Protocol fuzz test automatic pause method and device, equipment and storage medium

Abstract

The invention provides a protocol fuzz test automatic pause method, apparatus and device, and a storage medium. The method comprises the steps of generating a dynamic threshold adaptive to protocol features and a test environment according to an initial preset value input by a user; constructing a weighted state machine model of the protocol fuzz test according to the dynamic threshold value; performing multi-dimensional defect verification through the weighted state machine model, and determining a defect event of the protocol fuzz test; judging a potential risk score of the defect event according to the vulnerability hazard prediction model; when the potential hazard score exceeds a dynamic threshold, the protocol fuzz test is suspended according to an intelligent suspension decision. Through the implementation of the scheme of the invention, the defect event of the protocol fuzz test is determined based on the multi-stage defect verification of the weighted state machine model, and when the potential risk score of the defect event exceeds the dynamic threshold, the protocol fuzz test is suspended according to the intelligent suspension decision, so that the test efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method, device, equipment and storage medium for automatically pausing a protocol fuzz test. Background Art

[0002] Protocol fuzz testing is a software testing method that discovers potential defects in the system under test by sending a large amount of random abnormal data to the system under test. In the actual testing process, testers may manually suspend the test task according to the number of defects reported continuously to carry out defect repair or resource allocation. Currently, manually suspending the test task is not only inefficient, but also may miss the best time to suspend the test. Summary of the invention

[0003] The present application provides a method, device, equipment and storage medium for automatically pausing a protocol fuzz test, which are used to solve the problem in the related art that manually pausing a test task easily leads to missing the best test pause opportunity.

[0004] A first aspect of the present application provides a method for automatically pausing a protocol fuzz test, the method comprising: Generate a dynamic threshold adaptive to the protocol characteristics and the test environment according to the initial preset value input by the user; Constructing a weighted state machine model for protocol fuzz testing according to the dynamic threshold; Perform multi-dimensional defect verification through the weighted state machine model to determine defect events of the protocol fuzz test; Determine the potential risk score of the defect event according to the vulnerability risk prediction model; When the potential risk score exceeds the dynamic threshold, the protocol fuzz testing is suspended according to an intelligent suspension decision.

[0005] Optionally, in a first implementation of the first aspect of the present application, the step of generating a dynamic threshold adaptive to the protocol characteristics and the test environment according to the initial preset value input by the user includes: Obtain the protocol field complexity vector by parsing the grammatical structure of the target protocol document; generating an initial defect threshold base according to the protocol field complexity vector; Generate environmental noise interference factors by collecting the real-time resource utilization curve and network round-trip delay sequence of the test target; Inputting the initial defect threshold base and the environmental noise interference factor into a dynamic compensation model to determine a dynamic threshold correction value; Based on the dynamic threshold correction value, a nonlinear interpolation operation is performed on the initial preset value input by the user to generate a dynamic threshold that is adaptive to the current protocol characteristics and the test environment.

[0006] Optionally, in a second implementation of the first aspect of the present application, the step of constructing a weighted state machine model for the protocol fuzzy test according to the dynamic threshold includes: Parse the target protocol document through the protocol reverse analysis engine to generate a basic state transition diagram; Inserting a variant state transition edge in the basic state transition graph according to the abnormal path record in the historical defect database; Determine the dynamic weight value of the mutation state transfer edge according to the dynamic threshold; The dynamic weight value is input into the state transition probability matrix to construct a weighted state machine model for protocol fuzz testing.

[0007] Optionally, in a third implementation of the first aspect of the present application, the step of performing multi-dimensional defect verification through the weighted state machine model to determine the defect event of the protocol fuzz test includes: Performing a specification match check on the field structure of the test data packet of the protocol fuzz test through a protocol syntax parser to generate a syntax compliance tag vector; Based on the dynamic weight matrix in the weighted state machine model, the state transition path triggered by the test case of the protocol fuzz test is verified for jump legitimacy; If the deviation value between the actual jump path of the test case and the path marked as legal in the weight matrix exceeds a preset deviation threshold, a state abnormality event is triggered; Obtaining a context cache pool of the target protocol during a session; Generate a semantic conflict identifier according to the logical contradiction of the test response data in the context buffer pool; Inputting the grammatical compliance mark vector, the state exception event and the semantic conflict identifier into a cross-level verification engine; If the verification results of at least two dimensions point to the same protocol interaction node, it is determined that a defect event exists in the protocol interaction node.

[0008] Optionally, in a fourth implementation of the first aspect of the present application, the step of determining the potential risk score of the defect event according to the vulnerability risk prediction model includes: Generate a multi-dimensional threat feature vector according to the protocol stack layer identifier, attack surface diffusion coefficient and state machine backtracking path depth of the defect event; Performing pattern matching on the feature vectors through the historical vulnerability knowledge graph to obtain a baseline hazard score for similar vulnerability cases; Calculate the environment correction factor based on the resource occupancy rate of the current test environment; Perform threat propagation simulation on the variant edges associated with the defect event to generate a risk contamination index across state nodes; The baseline hazard score, environmental correction factor and risk pollution index are input into a nonlinear scoring aggregator, and the impact weights of historical vulnerabilities are dynamically reduced through a time decay function to output a potential hazard score for the defect event.

[0009] Optionally, in a fifth implementation of the first aspect of the present application, the step of suspending the protocol fuzzy test according to the intelligent suspension decision includes: Generate a dynamic distribution graph reflecting the density of test activities based on the protocol path coverage data and field variation intensity values ​​triggered by the current test case; Based on the distribution pattern of high-density areas in the dynamic distribution graph, the state nodes occupying system resources in the weighted state machine model are prioritized to generate a phased pause queue; The target test thread is gradually released according to the priority order of the phased suspension queue, and the complete running state of the thread is saved before the release.

