Method and system for determining electric power industrial control firmware vulnerabilities based on fuzz testing

Abstract

The invention discloses an electric power industrial control firmware vulnerability determination method and system based on fuzzy testing. The method comprises the following steps: determining a to-be-tested electric power engineering firmware program; reading an initial input case in the seed pool; generating an initial missing branch in a missing branch pool by executing the initial input use case; in each loop iteration of the fuzzy test, performing dynamic scheduling on the initial branches in the initial missing branch pool, and taking the branch combination with the highest efficiency obtained at the current stage as a candidate branch set; obtaining each branch in the candidate branch set, a corresponding original seed and an input offset sequence; performing flow-sensitive fuzzy variation on each branch based on an original seed and an input offset sequence; and finding a new seed through the variation, performing dynamic execution analysis on the new seed, updating the initial missing branch pool according to an analysis result, and generating a vulnerability set of the to-be-tested electric power engineering firmware program. The problem of precision loss in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of automated testing, and in particular to a method and system for determining power industrial control firmware vulnerabilities based on fuzzy testing. Background Art

[0002] At present, fuzz testing, as a general software vulnerability mining technology, has the advantages of high automation, strong versatility, and high computing resource utilization, and has attracted extensive research in academia and industry. Fuzz testing can automatically or semi-automatically generate input cases and send them to the program. It guides the generation process of input cases by obtaining feedback information generated during the program's runtime, such as program branch coverage, and monitors program exceptions such as crashes and assertion failures to discover possible program errors such as memory access out-of-bounds and buffer overflows in the program. Since most code areas in the program under test may not contain vulnerabilities, traditional fuzz testing technology uses code coverage as the main indicator. Blindly improving code coverage methods are difficult to effectively mine vulnerabilities, so target-oriented fuzz testing has emerged. Before the fuzz testing process begins, directional fuzz testing marks the code lines that may have vulnerabilities in the program under test, and drives the fuzz testing to gradually cover the marked code lines and trigger vulnerabilities during the fuzz testing process, without wasting computing resources on code areas that are not related to vulnerabilities.

[0003] Existing fuzz testing work usually models the fuzz testing process as an optimization problem, maximizing code coverage through search-based solutions such as evolutionary algorithms. Although this solution has low computational overhead, it usually requires a large number of iterations to converge to the optimal solution, and it is difficult to make reasonable parameter adjustments. Summary of the invention

[0004] In view of the above technical problems, the present invention provides a method for determining power industrial control firmware vulnerabilities based on fuzzy testing, comprising:

[0005] Determine the power engineering firmware program to be tested;

[0006] Reading an initial input case in a seed pool, inputting the initial input case into a power engineering firmware program to be tested; generating an initial missing branch in a missing branch pool by executing the initial input case;

[0007] In each loop iteration of the fuzz test, the initial branches in the initial missed branch pool are dynamically scheduled, and the most efficient branch combination obtained in the current stage is used as a candidate branch set;

[0008] Obtaining the original seed and input offset sequence corresponding to each branch in the candidate branch set; performing flow-sensitive fuzzy mutation on each branch based on the original seed and input offset sequence;

[0009] New seeds are discovered through the fuzzy mutation, and dynamic execution analysis is performed on the new seeds. The initial missing branch pool is updated according to the analysis results to generate a vulnerability set of the power engineering firmware program to be tested.

[0010] Further, after the step of determining the power engineering firmware program to be tested, the method further includes:

[0011] During the compilation phase of the power engineering firmware program to be tested, obtaining the target point location information that triggers the vulnerability;

[0012] Calculate the distance between the basic block and the target point according to the target point position information;

[0013] Compile and insert the electric power engineering firmware program to be tested.

[0014] Further, by executing the initial input use case, generating an initial missing branch in the missing branch pool includes:

[0015] By executing the initial input use case, program branches that are not initially covered in the seed execution path are used as initial missing branches.

[0016] Furthermore, in each loop iteration of the fuzzy test, the initial branches in the initial missed branch pool are dynamically scheduled, and the most efficient branch combination obtained in the current stage is used as a candidate branch set, including:

[0017] Extracting test-related branch attributes from the initial branch, and designing branch features for marking the initial branch based on the branch attributes;

[0018] The branch scheduler performs branch scheduling according to the branch characteristics, and uses the most efficient branch combination obtained in the current stage as a candidate branch set.

[0019] Furthermore, the branch scheduler performs branch scheduling according to the branch characteristics, including:

[0020] Build a dynamic branch scheduling strategy based on particle swarm optimization algorithm;

[0021] The branch scheduler performs branch scheduling according to the dynamic branch scheduling strategy and the branch characteristics.

