Network protocol state machine generation method and network protocol fuzz testing method

Abstract

The application provides a network protocol state machine generation method and a network protocol fuzzy testing method, and relates to the technical field of software testing. The network protocol state machine generation method comprises the following steps: obtaining information of a data packet type of a network protocol to be tested; constructing an abstract query data packet by using a data packet template corresponding to the data packet type, generating an abstract query data packet sequence composed of at least one abstract query data packet; sending the abstract query data packet sequence to a mapping client; obtaining an abstract response data packet sequence from the mapping client; and constructing a target state machine of the network protocol to be tested by using a preset active learning algorithm based on the abstract query data packet sequence and the abstract response data packet sequence. The application can accurately and completely construct a network protocol state machine for fuzzy testing, so that the constructed network protocol state machine can be used to efficiently and comprehensively perform fuzzy testing on the network protocol.

Description

Technical Field

[0001] This invention relates to the field of software testing technology, and in particular to a method for generating state machines for network protocols and a fuzz testing method for network protocols. Background Technology

[0002] As the cornerstone of the modern internet, the security and reliability of network protocols directly affect the stability and security of the entire network environment. However, as interfaces directly exposed to the external network, network protocols often become prime targets for potential attackers. To ensure the robustness of protocol implementations, they must be able to accurately process and parse various network traffic, whether normal communication traffic or potential attack traffic.

[0003] Fuzzing, as an automated vulnerability discovery technique, discovers potential program errors by sending randomly generated test cases to the program under test and observing whether the program exhibits abnormal behavior. However, traditional fuzzing methods, relying on randomly generated test cases, often struggle to effectively uncover all vulnerabilities in a protocol implementation. This is because randomly generated test cases may not cover all states and behaviors of the protocol, leading to the omission of some vulnerabilities. To improve the effectiveness of fuzzing, researchers have proposed fuzzing methods based on state machine learning. The passive state machine learning scheme infers the protocol's state machine by analyzing pre-acquired traffic packets. However, the effectiveness of this method is highly dependent on the completeness and sufficiency of the input data packet sequence samples. If the sample set is insufficient, the inferred state machine may be incomplete or incorrect, and this method often fails for encrypted network protocols.

[0004] Therefore, how to accurately and completely construct a network protocol state machine for fuzz testing, so as to use the constructed network protocol state machine to efficiently and comprehensively perform fuzz testing on the network protocol, is an urgent technical problem to be solved. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a method for generating a state machine for a network protocol and a method for fuzz testing a network protocol, so as to accurately and completely construct a state machine for fuzz testing of the network protocol, and to use the constructed state machine to efficiently and comprehensively perform fuzz testing on the network protocol.

[0006] This invention provides a method for generating a state machine for a network protocol, which is applied to a state machine inference module and includes the following steps.

[0007] The process involves: acquiring information about the data packet type of the network protocol under test; constructing an abstract query data packet using a data packet template corresponding to the data packet type, and generating an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a general data representation language to describe its corresponding data packet structure; sending the abstract query data packet sequence to a mapping client to instruct the mapping client to generate a query data packet sequence consisting of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and sending the query data packet sequence to the system under test based on the network protocol under test; obtaining an abstract response data packet sequence from the mapping client, and constructing a target state machine of the network protocol under test based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm; wherein the abstract response data packet sequence is generated by the mapping client based on the response data packet sequence, and the response data packet sequence is generated by the system under test based on the query data packet sequence.

[0008] This invention provides a method for generating a state machine for a network protocol, applied to a mapping client, comprising the following steps.

[0009] An abstract query data packet sequence is obtained from the state machine inference module. This abstract query data packet sequence is constructed by the state machine inference module using a data packet template corresponding to the data packet type of the network protocol under test. The data packet template is generated using a general data representation language to describe its corresponding data packet structure. Based on the abstract query data packet sequence and its corresponding data packet template, a query data packet sequence composed of query data packets is generated. The query data packet sequence is sent to the system under test implemented based on the network protocol under test. From the system under test, a response data packet sequence generated by the system under test based on the query data packet sequence is obtained. An abstract response data packet sequence is generated based on the response data packet sequence and its corresponding data packet template. The abstract response data packet sequence is sent to the state machine inference module, so that the state machine inference module, based on the abstract query data packet sequence and the abstract response data packet sequence, constructs the target state machine of the network protocol under test using a preset active learning algorithm.

[0010] This invention provides a fuzz testing method for network protocols, applied to a fuzz testing module, comprising the following steps.

[0011] Obtain the target state machine of the network protocol to be tested; construct test abstract data packets according to the data packet template corresponding to each state in at least one state of the target state machine, and generate a test abstract data packet sequence; wherein, the data packet template is generated using a general data representation language to describe its corresponding data packet structure; send the test abstract data packet sequence to a mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence, and to use the data packet sequence to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested.

