Network protocol fuzz testing method and device, storage medium and electronic equipment

Abstract

The invention discloses a network protocol fuzz testing method and device, a storage medium and electronic equipment, and the method comprises the steps: obtaining initial data inputted into a target program and first response data outputted by the target program according to the initial data, carrying out the first mutation operation on a target byte of the initial data through employing a first mutation mode, obtaining test data corresponding to the initial data, obtaining second response data corresponding to the test data, determining a first difference degree between the first response data and the second response data based on a difference degree algorithm, and if the first difference degree indicates that the target byte is a variable byte, performing a second variation operation on the initial data based on a second variation mode, according to the method and the device, the test efficiency of the fuzzy test is improved, and the accuracy of network protocol vulnerability detection improved by byte-level mutation operation is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a network protocol fuzzy testing method, device, storage medium and electronic device. Background Art

[0002] Nowadays, with the rapid development of science and technology, various applications are used in people's lives. When applications receive data through network communication, there are cases where the program crashes due to network protocol vulnerabilities. Therefore, vulnerability detection of the network protocol corresponding to the application has become a necessary matter to ensure the normal operation of the application.

[0003] In the related technology, when performing vulnerability detection on network protocols, the methods adopted include black box detection. However, due to the lack of feedback information during the testing process, black box detection leads to invalid mutation operations in the testing process, which reduces the efficiency of vulnerability detection. Therefore, how to reduce invalid mutation operations in black box testing has become an urgent problem to be solved. Summary of the invention

[0004] The embodiments of the present specification provide a network protocol fuzz testing method, device, storage medium and electronic device. The byte volatility can be determined by generating test data through mutation operations on target bytes of initial data, and then the network protocol test of the program can be performed based on the generated mutation data according to the target bytes, thereby reducing the time for testing bytes with non-volatile degrees of volatility and detecting target program anomalies based on the running status of the target program, thereby improving the test efficiency of the fuzzy test and the accuracy of network protocol vulnerability detection improved by byte-level mutation operations.

[0005] In a first aspect, an embodiment of the present specification provides a network protocol fuzz testing method, the method comprising:

[0006] Acquire initial data input into a target program, and first response data output by the target program in response to the initial data;

[0007] Performing a first mutation operation on a target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data;

[0008] Acquire second response data corresponding to the test data, and determine a first difference between the first response data and the second response data based on a difference algorithm;

[0009] If the first difference indicates that the target byte is a mutable byte, performing a second mutation operation on the initial data based on a second mutation mode to obtain mutant data;

[0010] The mutated data is transmitted to the target program, and a fuzzy test is performed on the network protocol of the target program.

[0011] Through the above technical scheme, it is possible to obtain initial data and corresponding first response data, as well as second response data of the target program response after performing a first mutation operation on the target byte of the initial data, calculate the difference between the first response data and the second response data, and when it is determined that the target byte is a mutable byte, perform a second mutation operation on the target byte to obtain mutant data, and perform fuzzy testing on the network protocol of the target program according to the mutant data, so as to determine the byte volatility through the test data generated by performing a mutation operation on the target byte of the initial data, and then perform network protocol testing on the program based on the mutant data generated by the target byte, thereby reducing the time for testing bytes with non-volatile degrees of volatility, and testing the network protocol of the program according to the running status of the target program, thereby improving the test efficiency of the fuzzy test and the accuracy of network protocol vulnerability detection improved by the byte-level mutation operation.

[0012] In combination with the first aspect and the above implementation manner, in some possible implementation manners, obtaining initial data input into the target program, and first response data output by the target program in response to the initial data, includes:

[0013] Acquire network traffic data corresponding to the target program and protocol features corresponding to the network traffic data;

[0014] Filter the network traffic data based on the protocol characteristics to obtain payload data corresponding to the network traffic data;

[0015] Traversing the payload data to obtain initial data;

[0016] The initial data is input into the target program, and first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.

[0017] Through the above technical solution, the initial data used for fuzz testing is screened out according to the network protocol characteristics of the network through which the target program performs data transmission, so that the fuzz test is performed based on the valid data to improve the accuracy of program detection.

[0018] In combination with the first aspect and the above implementation manner, in some possible implementation manners, the adopting a first mutation mode to perform a first mutation operation on a target byte of the initial data to obtain test data corresponding to the initial data includes:

[0019] Perform bit flipping on the target byte in the initial data to obtain test data corresponding to the initial data; or,

[0020] Performing a bitwise addition operation on the target byte to obtain test data corresponding to the initial data; or,

[0021] A bitwise subtraction operation is performed on the target byte to obtain test data corresponding to the initial data.

[0022] Through the above technical solution, the first mutation operation is performed on the target bytes of the initial data using the first mutation methods such as bit flipping, bit addition and bit subtraction to obtain test data, so that the target program can be detected according to the test data.

[0023] In combination with the first aspect and the foregoing implementation manner, in some possible implementation manners, obtaining second response data corresponding to the test data, and determining a first difference between the first response data and the second response data based on a difference algorithm includes:

[0024] Transmitting the test data to the target program, and acquiring second response data returned by the target program in response to the test data;

[0025] Acquire a first data length of the first response data and a second data length of the second response data;

[0026] A first degree of difference between the first response data and the second response data is determined based on the first response data, the second response data, the first data length, and the second data length using a degree of difference algorithm.

[0027] In combination with the first aspect and the foregoing implementation manner, in some possible implementation manners, after determining the first difference between the first response data and the second response data based on the difference algorithm, the method further includes:

[0028] Obtaining a preset difference threshold, and comparing the first difference with the preset difference threshold;

[0029] If the first difference is less than the preset difference threshold, the target byte is determined to be a variable byte.

[0030] Through the above technical solution, the first difference is judged according to the preset difference threshold, and the byte type of the target byte is determined to improve the efficiency of subsequent fuzzy testing based on the byte type of the target byte.

