Network protocol gray box fuzz testing method and device based on device response status

Abstract

The present invention provides a network protocol gray-box fuzz testing method and apparatus based on device response status. The method comprises: collecting device response status messages returned by a target network device and automatically segmenting the messages based on the device response status messages; constructing and maintaining a state machine model based on the device response status messages; intelligently selecting seed messages according to the state machine model; mutating the selected seed messages based on the message segments to generate a sequence of mutated messages; sending the mutated message sequence to the target network device and collecting the response messages returned by the target network device; adding mutated message sequences that result in new states, new state transitions, or new vulnerabilities to a seed library, and adding mutated message sequences that result in device crashes to a crash input library. By analyzing device response messages to automatically segment the messages and constructing a state machine model to guide seed message selection and mutation, the present invention improves the efficiency and effectiveness of fuzz testing.

Description

Technical Field

[0001] The present invention relates to the field of network testing technology, and in particular to a network protocol gray box fuzz testing method and apparatus based on device response status. Background Art

[0002] With the continuous development and popularization of network technology, various network-connected intelligent devices have entered our lives, bringing us new ways of living. At the same time, these devices have also exposed many serious security issues. These devices use network protocols to provide services to remote users or request services from remote servers, creating ample opportunities for remote attacks. Therefore, network protocols have become a significant risk point for these devices.

[0003] Common analysis methods for network protocols include fuzz testing, static analysis, and manual auditing. Static analysis methods typically require obtaining the program's source code and modeling the program's execution path and constraints. Generally, the source code and development documentation for network protocol-related programs for intelligent network devices are difficult to obtain, and network protocol programs are generally large in scale, resulting in high analysis complexity for static analysis methods. Manual audits are inefficient in discovering network protocol vulnerabilities, and it is difficult to develop a comprehensive manual audit methodology. Fuzz testing methods, on the other hand, are widely researched and used in the industry due to their independence from program source code or documentation, ease of use, high degree of automation, and strong reusability.

[0004] Currently, fuzz testing technologies for network protocols are mainly divided into black-box fuzz testing, stateless gray-box fuzz testing, and stateful gray-box fuzz testing. However, each of these testing technologies has some defects:

[0005] 1. Black-box fuzz testing technology: Several black-box testing tools exist in the existing technology. These tools traverse a given protocol model in the form of a finite state machine or graph and utilize the data model or syntax of received messages to generate message sequences for testing the device under test. However, the effectiveness of these tools depends heavily on the completeness of the given state and data models. These models are often manually written based on the developer's understanding of the protocol specification and captured network traffic samples between the client and server, making them difficult to use. Furthermore, black-box testing techniques are not applicable to protocols not disclosed in the protocol standard documentation.

[0006] Second, stateless gray-box fuzz testing techniques: Stateless gray-box testing tools for network protocols face the following challenges: First, protocol programs are stateful and message-driven. They receive a series of messages (also known as requests) from clients, process them, and send responses. The protocol program's response depends on the current message and the current internal protocol program state, which is controlled by the previous message sequence. A specific subsequent state is triggered only when a specific precondition state is satisfied and a specific message is received. However, current gray-box testers and their extensions are unaware of either the protocol program state information or the required structure or order of sent messages. Consequently, for a message sequence (m1, m2, …, mi), these tools assume that a single message mi is the most useful, and exploring it will result in higher code coverage or the discovery of potential vulnerabilities. These tools treat each message in the sequence equally, repeatedly mutating less useful messages from m1 to mi-1 before processing mi, without knowing that mi should be the intended target. Consequently, these tools generate a large number of useless messages, or generate messages that fail to effectively trigger new states, resulting in poor coverage. Second, these tools typically input test cases into the program under test one at a time, preventing interaction. Finally, the coverage-based approach of these tools is not suitable for end-to-end fuzz testing, where code coverage is difficult to obtain and calculate. However, end-to-end fuzz testing is a very important requirement for network protocol fuzz testing of smart devices.

[0007] 3. Stateful Gray-Box Fuzz Testing: This technology builds on stateless gray-box fuzz testing by implementing interactive communication and state awareness. Specifically, the state of the protocol under test is determined by the returned response code, and a state automaton is maintained to model the protocol's message transitions. This technology selects a target state for each test round and, based on this state, chooses a seed for mutation. However, this technology defaults to a random mutation strategy, assuming that every byte of a message plays the same role and mutating the entire message. In reality, in network protocols, messages are divided into multiple fields, each with a different data type and function. Network protocol programs also perform different operations on each field, and they check the message format to filter out messages that do not conform to the format. Therefore, this technology can generate a large amount of useless data during the mutation process.

