State variable-based double information perception network protocol fuzzing method and system

Abstract

The present application relates to the technical field of network protocol testing, in particular to a double information perception network protocol fuzzy testing method and system based on state variables, which performs static analysis on network protocol source code and identifies state variables in the source code; the change of network protocol state variables is tracked and detected by plugging the state variables, the process state in the network protocol is acquired, and a state machine is constructed according to the process state to map the state space and the code space; the key state of the network protocol is selected according to the state weight, the message pool of the key state is constructed, and the messages are selected, replaced and cross-compiled in the message pool according to the state and the message perception to obtain message variation, the message sequence for generating test cases is generated according to the message variation, and the key state of the network protocol is tested by using the test cases. The present application can obtain higher edge coverage, more crash triggers and faster first crash trigger, and has good application prospect.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network protocol testing, and particularly relates to a double information perception network protocol fuzzy testing method and system based on state variables. BACKGROUND

[0002] Vulnerability mining is a key means for detecting software security, and fuzzy testing is an important research direction in the field of vulnerability mining. Fuzzy testing uses random data as input to the target program to be tested, monitors program exceptions such as crashes and assertion failures, and then finds possible security vulnerabilities such as memory leaks. In recent years, with the proposal of gray-box fuzzy testing, a number of gray-box fuzzy testing tools represented by AFL have received more attention. In fact, since the proposal of fuzzy testing, it has been gradually widely applied to network protocol related testing and vulnerability mining. Traditional protocol fuzzy testing is performed by a black-box testing method, which does not require protocol program source code and only needs to test the network address and port number of the running protocol device. However, the lack of feedback information in the black-box fuzzy testing process leads to a relatively blind scheme, resulting in poor testing effect. The popular fuzzy testing tools are mainly gray-box fuzzy testing, which uses coverage information for feedback and introduces a genetic mutation algorithm, so that the code coverage in the test results and the final vulnerability mining effect are significantly improved. However, most existing gray-box fuzzy testing tools are directed at local programs and do not take into account the program state, so they cannot effectively test network protocols. Moreover, the mutation efficiency of related testing tools is low, and the message mutation scheme has deficiencies.

[0003] Due to the complexity of network protocol programs, existing protocol fuzzing tools cannot effectively explore the protocol state space. This involves the following three challenges: the first is that the existing gray box fuzzer is insufficient for the network protocol state representation scheme. Since the protocol itself has a state, the response to the same input will be different in different states, and only a certain state and specific message can trigger some vulnerabilities. Efficient network protocol gray box fuzzing not only needs to reasonably describe and express the state of the protocol itself, but also needs to pay attention to the transition of the program state. The lack of sensitivity to protocol state in the test scheme will also cause some problems in the information feedback, which may mislead the guidance direction of the genetic variation algorithm. The second is that the existing gray box fuzzer cannot focus on the key state. The scheduling of states and seeds is relatively independent. Not all seeds are equally important in the test process, and under the limitation of limited test time, an efficient scheme needs to be designed for seed scheduling to focus on the key state. Although some existing tools have taken the protocol state as important information, and combined with the coverage guided scheme to guide the fuzzing, but the two are not organically combined, and are still relatively independent without correlation analysis. Overall, the scheduling of seeds is in stages, and the selection process of seeds is after the selection of protocol states. Therefore, the exploration of key states needs to be considered, the expression of the state machine needs to be enhanced, and the information in the process needs to be fully utilized. The third is the message mutation problem. The existing mutation strategy is not sensitive to the structural and sequential nature of the message sequence. Due to the lack of specific messages, the protocol implementation program may not be able to continuously receive the generated message sequence. The protocol fuzzer generates more invalid messages, which greatly reduces the test efficiency. SUMMARY

[0004] To this end, the application provides a double information perception network protocol fuzzing method and system based on state variables, which solves the limitations of current fuzzing, such as inaccurate state representation, inability to test key states, and lack of effectiveness of mutation strategies. Through lightweight protocol program state representation, the disadvantage of obtaining a state that is too coarse-grained due to response codes is avoided, and the coverage of the highest abstraction layer of the protocol program is cooperatively linked, which can more effectively select states and message mutations, and improve the effect of network protocol fuzzing.

