Network protocol grey box fuzzy test method and device based on equipment response state

Abstract

The invention provides a network protocol grey box fuzzy testing method and device based on an equipment response state, and the method comprises the steps: collecting an equipment response state message returned by target network equipment, and automatically dividing message fragments based on the equipment response state message; constructing and maintaining a state machine model based on the equipment response state message; intelligently selecting a seed message according to the state machine model; performing variation based on message fragments on the selected seed messages to generate a variation message sequence; sending the variation message sequence to the target network device, and collecting a response message returned by the target network device; and adding the variation message sequence causing the new state, the new state transition or the new vulnerability into the seed library, and adding the variation message sequence causing the equipment crash into the crash input library. According to the method, the message fragments are automatically divided by analyzing the equipment response message, and the state machine model is constructed to guide seed message selection and variation, so that the efficiency and effectiveness of fuzzy testing are improved.

Description

Technical Field

[0001] The present invention relates to the field of network testing technology, and in particular to a network protocol gray box fuzzy testing method and device based on device response status. Background Art

[0002] With the continuous development and popularization of network technology, various network intelligent devices have come into our sight, and their existence has brought us a new way of life. At the same time, network intelligent devices have also exposed many serious security issues. Network intelligent devices provide services to remote users or request services from remote servers through network protocols, which also provides ample opportunities for remote attacks. Therefore, network protocols have become an important risk point for network intelligent devices.

[0003] Common analysis methods for analyzing network protocols include fuzz testing, static analysis, and manual auditing. Static analysis methods usually require obtaining the source code of the program first and modeling the execution path and constraints of the program. Generally, the source code and development documents of network protocol-related programs for network intelligent devices are difficult to obtain, and network protocol programs are generally large in scale, resulting in high analysis complexity for static analysis methods. Manual audits are very inefficient in discovering network protocol vulnerabilities, and it is difficult to summarize a set of manual auditing methodologies. The fuzz testing method has the characteristics of not relying on program source code or documents, being simple and easy to use, having a high degree of automation, and being highly reusable, so it is widely studied and used in the industry.

[0004] At present, the fuzz testing technologies for network protocols are mainly divided into black box fuzz testing, stateless gray box fuzz testing, and stateful gray box fuzz testing. However, each of these testing technologies has some defects:

[0005] 1. Black box fuzz testing technology: There are some black box testing tools in the existing technology. These tools traverse the given protocol model in the form of a finite state machine or graph, and use the data model or syntax of the received message to generate a message sequence and test the device under test. However, the effectiveness of these tools depends largely on the integrity of the given state model and data model, which are usually manually written based on the developer's understanding of the protocol specification document and the captured network traffic samples between the client and the server, so they are difficult to use. In addition, black box testing technology is not suitable for protocols that are not disclosed in the protocol standard document.

[0006] 2. Stateless gray-box fuzz testing technology: The problems with stateless gray-box testing tools for network protocols are: First, the protocol program is stateful and message-driven. It gets a series of messages (also known as requests) from the client, processes the messages and sends responses. The response of the protocol program depends on the current message and the current internal protocol program state controlled by the previous message sequence. Only when a specific pre-condition state is met and a specific message is received will a specific subsequent state be triggered. However, the current gray-box tester and its extensions know neither the protocol program state information nor the required structure or order of the messages to be sent. This leads to the assumption that for a message sequence (m1, m2, …, mi), a message mi is the most useful message, and exploring it will lead to higher code coverage or discover potential vulnerabilities. These tools treat each message in the message sequence equally, and before processing mi, they will repeatedly mutate the less useful messages m1 to mi-1, without knowing that they should focus on mi. Therefore, these tools generate a large number of useless messages, or the generated messages cannot effectively trigger new states, resulting in poor coverage. Secondly, these tools usually input test cases into the program under test at one time during the testing process, and cannot form interaction. Finally, the coverage-based approach of these tools is not suitable for end-to-end fuzz testing, because code coverage is difficult to obtain and calculate in end-to-end fuzz testing. In network protocol fuzz testing of smart devices, end-to-end fuzz testing is an important requirement.

[0007] 3. Stateful gray-box fuzz testing technology: This technology realizes interactive communication and state perception based on the stateless gray-box fuzz testing technology. Specifically, the state of the protocol to be tested is judged by the returned response code, and a state automaton is maintained to model the message transfer of the protocol. This technology selects the target state to be tested in each round of testing, and selects the seed for mutation based on the state. However, when mutating, this technology will adopt a random mutation strategy by default, that is, it assumes that each byte of the message plays the same role and mutates the entire message. In fact, in the network protocol, the message is divided into multiple fields, and the data type and role of each field are different. The network protocol program also operates differently on each field, and the network protocol program will check the format of the message and filter out messages that do not conform to the format. Therefore, this technology may generate a large amount of useless data during the mutation process.