[0008] Additionally, some tools within this technology instrument the static variables and functions of protocol programs in memory. By detecting the execution of in-memory functions and access to specific static variables, they provide a more granular representation of protocol program status information. However, this requires dynamic instrumentation and runtime binary analysis, resulting in significant performance losses. Furthermore, these tools also need to analyze the protocol implementation of network services to obtain status information. If the protocol implementation is complex or lacks a clearly defined protocol specification, these tools may struggle to accurately capture and represent the network service status. Summary of the Invention

[0009] In view of this, the present invention provides a network protocol gray box fuzz testing method and apparatus based on device response status to solve at least one of the above-mentioned problems.

[0010] In order to achieve the above object, the present invention adopts the following scheme:

[0011] According to a first aspect of the present invention, a network protocol gray-box fuzz testing method based on device response status is provided, the method comprising: sending an initial message sequence containing a message to be tested to a target network device, collecting device response status messages returned by the target network device, and automatically dividing message segments based on the device response status messages; constructing and maintaining a state machine model based on the device response status messages, the state machine model recording a mapping relationship between different message sequences and device states, and updating the state machine model according to the new device response state; intelligently selecting seed messages according to the state machine model; mutating the selected seed messages based on the message segments to generate a mutated message sequence; sending the mutated message sequence to the target network device, collecting response messages returned by the target network device, and judging whether a new state, a new state transition or a new vulnerability is triggered based on the response messages; adding the mutated message sequence that causes a new state, a new state transition or a new vulnerability to a seed library, and adding the mutated message sequence that causes a device crash to a crash input library.

[0012] As an embodiment of the present invention, the above method automatically divides the message segments based on the device response status message, including: modifying the message to be tested byte by byte, observing the response changes of the target network device, and calculating the similarity between different device response status messages; dividing the message to be tested into multiple segments according to the similarity, each segment corresponding to the processing logic of a specific code segment in the target network device.

[0013] As an embodiment of the present invention, the similarity between the response status messages of different devices in the above method is calculated by the following formula:

[0014]

[0015] In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status message of two devices, and edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another. The operations include insertion, deletion, flipping, replacement, and splicing.

[0016] As an embodiment of the present invention, the above method of intelligently selecting seed messages according to the state machine model includes: based on the mapping relationship between different message sequences recorded in the state machine model and the device state, selecting the seed message sequence according to a preset priority rule, the priority rule is set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model, and seed messages with high priority are selected first.

[0017] As an embodiment of the present invention, the above method mutates the selected seed message based on the message fragments to generate a mutated message sequence, including: decomposing the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; performing a mutation operation on the message fragments marked as variable fields in the candidate message sequence to be mutated, and the mutation operation includes message-level mutation and fragment-level mutation; the message-level mutation includes adding, deleting, and splicing messages, and the fragment-level mutation includes bit flipping, arithmetic operations, replacement, deletion, Havoc, and splicing. When performing fragment-level mutation, the length field associated with each modified variable field is modified at the same time, and the message sequence is reassembled to generate a mutated message sequence.

[0018] According to a second aspect of the present invention, a network protocol gray-box fuzz testing apparatus based on device response status is provided, the apparatus comprising: a first response collection unit, configured to send an initial message sequence containing a message to be tested to a target network device, and collect device response status messages returned by the target network device; a message segmentation unit, configured to automatically segment message segments based on the device response status messages; a state machine construction unit, configured to construct and maintain a state machine model based on the device response status messages, the state machine model recording a mapping relationship between different message sequences and device states, and updating the state machine model according to a new device response state; a seed selection unit, configured to intelligently select seed messages according to the state machine model; a message mutation unit, configured to mutate the selected seed messages based on the message segments to generate a mutated message sequence; a second response collection unit, configured to send the mutated message sequence to the target network device, collect response messages returned by the target network device, and determine whether a new state, new state transition, or new vulnerability is triggered based on the response messages; and a message addition unit, configured to add mutated message sequences that result in a new state, new state transition, or new vulnerability to a seed library, and to add mutated message sequences that result in a device crash to a crash input library.

[0019] As an embodiment of the present invention, the above-mentioned message fragment division unit: a similarity calculation module, used to modify the message to be tested byte by byte, observe the response changes of the target network device, and calculate the similarity between the response status messages of different devices; a fragment division module, used to divide the message to be tested into multiple fragments according to the similarity, each fragment corresponding to the processing logic of a specific code segment in the target network device.

[0020] As an embodiment of the present invention, the similarity between the response status messages of different devices in the above method is calculated by the following formula:

[0021]

[0022] In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status message of two devices, and edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another. The operations include insertion, deletion, flipping, replacement, and splicing.

[0023] As an embodiment of the present invention, the seed selection unit in the above method is specifically used to: based on the mapping relationship between different message sequences recorded in the state machine model and the device state, select the seed message sequence according to a preset priority rule, and the priority rule is set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model. Seed messages with high priority are selected first.