[0005] According to the design scheme provided by the application, on the one hand, a double information perception network protocol fuzzing method based on state variables is provided, which comprises:

[0006] performing static analysis on the network protocol source code and identifying state variables in the source code, the state variables being program variables representing the state of the network protocol;

[0007] Tracking and detecting changes of network protocol state variables by instrumenting state variables, obtaining process states in the network protocol according to the changes of the state variables, and constructing a state machine according to the process states to map the state space and the code space, wherein the process states are code state transitions according to the changes of the state variables;

[0008] Selecting key states of the network protocol according to state weights, constructing a message pool of the key states, and selecting and replacing messages in the message pool according to state and message awareness to cross-compile the messages to obtain message mutations, generating a message sequence for generating test cases according to the message mutations, and performing targeted testing on the key states of the network protocol using the test cases, wherein the message pool is all protocol message combinations that enable the network protocol entity program to reach the key states.

[0009] As the network protocol fuzzy testing method based on state variables and double information awareness of the application, further, the source code of the network protocol is statically analyzed, and state variables in the source code are identified, including:

[0010] The source code is statically analyzed, and the call stack backtracking information when the protocol source code reads messages is used to obtain an event processing loop.

[0011] The state variables in the source code are identified and labeled, and each state variable is assigned a unique string identifier, which is output in the form of a state list, wherein the state variables include: event processing loop program variables, program variables read / written in message processing functions, enumeration / integer global variables written by constants, and member variables in structures.

[0012] As the network protocol fuzzy testing method based on state variables and double information awareness of the application, further, the call stack backtracking information when the protocol source code reads messages is used to obtain an event processing loop, including:

[0013] Setting a breakpoint at a program input type system call;

[0014] In the network protocol service processing stage, if the breakpoint is triggered, the current protocol program function call stack information is used as auxiliary information for identifying the event processing loop, and all loop structures containing I / O operations are collected to establish a mapping relationship through the functions to which the loop structures belong.

[0015] Based on the stack backtracking information, all functions are matched in the mapping relationship layer by layer from the bottom function of the function call stack, and the loop structure contained in the first matched function is used as the event processing loop.

[0016] As the network protocol fuzzy testing method based on state variables and double information awareness of the application, further, the changes of network protocol state variables are tracked and detected by instrumenting state variables, including:

[0017] Patching the state variable write operation in the network protocol source code, mapping the write value of the state variable to the shared memory block of the fuzzy testing and the network protocol source code under test;

[0018] Performing XOR operation on the hash value of the state variable string identifier and the new value to be written, taking the XOR value as the index of updating the shared memory block, so as to record the state transition process of the network protocol state variable by using the change of the shared memory block.

[0019] As the network protocol fuzzy testing method based on the dual information perception of the state variable of the application, further, a state machine is constructed according to the process state, so as to map the state space and the code space, comprising:

[0020] A state machine is constructed according to the feedback code or the state variable, and the state machine is extended to a directed graph structure, and a state node is extended to a six-tuple representation, so as to establish the mapping relationship between the state space and the code space by using the directed graph structure;

[0021] Wherein, the directed graph structure is represented as <S,E,∑:S→{re_mes}>, S is a protocol state set, E is a state and a corresponding program variable set, ∑ is a mapping recording a message and a corresponding state, re_mes is a request message, and the six-tuple representation of the state node is

[0022] <depth,pnode,statetrans_paths,covered_bits,selscted_time,fuzzed_times>, depth represents the depth of the state node; pnode represents the forward state node of the state node; statetrans_paths represents the number of state transition paths explored at the current state; covered_bits represents the program bit map covered at the current state; selected_times represents the number of times the state is selected; and fuzzed_times represents the number of times the state is tested.

[0023] As the network protocol fuzzy testing method based on the dual information perception of the state variable of the application, further, the network protocol key state is selected according to the state weight, comprising:

[0024] The state weight is calculated according to the depth of the state node, the number of state transition paths explored at the current state, the program bit map covered at the current state, the number of times the state is selected, and the number of times the state is tested;

[0025] The state weight is taken as the probability of selecting the state, so as to obtain the network protocol key state for targeted testing in the best time.

[0026] As the state variable-based dual information perception network protocol fuzzy test method of the application, further, a message pool of key states is constructed, comprising:

[0027] A mutation message pool is constructed for each state, wherein the messages in the mutation message pool are high-value messages extracted from interesting message sequences generated under corresponding network protocol states, and the interesting message sequences are target messages identified according to state transition, code coverage and error handling times;

[0028] The message score is calculated according to the number of new states generated, the number of new branches triggered and the execution time, the messages with the message score are added to the message pool under the corresponding state, and the message pool of the corresponding key state used for mutation is obtained.

