Protocol fuzz testing method and system based on cross-multi-state

Abstract

The invention relates to a protocol fuzz testing method and system based on cross-multi-state, and the method comprises the following steps: S1, carrying out the preprocessing of a target protocol entity program, and carrying out the testing preparation; s2, performing a fuzzy test, including a recursive selection field combination stage and a valuable seed replacement and variation stage in the fuzzy test process, and synchronously updating a variation field relation table and a variation field selection probability table; and S3, feeding back the result information. The system comprises a test preparation module, a fuzzy test module and a result information feedback module. According to the invention, the transitivity of the field relationship is utilized to carry out combined variation on the fields of all the data models in the adjacent related states, unnecessary variation operation is reduced, the variation field relationship is efficiently utilized to carry out combined variation, and a field relationship table and a probability selection table between the state data models are introduced to improve the reliability of the state data models. The branch coverage rate and the test diversity are improved, and the test efficiency is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of fuzzy testing, and in particular relates to a protocol fuzzy testing method and system based on spanning multiple states. Background Art

[0002] Network protocol fuzz testing is a security testing method used to identify potential security vulnerabilities in computer programs or systems. The basic principle is to send a large amount of random or incompletely formatted data to the target network service or protocol to observe the system's response and behavioral changes. This technology can help find system crashes, undefined behaviors, or other security issues caused by abnormal input. For example, CVE-2015-5477 is a vulnerability that affects the BIND DNS server. The vulnerability involves the processing of TKEY queries. An attacker can send specially crafted TKEY DNS requests to cause assertion failures in BIND, which in turn causes the system to crash, allowing malicious users to launch a denial of service attack.

[0003] In recent years, the technology of protocol fuzz testing based on grammar generation has developed rapidly. The emerging method combines grammar generation and coverage guidance, which greatly improves the ability and depth of protocol vulnerability detection. This method uses coverage branch feedback as the main criterion, combines grammar-driven generation and dynamic analysis, and realizes intelligent test case construction. The core idea is that the generated test cases must not only conform to the protocol grammar, but also explore the program execution path in a targeted manner, thereby increasing the chance of discovering potential defects. Therefore, this new method not only improves the test efficiency, but also achieves code coverage more accurately, helping to reveal more hidden and deep security risks. The current work related to protocol fuzz testing based on grammar generation and coverage guidance includes the following: When Charon selects a field of a state data model for mutation, if a field mutation in a state adds a coverage branch, it keeps the mutation value of the field unchanged and mutates the field of the next state data model. This strategy can pass valid code trigger values ​​to subsequent states. However, the test complexity of this method is high. If there are too many states, it may overemphasize the mutation of the subsequent state data model fields and ignore the mutation of the previous state fields.

[0004] PAVFuzz automatically learns the relationship between two mutated fields in adjacent state models during testing to guide testing. When a field needs to be mutated, PAVFuzz queries the relationship table, finds the mutated field of the previous state model with the largest relationship value, and mutates it together with the current mutated field. This process is designed to guide fuzz testing towards maximizing coverage.

[0005] In summary, although the protocol fuzz testing technology based on syntax generation and coverage feedback has achieved certain results, there are still problems with the large number of fields and single selection in the field combination mutation between state data models. The actual situation shows that only the field combination mutation of specific before and after state data models can significantly improve the coverage. In the limited testing time, it is impossible to accurately focus on the key combination fields, which will limit the effect and efficiency of fuzz testing. Therefore, identifying and prioritizing the combination fields that have a significant impact on coverage is the key to improving the effectiveness of mutation strategies. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a protocol fuzzy testing method and system based on cross-multi-states, which improves branch coverage and test diversity and effectively improves test efficiency by introducing field relationship tables and probability selection tables between state data models.

[0007] The present invention provides a protocol fuzzy testing method based on cross-multi-state, which is characterized by comprising the following steps: S1: Preprocess the target protocol entity program to prepare for testing; S2: Perform fuzz testing, which includes a recursive field combination selection phase and a valuable seed replacement and mutation phase, and simultaneously updates the mutation field relationship table and the mutation field selection probability table; S3: Provide feedback on the result information.

