Network protocol fuzzing method and system based on protocol process state machine

Abstract

The present application relates to the technical field of network protocol testing, in particular to a network protocol fuzzy testing method and system based on a protocol process state machine, which performs static analysis on network protocol source code and identifies state variables in the source code; the change of network protocol state variables is tracked and detected by plugging the state variables, the process state in the network protocol is acquired, the protocol process state machine for mapping the protocol state space and the code space is constructed according to the process state, and the key state of the network protocol is selected and tested accordingly. The present application uses the state variables identified in the source code to obtain additional process states, establishes the mapping between the state space and the code space, constructs the protocol process state machine, and allocates weights to each state to realize the fuzzy testing of the key state, thus having a good application prospect in the field of network protocol testing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network protocol testing, in particular to a network protocol fuzzing method and system based on protocol process state machine. BACKGROUND

[0002] Network protocols are an important part of network communication systems, supporting the interaction and communication between different entities in the network. Their security deserves more attention and research. Vulnerability discovery is an important method for detecting software security problems, and the development of network protocol program vulnerability discovery technology has gone through many stages, from classic black-box fuzzing to feedback-based gray-box fuzzing, and then to hybrid testing technology combined with program analysis. Fuzzing is widely used in modern vulnerability discovery work for its high efficiency and low false positive rate, and has achieved remarkable results in the field of software security. Fuzzing involves introducing random input data into the target program and monitoring exceptions (such as crashes and assertion failures) to identify potential security vulnerabilities, including memory leaks. The earliest popular network protocol black-box fuzzing tools are Peach and Boofuzz, which require the specification of network protocol message formats and the design of test case generation strategies. With the development of intelligent feedback fuzzing, some gray-box fuzzing tools, such as AFL, have received more attention. For protocol fuzzing, the main method is to modify AFL to adapt to the interactive characteristics of network protocols, and to study general instrumentation techniques to adapt to AFL, with the typical tool being AFLNet.

[0003] However, most existing gray-box fuzzing tools still have deficiencies in protocol state representation schemes. AFLNet uses response codes in response messages to represent service states, but this method cannot produce completely reliable states. StateAFL uses memory information to represent the service state of the program, but directly mapping complex memory states to service states can cause problems. NSFuzz proposes a lightweight state representation scheme, but it does not link the state space to the code space. Although some existing tools have considered protocol states as important information, they lack organic integration of coverage-oriented strategies to guide fuzzing together, and remain relatively independent without relevant analysis, and cannot accurately represent protocol state tables and effectively test key states. SUMMARY

[0004] To this end, the present application provides a network protocol fuzzing method and system based on protocol process state machine, which solves the problems of inaccurate state representation and inability to test key states in current fuzzing, uses state variables identified in the source code to obtain additional process states, establishes a mapping between the state space and the code space, constructs a protocol process state machine, and assigns weights to each state to achieve fuzzing of key states.

[0005] According to the design scheme provided by the application, on one hand, a network protocol fuzzy testing method based on a protocol process state machine is provided, comprising:

[0006] The network protocol source code is statically analyzed, and a state variable in the source code is identified, the state variable being a program variable representing a network protocol state;

[0007] The state variable is instrumented to track and detect changes of the network protocol state variable, to obtain a process state in the network protocol, and to construct a protocol process state machine for mapping a protocol state space and a code space according to the process state, the process state being a code state transition according to the state variable change;

[0008] The network protocol key state is selected according to a protocol state weight, and the network protocol key state is tested.

[0009] As the network protocol fuzzy testing method based on the protocol process state machine, further, the network protocol source code is statically analyzed, and a state variable in the source code is identified, comprising:

[0010] The source code is statically analyzed, and an event processing loop is obtained by using call stack backtracking information when the protocol source code reads a message;

[0011] The state variable in the source code is identified and labeled, and a unique string identifier is assigned to each state variable, which is output in a state list form, the state variable including an event processing loop program variable, a program variable read / written in a message processing function, an enumeration / integer global variable written by a constant, and a member variable in a structure.

