Network protocol state machine generation method and network protocol fuzz test method

Abstract

The invention provides a network protocol state machine generation method and a network protocol fuzzy testing method, and relates to the technical field of software testing. The network protocol state machine generation method comprises the following steps: acquiring information of a data packet type of a network protocol to be tested; constructing an abstract query data packet by using a data packet template corresponding to the data packet type, and generating an abstract query data packet sequence composed of at least one abstract query data packet; sending the abstract query data packet sequence to a mapping client; and obtaining the abstract response data packet sequence from the mapping client, and constructing a target state machine of the to-be-tested network protocol by using a preset active learning algorithm based on the abstract query data packet sequence and the abstract response data packet sequence. According to the invention, the network protocol state machine used for the fuzzy test can be accurately and completely constructed, and the network protocol state machine obtained by construction is utilized to efficiently and comprehensively carry out the fuzzy test on the network protocol.

Description

Technical Field

[0001] The present invention relates to the technical field of software testing, and in particular to a state machine generation method for a network protocol and a fuzzy testing method for a network protocol. Background Art

[0002] As the cornerstone of the modern Internet, the security and reliability of network protocols are directly related to the stability and security of the entire network environment. However, as the interface directly exposed by the host to the external network, network protocols often become the focus of potential attackers. In order to ensure the robustness of the protocol implementation, it must be able to accurately process and parse various network traffic, whether it is normal communication traffic or possible attack traffic.

[0003] As an automated vulnerability mining technology, fuzz testing discovers potential program errors by sending randomly generated test cases to the program under test and observing whether the program exhibits abnormal behavior. However, traditional fuzz testing methods, which rely on randomly generated test cases, often fail to effectively reveal all vulnerabilities in protocol implementations. This is because randomly generated test cases may not cover all states and behaviors of the protocol, resulting in some vulnerabilities being missed. In order to improve the effect of fuzz testing, researchers have proposed a fuzz testing method based on state machine learning. Among them, the state machine passive learning scheme infers the state machine of the protocol by analyzing the traffic packets obtained in advance. However, the effectiveness of this method is highly dependent on the integrity and sufficiency of the input data packet sequence samples. If the sample set is insufficient, the inferred state machine may be incomplete or incorrect, and this method is often difficult to work for encrypted network protocols.

[0004] Therefore, how to accurately and completely construct a network protocol state machine for fuzz testing, and use the constructed network protocol state machine to efficiently and comprehensively perform fuzz testing on the network protocol, is a technical problem that needs to be solved urgently. Summary of the invention

[0005] In view of the above-mentioned problems existing in the prior art, the present invention provides a state machine generation method for a network protocol and a fuzzy testing method for a network protocol, so as to accurately and completely construct a network protocol state machine for fuzz testing, so as to utilize the constructed network protocol state machine to efficiently and comprehensively perform fuzz testing on the network protocol.

[0006] The present invention provides a state machine generation method for a network protocol, which is applied to a state machine inference module and comprises the following steps.

[0007] Obtain information on the packet type of the network protocol to be tested; construct an abstract query packet using a packet template corresponding to the packet type, and generate an abstract query packet sequence consisting of at least one abstract query packet; wherein the packet template is generated using a universal data representation language and is used to describe its corresponding packet structure; send the abstract query packet sequence to a mapping client to instruct the mapping client to generate a query packet sequence consisting of query packets based on the abstract query packet sequence and its corresponding packet template, and send the query packet sequence to a system to be tested implemented based on the network protocol to be tested; obtain an abstract response packet sequence from the mapping client, and construct a target state machine of the network protocol to be tested based on the abstract query packet sequence and the abstract response packet sequence using a preset active learning algorithm; wherein the abstract response packet sequence is generated by the mapping client based on the parsing of the response packet sequence, and the response packet sequence is generated by the system to be tested based on the query packet sequence.

[0008] The present invention provides a state machine generation method for a network protocol, which is applied to a mapping client and comprises the following steps.

[0009] An abstract query data packet sequence is obtained from a state machine inference module; wherein the abstract query data packet sequence is constructed by the state machine inference module using a data packet template corresponding to a data packet type of a network protocol to be tested; the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; based on the abstract query data packet sequence and its corresponding data packet template, a query data packet sequence composed of query data packets is generated; the query data packet sequence is sent to a system to be tested implemented based on the network protocol to be tested; from the system to be tested, a response data packet sequence generated by the system to be tested based on the query data packet sequence is obtained; based on the response data packet sequence and its corresponding data packet template, an abstract response data packet sequence is generated; the abstract response data packet sequence is sent to the state machine inference module, so that the state machine inference module, based on the abstract query data packet sequence and the abstract response data packet sequence, constructs a target state machine of the network protocol to be tested using a preset active learning algorithm.

[0010] The present invention provides a fuzzy testing method for a network protocol, which is applied to a fuzzy testing module and comprises the following steps.

[0011] Acquire a target state machine of a network protocol to be tested; construct a test abstract data packet according to a data packet template corresponding to each state in at least one state of the target state machine, and generate a test abstract data packet sequence; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; send the test abstract data packet sequence to a mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain a data packet sequence to be tested according to the test abstract data packet sequence, and use the data packet sequence to be tested to perform a fuzzy test on a system to be tested that is implemented based on the network protocol to be tested.