[0008] Preferably, the specific steps of step S1 include: S1.1: Use the stub compilation tool to perform stub compilation on the target protocol entity program to generate the corresponding binary executable file; S1.2: Combined with the official protocol specification of the target protocol entity program, use the data model definition function provided by the Boofuzz ​​fuzz testing framework to define the data model set of the protocol , and its calculation formula is: ={ ,..., ,..., }, i=1,…,n, Where n is the total number of data models; S1.3: Use the state model definition function provided by the Boofuzz ​​fuzz testing framework to define the state model set of the protocol. The calculation formula is: ={ ,..., ,..., }, j=1,…,m, in, Represents a state model, which is a collection of data models In it, several data models are composed in a certain order, and m is the length of the state model set; S1.4: Run the binary executable file generated in step S1.1, and open a shared memory ShareMem of 64KB, and count the coverage branch information of the target protocol entity program in real time.

[0009] Preferably, the specific steps of step S2 include: S2.1: State model selection; from the state model set Select a state model in order , go to step S2.2, if the state model set When the traversal is completed, the process re-enters step S2.1 until the set test time is over; S2.2: Data model selection; based on the state model in step S2.1 above The sequential relationship of the data model in the traversal state model Get the data model , and initialize the data model The mutation value of , go to step S2.3, if for the state model When the traversal is completed, the target protocol entity program is reset to the initial state and goes to step S2.1. Initialize the data model The calculation formula of the variation value is: =DM, in, To initialize the data model The mutation value, DM is the fixed number of mutations, which is taken in the data model during the field selection phase. The number of new test cases generated under S2.3: Recursive selection of field combination phase; extracting data model A collection of mutation fields consisting of multiple mutation fields , and its calculation formula is: ={ ,..., ,..., }, i=1,…,n, f=1,…,k, Among them, n is the total number of data models, k is the number of data models The number of variant fields included in ; The variant field relationship table is a tree data structure of a prefix tree, which is specially used to process string prefix matching. The string stored in each non-leaf node is the data model name or field subscript, and the leaf node also contains the specific relationship value; The variant field selection probability table is a tree data structure of a prefix tree, which is specially used to process string prefix matching. The string stored in each non-leaf node is the data model name or field subscript, and the leaf node also contains the specific selection probability value probability; Under the guidance of the variant field selection probability table, a probability selection algorithm of a tree array is used to select a field relation tuple from the variant field relation table according to probability ( , ),in Is the current data model The string concatenated with the model name and the variant field subscript. Is the current data model In the state model The previous data model in The model name and the variant field subscript concatenated string, and then according to Select data model in the relationship table of demutated fields In the state model The field relation tuple of the previous data model in If the value of all fields in the previous data model is 0, then Select from all the fields in the previous data model until the state model is traversed Data model in; add all selected field relation tuples to the field relation tuple set , after each test, the field relation tuple set Clear; set the field relation tuple Each variant field in is added to the variant field collection , clear the collection after each test; S2.4: Replacement and mutation phase of valuable seeds; set of mutated field values ​​in step S2.3 Mutate or replace the value of each field in the , and add all mutated fields to the mutated field value set In the example, after each test, the mutated field value set Clear; generate data model The mutated data packet , thus forming a data packet set , and its calculation formula is: ={ ,..., ,..., }, l=1,…,s, Among them, s is the state model The total number of data models in the set, and the set is cleared after each test; Gathering Data Packets The data packets in the state model The sequential combination of ; Test cases The state model is included The data packet after the field mutation or value replacement of each data model in the data; S2.5: Test cases Inject into the target protocol entity program, count the coverage branch information of the opened shared memory ShareMem and the status information returned by the target protocol entity program.

[0010] Preferably, the specific steps of step S2 also include: When the test case generated in step S2.4 When the target protocol entity program crashes, the exception log is recorded and the test case is saved , used for vulnerability analysis after the test is completed.

[0011] Preferably, the variant field value set collected in step S2.4 is The value of the coverage branch can be increased and added to the valuable seed pool, and the values ​​in the valuable seed pool are preferentially used for replacement or mutation.

[0012] Preferably, in the update phase of the variant field relationship table and the variant field selection probability table in step S2, the relationship values ​​of the relevant variant fields in the variant field relationship table and the probability values ​​of the variant field selection probability table are updated and quantitatively represented. The specific steps include: S2.6: Collect the coverage branch information of step S2.5; in each test case After execution, determine whether there is a new coverage branch. If there is a new coverage branch, go to step S2.7 and step S2.8. If not, go back to step S2.4. S2.7: Update the relationship values ​​in the mutation field relationship table and the probability values ​​in the mutation field selection probability table. For the field relationship tuple set in step S2.3 All the field tuples in the mutated field relationship table are updated with relation values, and the mutated field selection probability table is updated with probability values; S2.8 Update of valuable seed pool.