[0010] Optionally, in a sixth implementation of the first aspect of the present application, the method further includes: Determine, according to the status data corresponding to the complete running status, a correlation matrix between the variation fields of the protocol fuzzy test and the potential risk scores; Based on the entropy distribution characteristics of the association matrix, reverse gradient correction is performed on the mutation edge generation rule of the weighted state machine model to generate a mutation strategy update weight table; According to the mutation strategy, the field heat attenuation factor in the weight table is updated, the probability distribution parameters of the test case generator are reconstructed, and an adaptive mutation seed pool is generated; The adaptive mutation seed pool is mapped to the resource allocation priority queue of the unpaused test thread through a dynamic scheduler, activating a closed-loop feedback mechanism of the test strategy.

[0011] A second aspect of the present application provides a protocol fuzzy test automatic suspension device, the protocol fuzzy test automatic suspension device comprising: A generation module, used to generate a dynamic threshold adaptive to the protocol characteristics and the test environment according to an initial preset value input by a user; A construction module, used for constructing a weighted state machine model of the protocol fuzzy test according to the dynamic threshold; A determination module, configured to perform multi-dimensional defect verification through the weighted state machine model to determine defect events of the protocol fuzz test; A judgment module, used to judge the potential risk score of the defect event according to the vulnerability risk prediction model; A pause module is used to pause the protocol fuzzy test according to an intelligent pause decision when the potential risk score exceeds the dynamic threshold.

[0012] A third aspect of an embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the processor is used to execute a computer program stored in the memory, and when the processor executes the computer program, the steps of the automatic suspension method of protocol fuzz testing provided in the first aspect of the embodiment of the present application are implemented.

[0013] The fourth aspect of the embodiments of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the automatic suspension method of the protocol fuzzy test provided in the first aspect of the embodiments of the present application are implemented.

[0014] In summary, according to the automatic suspension method, device, equipment and storage medium of a protocol fuzz test provided by the scheme of the present application, a dynamic threshold adaptive to the protocol characteristics and the test environment is generated according to the initial preset value input by the user; a weighted state machine model of the protocol fuzz test is constructed according to the dynamic threshold; multi-dimensional defect verification is performed through the weighted state machine model to determine the defect event of the protocol fuzz test; the potential risk score of the defect event is judged according to the vulnerability hazard prediction model; when the potential risk score exceeds the dynamic threshold, the protocol fuzz test is suspended according to the intelligent suspension decision. Through the implementation of the scheme of the present application, the defect event of the protocol fuzz test is determined based on the multi-level defect verification of the weighted state machine model, and when the potential risk score of the defect event exceeds the dynamic threshold, the protocol fuzz test is suspended according to the intelligent suspension decision, thereby improving the test efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A flowchart of a method for automatically pausing a protocol fuzzy test provided in an embodiment of the present application; Figure 2 A schematic diagram of a program module of a protocol fuzzy test automatic suspension device provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to make the purpose, features, and advantages of the invention of this application more obvious and easy to understand, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0017] In order to solve the problem in the related art that manually pausing the test task may miss the best test suspension time, the embodiment of the present application provides a method for automatically pausing the protocol fuzzy test, such as Figure 1 The flowchart of the automatic suspension method of the protocol fuzzy test provided in this embodiment includes the following steps: Step 110: Generate a dynamic threshold adaptive to the protocol characteristics and the test environment according to the initial preset value input by the user.

[0018] Specifically, the initial preset value is the number of defects that the user expects to suspend the test task. After the initial preset value is input, the characteristic vector of the target protocol is extracted through the protocol parsing module, covering key information such as protocol type, field complexity, and historical vulnerability distribution. The basic defect threshold is calculated using the preset value dynamic generator. At the same time, the actual test data such as network delay and system resource occupancy are monitored in real time using environmental parameter acquisition technology, and the correction coefficient is generated with the help of the environmental compensation model. The basic threshold and the correction coefficient are nonlinearly fused to obtain a dynamic preset threshold that adapts to different protocol characteristics and environmental conditions. This value can reflect the real-time risk level of defect triggering and provide a quantitative basis for subsequent test tasks. Relying on this automatic control mechanism, the combination of real-time data acquisition and model calculation can not only ensure that the test task is interrupted in time when the number of defects reaches the predetermined index, but also reduce the frequency of manual intervention, thereby greatly improving the intelligence and test accuracy of the overall system, and providing solid data support for subsequent state modeling and defect verification.

[0019] In an optional implementation of the present embodiment, the step of generating a dynamic threshold adaptive to the protocol characteristics and the test environment according to the initial preset value input by the user includes: obtaining a protocol field complexity vector by parsing the grammatical structure of the target protocol document; generating an initial defect threshold cardinality according to the protocol field complexity vector; generating an environmental noise interference factor by collecting the real-time resource occupancy curve and network round-trip delay sequence of the test target; inputting the initial defect threshold cardinality and the environmental noise interference factor into a dynamic compensation model to determine a dynamic threshold correction value; performing a nonlinear interpolation operation on the initial preset value input by the user based on the dynamic threshold correction value to generate a dynamic threshold adaptive to the current protocol characteristics and the test environment.