[0012] According to a fuzzy testing method for a network protocol provided by the present invention, the test abstract data packet is constructed based on the data packet template corresponding to each state in at least one state of the target state machine, and a test abstract data packet sequence is generated, including: using a preset path search algorithm to determine the state path from the initial state to the target test state in the target state machine; using the data packet templates corresponding to each state other than the target test state in the state path to construct a preceding abstract data packet sequence; using a preset mutation algorithm to construct a mutated abstract data packet based on the data packet template corresponding to the target test state; obtaining the test abstract data packet sequence based on the preceding abstract data packet sequence and the mutated abstract data packet; and using the test abstract data packet templates to construct a mutated abstract data packet sequence. The data packet template corresponding to each data packet in the packet sequence is used to obtain the data packet sequence to be tested according to the test abstract data packet sequence, including: using the data packet template corresponding to each data packet in the preceding abstract data packet sequence to obtain the preceding test data packet sequence according to the preceding abstract data packet sequence; using the data packet template corresponding to the variant abstract data packet to obtain the variant test data packet according to the variant abstract data packet; using the data packet sequence to be tested to perform fuzzy testing on the system to be tested implemented based on the network protocol to be tested, including: using the preceding test data packet sequence to guide the system to be tested to transfer the state to the target test state; using the variant test data packet to perform fuzzy testing on the system to be tested.

[0013] The present invention provides a fuzzy testing method for a network protocol, which is applied to a mapping client and comprises the following steps.

[0014] A test abstract data packet sequence is received from a fuzzy testing module; wherein the test abstract data packet sequence is constructed by the fuzzy testing module according to a data packet template corresponding to each state in at least one state of a target state machine of a network protocol to be tested; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; using the data packet template corresponding to each data packet in the test abstract data packet sequence, a data packet sequence to be tested is obtained according to the test abstract data packet sequence; using the data packet sequence to be tested, a fuzzy test is performed on a system to be tested that is implemented based on the network protocol to be tested.

[0015] According to a fuzzy testing method for a network protocol provided by the present invention, the test abstract data packet sequence includes a preceding abstract data packet sequence and a variant abstract data packet; wherein the preceding abstract data packet sequence is constructed by the fuzzy testing module using data packet templates corresponding to each data packet in a state path, and the state path is a path from an initial state to a previous state of a target test state in the target state machine obtained by the fuzzy testing module using a preset path search algorithm; the variant abstract data packet is constructed by the fuzzy testing module using a preset mutation algorithm according to the data packet template corresponding to the target test state; the data packet template corresponding to each data packet in the test abstract data packet sequence is constructed by using a preset mutation algorithm. Packet template, obtains the data packet sequence to be tested according to the test abstract data packet sequence, including: using the data packet template corresponding to each data packet in the preceding abstract data packet sequence, according to the preceding abstract data packet sequence, obtains the preceding test data packet sequence; using the data packet template corresponding to the variant abstract data packet, according to the variant abstract data packet, obtains the variant test data packet; using the data packet sequence to be tested, fuzzy testing the system to be tested implemented based on the network protocol to be tested, including: using the preceding test data packet sequence to guide the system to be tested to transfer the state to the target test state; using the variant test data packet to fuzzy test the system to be tested.

[0016] The present invention also provides a state machine generating device for a network protocol, which is arranged in a state machine inference module and includes the following modules: An acquisition module is used to acquire information about the packet type of the network protocol to be tested; a first construction module is used to construct an abstract query packet using a packet template corresponding to the packet type, and generate an abstract query packet sequence consisting of at least one abstract query packet; wherein the packet template is generated using a universal data representation language and is used to describe its corresponding packet structure; a sending module is used to send the abstract query packet sequence to a mapping client to instruct the mapping client to generate a query packet sequence consisting of query packets based on the abstract query packet sequence and its corresponding packet template, and to send the query packet sequence to a system to be tested implemented based on the network protocol to be tested; a second construction module is used to obtain an abstract response packet sequence from the mapping client, and construct a target state machine of the network protocol to be tested based on the abstract query packet sequence and the abstract response packet sequence using a preset active learning algorithm; wherein the abstract response packet sequence is generated by the mapping client based on the parsing of the response packet sequence, and the response packet sequence is generated by the system to be tested based on the query packet sequence.

[0017] The present invention also provides a fuzzy testing device for a network protocol, which is arranged in a fuzzy testing module and includes the following modules: An acquisition module is used to acquire a target state machine of a network protocol to be tested; a construction module is used to construct a test abstract data packet according to a data packet template corresponding to each state in at least one state of the target state machine, and generate a test abstract data packet sequence; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; a sending module is used to send the test abstract data packet sequence to a mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain a data packet sequence to be tested according to the test abstract data packet sequence, and use the data packet sequence to be tested to perform fuzzy testing on a system to be tested that is implemented based on the network protocol to be tested.

[0018] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a fuzzy testing method for a network protocol as described above is implemented.

[0019] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the fuzzy testing method of the network protocol as described in any one of the above is implemented.