[0013] Preferably, the update of the relation value value in the mutated field relation table is performed by searching the field relation tuple set. Each field relation tuple in , ) to search for a specific leaf node and add 1 to the value of the corresponding leaf node; The probability value in the mutation field selection probability table is updated. The specific steps are: Prefix matching is performed on the variant field relationship table. The specific steps are to find the field relationship tuple set Each field relation tuple in , ) The concatenated string will be returned with All relevant variant fields are leaf nodes. The value of the leaf node is the relationship value. The value is mapped to probability and the softmax formula is used. The formula is as follows:

[0014] in, Represents a field relation tuple ( , ) The probability of choosing y; The value of ranges from 1 to v, which is the number of all relationship fields with the field with index 0 in the i-th data model; Then, in the variant field selection probability table, according to the field relationship tuple ( , ) to search for a specific leaf node and update the probability of the corresponding leaf node; Preferably, the step S3 presents the collected coverage branch data information in real time and visually in the user interface, and intuitively feeds back the test progress of the current fuzz test.

[0015] A system based on a protocol fuzz testing method across multiple states, comprising a test preparation module, a fuzz testing module, and a result information feedback module; Test preparation module; provide test data input and pre-process the test data input; use the stub compilation tool to perform stub compilation on the target protocol entity program to generate the corresponding binary executable file; refer to the official protocol specification of the target protocol entity program, write the test template, and form a data model set and state model collection ; Open up a 64KB shared memory ShareMem to count the coverage branch information of the target protocol entity program in real time; Fuzz testing module; state model The sequential relationship of the data model in the traversal state model Get the data model , and then execute the recursive field selection stage; use the tree array probability selection algorithm to select the mutation field set according to the mutation field relationship table , and replace or mutate the value of each mutated field to generate test cases , the test case Inject into the target protocol entity program, collect feedback information, and then update the relationship value in the mutation field relationship table, the probability value in the mutation field selection probability table, and the valuable seed pool; Result information feedback module; for test cases The results after being input into the target protocol entity program are analyzed, and the collected coverage branch data information is visualized in real time in the user interface, providing intuitive feedback on the test progress of the current fuzz test.

[0016] The present invention has the following technical effects: 1. The transitivity of field relationships is used to perform combined mutations on the fields of data models of all adjacent related states, reducing unnecessary mutation operations. The mutation field relationships are efficiently used for combined mutations. By introducing the field relationship table and probability selection table between state data models, the branch coverage and test diversity are improved, effectively improving the test efficiency.

[0017] 2. The relationship values ​​of the mutated fields in the data model before and after the dynamic calculation are used, and the relevant fields are selected through probability mapping. The probability selection algorithm is used instead of only selecting the field with the largest relationship value to improve the diversity of field selection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of the protocol fuzzy testing method based on multiple states of the present invention; Figure 2 A schematic diagram of a data model set defined by the protocol fuzzy testing method across multiple states of the present invention, taking the RTSP protocol as an example; Figure 3 A schematic diagram of a state model set defined by the protocol fuzzy testing method across multiple states of the present invention, taking the RTSP protocol as an example; Figure 4 The present invention is based on the cross-multi-state protocol fuzzy testing method, taking the RTSP protocol as an example, and defines a recursive selection field schematic diagram. DETAILED DESCRIPTION

[0019] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings.