[0008] In addition, some tools in this technology perform stubbing on the static variables and functions of the protocol program in memory, and represent the status information of the protocol program in a more fine-grained manner by detecting the operation of the functions in memory and the access to specific static variables. However, since dynamic stubbing and runtime binary analysis are required, the performance loss is serious. At the same time, these tools also need to analyze the protocol implementation of the network service to obtain the status information. If the protocol implementation is complex or there is no clearly defined protocol specification, these tools may find it difficult to accurately capture and represent the status of the network service. Summary of the invention

[0009] In view of this, the present invention provides a network protocol gray box fuzzy testing method and apparatus based on device response status to solve at least one of the above-mentioned problems.

[0010] In order to achieve the above object, the present invention adopts the following scheme:

[0011] According to a first aspect of the present invention, there is provided a network protocol gray-box fuzz testing method based on device response status, the method comprising: sending an initial message sequence including a message to be tested to a target network device, collecting device response status messages returned by the target network device, and automatically dividing message segments based on the device response status messages; constructing and maintaining a state machine model based on the device response status messages, the state machine model recording a mapping relationship between different message sequences and device states, and updating the state machine model according to a new device response state; intelligently selecting a seed message according to the state machine model; mutating the selected seed message based on the message segments to generate a mutated message sequence; sending the mutated message sequence to the target network device, collecting a response message returned by the target network device, and judging whether a new state, a new state transition or a new vulnerability is triggered based on the response message; adding a mutated message sequence that causes a new state, a new state transition or a new vulnerability to a seed library, and adding a mutated message sequence that causes a device crash to a crash input library.

[0012] As an embodiment of the present invention, the above method automatically divides the message segments based on the device response status message, including: modifying the message to be tested byte by byte, observing the response changes of the target network device, and calculating the similarity between different device response status messages; dividing the message to be tested into multiple segments according to the similarity, each segment corresponding to the processing logic of a specific code segment in the target network device.

[0013] As an embodiment of the present invention, the similarity between the response status messages of different devices in the above method is calculated by the following formula:

[0014]

[0015] In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status messages of two devices, edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another, and the operations include insertion, deletion, flipping, replacement and concatenation.

[0016] As an embodiment of the present invention, the above method of intelligently selecting seed messages according to the state machine model includes: based on the mapping relationship between different message sequences recorded in the state machine model and the device status, selecting the seed message sequence according to a preset priority rule, the priority rule is set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model, and seed messages with high priority are selected first.

[0017] As an embodiment of the present invention, the above method mutates the selected seed message based on the message fragments to generate a mutated message sequence, including: decomposing the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; performing a mutation operation on the message fragments marked as variable fields in the candidate message sequence to be mutated, and the mutation operation includes message-level mutation and fragment-level mutation; the message-level mutation includes adding, deleting and splicing messages, and the fragment-level mutation includes bit flipping, arithmetic operations, replacement, deletion, Havoc and splicing. When performing fragment-level mutation, the length field associated with each modified variable field is modified at the same time, and the message sequence is reassembled to generate a mutated message sequence.

[0018] According to a second aspect of the present invention, a network protocol gray box fuzz testing device based on device response status is provided, the device comprising: a first response collection unit, used to send an initial message sequence containing a message to be tested to a target network device, and collect device response status messages returned by the target network device; a message segmentation unit, used to automatically divide message segments based on the device response status message; a state machine construction unit, used to construct and maintain a state machine model based on the device response status message, the state machine model records the mapping relationship between different message sequences and device states, and updates the state machine model according to the new device response state; a seed selection unit, used to intelligently select seed messages according to the state machine model; a message mutation unit, used to mutate the selected seed message based on the message segment to generate a mutated message sequence; a second response collection unit, used to send the mutated message sequence to the target network device, collect the response message returned by the target network device, and determine whether a new state, a new state transition or a new vulnerability is triggered according to the response message; a message adding unit, used to add a mutated message sequence that causes a new state, a new state transition or a new vulnerability to a seed library, and add a mutated message sequence that causes a device crash to a crash input library.

[0019] As an embodiment of the present invention, the above-mentioned message fragment division unit: a similarity calculation module, used to modify the message to be tested byte by byte, observe the response changes of the target network device, and calculate the similarity between response status messages of different devices; a fragment division module, used to divide the message to be tested into multiple fragments according to the similarity, each fragment corresponding to the processing logic of a specific code segment in the target network device.

[0020] As an embodiment of the present invention, the similarity between the response status messages of different devices in the above method is calculated by the following formula:

[0021]

[0022] In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status messages of two devices, edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another, and the operations include insertion, deletion, flipping, replacement and concatenation.

