A state transition perception-based vulnerability mining strategy guiding method

Abstract

The present application relates to a kind of state transition perception-based vulnerability mining strategy guiding method, belong to network security technical field.The present application is through state transition perception matrix and optimal state traversal path (OSPT) technology, optimizes the seed selection and test case distribution method in network protocol fuzzy test process, improves the efficiency and coverage of vulnerability mining.This method is analyzed by the network protocol to be measured, extracts optimal state traversal path from network protocol state machine by Chinese post route problem (DCPP), and constructs state transition perception matrix to record the contribution degree of each test case to protocol state coverage, to optimize the selection of seed and the distribution process of test case.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a vulnerability mining strategy guidance method based on state transition perception. Background Art

[0002] Network protocol fuzz testing is an important means of discovering protocol entity anomalies and vulnerabilities. However, traditional fuzz testing methods have the following problems:

[0003] 1. A large number of test cases failed to trigger program exceptions because the protocol entity directly discarded the malformed data.

[0004] 2. The generation and distribution of test cases lack specificity, leading to duplicate testing and missed tests.

[0005] 3. The traversal path of the protocol state machine is too long, which increases the testing time and the difficulty of anomaly location. Summary of the Invention

[0006] (1) Technical issues to be resolved

[0007] The technical problem to be solved by the present invention is to design a vulnerability mining strategy guidance method to improve the efficiency and coverage of vulnerability mining.

[0008] (2) Technical solution

[0009] In order to solve the above technical problems, the present invention provides a vulnerability mining strategy guidance method based on state transition perception, comprising the following steps:

[0010] Step 1. Protocol state machine mapping and optimal state traversal path generation

[0011] 1.1. Mapping the protocol state machine to a directed graph: Map the protocol state machine M to a directed graph DG = (V, E), which represents the transition relationship of the protocol state machine. In this case, the state set S is mapped to the vertex set V, each state Si corresponds to a unique vertex Vi, and the state transition is mapped to a directed edge E, representing the transition from state Si to state Sj.

[0012] 1.2 Add virtual migration: When the directed graph DG mapped by the protocol state machine does not meet the strong connectivity condition, add virtual migration to make DG a strongly connected directed graph DG′;

[0013] 1.3 Find the shortest path that traverses all directed edges in the directed graph DG′, also known as the optimal state traversal path: The optimal state traversal path problem of the directed graph DG′ is transformed into the Chinese Postal Routing Problem (DCPP) for directed graphs. Using the DCPP solution algorithm, we find the shortest path that traverses all directed edges, called the optimal state traversal path (OSPT), which represents the shortest path that traverses all state transitions.

[0014] Step 2. Construction and optimization of state transition perception matrix

[0015] 2.1 State transition perception matrix construction: Obtain the state sequence, record the state transition, map the state transition to the state transition perception matrix, where the matrix elements represent the number of hits for a state transition, and output the state transition perception matrix;

[0016] 2.2 State Transition Perception Matrix Optimization: Based on the state transition perception matrix, the contribution of test cases to fuzz testing is evaluated, that is, the contribution of each test case to the protocol state coverage. If the network protocol state can be covered, the contribution is set to 1; if the network protocol state cannot be covered, the contribution is set to 0. When the number of hits for a certain state transition exceeds the threshold, the test case generation for that state is skipped and the test case is directly guided to the target state, thus obtaining the optimized state transition perception matrix and test case distribution strategy.

[0017] Step 3. Perform fuzz testing, trigger protocol entity anomalies, record and analyze vulnerability information, and perform the following optimizations during the fuzz testing process:

[0018] 3.1 Seed selection optimization: Based on the state transition perception matrix, seeds that can cover new state transitions are selected to increase the state coverage range. When the number of hits for a state transition exceeds a threshold, the test case generation step for that state is skipped and the state is directly guided to the target state. This results in an optimized seed selection strategy.

[0019] 3.2 Test case distribution optimization: Distribute test cases according to the order of OSPT to ensure that all state transitions are tested; combine the state transition perception matrix to dynamically adjust the test case distribution strategy to improve test efficiency and obtain the optimized test case distribution strategy.