[0022] Furthermore, after the step of generating the vulnerability set of the power engineering firmware program to be tested, the method further includes:

[0023] After completing the fuzzy test of all branches in the candidate branch set, the parameter weights of the branch height controller are updated according to the profit information of this round of iteration, and a new round of loop iteration is started until the preset time ends.

[0024] The present invention also provides a system for determining power industrial control firmware vulnerabilities based on fuzzy testing, comprising:

[0025] A test program determination module, used to determine the power engineering firmware program to be tested;

[0026] An initial missing branch determination module is used to read an initial input case in a seed pool, input the initial input case into a power engineering firmware program to be tested, and generate an initial missing branch in a missing branch pool by executing the initial input case;

[0027] A candidate branch set determination module is used to dynamically schedule the initial branches in the initial missed branch pool in each loop iteration of the fuzzy test, and use the most efficient branch combination obtained in the current stage as the candidate branch set;

[0028] A fuzzy mutation module, used to obtain the original seed and input offset sequence corresponding to each branch in the candidate branch set; based on the original seed and input offset sequence, perform flow-sensitive fuzzy mutation on each branch;

[0029] An update module is used to discover new seeds through the fuzzy mutation, dynamically perform analysis on the new seeds, update the initial missing branch pool according to the analysis results, and generate a vulnerability set of the power engineering firmware program to be tested.

[0030] Furthermore, it also includes:

[0031] A location information acquisition submodule, used to acquire the location information of the target point that triggers the vulnerability during the compilation phase of the power engineering firmware program to be tested;

[0032] A distance calculation submodule, used for calculating the distance between the basic block and the target point according to the position information of the target point;

[0033] The compiling and plugging submodule is used to compile and plug the electric power engineering firmware program to be tested.

[0034] Furthermore, the candidate branch set determination module includes:

[0035] A branch property marking submodule, used for extracting branch properties related to the test from the initial branch, and designing branch properties for marking the initial branch based on the branch properties;

[0036] The candidate branch set determination submodule is used for the branch scheduler to perform branch scheduling according to the branch characteristics, and to take the branch combination with the highest efficiency obtained in the current stage as the candidate branch set.

[0037] Furthermore, the candidate branch set determines the submodule, including:

[0038] The scheduling strategy construction submodule is used to build a dynamic branch scheduling strategy based on the particle swarm optimization algorithm;

[0039] The branch scheduling submodule is used for the branch scheduler to perform branch scheduling according to the dynamic branch scheduling strategy and the branch characteristics.

[0040] The present invention provides a method and system for determining vulnerabilities in power industrial control firmware based on fuzzy testing, which uses omitted branches instead of seeds as the overall scheduling object of fuzzy testing, and saves fine-grained guidance information in the static analysis stage through omitted branches for further testing, thereby solving the problem of precision loss in traditional methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a flowchart of a method for determining a vulnerability of power industrial control firmware based on fuzzy testing provided by an embodiment of the present invention;

[0042] Figure 2 It is the DyFuzz system framework involved in the embodiment of the present invention;

[0043] Figure 3 is an example of a CVE vulnerability involved in an embodiment of the present invention;

[0044] Figure 4 It is a structural diagram of a system for determining power industrial control firmware vulnerabilities based on fuzzy testing provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] Many specific details are set forth in the following description to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present invention, so the present invention is not limited to the specific implementation disclosed below.

[0046] Example 1

[0047] Based on the problems existing in the existing directed fuzz testing work, the present invention proposes a method for determining the vulnerability of power industrial control firmware based on fuzz testing. The process is as follows: Figure 1 As shown, the following steps are included:

[0048] Step S101, determining the power engineering firmware program to be tested.

[0049] Step S102, reading an initial input use case in a seed pool, inputting the initial input use case into a power engineering firmware program to be tested; and generating an initial missing branch in a missing branch pool by executing the initial input use case.

[0050] Step S103, in each loop iteration of the fuzzy test, the initial branches in the initial missed branch pool are dynamically scheduled, and the branch combination with the highest efficiency obtained in the current stage is used as a candidate branch set.

[0051] Step S104, obtaining the original seed and input offset sequence corresponding to each branch in the candidate branch set; and performing flow-sensitive fuzzy mutation on each branch based on the original seed and input offset sequence.