[0024] As an embodiment of the present invention, the message mutation unit in the above method includes: a decomposition module, which is used to decompose the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; a mutation module, which is used to perform mutation operations on message segments marked as variable fields in the candidate message sequence to be mutated, and the mutation operations include message-level mutation and segment-level mutation. The message-level mutation includes adding, deleting, and splicing messages, and the segment-level mutation includes bit flipping, arithmetic operations, replacement, deletion, Havoc, and splicing; a modification and assembly module, which is used to modify the length field associated with each modified variable field at the same time when performing segment-level mutation, and reassemble the message sequence to generate a mutated message sequence.

[0025] According to a third aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0026] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0027] The network protocol gray-box fuzz testing method and apparatus based on device response status proposed in the present invention automatically divides message segments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents and is applicable to private protocols or non-standard protocols. It can effectively reduce the generation of invalid mutation messages, reduce testing costs, and increase vulnerability discovery rates. It is particularly suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy, and state selection strategy of the present application, as well as the message segment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0029] Figure 1 Schematic diagram of the processing components within the response device provided in an embodiment of the present application;

[0030] Figure 2 This is a flowchart of a network protocol gray-box fuzz testing method based on device response status provided by an embodiment of the present application;

[0031] Figure 3 1 is a schematic diagram of a process for automatically dividing message segments provided by an embodiment of the present invention;

[0032] Figure 4 This is a schematic diagram of a process for generating a variant message sequence according to an embodiment of the present application;

[0033] Figure 5 This is a general architecture diagram of a network protocol gray-box fuzz testing method based on device response status provided by an embodiment of the present application;

[0034] Figure 6 Schematic diagram of the structure of the corpus module provided in the embodiment of the present application;

[0035] Figure 7 This is a schematic diagram of the structure of a network protocol gray box fuzz testing device based on device response status provided by an embodiment of the present application;

[0036] Figure 8 This is a structural diagram of a message segment division unit provided in an embodiment of the present application;

[0037] Figure 9 This is a schematic diagram of the structure of the message mutation unit provided in an embodiment of the present application;

[0038] Figure 10 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] To make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0040] The information collected in the technical solution of this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0041] The acquisition, transmission, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0042] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0043] First, the basic idea of ​​the network protocol gray-box fuzz testing method based on device response status of this application is described as follows:

[0044] Regarding the processing of messages within the response device, existing research divides the processing components within the response device into four categories (such as Figure 1 As shown in the figure), namely, filter, distributor, function and responder. The filter is responsible for grammatical analysis of the message. If the received message does not conform to the syntax specified by the protocol, or an exception occurs during the parsing process, the message will be discarded, and the filter will send a response message describing the error to the responder, thereby ensuring that the protocol-related programs run correctly. If the received message conforms to the syntax specified by the protocol, the filter will further extract semantic information and hand it over to the distributor for processing. The distributor selects a function for processing based on the extracted semantic information. After the function is processed, the responder returns a response message, and the responder determines the content of the response information to be sent based on the response code returned by the function. This is a common message processing architecture for network intelligent devices, and most network intelligent devices are designed in accordance with this architecture.

[0045] In networked intelligent devices, the responder uses the variable values ​​returned by function processing to determine the content of the response message. The result of the response message directly corresponds to the execution result of the program code, that is, the status of the program. Therefore, the response message returned by networked intelligent devices can be regarded as a valuable source of runtime device status information. The content of the response message can be used to infer the code blocks that have been executed in the program. When the program source code is unavailable, it is impossible to directly extract the correspondence between program execution and response messages. Although the response message cannot be equated with the device's execution path, it can still play an important role in fuzz testing of networked intelligent devices. During the two communications, the different response messages returned are a sufficient condition for the program to enter different execution paths. If two inputs receive different response messages, it can be inferred that the two inputs triggered different program code execution paths.

[0046] In a protocol, a message consists of multiple fields. For each field, the protocol program may have corresponding code or functions to handle it. Therefore, if a message is mutated at two different locations and the same response is obtained, it can be assumed that the two messages triggered the same processing logic, and the two locations may belong to the same field. Therefore, this application proposes a field partitioning strategy that does not rely on protocol standard documents and is effective for proprietary or non-standard protocol implementations.

[0047] like Figure 2 FIG2 is a flow chart of a network protocol gray-box fuzz testing method based on device response status provided by an embodiment of the present application. This embodiment describes the present application from the perspective of a testing tool. The method includes the following steps:

[0048] Step S201: sending an initial message sequence including a message to be tested to a target network device, collecting device response status messages returned by the target network device, and automatically dividing message segments based on the device response status messages.