[0023] As an embodiment of the present invention, the seed selection unit in the above method is specifically used to: based on the mapping relationship between different message sequences recorded in the state machine model and the device state, select the seed message sequence according to a preset priority rule, and the priority rule is set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model, and seed messages with high priority are selected first.

[0024] As an embodiment of the present invention, the message mutation unit in the above method includes: a decomposition module, which is used to decompose the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; a mutation module, which is used to perform mutation operations on message fragments marked as variable fields in the candidate message sequence to be mutated, and the mutation operations include message-level mutation and fragment-level mutation. The message-level mutation includes adding, deleting and splicing messages, and the fragment-level mutation includes bit flipping, arithmetic operations, replacement, deletion, Havoc and splicing; a modification and assembly module, which is used to modify the length field associated with each modified variable field at the same time when performing fragment-level mutation, and reassemble the message sequence to generate a mutated message sequence.

[0025] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0026] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0027] The network protocol gray box fuzz testing method and device based on device response status proposed in the present invention automatically divides message fragments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents, is applicable to private protocols or non-standard protocols, and can effectively reduce the generation of invalid mutation messages, reduce testing costs, and improve vulnerability discovery rates. It is particularly suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy, and state selection strategy of the present application, as well as the message fragment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0029] Figure 1 is a schematic diagram of a processing component inside a response device provided in an embodiment of the present application;

[0030] Figure 2 It is a flowchart of a network protocol gray box fuzzy testing method based on device response status provided by an embodiment of the present application;

[0031] Figure 3 is a schematic diagram of a process of automatically dividing message segments provided by an embodiment of the present invention;

[0032] Figure 4 It is a schematic diagram of a process for generating a variant message sequence provided in an embodiment of the present application;

[0033] Figure 5 It is a general architecture diagram of a network protocol gray box fuzz testing method based on device response status provided by an embodiment of the present application;

[0034] Figure 6 is a schematic diagram of the structure of the corpus module provided in an embodiment of the present application;

[0035] Figure 7 It is a structural schematic diagram of a network protocol gray box fuzzy testing device based on device response status provided by an embodiment of the present application;

[0036] Figure 8 It is a structural schematic diagram of a message segment division unit provided in an embodiment of the present application;

[0037] Fig. 9 It is a structural diagram of a message variation unit provided in an embodiment of the present application;

[0038] Fig.10 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0040] The information collected in the technical solution of this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0041] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0042] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0043] First, the basic idea of ​​the network protocol gray box fuzz testing method based on device response status of this application is described as follows:

[0044] Regarding the processing of messages within the response device, existing research divides the processing components within the response device into four categories (such as Figure 1 As shown in the figure, there are filters, distributors, functions and responders. The filter is responsible for grammatical analysis of the message. If the received message does not conform to the syntax specified by the protocol, or an exception occurs during the parsing process, the message will be discarded, and the filter will send a response message describing the error to the responder, thereby ensuring that the protocol-related programs run correctly. If the received message conforms to the syntax specified by the protocol, the filter will further extract semantic information and hand it over to the distributor for processing. The distributor selects a function for processing based on the extracted semantic information. After the function is processed, the responder returns a response message, and the responder determines the content of the response information to be sent based on the response code returned by the function. This is a common message processing architecture for network intelligent devices, and most network intelligent devices are designed in accordance with this architecture.

[0045] In network intelligent devices, the responder uses the variable value returned after function processing to determine the content of the response message. The result of the response message directly corresponds to the execution result of the program code, that is, the status of the program running. Therefore, the response message returned by the network intelligent device can be regarded as a valuable source of runtime device status information. Through the content of the response message, the code block that has been executed in the program can be inferred. When the program source code is not available, the correspondence between program execution and response message cannot be directly extracted. Although the response message cannot be equated with the execution path of the device, it can still play an important role in the fuzz testing of network intelligent devices. In the process of two communications, the different response messages returned are a sufficient condition for the program to enter different execution paths. If two inputs get different response messages, it can be inferred that the two inputs trigger different program code execution paths.

[0046] In the protocol, a message is composed of multiple fields. For each field, the protocol program may have corresponding code or function to process. Therefore, if the same response is obtained by mutating two different positions of the message, it can be considered that the two messages triggered the same processing logic, and the two positions may belong to the same field. Therefore, the present application proposes a field division strategy, which does not rely on the protocol standard document and has good effects on private protocols or non-standard protocol implementations.

[0047] like Figure 2 The figure is a flow chart of a network protocol gray box fuzz testing method based on device response status provided by an embodiment of the present application. This embodiment is a description of the present application from the test tool end. The method includes the following steps:

[0048] Step S201: sending an initial message sequence including a message to be tested to a target network device, collecting device response status messages returned by the target network device, and automatically dividing message segments based on the device response status messages.