[0052] Step S105, discovering new seeds through the fuzzy mutation, dynamically executing and analyzing the new seeds, updating the initial missing branch pool according to the analysis results, and generating a vulnerability set of the power engineering firmware program to be tested.

[0053] Further, after the step of determining the power engineering firmware program to be tested, the method further includes:

[0054] During the compilation phase of the power engineering firmware program to be tested, obtaining the target point location information that triggers the vulnerability;

[0055] Calculate the distance between the basic block and the target point according to the target point position information;

[0056] Compile and insert the electric power engineering firmware program to be tested.

[0057] Furthermore, by executing the initial input use case, program branches that are not initially covered in the seed execution path are taken as initial missing branches.

[0058] Further, extracting test-related branch attributes from the initial branch, and designing branch properties for marking the initial branch based on the branch attributes;

[0059] The branch scheduler performs branch scheduling according to the branch characteristics, and uses the most efficient branch combination obtained in the current stage as a candidate branch set.

[0060] Furthermore, a dynamic branch scheduling strategy is constructed based on the particle swarm optimization algorithm;

[0061] The branch scheduler performs branch scheduling according to the dynamic branch scheduling strategy and the branch characteristics.

[0062] After the step of generating the vulnerability set of the power engineering firmware program to be tested, the method further includes:

[0063] After completing the fuzzy test of all branches in the candidate branch set, the parameter weights of the branch height controller are updated according to the profit information of this round of iteration, and a new round of loop iteration is started until the preset time ends.

[0064] Example 2

[0065] In order to solve the problem of precision loss of guidance information in existing work, DyFuzz adds a missing branch pool to the fuzz testing process, and uses the missing branches as the object of overall fuzz testing scheduling to save the precise distance information at the basic block level provided in the compilation phase, and provide the original seed corresponding to the branch and the input offset sequence related to the branch constraint for fuzz testing, which is used to perform targeted mutations on the missing branches. At the same time, multiple test-related branch attributes are designed for the missing branches, and an adaptive branch scheduling strategy is customized based on the particle swarm optimization algorithm. The priority weights of branch attributes are dynamically calculated according to the real-time effectiveness of different branch attributes, so that the fuzz test can adjust the weights according to the real-time test benefit information at different stages of different tested programs to perform efficient targeted fuzz testing.

[0066] Figure 2 This is the overall system framework of DyFuzz:

[0067] Combine the following Figure 2 Briefly describe the workflow of DyFuzz:

[0068] Before the fuzz test process starts: in the compilation phase, the target point location information that may trigger the vulnerability is obtained, and the distance between all basic blocks and the target point is calculated based on the target point information. The calculation results are saved in BB_distance.txt and the program under test is compiled and instrumented. At the beginning of the fuzz test process: the fuzz test tool is initialized, the initial input case provided by the user is read, and the initial input case in the seed pool is dynamically analyzed. The analysis results are parsed to generate the initial missing branch information in the missing branch pool. In each iteration of the fuzz test cycle: the branch scheduler dynamically schedules the branches in the missing branch pool and obtains the branch combination that can achieve the maximum benefit in the current stage as the candidate branch set. For each branch in the candidate branch set, the original seed and the related input offset sequence corresponding to the branch are obtained, and the branch is subjected to flow-sensitive fuzzy mutation. Every time a new seed is found in the fuzz test process, it is dynamically analyzed, and the missing branch pool is updated using the analysis results. After completing the fuzz test of all branches in the candidate branch set, the parameter weight of the branch scheduler is updated according to the benefit information of this round of iteration, and a new round of loop iteration is started until the preset time ends.

[0069] (1) Missing branch pool

[0070] In the above problems, the distance-based directed fuzz testing method maintains information at the seed level, and there is no basic block-level information to guide seed scheduling, which results in that fuzz testing can only perform priority calculations based on the approximate relationship between the seed and the target point, and cannot effectively utilize the precise distance information obtained in the static analysis phase. Therefore, this paper proposes the concept of missed branches, defines the uncovered program branches in the seed execution path as missed branches, and uses missed branches as the basic unit of fuzz testing scheduling and guidance information calculation to ensure the accuracy of guidance information and improve the efficiency of the overall test.

[0071] a) Missing branches

[0072] DyFuzz considers uncovered branches adjacent to the execution path as missed branches. Take CVE-2021-37620 as an example. The vulnerability was discovered in Exiv2, a cross-platform C++ command-line tool for reading, writing, deleting, and modifying metadata of image files. Figure 3 (a) is the code snippet that triggers the vulnerability. When using the read() function starting from line 690 to read metadata, if the starting part of the parameter string buf is "type x", that is, an extra space is added to the left of the character x, the variable type in line 697 will be assigned a value of null. When reading type[0] in the if statement in line 699, the length of the type string is 0 and cannot be read through subscript 0, causing an out-of-bounds error, triggering CVE-2021-37620.