[0029] In another aspect, the application further provides a state variable-based dual information perception network protocol fuzzy test system, comprising a static analysis module, a state construction module and a targeted test module, wherein,

[0030] The static analysis module is used for static analysis of network protocol source code and identification of state variables in the source code, and the state variable is a program variable representing the state of the network protocol;

[0031] The state construction module is used for tracking and detecting changes of network protocol state variables by inserting a stake into the state variable, obtaining process states in the network protocol, and constructing a state machine according to the process states to map the state space and the code space, and the process state is a code state conversion according to the change of the state variable;

[0032] The targeted test module is used for selecting key states of the network protocol according to state weights, constructing a message pool of the key states, and selecting and replacing messages in the message pool according to state and message perception, and cross-compiling to obtain message mutation, generating a message sequence for generating test cases according to the message mutation, and using the test cases to perform targeted testing on the key states of the network protocol, and the message pool is all protocol message combinations that enable the network protocol entity program to reach the key states.

[0033] The application has the following beneficial effects:

[0034] The application obtains more process states by the state variables identified in the source code, can support manual annotation using API, thereby obtaining a more complete protocol representation scheme, and can customize the granularity of state representation, establish the mapping of state space and code space, fully associate the test process information, connect the protocol state and the code space, make the test process information more coordinated, fully obtain the available information, and lay a foundation data for state weight calculation and message pool construction; the state selection algorithm is realized by setting the weight for each state using the state and message aware mutation strategy, the message pool of the specific state is constructed to facilitate the subsequent message level mutation, the mutation position is limited, and a high-quality message sequence is generated to test the key state. Further experimental results show that, after the fuzzy testing of Tinydtls, ProFTPD and other protocol service programs, compared with AFLNet and NSFuzz, the tool ZFuzz in the embodiment can obtain higher edge coverage, more crash triggers and faster first crash trigger, has good feasibility and effectiveness, and has good application prospect in the field of network protocol testing. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 A dual information perception network protocol fuzzy testing process based on state variables in the embodiment is shown.

[0036] Figure 2 A test tool ZFuzz architecture in the embodiment is shown.

[0037] Figure 3 A mutation strategy 1 process in the embodiment is shown.

[0038] Figure 4 A mutation strategy 2 process in the embodiment is shown. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical scheme and advantages of the application more clear, specific and understandable, the application will be further described in detail below with reference to the drawings and technical scheme.

[0040] Network protocols are important components in network communication systems, support different entities to interact and communicate in the network, and their security is worth paying attention to and researching. Fuzzy testing is widely used in modern vulnerability mining work due to its high efficiency and low false positive rate, and has obtained more achievements in the field of software security. Existing fuzzy testing mainly targets local applications, and the research on fuzzy testing of network protocols is relatively less. Related fuzzers have some limitations, such as inaccurate state representation, inability to test key states, and lack of effectiveness of mutation strategies. Therefore, the embodiment of the application, as shown in Figure 1 The application provides a dual information perception network protocol fuzzy testing method based on state variables, which comprises:

[0041] S101, performing static analysis on network protocol source code, and identifying state variables in the source code, the state variables being program variables representing network protocol states.

[0042] Specifically, the source code can be statically analyzed, the event processing loop is obtained by using the call stack backtracking information when the protocol source code reads a message, the state variables in the source code are identified and labeled, and a unique string identifier is assigned to each state variable, which is output in the form of a state list, the state variables including: event processing loop program variables, program variables read / written in the message processing function, enumeration / integer global variables written by constants, and member variables in structures.

[0043] The protocol program has explicit stage characteristics during running. Taking a TCP-based server protocol program as an example, its life cycle is roughly divided into three stages: service initialization stage, service processing stage, and cleanup stage. Based on the research, most of the work is concentrated in the service processing stage, and the request message is processed and responded through network connection. In a specific protocol, the event processing loop is usually used in the processing stage. In the loop, the socket is used to read the request message, and the subsequent parsing and transaction processing are performed, and the response message is written into the socket for communication. The protocol service program communicates with the client by continuously executing the loop until the connection is disconnected.

[0044] For stateful protocol programs, state transitions are performed multiple times in the implementation of event processing. Through extensive analysis, developers use enumeration types or integer constants to identify protocol states when implementing protocol programs. In addition, such variables exist as global variables or structure member variables in protocol programs.

[0045] Therefore, these key variables in the protocol program can represent the protocol state. For example, when Bftpd receives a PASS request message, it will first determine whether the message can be processed under the current state. In the embodiment, only after the state check, the password field in the request message is taken as a parameter to call the processing function, otherwise an error response is returned directly. When the user completes the login and the password is correct, Bftpd will update the variable state, which is a global variable representing the state, and the updated variable is an enumeration type member variable. It is worth noting that this variable is always read or updated in the event processing loop. In addition, the scheme of using program variables to represent protocol states is more reasonable than using response codes. Bftpd returns a response code of 503 in different states, which cannot well represent the program process and distinguish states.