[0049] The test tool of this embodiment has a network communication module. First, through the network communication module, the test tool, as a client, uses a socket to establish a connection with the target network device and sends an initial message sequence containing the message to be tested. At the same time, the network communication module can implement message synchronization and crash detection mechanisms, ensure communication synchronization by setting multiple delays (communication delay, network delay, device no response waiting delay, etc.), and use a timeout detector to detect device crashes. Then, the response messages returned by the target device are collected, and these response messages contain the operating status information of the device. Based on these response messages, the message is automatically divided into multiple fragments using a message fragment division method based on the device response status.

[0050] Step S202: construct and maintain a state machine model based on the device response status message, the state machine model records the mapping relationship between different message sequences and device states, and updates the state machine model according to the new device response state.

[0051] In this embodiment, a state machine model can be constructed and maintained based on the device response status message collected in step S201. The state machine model records the mapping relationship between different message sequences and device states. The state machine learner receives the server response and updates the protocol state machine using the newly observed states and transitions. If there is a new status code in the server response, a new graph node representing the new state is added, that is, the update of the state machine model depends on the new device response state.

[0052] Step S203: Intelligently select a seed message according to the state machine model.

[0053] In this embodiment, according to the state machine model constructed in step S202, the seed message is intelligently selected. The seed selection strategy can consider factors such as the length of the seed, whether a new path has been found, and the number of times it has been executed. Seeds that are easier to find new paths, smaller in size, and faster in execution are preferred. Specific selection strategies include random, polling, and preference modes, among which the preference mode calculates the score based on the number of times the node is fuzzed, the number of times it is selected, and the number of paths found, and selects nodes with scores higher than the random number.

[0054] Step S204: mutate the selected seed message based on the message fragment to generate a mutated message sequence.

[0055] In this embodiment, a suitable mutation strategy may be selected to mutate the seed message selected in step S203 to generate a mutated message sequence.

[0056] Step S205: Send the mutated message sequence to the target network device, collect the response message returned by the target network device, and determine whether a new state, a new state transition or a new vulnerability is triggered according to the response message.

[0057] This step is similar to step S201, but the variant message sequence generated in step S204 is sent. The response message returned by the target device is collected, and it is determined whether a new state, a new state transition or a new vulnerability is triggered according to the response message.

[0058] Step S206: adding the mutated message sequence that leads to a new state, a new state transition or a new vulnerability to the seed library, and adding the mutated message sequence that leads to a device crash to the crash input library.

[0059] According to the result of step S205, the mutated message sequence that leads to a new state, a new state transition or a new vulnerability is added to the seed library for subsequent iterative testing; the mutated message sequence that causes the device to crash is added to the crash input library for subsequent reproduction and analysis.

[0060] Preferably, Figure 3 As shown, in this embodiment, the automatic division of message segments based on the device response status message in the above step S201 may further include:

[0061] Step S2011: modifying the message to be tested byte by byte, observing the response changes of the target network device, and calculating the similarity between response status messages of different devices.

[0062] Step S2012: Divide the message to be tested into multiple segments according to the similarity, each segment corresponds to the processing logic of a specific code segment in the target network device.

[0063] Network intelligent devices will verify the format and parameters of input information and filter messages that do not conform to standard syntax. Therefore, test cases generated by seed generators based on simple random mutations usually cannot pass message filtering, resulting in many invalid message sequences rejected by filters, resulting in low quality input data generated by existing tools. This application constructs deformed messages by designing different mutation operators for different fields. The premise for implementing this mutation strategy is to have a certain understanding of the format of the protocol. Therefore, this application designs the above-mentioned method for dividing message fragments based on device response status.

[0064] Assume that a network intelligent device sends a message sequence M to request the device to perform certain operations. Any message m∈M can request the device to perform a specific function, and all messages constitute M together to implement one or more operations. At the same time, the collection recovery message sequence M3 is used to reset the network intelligent device to the initial state. The present application selects a message m in the seed S, generates a detection message pi from it by performing operations such as byte-by-byte deletion or flipping on m, and forms a new detection message sequence Mi with other messages in this message sequence. Mi triggers one or more response messages ri (referred to as responses), which contain information about the execution output. The test tool assigns a response pool R to each message to determine whether the new response ri is unique. The uniqueness of the response indicates that it does not belong to any response category existing in the response pool. If ri is unique, the tool adds ri to the pool R and retains the corresponding message sequence Mi as a new seed. The test tool then divides the message m into different fragments based on the response.