[0020] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the fuzzy testing method of the network protocol as described above is implemented.

[0021] The state machine generation method of the network protocol provided by the present invention uses a data packet template corresponding to a data packet type to construct an abstract query data packet, and generates an abstract query data packet sequence composed of at least one abstract query data packet; sends the abstract query data packet sequence to a mapping client to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and sends the query data packet sequence to a system to be tested that is implemented based on the network protocol to be tested; obtains an abstract response data packet sequence from the mapping client, and constructs a target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm.

[0022] By using packet templates, users can easily add, remove or modify fields in packets without modifying or refactoring the code, which can significantly improve the efficiency of fuzz testing. At the same time, the state machine inference module uses packet templates to generate query packet sequences, while the mapping client uses the same template to parse these sequences and generate actual query packet sequences. This design effectively reduces the coupling between the state machine inference module and the mapping client, and enhances the modularity and maintainability of the fuzz testing system. In addition, users only need to implement the session maintenance code in the network protocol to be tested and save the global parameters of the new protocol session to uniformly construct the packet template, which further simplifies the adaptation process for different protocols and improves the processing efficiency of fuzz testing.

[0023] Using active learning algorithms to construct the target state machine of the network protocol to be tested can not only improve the efficiency and accuracy of state machine construction, but also make the system adaptive, thereby better understanding and simulating the behavior of the network protocol to be tested.

[0024] Therefore, the present invention can accurately and completely construct a network protocol state machine for fuzz testing, so as to utilize the constructed network protocol state machine to efficiently and comprehensively perform fuzz testing on the network protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1This is one of the flow charts of the state machine generation method of the network protocol provided by the present invention.

[0027] Figure 2 This is the second flow chart of the state machine generation method of the network protocol provided by the present invention.

[0028] Figure 3 It is one of the flow charts of the fuzzy testing method for the network protocol provided by the present invention.

[0029] Figure 4 This is the second flow chart of the fuzzy testing method for the network protocol provided by the present invention.

[0030] Figure 5 It is a schematic diagram of the process of target state machine generation and fuzzy testing provided by the present invention.

[0031] Figure 6 It is a schematic diagram of the generation process of the target state machine by the state machine inference module provided by the present invention.

[0032] Figure 7 It is a schematic diagram of the process of fuzzy testing performed by the fuzzy testing module provided by the present invention.

[0033] Figure 8 It is a schematic diagram of the character set provided by the invention.

[0034] Fig. 9 It is a structural schematic diagram of a state machine generating device for a network protocol provided by the present invention.

[0035] Fig.10 It is a structural schematic diagram of the fuzzy testing device for the network protocol provided by the present invention.

[0036] Fig.11 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Combine the following Figure 1-Figure 2 The state machine generation method of the present invention is described.

[0039] Figure 1 This is one of the flow charts of the state machine generation method of the network protocol provided by the present invention.

[0040] The method is applied to a state machine inference module. A state machine inference module is a software module or system component used to infer the state machine of the network protocol implementation to be tested.

[0041] like Figure 1 As shown, the method includes the following: Step 101: Obtain information on the data packet type of the network protocol to be tested.

[0042] The network protocols to be tested may include, but are not limited to, IKEv2 (Internet Key Exchange Version 2), TLS 1.3 (Transport Layer Security version 1.3), and SNMP (Simple Network Management Protocol).

[0043] As just an example, the packet types of IKEv2 may include: a packet in an IKE_SA_INIT exchange, a packet in an IKE_AUTH exchange, a packet in a CREATE_CHILD_SA exchange, and a packet in an INFORMATIONAL exchange.

[0044] In the specific implementation process, a character set corresponding to each network protocol to be tested can be established, such as Figure 8 As shown, the character set includes multiple character strings, each of which (eg, SA_Init_ACC) represents a data packet type (eg, IKE_SA_INIT) included in the network protocol to be tested. The state machine inference module can obtain information about the data packet type included in the network protocol to be tested from the character set.

[0045] Step 102: construct an abstract query data packet using a data packet template corresponding to the data packet type, and generate an abstract query data packet sequence consisting of at least one abstract query data packet.

[0046] The data packet template is generated using a universal data representation language and is used to describe the corresponding data packet structure. The data packet template defines the format and fields of the corresponding type of data packet, the types of the fields, and the hierarchical relationship between the fields.

[0047] Abstract query data packets are a data representation based on data packet templates, which are used to simulate data packets in actual network protocols during state machine inference. They follow the definition of the corresponding data packet template, including the format, fields, field types, and hierarchical relationships between fields of the data packet.

[0048] The character set in step 101 may also store data packet templates corresponding to various data packet types as a character-template mapping library.

[0049] The general data representation language may include but is not limited to XML language, JSON language, etc.

[0050] Just as an example, a simple login protocol data packet, whose XML language implementation data packet template is as follows: “ <loginrequest> <username> string< / username> <password> string< / password> < / loginrequest> ”.

[0051] In the specific implementation process, the data packet template corresponding to the data packet type can be used to construct an abstract query data packet.