[0046] Therefore, the event processing loop is obtained by using the call stack backtracking information when the protocol source code reads a message, which can be designed to include:

[0047] Setting a breakpoint at the program input class system call;

[0048] In the network protocol service processing phase, if the breakpoint is triggered, the current protocol program function call stack information is used as auxiliary information to identify the event processing cycle; and all loop structures containing I / O operations are collected, and a mapping relationship is established through the loop structure belonging function;

[0049] Based on the stack backtracking information, all functions are matched in the mapping relationship from the bottom function of the function call stack layer by layer, and the loop structure contained in the first matched function is used as the event processing cycle.

[0050] In the process of identifying the event processing cycle, it is necessary to distinguish it from other network service program loops, and at the same time exclude the interference of nested loops in the event processing cycle. Therefore, the call stack backtracking information when the protocol program reads the message is used to identify the event processing cycle, and the event processing cycle identification algorithm is shown in Algorithm 1.

[0051] First, when the network protocol program is initialized and enters the service processing phase, a breakpoint is set at the input class system call in the program. When the subsequent message triggers the breakpoint, the current protocol program function call stack information is saved as auxiliary information for identifying the loop. In the identification process, all loop structures containing I / O operations are collected, and a mapping relationship is established with the function to which it belongs. Then, based on the stack backtracking information, all functions are matched in the mapping from the bottom function of the function call stack layer by layer, and the loop structure contained in the first matched function is used as the event processing cycle. This is because the call stack backtracking information only records the function calls in the service processing phase, which can avoid the interference of the initialization phase loop. Moreover, the function matching from bottom to top identifies the outermost loop, which excludes the influence of nested loops.

[0052]

[0053]

[0054] Because static analysis lacks runtime information of the program, there may be false positives in the state variable identification process. Based on the analysis of the protocol program, the characteristics of the state variable are summarized, and heuristic rules can be used to reduce false positives. The specific rules can be summarized as follows:

[0055] 1) The operation of the state variable in the protocol program is always performed in the event processing cycle, so only the program variables in the loop are analyzed to reduce false positives.

[0056] 2) The protocol state variable is read or written in the event processing cycle or the message processing function, so only the variables loaded and stored are recorded.

[0057] 3) Protocol state variables are usually global variables of enumeration type or integer type and member variables in structures, and are usually assigned as constants, so only enumeration or integer global variables written by constants and member variables in structures are retained.

[0058] After the identification of state variables is completed, a unique string identifier is assigned to each variable, and a list is output for subsequent tracking modules. However, for protocol programs developed based on the event notification library, the event processing loop is usually in the library function, so the scheme provides an auxiliary module for manual annotation. Key information is annotated using an annotation API, which can refine the identified state variables, implement state-sensitive operations of different granularities, and accurately annotate state variables based on protocol knowledge.

[0059] S102, by inserting the state variable to track and detect the change of the network protocol state variable, obtain the process state in the network protocol, and construct a state machine according to the process state to map the state space and the code space, the process state is the code state conversion according to the change of the state variable.

[0060] Specifically, by inserting the state variable to track and detect the change of the network protocol state variable, which can include:

[0061] The state variable write operation in the network protocol source code is inserted and processed, and the write value of the state variable is mapped to the shared memory block of the fuzzy test and the network protocol source code to be tested;

[0062] The hash value of the state variable string identifier and the new value to be written are executed by an exclusive OR operation, and the exclusive OR value is used as an index to update the shared memory block, so as to record the state transition process of the network protocol state variable by using the change of the shared memory block.

[0063] In order to make the value of the state variable can be real-time transmission to the fuzzy tester, in the compilation phase to the state variable write operation in the source code is inserted and processed, facilitate subsequent state collection. At the same time, the write value of the state variable is mapped to the shared memory of the fuzzy tester and the protocol program to be tested, and the shared memory block is recorded as share_state. The specific mapping calculation method can be expressed as follows:

[0064]

[0065] Wherein, var_id represents the string identification of the state variable, which is subsequently hashed. The hash value and the new value to be written are subjected to XOR operation, and the final XOR value is used as the index to update the shared memory block. At the same time, the index can be calculated according to the previous value of the state variable to recover the corresponding value in the shared memory. Different state variables will produce different hash values, which also correspond to different regions in the shared memory. Each time the value of the state variable changes, it will cause changes in the shared memory, thereby recording the more detailed state transition process of the protocol program. The instrumented program will be used as the final program for subsequent processing, building a state machine model and performing mutation operations.