[0065] Therefore, the key idea of ​​this application is to determine the field to which each byte belongs in the protocol based on the response, thereby dividing the message into fragments, performing mutation operations within the fragments to reduce the input search space, and automatically clustering the fragments by classifying the device's responses. The essence of a message fragment is the continuous bytes in the message, which enables the smart device to execute a specific code segment. The following is a further description of the above-mentioned message fragment division steps using a specific embodiment, in which the message fragment division includes the following steps:

[0066] Step 1: For a single message m of seed S, this scheme deletes or flips each byte of m in turn, generates a probe message pi and a corresponding sequence Mi, sends Mi to the server and triggers a response ri. According to the response pool R, determine whether the new response ri is unique, and preliminarily classify the Mi that generates the same ri into one category. This operation is performed sequentially for all messages of the input sequence M.

[0067] Since the protocol may contain random fields (timestamps, etc.), the result of the division in step 1 is not accurate. This application introduces the similarity S ij To represent the two responses r i and r j The similarity between:

[0068]

[0069] In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status messages of two devices, and edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another, including insertion, deletion, flipping, replacement, and concatenation. The greater the similarity, the smaller the difference between the two.

[0070] Step 2: Send the detection message pi twice within a certain period of time and calculate the self-similarity S ii Due to the existence of the randomness field, or the randomness of the response (such as the inclusion of timestamp information in the response), there may be differences between two responses ri, r′i to the same message at different times.

[0071] Step 3: Calculate the similarity S between the two messages ij , then, S ij With self-similarity S ii For comparison. If S ij >=S ii or S ij >=S jj Established, it can be considered that the response ri and r j Belonging to the same category, if i and j are continuous, the i-th byte and the j-th byte can be divided into one fragment, otherwise they are considered not to be a fragment, so that the clustering of message fragments can be achieved.

[0072] Preferably, the intelligent selection of seed messages according to the state machine model in the above-mentioned step S103 includes: based on the mapping relationship between different message sequences recorded in the state machine model and the device status, selecting the seed message sequence according to a preset priority rule, the priority rule being set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model, and seed messages with high priority are selected first.

[0073] Before starting the fuzzy test, the application will first select the state of the network intelligent device at the beginning of the test. After selecting the state at the beginning of the test, it is also necessary to select the seed for the test. When selecting the seed, the test tool will select the corresponding seed sequence according to the required state, and calculate the priority of the seed according to the length of the seed, whether a new path is found, the number of times it has been executed, and other indicators, and select the seed with a higher priority for execution. The application scheme mainly tends to select seeds that are easier to find new paths and smaller in size. Among the selected different seeds, although the execution state finally reached may be s, there may be some redundant states in the middle, and the existence of these redundant states leads to additional communication overhead during the test. Therefore, the seed selection strategy implemented by the application scheme is: first select the seeds that have discovered new paths, improved coverage, or generated new crashes, and then calculate the ratio of the total number of states reached by the seed to the number of unique states reached by the seed. The seed with a smaller ratio is considered to have passed fewer redundant states, so the application selects seeds with a smaller ratio. Finally, seeds with small length, small size, and fast execution speed are preferred. Information about whether a seed discovered new paths, improved coverage, or produced new crashes, the total number of states reached, the number of unique states reached by the seed, the length, and the execution time are stored in the associated data structures of the seed corpus.

[0074] Preferably, Figure 4 As shown, in the above step S204, mutating the selected seed message based on the message fragment to generate a mutated message sequence may include the following sub-steps:

[0075] Step S2041: Decompose the selected seed message into three parts: prefix message sequence, candidate message sequence to be mutated, and subsequent message sequence. The prefix message sequence is generally fixed and is used to guide the device to a specific state for subsequent mutation testing; the candidate message sequence to be mutated is the part that needs to be mutated, which is the core part of the fuzzy test of this application. Various mutation operations are performed on this part of the message to generate different mutation message sequences; the subsequent message sequence is a message sequence for completing subsequent interactive operations. This part of the message sequence can be used to reset the device state or perform other necessary operations to ensure the integrity and reliability of the test.

[0076] This step decomposes the seed message into three logical parts. On the one hand, it can improve the mutation efficiency, because only the specific part of the message (the candidate message sequence to be mutated) is mutated, which can reduce the generation of invalid mutations and improve the test efficiency. The prefix and subsequent message sequences remain unchanged, ensuring the integrity and validity of the mutated message. On the other hand, it can also control the mutation range and avoid large-scale random modifications to the entire message, thereby reducing the risk of testing.

[0077] Step S2042: performing mutation operations on the message segments marked as variable fields in the candidate message sequence to be mutated, wherein the mutation operations include message-level mutation and segment-level mutation, wherein the message-level mutation includes adding, deleting and splicing messages, and the segment-level mutation includes bit flipping, arithmetic operation, replacement, deletion, Havoc and splicing.