[0052] Just as an example, for the data packet template in the above example, you can construct the following abstract query data packet: “ <loginrequest> <username attr="’string’"> testUser< / username> <password attr="’string’"> testPassword123< / password> < / loginrequest> ”.

[0053] Step 103: Send the abstract query data packet sequence to the mapping client to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and send the query data packet sequence to the system to be tested implemented based on the network protocol to be tested.

[0054] The mapping client is a processing device (eg, a remote host) that actually interacts with the system under test.

[0055] For a detailed description of the mapping client generating a query packet sequence composed of query packets based on the abstract query packet sequence and its corresponding packet template, see Figure 2 The relevant content in will not be repeated here.

[0056] Step 104: Obtain an abstract response data packet sequence from the mapping client, and construct a target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm.

[0057] The target state machine is a state machine used to perform network protocol fuzz testing on the system to be tested.

[0058] The abstract response packet sequence is generated by the mapping client based on the parsing of the response packet sequence, and the response packet sequence is generated by the system under test based on the query packet sequence.

[0059] The preset active learning algorithm may include but is not limited to: L* algorithm, T* algorithm, RPNI algorithm, ActiveLearning algorithm, etc.

[0060] When using active learning algorithms to infer the target state machine, such as Figure 6 As shown, by using the mapping client as an intermediary to interact with the system to be tested through black-box communication, the target state machine model is inferred and verified under the guidance of membership query and equivalence query.

[0061] In some embodiments, the L* algorithm may be used to construct a target state machine of the network protocol to be tested based on an abstract query data packet sequence and an abstract response data packet sequence.

[0062] The L* algorithm aims to learn and construct a deterministic finite automaton (DFA) by alternating between membership queries and equivalence queries.

[0063] As an example, first create a hypothetical state machine, as in step 101, according to the character set corresponding to the network protocol to be tested (such as Figure 8 As shown in Figure 1, a series of member query sequences (i.e., abstract query packet sequences) that conform to the hypothetical state machine are constructed. These sequences are then converted by the mapping client into a sequence of packets that can actually be transmitted (i.e., query packet sequences), sent to the system under test, and the output of the system under test (i.e., response packet sequences) is collected as observations. If a discrepancy is found between the expected output sequence and the actual output sequence, the algorithm will construct a new hypothetical state machine based on these differences. On the other hand, equivalence queries are used to check whether the current hypothetical state machine and the reference state machine (which may be the initial state machine or the state machine in the previous iteration) have the same behavior on a given input. If the two behaviors are different, the algorithm will propose a series of test sequences to distinguish them, and adjust the hypothetical state machine based on the results of these test sequences to make it more accurately match the behavior of the system under test. By continuously iterating this process, the algorithm can gradually improve and optimize the state machine model and finally obtain the target state machine.

[0064] In the specific implementation process, for equivalent queries, the random generation algorithm can be used to generate query members, but it has limitations, such as the generation of duplicate sequences and low query efficiency. Therefore, it is necessary to prune invalid query sequences.

[0065] For protocols based on TCP connections, the preamble sequences that cause the TCP connection to be disconnected can be ignored to reduce the time consumption of the equivalent query stage. However, for protocols involving session recovery, since the test process involves the interruption and recovery of TCP connections, pruning cannot be performed only through TCP connection detection. At this time, the character set provided to the state machine inference module needs to include not only the packet type of the protocol itself, but also special characters to control the reconstruction of TCP connections, so as to test the multi-session state machine of the protocol.

[0066] For protocols based on UDP connections, since UDP's connectionless nature may lead to packet loss and uncertain responses, a timeout retransmission mechanism needs to be set to enhance robustness. When a timeout occurs during the inference process, the current data packet will be retransmitted several times, and the test target will be considered unresponsive only after the upper limit is reached.

[0067] Figure 2 This is the second flow chart of the state machine generation method of the network protocol provided by the present invention.

[0068] The method is applied to the mapping client, which is a middleware responsible for maintaining the network session of the network protocol implementation to be tested. The mapping client receives abstract packet sequences from the state machine inference module and the fuzz testing module, and constructs these abstract packet sequences into specific network packet sequences, which are then forwarded to the system under test (SUT). At the same time, the mapping client is also responsible for receiving response packets from the SUT and parsing them. The mapping client does not directly construct protocol data packets through program code, but constructs specific data packets based on pre-defined data packet templates.

[0069] like Figure 2 As shown, the method includes the following: Step 201: Obtain an abstract query data packet sequence from a state machine inference module.

[0070] The abstract query packet sequence is constructed by the state machine inference module using the packet template corresponding to the packet type of the network protocol to be tested. The packet template is generated using a universal data representation language to describe its corresponding packet structure.

[0071] For a detailed description of the abstract query packet sequence and packet template, see Figure 1 The relevant content in will not be repeated here.

[0072] Step 202: Generate a query data packet sequence consisting of query data packets based on the abstract query data packet sequence and its corresponding data packet template.

[0073] The process of generating a query packet sequence composed of query packets based on an abstract query packet sequence and its corresponding packet template is to convert the abstract query packet sequence represented by a general data representation language into a query packet sequence available in a specific network protocol.