[0020] Preferably, during the fuzz testing process, a new session is started after a session ends, so the terminal state of the state machine M is returned to the initial state as a state migration, which is called a virtual migration, and the virtual migration is added to the state machine.

[0021] Preferably, in step 3, recording and analyzing vulnerability information specifically includes: analyzing the abnormal state and input data of the protocol entity triggered during the fuzz testing process to identify potential vulnerabilities; generating a vulnerability report, in which the information includes vulnerability type, triggering conditions and repair suggestions;

[0022] Preferably, in step 3, anomaly location is also performed: based on OSPT and the state transition perception matrix, the abnormal state and migration path of the network protocol are located; combined with the crash log and debugging information, the cause of the vulnerability is analyzed; and an anomaly location report is generated, in which the information includes the abnormal state, migration path and root cause.

[0023] The present invention also provides a system for implementing the method.

[0024] The present invention also provides a network protocol fuzzy testing method implemented based on the method.

[0025] The present invention also provides a network protocol fuzzy testing system implemented based on the method.

[0026] The present invention also provides an application of the method in the field of network security technology.

[0027] (3) Beneficial effects

[0028] The present invention provides a vulnerability mining strategy guidance method based on state transition perception, which has the following advantages:

[0029] 1. Improve test coverage: Ensure that all state transitions are tested through OSPT to avoid missing issues related to network status.

[0030] 2. Reduce duplicate testing: Optimize seed selection through the state transition perception matrix to reduce the probability of duplicate testing. When the number of hits for a state transition exceeds a threshold, skip the test case generation step for that state.

[0031] 3. Improve test efficiency: shorten test time through shortest path traversal and dynamic distribution strategy.

[0032] 4. Rapid anomaly location: Combine OSPT and state transition perception matrix to quickly locate abnormal states and migration paths. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a schematic diagram of the state machine after adding virtual migration;

[0034] Figure 2 This is a schematic diagram of the optimal state traversal path (OSPT);

[0035] Figure 3 Schematic diagram of the state transition perception matrix. DETAILED DESCRIPTION

[0036] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below with reference to the accompanying drawings and examples.

[0037] The present invention provides a vulnerability mining strategy guidance method based on state transition perception. The main process is as follows: deploying a fuzz testing environment, collecting the state machine and test data of the target protocol; mapping the protocol state machine into a directed graph, generating the optimal state traversal path (OSPT); constructing a state transition perception matrix, recording the number of state transition hits; optimizing seed selection and test case distribution based on the OSPT and the state transition perception matrix; executing fuzz testing, triggering protocol entity anomalies, and recording and analyzing vulnerability information. Specifically, the following steps are included:

[0038] Step 1. Protocol state machine mapping and optimal state traversal path generation

[0039] 1.1 Mapping the protocol state machine into a directed graph

[0040] Map the protocol state machine M to a directed graph DG = (V, E), where:

[0041] ○ Map the state set S to the vertex set V, where each state Si corresponds to a unique vertex Vi.

[0042] ○State transitions are mapped to directed edges E, representing transitions from state Si to state Sj, marked as input Im and output Om.

[0043] ●Output result: directed graph DG, representing the migration relationship of the protocol state machine.

[0044] 1.2 Add virtual migration

[0045] ●Problem description: If the directed graph DG mapped by the protocol state machine does not meet the strong connectivity condition, the DCPP solution algorithm cannot be directly applied.

[0046] ●Solution:

[0047] ○Add virtual transitions (such as returning from the final state to the initial state) to make the DG a strongly connected graph.

[0048] ○ For example, if state s7 is a terminal state, add a virtual transition s7→s0.

[0049] ●Output result: strongly connected directed graph DG′.

[0050] 1.3 Optimal state traversal path generation

[0051] ●Problem description: Find the shortest path that traverses all directed edges in the directed graph DG′.

[0052] ●Solution:

[0053] ○The optimal state traversal path problem of the directed graph DG′ is transformed into the directed graph Chinese Postal Problem (DCPP).

[0054] ○ Use the DCPP solution algorithm to find the shortest path that traverses all directed edges, called the optimal state traversal path (OSPT).

[0055] ●Output result: Optimal State Traversal Path (OSPT), which represents the shortest path that traverses all state transitions.