[0020] Specifically, in this embodiment, by parsing the grammatical structure of the target protocol document, firstly, the protocol format, field definition and preset grammatical rules are analyzed by using a lexical analyzer and a grammatical analyzer to form a grammatical tree that describes the overall structure of the protocol, and thereby the arrangement relationship and nesting level of each field in the protocol are extracted. This structured representation is called a protocol field complexity vector, in which each vector element reflects a quantitative score of field length, type diversity and dependencies between fields. For example, in the HTTP protocol, there is a significant difference in complexity between the header information and the body content, so the corresponding scores in the complexity vector are also different. Next, based on these scores, a predetermined rule and weight allocation mechanism are used to calculate an initial defect threshold base, which is used to measure the basic level of the potential defect risk of the protocol itself. At the same time, the resource utilization curve and network round-trip delay sequence of the target test system are collected in real time. These two types of data represent the usage of system memory, CPU and other resources and the delay time from sending to receiving of the data packet, respectively. Through statistical analysis technology Determine the system load fluctuation and network delay anomalies, and then generate an environmental noise interference factor. This factor is used to describe the measurement deviation caused by resource fluctuations or network instability in the actual test environment. For example, instantaneous spikes may occur under high load conditions, and the interference factor quantifies this impact. Then, the initial defect threshold base and the environmental noise interference factor are input into the dynamic compensation model. This model is a control mechanism based on real-time feedback. By comparing the deviation between the actual operating data and the preset base, a dynamic threshold correction value is output. This correction value can balance the inherent risk of the protocol structure and the external environment interference. Finally, a nonlinear interpolation operation is used for the initial preset value input by the user. By introducing nonlinear functions such as exponentials or logarithms for smooth adjustment, the final generated dynamic threshold can not only accurately reflect the complexity of the protocol field, but also adapt to changes in the test environment in real time. For example, when facing encrypted communication protocols, the dynamic threshold can sensitively capture abnormal behaviors and realize intelligent decision-making for test interruption, thereby ensuring the accuracy of defect detection and the safety and efficiency of the test process.

[0021] Step 120: construct a weighted state machine model for protocol fuzz testing according to the dynamic threshold.

[0022] Specifically, relying on the dynamic preset threshold obtained by the front end, the target protocol standard document is used for detailed analysis to build a weighted model based on the state transition diagram. First, the basic state transition diagram is generated through document analysis, and the mutation nodes and edges are injected into the diagram in combination with the historical abnormal path records to reflect the potential abnormal state. In this process, by establishing a weighted state transition matrix, the initial weight of each state node is inversely proportional to the dynamic threshold, thereby realizing dynamic regulation of the state transition sensitivity. At the same time, the protocol session context cache technology is used to store handshake parameters, encrypted negotiation information and transaction identifiers, so that the model can accurately capture the context information of each test case. The introduction of real-time monitoring and feedback mechanism enables the entire weighted state machine model to automatically adjust the state weight according to changes in the test environment, providing a precise operating basis for subsequent defect capture, and ensuring that the test task can achieve intelligent scheduling and efficient anomaly detection in actual operation.

[0023] In an optional implementation of the present embodiment, the step of constructing a weighted state machine model for protocol fuzz testing according to a dynamic threshold includes: parsing the target protocol document through a protocol reverse analysis engine to generate a basic state transition diagram; inserting mutant state transition edges into the basic state transition diagram according to abnormal path records in a historical defect database; determining the dynamic weight value of the mutant state transition edge according to the dynamic threshold; and inputting the dynamic weight value into a state transition probability matrix to construct a weighted state machine model for protocol fuzz testing.

[0024] Specifically, the protocol reverse analysis engine is a software tool or system that uses reverse engineering technology to comprehensively analyze and reconstruct network communication protocols. Its core goal is to extract the internal structure, logical relationship and state transition information of the protocol from existing protocol documents, data packet flows and real-time communication logs. In this embodiment, when the target protocol (tested protocol) document is parsed by the protocol reverse analysis engine, the communication fields, control commands and their interdependencies defined in the protocol are identified and extracted using advanced syntax and semantic analysis algorithms, and a basic state transition diagram describing the protocol interaction logic is constructed. The so-called state transition diagram is a model that graphically displays each state of the protocol and its conversion relationship. For example, when analyzing the email transmission protocol, the states such as instruction reception, response return and connection disconnection can be expressed in the form of nodes; then, by consulting the abnormal path data recorded in the historical defect database, using the abnormal state transition information accumulated in the test process in the database, insert the variant state transition edge in the basic state transition diagram. The variant state transition edge here refers to the unexpected state transition caused by security vulnerabilities or abnormal events outside the normal protocol process, such as the state jump after the non-standard response that may appear in the SMTP protocol; then, using the pre-calculated The calculated dynamic threshold, that is, the risk reference index obtained based on the current test environment parameters and historical risk data, is used to evaluate the importance of these variant state transfer edges, so as to determine their dynamic weight values. The dynamic weight values ​​can quantitatively reflect the risk proportion of each variant edge in the abnormal behavior of the protocol. For example, in the HTTPS protocol test, the weight of the abnormal SSL handshake state transition is increased to more accurately capture potential vulnerabilities; finally, the determined dynamic weight value is input into the state transition probability matrix. The matrix is ​​a mathematical model in which each element represents the probability of transitioning from one state to another. A weighted state machine model is constructed through matrix operations. This model integrates the weights and probabilities of state nodes and state transitions to achieve the prediction and detection of abnormal behaviors in the protocol fuzzy testing process, so that in actual testing, the security risks caused by state deviation can be discovered in time, and the test strategy can be optimized based on this to ensure the accuracy and efficiency of the overall test process.

[0025] Step 130: Perform multi-dimensional defect verification through a weighted state machine model to determine defect events of the protocol fuzz test.