[0078] Message-level mutation is to operate on the entire message, such as adding, deleting or splicing messages. This mutation method is coarse-grained and suitable for discovering some simple vulnerabilities. Fragment-level mutation is to operate on specific fragments of the message, such as bit flipping, arithmetic operations, replacement, deletion, Havoc (large-scale changes) and splicing. This mutation method is fine-grained and suitable for discovering some complex vulnerabilities. It is particularly important that only message fragments marked as variable fields are mutated, which reflects the understanding of the protocol structure and improves the pertinence and effectiveness of the mutation.

[0079] Step S2043: When performing segment-level mutation, the length field associated with each modified variable field is modified at the same time, and the message sequence is reassembled to generate a mutated message sequence.

[0080] This step is to ensure the integrity of the message structure. After performing fragment-level mutation, the length field related to the modified fragment needs to be updated to ensure that the mutated message sequence still complies with the protocol specification to avoid test failure or misjudgment due to incorrect message length. The message sequence is reassembled to ensure that the mutated message can be correctly parsed by the network device.

[0081] From the above, it can be seen that the network protocol gray box fuzz testing method based on device response status proposed in the present invention automatically divides message fragments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents, is suitable for private protocols or non-standard protocols, and can effectively reduce the generation of invalid mutation messages, reduce testing costs, and improve vulnerability discovery rates. It is particularly suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy and state selection strategy of the present application, as well as the message fragment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing.

[0082] The above-mentioned network protocol gray box fuzz testing method based on device response status is further described below through a specific implementation method:

[0083] The overall architecture diagram of the network protocol gray box fuzz testing method based on the device response status is as follows: Figure 5 As shown, the test tool can include the following four modules: network communication module, corpus module, state module and seed module. The following describes them respectively:

[0084] (1) Network communication module: In the network communication module, the test tool implemented in this solution can act as a client and connect to the device under test through a socket.

[0085] (2) Corpus module: Figure 6 As shown, the corpus module includes a sequence parser, a seed corpus and a state corpus. The seed corpus is implemented as a queue structure whose elements are seeds. For each seed, the scheme maintains properties such as seed content, length, whether a new path is found, the number of times it has been executed, the state array triggered during execution, and the next element. The tool calculates the seed priority at the beginning of each test based on these properties to select the seed. For the state corpus, the present embodiment can maintain state entries and a hash map. The state entry mainly maintains the number of times the state is tested, whether it is covered, the corresponding seed sequence, etc. The hash map uses the structure of a hash table to map the state identifier to the state entry corresponding to the state identifier. Thus, the state corpus establishes a mapping of state identifiers (such as state codes) to state entries and state entries to seed libraries.

[0086] (3) State module: The test tool needs to select a starting state that is more likely to discover a new state in order to increase the possibility of fuzz testing discovering a new state, thereby increasing state coverage. The state module of this embodiment implements state selection algorithms such as random, polling, and preference mode. The random mode is to randomly select from all states, and the polling is to traverse all states. In the preference mode, if there are fewer state graph nodes, polling is performed. When there are more state graph nodes, the score is calculated based on the number of times the node is fuzzed, the number of times it has been selected, and the number of paths found. At the same time, a random number is calculated, and a node with a score greater than the random number is selected to ensure that the state where a new path has been discovered before is more likely to be selected. This will improve the efficiency of exploring new states and the efficiency of vulnerability mining. The state machine learner can accept server responses and use newly observed states and transitions to update the protocol state machine. If there is a new status code in the server response, a new graph node representing the new state is added.

[0087] (4) Seed module: It includes seed selection, seed variation and fragment division, which have been described in the previous method and will not be further elaborated here.

[0088] like Figure 7 The structure diagram of a network protocol gray box fuzz testing device based on device response status provided by an embodiment of the present application is shown, and the device includes: a first response collection unit 710, a message segment division unit 720, a state machine construction unit 730, a seed selection unit 740, a message variation unit 750, a second response collection unit 760 and a message addition unit 770, which are connected in sequence. Among them:

[0089] The first response collection unit 710 is configured to send an initial message sequence including a message to be tested to a target network device, and collect a device response status message returned by the target network device.

[0090] The message segment division unit 720 is configured to automatically divide the message segments based on the device response status message.

[0091] The state machine construction unit 730 is used to construct and maintain a state machine model based on the device response status message, the state machine model records the mapping relationship between different message sequences and device states, and updates the state machine model according to the new device response state.

[0092] The seed selection unit 740 is used to intelligently select a seed message according to the state machine model.

[0093] The message variation unit 750 is configured to mutate the selected seed message based on the message fragment to generate a variation message sequence.

[0094] The second response collection unit 760 sends the variant message sequence to the target network device, collects the response message returned by the target network device, and determines whether a new state, a new state transition or a new vulnerability is triggered according to the response message.

