specific situation of the test case is reproduced through the pcap file to verify whether the abnormal behavior can be reproduced stably.

[0027] Ping monitor is used to verify that the target is still up and wait for the target to reboot;

[0028] The process monitor is used to control a process during fuzzing to see if the target process exists.

[0029] In a possible implementation, the method supports fuzz testing of protocols such as ARP, IP, ICMP, ModbusTCP, and Modbus RTU.

[0030] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0031] The beneficial effects of the present disclosure are as follows: the present disclosure constructs data packets based on the results of in-depth analysis of the private communication protocol of the DCS system, automatically generates continuously mutating test cases, and provides multiple alternative mutation strategies for the generator, thereby generating a large amount of effective test data that reaches a certain degree of contract mutation sufficiency. Pre-designed protocol deformed data input is sent to the host computer and controller of the tested protocol, the test process and the returned abnormal results are monitored, and the possible security vulnerabilities and weaknesses of the system are mined through the analysis of the abnormal results. The functions of generating, mutating, monitoring, and locating problems for fuzzy test cases are realized. The vulnerability mining system is based on the fuzz testing technology of the genetic mutation algorithm, which mines unknown vulnerabilities, performs security and robustness testing on the industrial control system, deeply mines various known and unknown vulnerabilities of industrial control equipment or systems, generates test reports, clearly locates problems, and provides test messages for easy problem backtracking, significantly improving the security of industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a schematic diagram of a fuzzy testing system based on a genetic mutation algorithm shown in an embodiment of the present disclosure.

[0033] Figure 2 It is a flow chart of a fuzzy testing method based on a genetic mutation algorithm shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0034] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0035] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0036] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0037] Figure 1FIG. 1 is a schematic diagram of a fuzzy testing system based on a genetic mutation algorithm shown in an embodiment of the present disclosure. Figure 1 As shown, the system includes a data model, a generator and a mutator.

[0038] The data model is used to set the protocol type, protocol field and input parameters, and construct the data message according to the set protocol type, protocol field and input parameters combined with the built-in data construction rules. The mutator is used to store multiple preset mutation strategies.

[0039] The generator is used to generate test cases by using the generated data message as a seed and performing multiple rounds of iterative mutation processing using a genetic mutation algorithm according to the set data type (such as string, int, and bytes, etc.) and the mutation strategy selected from the mutator, and sending the generated test cases to the corresponding target under test (the target under test can be, for example, a DCS system). Each round of mutation includes flipping random bytes, inserting special symbols, and deleting any one or more of the operations in the partial input on the seed to be mutated. After each round of mutation, the test cases that meet the screening conditions are selected as the seeds for the next round of mutation. The screening requirements can include the execution time and coverage of the test cases; in this way, the test cases can be continuously iterated and optimized.

[0040] Each test case maintains a monitor. After each monitor sends the test case to the target, it monitors whether the test case causes anomalies to the target (for example, stopping or interrupting services, etc.). Each monitor contains multiple execution states, and the execution state is used to feedback the working process of the maintained test case. In the case of an abnormality in the target, the system obtains the abnormal result returned by the target, and displays the potential security vulnerabilities and weaknesses of the system through the analysis of the abnormal result, and provides the test case that caused the abnormal result for easy problem tracing.

[0041] For example, when the abnormal result is a system crash, the corresponding potential vulnerability is a buffer overflow, memory leak, or segmentation fault, where the host computer or controller cannot operate normally after receiving the malformed data of the test case, causing the system to crash or restart. The corresponding potential vulnerability is usually caused by the lack of an exception handling mechanism, such as a buffer overflow, memory leak, or segmentation fault. Such vulnerabilities can be exploited to cause a denial of service (DoS) attack, and can even be used to execute malicious code through further exploration of buffer overflow.

[0042] When the abnormal result is service hang, the corresponding potential vulnerabilities are infinite loop, resource exhaustion, and memory exhaustion. The system or service is stuck after receiving the malformed data of the test case and cannot process subsequent data or commands. This abnormality may be caused by infinite loop, resource exhaustion, memory exhaustion, etc. Such vulnerabilities are often used to perform denial of service attacks, making the device unable to continue working or causing resource exhaustion.

[0043] When the abnormal result is resource leakage, the corresponding potential vulnerability is resource leakage vulnerability. Among them, the malformed data causes the device resources (such as memory, file handles, network connections) to fail to be released in time, and then exhausted. This resource leakage vulnerability may cause system performance degradation or downtime under long-term attacks, which is one of the typical denial of service attack methods.