[0031] In combination with the first aspect and the foregoing implementation manner, in some possible implementation manners, before comparing the first difference with a preset difference threshold, the method further includes:

[0032] Acquire other payload data in the effective payload data, where the other payload data is data in the effective payload data except the initial data;

[0033] Acquire a third response data set corresponding to each of the other payload data, wherein the third response data set includes third response data responded by the target program to each of the other payload data;

[0034] After comparing the first difference with a preset difference threshold, the method further includes:

[0035] If the first difference is greater than or equal to the preset difference threshold, obtaining a second difference between the second response data and each of the third response data in the third response data set;

[0036] If each of the second differences is greater than the preset difference threshold, the target byte is determined to be a mutable byte, the test data is added to the payload data, the test data is used as the initial data, and the step of performing the first mutation operation on the target byte of the initial data using the first mutation method is performed;

[0037] If the second difference is smaller than the preset difference threshold, the target byte is determined to be a non-volatile byte.

[0038] Through the above technical solution, the byte type of the target byte is determined based on multi-layer judgment, and the possibility of the impact caused by the mutation of the target byte is determined, thereby improving the accuracy of fuzz testing.

[0039] In combination with the first aspect and the above implementation manner, in some possible implementation manners, performing a second mutation operation on the initial data based on a second mutation mode to obtain mutated data includes:

[0040] If the target byte is a variable byte, obtaining the byte sequence number of the target byte in the initial data;

[0041] Insert a preset character string into the initial data based on the byte sequence number to obtain variant data, wherein the preset character string is any character string in the variant character set; or,

[0042] Insert randomly generated characters into the initial data based on the byte sequence number to obtain variant data; or,

[0043] The target bytes of the initial data are replaced by randomly generated characters to obtain mutated data.

[0044] Through the above technical solution, multiple second mutation methods are used to perform second mutation operations on the target bytes to obtain mutation data for fuzzy testing of the network protocol, thereby improving the accuracy of fuzzy testing of the network protocol.

[0045] In combination with the first aspect and the above implementation manner, in some possible implementation manners, performing a second mutation operation on the initial data based on a second mutation mode to obtain mutated data includes:

[0046] If the target byte is a non-volatile byte, determining a test state of the target byte based on a preset probability;

[0047] If the test status indicates that the target byte needs to be tested, the step of inserting a preset character string into the initial data based on the byte sequence number is executed.

[0048] In combination with the first aspect and the above implementations, in some possible implementations, transmitting the variant data to the target program and performing fuzz testing on the network protocol of the target program includes:

[0049] Transmitting the variation data to the target program to obtain the running status of the target program;

[0050] If the running status indicates that the target program is abnormal, obtaining a kernel dump file recording the abnormality of the target program;

[0051] Restart the target program.

[0052] Through the above technical solution, by obtaining the running status of the target program running variant data, the impact caused by the target program running variant data is determined, thereby determining the program vulnerabilities in the network protocol of the target program and improving the accuracy of fuzz testing of the network protocol.

[0053] In a second aspect, an embodiment of the present specification provides a network protocol fuzz testing method, the method comprising:

[0054] A response data acquisition unit, used for acquiring initial data input into a target program, and first response data output by the target program in response to the initial data;

[0055] A test data acquisition unit, configured to perform a first mutation operation on a target byte of the initial data in a first mutation manner to obtain test data corresponding to the initial data;

[0056] a difference determination unit, configured to obtain second response data corresponding to the test data, and determine a first difference between the first response data and the second response data based on a difference algorithm;

[0057] a variant data acquisition unit, configured to perform a second variant operation on the initial data based on a second variant mode to obtain variant data if the first difference indicates that the target byte is a variable byte;

[0058] The testing unit is used to transmit the variant data to the target program and perform fuzz testing on the network protocol of the target program.

[0059] In a third aspect, an embodiment of the present specification provides a computer program product, wherein the computer program product stores at least one instruction, and the at least one instruction is suitable for being loaded by a processor and executing the above-mentioned method steps.

[0060] In a fourth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the steps of the above-mentioned method.

[0061] In a fifth aspect, an embodiment of the present specification provides an electronic device, comprising: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the steps of the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in this specification or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0063] Figure 1 A schematic diagram of a scenario of a network protocol fuzzy testing method provided in an embodiment of this specification;

[0064] Figure 2 A flowchart of a network protocol fuzzy testing method provided in an embodiment of this specification;

[0065] Figure 3 A flowchart of a network protocol fuzzy testing method provided in an embodiment of this specification;

[0066] Figure 4 An exemplary schematic diagram of a first variation operation provided in an embodiment of this specification;

[0067] Figure 5 An exemplary schematic diagram of a second variation operation provided in an embodiment of this specification;

[0068] Figure 6 A schematic diagram of the structure of a network protocol fuzzy testing device provided in an embodiment of this specification;

[0069] Figure 7 A schematic diagram of the structure of a network protocol fuzzy testing device provided in an embodiment of this specification;

[0070] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0071] In order to make the features and advantages of this specification more obvious and easy to understand, the technical solutions in this specification are described clearly and completely in conjunction with the drawings in this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this specification.

[0072] See also Figure 1 , which is a schematic diagram of a scenario of a network protocol fuzzy testing method provided in the embodiment of this specification. Figure 1 As shown, the network protocol fuzz testing method provided in the embodiment of this specification can be applied to the test terminal to implement the fuzz testing process of the network protocol. The scenario diagram provided in the embodiment of this specification mainly includes a test terminal 10 and an operation terminal 20. Among them, the test terminal 10 can be a terminal with data processing function, a server, or a microcomputer, such as a personal computer, a laptop, etc.; the operation terminal 20 can be a terminal with a target program installed, specifically a server, or a microcomputer, such as a personal computer, a laptop, etc. A feasible method is that the test terminal 10 and the operation terminal 20 can be the same terminal or different terminals, which can be set according to the actual situation.

[0073] In an embodiment of the present specification, the test terminal 10 obtains initial data of the target program run by the operation terminal 20, and first response data output by the target program for the initial data. The test terminal 10 performs a first mutation operation on the target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data, obtains second response data corresponding to the test data, and determines a first difference between the first response data and the second response data based on a difference algorithm. If the first difference indicates that the target byte is a mutable byte, a second mutation operation is performed on the initial data based on a second mutation method to obtain mutated data, and the mutated data is transmitted to the operation terminal 20, so that the target program of the operation terminal 20 performs a fuzzy test on the network protocol of the target program according to the running state of the mutated data when the target program is running, thereby determining the byte volatility through the test data generated by the mutation operation on the target byte of the initial data, and then generating mutated data based on the target byte to perform a network protocol test on the program, thereby reducing the time for testing bytes with non-volatile volatility, and testing the network protocol of the program according to the running state of the target program, thereby improving the test efficiency of the fuzzy test and the accuracy of the network protocol vulnerability detection improved by the byte-level mutation operation.