[0066] In the process of building the state machine by the current gray-box fuzzer, a simple feedback code or an unprocessed program variable is usually used, which lacks association with the program code space. The two kinds of feedback information are relatively independent and cannot well guide the fuzzer together. In the embodiment, the state machine M is expanded in structure, and the mapping relationship between the state space and the program space of the protocol state machine is designed to increase more process information between states by using the fine-grained program state represented by the program variable.

[0067] Firstly, the state machine M is expanded into a directed graph structure <S, E, ∑: S→{re_mes}>, wherein ∑ is a mapping recording messages and corresponding states. If the program state is v before the re_mes is sent, the program variable var_id corresponding to the change will be added to S, v→var_id is added to E, and the mapping relationship is added to ∑. Secondly, the state node is expanded into <depth, pnode, statetrans_paths, covered_bits, selscted_time, fuzzed_times>. Wherein, depth∈N, representing the depth of the state; pnode∈S, representing the forward state node of the state; statetrans_paths∈N, representing the number of state transition paths explored at the state; covered_bits∈M, representing the program bitmap covered at the state, M being a two-dimensional matrix;

[0068] selected_times∈N, representing the number of times the state is selected; fuzzed_times∈N, representing the number of times the state is tested.

[0069] In the protocol state graph, the current state node v∈S has a depth denoted as the distance d(v,v0) to the entry node v0. Since state nodes with greater depth are more difficult to explore, the shared memory block `shared_state` is collected based on state variables. Each time the fuzzer receives instrumentation feedback from the protocol under test, it records the shared memory of the current program variables, performs a hash operation, and uses the hash value as the overall state representation of the current protocol program. Each hash value is placed in a queue. As request messages are continuously sent, a set of state sequences `state_sequence` is obtained after the test cases are executed. By comparing different state sequences, the state variable identifier `var_id` corresponding to the changed shared memory block `shared_state` is obtained. Then, the function `unique` is used to compare the number of different hash values, thus obtaining `statetrans_paths`, i.e., `unique(hash(var_id))`.

[0070] `statetrans_paths` refers to the number of state transition paths that can be discovered when a certain state `v` is selected. A larger value indicates a greater number of explorable transition paths for the current state. This suggests a stronger correlation between the state and other states, and also implies that the state is more important and deserves closer attention. `covered_bits` represents the edge coverage bitmap that can be reached when exploring the state; each state retains its own independent bitmap. During fuzz testing, the program coverage after the test cases are executed in each state is recorded, and the bitmap coverage is calculated for each node of the state machine. As testing progresses, the mapping between the protocol program space and the state space is continuously improved.

[0071] From the above, we can derive that for a known protocol state v, the number of covered bits that this state can trigger is [covered_bits]. A larger value indicates a larger corresponding program space and a greater exploration value for that state. By supplementing the values ​​with the number of times a state is selected (selected_times) and the number of times it is tested (fuzzed_times), we can balance state exploration and utilization, and conduct testing more rationally.

[0072] S103. Select key states of the network protocol based on state weights, construct a message pool for key states, and select, replace, and cross-compile messages in the message pool based on state and message awareness to obtain message mutations. Generate message sequences for generating test cases based on message mutations, so as to use test cases to perform targeted testing on key states of the network protocol. The message pool is a combination of all protocol messages that enable the network protocol entity program to reach the key states.

[0073] Specifically, selecting key states of the network protocol based on state weights can be designed to include:

[0074] The state weight is calculated according to the depth of the state node, the number of state transition paths explored in the current state, the program bitmap covered by the current state, the number of times the state is selected, and the number of times the state is tested;

[0075] The state weight is used as the probability of selecting the state to obtain the key state of the network protocol for targeted testing in the best time.

[0076] In order to find the key state, a weight calculation method for the state is designed, and a heuristic algorithm is used to assign energy to the key state. The weight calculation is based on the following understanding:

[0077] (1) The deeper the network communication level, the more difficult the code is to be tested. The state has a forward dependency, and as the communication degree deepens, the required message sequence is more difficult to construct, so it will lead to more difficult full testing and more likely to have more potential vulnerabilities.

[0078] (2) The state located in the key position of the state machine will be associated with more state transition paths, and exploring such states will be more likely to trigger unknown coverage.

[0079] (3) The larger the program space affected by the state, the more complex the function implemented. The broad program space and complex code implementation will increase the difficulty of full testing, so the attention degree should also be increased.

[0080] (4) In the process of exploring program states, new state exploration needs to be considered to avoid imperfect state machine structure.

[0081] Based on the above principles, for the state v i The calculation formula of the state weight can be expressed as:

[0082]

[0083] The calculated weight is used as the probability of selecting the state. The deeper the position of the state, the larger the associated path, and the larger the corresponding program space, the larger the weight value. At the same time, the state with more selection and testing times will be limited. In order to facilitate the calculation of the high order of selection time, the order is degraded.