[0012] According to a fuzz testing method for a network protocol provided by the present invention, the step of constructing test abstract data packets and generating a test abstract data packet sequence based on data packet templates corresponding to each state in at least one state of the target state machine includes: determining a state path from the initial state to the target test state in the target state machine using a preset path search algorithm; constructing a preliminary abstract data packet sequence using data packet templates corresponding to each state other than the target test state in the state path; constructing a mutated abstract data packet based on the data packet templates corresponding to the target test state using a preset mutation algorithm; obtaining the test abstract data packet sequence based on the preliminary abstract data packet sequence and the mutated abstract data packet; and then using the test abstract data packet... The process of obtaining a test data packet sequence based on the test abstract data packet sequence, using the data packet template corresponding to each type of data packet in the packet sequence, includes: obtaining a pre-test data packet sequence based on the pre-test data packet sequence using the data packet template corresponding to each type of data packet in the pre-test abstract data packet sequence; obtaining a mutated test data packet based on the mutated abstract data packet using the data packet template corresponding to the mutated abstract data packet; and performing fuzz testing on the system under test based on the network protocol under test using the test data packet sequence, including: guiding the system under test to transition to the target test state using the pre-test data packet sequence; and performing fuzz testing on the system under test using the mutated test data packet.

[0013] This invention provides a fuzz testing method for network protocols, applied to a mapping client, comprising the following steps.

[0014] The system receives a sequence of abstract test data packets from a fuzzing module. This sequence is constructed by the fuzzing module based on a data packet template corresponding to at least one state of the target state machine of the network protocol under test. The data packet template is generated using a general data representation language to describe its corresponding data packet structure. Using the data packet template corresponding to each type of data packet in the abstract test data packet sequence, a sequence of data packets to be tested is obtained. The system under test, implemented based on the network protocol under test, is then fuzz-tested using this sequence of data packets.

[0015] According to a fuzz testing method for a network protocol provided by the present invention, the test abstract data packet sequence includes a preceding abstract data packet sequence and a mutated abstract data packet sequence; wherein, the preceding abstract data packet sequence is constructed by the fuzz testing module using data packet templates corresponding to each data packet in the state path, and the state path is the path from the initial state to the previous state of the target test state in the target state machine obtained by the fuzz testing module using a preset path search algorithm; the mutated abstract data packet is constructed by the fuzz testing module using a preset mutation algorithm based on the data packet template corresponding to the target test state; the method utilizes data corresponding to each type of data packet in the test abstract data packet sequence. The process of obtaining a test data packet sequence based on the test abstract data packet sequence includes: using the data packet template corresponding to each type of data packet in the pre-test abstract data packet sequence to obtain a pre-test data packet sequence; using the data packet template corresponding to the mutated abstract data packet to obtain a mutated test data packet; and using the test data packet sequence to perform fuzz testing on the system under test based on the network protocol under test, including: using the pre-test data packet sequence to guide the system under test to transition to the target test state; and using the mutated test data packet to perform fuzz testing on the system under test.

[0016] The present invention also provides a state machine generation device for a network protocol, which is disposed in the state machine inference module and includes the following modules: The system comprises the following modules: an acquisition module for acquiring information about the data packet type of the network protocol under test; a first construction module for constructing an abstract query data packet using a data packet template corresponding to the data packet type, generating an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a general data representation language to describe its corresponding data packet structure; a sending module for sending the abstract query data packet sequence to a mapping client, instructing the mapping client to generate a query data packet sequence consisting of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and to send the query data packet sequence to the system under test based on the network protocol under test; and a second construction module for acquiring an abstract response data packet sequence from the mapping client, and constructing a target state machine of the network protocol under test based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm; wherein the abstract response data packet sequence is generated by the mapping client based on the response data packet sequence, and the response data packet sequence is generated by the system under test based on the query data packet sequence.

[0017] The present invention also provides a fuzz testing device for network protocols, which is disposed in a fuzz testing module and includes the following modules: The acquisition module is used to acquire the target state machine of the network protocol to be tested; the construction module is used to construct test abstract data packets and generate a test abstract data packet sequence based on the data packet template corresponding to each state in at least one state of the target state machine; wherein, the data packet template is generated using a general data representation language to describe its corresponding data packet structure; the sending module is used to send the test abstract data packet sequence to the mapping client to instruct it to use the data packet template corresponding to each data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested based on the test abstract data packet sequence, and to use the data packet sequence to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested.

[0018] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement a fuzz testing method for any of the network protocols described above.

[0019] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a fuzzing method for any of the network protocols described above.

[0020] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements a fuzz testing method for any of the network protocols described above.

[0021] The network protocol state machine generation method provided by this invention utilizes a data packet template corresponding to a data packet type to construct an abstract query data packet, generating an abstract query data packet sequence composed of at least one abstract query data packet; the abstract query data packet sequence is sent to a mapping client to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and the query data packet sequence is sent to the system under test based on the network protocol to be tested; an abstract response data packet sequence is obtained from the mapping client, and based on the abstract query data packet sequence and the abstract response data packet sequence, a target state machine of the network protocol to be tested is constructed using a preset active learning algorithm.

[0022] By using packet templates, users can easily add, remove, or modify fields in the packets without modifying or refactoring the code, significantly improving the efficiency of fuzzing. Simultaneously, the state machine inference module uses the packet templates to generate query packet sequences, while the mapping client uses the same template to parse these sequences and generate the actual query packet sequences. This design effectively reduces the coupling between the state machine inference module and the mapping client, enhancing the modularity and maintainability of the fuzzing system. Furthermore, users only need to implement the session persistence code in the network protocol under test and save the global parameters of the new protocol session to uniformly construct packet templates, further simplifying the adaptation process for different protocols and improving the processing efficiency of fuzzing.

[0023] Constructing the target state machine of the network protocol under test using active learning algorithms can not only improve the efficiency and accuracy of state machine construction, but also enable the system to be adaptive, thereby better understanding and simulating the behavior of the network protocol under test.