[0056] Step 2. Construction and optimization of state transition perception matrix

[0057] 2.1 Construction of state transition perception matrix

[0058] ●Input data: The state sequence collected from the server, recording the state transition (such as S0→S1, S1→S2, etc.).

[0059] ●Build process:

[0060] ○ Map the state transitions to the state transition perception matrix, where the matrix elements represent the number of hits for a particular transition. For example, map the state transitions S0→S1, S1→S2, etc. in state sequence 1 to the matrix.

[0061] ●Output result: state transition perception matrix, recording the number of hits for each state transition.

[0062] 2.2 State Transition Perception Matrix Optimization

[0063] ●Input data: state transition perception matrix and global structure, recording the reachable transition information of each state.

[0064] Optimization process:

[0065] ○ According to the state transition perception matrix, evaluate the contribution of test cases to fuzz testing (the contribution of each test case to the protocol state coverage). If the network protocol state can be covered, the contribution is set to 1; if the network protocol state cannot be covered, the contribution is set to 0;

[0066] ○ When the hit count of a state transition exceeds the threshold, skip the test case generation step for that state and directly guide the state to the target state.

[0067] ●Output results: Optimized state transition perception matrix and test case distribution strategy (the priority of test case distribution can be adjusted to lower or increase the priority) to cover as many network protocol states as possible.

[0068] Step 3. Fuzz testing process optimization

[0069] 3.1 Seed selection optimization

[0070] ●Input data: optimized state transition perception matrix and optimal state traversal path (OSPT).

[0071] Optimization process:

[0072] ○ According to the state transition perception matrix, select seeds that can cover the new state transition to increase the covered state range.

[0073] When the number of hits for a state transition exceeds a threshold, skip the test case generation step for that state and directly guide the state to the target state. Setting a threshold is primarily to reduce the probability of repeated testing. Also, because a network state may be reached via multiple paths, the threshold cannot be set to 1. Based on experimental experience, the threshold can be set to 5.

[0074] ●Output result: optimized seed selection strategy.

[0075] 3.2 Test Case Distribution Optimization

[0076] ●Input data: optimized optimal state traversal path (OSPT) and state transition perception matrix.

[0077] Optimization process:

[0078] ○Distribute test cases according to the order of OSPT to ensure that all state transitions are tested.

[0079] ○ Combined with the state transition perception matrix, the test case distribution strategy is dynamically adjusted (the priority of test case distribution can be adjusted to lower or increase the priority) to improve test efficiency.

[0080] ●Output results: optimized test case distribution strategy.

[0081] Step 4. Vulnerability mining and anomaly location

[0082] 4.1 Vulnerability Exploration

[0083] ●Input data: abnormal states and input data triggered during fuzz testing.

[0084] ●Excavation process:

[0085] ○ Trigger abnormal states of protocol entities through fuzz testing and record abnormal states and input data.

[0086] ○Analyze abnormal states and identify potential vulnerabilities (such as buffer overflows, state machine logic errors, etc.).

[0087] ●Output results: vulnerability report, including vulnerability type, triggering conditions and repair suggestions.

[0088] 4.2 Abnormal Location

[0089] ●Input data: Optimal State Traversal Path (OSPT), state transition perception matrix and crash log.

[0090] Positioning process:

[0091] ○ Based on OSPT and state transition perception matrix, quickly locate network protocol abnormal status and migration path.

[0092] ○ Combine crash logs and debugging information to analyze the root cause of the vulnerability.

[0093] Output: Anomaly location report, including anomaly status, migration path, and root cause.

[0094] This example uses the state machine fuzz testing of the HTTP protocol as an example to demonstrate how to use the state transition perception matrix and optimal state traversal path (OSPT) technology to optimize the fuzz testing process and improve vulnerability discovery efficiency.

[0095] 1. Scenario Description

[0096] ●Target protocol: HTTP protocol, which includes multiple states (such as S0: initial state, S1: request receiving state, S2: response generating state, etc.) and state transitions (such as S0->S1: receiving request, S1->S2: generating response, etc.).

[0097] ●Target environment: HTTP server with security mechanisms such as ASLR (memory address space randomization) and DEP (data execution prevention) enabled.