[0049] The test tool of this embodiment has a network communication module. First, through the network communication module, the test tool acts as a client, uses a socket to establish a connection with the target network device, and sends an initial message sequence containing the message to be tested. At the same time, the network communication module can implement message synchronization and crash detection mechanisms, ensuring communication synchronization by setting multiple delays (communication delay, network delay, device no response waiting delay, etc.), and using a timeout detector to detect device crashes. Then, the response messages returned by the target device are collected. These response messages contain the device's operating status information. Based on these response messages, a message segmentation method based on the device response status is used to automatically divide the message into multiple segments.

[0050] Step S202: constructing and maintaining a state machine model based on the device response status message, wherein the state machine model records the mapping relationship between different message sequences and device states, and updates the state machine model according to the new device response state.

[0051] In this embodiment, a state machine model can be constructed and maintained based on the device response status messages collected in step S201. This state machine model records the mapping relationship between different message sequences and device states. The state machine learner receives the server response and updates the protocol state machine using the newly observed states and transitions. If the server response contains a new status code, a new graph node representing the new state is added. In other words, the update of the state machine model depends on the new device response state.

[0052] Step S203: Intelligently select a seed message according to the state machine model.

[0053] In this embodiment, seed messages are intelligently selected based on the state machine model constructed in step S202. The seed selection strategy can consider factors such as the seed's length, whether a new path has been discovered, and the number of times it has been executed. Preference is given to seeds that are more likely to discover new paths, are smaller in size, and execute faster. Specific selection strategies include random, round-robin, and preference modes. In preference mode, a score is calculated based on the number of times a node has been fuzzed, the number of times it has been selected, and the number of paths discovered. Nodes with scores higher than the random number are selected.

[0054] Step S204: mutating the selected seed message based on the message fragment to generate a mutated message sequence.

[0055] In this embodiment, a suitable mutation strategy may be selected to mutate the seed message selected in step S203 to generate a mutated message sequence.

[0056] Step S205: sending the mutated message sequence to the target network device, collecting response messages returned by the target network device, and determining whether a new state, a new state transition, or a new vulnerability is triggered based on the response messages.

[0057] This step is similar to step S201, but sends the variant message sequence generated in step S204. The response message returned by the target device is collected, and based on the response message, it is determined whether a new state, a new state transition, or a new vulnerability has been triggered.

[0058] Step S206: adding the mutated message sequence that leads to a new state, a new state transition, or a new vulnerability to the seed library, and adding the mutated message sequence that leads to a device crash to the crash input library.

[0059] According to the result of step S205, the mutated message sequence that leads to a new state, a new state transition, or a new vulnerability is added to the seed library for subsequent iterative testing; the mutated message sequence that causes the device to crash is added to the crash input library for subsequent reproduction and analysis.

[0060] Preferably, Figure 3 As shown, in this embodiment, the automatic division of message segments based on the device response status message in step S201 may further include:

[0061] Step S2011: modifying the message to be tested byte by byte, observing the response changes of the target network device, and calculating the similarity between the response status messages of different devices.

[0062] Step S2012: Divide the message to be tested into multiple segments according to the similarity, each segment corresponding to the processing logic of a specific code segment in the target network device.

[0063] Intelligent network devices verify the format and parameters of input information and filter out messages that do not conform to standard syntax. Therefore, test cases generated by seed generators based on simple random mutations usually fail to pass message filtering, resulting in many invalid message sequences that are rejected by the filter, resulting in low-quality input data generated by existing tools. This application constructs malformed messages by designing different mutation operators for different fields. The implementation of this mutation strategy requires a certain understanding of the protocol format. Therefore, this application designs the above-mentioned method for dividing message segments based on device response status.

[0064] Assume that a network intelligent device sends a message sequence M to request the device to perform certain operations. Any message m∈M can request the device to perform a specific function, and all messages constituting M together implement one or more operations. At the same time, the collection recovery message sequence M3 is used to reset the network intelligent device to the initial state. This application selects a message m from the seed S, generates a detection message pi from m by performing operations such as byte-by-byte deletion or flipping, and forms a new detection message sequence Mi with other messages in this message sequence. Mi will trigger one or more response messages ri (referred to as response), which contains information about the execution output. The test tool assigns a response pool R to each message to determine whether the new response ri is unique. The uniqueness of the response indicates that it does not belong to any response category existing in the response pool. If ri is unique, the tool adds ri to the pool R and retains the corresponding message sequence Mi as a new seed. The test tool then divides the message m into different fragments based on the response.

