Fuzzy test monitoring method and product based on flow capture

Abstract

The invention provides a fuzzy test monitoring method and product based on flow capture, and relates to the field of fuzzy test. The method is applied to a traffic monitoring monitor, and comprises the following steps: filtering and capturing the traffic of a target network interface in real time, and generating a PCAP file containing a captured traffic data packet; decoding the content of the traffic data packet in the PCAP file to obtain a decoded traffic data packet; performing anomaly detection on the decoded traffic data packet, and generating an analysis report based on a detection result; and uploading the analysis report and the PCAP file to a fuzzy test system. Through the implementation of the fuzzy test monitoring method based on traffic capture, the specific network traffic packet message can be captured and analyzed in real time through the fuzzy test monitoring tool, and the fuzzy test efficiency is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of fuzz testing, and in particular to a fuzz testing monitoring method and product based on traffic capture. Background Art

[0002] Fuzz testing is a testing technology widely used in the field of software security. It inputs random data or data in unexpected formats into the system and observes the system's response to discover potential vulnerabilities or defects. It is particularly suitable for finding problems such as crashes, boundary errors, memory leaks, etc. in software or protocol implementations. It can effectively reveal the stability and security of the system under abnormal input. Therefore, fuzz testing has become a key means in software development and security testing.

[0003] At present, common fuzz testing tools mainly rely on log systems or external monitoring tools to capture and analyze abnormal data packets. Such tools are often unable to directly capture and analyze specific traffic packets in network transmission in real time, especially in a highly concurrent network environment, where data packet loss and analysis delays may occur. In addition, related monitoring tools such as PING monitors and TCP monitors used in fuzz testing systems can only report abnormal information during the test, but the corresponding messages in specific traffic packets cannot be written to the disk, making it impossible to conduct in-depth analysis of related abnormal information through messages, which leads to low efficiency of fuzz testing. Summary of the invention

[0004] The purpose of the present application is to provide a fuzz testing monitoring method, system, electronic device and storable medium based on traffic capture, which can at least solve the problem of low fuzz testing efficiency of fuzz testing monitoring tools in related technologies due to the difficulty in real-time capture and analysis of specific network traffic packets.

[0005] In order to solve the above technical problems, the first aspect of the embodiment of the present application provides a fuzzy test monitoring method based on traffic capture, which is applied to a traffic monitoring monitor, including:

[0006] Filter and capture the traffic of the target network interface in real time, and generate a PCAP file containing the captured traffic packets;

[0007] Decoding the content of the traffic data packet in the PCAP file to obtain a decoded traffic data packet;

[0008] Performing anomaly detection on the decoded traffic data packets and generating an analysis report based on the detection results;

[0009] The analysis report and the PCAP file are uploaded to the fuzz testing system.

[0010] A second aspect of an embodiment of the present application provides a flow monitoring monitor, which is applied to a fuzzy testing system, including:

[0011] Traffic storage module, used to filter and capture the traffic of the target network interface in real time, and generate a PCAP file containing the captured traffic data packets;

[0012] A traffic parsing module, used for decoding the content of the traffic data packet in the PCAP file to obtain a decoded traffic data packet;

[0013] A detection and analysis module performs anomaly detection on the decoded traffic data packets and generates an analysis report based on the detection results;

[0014] The uploading module is used to upload the analysis report and the PCAP file to the fuzz testing system.

[0015] The third aspect of the present application provides an electronic device, comprising: a memory and a processor, wherein the processor is used to execute a computer program stored in the memory, and when the processor executes the computer program, it implements each step of the fuzzy testing monitoring method based on traffic capture described in the first aspect of the embodiment of the present application.

[0016] The fourth aspect of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the fuzzy testing monitoring method based on traffic capture described in the first aspect of the embodiment of the present application are implemented.