[0073] For the convenience of explanation, this section regards lines 696 to 703 as the same basic block, and marks the location where the CVE is triggered on line 699 as the target point. The CFG of the function body is as follows: Figure 3 (b) as shown:

[0074] in Figure 3 (b) The characters in the node, such as bb1:692, indicate that the basic block marked with bb1 represents Figure 3(a) The code starts at line 692. When the program enters the read() function, the control flow reaches the bb1 node. Only when the buf string satisfies the constraint at line 695 can the control flow enter the basic block starting at line 696 and cover the target point bb3. When the length of the buf string is less than 5, the constraint at line 695 is not satisfied, and the control flow jumps directly to the basic block starting at line 704, that is, the bb3 node. At this time, branch br2 = (bb1→bb2) is covered and branch br3 = (bb1→bb3) is not covered. Branch br3 is adjacent to the basic block bb1 that is covered during execution and is not covered, and is considered a missed branch by DyFuzz. DyFuzz is a seed s that can cover branch br2. i When performing dynamic execution analysis, br3 is recorded as a missed branch, and s i The original seed marked as found br3, the missed branches and the original seeds are saved in the missed branches pool for further processing.

[0075] b) Flow-sensitive variation

[0076] In traditional fuzz testing scenarios, given a seed s i exist Figure 3 The basic block coverage order in (b) is bb1→bb2, given by Figure 3 (a) shows that if s i If the constraint condition at line 695 is met, the target point at line 699 can be covered and the vulnerability is likely to be triggered. However, the fuzz testing tool under the original strategy cannot perceive bb1 which is closer to the target point bb3, and cannot make a targeted breakthrough on the constraint condition corresponding to branch br3=(bb1→bb3).

[0077] When DyFuzz performs dynamic execution analysis on the seed to collect missed branches, it uses DataFlowSanitizer to collect the input offset sequence related to the branch constraint. Figure 3 In line 690 of (a), the parameter buf of the read function is the program input. Then, while saving the missing branch br3, the relevant information of br3 is also saved, i.e., the original seed s i And the input offset sequence offs3 = [0-4], indicating that br3 and s i The execution paths of br3 are adjacent and br3 is related to the part with offset [0-4] in the program input. When fuzz testing br3, we only need to limit the search space of the mutation strategy to the part with offset [0-4] in the input for targeted fuzz testing, so that we can explore the branch where br3 is located more efficiently.

[0078] The overall update and maintenance process of the missing branch pool is shown in Algorithm 3.1:

[0079]

[0080] (2) Branch feature tag

[0081] In order to make the branch scheduler perform dynamic branch scheduling as expected, DyFuzz extracted 6 test-related branch attributes from the missing branches, and designed 9 branch features for marking the missing branches based on these branch attributes, indicating that the missing branches are higher or lower than most branches in the missing branch pool in this branch attribute, and used this branch feature in the branch scheduler for branch scheduling. The corresponding branch attributes and brief descriptions are shown in Table 2:

[0082] Table 2 Branch attribute table

[0083] property Property Description Branch Depth The distance between the branch and the main function entry basic block Constraint Length The total number of bytes in the input offset sequence corresponding to the branch Number of conditions The number of consecutive segments of the input offset sequence corresponding to the branch Vulnerability distance The distance between the branch and the target point Heat coefficient The number of seeds found in the test for the branch's original seed Cooling coefficient The original seed of the branch did not discover a new path in the test of n consecutive branches

[0084] When calculating the branch depth and vulnerability distance of the missed branch, DyFuzz takes the basic block pointed by the branch jump arrow as the endpoint of the distance calculation. i =(bb j →bb k ), then in calculating br i When the branch depth is , the main function entry basic block is used as the starting point, br i The successor basic block bb k This section further explains the branch attributes listed in Table 2:

[0085] Branch depth: The farther the missed branch is from the main function entry basic block in the program control flow graph, the more complex the branch constraints involved in its path, and the more difficult it is for fuzz testing to cover the branch. DyFuzz calculates the distance from the main function entry basic block to all basic blocks during the program compilation phase, and when collecting missed branches, saves the distance information maintained on the subsequent basic block of the missed branch into the missed branch structure as a measure of the branch depth of the missed branch.