[0020] like Figure 1 As shown, the protocol fuzz testing method based on cross-multi-states includes the following steps: S1: Preprocess the target protocol entity program to prepare for testing; S1.1: Use the stub compilation tool to perform stub compilation on the target protocol entity program to generate the corresponding binary executable file; Use the gcc and g++ compilation tools that come with AFL-Net to perform stub compilation on the target protocol entity program to generate the corresponding binary executable file. Its essence is to mark each static program block of the program under test. In the subsequent execution of a test case, the entire execution path of the test case can be determined according to different marks; S1.2: Combined with the official protocol specification of the target protocol entity program, use the data model definition function provided by the Boofuzz ​​fuzz testing framework to define the data model set of the protocol , and its calculation formula is: ={ ,..., ,..., }, i=1,…,n, Where n is the total number of data models; S1.3: Use the state model definition function provided by the Boofuzz ​​fuzz testing framework to define the state model set of the protocol. The calculation formula is: ={ ,..., ,..., }, j=1,…,m, in, Represents a state model, which is a collection of data models In it, several data models are composed in a certain order, and m is the length of the state model set; The defined data model set and state model collection Used as a protocol specification template for generating new test cases; like Figure 2 As shown, using the RTSP protocol, the defined data model set = {option, description 1, description 2, create, notify, record, play, pause, stop, get parameter, set parameter 1, set parameter 2}; like Figure 3As shown, using the RTSP protocol, the defined state model set = {description 1->notification, description 2->notification, option->record, setup->get parameter, setup->set parameter 1, setup->set parameter 2, setup->play, setup->play->pause, setup->play->pause->stop}; S1.4: Run the binary executable file generated by step S1.1, and open a shared memory ShareMem of 64KB. 64K bytes can represent 65536 branches, which is larger than the number of branches of most target protocol entity programs. It can meet the branch coverage statistics requirements of most target protocol entity programs and is used to count the coverage branch information of the target protocol entity program in real time.

[0021] S2: Perform fuzz testing, which includes a recursive field combination selection phase and a valuable seed replacement and mutation phase, and simultaneously updates the mutation field relationship table and the mutation field selection probability table; S2.1: State model selection; from the state model set Select a state model in order , go to step S2.2, if the state model set When the traversal is completed, the process re-enters step S2.1 until the set test time is over; S2.2: Data model selection; based on the state model in step S2.1 above The sequential relationship of the data model in the traversal state model Get the data model , and initialize the data model The mutation value of , go to step S2.3, if for the state model When the traversal is completed, the target protocol entity program is reset to the initial state and goes to step S2.1. Initialize the data model The calculation formula of the variation value is: =DM, in, To initialize the data model The mutation value, DM is the fixed number of mutations, which is taken in the data model during the field selection phase. The number of new test cases generated is DM=2000; Go to step S2.3, if for the state model When the traversal is completed, the protocol entity program is reset to the initial state and goes to step S2.1; S2.3: Recursive selection of field combination phase; extracting data model A collection of mutation fields consisting of multiple mutation fields , and its calculation formula is: ={ ,..., ,..., }, i=1,…,n, f=1,…,k, Among them, n is the total number of data models, k is the number of data models The number of variant fields included in ; The variant field relationship table is a tree data structure of a prefix tree, which is specially used to process string prefix matching. The string stored in each non-leaf node is the data model name or field subscript, and the leaf node also contains the specific relationship value; The variant field selection probability table is a tree data structure of a prefix tree, which is specially used to process string prefix matching. The string stored in each non-leaf node is the data model name or field subscript, and the leaf node also contains the specific selection probability value probability; The probability selection algorithm of the tree array is a method for generating random samples that obey a specified probability distribution, especially for discrete probability distribution. Its main idea is to use the tree array to assist in the rapid construction, query and update of the cumulative probability table. Because binary search is used, the time complexity is O( , thus supporting efficient discrete probability selection. The algorithm has been tested with millions of samples, and the results are consistent with the expected discrete probability distribution.

[0022] The sampling process of the original probability array P using the probability selection algorithm of the tree array is: 1) Initialize the tree array: Create a tree array of length N+1 and initialize all elements to 0. The array has one more element because the tree array usually starts with 1, and N is the length of the original probability array; 2) Build a tree array; traverse the probability array P, and for each event, update it in the tree array. This process involves defining an update function that is responsible for adding a value at a given index position and then adjusting the related nodes. Specifically, the function starts at the index and moves up in steps by bitwise ANDing the current index with its binary complement until it exceeds the array length.

[0023] 3) Sampling process: calculate the total weight (i.e., cumulative probability sum), generate a random floating point number between 0 and the total weight, use the binary search algorithm to determine which event's cumulative probability interval the random number belongs to, and traverse the prefix sum to determine the appropriate event subscript.