[0074] Just as an example, assume an abstract query packet sequence that describes multiple query requests for a login function. The abstract query packet sequence is as follows: 1. Login request: <loginrequest> 2. Verification Request: <verifyrequest> 3. Session query: <sessionquery> The corresponding data packet template is as follows: 1.LoginRequest template: " <packettemplate name="LoginRequest"> <field name="Username" type="string" / > <field name="Password" type="string" / > < / packettemplate> ”.

[0075] 2.VerifyRequest template: " <packettemplate name="VerifyRequest"> <field name="Token" type="string" / > < / packettemplate> ”.

[0076] 3.SessionQuery template: " <packettemplate name="SessionQuery"> <field name="SessionID" type="string" / > < / packettemplate> ”.

[0077] Based on the above data packet template and abstract query data packet sequence, a specific query data packet sequence can be generated. Assume the following specific field values: •Username: testUser • Password: testPassword123 •Token: abc123 •Session ID: session001 Then, the generated query packet sequence can be as follows: 1.LoginRequest packet: " <loginrequest> <username attr="’string’"> testUser< / username> <password attr="’string’"> testPassword123< / password> < / loginrequest> ”.

[0078] 2.VerifyRequest packet: " <verifyrequest> <token attr="’string’"> abc123< / token> < / verifyrequest> ”.

[0079] 3.SessionQuery data packet: " <sessionquery> <sessionid attr="’string’"> session001< / sessionid> < / sessionquery> ”.

[0080] Step 203: Send the query data packet sequence to the system to be tested implemented based on the network protocol to be tested.

[0081] Step 204: Obtain, from the system to be tested, a response data packet sequence generated by the system to be tested based on the query data packet sequence.

[0082] Step 205: Generate an abstract response data packet sequence based on the response data packet sequence analysis.

[0083] In the specific implementation process, the packet parsing capability provided by Scapy can be used to analyze the received response packet sequence and extract the valid fields; fill the packet template according to the extracted valid fields to generate an abstract response packet sequence. Scapy is a powerful interactive packet processing program written in Python.

[0084] For the implementation process of this step, please refer to the relevant content in step 102, which will not be repeated here.

[0085] Step 206: Send the abstract response data packet sequence to the state machine inference module, so that the state machine inference module constructs a target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm.

[0086] Combine the following Figure 3-Figure 4 The fuzzy estimation method of the present invention is described.

[0087] Figure 3 It is one of the flow charts of the fuzzy testing method for the network protocol provided by the present invention.

[0088] The method is applied to a fuzz testing module, which is a software module or system component that generates an abstract test data packet represented by a data packet template based on a target state machine generated by a state machine inference module.

[0089] like Figure 3 As shown, the method includes the following: Step 301: Obtain a target state machine of the network protocol to be tested.

[0090] In the specific implementation process, Figure 5 As shown, the fuzz testing module obtains the target state machine constructed by the active learning algorithm from the state machine inference module.

[0091] For a detailed description of the target state machine, see Figure 1 The relevant content in will not be repeated here.

[0092] Step 302: construct a test abstract data packet according to a data packet template corresponding to each state in at least one state of the target state machine, and generate a test abstract data packet sequence.

[0093] For a detailed description of the data packet template and how to construct a test abstract data packet based on the data packet template, see Figure 1 The relevant content in will not be repeated here.

[0094] In some embodiments, a preset path search algorithm can be used to determine the state path from the initial state to the target test state in the target state machine; a preceding abstract data packet sequence can be constructed using data packet templates corresponding to each state other than the target test state in the state path; a preset mutation algorithm is used to construct a mutated abstract data packet based on the data packet template corresponding to the target test state; and a test abstract data packet sequence is obtained based on the preceding abstract data packet sequence and the mutated abstract data packet.

[0095] In a specific implementation process, in a target state machine, there may be multiple state paths from an initial state to a target test state, and one state path may be randomly selected from them, and a pre-abstract data packet sequence may be constructed based on the state path.

[0096] In the specific implementation process, an abstract data packet can be constructed according to the data packet template corresponding to the target test state; then, a preset mutation algorithm is used to change the fields in the constructed abstract data packet to generate a mutated abstract data packet.

[0097] Just as an example, Figure 7 As shown, the state parser extracts the state path Path3:pkt1-pkt3 from the initial node of the state machine model (target state machine) to each state in a breadth-first search manner. The mutation generator selects fields for mutation according to the field type in the data packet template corresponding to the target test state (state pkt3), and generates the corresponding mutated abstract data packet in combination with the data packet template.

[0098] In a single round of testing, the state machine parser gives priority to states with higher priorities as target test states. The priority is affected by factors such as the number of tests of the state and the number of exceptions triggered.

[0099] Step 303: Send the test abstract data packet sequence to the mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence, and use the data packet sequence to be tested to perform fuzzy testing on the system to be tested implemented based on the network protocol to be tested.

[0100] In some embodiments, after sending a test abstract data packet sequence consisting of a preceding abstract data packet sequence and a variant abstract data packet to a mapping client, the mapping client uses a data packet template corresponding to each data packet in the preceding abstract data packet sequence to obtain a preceding test data packet sequence according to the preceding abstract data packet sequence; uses a data packet template corresponding to the variant abstract data packet to obtain a variant test data packet according to the variant abstract data packet; uses the preceding test data packet sequence to guide the system to be tested to transfer its state to a target test state; and uses the variant test data packet to perform fuzzy testing on the system to be tested.