[0024] Therefore, this invention can accurately and completely construct a network protocol state machine for fuzz testing, so as to efficiently and comprehensively perform fuzz testing on the network protocol using the constructed network protocol state machine. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0026] Figure 1This is one of the flowcharts illustrating the network protocol state machine generation method provided by the present invention.

[0027] Figure 2 This is the second flowchart illustrating the network protocol state machine generation method provided by the present invention.

[0028] Figure 3 This is one of the flowcharts illustrating the fuzz testing method for network protocols provided by this invention.

[0029] Figure 4 This is the second flowchart of the fuzz testing method for network protocols provided by this invention.

[0030] Figure 5 This is a schematic diagram illustrating the process of generating the target state machine and performing fuzz testing as provided by the present invention.

[0031] Figure 6 This is a schematic diagram illustrating the generation process of the target state machine by the state machine inference module provided by the present invention.

[0032] Figure 7 This is a schematic diagram illustrating the fuzz testing process performed by the fuzz testing module provided by this invention.

[0033] Figure 8 This is a schematic diagram of the character set provided by the invention.

[0034] Figure 9 This is a schematic diagram of the state machine generation device for network protocols provided by the present invention.

[0035] Figure 10 This is a schematic diagram of the structure of the fuzzy testing device for network protocols provided by the present invention.

[0036] Figure 11 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0038] The following is combined Figures 1-2 The state machine generation method of the present invention is described.

[0039] Figure 1 This is one of the flowcharts illustrating the network protocol state machine generation method provided by the present invention.

[0040] This method is applied to a state machine inference module. A state machine inference module is a software module or system component used to infer the state machine of the network protocol implementation under test.

[0041] like Figure 1 As shown, the method includes the following: Step 101: Obtain information about the data packet type of the network protocol to be tested.

[0042] The network protocols to be tested may include, but are not limited to: IKEv2 (Internet Key Exchange Version 2), TLS 1.3 (Transport Layer Security version 1.3), and SNMP (Simple Network Management Protocol).

[0043] For example only, IKEv2 packet types can include: packets in the IKE_SA_INIT exchange, packets in the IKE_AUTH exchange, packets in the CREATE_CHILD_SA exchange, and packets in the INFORMATIONAL exchange.

[0044] In the specific implementation process, a character set corresponding to each network protocol to be tested can be established, such as... Figure 8 As shown, the character set includes various strings, each of which (e.g., SA_Init_ACC) represents a packet type (e.g., IKE_SA_INIT) contained in the network protocol under test. The state machine inference module can obtain information about the packet types contained in the network protocol under test from the character set.

[0045] Step 102: Using the data packet template corresponding to the data packet type, construct an abstract query data packet and generate an abstract query data packet sequence consisting of at least one abstract query data packet.

[0046] Data packet templates are generated using a general data representation language and are used to describe the structure of their corresponding data packets. A data packet template defines the format and fields of its corresponding data packet type, the types of the fields, and the hierarchical relationships between the fields.

[0047] Abstract query packets are a data representation built upon packet templates, used to simulate packets in actual network protocols during state machine inference. They adhere to the definition of the corresponding packet template, including the packet format, fields, field types, and hierarchical relationships between fields.

[0048] The character set in step 101 can also store data packet templates corresponding to various data packet types, serving as a character-template mapping library.

[0049] Common data representation languages ​​may include, but are not limited to, XML and JSON.

[0050] As an example, a simple login protocol data packet, with its XML implementation template, is shown below: “ <loginrequest> <username> string< / username> <password> string< / password> < / loginrequest> ".

[0051] In practice, abstract query data packets can be constructed using the data packet templates corresponding to the data packet type.

[0052] As an example only, based on the data packet template in the example above, the following abstract query data packet can be constructed: “ <loginrequest> <username attr="’string’"> testUser< / username> <password attr="’string’"> testPassword123< / password> < / loginrequest> ".

[0053] Step 103: Send the abstract query data packet sequence to the mapping client to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and to send the query data packet sequence to the system under test based on the network protocol to be tested.

[0054] The mapping client is a processing device (e.g., a remote host) used to interact with the actual system under test.

[0055] For a detailed description of how the mapping client generates a sequence of query data packets based on an abstract query data packet sequence and its corresponding data packet template, see [link to documentation]. Figure 2 The relevant content will not be repeated here.

[0056] Step 104: Obtain the abstract response data packet sequence from the mapping client. Based on the abstract query data packet sequence and the abstract response data packet sequence, construct the target state machine of the network protocol to be tested using a preset active learning algorithm.

[0057] The target state machine is a state machine used for fuzz testing of network protocols on the system under test.

[0058] The abstract response packet sequence is generated by the mapping client based on the parsing of the response packet sequence, while the response packet sequence is generated by the system under test based on the query packet sequence.

[0059] The preset active learning algorithms may include, but are not limited to: L* algorithm, T* algorithm, RPNI algorithm, and ActiveLearning algorithm.

[0060] When using active learning algorithms to infer the target state machine, such as Figure 6 As shown, by using a mapping client as an intermediary to conduct black-box communication with the system under test, and guided by member queries and equivalence queries, the target state machine model is inferred and verified.

[0061] In some embodiments, the L* algorithm can be used to construct the target state machine of the network protocol under test based on the abstract query packet sequence and the abstract response packet sequence.