[0012] As the network protocol fuzzy testing method based on the protocol process state machine, further, the event processing loop is obtained by using the call stack backtracking information when the protocol source code reads the message, comprising:

[0013] A breakpoint is set at a program input type system call;

[0014] In a network protocol service processing stage, if the breakpoint is triggered, current protocol program function call stack information is taken as auxiliary information for identifying the event processing loop, and all loop structures containing I / O operations are collected, and a mapping relationship is established through a function to which the loop structure belongs;

[0015] Based on the stack backtracking information, all functions in the mapping relationship are matched layer by layer from a bottom function of the function call stack, and a loop structure contained in a first matched function is taken as the event processing loop.

[0016] As the network protocol fuzz testing method based on the protocol process state machine of the application, further, the change of the network protocol state variable is tracked and detected by means of the state variable insertion, containing:

[0017] The state variable write operation in the network protocol source code is inserted and processed, and the write value of the state variable is mapped to the shared memory block of the fuzz testing and the network protocol source code under test;

[0018] The hash value of the state variable string identifier and the new value to be written are executed by means of XOR operation, and the XOR value is used as the index of the updated shared memory block, so as to record the state transition process of the network protocol state variable by means of the change of the shared memory block.

[0019] As the network protocol fuzz testing method based on the protocol process state machine of the application, further, the state machine is constructed according to the process state, so as to map the state space and the code space, containing:

[0020] The state machine is constructed according to the feedback code or the state variable, and the state machine is expanded into a directed graph structure, and the state node is expanded into a six-tuple representation, so as to establish the mapping relationship between the state space and the code space by means of the directed graph structure;

[0021] Wherein, the directed graph structure is represented as <S,E,∑:S→{re_mes}>, S is a protocol state set, E is a state and a corresponding program variable set, ∑ is a mapping recording a message and a corresponding state, re_mes is a request message, and the six-tuple representation of the state node is <depth,pnode,statetrans_paths,covered_bits,selscted_time,fuzzed_times>, depth represents the depth of the state node; pnode represents the forward state node of the state node; statetrans_paths represents the number of state transition paths explored at the current state; covered_bits represents the program bit map covered at the current state; selected_times represents the number of times the state is selected; and fuzzed_times represents the number of times the state is tested.

[0022] As the network protocol fuzz testing method based on the protocol process state machine of the application, further, the network protocol key state is selected according to the state weight, containing:

[0023] The state weight is calculated according to the depth of the state node, the number of state transition paths explored at the current state, the program bit map covered at the current state, the number of times the state is selected, and the number of times the state is tested;

[0024] The state weight is used as the probability of the state being selected, and the network protocol key state is obtained according to the probability.

[0025] As the network protocol fuzz testing method based on the protocol process state machine of the application, further, the state weight is calculated, and the method further comprises:

[0026] The threshold values of the number of times of being selected and the number of times of being tested are set, and if the number of times of being selected and / or the number of times of being tested is greater than the threshold value, the state weight is set as a constant;

[0027] In the state weight calculation, if the data quantity value reaches a specified level, the values of the state node depth, the number of state transition paths explored in the current state, the number of times of being selected and the number of times of being tested are downgraded.

[0028] In another aspect, the application further provides a network protocol fuzz testing system based on a protocol process state machine, comprising a static analysis module, a plug-in tracking module, a state machine modeling module and a targeted testing module, wherein,

[0029] The static analysis module is used for performing static analysis on the network protocol source code and identifying state variables in the source code, the state variables being program variables representing the state of the network protocol;

[0030] The plug-in tracking module is used for tracking and detecting the changes of the network protocol state variables by plugging into the state variables to obtain the process state in the network protocol;

[0031] The state machine modeling module is used for constructing a protocol process state machine for mapping the protocol state space and the code space according to the process state, the process state being a code state conversion according to the changes of the state variables;

[0032] The targeted testing module is used for selecting the key states of the network protocol according to the protocol state weight and performing targeted testing on the key states of the network protocol.