[0026] Specifically, during the operation of the model, a multi-layer verification mechanism is used to capture potential defects in the test data packet in real time. First, with the help of protocol syntax verification, each field of the data packet is matched in a standardized manner to identify syntax anomalies in a timely manner; then, semantic consistency detection is used to compare the state transfer logic based on the session parameters in the context cache to determine the legitimacy of the protocol interaction; in addition, the hardware anomaly monitoring module detects underlying conditions such as memory access and CPU instruction anomalies to capture system-level fault information. The suspected defect information output by each verification module undergoes cross-layer consistency verification. Only when the detection results of multiple dimensions point to the same abnormal state will the system generate a final confirmed defect event. The introduction of a multi-dimensional verification mechanism not only reduces the false alarm rate, but also ensures that abnormal risks are identified in a timely manner during the protocol fuzz testing process, providing accurate data for subsequent defect feature extraction and risk assessment, and ensuring that the test task is carried out safely and continuously.

[0027] In an optional implementation of the present embodiment, a multi-dimensional defect verification is performed through a weighted state machine model to determine the defect event of the protocol fuzz test, including: performing a specification matching check on the field structure of the test data packet of the protocol fuzz test through a protocol syntax parser to generate a syntax compliance marking vector; based on the dynamic weight matrix in the weighted state machine model, performing jump legitimacy verification on the state transition path triggered by the test case of the protocol fuzz test; if the deviation value between the actual jump path of the test case and the path marked as a legal path in the weight matrix exceeds a preset deviation threshold, a state abnormality event is triggered; the context cache pool of the target protocol during the session is obtained; a semantic conflict identifier is generated according to the logical contradiction of the test response data in the context cache pool; the syntax compliance marking vector, the state abnormality event and the semantic conflict identifier are input into the cross-level verification engine; if the verification results of at least two dimensions point to the same protocol interaction node, it is determined that a defect event exists in the protocol interaction node.

[0028] Specifically, in this embodiment, during the protocol fuzzy test, a protocol syntax parser is used to perform strict specification matching verification on the field structure in the test data packet. The parser analyzes the format, length and data type of each field in the data packet based on technologies such as regular expressions and context-free grammars, thereby generating a syntax compliance tag vector. The vector consists of a series of binary tags or values ​​to characterize whether each field complies with the standard definition of the target protocol. For example, in the HTTP protocol test, the parameters in the request header are compared with the RFC standard (a series of specification documents issued by the Internet Engineering Task Force). The compliant part is recorded as 1, and the non-compliant part is recorded as 0, thereby constructing a grammatical compliance tag vector. The complete tag vector is generated; then, the state transition path triggered by the test case is verified for legitimacy by using the dynamic weight matrix constructed in the weighted state machine model. The dynamic weight matrix quantifies the probability value of each state transition and assigns a corresponding weight to each legal path, thereby providing a reference standard for the state jump of the actual test case. If a significant deviation is detected between the actual jump path of the test case and the legal path identified in the matrix, and the deviation value exceeds the preset tolerance threshold, the system will automatically trigger a state abnormality event. This abnormal event indicates that the actual jump behavior has seriously deviated from the expected protocol process. For example, in the FTP protocol test, after logging in, the target If the status of the list does not meet the expected intermediate state, it can be regarded as an exception; then, by obtaining the context cache pool of the target protocol during the session, the session identifier, handshake information, encryption negotiation data, etc. stored in it are compared and analyzed to detect whether there is a logical contradiction in the test response data. If a time series disorder or state identifier conflict is found in a certain session data, a semantic conflict identifier is generated. This identifier is used as a value or a specific mark to indicate the semantic inconsistency in the protocol interaction; on this basis, the grammatical compliance mark vector, state abnormality event and semantic conflict identifier are input into the cross-level verification engine together. The engine integrates different verification dimensions to The cross-level verification engine uses the data from the SMTP protocol to conduct a multi-level and cross-dimensional comprehensive comparison of the test data packets. With the help of mathematical operations such as logical AND and weighted sum, it determines whether at least two independent verification dimensions simultaneously point to the existence of an abnormality in the same protocol interaction node, thereby determining that there is a defect event in the interaction node. For example, in the SMTP protocol test, if the abnormal email header format and the session state jump deviation are detected at the same time, the cross-level verification engine will determine that there is a security vulnerability in the node. This comprehensive judgment mechanism can effectively reduce the false alarm rate and improve the accuracy of the detection results, ensuring that potential security risks can be captured and responded to in a timely manner during the actual test process, thereby providing a clear basis for subsequent vulnerability repairs and test strategy adjustments.

[0029] Step 140: Determine the potential risk score of the defect event based on the vulnerability risk prediction model.

[0030] Specifically, for confirmed defect events, the system uses a vulnerability hazard prediction model to quantitatively evaluate the potential risks of the defects. Specifically, by extracting multi-dimensional feature information such as the protocol stack layer, attack surface diffusion coefficient, and state machine backtracking path involved in the defect event, a standardized threat feature vector is formed; then, similar cases in the historical vulnerability knowledge graph are used for pattern matching to obtain a baseline hazard score, and the environmental correction factor is calculated in combination with the resource occupancy rate in the current test environment, and risk propagation simulation is performed on the mutant edge. Finally, a nonlinear fusion algorithm and a time decay function are used to synthesize the scores of each item and output the potential hazard score of the defect event. The score reflects the security risks that may be caused by the defect in a numerical form, providing a clear quantitative basis for subsequent intelligent suspension decisions.