[0024] Under the guidance of the variant field selection probability table, a probability selection algorithm of a tree array is used to select a field relation tuple from the variant field relation table according to probability ( , ),in Is the current data model The string concatenated with the model name and the variant field subscript. Is the current data model In the state model The previous data model in The model name and the variant field subscript concatenated string, and then according to Select data model in the relationship table of demutated fields In the state model The field relation tuple of the previous data model in If the value of all fields in the previous data model is 0, then Select from all the fields in the previous data model until the state model is traversed Data model in; add all selected field relation tuples to the field relation tuple set , after each test, the field relation tuple set Clear; set the field relation tuple Each variant field in is added to the variant field collection , clear the collection after each test; Figure 4 As shown, a schematic diagram of a recursive selection field defined using the RTSP protocol; S2.4: Replacement and mutation phase of valuable seeds; set of mutated field values ​​in step S2.3 Mutate or replace the value of each field in the , and add all mutated fields to the mutated field value set In the example, after each test, the mutated field value set Clear; generate data model The mutated data packet , thus forming a data packet set , and its calculation formula is: ={ ,..., ,..., }, l=1,…,s, Among them, s is the state model The total number of data models in the set, and the set is cleared after each test; Gathering Data Packets The data packets in the state model The sequential combination of ; Test cases The state model is included The data packet after the field mutation or value replacement of each data model in the data; S2.5: Test cases Inject into the target protocol entity program, count the coverage branch information of the opened shared memory ShareMem and the status information returned by the target protocol entity program.

[0025] When the test case generated in step S2.4 When the target protocol entity program crashes, the exception log is recorded and the test case is saved , used for vulnerability analysis after the test is completed.

[0026] The mutated field value set collected in step S2.4 The value of the coverage branch can be increased and added to the valuable seed pool, and the values ​​in the valuable seed pool are preferentially used for replacement or mutation.

[0027] In the update phase of the mutation field relationship table and the mutation field selection probability table in step S2, the relationship values ​​of the relevant mutation fields in the mutation field relationship table and the probability values ​​of the mutation field selection probability table are updated and quantitatively represented. The specific steps include: S2.6: Collect the coverage branch information of step S2.5; in each test case After execution, determine whether there is a new coverage branch. If there is a new coverage branch, go to step S2.7 and step S2.8. If not, go back to step S2.4. S2.7: Update the relationship values ​​in the mutation field relationship table and the probability values ​​in the mutation field selection probability table. For the field relationship tuple set in step S2.3 All the field tuples in the mutated field relationship table are updated with relation values, and the mutated field selection probability table is updated with probability values; S2.8 Update of valuable seed pool.

[0028] Update the relation value in the mutated field relation table. The specific steps are to find the field relation tuple set. Each field relation tuple in , ) to search for a specific leaf node and add 1 to the value of the corresponding leaf node; The probability value in the mutation field selection probability table is updated. The specific steps are: Prefix matching is performed on the variant field relationship table. The specific steps are to find the field relationship tuple set Each field relation tuple in , ) The concatenated string will be returned with All relevant variant fields are leaf nodes. The value of the leaf node is the relationship value. The value is mapped to probability and the softmax formula is used. The formula is as follows:

[0029] in, Represents a field relation tuple ( , ) The probability of choosing y; The value of ranges from 1 to v, which is the number of all relationship fields with the field with index 0 in the i-th data model; Then, in the variant field selection probability table, according to the field relationship tuple ( , ) to search for a specific leaf node and update the probability of the corresponding leaf node; S3: Provide feedback on the result information.

[0030] The step S3 presents the collected coverage branch data information in real time in the user interface, and intuitively feedbacks the test progress of the current fuzz test. At the same time, the number of times the target protocol entity program crashes is tracked and displayed in real time to ensure timely identification of system stability risks. In addition, the system automatically records and saves each test case that causes the target protocol entity program to crash. , in order to provide key basis for subsequent crash reproduction and in-depth analysis.

[0031] For this embodiment, experimental verification was carried out on the RTSP protocol and the MQTT protocol. The control group selected the most advanced fuzzer Boofuzz, and each group of experiments lasted for 24 hours. In order to reduce the impact of randomness in the fuzz test, all experiments were repeated three times and the results were averaged.