[0074] based on Figure 1 The scene shown is shown below. Figure 2 , the network protocol fuzzy testing method provided in the embodiments of this specification is introduced in detail.

[0075] See also Figure 2 , is a flowchart of a network protocol fuzzy testing method provided by the embodiment of this specification. Figure 2 As shown, the method may include the following steps S101-S105.

[0076] S101, acquiring initial data input into a target program, and first response data output by the target program in response to the initial data;

[0077] In one embodiment, initial data input into a target program is obtained. The target program may be a program under test. The initial data may be any data that can be recognized and run by the target program. First response data outputted by the target program in response to the initial data after the target program runs in response to the initial data is obtained. The first response data may be data generated by the target program after the target program runs according to the initial data.

[0078] S102, performing a first mutation operation on a target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data;

[0079] In one embodiment, a first mutation method is used to perform a first mutation operation on a target byte in the initial data to obtain test data after the target byte of the initial data is mutated. The target byte may be any byte in the initial data. In order to ensure that all bytes in the initial data are traversed, a feasible method may be to perform a first mutation operation on each byte in the initial data in turn according to the byte sequence number of the byte in the initial data to obtain test data corresponding to each byte. The test data may be data obtained after the first mutation operation is performed on the target byte of the initial data.

[0080] The first mutation mode may be a mode of mutating the target byte, specifically, it may be a bit operation mode such as bit flipping, bit addition, bit subtraction, etc. on the target byte. It should be noted that in order to ensure the accuracy of the test on the target byte, a feasible method may be: perform a first mutation operation on the target byte in sequence according to various bit operations of the first mutation mode to obtain at least one test data.

[0081] S103, obtaining second response data corresponding to the test data, and determining a first difference between the first response data and the second response data based on a difference algorithm;

[0082] In one embodiment, test data is input into a target program, second response data output by the target program in response to the test data is obtained, and a difference algorithm is used to perform calculations based on the first response data and the second response data to obtain a first difference between the first response data and the second response data. The second response data may be data generated by the target program running the test data, and the first difference may be used to characterize the degree of difference between the first response data and the second response data.

[0083] The difference algorithm may be a formula as shown in formula (1), and the first difference between the first response data and the second response data is calculated and obtained. Formula (1) is:

[0084]

[0085] Among them, r can be the first response data, r' can be the second response data, min_len(r,r') can be the byte length corresponding to the data with the shortest data length between the first response data r and the second response data r', and d1 can be the number of bytes before r and r'. The edit distance of bytes, d2 can be the prefix of r and r′ The edit distance of bytes, d3 can be the prefix of r and r′ The edit distance may be the edit distance of the first min_len(r,r′) bytes of r and r′, and d4 may be the edit distance of the first min_len(r,r′) bytes of r and r′. The edit distance may indicate the number of bytes that need to be modified to convert the bytes in the first response data and the second response data into the same data.

[0086] For example, the first response data is "404 Not found" and the second response data is "405 Method Not Allowed", then min_len(r, r′) is 13, d1 is the edit distance between the first byte of r and r′, and since the first two bytes of r and r′ are both "40", d1 is 0; d3 is the edit distance between the first 7 bytes of r and r′, and since the first 7 bytes of r are "404 Not" and the first 7 bytes of r′ are "405 Met", it takes 3 bytes to edit the first 7 bytes of r′ to be the same as the first 7 bytes of r, so d3 is 3.

[0087] It should be noted that since min_len(r,r′) may not be divisible by 8, 4 or 2, a feasible method is to round up. For example, if min_len(r,r′) is 13, then d1 is 13 / 8, and after rounding up, d1 is 2.

[0088] S104, if the first difference indicates that the target byte is a mutable byte, performing a second mutation operation on the initial data based on a second mutation method to obtain mutant data;

[0089] In one embodiment, the obtained first difference degree is compared with a preset difference degree threshold. If the first difference degree is less than the preset difference degree threshold, the first difference degree indicates that the target byte is a variable byte. A second mutation operation is performed on the initial data based on the second mutation method to obtain mutated data corresponding to the initial data. The second mutation method may be to perform a second mutation operation on the target byte of the initial data in one or more methods. The mutated data may be data obtained after the second mutation operation is performed on the initial data. One initial data may correspond to one or more mutated data, which may be specifically set according to actual conditions.

[0090] S105, transmitting the mutated data to the target program, and performing fuzz testing on the network protocol of the target program;

[0091] In one embodiment, the generated variant data is transmitted to the target program, and the running state of the target program after receiving the variant data is monitored to implement fuzz testing of the network protocol of the target program. If the running state of the target program is an abnormal state such as a crash, it indicates that there may be a vulnerability in the network protocol of the target program.

[0092] It should be noted that, since it is necessary to determine whether the target program will enter an abnormal state due to running variant data when fuzz testing the target program, only one variant data is transmitted to the target program each time. After the variant data completes the test, other variant data are transmitted to avoid being unable to determine the cause of the target program's abnormality due to the simultaneous transmission of multiple variant data, thereby improving the testing efficiency of the target program's network protocol.

[0093] In an embodiment of the present specification, by obtaining initial data and corresponding first response data, and performing a first mutation operation on a target byte of the initial data to obtain second response data of a target program response, based on the difference calculation between the first response data and the second response data, when it is determined that the target byte is a mutable byte, a second mutation operation is performed on the target byte to obtain mutant data, and a fuzzy test is performed on the network protocol of the target program based on the mutant data, thereby determining the byte volatility through the test data generated by performing a mutation operation on the target byte of the initial data, and then performing a network protocol test on the program based on the mutant data generated based on the target byte, reducing the time for testing bytes with non-volatile degrees of volatility, and testing the program's network protocol based on the running status of the target program, thereby improving the test efficiency of the fuzzy test and the accuracy of network protocol vulnerability detection improved by the byte-level mutation operation.

[0094] See also Figure 3 , is a flowchart of a network protocol fuzzy testing method provided by the embodiment of this specification. Figure 3 As shown, the method may include the following steps S201-S214.