[0098] ●Target effect: Trigger abnormal state of HTTP protocol through fuzz testing and explore potential vulnerabilities (such as buffer overflow, state machine logic errors, etc.).

[0099] 2. Implementation steps

[0100] 2.1 Protocol State Machine Mapping and Optimal State Traversal Path Generation

[0101] 1. The protocol state machine is mapped into a directed graph:

[0102] ○ Input data: HTTP protocol state machine M, including state set S = {S0, S1, S2, S3} and state transition set T = {T0: S0 → S1, T1: S1 → S2, T2: S2 → S3, T3: S3 → S0}.

[0103] ○Mapping process:

[0104] ■Map the state set S to the vertex set V = {v0, v1, v2, v3} of the directed graph DG = (V, E).

[0105] ■Map the state transition set T to a directed edge set E = {e01, e12, e23, e30}, marked as input Imim and output Omom.

[0106] ○Output result: directed graph DG, representing the state transition relationship of the HTTP protocol.

[0107] 2. Add virtual migration:

[0108] ○Problem description: The directed graph DG does not meet the strong connectivity condition and the DCPP solution algorithm cannot be directly applied.

[0109] Solution:

[0110] ■Add virtual transition T4:S3→S0 to make DG a strongly connected graph.

[0111] ○Output result: strongly connected directed graph DG′.

[0112] 3. Optimal state traversal path generation:

[0113] ○Problem description: Find the shortest path that traverses all directed edges in the directed graph DG′.

[0114] Solution:

[0115] ■Convert the optimal state traversal path problem of a directed graph DG′ into the directed graph Chinese Postal Problem (DCPP).

[0116] ■Use the DCPP solution algorithm to find the shortest path that traverses all directed edges, which is called the optimal state traversal path (OSPT).

[0117] ○ Output result: Optimal State Traversal Path (OSPT), such as S0→S1→S2→S3→S0.

[0118] 2.2 Construction and Optimization of State Transition Perception Matrix

[0119] 1. State transition perception matrix construction:

[0120] ○ Input data: state sequences collected from the HTTP server, such as state sequence 1: [S0, S1, S2, S1, S3], state sequence 2: [S0, S1, S2, S2, S3].

[0121] ○Build process:

[0122] ■Map state transitions T0:S0→S1, T1:S1→S2, T2:S2→S1, and T3:S1→S3 into the state transition perception matrix.

[0123] ■Matrix elements represent the number of hits for a transition, such as T0 hits 2 times, T1 hits 2 times, T2 hits 1 time, and T3 hits 1 time.

[0124] ○ Output result: state transition perception matrix, recording the number of hits for each state transition.

[0125] 2. State transition perception matrix optimization:

[0126] ○ Input data: state transition perception matrix and global structure, recording the reachable transition information of each state.

[0127] ○Optimization process:

[0128] ■Evaluate the contribution of test cases to fuzz testing based on the state transition perception matrix.

[0129] ■When the hit count of a state transition exceeds the threshold, skip the test case generation for that state and directly guide to the target state.

[0130] ○ Output results: optimized state transition perception matrix and test case distribution strategy.

[0131] 2.3 Fuzz Testing Process Optimization

[0132] 1. Seed selection optimization:

[0133] ○ Input data: optimized state transition perception matrix and optimal state traversal path (OSPT).

[0134] ○Optimization process:

[0135] ■Based on the state transition perception matrix, select seeds that can cover new state transitions to reduce repeated testing.

[0136] ■When the hit count of a state transition exceeds the threshold, skip the test case generation step for that state and directly guide the state to the target state.

[0137] ○Output result: optimized seed selection strategy.

[0138] 2. Test case distribution optimization:

[0139] ○ Input data: Optimal State Traversal Path (OSPT) and state transition perception matrix.

[0140] ○Optimization process:

[0141] ■Distribute test cases according to the order of OSPT to ensure that all state transitions are tested.

[0142] ■ Combined with the state transition perception matrix, dynamically adjust the distribution strategy of test cases to improve testing efficiency.

[0143] ○Output results: optimized test case distribution strategy.

[0144] 2.4 Vulnerability Mining and Anomaly Location

[0145] 1. Vulnerability mining:

[0146] ○ Input data: abnormal states and input data triggered during fuzz testing.