[0086] Constraint length, number of conditions: DyFuzz performs dynamic execution analysis on seeds when it finds new seeds, collecting missing branches on the seed execution path and input offset sequences related to branch constraints. i The input offset sequence is offs i =[1-4,6-9], then the offset sequence corresponds to br iThe two sets of consecutive input offsets are related, that is, the constraint expression consists of more than two constraints combined by conditional connectors. At the same time, the total string length of the branch constraint is 8, which is used as the constraint length measure of the missing branch; and the number of consecutive strings of the branch constraint is 2, which is used as the condition number measure of the missing branch.

[0087] Vulnerability distance: Based on the strategy of AFLGo, DyFuzz calculates the distance from all basic blocks to the target point during the program compilation phase. When DyFuzz collects missed branches, it saves the target point distance information maintained on the subsequent basic block of the missed branch into the missed branch structure as the vulnerability distance metric of the missed branch.

[0088] Heat coefficient: When collecting missed branches, DyFuzz will save the original seed that discovered the branch and the pointer to the seed structure instance, and consider the validity of the original seed while measuring the validity of the missed branch. The more paths the original seed finds in the entire fuzz testing process, the greater the possibility of discovering new paths when fuzzing the seed, and the higher the heat coefficient of the missed branch. DyFuzz calculates the heat coefficient heatCoe of the missed branch through formula (3.1):

[0089]

[0090] Where Num s It represents the number of paths found by the seed in the entire test process, timeS represents the number of times the seed is used as the original seed for fuzzy testing, λ is a preset constant greater than 1, and λ=2 is usually taken according to the empirical value. The calculated heatCoe is used as the heat coefficient measurement of the missed branch.

[0091] Cooling coefficient: When a seed is used as the original seed for fuzz testing, if no new seeds or vulnerabilities are found after multiple fuzz testing iterations, it means that the seed’s ability to discover new paths is limited. The number of consecutive zero returns is used as the cooling coefficient measure of the missed branch.

[0092] After extracting the above six attributes from the missing branches, DyFuzz designed nine branch features, marked the branches with different features in the missing branch pool and used them for dynamic branch scheduling. The names and corresponding descriptions of the branch features are shown in Table 3:

[0093] Table 3 Branch characteristics table

[0094] Branch Features Branch feature description Depth The branch depth is deeper than most branches in the missing branch pool Shallow depth The branch depth is shallower than most branches in the missing branch pool Constraint length The constraint length is longer than most branches in the missing branch pool Short Constraint The constraint length is shorter than most branches in the missing branch pool Many conditions The number of conditions is greater than most branches in the missing branch pool Few conditions The number of conditions is less than most branches in the missing branch pool Vulnerability The vulnerability is closer than most branches in the missing branch pool High heat The heat coefficient is higher than most branches in the missing branch pool Short cooling The cooldown factor is lower than most branches in the missing branch pool

[0095] At the beginning of each fuzz testing iteration, DyFuzz counts the branch attribute data distribution of the overall missing branches in the missing branch pool to determine whether each branch is marked with these 9 features, where a single branch can be marked with multiple branch features. Considering the number of missing branches in large programs, sorting them in each fuzz testing iteration will incur a lot of computational overhead, seriously affecting the throughput of fuzz testing. In order to reduce the resource consumption of the marking process, DyFuzz maintains the maximum and minimum values ​​of each branch attribute during the fuzz testing process, and sets the marking thresholds for different branch features by adding an offset ratio.

[0096] In addition, during the testing process, this paper found that the front part of the missing branches with smaller subscripts in the missing branch pool will be densely marked by multiple branch features, resulting in the concentration of test resources on these branches. In order to avoid resource tilt caused by physical location factors, this section refers to the elevator scheduling algorithm. That is, a single pointer to the missing branch structure array is globally maintained. After the marking of the previous branch feature is completed, the pointer remains unchanged and continues to increment to find the next missing branch that meets the branch feature marking threshold until the pointer points to the empty node at the end of the array. At this time, the pointer is reset to point to the list head node and the branch feature marking continues.

[0097] The workflow of each branch feature marking is shown in Algorithm 3.2:

[0098]

[0099] (3) Dynamic branch scheduling

[0100] During the experiment, this paper found that after multiple rounds of fuzz testing iterations, the number of missing branches in the missing branch pool is usually 1 to 2 orders of magnitude more than the number of seeds in the seed pool. In order to reduce the computing resources wasted on low-quality branches during fuzz testing, and to dynamically adjust the weights according to the real-time effectiveness of different branch attributes, this paper designed a branch scheduler. Branch scheduling is performed before each round of fuzz testing iteration process. The most efficient branch combination in the current test environment is selected from a large number of branches in the missing branch pool as the candidate branch set, and only the missing branches in the candidate branch set are tested in this round of fuzz testing iteration.