[0033] The application has the following beneficial effects:

[0034] The application can obtain the event processing cycle and the state variables by performing static analysis on the protocol program source code, can derive a more fine-grained state representation scheme, can detect the state variables to track their subsequent changes, can obtain detailed protocol state and inter-process information by tracking the state variables, can construct a protocol process state machine integrating the state space and the code space, can integrate the state space and the code space to effectively guide the fuzz testing process together, and can assign weights to the states to select the key states and perform targeted fuzz testing, thus having a good application prospect in the field of network protocol testing. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 It is a network protocol fuzz testing flowchart based on the protocol process state machine in the embodiment.

[0036] Figure 2 Fig. 1 shows a schematic diagram of a test tool architecture in the embodiments. DETAILED DESCRIPTION

[0037] In order to make the objects, technical solutions and advantages of the present application clearer and more apparent, the present application will be further described in detail below with reference to the drawings and technical solutions.

[0038] Network protocols are important components in network communication systems, supporting different entities to interact and communicate in the network, and their security is worth paying attention to and studying. Fuzz testing is widely used in modern vulnerability mining work due to its high efficiency and low false positive rate, and has achieved more results in the field of software security. Existing fuzz testing has problems such as inaccurate state representation and inability to test key states. Therefore, the embodiments of the present application, as shown in Figure 1 provide a network protocol fuzz testing method based on protocol process state machine, which includes:

[0039] S101, static analysis is performed on the network protocol source code, and state variables in the source code are identified, the state variables being program variables representing the state of the network protocol.

[0040] Specifically, the source code can be statically analyzed, the event processing loop is obtained by using the call stack backtracking information when the protocol source code reads the message, the state variables in the source code are identified and labeled, and each state variable is assigned a unique string identifier, which is output in the form of a state list, the state variables including: event processing loop program variables, program variables read / written in the message processing function, enumeration / integer global variables written by constants, and member variables in the structure.

[0041] Protocol programs have explicit stage characteristics in the running process. Taking a TCP-based server protocol program as an example, its life cycle is roughly divided into three stages: service initialization stage, service processing stage, and cleanup stage. Based on the research, most of the work is concentrated in the service processing stage, and the request message is processed and responded through network connection. In a specific protocol, the event processing loop is usually used in the processing stage. In the loop, the socket is used to read the request message, and the subsequent parsing and transaction processing are performed, and the response message is written into the socket for communication. The protocol service program communicates with the client by continuously executing the loop until the connection is disconnected.

[0042] For stateful protocol programs, state transitions are performed multiple times in the implementation of event processing. Through extensive analysis, developers use enumeration types or integer constants to identify protocol states when implementing protocol programs. In addition, such variables exist as global variables or structure member variables in the protocol program.

[0043] Therefore, these key variables in the protocol procedure can represent the protocol state. For example, when Bftpd receives a PASS request message, it will first determine whether the message can be processed in the current state. In the embodiment, only after the state check, the password field in the request message is taken as a parameter to call the processing function, otherwise an error response will be returned directly. When the user completes the login and the password is correct, Bftpd will update the variable state, which is a global variable representing the state, and the updated variable is a member variable of the enumeration type. It is worth noting that the variable is always read or updated in the event processing loop. In addition, the scheme of using program variables to represent the protocol state is more reasonable than using response codes. Bftpd returns the response code 503 in different states, which cannot well represent the program process and distinguish the states.

[0044] To this end, the event processing loop is obtained by using the call stack backtracking information when the protocol source code reads the message, which can be designed to include:

[0045] Setting a breakpoint at the input class system call of the program;

[0046] In the network protocol service processing stage, if the breakpoint is triggered, the current protocol program function call stack information is taken as auxiliary information for identifying the event processing loop; and all loop structures containing I / O operations are collected, and a mapping relationship is established through the functions to which the loop structures belong;

[0047] Based on the stack backtracking information, all functions in the mapping relationship are matched from the bottom function of the function call stack layer by layer, and the loop structure contained in the first matched function is taken as the event processing loop.

[0048] In the process of identifying the event processing loop, it is necessary to distinguish it from the loops of other network service programs, and at the same time, to exclude the interference of the nested loops in the event processing loop. Therefore, the call stack backtracking information when the protocol program reads the message is used to identify the event processing loop, and the event processing loop identification algorithm is shown in Algorithm 1.