[0017] As can be seen from the above, the embodiment of the present application first filters and captures the traffic of the target network interface in real time, and generates a PCAP file containing the captured traffic data packets, so that the messages in the target network interface traffic are captured in real time and stored on the disk, then, the content of the traffic data packets in the PCAP file is decoded to obtain the decoded traffic data packets, and the decoded traffic data packets contain the real-time messages in the target network traffic, and then the decoded traffic data packets are detected for abnormalities, and an analysis report is generated based on the detection results, so that the traffic monitoring monitor has the function of automatically identifying potential vulnerabilities such as protocol errors and data packet abnormalities, which can reduce manual intervention and thus improve the efficiency of fuzzy testing, and finally upload the analysis report and PCAP file to the fuzzy testing system for testers to conduct in-depth comparative analysis of fuzzy testing. Therefore, the fuzzy testing monitoring method and product based on traffic capture proposed by the present invention can capture and analyze specific network traffic packets in real time through fuzzy testing monitoring tools, effectively improving the efficiency of fuzzy testing.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the related technologies or the embodiments of the present application, the drawings required for use in the description of the related technologies or the embodiments of the present application will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, not all embodiments. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flow chart of a fuzzy testing monitoring method based on traffic capture provided in an embodiment of the present application;

[0021] Figure 2 A detailed flow chart of the fuzzy testing monitoring method based on traffic capture provided in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of a program module of a flow monitoring monitor provided in an embodiment of the present application;

[0023] Figure 4 A module block diagram of an electronic device provided in an embodiment of the present application;

[0024] Figure 5 A module block diagram of a computer-readable storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the present application more obvious and easy to understand, the present application will be clearly and completely described below in conjunction with the embodiments of the present application and the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. It should be understood that the various embodiments of the present application described below are only used to explain the present application and are not used to limit the present application, that is, based on the various embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present application. In addition, the technical features involved in the various embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.

[0026] See also Figure 1 , Figure 1 A flow chart of a fuzzy testing monitoring method based on traffic capture is provided in an embodiment of the present application. The fuzzy testing monitoring method based on traffic capture includes the following steps 101 to 104.

[0027] Step 101: Filter and capture the traffic of the target network interface in real time, and generate a PCAP file containing the captured traffic data packets.

[0028] First, we need to filter and capture the traffic of the specified network interface through the five-tuple during the fuzz testing process.

[0029] Specifically, a five-tuple is a set of five quantities: source IP address, destination IP address, source port, destination port, and transport layer protocol. For example, 192.168.1.1 10000 TCP 121.14.88.7680 constitutes a five-tuple, which means that a terminal with an IP address of 192.168.1.1 connects to a terminal with an IP address of 121.14.88.76 and a port of 80 through port 10000 and TCP protocol. The five-tuple can distinguish different sessions, and the corresponding sessions are unique.

[0030] Secondly, in fuzz testing, monitors such as PING monitors and TCP monitors can usually only report abnormal information when monitoring fuzz test anomalies, but the real-time messages cannot be saved to disk. Our traffic monitoring monitor can generate corresponding PCAP files based on captured messages and save them to disk without affecting other monitors. This PCAP file can be used for subsequent anomaly marking, later backtracking, and abnormal message analysis.

[0031] Specifically, Packet Capture is a network analysis tool, and PCAP is a data packet capture library. Many software use it as a data packet capture tool, such as WireShark, which also uses the PCAP library to capture data packets. The data packets captured by PCAP are not the original network byte streams, but are reassembled to form a new data format. It can record detailed information about network data packets, including source address, destination address, protocol type, data content, etc. Furthermore, PCAP files are commonly used datagram storage formats, which can be understood as a file format, but the data in them is stored in a specific format, so if you want to parse the data in them, you must also parse it in a certain format. Using a packet capture tool like WireShark, you can open PCAP files normally, and you can view the network datagrams in the PCAP files normally. At the same time, the WireShark packet capture tool can also generate files in this format.