[0031] In an optional implementation of the present embodiment, the step of determining the potential danger score of a defect event according to a vulnerability hazard prediction model includes: generating a multidimensional threat feature vector according to the protocol stack layer identifier of the defect event, the attack surface diffusion coefficient, and the state machine backtracking path depth; performing pattern matching on the feature vector through a historical vulnerability knowledge graph to obtain a baseline hazard score for similar vulnerability cases; calculating an environmental correction factor according to the resource occupancy rate of the current test environment; performing threat propagation simulation on the variant edges associated with the defect event to generate a risk pollution index across state nodes; inputting the baseline hazard score, the environmental correction factor, and the risk pollution index into a nonlinear scoring aggregator, and dynamically reducing the impact weights of historical vulnerabilities through a time decay function to output a potential danger score for the defect event.

[0032] Specifically, in this embodiment, during the analysis of defect events, it is first necessary to construct a multi-dimensional threat feature vector based on the corresponding protocol stack layer identifier, attack surface diffusion coefficient, and state machine backtracking path depth. The protocol stack layer identifier is used to indicate the network protocol layer where the defect event occurs. For example, in the OSI model, if a defect occurs in the transport layer, it may affect the reliability of TCP or UDP, and if the defect occurs in the application layer, it may involve business logic vulnerabilities of protocols such as HTTP and DNS. The attack surface diffusion coefficient is used to measure the impact range of the defect within the system. Its calculation method combines the upstream and downstream dependencies affected by the vulnerability. For example, a key negotiation vulnerability in a TLS handshake process may affect multiple subsequent encrypted communication stages, resulting in a higher attack surface diffusion coefficient. The state machine backtracking path depth is used to describe the propagation path of the defect in the protocol state machine. For example, if the vulnerability only affects the current state but not the preceding or subsequent state, the backtracking depth is low, and if the vulnerability can backtrack to affect multiple previous states, such as the bypass vulnerability in the identity authentication stage affects the entire subsequent session, then the backtracking path depth is high. Based on these feature data, a multi-dimensional threat feature vector is constructed to quantify the impact scope and propagation characteristics of the defect event. The feature vector is pattern matched through the historical vulnerability knowledge graph to obtain the baseline hazard score of similar vulnerability cases. The knowledge graph is a database that stores vulnerability information in a graph structure, which contains the feature descriptions, attack methods, impact scope and repair suggestions of historical security vulnerabilities. For example, if the vulnerability currently being analyzed is highly similar to a known buffer overflow vulnerability in the feature vector, the historical hazard score of the vulnerability can be used as a reference as the baseline score. This matching process uses vector similarity calculation methods, such as Euclidean distance or cosine similarity, to measure the similarity between the current defect event and the historical vulnerability, and determines the baseline score through a weight distribution strategy.

[0033] The environment correction factor is calculated based on the resource utilization of the current test environment. This factor is used to adjust the baseline score to make it consistent with the actual situation of the test environment. If the system resource utilization is high, such as CPU and memory usage close to the peak, it indicates that the system is in a high-load state. At this time, some defects may aggravate system instability, so the hazard score needs to be appropriately increased. Conversely, if the system is in a low-load state, the immediate impact of the vulnerability may be low, so the score can be appropriately reduced. At the same time, the threat propagation simulation is performed on the variant edges associated with the defect event to generate a risk pollution index across state nodes. The variant edge refers to the state transition path generated by a vulnerability or abnormal input in the protocol state machine model. The threat propagation simulation is based on the Markov process or random walk algorithm to simulate the defect propagation behavior in the state machine and calculate its impact range. For example, in the DNS resolution process, if an abnormal value of an input field can cause multiple subsequent queries to fail, the risk pollution index of the variant edge is high, indicating that it may affect multiple state nodes. Finally, the baseline hazard score, environmental correction factor, and risk pollution index are input into the nonlinear scoring aggregator, and the impact weight of the historical vulnerability is dynamically reduced through the time decay function to output the potential hazard score of the defect event. The nonlinear scoring aggregator uses weighted summation or neural network methods to comprehensively calculate multiple risk indicators to ensure that the score can fully reflect the potential harm of the vulnerability. The time decay function is used to dynamically reduce the impact of historical vulnerabilities to avoid excessive interference of outdated cases on the scoring results. For example, for a SQL injection vulnerability from ten years ago, its impact weight will gradually decay over time to ensure that the score is more in line with the actual situation of the current security environment. The potential hazard score finally generated can be used to prioritize vulnerabilities, thereby guiding subsequent security repair decisions.

[0034] Step 150: When the potential risk score exceeds the dynamic threshold, suspend the protocol fuzzy test according to the intelligent suspension decision.

[0035] Specifically, when the potential risk score of a defect event exceeds the previously generated dynamic threshold, the system triggers an intelligent pause decision mechanism. At this point, all key data at the test site (including the current weight matrix of the weighted state machine, defect feature fingerprints, and queues of mutation strategies to be executed) will be saved as a complete snapshot in non-volatile memory, and the resource recovery process will be started to release network connections and encryption and decryption resources, but the minimum protocol session will still be retained to maintain the system heartbeat. The pause decision formed in this way not only ensures that the test task is automatically interrupted before the risk accumulates to a certain critical value, but also provides a reliable recovery basis for subsequent self-optimization of test strategies and incremental restart. The entire process forms a closed-loop system, from dynamic threshold generation to risk assessment to intelligent pause decision-making, and each link is organically connected to ensure the efficiency and security of protocol fuzz testing.

[0036] In an optional implementation of the present embodiment, the step of pausing the protocol fuzzy test according to the intelligent pause decision includes: generating a dynamic distribution map reflecting the density of the test activity according to the protocol path coverage data and the field variation intensity value triggered by the current test case; prioritizing the state nodes occupying system resources in the weighted state machine model based on the distribution pattern of the high-density areas in the dynamic distribution map, and generating a phased pause queue; gradually releasing the target test thread according to the priority order of the phased pause queue, and saving the complete running state of the thread before releasing.