[0101] Since the algorithm complexity of the particle swarm optimization algorithm is low during the iteration process and does not affect the throughput of the fuzz testing tool, MOPT and OTA use this algorithm for mutation strategy selection, demonstrating the effectiveness of the algorithm in fuzz testing scenarios. In order to enable the fuzz testing tool to select the branch with the highest current benefit for testing under different test environments, this paper customizes a dynamic branch scheduling strategy based on the particle swarm optimization algorithm, and dynamically adjusts the weight of branch characteristics in the branch scheduling process based on the historical benefit information during the test process. This section will first introduce the basic idea and iterative process of the particle swarm optimization algorithm, and further introduce the iterative optimization process of the branch scheduler in DyFuzz.

[0102] a) Particle Swarm Optimization Algorithm

[0103] This section introduces the basic concepts and iterative process of the particle swarm optimization algorithm. The particle swarm optimization algorithm is a simulation optimization algorithm that simulates the predation behavior of bird groups. The algorithm simulates the search process of each individual bird for the objective function to achieve the search for the global optimal solution.

[0104] The particle swarm optimization algorithm is also known as the bird flock foraging algorithm. Each individual bird represents a possible optimal solution. The entire bird flock will transmit information to each other during the foraging process. Each individual bird will record two optimal value information during the iteration process: the individual optimal solution (the location where the current individual bird finds the most food) and the group optimal solution (the location where the entire bird flock finds the most food). Each individual bird will update its current position based on these two optimal value information to approach the global optimal solution.

[0105] In the particle swarm algorithm, the i-th particle is included in the The position information P[i][j], i∈[1,m], j∈(1,∞) in the round iteration, where m is the number of particles in the particle swarm, and the fitness function F(x), are used to evaluate the quality of position x. Currently, position x1 is better than position x2 only when F(x1)>F(x2).

[0106] The two optimal value update processes are as follows:

[0107]

[0108] P global =MAX(P local [1]...P local [m]) (3.3)

[0109] Where Plocal[i] represents the individual optimal solution found by the i-th particle, which will save the explored position with the highest fitness during the iteration process. Pglobal represents the group optimal solution. After each round of iteration, Pglobal is assigned to the position with the highest fitness among the individual optimal solutions of all particles.

[0110] The update process for each individual particle is as follows:

[0111] v[i][j]=r×v[i][[j-1]+s×P local [i]+t×P global (3.4)

[0112] P[i][j]=P[i][j-1]+v[i][j] (3.5)

[0113] Where v[i][j] in equation (3.4) represents the position of the ith particle in the The velocity vector in the round iteration, the current velocity vector and the historical velocity vector, the individual optimal solution, and the group optimal solution are related. r, s, and t are the update weights of the related variables, which are fixed values ​​in the entire test process. Formula (3.5) updates the current position of the particle according to the velocity vector calculated in formula (3.4).

[0114] b) Dynamic branch scheduling based on particle swarm

[0115] DyFuzz assigns a pre-selected weight pw[i] to each branch feature described in Section (2), with an initial value of 20, which is used to calculate the proportion of the feature branch in the pre-selected branch set. For example, in the first round of fuzz testing iterations, the number of branches with deep deep markings nbr[i] is calculated by formula (3.6):

[0116]

[0117] Where pw[i] is the pre-selection weight of the deep feature, and N is the size of the candidate branch set. The pre-selection weight of each branch feature is updated based on the historical benefit information obtained by the feature branch during the fuzz testing process. DyFuzz iteratively adjusts each pre-selection weight based on the particle swarm optimization algorithm, where the pre-selection weight of each branch feature is regarded as a particle, and the group optimal solution Pglobal[i] of each branch feature is expressed as the proportion of the number of seeds found by the feature branch to the total number of seeds, as shown in formula (3.7):

[0118]

[0119] where fS global [i] is the number of seeds found during the entire fuzz testing process for this feature branch, fStotal is the total number of seeds found during the fuzz testing process. The individual optimal solution P for each branch feature local [i] represents the pre-selected weight value of the feature branch when the fitness value is the highest. The fitness function f(i) is calculated by formula (3.8):

[0120]

[0121] where fS round [i] is the number of seeds found in the current round for this feature branch, fC round [i] is the number of vulnerabilities found in the feature branch in the current round. α and β are the weights of the number of seeds and the number of vulnerabilities in the fitness function calculation. According to experience, α=1 and β=15 are usually taken.