[0062] The L* algorithm aims to learn and construct a deterministic finite automaton (DFA) by alternating between membership queries and equivalence queries.

[0063] As an example only, we first create a hypothetical state machine, as in step 101, based on the character set corresponding to the network protocol under test (e.g., ...). Figure 8 As shown, a series of member query sequences (i.e., abstract query packet sequences) conforming to the hypothetical state machine are constructed. These sequences are then mapped by the client into actual transmittable packet sequences (i.e., query packet sequences), sent to the system under test, and the outputs of the system under test (i.e., response packet sequences) are collected as observations. If a discrepancy is found between the expected output sequence and the actual output sequence, the algorithm constructs a new hypothetical state machine based on these differences. On the other hand, equivalence queries are used to check whether the current hypothetical state machine and the reference state machine (which may be the initial state machine or the state machine in the previous iteration) have the same behavior on a given input. If their behaviors differ, the algorithm proposes a series of test sequences to distinguish them and adjusts the hypothetical state machine based on the results of these test sequences to more accurately match the behavior of the system under test. By continuously iterating this process, the algorithm can progressively improve and optimize the state machine model, finally obtaining the target state machine.

[0064] In practice, for equivalent queries, random generation algorithms can be used to generate query members, but this has limitations, such as the potential for generating duplicate sequences and low query efficiency. Therefore, it is necessary to prune invalid query sequences.

[0065] For protocols based on TCP connections, the preceding sequences that lead to TCP connection termination can be ignored to reduce the time spent in the equivalence lookup phase. However, for protocols involving session recovery, since the testing process involves the interruption and restoration of TCP connections, pruning cannot be performed solely through TCP connection detection. In this case, the character set provided to the state machine inference module needs to include not only the protocol's own packet types but also special characters to control the reconstruction of TCP connections, thereby testing the protocol's multi-session state machine.

[0066] For protocols based on UDP connections, the connectionless nature of UDP can lead to packet loss and unpredictable responses. Therefore, a timeout retransmission mechanism is needed to enhance robustness. If a timeout occurs during the inference process, the current data packet will be retransmitted several times until the upper limit is reached, at which point the test target is considered unresponsive.

[0067] Figure 2 This is the second flowchart illustrating the network protocol state machine generation method provided by the present invention.

[0068] This method is applied to a mapping client, which is middleware responsible for maintaining network sessions for the network protocol implementation under test. The mapping client receives abstract packet sequences from the state machine inference module and the fuzzing module, constructs these abstract packet sequences into concrete network packet sequences, and then forwards them to the system under test (SUT). Simultaneously, the mapping client is also responsible for receiving response packets from the SUT and parsing them. The mapping client does not directly construct protocol data packets through program code; instead, it constructs concrete data packets based on predefined data packet templates.

[0069] like Figure 2 As shown, the method includes the following: Step 201: Obtain the abstract query data packet sequence from the state machine inference module.

[0070] The abstract query packet sequence is constructed by the state machine inference module using packet templates corresponding to the packet types of the network protocol under test. The packet templates are generated using a general data representation language to describe their corresponding packet structures.

[0071] For a detailed description of the abstract query packet sequence and packet template, see [link to documentation]. Figure 1 The relevant content will not be repeated here.

[0072] Step 202: Based on the abstract query data packet sequence and its corresponding data packet template, generate a query data packet sequence composed of query data packets.

[0073] The process of generating a query packet sequence composed of query packets based on an abstract query packet sequence and its corresponding packet template is to transform the abstract query packet sequence represented by a general data representation language into a query packet sequence that can be used in a specific network protocol.

[0074] As an example only, suppose we consider an abstract query packet sequence that describes multiple query requests for a certain login function. This abstract query packet sequence is shown below: 1. Login request: <loginrequest> 2. Verification Request: <verifyrequest> 3. Session query: <sessionquery> The corresponding data packet template is as follows: 1. LoginRequest template: " <packettemplate name="LoginRequest"> <field name="Username" type="string" / > <field name="Password" type="string" / > < / packettemplate> ".

[0075] 2. VerifyRequest template: " <packettemplate name="VerifyRequest"> <field name="Token" type="string" / > < / packettemplate> ".

[0076] 3. SessionQuery template: " <packettemplate name="SessionQuery"> <field name="SessionID" type="string" / > < / packettemplate> ".

[0077] Based on the above data packet template and abstract query data packet sequence, a specific query data packet sequence can be generated. Assume the following specific field values: Username: testUser • Password: testPassword123 • Token: abc123 • Session ID: session001 Therefore, the generated query data packet sequence can be as follows: 1. LoginRequest data packet: " <loginrequest> <username attr="’string’"> testUser< / username> <password attr="’string’"> testPassword123< / password> < / loginrequest> ".

[0078] 2. VerifyRequest data packet: " <verifyrequest> <token attr="’string’"> abc123< / token> < / verifyrequest> ".

[0079] 3. SessionQuery data packet: " <sessionquery> <sessionid attr="’string’"> session001< / sessionid> < / sessionquery> ".

[0080] Step 203: Send the query data packet sequence to the system under test based on the network protocol to be tested.

[0081] Step 204: Obtain the response data packet sequence generated by the system under test based on the query data packet sequence from the system under test.

[0082] Step 205: Generate an abstract response data packet sequence based on the response data packet sequence parsing.