[0095] S201, obtaining network traffic data corresponding to the target program and protocol features corresponding to the network traffic data;

[0096] In one embodiment, network traffic data generated by a target program during normal communication within a preset time period is obtained. The network traffic data may be data entering or outputting a designated network for the target program through a network interface device. The designated network may be a network used for data transmission with the target program. Protocol characteristics corresponding to the designated network are obtained. The protocol characteristics may be a protocol name of the network protocol, a network address, a communication port, etc.

[0097] S202, filtering network traffic data based on protocol features to obtain payload data corresponding to the network traffic data;

[0098] In one embodiment, based on the protocol characteristics of the network protocol used by the target program for data transmission, the acquired network traffic data is screened to obtain payload data in the network traffic data. The payload data may be data in the network traffic data that can be used to test the network protocol, and may specifically be data that needs to be processed after being received by the target program, as well as data generated after the operation, etc. It can be understood that for data that does not need to be processed by the target program, the network protocol of the target program cannot be fuzzy tested through the data, and therefore the data is discarded.

[0099] S203, traverse the payload data to obtain initial data;

[0100] S204, inputting the initial data in the payload data into the target program, and obtaining first response data returned by the target program in response to the initial data;

[0101] In one embodiment, each payload data is traversed to obtain initial data in the payload data, and the obtained initial data is transmitted to the target program to obtain the first response data output by the target program after running in response to the initial data. The initial data can be any data in the payload data. The method for obtaining the initial data in the payload data can be set according to the actual situation. For example, it can be selected according to the generation time of each payload data, and each payload data is determined as the initial data in the order of the generation time.

[0102] It should be noted that the method of inputting the initial data into the target program may be to adopt a designated network transmission so as to implement fuzzy testing of the network protocol of the designated network according to the initial data.

[0103] S205, performing a first mutation operation on a target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data;

[0104] In one embodiment, a first mutation operation is performed on a target byte in the initial data using a first mutation method to obtain test data after the target byte of the initial data is mutated. The target byte may be any byte in the initial data. In order to ensure that all bytes in the initial data are traversed, a feasible method may be: according to the byte sequence number of the byte in the initial data, the first mutation operation is performed on each byte in the initial data in turn to obtain test data corresponding to each byte. The test data may be the data obtained after the first mutation operation is performed on the target byte of the initial data.

[0105] The first mutation mode may be a mode of mutating the target byte, specifically, it may be a bit operation mode such as bit flipping, bit addition, bit subtraction, etc. on the target byte. It should be noted that in order to ensure the accuracy of the test on the target byte, a feasible method may be: perform the first mutation operation on the target byte in turn according to various bit operations of the first mutation mode, and obtain at least one test data corresponding to each bit operation mode.

[0106] For example, Figure 4 As shown, Figure 4 The data of the target byte in is "A", and the corresponding ASCII code is 65, which is converted to binary as "1000001". The bit flip operation in the first variation mode is used to perform the first variation operation on the target byte, and the variant byte "0111110" is obtained, which is converted to decimal as 62. The character corresponding to the ASCII code "62" is ">", so the test data obtained according to the variant byte is determined to be ">"; the bit addition operation in the first variation mode is used to perform the first variation operation on the target byte, and the variant byte "1000010" is obtained. The test data "B" is obtained according to the variant byte. It can be understood that due to the numerical restrictions on ASCII codes, the actual numerical setting needs to be considered when performing bit addition or bit subtraction operations. The specific bit operation method of the first variation mode can be set according to actual conditions.

[0107] S206, transmitting the test data to the target program, and obtaining second response data returned by the target program in response to the test data;

[0108] S207, obtaining a first data length of the first response data and a second data length of the second response data;

[0109] In one embodiment, after the test data is transferred to the target program, the second response data generated by the target program in response to the test data is obtained, and the first data length of the first response data and the second data length corresponding to the second response data are obtained. The first data length may be the number of bytes included in the first response data, and the second data length may be the number of bytes included in the second response data.

[0110] Exemplarily, if the first response data is “404 Not found”, the first data length is 13, and if the second response data is “405 Method Not Allowed”, the second data length is 22.

[0111] S208, using a difference algorithm to determine a first difference between the first response data and the second response data based on the first response data, the second response data, the first data length, and the second data length;

[0112] In one embodiment, a difference algorithm is used to perform calculation based on the first response data, the second response data, the first data length and the second data length to obtain a first difference between the first response data and the second response data. The difference algorithm may be the formula (1) shown in step S103. The specific process of obtaining the first difference using the difference algorithm may refer to step S103 and will not be described in detail here.

[0113] S209, obtaining a preset difference threshold, and comparing the first difference with the preset difference threshold;

[0114] S210, if the first difference is less than a preset difference threshold, determining that the target byte is a variable byte;

[0115] In one embodiment, a preset difference threshold is obtained, and the first difference and the preset difference threshold are compared. If the first difference is less than the preset difference threshold, the target byte is determined to be a variable byte. The preset difference threshold can be a threshold set according to actual conditions and used to determine the mutation probability of the target byte. The variable byte can be a byte that is suitable for mutation during the test process when the initial data is used for fuzzy testing.

[0116] Exemplarily, if the first difference degree obtained is 0.8 and the preset difference degree threshold is 1, since 0.8 is less than 1, the target byte can be considered to be a variable byte.

[0117] Furthermore, if the first difference is greater than or equal to a preset difference threshold, the second difference between the second response data and each third response data is obtained, and if each second difference is greater than the preset difference threshold, the target byte is determined to be a variable byte. Among them, the method for obtaining the third response data may be: obtaining other payload data in the effective payload data, the other payload data is the data in the effective payload data except the initial data, obtaining the third response data corresponding to each other payload data, the third response data may be the data in the third response data set, and the third response data set includes the data to which the target program responds to each other payload data. For example, the effective payload data includes "data A", "data B" and "data C", and the initial data is "data A", then the other payload data may be "data B" and "data C".

[0118] It should be noted that if the second difference between the second response data and each third response data is greater than the preset difference threshold, it can be considered that the mutation of the test data may have tested the unknown functional code of the target program. Therefore, the target byte is determined as a variable byte, and the test data is added to the payload data. The test data is used as the initial data to execute step S203, so that the subsequent steps are executed with the test data as the initial data to achieve the testing of the unknown functional code of the target program that may exist, thereby improving the comprehensiveness and accuracy of the fuzzy testing of the network protocol of the target program.