[0049] First, set a breakpoint at the input class system call in the program when the network protocol program completes initialization and enters the service processing phase. When the subsequent message triggers the breakpoint, save the current protocol program function call stack information as auxiliary information for identifying loops. In the identification process, all loop structures containing I / O operations are collected, and a mapping relationship is established with the functions to which they belong. Then, based on the stack backtracking information, all functions are matched in the mapping from the bottom function of the function call stack layer by layer, and the loop structure contained in the first matched function is taken as the event processing loop. This is because the function call stack backtracking information only records the function calls in the service processing phase, which can avoid the interference of the initialization phase loops. Moreover, the bottom-up function matching identifies the outermost loop, excluding the influence of nested loops.

[0050]

[0051]

[0052] Since static analysis lacks runtime information of the program, false positives may exist in the state variable identification process. Based on the analysis of the protocol program, the characteristics of the state variables are summarized, and heuristic rules can be used to reduce false positives. The specific rules can be summarized as follows:

[0053] 1) The operations of state variables in the protocol program are always performed in the event processing loop, so only analyzing the program variables in this loop can reduce the scope and false positives.

[0054] 2) Protocol state variables are read or written in the event processing loop or message processing function, so only variables that are loaded and stored are recorded.

[0055] 3) Protocol state variables are usually global variables of enumeration type or integer type and member variables in structures, and are usually assigned to constants, so only enumeration or integer global variables that are written by constants and member variables in structures are retained.

[0056] After completing the identification of state variables, a unique string identifier is assigned to each variable, and a list is output for subsequent tracking. However, for protocol programs developed based on event notification libraries, the event processing loop is usually in the library function, and manual annotation is provided as an aid. Using the annotation API to annotate key information can not only refine the identified state variables to achieve different granularity of state-sensitive operations, but also accurately annotate state variables based on protocol knowledge.

[0057] S102, track and detect the change of the network protocol state variable by inserting the state variable, obtain the process state in the network protocol, and construct a protocol process state machine for mapping the protocol state space and the code space according to the process state, the process state is the code state conversion according to the state variable change.

[0058] Specifically, the change of the network protocol state variable is tracked and detected by inserting the state variable, which can include:

[0059] The state variable write operation in the network protocol source code is inserted and processed, and the write value of the state variable is mapped to the shared memory block of the fuzzy test and the network protocol source code to be tested.

[0060] The hash value of the state variable string identifier and the new value to be written are executed by XOR operation, and the XOR value is used as the index of updating the shared memory block, so as to record the state transition process of the network protocol state variable by using the change of the shared memory block.

[0061] In order to make the value of the state variable can be real-time transmitted to the fuzzy tester, the state variable write operation in the source code is inserted and processed in the compilation phase, which is convenient for subsequent state collection. At the same time, the write value of the state variable is mapped to the shared memory of the fuzzy tester and the protocol program to be tested, and the shared memory block is recorded as share_state. The specific mapping calculation method can be expressed as follows:

[0062]

[0063] Wherein, var_id represents the string identifier of the state variable, which is subsequently hashed. The hash value and the new value to be written are executed by XOR operation, and the final XOR value is used as the index to update the shared memory block. At the same time, the index can be calculated according to the previous value of the state variable to recover the corresponding value in the shared memory. Different state variables will produce different hash values, which also correspond to different regions in the shared memory. Each time the value of the state variable changes, it will cause the change of the shared memory, so the more detailed state transition process of the protocol program can be recorded. The program after insertion will be used as the final program for subsequent processing, such as building a state machine model and performing mutation operation.

[0064] In the process of building the state machine of the current gray box fuzzy tester, simple feedback codes or program variables without processing are usually used, which lack the association with the program code space. The two kinds of feedback information are relatively independent and cannot well guide the fuzzy test together. In the embodiment, the structure of the state machine M is expanded, and the mapping relationship between the state space and the program space of the protocol state machine is designed to increase more process information between states by using the fine-grained program state represented by the program variable.