[0044] In a possible implementation, the types of monitors include Pcap monitors, Ping monitors, and process monitors.

[0045] The Pcap monitor sets up a network capturer during iteration. If an exception occurs in the target under test, the captured data is recorded as a pcap file, which is compatible with wireshark and tcpdump. It is convenient for backtracking and analyzing the specific communication process. If an abnormal result is found, the specific situation of the test case can be reproduced through the pcap file to verify whether the abnormal behavior can be reproduced stably.

[0046] Ping monitor is used to verify that the target is still healthy and wait for the target to reboot.

[0047] The process monitor is used to control a process during fuzzing to see if the target process exists.

[0048] The present invention constructs data packets based on the results of in-depth analysis of the private communication protocol of the DCS system, automatically generates continuously mutating test cases, and provides multiple alternative mutation strategies for the generator to generate a large amount of effective test data that reaches a certain degree of contract mutation. Pre-designed protocol deformed data input is sent to the host computer and controller of the tested protocol, the test process and the returned abnormal results are monitored, and the possible security vulnerabilities and weaknesses of the system are mined through the analysis of abnormal results. The functions of generating, mutating, monitoring, and locating problems for fuzzy test cases are realized. The vulnerability mining system is based on the fuzz testing technology of the genetic mutation algorithm, which mines unknown vulnerabilities, performs security and robustness testing on the industrial control system, deeply mines various known and unknown vulnerabilities of industrial control equipment or systems, generates test reports, clearly locates problems, and provides test messages to facilitate problem backtracking, significantly improving the security of industrial control systems.

[0049] In an application example, the system disclosed in the present invention supports fuzz testing of protocols such as ARP, IP, ICMP, ModbusTCP, Modbus RTU, etc. It conducts unknown vulnerability mining, security and robustness testing on industrial control systems (I / A Series, Siemens S7, Ovation systems, etc.), deeply mines various known and unknown vulnerabilities of industrial control equipment or systems, and the product can automatically generate ISASecure standard test reports, clearly locate problems, and provide test messages for easy problem tracing, thus significantly improving the security of industrial control systems.

[0050] Figure 2 is a flow chart of a fuzzy testing method based on a genetic mutation algorithm shown in an embodiment of the present disclosure, such as Figure 2 As shown, the method includes:

[0051] Step 101, constructing a data message according to the set protocol type, protocol field and input parameters combined with the built-in data construction rules;

[0052] Step 102: according to the set data type and the mutation strategy selected from the mutator, the formed data message is used as a seed to perform multiple rounds of iterative mutation processing using a genetic mutation algorithm to generate test cases, and the generated test cases are sent to the corresponding target under test; each round of mutation includes flipping random bytes, inserting special symbols, and deleting any one or more operations in the partial input of the seed to be mutated, and after each round of mutation, the test cases that meet the screening conditions are selected as seeds for the next round of mutation;

[0053] Step 103, after each monitor sends the maintained test case to the target under test, it monitors whether the test case causes an exception to the target under test; when an exception occurs to the target under test, the method obtains the abnormal result returned by the target under test, displays the potential security holes and vulnerabilities of the method through the analysis of the abnormal result, and provides the test case that caused the abnormal result.

[0054] In one possible implementation, when the abnormal result is a method crash, the corresponding potential vulnerability is a buffer overflow, a memory leak, or a segmentation fault;

[0055] When the abnormal result is service suspension, the corresponding potential vulnerabilities are infinite loop, resource exhaustion, and memory exhaustion;

[0056] When the abnormal result is resource leakage, the corresponding potential vulnerability is resource leakage vulnerability.

[0057] In a possible implementation, the types of monitors include Pcap monitors, Ping monitors, and process monitors;

[0058] The Pcap monitor sets up a network capturer during iteration. If an abnormality occurs in the target under test, the captured data is recorded as a pcap file. The pcap file is compatible with wireshark and tcpdump. If an abnormal result is found, the specific situation of the test case is reproduced through the pcap file to verify whether the abnormal behavior can be reproduced stably.

[0059] Ping monitor is used to verify that the target is still up and wait for the target to reboot;

[0060] The process monitor is used to control a process during fuzzing to see if the target process exists.

[0061] In a possible implementation, the method supports fuzz testing of protocols such as ARP, IP, ICMP, ModbusTCP, and Modbus RTU.