[0032] The experimental results are shown in Table 1 below: Table 1 Target Protocol Target protocol implementation Number of branches covered by Boofuzz This embodiment covers the number of branches Improvements of this embodiment over Boofuzz RTSP Live555 3023 3216 6.4% MQTT mosquitto 1942 2057 5.9% As can be seen from Table 1 above, in the RTSP protocol, the number of branches covered by this embodiment is 193 more than that covered by Boofuzz, a relative increase of 6.4%; in the MQTT protocol, the number of branches covered by this embodiment is 115 more than that covered by Boofuzz, a relative increase of 5.9%; this embodiment has a significant improvement in the number of covered branches. This embodiment uses the transitivity of field relationships to perform combined mutations on the fields of the data models of all adjacent related states, reducing unnecessary mutation operations, and efficiently using the mutation field relationship for combined mutations, and by introducing the field relationship table and probability selection table between state data models, it improves branch coverage and test diversity, effectively improving test efficiency.

[0033] Any of the methods or steps described above may be stored as computer instructions or programs in various types of computer memories, and the computer instructions or programs may be recognized by various types of computer processors to implement any of the methods or steps described above.

[0034] The embodiments described above are only descriptions of the preferred modes of the present invention, and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A protocol fuzz testing method based on multiple states, characterized by: The steps include: S1: Preprocess the target protocol entity program to prepare for testing; S2: Perform fuzz testing, which includes a recursive field combination selection phase and a valuable seed replacement and mutation phase, and simultaneously updates the mutation field relationship table and the mutation field selection probability table; S3: Provide feedback on the result information.

2. The protocol fuzz testing method based on cross-multi-state according to claim 1 is characterized in that: The specific steps of step S1 include: S1.1: Use the stub compilation tool to perform stub compilation on the target protocol entity program to generate the corresponding binary executable file; S1.2: Combined with the official protocol specification of the target protocol entity program, use the data model definition function provided by the Boofuzz ​​fuzz testing framework to define the data model set of the protocol , and its calculation formula is: ={ ,..., ,..., }, i=1,…,n, Where n is the total number of data models; S1.3: Use the state model definition function provided by the Boofuzz ​​fuzz testing framework to define the state model set of the protocol. The calculation formula is: ={ ,..., ,..., }, j=1,…,m, in, Represents a state model, which is a collection of data models In it, several data models are composed in a certain order, and m is the length of the state model set; S1.4: Run the binary executable file generated in step S1.1, and open a shared memory ShareMem of 64KB, and count the coverage branch information of the target protocol entity program in real time.

3. The protocol fuzz testing method based on spanning multiple states according to claim 2 is characterized in that: The specific steps of step S2 include: S2.1: State model selection; from the state model set Select a state model in order , go to step S2.2, if the state model set When the traversal is completed, the process re-enters step S2.1 until the set test time is over; S2.2: Data model selection; based on the state model in step S2.1 above The sequential relationship of the data model in the traversal state model Get the data model , and initialize the data model The mutation value of , go to step S2.3, if for the state model When the traversal is completed, the target protocol entity program is reset to the initial state and goes to step S2.

1. Initialize the data model The calculation formula of the variation value is: =DM, in, To initialize the data model The mutation value, DM is the fixed number of mutations, which is taken in the data model during the field selection phase. The number of new test cases generated under S2.3: Recursive selection of field combination phase; extracting data model A collection of mutation fields consisting of multiple mutation fields , and its calculation formula is: ={ ,..., ,..., }, i=1,…,n ,f=1,…,k, Among them, n is the total number of data models, k is the number of data models The number of variant fields included in ; The variant field relationship table is a tree data structure of a prefix tree, which is specially used to process string prefix matching. The string stored in each non-leaf node is the data model name or field subscript, and the leaf node also contains the specific relationship value; The variant field selection probability table is a tree data structure of a prefix tree, which is specially used to process string prefix matching. The string stored in each non-leaf node is the data model name or field subscript, and the leaf node also contains the specific selection probability value probability; Under the guidance of the variant field selection probability table, a probability selection algorithm of a tree array is used to select a field relation tuple from the variant field relation table according to probability ( , ),in Is the current data model The string concatenated with the model name and the variant field subscript. Is the current data model In the state model The previous data model in The model name and the variant field subscript concatenated string, and then according to Select data model in the relationship table of demutated fields In the state model The field relation tuple of the previous data model in If the value of all fields in the previous data model is 0, then Select from all the fields in the previous data model until the state model is traversed Data model in; add all selected field relation tuples to the field relation tuple set , after each test, the field relation tuple set Clear; set the field relation tuple Each variant field in is added to the variant field collection , clear the collection after each test; S2.4: Replacement and mutation phase of valuable seeds; set of mutated field values ​​in step S2.3 Mutate or replace the value of each field in the , and add all mutated fields to the mutated field value set In the example, after each test, the mutated field value set Clear; generate data model The mutated data packet , thus forming a data packet set , and its calculation formula is: ＝{ ,..., ,..., }， l＝1,…,s， Among them, s is the state model The total number of data models in the set, and the set is cleared after each test; Gathering Data Packets The data packets in the state model The sequential combination of ; Test cases The state model is included The data packet after the field mutation or value replacement of each data model in the data; S2.5: Test cases Inject into the target protocol entity program, count the coverage branch information of the opened shared memory ShareMem and the status information returned by the target protocol entity program.