[0083] In practice, Scapy's packet parsing capabilities can be used to analyze the received response packet sequence and extract valid fields. Based on the extracted valid fields, a packet template can be filled to generate an abstract response packet sequence. Scapy is a powerful interactive packet processing program written in Python.

[0084] For details on the implementation process of this step, please refer to the relevant content in step 102, which will not be repeated here.

[0085] Step 206: Send the abstract response data packet sequence to the state machine inference module so that the state machine inference module can construct the target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm.

[0086] The following is combined Figures 3-4 The fuzzy measurement method of the present invention is described.

[0087] Figure 3 This is one of the flowcharts illustrating the fuzz testing method for network protocols provided by this invention.

[0088] This method is applied to a fuzz testing module, which is a software module or system component that generates an abstract test data packet represented by a data packet template based on a target state machine generated by a state machine inference module.

[0089] like Figure 3 As shown, the method includes the following: Step 301: Obtain the target state machine of the network protocol to be tested.

[0090] In the specific implementation process, such as Figure 5 As shown, the fuzzing module obtains the target state machine constructed by the active learning algorithm from the state machine inference module.

[0091] For a detailed description of the target state machine, see [link to relevant documentation]. Figure 1 The relevant content will not be repeated here.

[0092] Step 302: Based on the data packet template corresponding to each state in at least one state of the target state machine, construct a test abstract data packet and generate a test abstract data packet sequence.

[0093] For a detailed description of the data packet template and how to construct a test abstract data packet based on the data packet template, see [link to relevant documentation]. Figure 1 The relevant content will not be repeated here.

[0094] In some embodiments, a preset path search algorithm can be used to determine the state path from the initial state to the target test state in the target state machine; a preliminary abstract data packet sequence can be constructed using the data packet templates corresponding to each state other than the target test state in the state path; a preset mutation algorithm can be used to construct a mutated abstract data packet based on the data packet templates corresponding to the target test state; and a test abstract data packet sequence can be obtained based on the preliminary abstract data packet sequence and the mutated abstract data packet.

[0095] In the specific implementation process, there can be multiple state paths in the target state machine from the initial state to the target test state. One state path can be randomly selected, and a pre-abstract data packet sequence can be constructed based on this state path.

[0096] In the specific implementation process, an abstract data packet can be constructed based on the data packet template corresponding to the target test state; then, a preset mutation algorithm can be used to change the fields in the constructed abstract data packet to generate a mutated abstract data packet.

[0097] For example only, such as Figure 7 As shown, the state parser extracts the state paths (Path3:pkt1-pkt3) from the initial node of the state machine model (target state machine) to each state using a breadth-first search. The mutation generator selects fields for mutation based on the field type in the data packet template corresponding to the target test state (state pkt3), and generates the corresponding mutated abstract data packet based on the data packet template.

[0098] In a single round of testing, the state machine parser prioritizes the state with higher priority as the target test state. The priority is affected by factors such as the number of times the state is tested and the number of times an exception is triggered.

[0099] Step 303: Send the test abstract data packet sequence to the mapping client to instruct it to use the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the test data packet sequence and to use the test data packet sequence to perform fuzz testing on the system under test based on the network protocol under test.

[0100] In some embodiments, after sending the test abstract data packet sequence, composed of the pre-abstract data packet sequence and the mutated abstract data packet sequence, to the mapping client, the mapping client uses the data packet template corresponding to each type of data packet in the pre-abstract data packet sequence to obtain the pre-test data packet sequence based on the pre-abstract data packet sequence; uses the data packet template corresponding to the mutated abstract data packet to obtain the mutated test data packet based on the mutated abstract data packet; uses the pre-test data packet sequence to guide the system under test to transition to the target test state; and uses the mutated test data packet to perform fuzz testing on the system under test.

[0101] In the embodiments provided by the present invention, a pre-test data packet sequence and a variant test data packet can be constructed for different target test states, thereby enabling in-depth fuzz testing of each state of the system under test and discovering more hidden vulnerabilities.

[0102] Figure 4 This is the second flowchart of the fuzz testing method for network protocols provided by this invention, as shown below. Figure 4 As shown, this method is applied to a mapping client and includes the following: Step 401: Receive the test abstract data packet sequence from the fuzz testing module.

[0103] The test abstract data packet sequence is constructed by the fuzzing module based on the data packet template corresponding to each state in at least one state of the target state machine of the network protocol under test.

[0104] Step 402: Using the data packet template corresponding to each type of data packet in the test abstract data packet sequence, obtain the data packet sequence to be tested based on the test abstract data packet sequence.

[0105] A test packet sequence refers to a series of packets generated based on a test abstract packet sequence by converting each test abstract packet into a specific network packet format. These packets follow the structure and field definitions of the packet template corresponding to the test abstract packet, but contain actual data values ​​and are ready to be sent to the target protocol implementation (such as network devices or software) for testing.

[0106] In some embodiments, the test abstract data packet sequence includes a preceding abstract data packet sequence and a mutated abstract data packet sequence. The preceding abstract data packet sequence is constructed by the fuzzing module using data packet templates corresponding to each data packet in the state path. The state path is the path from the initial state to the previous state in the target state machine, obtained by the fuzzing module using a preset path search algorithm. The mutated abstract data packet sequence is constructed by the fuzzing module using a preset mutation algorithm based on the data packet template corresponding to the target test state. In this embodiment, the preceding test data packet sequence can be obtained using the data packet template corresponding to each type of data packet in the preceding abstract data packet sequence; and the mutated test data packet can be obtained using the data packet template corresponding to the mutated abstract data packet sequence.