[0147] ○ Excavation process:

[0148] ■Trigger the abnormal state of HTTP protocol through fuzz testing and record the abnormal state and input data.

[0149] ■Analyze abnormal states and identify potential vulnerabilities (such as buffer overflows, state machine logic errors, etc.).

[0150] ○ Output: Vulnerability report, including vulnerability type, triggering conditions and repair suggestions.

[0151] 2. Abnormal positioning:

[0152] ○ Input data: Optimal State Traversal Path (OSPT), state transition perception matrix, and crash log.

[0153] ○ Positioning process:

[0154] ■ Quickly locate abnormal states and migration paths based on OSPT and state transition perception matrix.

[0155] ■ Analyze the root cause of the vulnerability by combining crash logs and debugging information.

[0156] ○ Output results: Abnormal location report, including abnormal status, migration path and root cause.

[0157] 3. Implementation Results

[0158] ●Protocol state machine mapping: Successfully mapped the HTTP protocol state machine into a directed graph and generated the optimal state traversal path (OSPT).

[0159] ●State transition perception matrix: Successfully build and optimize the state transition perception matrix to reduce repeated testing.

[0160] ●Vulnerability mining: By triggering the abnormal state of the HTTP protocol through fuzz testing, a buffer overflow vulnerability was successfully discovered.

[0161] ●Abnormal location: Based on OSPT and state transition perception matrix, quickly locate abnormal states and migration paths.

[0162] like Figure 1As shown in the figure, vertex v2 corresponding to state s2 in the directed graph mapped from the state machine cannot reach vertex v1 corresponding to state s1, and the directed graph does not meet the DCCP solution conditions. To address this issue, the following strategy is adopted: During fuzz testing, a new session needs to be initiated after a session ends. Therefore, returning the final state of state machine M to its initial state is considered a state transition, called a virtual transition, and added to the state machine. After the protocol state machine is mapped to a directed graph DG, the problem of finding the shortest path through all state transitions is converted into a DCCP problem for solution. The DCCP problem has a polynomial-time solution. The classic DCCP solution algorithm adds directed edges to the directed graph DG so that the in-degree and out-degree of each vertex are equal, resulting in a directed Euler graph DG'. The Euler circuit of DG' is the shortest path through all transitions in DG. Using the DCCP solution, the shortest path through all directed edges in DG is obtained, which is then used to find the shortest path through all state transitions in the protocol state machine, called the optimal state traversal path (OSPT). During fuzz testing, fuzz testing is performed based on traversing the OSTP corresponding to the protocol state machine, which can ensure that all state transitions in the protocol state machine are tested.

[0163] like Figure 2 As shown in the figure, the optimal state traversal path contains repeated state transitions. For example, state s3→s4 appears three times in the OPT diagram. To address this issue, inspired by the edge coverage feedback principle of traditional fuzz testing, we propose a further optimization scheme. Specifically, we abstract the code execution path into transitions between basic blocks and introduce a state transition awareness matrix to evaluate the contribution of the current test case to the fuzz test. This matrix, to a certain extent, characterizes the coverage of the protocol state and provides an important feedback metric for case selection in protocol fuzz testing.

[0164] like Figure 3 As shown in the figure, the transitions T1, T2, and T3 between all states [S0, S1, S2, S1, S3] in state sequence 1 collected from the server correspond to S0->S1, S1->S2, S2->S1, and S1->S3, respectively, and are mapped into the state transition matrix, with each bit in the matrix representing a specific transition. Similarly, the state transitions T0, T1, T4, and T5 in state sequence ② correspond to S0->S1, S1->S2, S2->S2, and S2->S3, respectively, and are mapped into the state matrix in the same manner. The color of the state transition matrix elements along the way indicates the number of hits for that transition during fuzz testing. Each state relationship is also recorded, and a global structure is used to maintain the reachable transition information for each state for use in subsequent fuzz testing stages.