[0065] Therefore, the key concept of this application is to determine the protocol field to which each byte belongs based on the response, thereby dividing the message into segments, performing mutation operations within the segments to reduce the input search space, and automatically clustering the segments by classifying the device responses. The essence of a message segment is the continuous bytes in the message, which enables the smart device to execute a specific code segment. The following is a further description of the above message segment division steps using a specific embodiment. The message segment division in this embodiment includes the following steps:

[0066] Step 1: For a single message m from a seed S, this scheme sequentially deletes or flips each byte of m to generate a probe message pi and a corresponding sequence Mi. Mi is sent to the server, triggering a response ri. Based on the response pool R, the new response ri is determined to be unique, and Mi messages that generate the same ri are preliminarily classified into a single category. This operation is repeated for all messages in the input sequence M.

[0067] Since the protocol may contain random fields (timestamps, etc.), the result of step 1 division is not accurate. This application introduces the similarity S ij To represent two responses r i and r j The degree of similarity between:

[0068]

[0069] In the above formula, S ij To indicate that two devices respond to status messages r i and r j The degree of similarity between the two devices; max_len represents the maximum length of the response status message between the two devices; edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another. These operations include insertion, deletion, flipping, replacement, and concatenation. The greater the similarity, the smaller the difference between the two.

[0070] Step 2: Send the detection message pi twice within a certain period of time and calculate the self-similarity S ii Due to the existence of the randomness field or the randomness of the response (such as the timestamp included in the response), there may be differences between two responses ri and r′i to the same message at different times.

[0071] Step 3: Calculate the similarity S between the two messages ij , then, S ij and self-similarity S ii Compare. If S ij >=S ii or S ij >=S jj Established, it can be considered that the response ri and r j Belong to the same category. If i and j are continuous, the i-th byte and the j-th byte can be divided into one fragment. Otherwise, they are not considered to be a fragment, so that the message fragments can be clustered.

[0072] Preferably, the intelligent selection of seed messages according to the state machine model in the above-mentioned step S103 includes: based on the mapping relationship between different message sequences recorded in the state machine model and the device status, selecting the seed message sequence according to a preset priority rule, the priority rule being set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model, and seed messages with high priority are selected first.

[0073] Before starting fuzz testing, this application first selects the state of the network intelligent device at the start of the test. After selecting the state, the seed for testing needs to be selected. When selecting seeds, the testing tool selects the corresponding seed sequence based on the required state and calculates the seed priority based on indicators such as the seed length, whether new paths have been discovered, and the number of times the seed has been executed, selecting the seed with the higher priority for execution. This application's solution primarily tends to select seeds that are more likely to discover new paths and are smaller in size. Although the final execution state reached by different selected seeds may all be s, there may be some redundant states in between. The presence of these redundant states results in additional communication overhead during the testing process. Therefore, the seed selection strategy implemented in this application's solution is as follows: first, select seeds that discover new paths, improve coverage, or produce new crashes. Next, calculate the ratio of the total number of states reached by the seed to the number of unique states reached by the seed. Seeds with a smaller ratio are considered to have passed through fewer redundant states, so this application selects seeds with a smaller ratio. Finally, seeds with a smaller length, smaller size, and faster execution speed are preferred. Information about whether a seed discovered new paths, improved coverage, or produced new crashes, the total number of states reached, the number of unique states reached by the seed, its length, and its execution time are stored in the associated data structures of the seed corpus.

[0074] Preferably, Figure 4 As shown, in the above step S204, mutating the selected seed message based on the message fragment to generate a mutated message sequence may include the following sub-steps:

[0075] Step S2041: Decompose the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence. The prefix message sequence is generally fixed and is used to guide the device to a specific state for subsequent mutation testing. The candidate message sequence to be mutated is the part that requires mutation, which is the core of the fuzz testing in this application. Various mutation operations are performed on this part of the message to generate different mutant message sequences. The subsequent message sequence is the message sequence for completing subsequent interactive operations. This message sequence can be used to reset the device state or perform other necessary operations to ensure the integrity and reliability of the test.

[0076] This step improves mutation efficiency by breaking the seed message into three logical parts. This is because only specific parts of the message (the candidate message sequence) are mutated, reducing invalid mutations and improving testing efficiency. The prefix and subsequent message sequences remain unchanged, ensuring the integrity and validity of the mutated message. Furthermore, the mutation scope is controlled, avoiding large-scale random modifications to the entire message, thereby reducing testing risk.

[0077] Step S2042: performing mutation operations on the message segments marked as variable fields in the candidate message sequence to be mutated, wherein the mutation operations include message-level mutation and segment-level mutation. The message-level mutation includes adding, deleting, and splicing messages, and the segment-level mutation includes bit flipping, arithmetic operation, replacement, deletion, Havoc, and splicing.

[0078] Message-level mutation operates on the entire message, such as adding, deleting, or concatenating messages. This type of mutation is coarse-grained and suitable for discovering simple vulnerabilities. Fragment-level mutation, on the other hand, operates on specific fragments of the message, such as bit flipping, arithmetic operations, replacement, deletion, Havoc (large-scale modification), and concatenation. This type of mutation is more fine-grained and suitable for discovering complex vulnerabilities. Importantly, only message fragments marked as variable fields are mutated, which demonstrates an understanding of the protocol structure and improves the targetedness and effectiveness of the mutation.