[0065] Firstly, the state machine M is extended to a directed graph structure <S, E, ∑: S→{re_mes}>, where ∑ is a mapping of recording messages and corresponding states. If the program state is v before sending re_mes, the corresponding program variable var_id that produces changes will be added to S, v→var_id is added to E, and the mapping relationship is added to ∑. Secondly, the state node is extended to <depth, pnode, statetrans_paths, covered_bits, selscted_time, fuzzed_times>. Where depth∈N, representing the depth of the state; pnode∈S, representing the forward state node of the state; statetrans_paths∈N, representing the number of state transition paths explored at this state; covered_bits∈M, representing the program bit map covered by this state, M is a two-dimensional matrix; selected_times∈N, representing the number of times the state is selected; fuzzed_times∈N, representing the number of times the state is tested.

[0066] In the protocol state graph, the current state node v∈S, its depth is recorded as the distance d(v, v0) to the entry node v0. Based on the research, the state node with a larger depth value is more difficult to be explored. According to the collection of state variables, the shared memory block shared_state is obtained. Each time the fuzz tester receives the feedback of the instrumented protocol, it records the shared memory of the current program variables and sorts them for hash operation. The hash value at this time is used as the overall state representation of the current protocol program. Put each hash value into the queue, and with the continuous sending of request messages, a group of state sequences state_sequence is obtained after the test case is executed. By comparing different state sequences, the state variable identifier var_id corresponding to the shared memory block shared_state that changes is obtained, and then the function unique is used to compare the number of different hash values, and thus statetrans_paths is obtained, i.e. unique(hash(var_id)).

[0067] statetrans_paths refers to the state transition path that can be discovered when selecting a state v. The larger the value, the more state transition paths that can be explored from the current state. Therefore, the correlation between this state and other states is higher, which also means that this state is more important and deserves attention. covered_bits represents the edge coverage bitmap that can be achieved when exploring the state. For each state, a separate bitmap is reserved. During the fuzz testing, the program coverage after the test case is executed is recorded, and the bitmap coverage of each node of the state machine is calculated. With the progress of the test, the mapping between the protocol program space and the state space is constantly improved.

[0068] From the above, for a known protocol state v, the covered_bits that can be triggered by this state can be obtained. The larger the value, the larger the corresponding program space, and the greater the exploration value of the state. By supplementing the selected_times and fuzzed_times of the state, the state exploration and utilization are balanced, and the test is more reasonable.

[0069] S103, select the network protocol key state according to the protocol state weight, and test the network protocol key state.

[0070] Specifically, the network protocol key state is selected, which can be designed to include:

[0071] According to the depth of the state node, the number of state transition paths explored in the current state, the program bit map covered by the current state, the number of times the state is selected, and the number of times the state is tested, the state weight is calculated.

[0072] The state weight is used as the probability of selecting the protocol state, and the network protocol key state is obtained according to the probability.

[0073] In order to find the key state, a weight calculation method for the state is designed, and a heuristic algorithm is used to assign energy to the key state. The weight calculation is based on the following understanding:

[0074] (1) The deeper the network communication level, the more difficult it is to test the code. The state has a forward dependency, and as the communication degree deepens, the required message sequence is more difficult to construct, so it will lead to more difficult full testing, and it is more likely to have more potential vulnerabilities.

[0075] (2) States located in key positions of the state machine will be associated with more state transition paths, and exploring such states will be more likely to trigger unknown coverage.

[0076] (3) The larger the program space affected by the state, the more complex the function implemented. The broad program space and complex code implementation will increase the difficulty of full testing, so the attention should also be increased.

[0077] (4) In the process of exploring program states, new state exploration needs to be considered to avoid imperfect state machine structure.

[0078] Based on the above principles, for state v i The calculation formula of the state weight can be expressed as:

[0079]

[0080] The calculated weight is the probability of the state being selected, the deeper the position of the state, the larger the associated path, the larger the corresponding program space, and the larger the weight value. At the same time, the state selected and tested more times will be limited. Therefore, the threshold value of the number of times the state is selected and the number of times the state is tested can be set, and if the number of times the state is selected and / or the number of times the state is tested is greater than the threshold value, the weight of the state is set to a constant; and in the state weight calculation, if the data value reaches a specified level, the state node depth, the number of state transition paths explored by the current state, the number of times the state is selected and the number of times the state is tested are downgraded to facilitate the calculation of the selection time of a high order of magnitude.