[0119] Further, if among the second differences between the second response data and the third response data, there is a second difference less than a preset difference threshold, the target byte is determined to be a non-volatile byte.

[0120] S211, performing a second mutation operation on the initial data based on a second mutation method to obtain mutated data;

[0121] In one embodiment, a second mutation operation is performed on the initial data based on a second mutation method to obtain at least one mutated data. The second mutation method may be to perform a second mutation operation on the target bytes of the initial data in one or more methods. The mutated data may be data obtained after the second mutation operation is performed on the initial data. One initial data may correspond to one or more mutated data, which may be specifically set according to actual conditions.

[0122] Specifically, the method for performing the second mutation operation on the initial data based on the second mutation mode may be: determining the byte type of the target byte, if the target byte is a mutable byte, obtaining the byte sequence number of the target byte in the initial data, inserting a preset string into the initial data based on the byte sequence number, obtaining the mutated data, the preset string being any string in the mutated character set, the mutated string set may be a set that includes at least one string in advance, and the strings included in the mutated string set may be set according to actual conditions; or, inserting randomly generated characters into the initial data based on the byte sequence number, obtaining the mutated data; or, replacing the target byte of the initial data with the randomly generated characters, obtaining the mutated data. The byte sequence number may be an arrangement sequence number that represents the position of the target byte in the initial data, for example, in the initial data "GET / HTTP / 1.1", the byte sequence number of "G" is "1"; the randomly generated characters may be generated using any random generation algorithm.

[0123] For example, Figure 5 As shown, Figure 5By inserting the string "aaa" in the mutant string set in front of the target byte "G", the mutant data "aaa GET / HTTP / 1.1" is generated; by inserting the randomly generated character "b" in front of the target byte "G", the mutant data "bGET / HTTP / 1.1" is generated; by replacing the target byte "G" with the randomly generated character "b", the mutant data "bET / HTTP / 1.1" is generated.

[0124] Furthermore, in addition to performing the second mutation operation on the initial data by the above method, the mutated data can also be obtained by performing bit operations such as bit flipping, bit addition or bit subtraction on the target byte. It can be understood that since the purpose of generating the mutated data is to perform fuzzy testing on the network protocol of the target program through the mutated data, multiple bit operations can be performed on the target byte to generate the mutated data, and the specific method of generating the mutated data can be set according to the actual situation.

[0125] It should be noted that when the second mutation method is used to generate mutation data, a feasible method may be: if the target byte is a non-volatile byte, the test state of the target byte is determined based on a preset probability, and if the test state indicates that the target byte needs to be tested, the second mutation operation is performed on the target byte. The preset probability may be a pre-set probability for determining whether to perform the second mutation operation on the non-volatile byte, such as 90%, etc., which may be set specifically according to actual conditions, and the test state may be a state indicating whether to test the target byte, and if the test state of the target byte obtained based on the preset probability is that it needs to be tested, the second mutation operation is performed on the target byte; if the test state indicates that the target byte does not need to be tested, the test state is determined for the next target byte, thereby reducing the test of non-volatile bytes and improving the test efficiency of the fuzzy test of the network protocol.

[0126] S212, transmitting the mutated data to the target program to obtain the running status of the target program;

[0127] In one embodiment, the variant data is transmitted to the target program, and the operating state of the target program when the variant data is received and the target program processes the variant data is obtained. The operating state may be a state that represents the target program when running the variant data, such as normal operation, crash, etc.

[0128] Specifically, the method for obtaining the running status can be: by setting a proxy plug-in, obtaining the process status of the target program in real time through the proxy plug-in, and determining the running status of the target program according to the process status. If the proxy plug-in queries the process status of the target program and there is a long period of lag, etc., then it is considered that the running status of the target program is abnormal.

[0129] It should be noted that, since it is necessary to determine whether the target program will enter an abnormal state due to running variant data when fuzz testing the target program, only one variant data is transmitted to the target program each time. After the variant data completes the test, other variant data are transmitted to avoid being unable to determine the cause of the target program's abnormality due to the simultaneous transmission of multiple variant data, thereby improving the testing efficiency of the target program's network protocol.

[0130] Furthermore, in addition to transmitting the mutated data to the target program for fuzz testing, one or more data in the payload data can be randomly transmitted to the target program for fuzz testing, so as to fuzz test the network protocol of the target program by transmitting different data, thereby improving the accuracy of the fuzz testing.

[0131] S213, if the running status indicates that the target program is abnormal, obtaining a kernel dump file recording the abnormality of the target program;

[0132] In one embodiment, if the running status indicates that an exception has occurred in the target program, a core dump file recording the exception of the target program is obtained. The core dump file may be a file generated by the operating system of the running terminal when the exception has occurred in the target program, and is used to record the process from the start of the running of the target program according to the mutated data to the occurrence of the exception in the target program. Specifically, the file may include data such as the memory status and register status of the running terminal and the specific location where the target program crashed.

[0133] Specifically, since the proxy plug-in can be used to obtain the running status of the target program in real time, when the proxy plug-in detects that the running status of the target program is abnormal, it obtains the core dump file and transmits the core dump file to the test terminal running the test tool. The test tool can be a tool for calculating the difference of the initial data and performing mutation operations.

[0134] S214, restart the target program;

[0135] In one embodiment, if an exception occurs when the target program is running according to the variant data, causing the target program to crash, the target program is restarted through the proxy plug-in to be able to perform fuzz testing on the network protocol according to other variant data.

[0136] It should be noted that the target byte can be a single byte or multiple bytes, for example, it can be a double byte or a quad byte, etc. In order to improve the accuracy of the fuzzy test of the network protocol according to the initial data, a feasible method can be: traverse each byte of the initial data in a way that the target byte is a single byte, determine to use the first mutation method to generate the test data corresponding to each byte, determine the byte type of the target byte according to the test data, generate the corresponding mutation data to perform the fuzzy test of the network protocol, and after completing the fuzzy test with the target byte as a single byte, repeat the fuzzy test steps with the target byte as a double byte and quad byte in turn. The specific setting can be made according to the actual situation. It can be understood that when the target byte in the initial data is mutated, each byte in the initial data can be processed in a step-by-step manner to improve the accuracy of the fuzzy test of the network protocol according to the traversal test of each byte.