[0079] Step S2043: When performing segment-level mutation, the length field associated with each modified variable field is modified simultaneously, and the message sequence is reassembled to generate a mutated message sequence.

[0080] This step is to ensure the integrity of the message structure. After performing fragment-level mutation, the length field related to the modified fragment needs to be updated to ensure that the mutated message sequence still complies with the protocol specification and avoid test failure or misjudgment due to incorrect message length. The message sequence is reassembled to ensure that the mutated message can be correctly parsed by the network device.

[0081] From the above, it can be seen that the network protocol gray box fuzz testing method based on device response status proposed in the present invention automatically divides message segments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents, is applicable to private protocols or non-standard protocols, and can effectively reduce the generation of invalid mutation messages, reduce testing costs, and improve vulnerability discovery rates. It is particularly suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy and state selection strategy of this application, as well as the message segment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing.

[0082] The following further describes the above-mentioned network protocol gray-box fuzz testing method based on device response status through a specific implementation method:

[0083] The overall architecture diagram of the network protocol gray box fuzz testing method based on the device response status is as follows: Figure 5 As shown, the test tool can include the following four modules: network communication module, corpus module, status module and seed module. The following describes each of them:

[0084] (1) Network communication module: In the network communication module, the test tool implemented in this solution can act as a client and connect to the device under test through a socket.

[0085] (2) Corpus module: Figure 6 As shown, the corpus module includes a sequence parser, a seed corpus and a state corpus. The seed corpus is implemented in this solution as a queue structure whose elements are seeds. For each seed, this solution maintains properties such as seed content, length, whether a new path is found, the number of times it has been executed, the state array triggered during execution, and the next element. The tool calculates the seed priority at the beginning of each test based on these properties to select the seed. For the state corpus, this embodiment can maintain state entries and a hash map. The state entry mainly maintains the number of times the state has been tested, whether it is covered, the corresponding seed sequence, etc. The hash map uses the hash table structure to map the state identifier to the state entry that executes the corresponding state identifier. Thus, the state corpus establishes a mapping of state identifiers (such as state codes) to state entries and state entries to seed libraries.

[0086] (3) State module: The test tool needs to select a starting state that is more likely to discover a new state in order to increase the possibility of fuzz testing discovering a new state, thereby improving the state coverage. The state module of this embodiment implements state selection algorithms such as random, polling, and preference mode. Random mode is to randomly select from all states, polling is to traverse all states, and in preference mode, if there are fewer state graph nodes, polling is performed. When there are more state graph nodes, the score is calculated based on the number of times the node is fuzzed, the number of times it has been selected, and the number of paths found. At the same time, a random number is calculated and a node with a score greater than the random number is selected to ensure that the state where a new path has been found before is more likely to be selected. This will improve the efficiency of exploring new states and the efficiency of vulnerability mining. The state machine learner can accept server responses and use the newly observed states and transitions to update the protocol state machine. If there is a new status code in the server response, a new graph node representing the new state is added.

[0087] (4) Seed module: It includes seed selection, seed mutation and fragment division, which have been described in the previous method and will not be repeated here.

[0088] like Figure 7 The figure shows a schematic diagram of the structure of a network protocol gray-box fuzz testing device based on device response status provided by an embodiment of the present application. The device includes: a first response collection unit 710, a message segmentation unit 720, a state machine construction unit 730, a seed selection unit 740, a message variation unit 750, a second response collection unit 760, and a message addition unit 770, which are connected in sequence. Among them:

[0089] The first response collecting unit 710 is configured to send an initial message sequence including a message to be tested to a target network device, and collect a device response status message returned by the target network device.

[0090] The message segment division unit 720 is configured to automatically divide the message segments based on the device response status message.

[0091] The state machine construction unit 730 is used to construct and maintain a state machine model based on the device response status message, the state machine model records the mapping relationship between different message sequences and device states, and updates the state machine model according to the new device response state.

[0092] The seed selection unit 740 is configured to intelligently select a seed message according to the state machine model.

[0093] The message mutation unit 750 is configured to mutate the selected seed message based on the message fragment to generate a mutated message sequence.

[0094] The second response collection unit 760 sends the variant message sequence to the target network device, collects the response messages returned by the target network device, and determines whether a new state, a new state transition or a new vulnerability is triggered according to the response messages.

[0095] The message adding unit 770 is used to add a mutated message sequence that causes a new state, a new state transition, or a new vulnerability to the seed library, and to add a mutated message sequence that causes a device crash to the crash input library.