[0095] The message adding unit 770 is used to add a mutated message sequence that causes a new state, a new state transition or a new vulnerability to the seed library, and to add a mutated message sequence that causes a device crash to the crash input library.

[0096] Preferably, Figure 8 As shown, the message segmentation unit 720 includes: a similarity calculation module 721, which is used to modify the message to be tested byte by byte, observe the response changes of the target network device, and calculate the similarity between the response status messages of different devices; a segmentation module 722, which is used to divide the message to be tested into multiple segments according to the similarity, each segment corresponding to the processing logic of a specific code segment in the target network device.

[0097] Preferably, the similarity between the above-mentioned different device response status messages is calculated by the following formula:

[0098]

[0099] In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status messages of two devices, edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another, and the operations include insertion, deletion, flipping, replacement and concatenation.

[0100] Preferably, the above-mentioned seed selection unit 740 is specifically used to: based on the mapping relationship between different message sequences recorded in the state machine model and the device state, select the seed message sequence according to a preset priority rule, and the priority rule is set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model, and seed messages with high priority are selected first.

[0101] Preferably, Fig. 9As shown, the message mutation unit 750 includes: a decomposition module 751, which is used to decompose the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; a mutation module 752, which is used to perform a mutation operation on the message fragments marked as variable fields in the candidate message sequence to be mutated, and the mutation operation includes message-level mutation and fragment-level mutation. The message-level mutation includes adding, deleting and splicing messages, and the fragment-level mutation includes bit flipping, arithmetic operations, replacement, deletion, Havoc and splicing; a modification assembly module 753, which is used to modify the length field associated with each modified variable field at the same time when performing fragment-level mutation, and reassemble the message sequence to generate a mutated message sequence.

[0102] From the above, it can be seen that the network protocol gray box fuzz testing device based on device response status proposed in the present invention automatically divides message fragments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents, is suitable for private protocols or non-standard protocols, and can effectively reduce the generation of invalid mutation messages, reduce testing costs, and improve vulnerability discovery rates. It is particularly suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy and state selection strategy of the present application, as well as the message fragment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing.

[0103] Fig.10 is a schematic diagram of an electronic device provided by an embodiment of the present invention. Fig.10 The electronic device shown is a general data processing device, which includes a general computer hardware structure, which includes at least a processor 801 and a memory 802. The processor 801 and the memory 802 are connected via a bus 803. The memory 802 is suitable for storing one or more instructions or programs executable by the processor 801. The one or more instructions or programs are executed by the processor 801 to implement the steps in the above-mentioned network protocol gray box fuzz testing method based on the device response state.

[0104] The processor 801 may be an independent microprocessor or a collection of one or more microprocessors. Thus, the processor 801 executes the commands stored in the memory 802 to execute the method flow of the embodiment of the present invention as described above to realize the processing of data and the control of other devices. The bus 803 connects the above-mentioned multiple components together, and at the same time connects the above-mentioned components to the display controller 804 and the display device and the input / output (I / O) device 805. The input / output (I / O) device 805 may be a mouse, a keyboard, a modem, a network interface, a touch input device, a somatosensory input device, a printer, and other devices known in the art. Typically, the input / output (I / O) device 805 is connected to the system via an input / output (I / O) controller 806.

[0105] The memory 802 may store software components such as an operating system, a communication module, an interaction module, and an application program. Each of the modules and applications described above corresponds to a set of executable program instructions that implement one or more functions and methods described in the embodiments of the invention.

[0106] An embodiment of the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the above-mentioned network protocol gray box fuzz testing method based on device response status are implemented.

[0107] From the above, it can be seen that the network protocol gray box fuzz testing method and device based on device response status proposed in the present invention automatically divides message fragments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents, is suitable for private protocols or non-standard protocols, and can effectively reduce the generation of invalid mutation messages, reduce testing costs, and improve vulnerability discovery rates. It is particularly suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy and state selection strategy of the present application, as well as the message fragment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing.

[0108] The preferred embodiments of the present invention are described above with reference to the accompanying drawings. Many features and advantages of these embodiments are clear from this detailed description, and therefore the claims are intended to cover all such features and advantages of these embodiments that fall within their true spirit and scope. In addition, since many modifications and changes are easily conceivable to those skilled in the art, it is not intended to limit the embodiments of the present invention to the precise structure and operation illustrated and described, but all suitable modifications and equivalents falling within its scope may be covered.