[0081] As shown in Figure 2 The protocol state variable identification and tracking part, the protocol process state machine construction part and the state selection part are mainly included in the ZFuzz architecture of the scheme. In the protocol state variable identification and tracking part, the event processing loop and the state variable list of the protocol program are obtained by processing the target program source code through automatic analysis and manual API annotation. In the variable tracking stage, the compilation and splicing engine first analyzes the manual annotation information, and then generates corresponding information output, and splices the target program according to the state variable list. The fuzzy tester can obtain state feedback information, and can also obtain coverage feedback information during execution. In the protocol state machine construction part, the existing protocol gray box fuzzy test tool usually only contains simple state information in the construction of the protocol state machine model. For example, AFLNet uses the response code in the response message, and SGFuzz uses the enumerated type variable as the state variable but lacks filtering. As a result, the existing state machine has problems such as rough state, inaccurate representation and only considering reachability. In the actual implementation of the state machine, no associated information with the protocol program space is involved, that is, the program state and the code coverage are independent of each other and lack of association and cooperation. Therefore, the protocol process state machine is used to expand the state machine structure, map the program space and the state space, and realize more detailed state design and process information improvement in cooperation with the protocol state variable.

[0082] Further, based on the above method, the embodiment of the present application also provides a network protocol fuzzy test system based on a protocol process state machine, comprising: a static analysis module, a splicing tracking module, a state machine construction module and a targeted test module, wherein,

[0083] The static analysis module is used for static analysis of the network protocol source code, and identification of the state variable in the source code, the state variable being a program variable representing the state of the network protocol;

[0084] The splicing tracking module is used for tracking and detecting the change of the network protocol state variable by splicing the state variable to obtain the process state in the network protocol.

[0085] a state mechanism module, configured to construct a protocol process state machine for mapping the protocol state space and the code space according to a process state, the process state being a code state transition according to a state variable change;

[0086] a targeted test module, configured to select a network protocol key state according to a protocol state weight, and perform targeted test on the network protocol key state.

[0087] The relative steps, numerical expressions and numerical values of components and steps set forth in the embodiments are not intended to limit the scope of the present application, unless otherwise specified.

[0088] The various embodiments are described in a progressive manner in the present specification, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the system disclosed by the embodiments, the description is relatively simple because it corresponds to the method disclosed by the embodiments. The relevant parts can be referred to the description of the method.

[0089] The units and method steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been described in general terms in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation does not exceed the scope of the present application.

[0090] Those skilled in the art can understand that all or part of the steps of the above method can be instructed by a program to complete the relevant hardware, and the program can be stored in a computer readable storage medium, such as a read-only memory, a magnetic disk or an optical disk. Alternatively, all or part of the steps of the above embodiments can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiments can be implemented in the form of hardware or in the form of a software function module. The present application is not limited to any specific form of combination of hardware and software.

[0091] Finally, it should be noted that the above-described embodiments are merely specific embodiments of the present application, which are used to illustrate the technical solutions of the present application, but not to limit the same. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that any person skilled in the art can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some of the technical features, within the technical scope disclosed by the present application. The modifications, changes or replacements do not cause the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network protocol fuzzing method based on a protocol process state machine, characterized in that, Comprise: Performing static analysis on network protocol source code, and identifying state variables in the source code, the state variables being program variables representing network protocol states; Tracking and detecting changes of network protocol state variables by instrumenting the state variables, obtaining process states in the network protocol, and constructing a state machine according to feedback codes or state variables, and extending the state machine into a directed graph structure, and extending state nodes into six-tuple representations, so as to establish a mapping relationship between state space and code space by using the directed graph structure, wherein the directed graph structure is represented as <S, E, ∑: S→{re_mes}>, S is a protocol state set, E is a set of states and corresponding program variables, ∑ is a mapping recording messages and corresponding states, re_mes is a request message, and the six-tuple representation of the state node is <depth, pnode, statetrans_paths, covered_bits, selected_times, fuzzed_times>, depth represents the depth of the state node, pnode represents the forward state node of the state node, statetrans_paths represents the number of state transition paths explored at the current state, covered_bits represents the program bit map covered at the current state, selected_times represents the number of times the state is selected, and fuzzed_times represents the number of times the state is tested, and the process state is a code state transition according to the state variable change; Calculating state weights according to the depth of the state node, the number of state transition paths explored at the current state, the program bit map covered at the current state, the number of times the state is selected, and the number of times the state is tested, taking the state weight as the probability of selecting the protocol state, obtaining key states of the network protocol according to the probability, and performing targeted testing on the key states of the network protocol, and the protocol state weight is used to describe the value of each network protocol state in the fuzzing process.