[0096] Preferably, Figure 8 As shown, the above-mentioned message segmentation unit 720 includes: a similarity calculation module 721, which is used to modify the message to be tested byte by byte, observe the response changes of the target network device, and calculate the similarity between the response status messages of different devices; a segment division module 722, which is used to divide the message to be tested into multiple segments according to the similarity, each segment corresponding to the processing logic of a specific code segment in the target network device.

[0097] Preferably, the similarity between the above-mentioned different device response status messages is calculated by the following formula:

[0098]

[0099] In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status message of two devices, and edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another. The operations include insertion, deletion, flipping, replacement, and splicing.

[0100] Preferably, the above-mentioned seed selection unit 740 is specifically used to: based on the mapping relationship between different message sequences recorded in the state machine model and the device state, select the seed message sequence according to the preset priority rules. The priority rules are set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model. Seed messages with high priority are selected first.

[0101] Preferably, Figure 9As shown, the message mutation unit 750 includes: a decomposition module 751, which is used to decompose the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; a mutation module 752, which is used to perform a mutation operation on the message segments marked as variable fields in the candidate message sequence to be mutated, and the mutation operation includes message-level mutation and segment-level mutation. The message-level mutation includes adding, deleting and splicing messages, and the segment-level mutation includes bit flipping, arithmetic operation, replacement, deletion, Havoc and splicing; a modification assembly module 753, which is used to modify the length field associated with each modified variable field at the same time when performing segment-level mutation, and reassemble the message sequence to generate a mutated message sequence.

[0102] From the above, it can be seen that the network protocol gray box fuzz testing device based on device response status proposed in the present invention automatically divides message segments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents, is applicable to private protocols or non-standard protocols, and can effectively reduce the generation of invalid mutation messages, reduce testing costs, and improve vulnerability discovery rates. It is especially suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy and state selection strategy of this application, as well as the message segment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing.

[0103] Figure 10 is a schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 10 The electronic device shown is a general-purpose data processing device, which includes a general-purpose computer hardware structure, including at least a processor 801 and a memory 802. The processor 801 and the memory 802 are connected via a bus 803. The memory 802 is adapted to store one or more instructions or programs executable by the processor 801. The one or more instructions or programs are executed by the processor 801 to implement the steps of the aforementioned network protocol gray-box fuzz testing method based on device response status.

[0104] The above-mentioned processor 801 can be an independent microprocessor or a collection of one or more microprocessors. Thus, the processor 801 executes the commands stored in the memory 802, thereby executing the method flow of the embodiment of the present invention as described above to realize the processing of data and the control of other devices. The bus 803 connects the above-mentioned multiple components together, and at the same time connects the above-mentioned components to the display controller 804 and the display device and the input / output (I / O) device 805. The input / output (I / O) device 805 can be a mouse, keyboard, modem, network interface, touch input device, somatosensory input device, printer and other devices known in the art. Typically, the input / output (I / O) device 805 is connected to the system through the input / output (I / O) controller 806.

[0105] The memory 802 may store software components such as an operating system, a communication module, an interaction module, and an application program. Each of the modules and applications described above corresponds to a set of executable program instructions that implement one or more functions and methods described in the embodiments of the invention.

[0106] An embodiment of the present invention also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program implements the steps of the above-mentioned network protocol gray box fuzz testing method based on device response status.

[0107] From the above, it can be seen that the network protocol gray box fuzz testing method and device based on device response status proposed in the present invention automatically divides message segments by analyzing device response messages, and constructs a state machine model to guide seed message selection and mutation, thereby improving the efficiency and effectiveness of fuzz testing. This method does not need to rely on protocol specification documents, is applicable to private protocols or non-standard protocols, and can effectively reduce the generation of invalid mutation messages, reduce testing costs, and improve vulnerability discovery rates. It is especially suitable for network protocol security testing of network intelligent devices. In addition, the intelligent mutation strategy, seed selection strategy and state selection strategy of this application, as well as the message segment division method based on device response status, significantly improve the efficiency and accuracy of fuzz testing.

[0108] Preferred embodiments of the present invention have been described above with reference to the accompanying drawings. Many features and advantages of these embodiments are apparent from this detailed description, and thus the appended claims are intended to cover all such features and advantages of these embodiments that fall within their true spirit and scope. Furthermore, since numerous modifications and changes will readily occur to those skilled in the art, the embodiments of the present invention are not intended to be limited to the precise construction and operation illustrated and described, but are intended to cover all suitable modifications and equivalents that fall within the scope thereof.