[0109] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0111] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0112] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0113] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network protocol gray box fuzz testing method based on device response status, characterized in that: The method comprises: Sending an initial message sequence including a message to be tested to a target network device, collecting device response status messages returned by the target network device, and automatically dividing message segments based on the device response status messages; Building and maintaining a state machine model based on the device response status message, the state machine model records the mapping relationship between different message sequences and device states, and updating the state machine model according to the new device response state; Intelligently selecting a seed message according to the state machine model; mutating the selected seed message based on the message fragment to generate a mutated message sequence; Sending the mutated message sequence to the target network device, collecting response messages returned by the target network device, and determining whether a new state, a new state transition, or a new vulnerability is triggered according to the response messages; The mutated message sequences that lead to new states, new state transitions, or new vulnerabilities are added to the seed library, and the mutated message sequences that cause the device to crash are added to the crash input library.

2. The network protocol gray box fuzz testing method based on device response status as described in claim 1 is characterized in that: The automatic division of message segments based on the device response status message includes: modifying the message to be tested byte by byte, observing the response changes of the target network device, and calculating the similarity between different device response status messages; dividing the message to be tested into multiple segments according to the similarity, each segment corresponding to the processing logic of a specific code segment in the target network device.

3. The network protocol gray box fuzz testing method based on device response status as described in claim 2 is characterized in that: The similarity between the response status messages of different devices is calculated by the following formula: In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status messages of two devices, edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another, and the operations include insertion, deletion, flipping, replacement and concatenation.

4. The network protocol gray box fuzz testing method based on device response status as described in claim 1 is characterized in that: The intelligently selecting a seed message according to the state machine model comprises: Based on the mapping relationship between different message sequences and device states recorded in the state machine model, a seed message sequence is selected according to a preset priority rule. The priority rule is set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model. Seed messages with high priority are selected first.

5. The network protocol gray box fuzz testing method based on device response status as described in claim 1 is characterized in that: The mutating the selected seed message based on the message fragment to generate a mutated message sequence comprises: Decomposing the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; Performing a mutation operation on the message segments marked as variable fields in the candidate message sequence to be mutated, wherein the mutation operation includes message-level mutation and segment-level mutation; The message-level mutation includes adding, deleting and splicing messages, and the fragment-level mutation includes bit flipping, arithmetic operation, replacement, deletion, Havoc and splicing. When performing fragment-level mutation, the length field associated with each modified variable field is modified at the same time, and the message sequence is reassembled to generate a mutated message sequence.

6. A network protocol gray box fuzz testing device based on device response status, characterized in that: The device comprises: A first response collection unit, configured to send an initial message sequence including a message to be tested to a target network device, and collect a device response status message returned by the target network device; A message segment division unit, configured to automatically divide the message segments based on the device response status message; A state machine construction unit, configured to construct and maintain a state machine model based on the device response status message, wherein the state machine model records the mapping relationship between different message sequences and device states, and updates the state machine model according to the new device response state; A seed selection unit, configured to intelligently select a seed message according to the state machine model; A message mutation unit, configured to mutate the selected seed message based on the message fragment to generate a mutant message sequence; A second response collection unit, sending the variant message sequence to the target network device, collecting response messages returned by the target network device, and determining whether a new state, a new state transition or a new vulnerability is triggered according to the response messages; The message adding unit is used to add the mutated message sequence that causes a new state, a new state transition or a new vulnerability to the seed library, and to add the mutated message sequence that causes the device to crash to the crash input library.

7. The network protocol gray box fuzz testing device based on device response status as claimed in claim 6, characterized in that: The message segment division unit: A similarity calculation module, used to modify the message to be tested byte by byte, observe the response changes of the target network device, and calculate the similarity between the response status messages of different devices; The fragment division module is used to divide the message to be tested into multiple fragments according to the similarity, and each fragment corresponds to the processing logic of a specific code segment in the target network device.

8. The network protocol gray box fuzz testing device based on device response status as claimed in claim 7, characterized in that: The similarity between the response status messages of different devices is calculated by the following formula: In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status messages of two devices, edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another, and the operations include insertion, deletion, flipping, replacement and concatenation.

9. The network protocol gray box fuzz testing device based on device response status as claimed in claim 6, characterized in that: The seed selection unit is specifically used to: based on the mapping relationship between different message sequences recorded in the state machine model and the device state, select the seed message sequence according to the preset priority rules. The priority rules are set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model. Seed messages with high priority are selected first.

10. The network protocol gray box fuzz testing device based on device response status according to claim 6, characterized in that: The message variation unit comprises: A decomposition module, used for decomposing the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; A mutation module, used for performing mutation operations on message segments marked as variable fields in the candidate message sequence to be mutated, wherein the mutation operations include message-level mutation and segment-level mutation, wherein the message-level mutation includes adding, deleting and splicing messages, and the segment-level mutation includes bit flipping, arithmetic operation, replacement, deletion, Havoc and splicing; The modification assembly module is used to modify the length field associated with each modified variable field at the same time when performing fragment-level mutation, and reassemble the message sequence to generate a mutated message sequence.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images