[0122] The overall update process of the pre-selected weights is described as follows:

[0123] (1) After all branches in the candidate branch set have completed the test, the fitness value f(i) of each branch feature pre-selection weight pw[i] in this round of testing is calculated based on formula (3.8) and compared with the individual optimal solution P of the branch feature local [i] The corresponding fitness value is compared. If the current pre-selected weight value can obtain a higher fitness value, P local [i] is updated to pw[i].

[0124] (2) By counting the number of path discoveries and vulnerability discoveries of all feature branches in the entire fuzz testing process, the optimal group solution P for each branch feature is obtained based on formula (3.7) global [i] Update.

[0125] (3) After obtaining the individual optimal solution and group optimal solution of each branch feature, the pre-selected weight value of each branch feature is updated based on equations (3.9) and (3.10):

[0126] vw[i][j]=r×vw[i][j-1]+s×P local [i]+t×P global (3.9)

[0127] pw[i][j]=pw[i][j-1]+vw[i][j] (3.10)

[0128] (4) After calculating the pre-selection weights of all branch features in the new round of iteration, the proportion of each feature branch in the pre-selected branch set of the next round of iteration is calculated by formula (3.6). The branch scheduler selects the corresponding number of branches for each branch feature in the missed branch pool based on the distribution of the number and then starts a new round of fuzzy testing iteration.

[0129] Based on the same inventive concept, the present invention also provides a system 400 for determining power industrial control firmware vulnerabilities based on fuzzy testing, such as Figure 4 As shown, including:

[0130] A test program determination module 410 is used to determine the power engineering firmware program to be tested;

[0131] The initial missing branch determination module 420 is used to read the initial input use case in the seed pool, input the initial input use case into the power engineering firmware program to be tested; and generate the initial missing branch in the missing branch pool by executing the initial input use case;

[0132] A candidate branch set determination module 430 is used to dynamically schedule the initial branches in the initial missing branch pool in each loop iteration of the fuzzy test, and use the most efficient branch combination obtained in the current stage as the candidate branch set;

[0133] A fuzzy mutation module 440 is used to obtain the original seed and input offset sequence corresponding to each branch in the candidate branch set; based on the original seed and input offset sequence, perform flow-sensitive fuzzy mutation on each branch;

[0134] The update module 450 is used to discover new seeds through the fuzzy mutation, dynamically perform analysis on the new seeds, update the initial missing branch pool according to the analysis results, and generate a vulnerability set of the power engineering firmware program to be tested.

[0135] Furthermore, it also includes:

[0136] A location information acquisition submodule, used to acquire the location information of the target point that triggers the vulnerability during the compilation phase of the power engineering firmware program to be tested;

[0137] A distance calculation submodule, used for calculating the distance between the basic block and the target point according to the position information of the target point;

[0138] The compiling and plugging submodule is used to compile and plug the electric power engineering firmware program to be tested.

[0139] Furthermore, the candidate branch set determination module includes:

[0140] A branch property marking submodule, used for extracting branch properties related to the test from the initial branch, and designing branch properties for marking the initial branch based on the branch properties;

[0141] The candidate branch set determination submodule is used for the branch scheduler to perform branch scheduling according to the branch characteristics, and to take the branch combination with the highest efficiency obtained in the current stage as the candidate branch set.

[0142] Furthermore, the candidate branch set determines the submodule, including:

[0143] The scheduling strategy construction submodule is used to build a dynamic branch scheduling strategy based on the particle swarm optimization algorithm;

[0144] The branch scheduling submodule is used for the branch scheduler to perform branch scheduling according to the dynamic branch scheduling strategy and the branch characteristics.

[0145] The present invention provides a method and system for determining vulnerabilities in power industrial control firmware based on fuzzy testing, which uses omitted branches instead of seeds as the overall scheduling object of fuzzy testing, and saves fine-grained guidance information in the static analysis stage through omitted branches for further testing, thereby solving the problem of precision loss in traditional methods.