[0032] Furthermore, in an embodiment of the present application, before the step of filtering and capturing the traffic of a specified network interface, it also includes: receiving a monitoring configuration file generated by a fuzzy testing system; parsing the monitoring configuration file to obtain monitoring configuration information; wherein the monitoring configuration information includes: the target network interface name, setting parameters of the BPF filter, the file size of the message in the traffic data packet, and abnormal message matching rules; initializing the monitoring task according to the monitoring configuration information; when the monitoring task is initialized, if a monitoring start instruction generated by the fuzzy testing system is received, the monitoring task is started.

[0033] Specifically, before the main fuzz test program starts, we will use the fuzz test system to configure the monitoring parameters, generate a corresponding monitoring configuration file, and then send it to the traffic monitoring monitor. The traffic monitoring monitor will then receive and parse the monitoring configuration file, initialize the monitoring task, and execute the monitoring task after the main fuzz test program starts. It is understandable that under normal circumstances we can indirectly configure the traffic monitoring monitor through the fuzz test system, but as long as the format of the monitoring configuration file is correct, we can also configure the traffic monitoring monitor in other ways, which is not specifically limited here.

[0034] In detail, the parameters in the monitoring configuration file include the target network interface name, anomaly matching rules, BPF filters, file size of the message, etc.

[0035] Target network interface name: In actual situations, a host may have multiple network cards, so it is necessary to capture the target network interface corresponding to the specified network card.

[0036] Exception matching rule: If the corresponding exception message is matched in the captured message, the exception can be reported later, which is equivalent to a filter.

[0037] BPF filter: There will be many messages in a network card, and you can set a filter to filter them. For example, to obtain only the response packets of HTTP and HTTPS servers, you can set it to tcp src port 80or src port 443.

[0038] File size of the message: This is to set the size of a single message, the interval of iteration, and after the monitor exception is reported, the corresponding PCAP file location can be found by the iteration number.

[0039] Furthermore, in an embodiment of the present application, it also includes: configuring a Bloom filter based on the configuration parameters carried in the abnormal message matching rules to obtain a preset algorithm model; performing anomaly detection on the decoded traffic data packet, including: performing anomaly detection on the decoded traffic data packet based on the preset algorithm model.

[0040] Specifically, after capturing the traffic data packets, the messages therein must be detected for anomalies. Therefore, when configuring the traffic monitoring monitor through the fuzzy testing system, the anomaly detection algorithm must also be configured and written into the monitoring configuration file. Our algorithm model is preset based on the Bloom filter principle. Bloom filter is a probabilistic data structure with extremely high space efficiency, which is mainly used to determine whether an element may belong to a certain set. Its basic principle is to use a bit array (Bitmap) and a set of hash functions to achieve fast and approximate existence queries.

[0041] In an embodiment of the present application, the traffic of the target network interface is filtered and captured, and a PCAP file containing traffic data packets is generated, including: filtering the traffic of the target network interface based on a BPF filter with preset filtering conditions; capturing traffic data packets that meet the filtering conditions from the target network interface; and generating a corresponding PCAP file based on the traffic data packets.

[0042] Specifically, since the network interface traffic will have a large number of messages, if we capture all the messages it will consume too many resources, so we need to use the BPF filter to perform a preliminary filtering of the interface traffic, for example, by setting it to only obtain the response packets of HTTP and HTTPS servers.

[0043] Step 102: Decode the content of the traffic data packet in the PCAP file to obtain a decoded traffic data packet.

[0044] In an embodiment of the present application, the content of the decoded traffic data packet includes a protocol type and a payload content.

[0045] Specifically, after capturing the interface traffic, the content of each data packet is decoded based on deep packet inspection technology. In addition to the address and port information, the protocol type and load content can also be obtained for subsequent anomaly detection.