[0137] In the embodiment of the present specification, by obtaining the initial data and the corresponding first response data, and the second response data to which the target program responds after the first mutation operation is performed on the target byte of the initial data, according to the difference calculation between the first response data and the second response data, when the target byte is determined to be a mutable byte, the target byte is subjected to a second mutation operation to obtain the mutation data, and the network protocol of the target program is fuzzy tested according to the mutation data, thereby determining the byte volatility by the test data generated by the mutation operation on the target byte of the initial data, and then performing the program network protocol test according to the target byte to generate the mutation data, reducing the time for testing bytes with non-mutable volatility, and testing the program network protocol according to the running state of the target program, thereby improving the test efficiency of the fuzzy test, and the accuracy of the network protocol vulnerability detection improved by the byte-level mutation operation. Further, according to the network protocol characteristics of the network in which the target program performs data transmission, the initial data for the fuzzy test is screened out, so that the fuzzy test is performed according to the valid data to improve the accuracy of the network protocol detection. Further, the byte type of the target byte is determined through multi-layer judgment, and the possibility of the impact caused by the mutation of the target byte is determined, thereby improving the accuracy of the fuzzy test.

[0138] based on Figure 1 The scene shown is shown below. Figure 6 and Figure 7 , the network protocol fuzzy testing device provided in the embodiment of this specification is introduced in detail. It should be noted that, Figure 6 and Figure 7 The network protocol fuzzy testing device in the embodiment of this specification is used to execute Figures 2 to 5 For the convenience of explanation, only the part related to the embodiment of this specification is shown. For the specific technical details not disclosed, please refer to the embodiment of this specification. Figures 2 to 5The embodiment shown.

[0139] See also Figure 6 , is a schematic diagram of the structure of a network protocol fuzzy testing device provided in the embodiment of this specification. Figure 6 As shown, the network protocol fuzzy testing device 1 of the embodiment of this specification may include: a response data acquisition unit 11, a test data acquisition unit 12, a difference determination unit 13, a variant data acquisition unit 14 and a testing unit 15.

[0140] A response data acquisition unit 11 is used to acquire initial data input into a target program, and first response data output by the target program in response to the initial data;

[0141] A test data acquisition unit 12 is used to perform a first mutation operation on a target byte of the initial data in a first mutation manner to obtain test data corresponding to the initial data;

[0142] A difference determination unit 13, configured to obtain second response data corresponding to the test data, and determine a first difference between the first response data and the second response data based on a difference algorithm;

[0143] a variant data acquisition unit 14, configured to perform a second variant operation on the initial data based on a second variant mode to obtain variant data if the first difference indicates that the target byte is a variable byte;

[0144] The testing unit 15 is used to transmit the variant data to the target program and perform fuzz testing on the network protocol of the target program.

[0145] Optionally, the response data acquiring unit 11 is further used for:

[0146] Acquire network traffic data corresponding to the target program and protocol features corresponding to the network traffic data;

[0147] Filter the network traffic data based on the protocol characteristics to obtain payload data corresponding to the network traffic data;

[0148] Traversing the payload data to obtain initial data;

[0149] The initial data is input into the target program, and first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.

[0150] Optionally, the test data acquisition unit 12 is further used for:

[0151] Perform bit flipping on the target byte in the initial data to obtain test data corresponding to the initial data; or,

[0152] Performing a bitwise addition operation on the target byte to obtain test data corresponding to the initial data; or,

[0153] A bitwise subtraction operation is performed on the target byte to obtain test data corresponding to the initial data.

[0154] Optionally, the difference determination unit 13 is further used for:

[0155] Transmitting the test data to the target program, and acquiring second response data returned by the target program in response to the test data;

[0156] Acquire a first data length of the first response data and a second data length of the second response data;

[0157] A first degree of difference between the first response data and the second response data is determined based on the first response data, the second response data, the first data length, and the second data length using a degree of difference algorithm.

[0158] Optional, such as Figure 7 As shown, the network protocol fuzzy testing device 1 also includes a byte type determination unit 16, which is used to:

[0159] Obtaining a preset difference threshold, and comparing the first difference with the preset difference threshold;

[0160] If the first difference is less than the preset difference threshold, the target byte is determined to be a variable byte.

[0161] Optionally, the response data acquiring unit 11 is further used for:

[0162] Acquire other payload data in the effective payload data, where the other payload data is data in the effective payload data except the initial data;

[0163] Acquire a third response data set corresponding to each of the other payload data, wherein the third response data set includes third response data returned by the target program for each of the other payload data;

[0164] The byte type determination unit 16 is further used for:

[0165] If the first difference is greater than or equal to the preset difference threshold, obtaining a second difference between the second response data and each of the third response data in the third response data set;

[0166] If each of the second differences is greater than the preset difference threshold, the target byte is determined to be a mutable byte, the test data is added to the payload data, the test data is used as the initial data, and the step of performing the first mutation operation on the target byte of the initial data using the first mutation method is performed;

[0167] If the second difference is smaller than the preset difference threshold, the target byte is determined to be a non-volatile byte.

[0168] Optionally, the variation data acquiring unit 14 is further used for:

[0169] If the target byte is a variable byte, obtaining the byte sequence number of the target byte in the initial data;

[0170] Insert a preset character string into the initial data based on the byte sequence number to obtain variant data, wherein the preset character string is any character string in the variant character set; or,

[0171] Insert randomly generated characters into the initial data based on the byte sequence number to obtain variant data; or,

[0172] The target bytes of the initial data are replaced by randomly generated characters to obtain mutated data.

[0173] Optionally, the variation data acquiring unit 14 is further used for:

[0174] If the target byte is a non-volatile byte, determining a test state of the target byte based on a preset probability;

[0175] If the test status indicates that the target byte needs to be tested, the step of inserting a preset character string into the initial data based on the byte sequence number is executed.

[0176] Optionally, the testing unit 15 is further used for:

[0177] Transmitting the variation data to the target program to obtain the running status of the target program;

[0178] If the running status indicates that the target program is abnormal, obtaining a kernel dump file recording the abnormality of the target program;

[0179] Restart the target program.