[0109] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0111] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0112] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0113] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network protocol gray box fuzz testing method based on device response status, characterized in that: The method comprises: Sending an initial message sequence including a message to be tested to a target network device, collecting device response status messages returned by the target network device, and automatically dividing the message into segments based on the device response status messages; Building and maintaining a state machine model based on the device response status message, the state machine model records the mapping relationship between different message sequences and device states, and updating the state machine model according to the new device response state; Intelligently selecting a seed message according to the state machine model; mutating the selected seed message based on the message fragment to generate a mutated message sequence; Sending the mutated message sequence to the target network device, collecting response messages returned by the target network device, and determining whether a new state, a new state transition, or a new vulnerability is triggered based on the response messages; Add the mutated message sequences that lead to new states, new state transitions, or new vulnerabilities to the seed library, and add the mutated message sequences that cause device crashes to the crash input library; The automatic segmentation of the message based on the device response status message includes: modifying the message to be tested byte by byte, observing the response changes of the target network device, and calculating the similarity between the response status messages of different devices; dividing the message to be tested into multiple segments based on the similarity, each segment corresponding to the processing logic of a specific code segment in the target network device; The intelligently selecting a seed message according to the state machine model includes: Based on the mapping relationship between different message sequences recorded in the state machine model and the device status, the seed message sequence is selected according to the preset priority rules. The priority rules are set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model. Seed messages with high priority are selected first.

2. The network protocol gray box fuzz testing method based on device response status according to claim 1, characterized in that: The similarity between the response status messages of different devices is calculated by the following formula: In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status message of two devices, and edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another. The operations include insertion, deletion, flipping, replacement, and splicing.

3. The network protocol gray box fuzz testing method based on device response status according to claim 1, characterized in that: The mutating the selected seed message based on the message fragment to generate a mutated message sequence includes: Decomposing the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; Performing a mutation operation on the message segments marked as variable fields in the candidate message sequence to be mutated, wherein the mutation operation includes message-level mutation and segment-level mutation; The message-level mutation includes adding, deleting and splicing messages, and the fragment-level mutation includes bit flipping, arithmetic operation, replacement, deletion, Havoc and splicing. When performing fragment-level mutation, the length field associated with each modified variable field is modified at the same time, and the message sequence is reassembled to generate a mutated message sequence.

4. A network protocol gray box fuzz testing device based on device response status, characterized in that: The device comprises: A first response collecting unit, configured to send an initial message sequence including a message to be tested to a target network device, and collect a device response status message returned by the target network device; a message segment division unit, configured to automatically divide the message segments based on the device response status message; a state machine construction unit, configured to construct and maintain a state machine model based on the device response status message, wherein the state machine model records the mapping relationship between different message sequences and device states, and updates the state machine model according to the new device response state; A seed selection unit, configured to intelligently select a seed message according to the state machine model; a message mutation unit, configured to mutate the selected seed message based on the message fragment to generate a mutated message sequence; a second response collection unit, configured to send the variant message sequence to the target network device, collect response messages returned by the target network device, and determine whether a new state, a new state transition, or a new vulnerability is triggered based on the response messages; A message adding unit, configured to add a mutated message sequence that results in a new state, a new state transition, or a new vulnerability to a seed library, and to add a mutated message sequence that results in a device crash to a crash input library; The message segment division unit: A similarity calculation module is used to modify the message to be tested byte by byte, observe the response changes of the target network device, and calculate the similarity between the response status messages of different devices; a fragment division module, configured to divide the message to be tested into a plurality of fragments according to the similarity, each fragment corresponding to the processing logic of a specific code segment in the target network device; The seed selection unit is specifically used to: based on the mapping relationship between different message sequences recorded in the state machine model and the device state, select the seed message sequence according to the preset priority rules. The priority rules are set based on the length of the seed message sequence, whether a new state has been triggered, the number of executions, and the probability of triggering a new state predicted by the state machine model. Seed messages with high priority are selected first.

5. The network protocol gray box fuzz testing device based on device response status according to claim 4, characterized in that: The similarity between the response status messages of different devices is calculated by the following formula: In the above formula, S ij To indicate that two devices respond to status messages r i and r j max_len represents the maximum length of the response status message of two devices, and edit_distance is the edit distance, which represents the minimum number of operations required to convert one string into another. The operations include insertion, deletion, flipping, replacement, and splicing.

6. The network protocol gray box fuzz testing device based on device response status according to claim 4, characterized in that: The message variation unit includes: a decomposition module, configured to decompose the selected seed message into three parts: a prefix message sequence, a candidate message sequence to be mutated, and a subsequent message sequence; A mutation module is used to perform mutation operations on message segments marked as variable fields in a candidate message sequence to be mutated. The mutation operations include message-level mutation and segment-level mutation. The message-level mutation includes adding, deleting, and splicing messages, and the segment-level mutation includes bit flipping, arithmetic operation, replacement, deletion, Havoc, and splicing. The modification assembly module is used to simultaneously modify the length field associated with each modified variable field when performing segment-level mutation, and reassemble the message sequence to generate a mutated message sequence.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 3 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images