[0037] Specifically, in this embodiment, during the test process, by analyzing the protocol path coverage data and field variation strength value triggered by the current test case, a dynamic distribution diagram can be constructed to reflect the density of the test activity. The protocol path coverage data records the protocol state nodes accessed during the test process and their transfer relationships. For example, when testing the HTTP protocol, if a test case triggers multiple key states such as request parsing, identity authentication, and session management, the coverage data can reflect the response of the protocol in different states. The field variation strength value is used to quantify the degree of modification of the protocol field by the test case. For example, if the amplitude of operations such as adding random noise, inserting boundary values, or adjusting the data format in the input data is large, the variation strength value is high. By statistically analyzing these data, a dynamic distribution diagram of the test activity can be drawn, in which the high-density area indicates that there are more protocol states triggered in the test set, and the low-density area indicates that the state coverage is less or the test impact is weaker. Based on the distribution law of the high-density area of ​​the dynamic distribution diagram, the state nodes in the weighted state machine model can be further prioritized. The weighted state machine model assigns each state node a corresponding weight to reflect its occupation of system resources. For example, during the TLS handshake process, the key negotiation phase may occupy a high CPU computing resource, while during the DNS resolution process, a large number of domain name queries may lead to high network bandwidth consumption. Therefore, by analyzing the distribution of high-density areas, those state nodes that are frequently accessed and have high resource usage can be identified and prioritized accordingly to optimize the test execution strategy later. After determining the priority order, a phased pause queue is constructed to reasonably schedule system resources during the test process. The phased pause queue is used to control the execution order of test threads to ensure that resource-intensive state nodes do not occupy too much computing power at the same time. For example, when testing the HTTP protocol, if multiple test threads execute requests involving cryptographic operations at the same time, the CPU usage may soar, thereby affecting the stability of the test. To solve this problem, state nodes that occupy higher resources can be assigned to different execution stages according to the priority order, and dynamic allocation of resources can be achieved through pause and release strategies.

[0038] During the specific execution process, the target test thread is gradually released according to the priority order of the staged pause queue, and the complete running state of the thread is saved before release. The order of thread release follows the result of priority sorting, that is, low-priority threads need to wait for high-priority threads to complete execution or reduce resource occupancy before they can continue to execute. For example, when testing the FTP protocol, if the resource occupancy of the file transfer status node is high, the test task of the control connection can be executed first, and the file transfer thread can be released at an appropriate time to avoid excessive consumption of bandwidth. Before releasing the test thread, its complete running state needs to be saved, including the currently executed test case, the covered protocol path, the history of the mutated field, and the generated test data, to ensure that the thread can continue to run from the interruption point when resuming execution, thereby improving the continuity and efficiency of the test.

[0039] In an optional implementation of the present embodiment, a correlation matrix between the mutation fields of the protocol fuzzy test and the potential risk scores is determined based on the state data corresponding to the complete running state; based on the entropy distribution characteristics of the correlation matrix, the mutation edge generation rules of the weighted state machine model are reversely gradient corrected to generate a mutation strategy update weight table; according to the field heat attenuation factor in the mutation strategy update weight table, the probability distribution parameters of the test case generator are reconstructed to generate an adaptive mutation seed pool; the adaptive mutation seed pool is mapped to the resource allocation priority queue of the unpaused test thread through the dynamic scheduler, and the closed-loop feedback mechanism of the test strategy is activated.

[0040] Specifically, in this embodiment, during the protocol fuzzy test, by analyzing the state data corresponding to the complete running state, the correlation matrix between the mutated field and the potential risk score can be determined, which is used to quantify the impact of the degree of mutation of a specific field on the security of the protocol. The state data includes the field mutation history, protocol path coverage, and triggered defect events recorded during the execution of the test case. For example, when testing the HTTPS protocol, if the mutated field involves certificate parsing or key exchange, and the mutation causes a protocol crash or resource exhaustion, it means that the field is strongly associated with a high-risk vulnerability, so it is necessary to give a higher weight in the correlation matrix. After constructing the correlation matrix, the mutation edge generation rule in the weighted state machine model can be reversed based on its entropy distribution characteristics. The entropy distribution characteristics are used to measure the degree of influence of the mutated field on the test behavior. If the test result caused by the mutation of a field is highly uncertain, its information entropy is high, indicating that the field may have a strong security risk. For example, in the SIP protocol test, if an unpredictable state jump is triggered by mutating the message header field, the mutation strategy of the field can be adjusted by reverse gradient correction to make it more inclined to trigger abnormal conditions in the critical state. The reverse gradient correction process adjusts the generation probability of mutation edges so that test cases are more inclined to explore high-risk areas, thereby improving the effectiveness of the test.