[0180] In the embodiment of the present specification, by obtaining the initial data and the corresponding first response data, and the second response data to which the target program responds after the first mutation operation is performed on the target byte of the initial data, according to the difference calculation between the first response data and the second response data, when the target byte is determined to be a mutable byte, the target byte is subjected to a second mutation operation to obtain the mutation data, and the network protocol of the target program is fuzzy tested according to the mutation data, thereby determining the byte volatility by the test data generated by the mutation operation on the target byte of the initial data, and then performing the program network protocol test according to the target byte to generate the mutation data, reducing the time for testing bytes with non-mutable volatility, and testing the program network protocol according to the running state of the target program, thereby improving the test efficiency of the fuzzy test, and the accuracy of the network protocol vulnerability detection improved by the byte-level mutation operation. Further, according to the network protocol characteristics of the network in which the target program performs data transmission, the initial data for the fuzzy test is screened out, so that the fuzzy test is performed according to the valid data to improve the accuracy of the network protocol detection. Further, the byte type of the target byte is determined through multi-layer judgment, and the possibility of the impact caused by the mutation of the target byte is determined, thereby improving the accuracy of the fuzzy test.

[0181] The present specification also provides a computer storage medium, which can store a plurality of program instructions, which are suitable for being loaded and executed by a processor as described above. Figure 1-Figure 5 The method steps of the embodiment shown in the figure can be found in the specific implementation process. Figure 1-Figure 5 The specific description of the illustrated embodiment will not be repeated here.

[0182] The embodiment of the present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1-Figure 5 The network protocol fuzzy testing method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 5 The specific description of the illustrated embodiment will not be repeated here.

[0183] See also Figure 8 , is a schematic diagram of the structure of an electronic device provided in the embodiment of this specification. Figure 8As shown, the electronic device 1000 may include: at least one processor 1001, such as a CPU, at least one network interface 1004, an input / output interface 1003, a memory 1005, and at least one communication bus 1002. The communication bus 1002 is used to realize the connection and communication between these components. The network interface 1004 may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 1005 may optionally also be at least one storage device located away from the aforementioned processor 1001. As shown in FIG. Figure 8 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, an input and output interface module, and a network protocol fuzzy testing device program.

[0184] exist Figure 8 In the electronic device 1000 shown, the input-output interface 1003 is mainly used to provide an input interface for the user and obtain data input by the user.

[0185] In one embodiment, the processor 1001 may be used to call the network protocol fuzzy test device program stored in the memory 1005, and specifically perform the following operations:

[0186] Acquire initial data input into a target program, and first response data output by the target program in response to the initial data;

[0187] Performing a first mutation operation on a target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data;

[0188] Acquire second response data corresponding to the test data, and determine a first difference between the first response data and the second response data based on a difference algorithm;

[0189] If the first difference indicates that the target byte is a mutable byte, performing a second mutation operation on the initial data based on a second mutation mode to obtain mutant data;

[0190] The mutated data is transmitted to the target program, and a fuzzy test is performed on the network protocol of the target program.

[0191] Optionally, when the processor 1001 executes the acquisition of initial data input into the target program and the first response data output by the target program in response to the initial data, the processor 1001 specifically performs the following operations:

[0192] Acquire network traffic data corresponding to the target program and protocol features corresponding to the network traffic data;

[0193] Filter the network traffic data based on the protocol characteristics to obtain payload data corresponding to the network traffic data;

[0194] Traversing the payload data to obtain initial data;

[0195] The initial data is input into the target program, and first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.

[0196] Optionally, when the processor 1001 performs a first mutation operation on a target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data, the processor 1001 specifically performs the following operations:

[0197] Perform bit flipping on the target byte in the initial data to obtain test data corresponding to the initial data; or,

[0198] Performing a bitwise addition operation on the target byte to obtain test data corresponding to the initial data; or,

[0199] A bitwise subtraction operation is performed on the target byte to obtain test data corresponding to the initial data.

[0200] Optionally, when the processor 1001 executes the step of acquiring the second response data corresponding to the test data and determining the first difference between the first response data and the second response data based on a difference algorithm, the processor 1001 specifically performs the following operations:

[0201] Transmitting the test data to the target program, and acquiring second response data returned by the target program in response to the test data;

[0202] Acquire a first data length of the first response data and a second data length of the second response data;

[0203] A first degree of difference between the first response data and the second response data is determined based on the first response data, the second response data, the first data length, and the second data length using a degree of difference algorithm.

[0204] Optionally, after executing the difference-based algorithm to determine the first difference between the first response data and the second response data, the processor 1001 further performs the following operations:

[0205] Obtaining a preset difference threshold, and comparing the first difference with the preset difference threshold;

[0206] If the first difference is less than the preset difference threshold, the target byte is determined to be a variable byte.

[0207] Optionally, before comparing the first difference with a preset difference threshold, the processor 1001 further performs the following operations:

[0208] Acquire other payload data in the effective payload data, where the other payload data is data in the effective payload data except the initial data;

[0209] Acquire a third response data set corresponding to each of the other payload data, wherein the third response data set includes third response data returned by the target program for each of the other payload data;

[0210] After comparing the first difference with a preset difference threshold, the processor 1001 further performs the following operations:

[0211] If the first difference is greater than or equal to the preset difference threshold, obtaining a second difference between the second response data and each of the third response data in the third response data set;

[0212] If each of the second differences is greater than the preset difference threshold, the target byte is determined to be a mutable byte, the test data is added to the payload data, the test data is used as the initial data, and the step of performing the first mutation operation on the target byte of the initial data using the first mutation method is performed;

[0213] If the second difference is smaller than the preset difference threshold, the target byte is determined to be a non-volatile byte.

[0214] Optionally, when the processor 1001 performs a second mutation operation on the initial data based on the second mutation mode to obtain the mutated data, the processor 1001 specifically performs the following operations:

[0215] If the target byte is a variable byte, obtaining the byte sequence number of the target byte in the initial data;

[0216] Insert a preset character string into the initial data based on the byte sequence number to obtain variant data, wherein the preset character string is any character string in the variant character set; or,

[0217] Insert randomly generated characters into the initial data based on the byte sequence number to obtain variant data; or,

[0218] The target bytes of the initial data are replaced by randomly generated characters to obtain mutated data.