[0165] It can be seen that the present invention includes the steps of protocol state machine mapping and optimal state traversal path generation, state transition perception matrix construction and optimization, fuzz testing process optimization, vulnerability mining and anomaly location. The method ensures that all state transitions are tested by mapping the protocol state machine into a directed graph and generating the optimal state traversal path (OSPT). By constructing the state transition perception matrix, seed selection and test case distribution are optimized, improving test efficiency and coverage. By using the state transition perception matrix and the optimal state traversal path (OSPT) technology, the seed selection and test case distribution method in the network protocol fuzz testing process are optimized, improving the efficiency and coverage of vulnerability mining. The method analyzes the network protocol to be tested, extracts the optimal state traversal path from the network protocol state machine through the China Postal Problem (DCPP), and constructs a state transition perception matrix to record the contribution of each test case to the protocol state coverage, thereby optimizing the seed selection and test case distribution process. The present invention has broad application prospects and is suitable for fields such as network protocol security testing and vulnerability mining.

[0166] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A vulnerability mining strategy guidance method based on state transition perception, characterized by comprising the following steps: Step 1. Protocol state machine mapping and optimal state traversal path generation 1.

1. Map the protocol state machine to a directed graph: Map the protocol state machine M to a directed graph DG = (V, E), which represents the migration relationship of the protocol state machine, where Map the state set S to the vertex set V, each state Si corresponds to a unique vertex Vi, and map the state transition to a directed edge E, representing the transition from state Si to state Sj; 1.2 Add virtual migration: When the directed graph DG mapped by the protocol state machine does not meet the strong connectivity condition, add virtual migration to make DG a strongly connected directed graph DG′; 1.3 Find the shortest path that traverses all directed edges in the directed graph DG′, also known as the optimal state traversal path: The optimal state traversal path problem of the directed graph DG′ is transformed into the Chinese Postal Routing Problem (DCPP) for directed graphs. Using the DCPP solution algorithm, we find the shortest path that traverses all directed edges, called the optimal state traversal path (OSPT), which represents the shortest path that traverses all state transitions. Step 2. Construction and optimization of state transition perception matrix 2.1 State transition perception matrix construction: Obtain the state sequence, record the state transition, map the state transition to the state transition perception matrix, where the matrix elements represent the number of state transition hits, and output the state transition perception matrix; 2.2 State transition perception matrix optimization: Based on the state transition perception matrix, the contribution of test cases to fuzz testing is evaluated, that is, the contribution of each test case to the protocol state coverage. If the network protocol state can be covered, the contribution is set to 1; If the network protocol state cannot be covered, the contribution is set to 0. When the number of hits in the state transition exceeds the threshold, the test case generation for that state is skipped and the test case is directly guided to the target state, thus obtaining the optimized state transition perception matrix and test case distribution strategy. Step 3. Perform fuzz testing, trigger protocol entity anomalies, record and analyze vulnerability information, and perform the following optimizations during the fuzz testing process: 3.1 Seed selection optimization: Based on the state transition perception matrix, seeds that can cover new state transitions are selected to increase the state coverage range. When the number of hits for a state transition exceeds a threshold, the test case generation step for that state is skipped and the state is directly guided to the target state. This results in an optimized seed selection strategy. 3.2 Test case distribution optimization: Distribute test cases according to the order of OSPT to ensure that all state transitions are tested; combine the state transition perception matrix to dynamically adjust the test case distribution strategy to improve test efficiency and obtain the optimized test case distribution strategy.

2. The method as claimed in claim 1 is characterized in that, during the fuzz testing process, a new session is started after a session ends, so the terminal state of the state machine M is returned to the initial state as a state migration, which is called a virtual migration, and the virtual migration is added to the state machine.

3. The method according to claim 1, wherein In step 3, the vulnerability information is recorded and analyzed specifically as follows: based on the abnormal state of the protocol entity and the input data triggered during the fuzz testing process; analyzing the abnormal state and identifying potential vulnerabilities; generating a vulnerability report, which includes information such as the vulnerability type, triggering conditions, and repair suggestions.

4. The method according to claim 1, wherein In step 3, anomaly location is also performed: based on OSPT and the state transition perception matrix, the abnormal state and migration path of the network protocol are located; the cause of the vulnerability is analyzed by combining crash logs and debugging information; and an anomaly location report is generated, which includes information such as the abnormal state, migration path, and root cause.

5. The method according to claim 1, wherein Potential vulnerabilities include buffer overflows and state machine logic errors.

6. The method according to claim 1, wherein The threshold is set to 5.

Images