[0101] In the embodiment provided by the present invention, a pre-test data packet sequence and a variation test data packet can be constructed for different target test states, so that deep fuzzy testing can be performed on each state of the system to be tested to discover more hidden vulnerabilities.

[0102] Figure 4 This is the second flow chart of the fuzzy testing method for the network protocol provided by the present invention. Figure 4 As shown, the method is applied to a mapping client, and the method includes the following steps: Step 401: Receive a test abstract data packet sequence from a fuzzy test module.

[0103] The test abstract data packet sequence is constructed by the fuzzy test module according to the data packet template corresponding to each state in at least one state of the target state machine of the network protocol to be tested.

[0104] Step 402: using the data packet template corresponding to each data packet in the test abstract data packet sequence, and obtaining a data packet sequence to be tested according to the test abstract data packet sequence.

[0105] The packet sequence to be tested refers to a series of packets generated by converting each test abstract packet into a specific network packet format based on the test abstract packet sequence. These packets follow the structure and field definition of the packet template corresponding to the test abstract packet, but contain actual data values ​​and are ready to be sent to the target protocol implementation (such as network equipment or software) for testing.

[0106] In some embodiments, the test abstract data packet sequence includes a preceding abstract data packet sequence and a variant abstract data packet. The preceding abstract data packet sequence is constructed by the fuzzy test module using the data packet templates corresponding to each data packet in the state path. The state path is the path from the initial state to the previous state of the target test state in the target state machine obtained by the fuzzy test module using a preset path search algorithm; the variant abstract data packet is constructed by the fuzzy test module using a preset mutation algorithm according to the data packet template corresponding to the target test state. In this embodiment, the preceding test data packet sequence can be obtained according to the preceding abstract data packet sequence using the data packet template corresponding to each data packet in the preceding abstract data packet sequence; the variant test data packet can be obtained according to the variant abstract data packet using the data packet template corresponding to the variant abstract data packet.

[0107] In the specific implementation process, for the encryption and security fields involving the logic of the network protocol to be tested, the mapping client can call the manually constructed protocol logic for separate processing to ensure the legitimacy of the test package.

[0108] Step 403: Use the data packet sequence to perform fuzzy testing on the system to be tested that is implemented based on the network protocol to be tested.

[0109] In some embodiments, the sequence of data packets to be tested includes a sequence of pre-test data packets and a sequence of variant test data packets. The pre-test data packet sequence is used to guide the system to be tested to transfer its state to a target test state; and the variant test data packets are used to perform fuzzy testing on the system to be tested.

[0110] In the specific implementation process, after the system to be tested is guided to the target test state, multiple rounds of test data packets can be generated to continuously perform fuzz testing on the system to be tested. During the continuous fuzz testing of the system to be tested, it is necessary to monitor the state of the system to be tested to determine whether the system vulnerability is triggered. For a completely black-box network protocol implementation to be tested, such as a network device, anomalies such as the overall system deactivation and the deactivation of port services involved in the protocol can be detected.

[0111] In addition, a single round of fuzz testing will send a specific message sequence to multiple systems under test at the same time, and compare the output results of each system under test by difference, to determine whether there are security risks that violate the semantic specification, although they do not directly trigger the program crash. Therefore, such situations will also be monitored as exceptions. After each round of fuzz testing, the system under test can be reset to its initial state to avoid affecting the next round of testing.

[0112] When a vulnerability is detected during the fuzz testing process, the corresponding data packet can be parsed into the corresponding data packet template and updated into the character-template mapping library for the next round of testing of the state machine inference module.

[0113] The state machine generating device of the network protocol provided by the present invention is described below. The state machine generating device of the network protocol described below and the state machine generating method of the network protocol described above can be referred to each other.

[0114] Fig. 9 Schematic diagram of the structure of the state machine generating device of the network protocol provided by the present invention. Fig. 9 As shown, the device 900 includes the following modules.

[0115] An acquisition module 910 is used to acquire information about the data packet type of the network protocol to be tested; Construction module 920 is used to construct an abstract query data packet using a data packet template corresponding to the data packet type, and generate an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a universal data representation language to describe its corresponding data packet structure.

[0116] The sending module 930 is used to send the abstract query data packet sequence to the mapping client to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and to send the query data packet sequence to the system to be tested implemented based on the network protocol to be tested.

[0117] The parsing module 940 is used to obtain an abstract response data packet sequence from the mapping client, and based on the abstract query data packet sequence and the abstract response data packet sequence, construct a target state machine of the network protocol to be tested using a preset active learning algorithm; wherein the abstract response data packet sequence is generated by the mapping client based on the parsing of the response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence.

[0118] The fuzzy testing device for the network protocol provided by the present invention is described below. The fuzzy testing device for the network protocol described below and the fuzzy testing method for the network protocol described above can be referenced to each other.

[0119] Fig.10 Schematic diagram of the structure of the fuzzy testing device for the network protocol provided by the present invention. Fig.10 As shown, the device 1000 includes the following modules.