[0107] In practice, for encryption and security fields involving the logic of the network protocol under test, the mapping client can call manually constructed protocol logic for separate processing to ensure the legitimacy of the test packet.

[0108] Step 403: Use the sequence of data packets to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested.

[0109] In some embodiments, the test data packet sequence includes a pre-test data packet sequence and a mutation test data packet. The pre-test data packet sequence is used to guide the system under test to transition to the target test state; the mutation test data packet is used to perform fuzz testing on the system under test.

[0110] In practice, after guiding the system under test to the target test state, multiple rounds of test data packets can be generated to continuously perform fuzz testing on the system. During this continuous fuzz testing, the system's status needs to be monitored to determine if any system vulnerabilities have been triggered. For completely black-box network protocol implementations under test, such as network devices, anomalies such as overall system shutdown or the shutdown of port services related to the protocol can be detected.

[0111] Furthermore, a single round of fuzzing simultaneously sends the specific message sequence to multiple systems under test and performs differential comparisons on the outputs of each system to determine if there are any security vulnerabilities that, while not directly triggering program crashes, violate semantic specifications. Such vulnerabilities are then monitored as anomalies. After each round of fuzzing, the system under test can be reset to its initial state to avoid impacting the next round of testing.

[0112] When a vulnerability is detected during fuzzing, the corresponding data packet can be parsed into the corresponding data packet template and updated in the character-template mapping library for the next round of testing by the state machine inference module.

[0113] The state machine generation apparatus for network protocols provided by the present invention is described below. The state machine generation apparatus for network protocols described below can be referred to in correspondence with the state machine generation method for network protocols described above.

[0114] Figure 9 This is a schematic diagram of the state machine generation device for network protocols provided by the present invention. Figure 9 As shown, the device 900 includes the following modules.

[0115] The acquisition module 910 is used to acquire information about the data packet type of the network protocol under test. The construction module 920 is used to construct an abstract query data packet using the data packet template corresponding to the data packet type, and generate an abstract query data packet sequence consisting of at least one abstract query data packet; wherein, the data packet template is generated using a general data representation language and is used to describe its corresponding data packet structure.

[0116] The sending module 930 is used to send the abstract query data packet sequence to the mapping client, so as to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and to send the query data packet sequence to the system under test based on the network protocol under test.

[0117] The parsing module 940 is used to obtain an abstract response data packet sequence from the mapping client, and construct a target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm; wherein, the abstract response data packet sequence is generated by the mapping client based on the response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence.

[0118] The fuzz testing apparatus for network protocols provided by the present invention will be described below. The fuzz testing apparatus for network protocols described below can be referred to in correspondence with the fuzz testing method for network protocols described above.

[0119] Figure 10 This is a schematic diagram of the structure of the fuzz testing device for network protocols provided by the present invention. Figure 10 As shown, the device 1000 includes the following modules.

[0120] The acquisition module 1010 is used to acquire the target state machine of the network protocol to be tested.

[0121] The construction module 1020 is used to construct a test abstract data packet and generate a test abstract data packet sequence based on the data packet template corresponding to each state in at least one state of the target state machine; wherein the data packet template is generated using a general data representation language and is used to describe its corresponding data packet structure.

[0122] The sending module 1030 is used to send the test abstract data packet sequence to the mapping client, so as to instruct the client to use the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the test data packet sequence according to the test abstract data packet sequence, and to use the test data packet sequence to perform fuzz testing on the system to be tested based on the network protocol to be tested.

[0123] Figure 11 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 11 As shown, the electronic device may include: a processor 1110, a communications interface 1120, a memory 1130, and a communication bus 1140, wherein the processor 1110, the communications interface 1120, and the memory 1130 communicate with each other through the communication bus 1140. Processor 1110 can call logic instructions in memory 1130 to execute a fuzz testing method for a network protocol. This method includes: acquiring information about the data packet type of the network protocol under test; constructing an abstract query data packet using a data packet template corresponding to the data packet type, generating an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a general data representation language to describe its corresponding data packet structure; sending the abstract query data packet sequence to a mapping client to instruct the mapping client to generate a query data packet sequence consisting of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and sending the query data packet sequence to the system under test implemented based on the network protocol under test; acquiring an abstract response data packet sequence from the mapping client, and constructing a target state machine of the network protocol under test based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm; wherein the abstract response data packet sequence is generated by the mapping client based on a response data packet sequence, and the response data packet sequence is generated by the system under test based on the query data packet sequence.

[0124] Furthermore, the logical instructions in the aforementioned memory 1130 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0125] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the fuzz testing method for the network protocol provided by the above methods. The method includes: obtaining information about the data packet type of the network protocol to be tested; constructing an abstract query data packet using a data packet template corresponding to the data packet type, and generating an abstract query data packet sequence composed of at least one abstract query data packet; wherein the data packet template is generated using a general data representation language to describe its corresponding data packet structure; sending the abstract query data packet sequence to a mapping client to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and sending the query data packet sequence to the system to be tested based on the network protocol to be tested; obtaining an abstract response data packet sequence from the mapping client, and constructing a target state machine of the network protocol to be tested using a preset active learning algorithm based on the abstract query data packet sequence and the abstract response data packet sequence; wherein the abstract response data packet sequence is generated by the mapping client based on the parsing of the response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence.