[0084] The message pool for constructing the key state can include:

[0085] A mutation message pool is constructed for each state, wherein the messages in the mutation message pool are high-value messages extracted from the interesting message sequence generated from the corresponding network protocol state, and the interesting message sequence is the target message identified according to state transition, code coverage, and error handling times;

[0086] The messages with the message scores are added to the message pool in the corresponding state to obtain the message pool for mutation in the corresponding key state.

[0087] The message sequence and structure corresponding to the target state are not sensitive, and the effect is poor. In order to coordinate the protocol state and the message structure, a mutation message pool is constructed for each state. The messages in the message pool are a high-value message set extracted from the interesting message sequence generated in the corresponding state.

[0088] Specifically, in the fuzzy test process, the message sequence with promoted state transition, improved code coverage and less error handling times is identified as an interesting message sequence. Then, a classification algorithm is used to extract a message at a specific position, a score is calculated according to a message value formula, and the message with the score is added to the message pool in the corresponding state, thereby obtaining the message pool for mutation in the specific state.

[0089] Value=a*newState+b*newCovered+c*e-Time (4)

[0090] newState represents the number of new states generated, newCovered represents the number of new branches triggered, and Time represents the execution time. The weights a, b and c are in the set {x | 0≤x≤1}, and a+b+c=1. The values can be selected according to the required proportion, and the values can be a=0.4, b=0.3 and c=0.3.

[0091] For example Figure 2As shown, the scheme of the present case fuzzy testing tool ZFuzz mainly includes the identification and tracking of protocol state variables, the construction of protocol state mechanism, and the selection and seed mutation of state. In the protocol state variable identification and tracking part, the target program source code is processed through automatic analysis and manual annotation API to obtain the event handling loop and state variable list of the protocol program. In the variable tracking stage, the compilation and insertion engine will first analyze the manual annotation information and then generate corresponding information output, while the target program is inserted according to the state variable list. The fuzzy tester can get state feedback information and coverage feedback information during execution. In the protocol state mechanism construction part, the existing protocol gray box fuzzy testing tools usually only contain simple state information in the construction of protocol state machine model. For example, AFLNet uses the response code in the response message, and SGFuzz uses the enumerated type variable as the state variable but lacks filtering. As a result, the existing state machine has problems such as rough state, inaccurate representation, and only considering reachability. In the actual implementation of the state machine, no associated information with the protocol program space is involved, i.e., the program state and code coverage are independent of each other and lack of association and cooperation. Therefore, the state mechanism module is designed to expand the state machine structure, map the program space and state space, and cooperate with the protocol state variable to achieve more detailed state design and process information improvement. In the state and information perception mutation part, in the abstract layer of the protocol program, the upper layer area directly or indirectly affects the exploration of the lower layer area. In the protocol fuzzy testing process, the first thing to be considered is the reasonable state, and then the corresponding seed is scheduled. Therefore, the state selection algorithm is designed to calculate the weight of the protocol state and allocate energy to the key state using heuristic algorithm. Then, the message pool of interest is constructed for the specific state, the messages at specific positions are extracted according to the state and information perception scheme, and the messages are scored using the value evaluation formula to guide the subsequent seed mutation process.

[0092] To generate efficient message sequences, two new message-level mutation schemes are provided. Select and replace in the message pool in units of messages without destroying the structure of the message and the order of the message sequence.

[0093] Mutation strategy 1: Repeat, replace, and insert operations are performed on the messages in the mutation message pool corresponding to a specific state. Specifically, Figure 3 As shown, the high-value messages in the message pool of the target state S2 are selected to perform the mutation strategy.

[0094] Mutation strategy 2: Cross mutation. Specifically, Figure 4 As shown, two message sequences that can reach a specific state are selected, and cross mutation is performed on the infix messages as endpoints to obtain a new message sequence that can reach the target state.

[0095] Further, based on the above method, the embodiment of the application also provides a state variable-based double information perception network protocol fuzzy testing system, comprising a static analysis module, a state mechanism modeling module and a targeted testing module, wherein,

[0096] The static analysis module is used for static analysis on network protocol source code and identification of state variables in the source code, the state variables being program variables representing network protocol states;

[0097] The state mechanism modeling module is used for tracking and detecting changes of network protocol state variables by meansing of plugging in the state variables, obtaining process states in the network protocol, and constructing a state machine according to the process states to map state space and code space, the process states being code state transitions according to state variable changes;

[0098] The targeted testing module is used for selecting key states of the network protocol according to state weights, constructing a message pool of the key states, and selecting and replacing messages and cross-compiling the messages in the message pool according to state and message perception to obtain message mutations, generating a message sequence for generating test cases according to the message mutations, and performing targeted testing on the key states of the network protocol by using the test cases, the message pool being all protocol message combinations enabling the network protocol entity program to reach the key states.