[0046] In detail, Deep Packet Inspection (DPI) is an advanced network packet filtering technology that mainly plays a role in the application layer of the Open Systems Interconnection (OSI) reference model. It is used to inspect the data portion of the data packet (including its header) that passes through the detection point to search for protocols that do not match the specifications, viruses, spam, intrusions, etc., and decide whether the data packet can pass or needs to be routed to other destinations based on predetermined criteria. DPI technology not only checks the header information of the data packet (such as source address, destination address, port number and protocol type, etc.), but also deeply analyzes the payload of the data packet to identify specific applications, user behaviors, protocols, etc.

[0047] Step 103: Perform anomaly detection on the decoded traffic data packets and generate an analysis report based on the detection results.

[0048] In an embodiment of the present application, the content of the traffic data packet in the PCAP file includes an iteration number for indicating the current iteration number; generating an analysis report based on the detection result includes: if the detection result contains abnormal information, obtaining the iteration number corresponding to the abnormal information; writing the abnormal information and the corresponding iteration number into the analysis report; after the step of generating the analysis report based on the detection result, it also includes: marking the corresponding PCAP file according to the iteration number.

[0049] Specifically, after capturing the traffic data packets, we need to perform anomaly detection on the messages therein. When configuring the traffic monitoring monitor through the fuzzy testing system, we have already configured the anomaly detection algorithm and written it into the monitoring configuration file. Our algorithm model is preset based on the Bloom filter principle. Since we have previously decoded the data packets to obtain the protocol type and payload content, we can use the algorithm model to perform anomaly analysis on the protocol type and payload content. Through a large number of algorithms, we can automatically identify potential vulnerabilities and protocol anomalies, which can be more flexible and intelligent than traditional rule bases and reduce manual intervention.

[0050] Furthermore, the PCAP file also includes an iteration number indicating the current iteration number. When abnormal information is detected, the abnormal information is recorded according to the corresponding iteration number, written into the analysis report, and the corresponding PCAP file is marked to facilitate the tester to quickly find related files according to the iteration number when in-depth analysis is required, thereby improving the efficiency of fuzz testing.

[0051] Step 104: Upload the analysis report and PCAP file to the fuzz testing system.

[0052] It is understandable that a corresponding analysis report will be generated after the anomaly detection is completed. If an anomaly is detected, the corresponding anomaly information will be recorded in the analysis report, and the PCAP file will be marked accordingly. The analysis report and the PCAP file will then be uploaded to the fuzz testing system for subsequent analysis by the tester.

[0053] In an embodiment of the present application, it also includes: real-time monitoring of whether other monitors in the fuzzy testing system have discovered vulnerabilities; if it is monitored that other monitors in the fuzzy testing system have discovered vulnerabilities, marking the PCAP file corresponding to the vulnerability to obtain a vulnerability marked PCAP file; uploading the vulnerability marked PCAP file to the fuzzy testing system.

[0054] Specifically, since other monitors in the fuzz test system, such as the relevant PING monitor and TCP monitor, only have the function of detecting anomalies, but do not have the corresponding traffic disk, it is impossible to view real-time messages. Based on this, in addition to its own traffic capture, analysis and anomaly detection functions, the traffic monitoring monitor can also monitor in real time whether other monitors in the fuzz test system have found vulnerabilities. If a vulnerability is detected, the corresponding PCAP file will be marked to obtain a vulnerability marking PCAP file, which will be sent to the fuzz test system together with the analysis report later. In this way, without affecting other existing tools in the fuzz test system, the shortcomings of other monitors are made up, and traffic is recorded on the disk, which is convenient for subsequent analysis by testers.

[0055] It is understandable that the traffic monitoring monitor itself also marks the PCAP file generated by the abnormality, but it is distinguished from the vulnerability marking PCAP file here. In the end, two different types of PCAP files can be formed, or different markings can be made on the same PCAP file. This embodiment does not make specific restrictions here.