[0219] Optionally, when the processor 1001 performs a second mutation operation on the initial data based on the second mutation mode to obtain the mutated data, the processor 1001 specifically performs the following operations:

[0220] If the target byte is a non-volatile byte, determining a test state of the target byte based on a preset probability;

[0221] If the test status indicates that the target byte needs to be tested, the step of inserting a preset character string into the initial data based on the byte sequence number is executed.

[0222] Optionally, when the processor 1001 transmits the variant data to the target program and performs fuzz testing on the network protocol of the target program, the processor 1001 specifically performs the following operations:

[0223] Transmitting the variation data to the target program to obtain the running status of the target program;

[0224] If the running status indicates that the target program is abnormal, obtaining a kernel dump file recording the abnormality of the target program;

[0225] Restart the target program.

[0226] In the embodiment of the present specification, by obtaining the initial data and the corresponding first response data, and the second response data to which the target program responds after the first mutation operation is performed on the target byte of the initial data, according to the difference calculation between the first response data and the second response data, when the target byte is determined to be a mutable byte, the target byte is subjected to a second mutation operation to obtain the mutation data, and the network protocol of the target program is fuzzy tested according to the mutation data, thereby determining the byte volatility by the test data generated by the mutation operation on the target byte of the initial data, and then performing the program network protocol test according to the target byte to generate the mutation data, reducing the time for testing bytes with non-mutable volatility, and testing the program network protocol according to the running state of the target program, thereby improving the test efficiency of the fuzzy test, and the accuracy of the network protocol vulnerability detection improved by the byte-level mutation operation. Further, according to the network protocol characteristics of the network in which the target program performs data transmission, the initial data for the fuzzy test is screened out, so that the fuzzy test is performed according to the valid data to improve the accuracy of the network protocol detection. Further, the byte type of the target byte is determined through multi-layer judgment, and the possibility of the impact caused by the mutation of the target byte is determined, thereby improving the accuracy of the fuzzy test.

[0227] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0228] The above disclosure is only the preferred embodiment of this specification, which certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A network protocol fuzz testing method, characterized in that: The method comprises: Acquire initial data input into a target program, and first response data output by the target program in response to the initial data; Performing a first mutation operation on a target byte of the initial data using a first mutation method to obtain test data corresponding to the initial data; Acquire second response data corresponding to the test data, and determine a first difference between the first response data and the second response data based on a difference algorithm; If the first difference indicates that the target byte is a mutable byte, performing a second mutation operation on the initial data based on a second mutation mode to obtain mutant data; The mutated data is transmitted to the target program, and a fuzzy test is performed on the network protocol of the target program.

2. The method according to claim 1, characterized in that The obtaining of initial data input into the target program, and first response data output by the target program in response to the initial data, comprises: Acquire network traffic data corresponding to the target program and protocol features corresponding to the network traffic data; Filter the network traffic data based on the protocol characteristics to obtain payload data corresponding to the network traffic data; Traversing the payload data to obtain initial data; The initial data is input into the target program, and first response data returned by the target program in response to the initial data is obtained, wherein the initial data is any data in the payload data.

3. The method according to claim 1, characterized in that The step of performing a first mutation operation on a target byte of the initial data by using a first mutation method to obtain test data corresponding to the initial data includes: Perform bit flipping on the target byte in the initial data to obtain test data corresponding to the initial data; or, Performing a bitwise addition operation on the target byte to obtain test data corresponding to the initial data; or, A bitwise subtraction operation is performed on the target byte to obtain test data corresponding to the initial data.

4. The method according to claim 1, characterized in that: The obtaining of second response data corresponding to the test data, and determining a first difference between the first response data and the second response data based on a difference algorithm, includes: Transmitting the test data to the target program, and acquiring second response data returned by the target program in response to the test data; Acquire a first data length of the first response data and a second data length of the second response data; A first degree of difference between the first response data and the second response data is determined based on the first response data, the second response data, the first data length, and the second data length using a degree of difference algorithm.

5. The method according to claim 1, characterized in that After determining the first difference between the first response data and the second response data based on the difference algorithm, the method further includes: Obtaining a preset difference threshold, and comparing the first difference with the preset difference threshold; If the first difference is less than the preset difference threshold, the target byte is determined to be a variable byte.

6. The method according to claim 5, characterized in that Before comparing the first difference with a preset difference threshold, the method further includes: Acquire other payload data in the effective payload data, where the other payload data is data in the effective payload data except the initial data; Acquire a third response data set corresponding to the other payload data, wherein the third response data set includes third response data returned by the target program for each of the other payload data; After comparing the first difference with a preset difference threshold, the method further includes: If the first difference is greater than or equal to the preset difference threshold, obtaining a second difference between the second response data and each of the third response data in the third response data set; If each of the second differences is greater than the preset difference threshold, the target byte is determined to be a mutable byte, the test data is added to the payload data, the test data is used as the initial data, and the step of performing the first mutation operation on the target byte of the initial data using the first mutation method is performed; If the second difference is smaller than the preset difference threshold, the target byte is determined to be a non-volatile byte.

7. The method according to claim 1, characterized in that The performing a second mutation operation on the initial data based on the second mutation mode to obtain the mutated data includes: If the target byte is a variable byte, obtaining the byte sequence number of the target byte in the initial data; Insert a preset character string into the initial data based on the byte sequence number to obtain variant data, wherein the preset character string is any character string in the variant character set; or, Insert randomly generated characters into the initial data based on the byte sequence number to obtain variant data; or, The target bytes of the initial data are replaced by randomly generated characters to obtain mutated data.

8. A network protocol fuzzy testing device, characterized in that: The device comprises: A response data acquisition unit, used for acquiring initial data input into a target program, and first response data output by the target program in response to the initial data; A test data acquisition unit, configured to perform a first mutation operation on a target byte of the initial data in a first mutation manner to obtain test data corresponding to the initial data; a difference determination unit, configured to obtain second response data corresponding to the test data, and determine a first difference between the first response data and the second response data based on a difference algorithm; a variant data acquisition unit, configured to perform a second variant operation on the initial data based on a second variant mode to obtain variant data if the first difference indicates that the target byte is a variable byte; The testing unit is used to transmit the variant data to the target program and perform fuzz testing on the network protocol of the target program.

9. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the steps of the method according to any one of claims 1 to 7.

10. An electronic device comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the steps of the method according to any one of claims 1 to 7.

Images