[0099] To verify the effectiveness of the scheme, the following experimental data are used for further explanation and description:

[0100] Experiments are performed on a server with an Intel(R) CoreTM i7-8700 K@3.70GHz CPU and a memory size of 32 GB. Three indicators are proposed to test the performance of the tool, namely, throughput, code edge coverage quantity and crash triggering quantity. Widely used protocols are selected as benchmarks for testing, including RTSP, FTP and DTLS. The service implementation programs of these protocols have been selected by related fuzzy testing work and have been subjected to corresponding security analysis work. Table 1 shows the specific test program information.

[0101] Table 1 Test program information

[0102]

[0103] AFLNet and NSFuzz are used as benchmark programs to test the selected target protocol programs, obtain edge coverage information and evaluate the tool. The specific experiment uses the comparison tool and the tool ZFuzz in the embodiment of the application to perform 24h testing, collects code branch coverage conditions of the same protocol program to be tested, and Table 2 shows the final experimental results.

[0104] Table 2 Branch coverage

[0105] Target protocol program AFLNET NSFUZZ ZFuzz PureFTPD 983 1035 1152(17.19％、11.30％) ProFTPD 4650 4783 5182(11.44％、8.34％) Live555 2776 2803 2895(4.29％、3.28％) Exim 3588 3621 3770(5.07％、4.11％) Tinydtls 465 549 618(32.90％、12.57％)

[0106] From the table data, it can be seen that under the same test time and the same experimental environment, the scheme ZFuzz can obtain higher code coverage effect on all target programs. Code coverage is a common indicator of fuzz testing work, which can indicate how much code is explored in the test process. The higher the code coverage, the greater the probability of triggering a bug.

[0107] In addition to the commonly used code coverage as an indicator, the crash triggering situation can also directly reflect the bug mining effect of the tool. Tables 3 and 4 show the crash situation of the target protocol in the fuzz testing process, including the number of triggered crashes and the first triggering time. In dealing with the crash situation, the last instruction address of the crash is clustered, and then manually analyzed to determine the program bug. In the actual analysis process, the same bug may trigger a crash at different instruction addresses, so the number of crashes generated will be higher than the number of bugs.

[0108] Table 3 Crash triggering situation

[0109] Target protocol program AFLNET NSFUZZ ZFuzz Live555 4 4 6 Tinydtls 2 4 7

[0110] From the table, compared with the control tool, ZFuzz can trigger more crashes and cover the crashes triggered by other tools. Under the same target and environment, ZFuzz can obtain better results.

[0111] Table 4 First crash triggering time

[0112] Target protocol program AFLNET NSFUZZ ZFuzz Live555 756s 96s 20s Tinydtls 26s 5s <1s

[0113] In terms of the first triggering time of the crash, the tool in the scheme can trigger the crash faster. In particular, when testing the Tinydtls protocol program, it can trigger a crash in less than 1 second.

[0114] The above experiments can show that the ZFuzz tool in the scheme can discover more crashes and trigger crashes faster in the fuzz testing process, so it has better bug mining ability and overall better effectiveness.

[0115] Unless otherwise specified, the relative steps, numerical expressions and numerical values of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0116] The various embodiments are described in the specification in a progressive manner, each embodiment focusing on different aspects of the other embodiments, and the same or similar parts between the embodiments can be mutually referred to. For the system disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method.

[0117] The units and method steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been described in the above description in general terms. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation does not exceed the scope of the present application.

[0118] Those skilled in the art can understand that all or part of the steps in the above method can be instructed by a program to complete the relevant hardware, and the program can be stored in a computer readable storage medium, such as a read-only memory, a magnetic disk or an optical disk, etc. Alternatively, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiments can be implemented in the form of hardware or in the form of a software function module. The present application is not limited to any specific form of combination of hardware and software.