2. The protocol procedure state machine based network protocol fuzzing method of claim 1, wherein, Performing static analysis on network protocol source code, and identifying state variables in the source code, comprising: Performing static analysis on the source code, and obtaining an event processing loop by using call stack backtracking information when the protocol source code reads a message; Identifying and labeling state variables in the source code, and assigning a unique string identifier to each state variable, and outputting in the form of a state list, wherein the state variables include: event processing loop program variables, program variables read / written in message processing functions, enumeration / integer global variables written by constants, and member variables in structures.

3. The protocol process state machine based network protocol fuzzing method of claim 2, wherein, Obtaining an event processing loop by using call stack backtracking information when the protocol source code reads a message, comprising: Setting a breakpoint at a program input class system call; In the network protocol service processing stage, if the breakpoint is triggered, the current protocol program function call stack information is used as auxiliary information for identifying the event processing loop; All loop structures containing I / O operations are collected, and a mapping relationship between the loop structures and the functions to which the loop structures belong is established; Based on stack backtracking information, all functions are matched in mapping relationship from the bottom function of function call stack layer by layer, and the loop structure contained in the first matched function is taken as the event processing loop.

4. The protocol process state machine based network protocol fuzzing method of claim 1, wherein, The change of the network protocol state variable is tracked and detected by inserting a probe into the state variable, including: The state variable write operation in the network protocol source code is handled by inserting a probe, and the write value of the state variable is mapped to the shared memory block of the fuzzy test and the network protocol source code under test. The hash value of the state variable string identifier and the new value to be written are executed by XOR operation, and the XOR value is used as the index of the updated shared memory block, so as to record the state transition process of the network protocol state variable by using the change of the shared memory block.

5. The protocol process state machine based network protocol fuzzing method of claim 1, wherein, The state weight is calculated, further including: Setting the threshold value of the number of times the state is selected and the number of times the state is tested, if the number of times the state is selected and / or the number of times the state is tested is greater than the threshold value, the state weight is set to a constant; And in the state weight calculation, if the data amount value reaches the specified level, the state node depth, the number of state transition paths explored in the current state, the number of times the state is selected and the number of times the state is tested are downgraded.

6. A protocol procedure state machine based network protocol fuzzing system, characterized in that, The method implementation of claim 1, comprising a static analysis module, a probe tracking module, a state mechanism modeling module and a targeted test module, wherein, The static analysis module is used for static analysis of the network protocol source code and identification of the state variable in the source code, the state variable being a program variable representing the state of the network protocol; The probe tracking module is used for tracking and detecting the change of the network protocol state variable by inserting a probe into the state variable, obtaining the process state in the network protocol, and the process state being a code state transition according to the change of the state variable; The state mechanism modeling module is used for constructing a protocol process state machine for mapping the protocol state space and the code space according to the process state; The targeted test module is used for selecting the key state of the network protocol according to the protocol state weight, and performing targeted test on the key state of the network protocol.

7. An electronic device, comprising: It includes: At least one processor, and a memory coupled to the at least one processor; Wherein, the memory stores a computer program, the computer program can be executed by the at least one processor to realize the method of any one of claims 1~5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, when the computer program is executed, the method of any one of claims 1~5 can be realized.

Images