[0056] As can be seen from the above, the embodiment of the present application first filters and captures the traffic of the target network interface in real time, and generates a PCAP file containing the captured traffic data packets, so that the messages in the target network interface traffic are captured in real time and stored on the disk, then, the content of the traffic data packets in the PCAP file is decoded to obtain the decoded traffic data packets, and the decoded traffic data packets contain the real-time messages in the target network traffic, and then the decoded traffic data packets are detected for abnormalities, and an analysis report is generated based on the detection results, so that the traffic monitoring monitor has the function of automatically identifying potential vulnerabilities such as protocol errors and data packet abnormalities, which can reduce manual intervention and thus improve the efficiency of fuzzy testing, and finally upload the analysis report and PCAP file to the fuzzy testing system for testers to conduct in-depth comparative analysis of fuzzy testing. Therefore, the fuzzy testing monitoring method and product based on traffic capture proposed by the present invention can capture and analyze specific network traffic packets in real time through fuzzy testing monitoring tools, effectively improving the efficiency of fuzzy testing.

[0057] It should be understood that the size of the serial number of each step in this embodiment does not mean the order of execution of the steps. The execution order of each step should be determined by its function and internal logic, and should not constitute a sole limitation on the implementation process of the embodiment of this application.

[0058] In summary, the detailed process of the fuzzy test monitoring method based on traffic capture in the embodiment of the present application can be found in Figure 2 , specifically:

[0059] Step 201: receiving a monitoring configuration file generated by a fuzzy testing system, and parsing to obtain monitoring configuration information;

[0060] Step 202: configure a Bloom filter according to the monitoring configuration information, obtain a preset algorithm model, and initialize the monitoring task according to the monitoring configuration information;

[0061] Step 203: After receiving the monitoring start instruction generated by the fuzzy testing system, the BPF filter based on the preset filtering condition starts filtering the traffic of the target network interface;

[0062] Step 204: Capture traffic data packets that meet the filtering conditions from the target network interface, and generate corresponding PCAP files based on the traffic data packets;

[0063] Step 205: Decode the content of the traffic data packet in the PCAP file to obtain the protocol type and payload content in the traffic data packet;

[0064] Step 206: Perform anomaly detection on the protocol type and the load content based on a preset algorithm model;

[0065] Step 207: If the detection result contains abnormal information, the iteration number corresponding to the abnormal information is obtained, and the abnormal information and the corresponding iteration number are written into the analysis report, and the corresponding PCAP file is marked according to the iteration number;

[0066] Step 208: monitor in real time whether other monitors in the fuzzy test system have found a vulnerability. If it is detected that other monitors in the fuzzy test system have found a vulnerability, mark the PCAP file corresponding to the vulnerability to obtain a vulnerability mark PCAP file;

[0067] Step 209: Upload the analysis report, PCAP file and vulnerability marker PCAP file to the fuzz testing system.

[0068] For a more detailed process of each step in steps 201 to 209, please refer to the description of the relevant parts shown in the above text, and the embodiment of the present application will not be repeated here.

[0069] See also Figure 3 , Figure 3 A flow monitoring monitor provided in an embodiment of the present application. The device can be used to implement the fuzzy test monitoring method based on flow capture involved in an embodiment of the present application. The flow monitoring monitor 300 mainly includes:

[0070] The traffic storage module 301 is used to filter and capture the traffic of the target network interface in real time, and generate a PCAP file containing the captured traffic data packets;

[0071] Traffic parsing module 302, used to decode the content of the traffic data packet in the PCAP file to obtain a decoded traffic data packet;

[0072] The detection and analysis module 303 performs anomaly detection on the decoded traffic data packets and generates an analysis report based on the detection results;

[0073] The upload module 304 is used to upload the analysis report and PCAP file to the fuzz testing system.

[0074] In some implementations of this embodiment, the traffic monitoring monitor further includes: a monitoring configuration module. The monitoring configuration module is used to: receive a monitoring configuration file generated by a fuzzy test system; parse the monitoring configuration file to obtain monitoring configuration information; wherein the monitoring configuration information includes: the target network interface name, the setting parameters of the BPF filter, the file size of the message in the traffic data packet, and the abnormal message matching rules; initialize the monitoring task according to the monitoring configuration information; when the monitoring task is initialized, if a monitoring start instruction generated by the fuzzy test system is received, start executing the monitoring task.