[0041] Based on the result of reverse gradient correction, a mutation strategy update weight table can be generated, which contains the field heat decay factor, which is used to control the priority distribution of field mutations during the test process. If a field has been frequently mutated in the early stage of the test and failed to trigger a valid defect, the mutation probability of the field can be reduced by setting the heat decay factor, so that more test resources can be allocated to the field that has not been fully tested. For example, in the test of Modbus protocol (an application layer communication protocol used in the field of industrial automation), if the mutation of the start address field does not cause an exception, but the mutation of the function code field leads to undefined behavior, the subsequent test should reduce the mutation frequency of the start address field and increase the mutation weight of the function code field. According to the mutation strategy update weight table, the probability distribution parameters of the test case generator can be reconstructed to generate an adaptive mutation seed pool. The test case generator generates new test cases based on statistical models and heuristic strategies, and the probability distribution parameters determine the mutation weights of different fields. By introducing an adaptive mutation seed pool, it can be ensured that the generation of test cases is more in line with the current test objectives. For example, in the MQTT protocol test, if dynamic analysis finds that the variation of the QoS field (Quality of Service, used to define the service quality level of message delivery) has a greater impact on the stability of message transmission, the variation frequency of this field should be increased, and the random variation of other low-impact fields should be reduced. Finally, the adaptive variation seed pool is mapped to the resource allocation priority queue of the unpaused test thread through the dynamic scheduler, thereby activating the closed-loop feedback mechanism of the test strategy. The dynamic scheduler adjusts the competition strategy of the test thread for computing resources and optimizes the execution order of the test cases based on the real-time feedback of the test process. For example, when testing the IPSec protocol, if the current test thread is analyzing the variation of security parameters in the IKE handshake phase, and another thread is testing the integrity of ESP encrypted data, the resource allocation can be adjusted according to the feedback results to ensure that the test process can not only cover the critical path of the protocol, but also reasonably utilize computing resources, thereby improving the overall efficiency of fuzz testing.

[0042] According to a method for automatically pausing a protocol fuzz test provided by the scheme of the present application, a dynamic threshold adaptive to the protocol characteristics and the test environment is generated according to the initial preset value input by the user; a weighted state machine model of the protocol fuzz test is constructed according to the dynamic threshold; multi-dimensional defect verification is performed through the weighted state machine model to determine the defect events of the protocol fuzz test; the potential risk score of the defect event is judged according to the vulnerability hazard prediction model; when the potential risk score exceeds the dynamic threshold, the protocol fuzz test is suspended according to the intelligent suspension decision. Through the implementation of the scheme of the present application, the defect events of the protocol fuzz test are determined based on the multi-level defect verification of the weighted state machine model, and when the potential risk score of the defect event exceeds the dynamic threshold, the protocol fuzz test is suspended according to the intelligent suspension decision, thereby improving the test efficiency.

[0043] Figure 2 A protocol fuzzy test automatic suspension device is provided in an embodiment of the present application, and the protocol fuzzy test automatic suspension device can be used to implement the protocol fuzzy test automatic suspension method in the above-mentioned embodiment. Figure 2 As shown, the automatic suspension device for protocol fuzz testing mainly includes: A generating module 10, for generating a dynamic threshold adaptive to the protocol characteristics and the test environment according to an initial preset value input by a user; A construction module 20 is used to construct a weighted state machine model for protocol fuzz testing according to a dynamic threshold; A determination module 30 is used to perform multi-dimensional defect verification through a weighted state machine model to determine defect events of the protocol fuzz test; A judgment module 40 is used to judge the potential risk score of the defect event according to the vulnerability risk prediction model; The suspension module 50 is used to suspend the protocol fuzzy test according to the intelligent suspension decision when the potential risk score exceeds the dynamic threshold.

[0044] In an optional implementation of the present embodiment, the generation module is specifically used to: obtain a protocol field complexity vector by parsing the grammatical structure of the target protocol document; generate an initial defect threshold cardinality based on the protocol field complexity vector; generate an environmental noise interference factor by collecting the real-time resource occupancy curve and network round-trip delay sequence of the test target; input the initial defect threshold cardinality and the environmental noise interference factor into a dynamic compensation model to determine a dynamic threshold correction value; perform nonlinear interpolation operations on an initial preset value input by the user based on the dynamic threshold correction value, and output a dynamic threshold that is adaptive to the current protocol characteristics and the test environment.

[0045] In an optional implementation of the present embodiment, the construction module is specifically used for: parsing the target protocol document through a protocol reverse analysis engine to generate a basic state transition diagram; inserting mutant state transfer edges into the basic state transition diagram according to abnormal path records in a historical defect database; determining the dynamic weight value of the mutant state transfer edge according to a dynamic threshold; inputting the dynamic weight value into a state transition probability matrix to construct a weighted state machine model for protocol fuzz testing.

[0046] In an optional implementation of the present embodiment, the determination module is specifically used for: performing a specification matching check on the field structure of the test data packet of the protocol fuzz test through a protocol syntax parser to generate a syntax compliance marking vector; based on the dynamic weight matrix in the weighted state machine model, performing jump legitimacy verification on the state transition path triggered by the test case of the protocol fuzz test; if the deviation value between the actual jump path of the test case and the path marked as a legal path in the weight matrix exceeds a preset deviation threshold, a state exception event is triggered; obtaining the context cache pool of the target protocol during the session; generating a semantic conflict identifier based on the logical contradiction of the test response data in the context cache pool; inputting the syntax compliance marking vector, the state exception event and the semantic conflict identifier into the cross-level verification engine; if the verification results of at least two dimensions point to the same protocol interaction node, it is determined that there is a defect event in the protocol interaction node; wherein the dimensions correspond to the syntax compliance marking vector, the state exception event and the semantic conflict identifier.

[0047] In an optional implementation of the present embodiment, the judgment module is specifically used to: generate a multidimensional threat feature vector based on the protocol stack layer identifier, attack surface diffusion coefficient and state machine backtracking path depth of the defect event; perform pattern matching on the feature vector through the historical vulnerability knowledge graph to obtain the baseline hazard score of similar vulnerability cases; calculate the environmental correction factor based on the resource occupancy rate of the current test environment; perform threat propagation simulation on the variant edges associated with the defect event to generate a risk pollution index across state nodes; input the baseline hazard score, environmental correction factor and risk pollution index into the nonlinear scoring aggregator, and dynamically reduce the impact weight of the historical vulnerability through the time decay function to output the potential danger score of the defect event.