[0120] The acquisition module 1010 is used to acquire the target state machine of the network protocol to be tested.

[0121] Construction module 1020 is used to construct a test abstract data packet and generate a test abstract data packet sequence based on the data packet template corresponding to each state in at least one state of the target state machine; wherein the data packet template is generated using a universal data representation language to describe its corresponding data packet structure.

[0122] The sending module 1030 is used to send the test abstract data packet sequence to the mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence, and use the data packet sequence to be tested to perform fuzzy testing on the system to be tested implemented based on the network protocol to be tested.

[0123] Fig.11 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.11 As shown, the electronic device may include: a processor (processor) 1110 , a communication interface (Communications Interface) 1120 , a memory (memory) 1130 and a communication bus 1140 , wherein the processor 1110 , the communication interface 1120 , and the memory 1130 communicate with each other via the communication bus 1140 . The processor 1110 can call the logic instructions in the memory 1130 to execute the fuzzy testing method of the network protocol, which includes: obtaining information on the packet type of the network protocol to be tested; using the packet template corresponding to the packet type to construct an abstract query packet and generate an abstract query packet sequence consisting of at least one abstract query packet; wherein the packet template is generated using a universal data representation language and is used to describe its corresponding packet structure; sending the abstract query packet sequence to a mapping client to instruct the mapping client to generate a query packet sequence consisting of query packets based on the abstract query packet sequence and its corresponding packet template, and sending the query packet sequence to a system to be tested implemented based on the network protocol to be tested; obtaining an abstract response packet sequence from the mapping client, and constructing a target state machine of the network protocol to be tested based on the abstract query packet sequence and the abstract response packet sequence using a preset active learning algorithm; wherein the abstract response packet sequence is generated by the mapping client based on the parsing of the response packet sequence, and the response packet sequence is generated by the system to be tested based on the query packet sequence.

[0124] In addition, the logic instructions in the above-mentioned memory 1130 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0125] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the fuzzy testing method of the network protocol provided by the above methods, the method including: obtaining information on the data packet type of the network protocol to be tested; using a data packet template corresponding to the data packet type to construct an abstract query data packet, and generate an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; sending the abstract query data packet sequence to a mapping client to instruct the mapping client to generate a query data packet sequence consisting of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and sending the query data packet sequence to a system to be tested implemented based on the network protocol to be tested; obtaining an abstract response data packet sequence from the mapping client, and constructing a target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm; wherein the abstract response data packet sequence is generated by the mapping client based on the parsing of the response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence.

[0126] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a fuzzy testing method for a network protocol provided by the above-mentioned methods, the method comprising: obtaining information on a packet type of the network protocol to be tested; constructing an abstract query packet using a packet template corresponding to the packet type, and generating an abstract query packet sequence consisting of at least one abstract query packet; wherein the packet template is generated using a universal data representation language and is used to describe its corresponding packet structure; sending the abstract query packet sequence to a mapping client to instruct the mapping client to generate a query packet sequence consisting of query packets based on the abstract query packet sequence and its corresponding packet template, and sending the query packet sequence to a system to be tested implemented based on the network protocol to be tested; obtaining an abstract response packet sequence from the mapping client, and constructing a target state machine of the network protocol to be tested based on the abstract query packet sequence and the abstract response packet sequence using a preset active learning algorithm; wherein the abstract response packet sequence is generated by the mapping client based on parsing of the response packet sequence, and the response packet sequence is generated by the system to be tested based on the query packet sequence.

[0127] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0128] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.< / sessionquery> < / verifyrequest> < / loginrequest>

Claims

1. A method for generating a state machine of a network protocol, characterized in that: Applied to a state machine inference module, the method comprises: Get information about the data packet type of the network protocol to be tested; Using a data packet template corresponding to the data packet type, construct an abstract query data packet, and generate an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; Sending the abstract query data packet sequence to a mapping client to instruct the mapping client to generate a query data packet sequence consisting of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and sending the query data packet sequence to the system to be tested implemented based on the network protocol to be tested; An abstract response data packet sequence is obtained from the mapping client, and based on the abstract query data packet sequence and the abstract response data packet sequence, a target state machine of the network protocol to be tested is constructed using a preset active learning algorithm; wherein the abstract response data packet sequence is generated by the mapping client based on the parsing of the response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence.

2. A method for generating a state machine of a network protocol, characterized in that: Applied to a mapping client, the method comprises: Acquire an abstract query data packet sequence from a state machine inference module; wherein the abstract query data packet sequence is constructed by the state machine inference module using a data packet template corresponding to a data packet type of a network protocol to be tested; the data packet template is generated using a universal data representation language and is used to describe a corresponding data packet structure; Based on the abstract query data packet sequence and its corresponding data packet template, generating a query data packet sequence consisting of query data packets; Sending the query data packet sequence to the system to be tested implemented based on the network protocol to be tested; acquiring, from the system to be tested, a response data packet sequence generated by the system to be tested based on the query data packet sequence; Parsing and generating an abstract response data packet sequence based on the response data packet sequence; The abstract response data packet sequence is sent to the state machine inference module, so that the state machine inference module constructs the target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm.