[0126] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a fuzz testing method for the network protocol provided by the above methods. The method includes: obtaining information about the data packet type of the network protocol to be tested; constructing an abstract query data packet using a data packet template corresponding to the data packet type, and generating an abstract query data packet sequence consisting of at least one abstract query data packet; wherein the data packet template is generated using a general data representation language to describe its corresponding data packet structure; sending the abstract query data packet sequence to a mapping client to instruct the mapping client to generate a query data packet sequence consisting of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and sending the query data packet sequence to a system to be tested based on the network protocol to be tested; obtaining an abstract response data packet sequence from the mapping client, and constructing a target state machine of the network protocol to be tested using a preset active learning algorithm based on the abstract query data packet sequence and the abstract response data packet sequence; wherein the abstract response data packet sequence is generated by the mapping client based on a response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence.

[0127] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0128] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.< / sessionquery> < / verifyrequest> < / loginrequest>

Claims

1. A method for generating a state machine for a network protocol, characterized in that, The method includes: The state machine inference module obtains information about the data packet type of the network protocol under test. The state machine inference module uses the data packet template corresponding to the data packet type to construct an abstract query data packet and generate an abstract query data packet sequence consisting of at least one abstract query data packet; wherein, the data packet template is generated using a general data representation language to describe its corresponding data packet structure; The state machine inference module sends the abstract query data packet sequence to the mapping client to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and to send the query data packet sequence to the system under test based on the network protocol under test. The state machine inference module obtains an abstract response data packet sequence from the mapping client, and constructs the target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm; wherein, the abstract response data packet sequence is generated by the mapping client based on the response data packet sequence, and the response data packet sequence is generated by the system to be tested based on the query data packet sequence; The fuzzing module, after acquiring the target state machine, constructs a test abstract data packet based on the data packet template corresponding to each of at least one state of the target state machine, generating a test abstract data packet sequence, including: Using a preset path search algorithm, determine the state path from the initial state to the target test state in the target state machine; Using the data packet templates corresponding to each state other than the target test state in the state path, a pre-abstract data packet sequence is constructed; Using a preset mutation algorithm, a mutated abstract data packet is constructed based on the data packet template corresponding to the target test state; The test abstract data packet sequence is obtained based on the preceding abstract data packet sequence and the mutated abstract data packet; The test abstract data packet sequence is sent to the mapping client to instruct it to use the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence, and to use the data packet sequence to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested.

2. A method for generating a state machine for a network protocol, characterized in that, The method includes: The mapping client obtains an abstract query data packet sequence from the state machine inference module; wherein, the abstract query data packet sequence is constructed by the state machine inference module using a data packet template corresponding to the data packet type of the network protocol under test; the data packet template is generated using a general data representation language to describe its corresponding data packet structure; The mapping client generates a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template; The mapping client sends the query data packet sequence to the system under test based on the network protocol under test; The mapping client obtains the response data packet sequence generated by the system under test based on the query data packet sequence from the system under test; The mapping client parses and generates an abstract response data packet sequence based on the response data packet sequence; The mapping client sends the abstract response data packet sequence to the state machine inference module, so that the state machine inference module can construct the target state machine of the network protocol to be tested based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm. The fuzzing module, after acquiring the target state machine, constructs a test abstract data packet based on the data packet template corresponding to each of at least one state of the target state machine, generating a test abstract data packet sequence, including: Using a preset path search algorithm, determine the state path from the initial state to the target test state in the target state machine; Using the data packet templates corresponding to each state other than the target test state in the state path, a pre-abstract data packet sequence is constructed; Using a preset mutation algorithm, a mutated abstract data packet is constructed based on the data packet template corresponding to the target test state; The test abstract data packet sequence is obtained based on the preceding abstract data packet sequence and the mutated abstract data packet; The test abstract data packet sequence is sent to the mapping client to instruct it to use the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence, and to use the data packet sequence to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested.

3. A fuzz testing method for a network protocol, characterized in that, Applied to a fuzz testing module, the method includes: Obtain the target state machine of the network protocol to be tested; Based on the data packet template corresponding to each state in at least one state of the target state machine, a test abstract data packet is constructed, and a test abstract data packet sequence is generated; wherein, the data packet template is generated using a general data representation language to describe its corresponding data packet structure; The test abstract data packet sequence is sent to the mapping client to instruct it to use the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence, and to use the data packet sequence to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested. The step of constructing a test abstract data packet and generating a test abstract data packet sequence based on the data packet template corresponding to each of at least one state of the target state machine includes: Using a preset path search algorithm, determine the state path from the initial state to the target test state in the target state machine; Using the data packet templates corresponding to each state other than the target test state in the state path, a pre-abstract data packet sequence is constructed; Using a preset mutation algorithm, a mutated abstract data packet is constructed based on the data packet template corresponding to the target test state; The test abstract data packet sequence is obtained based on the preceding abstract data packet sequence and the mutated abstract data packet.

4. The fuzz testing method for network protocols according to claim 3, characterized in that, The step of obtaining the test data packet sequence based on the data packet template corresponding to each type of data packet in the test abstract data packet sequence includes: Using the data packet template corresponding to each type of data packet in the aforementioned abstract data packet sequence, a preceding test data packet sequence is obtained based on the aforementioned abstract data packet sequence. Using the data packet template corresponding to the mutated abstract data packet, a mutated test data packet is obtained based on the mutated abstract data packet; The step of performing fuzz testing on the system under test based on the network protocol under test using the sequence of data packets to be tested includes: The pre-test data packet sequence is used to guide the system under test to transition its state to the target test state. The system under test is subjected to fuzz testing using a mutation test data package.