4. The protocol fuzz testing method based on spanning multiple states according to claim 3 is characterized in that: The specific steps of step S2 also include: When the test case generated in step S2.4 When the target protocol entity program crashes, the exception log is recorded and the test case is saved , used for vulnerability analysis after the test is completed.

5. The protocol fuzz testing method based on spanning multiple states according to claim 3 is characterized in that: The mutated field value set collected in step S2.4 The value of the coverage branch can be increased and added to the valuable seed pool, and the values ​​in the valuable seed pool are preferentially used for replacement or mutation.

6. The protocol fuzz testing method based on spanning multiple states according to claim 3 is characterized in that: In the update phase of the mutation field relationship table and the mutation field selection probability table in step S2, the relationship values ​​of the relevant mutation fields in the mutation field relationship table and the probability values ​​of the mutation field selection probability table are updated and quantitatively represented. The specific steps include: S2.6: Collect the coverage branch information of step S2.5; in each test case After execution, determine whether there is a new coverage branch. If there is a new coverage branch, go to step S2.7 and step S2.

8. If not, go back to step S2.

4. S2.7: Update the relationship values ​​in the mutated field relationship table and the probability values ​​in the mutated field selection probability table. For the field relationship tuple set in step S2.3 All the field tuples in the mutated field relationship table are updated with relation values, and the mutated field selection probability table is updated with probability values; S2.8 Update of valuable seed pool.

7. The protocol fuzz testing method based on spanning multiple states according to claim 3 is characterized in that: Update the relation value in the mutated field relation table. The specific steps are to find the field relation tuple set. Each field relation tuple in , ) to search for a specific leaf node and add 1 to the value of the corresponding leaf node; The probability value in the mutation field selection probability table is updated. The specific steps are: Prefix matching is performed on the variant field relationship table. The specific steps are to find the field relationship tuple set Each field relation tuple in , ) The concatenated string will be returned with All relevant variant fields are leaf nodes. The value of the leaf node is the relationship value. The value is mapped to probability and the softmax formula is used. The formula is as follows: ， in, Represents a field relation tuple ( , ) The probability of choosing y; The value of ranges from 1 to v, which is the number of all relationship fields with the field with index 0 in the i-th data model; Then, in the variant field selection probability table, according to the field relationship tuple ( , ) to search for a specific leaf node and update the probability of the corresponding leaf node.

8. The protocol fuzz testing method based on cross-multi-state according to claim 1 is characterized in that: The step S3 presents the collected coverage branch data information in real time and visually in the user interface, providing intuitive feedback on the test progress of the current fuzz test.

9. A system comprising the protocol fuzz testing method based on multiple states according to claim 1, characterized in that: It includes test preparation module, fuzzy test module and result information feedback module; Test preparation module: providing test data input and pre-processing the test data input; Use the stub compilation tool to perform stub compilation on the target protocol entity program to generate the corresponding binary executable file; refer to the official protocol specification of the target protocol entity program, write a test template, and form a data model set and state model collection ; Open up a 64KB shared memory ShareMem to count the coverage branch information of the target protocol entity program in real time; Fuzz testing module; state model The sequential relationship of the data model in the traversal state model Get the data model , and then execute the recursive field selection stage; use the tree array probability selection algorithm to select the mutation field set according to the mutation field relationship table , and replace or mutate the value of each mutated field to generate test cases , the test case Inject into the target protocol entity program, collect feedback information, and then update the relationship value in the mutation field relationship table, the probability value in the mutation field selection probability table, and the valuable seed pool; Result information feedback module; for test cases The results after being input into the target protocol entity program are analyzed, and the collected coverage branch data information is visualized in real time in the user interface, providing intuitive feedback on the test progress of the current fuzz test.

Images