[0146] In addition, the present invention designs multiple test-related branch characteristics for missing branches, and customizes an adaptive branch scheduling strategy based on the particle swarm optimization algorithm, performs dynamic branch scheduling according to the real-time effectiveness of different branch characteristics, and improves the overall efficiency of directed fuzzy testing.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalents that do not depart from the spirit and scope of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for determining power industrial control firmware vulnerabilities based on fuzzy testing, characterized in that: include: Determine the power engineering firmware program to be tested; Reading an initial input case in a seed pool, inputting the initial input case into a power engineering firmware program to be tested; generating an initial missing branch in a missing branch pool by executing the initial input case; In each loop iteration of the fuzz test, the initial branches in the initial missed branch pool are dynamically scheduled, and the most efficient branch combination obtained in the current stage is used as a candidate branch set; Obtaining the original seed and input offset sequence corresponding to each branch in the candidate branch set; performing flow-sensitive fuzzy mutation on each branch based on the original seed and input offset sequence; New seeds are discovered through the fuzzy mutation, and dynamic execution analysis is performed on the new seeds. The initial missing branch pool is updated according to the analysis results to generate a vulnerability set of the power engineering firmware program to be tested.

2. The method according to claim 1, characterized in that After the step of determining the power engineering firmware program to be tested, it also includes: During the compilation phase of the power engineering firmware program to be tested, obtaining the target point location information that triggers the vulnerability; Calculate the distance between the basic block and the target point according to the target point position information; Compile and insert the electric power engineering firmware program to be tested.

3. The method according to claim 1, characterized in that By executing the initial input use case, an initial missing branch in the missing branch pool is generated, including: By executing the initial input use case, program branches that are not initially covered in the seed execution path are used as initial missing branches.

4. The method according to claim 1, characterized in that: In each loop iteration of the fuzz test, the initial branches in the initial missed branch pool are dynamically scheduled, and the most efficient branch combination obtained in the current stage is used as a candidate branch set, including: Extracting test-related branch attributes from the initial branch, and designing branch features for marking the initial branch based on the branch attributes; The branch scheduler performs branch scheduling according to the branch characteristics, and uses the most efficient branch combination obtained in the current stage as a candidate branch set.

5. The method according to claim 4, characterized in that The branch scheduler performs branch scheduling according to the branch characteristics, including: Build a dynamic branch scheduling strategy based on particle swarm optimization algorithm; The branch scheduler performs branch scheduling according to the dynamic branch scheduling strategy and the branch characteristics.

6. The method according to claim 1, characterized in that After the step of generating the vulnerability set of the power engineering firmware program to be tested, the method further includes: After completing the fuzzy test of all branches in the candidate branch set, the parameter weights of the branch height controller are updated according to the profit information of this round of iteration, and a new round of loop iteration is started until the preset time ends.

7. A system for determining power industrial control firmware vulnerabilities based on fuzzy testing, characterized in that: include: A test program determination module, used to determine the power engineering firmware program to be tested; An initial missing branch determination module is used to read an initial input case in a seed pool, input the initial input case into a power engineering firmware program to be tested, and generate an initial missing branch in a missing branch pool by executing the initial input case; A candidate branch set determination module is used to dynamically schedule the initial branches in the initial missed branch pool in each loop iteration of the fuzzy test, and use the most efficient branch combination obtained in the current stage as the candidate branch set; A fuzzy mutation module, used to obtain the original seed and input offset sequence corresponding to each branch in the candidate branch set; based on the original seed and input offset sequence, perform flow-sensitive fuzzy mutation on each branch; An update module is used to discover new seeds through the fuzzy mutation, dynamically perform analysis on the new seeds, update the initial missing branch pool according to the analysis results, and generate a vulnerability set of the power engineering firmware program to be tested.

8. The system according to claim 7, characterized in that Also includes: A location information acquisition submodule, used to acquire the location information of the target point that triggers the vulnerability during the compilation phase of the power engineering firmware program to be tested; A distance calculation submodule, used for calculating the distance between the basic block and the target point according to the position information of the target point; The compiling and plugging submodule is used to compile and plug the electric power engineering firmware program to be tested.

9. The system according to claim 7, characterized in that The candidate branch set determination module includes: A branch property marking submodule, used for extracting branch properties related to the test from the initial branch, and designing branch properties for marking the initial branch based on the branch properties; The candidate branch set determination submodule is used for the branch scheduler to perform branch scheduling according to the branch characteristics, and to take the branch combination with the highest efficiency obtained in the current stage as the candidate branch set.

10. The system according to claim 9, characterized in that The candidate branch set determines the submodule, including: The scheduling strategy construction submodule is used to build a dynamic branch scheduling strategy based on the particle swarm optimization algorithm; The branch scheduling submodule is used for the branch scheduler to perform branch scheduling according to the dynamic branch scheduling strategy and the branch characteristics.

Images