[0075] Furthermore, in some implementations of the present embodiment, the monitoring configuration module is also specifically used to: configure the Bloom filter based on the configuration parameters carried in the abnormal message matching rules to obtain a preset algorithm model; when executing the function of performing anomaly detection on the decoded traffic data packet, it is specifically used to: perform anomaly detection on the decoded traffic data packet based on the preset algorithm model.

[0076] In some implementations of this embodiment, when the traffic disk module performs the function of filtering and capturing the traffic of the target network interface and generating a PCAP file containing traffic data packets, it is specifically used to: filter the traffic of the target network interface based on a BPF filter with preset filtering conditions; capture the traffic data packets that meet the filtering conditions from the target network interface; and generate a corresponding PCAP file based on the traffic data packets.

[0077] In some implementations of this embodiment, when the traffic parsing module performs the function of decoding the content of the traffic data packet in the PCAP file to obtain the decoded traffic data packet, the content of the decoded traffic data packet includes the protocol type and the load content.

[0078] Furthermore, in some implementations of the embodiments of the present application, when the traffic parsing module performs the function of decoding the content of the traffic data packet in the PCAP file to obtain the decoded traffic data packet, the content of the traffic data packet in the PCAP file includes an iteration number used to indicate the current iteration number; when the detection and analysis module performs the function of generating an analysis report based on the detection result, it is specifically used to: if the detection result contains abnormal information, obtain the iteration number corresponding to the abnormal information; write the abnormal information and the corresponding iteration number into the analysis report; after the detection and analysis module completes the function of generating an analysis report based on the detection result, it is also used to: mark the corresponding PCAP file according to the iteration number.

[0079] In some implementations of this embodiment, the traffic monitoring monitor further includes: a vulnerability monitoring and marking module. The vulnerability monitoring and marking module is used to: monitor in real time whether other monitors in the fuzzy testing system have found vulnerabilities; if it is detected that other monitors in the fuzzy testing system have found vulnerabilities, mark the PCAP file corresponding to the vulnerability to obtain a vulnerability marking PCAP file; and upload the vulnerability marking PCAP file to the fuzzy testing system.

[0080] In detail, each module in the flow monitoring monitor 300 provided in the embodiment of the present invention adopts the same Figure 1 The fuzzy testing monitoring method based on traffic capture has the same technical means and can produce the same technical effects, so it will not be repeated here.

[0081] See also Figure 4 , Figure 4 A module block diagram of an electronic device provided in an embodiment of the present application.

[0082] like Figure 4 As shown, an embodiment of the present application also provides an electronic device, which can be used to implement the fuzzy testing monitoring method based on traffic capture in the aforementioned embodiment, and includes a memory 401 and at least one processor 402; wherein the memory 401 is used to store at least one program, and when the at least one program is executed by at least one processor 402, the at least one processor 402 executes the fuzzy testing monitoring method based on traffic capture provided in the embodiment of the present application.

[0083] See also Figure 5 , Figure 5 A module block diagram of a computer-readable storage medium provided in an embodiment of the present application.

[0084] like Figure 5 As shown, an embodiment of the present application further provides a computer-readable storage medium 500, on which executable instructions 510 are stored. When the executable instructions 510 are executed, the fuzzy testing monitoring method based on traffic capture provided in the embodiment of the present application is executed.

[0085] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0086] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in this application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integration. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk), etc.

[0087] It should be noted that each embodiment in the present application is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For product-type embodiments, since they are similar to method-type embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method-type embodiments.

[0088] It should also be noted that, in the present application, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of further restrictions, the elements defined by the statement "comprise one..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements.