5. A fuzz testing method for a network protocol, characterized in that, The method includes: The mapping client receives a test abstract data packet sequence from the fuzzing module; wherein the test abstract data packet sequence is constructed by the fuzzing module based on a data packet template corresponding to each state in at least one state of the target state machine of the network protocol under test; wherein the data packet template is generated using a general data representation language to describe its corresponding data packet structure. The mapping client uses the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence; The mapping client uses the sequence of data packets to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested. The test abstract data packet sequence includes a preceding abstract data packet sequence and a mutated abstract data packet; The preceding abstract data packet sequence is constructed by the fuzzing module using the data packet templates corresponding to each data packet in the state path. The state path is the path from the initial state to the previous state of the target test state in the target state machine obtained by the fuzzing module using a preset path search algorithm. The mutated abstract data packet is constructed by the fuzzing module using a preset mutation algorithm based on the data packet template corresponding to the target test state.

6. The fuzz testing method for network protocols according to claim 5, characterized in that, The step of obtaining the test data packet sequence based on the data packet template corresponding to each type of data packet in the test abstract data packet sequence includes: Using the data packet template corresponding to each type of data packet in the aforementioned abstract data packet sequence, a preceding test data packet sequence is obtained based on the aforementioned abstract data packet sequence. Using the data packet template corresponding to the mutated abstract data packet, a mutated test data packet is obtained based on the mutated abstract data packet; The step of performing fuzz testing on the system under test based on the network protocol under test using the sequence of data packets to be tested includes: The pre-test data packet sequence is used to guide the system under test to transition its state to the target test state. The system under test is subjected to fuzz testing using a mutation test data package.

7. A state machine generation device for a network protocol, characterized in that, The device includes: The acquisition module is used to enable the state machine inference module to obtain information about the data packet type of the network protocol under test. The construction module enables the state machine inference module to construct an abstract query data packet using the data packet template corresponding to the data packet type, and generate an abstract query data packet sequence consisting of at least one abstract query data packet; wherein, the data packet template is generated using a general data representation language to describe its corresponding data packet structure; The sending module is used to enable the state machine inference module to send the abstract query data packet sequence to the mapping client, so as to instruct the mapping client to generate a query data packet sequence composed of query data packets based on the abstract query data packet sequence and its corresponding data packet template, and to send the query data packet sequence to the system under test based on the network protocol under test; The parsing module enables the state machine inference module to obtain an abstract response data packet sequence from the mapping client, and to construct the target state machine of the network protocol under test based on the abstract query data packet sequence and the abstract response data packet sequence using a preset active learning algorithm; wherein, the abstract response data packet sequence is generated by the mapping client based on the response data packet sequence, and the response data packet sequence is generated by the system under test based on the query data packet sequence; The fuzzing module, after acquiring the target state machine, constructs a test abstract data packet based on the data packet template corresponding to each of at least one state of the target state machine, generating a test abstract data packet sequence, including: Using a preset path search algorithm, determine the state path from the initial state to the target test state in the target state machine; Using the data packet templates corresponding to each state other than the target test state in the state path, a pre-abstract data packet sequence is constructed; Using a preset mutation algorithm, a mutated abstract data packet is constructed based on the data packet template corresponding to the target test state; The test abstract data packet sequence is obtained based on the preceding abstract data packet sequence and the mutated abstract data packet; The test abstract data packet sequence is sent to the mapping client to instruct it to use the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the data packet sequence to be tested according to the test abstract data packet sequence, and to use the data packet sequence to be tested to perform fuzz testing on the system to be tested based on the network protocol to be tested.

8. A fuzz testing device for a network protocol, characterized in that, The device, located in the fuzz testing module, includes: The acquisition module is used to acquire the target state machine of the network protocol to be tested. A construction module is used to construct test abstract data packets and generate a sequence of test abstract data packets based on the data packet template corresponding to each state in at least one state of the target state machine; wherein the data packet template is generated using a general data representation language to describe its corresponding data packet structure; The sending module is used to send the test abstract data packet sequence to the mapping client, so as to instruct the client to use the data packet template corresponding to each type of data packet in the test abstract data packet sequence to obtain the test data packet sequence according to the test abstract data packet sequence, and to use the test data packet sequence to perform fuzz testing on the system to be tested based on the network protocol to be tested; The step of constructing a test abstract data packet and generating a test abstract data packet sequence based on the data packet template corresponding to each of at least one state of the target state machine includes: Using a preset path search algorithm, determine the state path from the initial state to the target test state in the target state machine; Using the data packet templates corresponding to each state other than the target test state in the state path, a pre-abstract data packet sequence is constructed; Using a preset mutation algorithm, a mutated abstract data packet is constructed based on the data packet template corresponding to the target test state; The test abstract data packet sequence is obtained based on the preceding abstract data packet sequence and the mutated abstract data packet.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the state machine generation method of the network protocol as described in any one of claims 1 to 2, or the fuzz testing method of the network protocol as described in any one of claims 3 to 6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the state machine generation method of the network protocol as described in any one of claims 1 to 2, or the fuzz testing method of the network protocol as described in any one of claims 3 to 6.

Images