[0119] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present application, which are used to illustrate the technical solutions of the present application, and are not limiting. The protection scope of the present application is not limited thereto, although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily think of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed by the present application, or make equivalent replacements to some of the technical features; and these modifications, changes or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A state variable based dual information aware network protocol fuzzing method, characterized in that, Comprising: Performing static analysis on network protocol source code, and identifying state variables in the source code, the state variables being program variables representing network protocol states; Tracking and detecting changes in network protocol state variables by instrumenting state variables, obtaining process states in network protocols, constructing state machines according to feedback codes or state variables, and expanding state machines into directed graph structures, and expanding state nodes into six-tuple representations to establish a mapping relationship between state space and code space using directed graph structures, wherein the directed graph structure is represented as <S, E, ∑: S→{re_mes}>, S is a set of protocol states, E is a set of states and corresponding program variables, ∑ is a mapping recording messages and corresponding states, re_mes is a request message, and the six-tuple representation of the state node is <depth, pnode, statetrans_paths, covered_bits, selected_times, fuzzed_times>, depth represents the depth of the state node; pnode represents the forward state node of the state node; statetrans_paths represents the number of state transition paths explored at the current state; covered_bits represents the program bit map covered by the current state; selected_times represents the number of times the state is selected; and fuzzed_times represents the number of times the state is tested, the process state being a code state transition according to state variable changes; Calculating state weights according to the depth of the state node, the number of state transition paths explored at the current state, the program bit map covered by the current state, the number of times the state is selected, and the number of times the state is tested, using the state weight as the probability of the state being selected to obtain the key state of the network protocol for targeted testing in the best time, constructing a message pool of key states, and selecting and replacing messages and cross-compiling in the message pool according to state and message awareness to obtain message mutations, generating message sequences for generating test cases according to the message mutations, and using the test cases to perform targeted testing on the key state of the network protocol, the message pool being all protocol message combinations that enable the network protocol entity program to reach the key state.

2. The state variable based dual information aware network protocol fuzzing method of claim 1, wherein, Performing static analysis on network protocol source code, and identifying state variables in the source code, comprising: Performing static analysis on the source code, and obtaining event handling loops using call stack backtracking information when the protocol source code reads messages; Identifying and labeling state variables in the source code, and assigning each state variable a unique string identifier, and outputting in the form of a state list, the state variables including: event handling loop program variables, program variables read / written in message processing functions, enumeration / integer global variables written by constants, and member variables in structures.

3. The state variable based dual information aware network protocol fuzzing method of claim 2, wherein, Obtaining event handling loops using call stack backtracking information when the protocol source code reads messages, comprising: Setting a breakpoint at the program input class system call; In the network protocol service processing stage, if a breakpoint is triggered, the current protocol program function call stack information is taken as auxiliary information for identifying the event processing loop; All loop structures containing I / O operations are collected, and a mapping relationship is established between the loop structures and the functions to which the loop structures belong; Based on the stack backtracking information, all functions are matched in the mapping relationship from the bottom function of the function call stack layer by layer, and the first matched function containing the loop structure is taken as the event processing loop.

4. The state variable based dual information aware network protocol fuzzing method of claim 1, wherein, The state variable is tracked and detected by inserting a stake, including: The state variable write operation in the network protocol source code is inserted and handled, and the write value of the state variable is mapped to the shared memory block of the fuzzy test and the network protocol source code to be tested. The hash value of the state variable string identifier and the new value to be written are executed by XOR operation, and the XOR value is taken as the index of the updated shared memory block to record the state transition process of the network protocol state variable by using the change of the shared memory block.

5. The state variable based dual information aware network protocol fuzzing method of claim 1, wherein, A message pool of key states is constructed, including: A mutation message pool is constructed for each state, wherein the messages in the mutation message pool are high-value messages extracted from the interesting message sequence generated under the corresponding network protocol state, and the interesting message sequence is the target message identified according to state transition, code coverage and error handling times; The message score is calculated according to the number of new states, the number of triggered new branches and the execution time, and the message with the message score is added to the message pool under the corresponding state to obtain the message pool of the corresponding key state for mutation.

6. A state variable based dual information aware network protocol fuzzing system, comprising: The method of claim 1 is implemented, including a static analysis module, a state machine modeling module and a targeted test module, wherein The static analysis module is used to perform static analysis on the network protocol source code and identify the state variable in the source code, the state variable being a program variable representing the state of the network protocol; The state machine modeling module is used to track and detect the change of the network protocol state variable by inserting a stake, obtain the process state in the network protocol, and construct a state machine according to the process state to map the state space and the code space, the process state being a code state transition according to the state variable change; The targeted test module is used to select the key state of the network protocol according to the state weight, construct a message pool of the key state, and select and replace the message in the message pool according to the state and the message awareness, and cross-compile to obtain a message mutation, generate a message sequence for generating test cases according to the message mutation, and perform targeted testing on the key state of the network protocol using the test cases, the message pool being all protocol message combinations that enable the network protocol entity program to reach the key state.

7. An electronic device, comprising: It includes: At least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, which can be executed by the at least one processor to implement the method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, which when executed, can implement the method of any one of claims 1-5.

Images