3. A fuzzy testing method for a network protocol, characterized in that: Applied to the fuzz testing module, the method comprises: Get the target state machine of the network protocol to be tested; According to the data packet template corresponding to each state in at least one state of the target state machine, a test abstract data packet is constructed to generate a test abstract data packet sequence; wherein the data packet template is generated using a universal data representation language and is used to describe the corresponding data packet structure; The test abstract data packet sequence is sent to the mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence, obtain the data packet sequence to be tested according to the test abstract data packet sequence, and use the data packet sequence to be tested to perform fuzzy testing on the system to be tested implemented based on the network protocol to be tested.

4. The fuzzy testing method of the network protocol according to claim 3 is characterized in that: The step of constructing a test abstract data packet and generating a test abstract data packet sequence according to a data packet template corresponding to each state in at least one state of the target state machine includes: Determine a state path from an initial state to a target test state in the target state machine by using a preset path search algorithm; Using the data packet templates corresponding to each state other than the target test state in the state path, construct a pre-stage abstract data packet sequence; Using a preset mutation algorithm, constructing a mutation abstract data packet according to a data packet template corresponding to the target test state; Obtaining the test abstract data packet sequence according to the preceding abstract data packet sequence and the variant abstract data packet; The method of using the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence comprises: Using the data packet template corresponding to each data packet in the preceding abstract data packet sequence, a preceding test data packet sequence is obtained according to the preceding abstract data packet sequence; Using the data packet template corresponding to the mutated abstract data packet, a mutated test data packet is obtained according to the mutated abstract data packet; The method of using the sequence of data packets to be tested to perform fuzzy testing on the system to be tested based on the network protocol to be tested includes: Using the pre-test data packet sequence, guiding the system to be tested to transfer its state to the target test state; The system to be tested is fuzzily tested using a mutated test data packet.

5. A fuzzy testing method for a network protocol, characterized in that: The method is applied to a mapping client, and the method comprises: Receive a test abstract data packet sequence from a fuzzy test module; wherein the test abstract data packet sequence is constructed by the fuzzy test module according to a data packet template corresponding to each state in at least one state of a target state machine of a network protocol to be tested; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; Using the data packet template corresponding to each data packet in the test abstract data packet sequence, and obtaining a data packet sequence to be tested according to the test abstract data packet sequence; The to-be-tested data packet sequence is used to perform fuzzy testing on the to-be-tested system implemented based on the to-be-tested network protocol.

6. The fuzz testing method for network protocol according to claim 5, characterized in that: The test abstract data packet sequence includes a pre-placed abstract data packet sequence and a variant abstract data packet; The preceding abstract data packet sequence is constructed by the fuzzy test module using the data packet template corresponding to each data packet in the state path, and the state path is the path from the initial state to the previous state of the target test state in the target state machine obtained by the fuzzy test module using a preset path search algorithm; the variant abstract data packet is constructed by the fuzzy test module using a preset mutation algorithm according to the data packet template corresponding to the target test state; The step of using the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence comprises: Using the data packet template corresponding to each data packet in the preceding abstract data packet sequence, a preceding test data packet sequence is obtained according to the preceding abstract data packet sequence; Using the data packet template corresponding to the mutated abstract data packet, a mutated test data packet is obtained according to the mutated abstract data packet; The method of using the sequence of data packets to be tested to perform fuzzy testing on the system to be tested based on the network protocol to be tested includes: Using the pre-test data packet sequence, guiding the system to be tested to transfer its state to the target test state; The system to be tested is fuzzily tested using a mutated test data packet.

7. A state machine generating device for a network protocol, characterized in that: Set in the state machine inference module, the device includes: An acquisition module, used to obtain information about the data packet type of the network protocol to be tested; A construction module, used to construct an abstract query data packet using a data packet template corresponding to the data packet type, and generate an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; A sending module, used for sending the abstract query data packet sequence to a mapping client, so as to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and to send the query data packet sequence to a system to be tested implemented based on the network protocol to be tested; A parsing module is used to obtain an abstract response data packet sequence from the mapping client, and based on the abstract query data packet sequence and the abstract response data packet sequence, construct a target state machine of the network protocol to be tested using a preset active learning algorithm; wherein the abstract response data packet sequence is generated by the mapping client based on the parsing of the response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence.

8. A fuzzy testing device for a network protocol, characterized in that: Set in the fuzzy test module, the device includes: An acquisition module, used to acquire a target state machine of the network protocol to be tested; A construction module, used to construct a test abstract data packet according to a data packet template corresponding to each state in at least one state of the target state machine, and generate a test abstract data packet sequence; wherein the data packet template is generated using a universal data representation language and is used to describe its corresponding data packet structure; A sending module is used to send the test abstract data packet sequence to the mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence, obtain the data packet sequence to be tested according to the test abstract data packet sequence, and use the data packet sequence to be tested to perform fuzzy testing on the system to be tested implemented based on the network protocol to be tested.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the fuzz testing method of the network protocol as described in any one of claims 1 to 6 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the fuzz testing method of the network protocol as described in any one of claims 1 to 6.

Images