[0089] The above description of the disclosed embodiments enables professionals and technicians in the field to implement or use the present application. Various modifications to these embodiments will be apparent to professionals and technicians in the field, and the general principles defined in the present application can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown in the present application, but will conform to the widest range consistent with the principles and novel features disclosed in the present application.

Claims

1. A fuzzy testing monitoring method based on traffic capture, applied to a traffic monitoring monitor, characterized in that: include: Filter and capture the traffic of the target network interface in real time, and generate a PCAP file containing the captured traffic packets; Decoding the content of the traffic data packet in the PCAP file to obtain a decoded traffic data packet; Performing anomaly detection on the decoded traffic data packets and generating an analysis report based on the detection results; The analysis report and the PCAP file are uploaded to the fuzz testing system.

2. The fuzzy testing monitoring method based on traffic capture according to claim 1 is characterized in that: Before the step of filtering and capturing the traffic of the designated network interface, the method further includes: receiving a monitoring configuration file generated by a fuzz testing system; Parsing the monitoring configuration file to obtain monitoring configuration information; wherein the monitoring configuration information includes: a target network interface name, setting parameters of a BPF filter, a file size of a message in the traffic data packet, and an abnormal message matching rule; Initializing the monitoring task according to the monitoring configuration information; When the monitoring task is initialized, if a monitoring start instruction generated by the fuzzy testing system is received, the monitoring task is started to be executed.

3. The fuzzy testing monitoring method based on traffic capture according to claim 2 is characterized in that: Also includes: Configure a Bloom filter based on the configuration parameters carried in the abnormal message matching rule to obtain a preset algorithm model; The performing abnormality detection on the decoded traffic data packet includes: Anomaly detection is performed on the decoded traffic data packets based on a preset algorithm model.

4. The fuzzy testing monitoring method based on traffic capture according to claim 1 is characterized in that: The traffic of the target network interface is filtered and captured, and a PCAP file containing traffic data packets is generated, including: The BPF filter based on the preset filtering conditions filters the traffic of the target network interface; Capture traffic data packets that meet the filtering condition from the target network interface; A corresponding PCAP file is generated based on the traffic data packet.

5. The fuzzy testing monitoring method based on traffic capture according to claim 1 is characterized in that: The content of the decoded traffic data packet includes a protocol type and a payload content.

6. The fuzzy testing monitoring method based on traffic capture according to claim 5 is characterized in that: The content of the traffic data packet in the PCAP file includes an iteration number indicating the current iteration number; The generating of the analysis report based on the detection result includes: If the detection result contains abnormal information, obtaining the iteration number corresponding to the abnormal information; Writing the abnormal information and the corresponding iteration number into an analysis report; After the step of generating an analysis report based on the test results, the method further includes: The corresponding PCAP file is marked according to the iteration number.

7. The fuzzy testing monitoring method based on traffic capture according to claim 1 further comprises: Real-time monitoring of other monitors in the fuzz testing system to see if vulnerabilities are found; If it is detected that other monitors in the fuzzy testing system find a vulnerability, the PCAP file corresponding to the vulnerability is marked to obtain a vulnerability marked PCAP file; The vulnerability marking PCAP file is uploaded to the fuzzy testing system.

8. A flow monitoring monitor, applied to a fuzzy testing system, characterized in that: include: Traffic storage module, used to filter and capture the traffic of the target network interface in real time, and generate a PCAP file containing the captured traffic data packets; A traffic parsing module, used for decoding the content of the traffic data packet in the PCAP file to obtain a decoded traffic data packet; A detection and analysis module performs anomaly detection on the decoded traffic data packets and generates an analysis report based on the detection results; The uploading module is used to upload the analysis report and the PCAP file to the fuzz testing system.

9. An electronic device, characterized in that: The device comprises a memory and a processor, wherein: The processor is used to execute the computer program stored in the memory; When the processor executes the computer program, it implements the steps in the fuzzy testing monitoring method based on traffic capture as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the fuzzy testing monitoring method based on traffic capture described in any one of claims 1 to 7 are implemented.

Images