[0062] The description of the above method has been explained in detail in the description of the above system and will not be repeated here.

[0063] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0064] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0065] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0066] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0067] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0068] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0069] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0070] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0071] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A fuzzy testing system based on genetic mutation algorithm, characterized in that: The method includes: the system includes a data model, a generator and a mutator; The data model is used to set the protocol type, protocol field and input parameters, and construct the data message according to the set protocol type, protocol field and input parameters combined with the built-in data construction rules; the mutator is used to store multiple preset mutation strategies; The generator is used to generate test cases by using the generated data message as a seed and performing multiple rounds of iterative mutation processing using a genetic mutation algorithm according to the set data type and the mutation strategy selected from the mutator, and send the generated test cases to the corresponding target under test; each round of mutation includes flipping random bytes of the seed to be mutated, inserting special symbols, and deleting any one or more operations in part of the input, and after each round of mutation, the test cases that meet the screening conditions are selected as the seeds for the next round of mutation; Each test case maintains a monitor. After each monitor sends the maintained test case to the target under test, it monitors whether the test case causes anomalies to the target under test. When an abnormality occurs in the target under test, the system obtains the abnormal result returned by the target under test, and displays the potential security holes and vulnerabilities of the system through the analysis of the abnormal result, and provides the test case that caused the abnormal result.

2. The system according to claim 1, characterized in that When the abnormal result is a system crash, the corresponding potential vulnerability is a buffer overflow, memory leak, or segmentation fault; When the abnormal result is service suspension, the corresponding potential vulnerabilities are infinite loop, resource exhaustion, and memory exhaustion; When the abnormal result is resource leakage, the corresponding potential vulnerability is resource leakage vulnerability.

3. The system according to claim 1, characterized in that Types of monitors include Pcap monitors, Ping monitors, and process monitors; The Pcap monitor sets up a network capturer during iteration. If an abnormality occurs in the target under test, the captured data is recorded as a pcap file. The pcap file is compatible with wireshark and tcpdump. If an abnormal result is found, the specific situation of the test case is reproduced through the pcap file to verify whether the abnormal behavior can be reproduced stably. Ping monitor is used to verify that the target is still up and wait for the target to reboot; The process monitor is used to control a process during fuzzing to see if the target process exists.

4. The system according to claim 1, characterized in that The system supports fuzz testing of protocols such as ARP, IP, ICMP, ModbusTCP, and Modbus RTU.

5. A fuzzy testing method based on genetic mutation algorithm, characterized in that: The method comprises: Step 101, constructing a data message according to the set protocol type, protocol field and input parameters combined with the built-in data construction rules; Step 102: according to the set data type and the mutation strategy selected from the mutator, the formed data message is used as a seed to perform multiple rounds of iterative mutation processing using a genetic mutation algorithm to generate test cases, and the generated test cases are sent to the corresponding target under test; each round of mutation includes flipping random bytes, inserting special symbols, and deleting any one or more operations in the partial input of the seed to be mutated, and after each round of mutation, the test cases that meet the screening conditions are selected as seeds for the next round of mutation; Step 103, after each monitor sends the maintained test case to the target under test, it monitors whether the test case causes an exception to the target under test; when an exception occurs to the target under test, the method obtains the abnormal result returned by the target under test, displays the potential security holes and vulnerabilities of the method through the analysis of the abnormal result, and provides the test case that caused the abnormal result.

6. The method according to claim 5, characterized in that When the abnormal result is a method crash, the corresponding potential vulnerability is a buffer overflow, memory leak, or segmentation fault; When the abnormal result is service suspension, the corresponding potential vulnerabilities are infinite loop, resource exhaustion, and memory exhaustion; When the abnormal result is resource leakage, the corresponding potential vulnerability is resource leakage vulnerability.

7. The method according to claim 5, characterized in that Types of monitors include Pcap monitors, Ping monitors, and process monitors; The Pcap monitor sets up a network capturer during iteration. If an abnormality occurs in the target under test, the captured data is recorded as a pcap file. The pcap file is compatible with wireshark and tcpdump. If an abnormal result is found, the specific situation of the test case is reproduced through the pcap file to verify whether the abnormal behavior can be reproduced stably. Ping monitor is used to verify that the target is still up and wait for the target to reboot; The process monitor is used to control a process during fuzzing to see if the target process exists.

8. The method according to claim 1, characterized in that The method supports fuzz testing of protocols such as ARP, IP, ICMP, ModbusTCP, and Modbus RTU.

9. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images