[0048] In an optional implementation of the present embodiment, the pause module is specifically used to: generate a dynamic distribution graph reflecting the density of test activities based on the protocol path coverage data and field variation intensity values ​​triggered by the current test case; prioritize the state nodes occupying system resources in the weighted state machine model based on the distribution pattern of high-density areas in the dynamic distribution graph, and generate a phased pause queue; gradually release the target test thread according to the priority order of the phased pause queue, and save the complete running state of the thread before releasing it.

[0049] In an optional implementation of the present embodiment, the automatic suspension device for protocol fuzz testing also includes: a control module. The control module is used to: determine the correlation matrix between the mutation fields of the protocol fuzz test and the potential risk score based on the state data corresponding to the complete running state; perform reverse gradient correction on the mutation edge generation rules of the weighted state machine model based on the entropy distribution characteristics of the correlation matrix, and generate a mutation strategy update weight table; reconstruct the probability distribution parameters of the test case generator based on the field heat attenuation factor in the mutation strategy update weight table, and generate an adaptive mutation seed pool; map the adaptive mutation seed pool to the resource allocation priority queue of the unsuspended test thread through the dynamic scheduler, and activate the closed-loop feedback mechanism of the test strategy.

[0050] According to the automatic suspension device for protocol fuzz testing provided by the scheme of the present application, a dynamic threshold adaptive to the protocol characteristics and the test environment is generated according to the initial preset value input by the user; a weighted state machine model of the protocol fuzz testing is constructed according to the dynamic threshold; multi-dimensional defect verification is performed through the weighted state machine model to determine the defect events of the protocol fuzz testing; the potential risk score of the defect event is judged according to the vulnerability hazard prediction model; when the potential risk score exceeds the dynamic threshold, the protocol fuzz testing is suspended according to the intelligent suspension decision. Through the implementation of the scheme of the present application, the defect events of the protocol fuzz testing are determined based on the multi-level defect verification of the weighted state machine model, and when the potential risk score of the defect event exceeds the dynamic threshold, the protocol fuzz testing is suspended according to the intelligent suspension decision, thereby improving the test efficiency.

[0051] According to the application plan provided Figure 3 An electronic device provided in an embodiment of the present application. The electronic device can be used to implement the automatic suspension method of the protocol fuzzy test in the aforementioned embodiment, mainly comprising: The memory 301, the processor 302 and the computer program 303 stored in the memory 301 and executable on the processor 302, the memory 301 and the processor 302 are connected by communication. When the processor 302 executes the computer program 303, the automatic suspension method of the protocol fuzzy test in the above embodiment is implemented. The number of processors can be one or more.

[0052] The memory 301 may be a high-speed random access memory (RAM) memory, or a non-volatile memory (non-volatile memory), such as a disk memory. The memory 301 is used to store executable program codes, and the processor 302 is coupled to the memory 301 .

[0053] Furthermore, the present application also provides a computer-readable storage medium, which may be provided in the electronic device in the above embodiments. Figure 3 Memory in the illustrated embodiment.

[0054] The computer readable storage medium stores a computer program, and when the program is executed by the processor, the automatic suspension method of the protocol fuzz test in the aforementioned embodiment is implemented. Furthermore, the computer storable medium can also be a U disk, a mobile hard disk, a read-only memory (ROM), a RAM, a magnetic disk or an optical disk, and other media that can store program codes.

[0055] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0056] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0057] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A protocol fuzz test automatic suspension method, characterized in that: include: Generate a dynamic threshold adaptive to the protocol characteristics and the test environment according to the initial preset value input by the user; Constructing a weighted state machine model for protocol fuzz testing according to the dynamic threshold; Perform multi-dimensional defect verification through the weighted state machine model to determine defect events of the protocol fuzz test; Determine the potential risk score of the defect event according to the vulnerability risk prediction model; When the potential risk score exceeds the dynamic threshold, the protocol fuzz testing is suspended according to an intelligent suspension decision.

2. The automatic suspension method for protocol fuzz testing according to claim 1 is characterized in that: The step of generating a dynamic threshold adaptive to the protocol characteristics and the test environment according to the initial preset value input by the user includes: Obtain the protocol field complexity vector by parsing the grammatical structure of the target protocol document; generating an initial defect threshold base according to the protocol field complexity vector; Generate environmental noise interference factors by collecting the real-time resource utilization curve and network round-trip delay sequence of the test target; Inputting the initial defect threshold base and the environmental noise interference factor into a dynamic compensation model to determine a dynamic threshold correction value; Based on the dynamic threshold correction value, a nonlinear interpolation operation is performed on the initial preset value input by the user to generate a dynamic threshold that is adaptive to the current protocol characteristics and the test environment.

3. The automatic suspension method for protocol fuzz testing according to claim 1 is characterized in that: The step of constructing a weighted state machine model for protocol fuzz testing according to the dynamic threshold comprises: Parse the target protocol document through the protocol reverse analysis engine to generate a basic state transition diagram; Inserting a variant state transition edge in the basic state transition graph according to the abnormal path record in the historical defect database; Determine the dynamic weight value of the mutation state transfer edge according to the dynamic threshold; The dynamic weight value is input into the state transition probability matrix to construct a weighted state machine model for protocol fuzz testing.

4. The automatic suspension method for protocol fuzz testing according to claim 1 is characterized in that: The step of performing multi-dimensional defect verification through the weighted state machine model to determine the defect event of the protocol fuzz test includes: Performing a specification match check on the field structure of the test data packet of the protocol fuzz test through a protocol syntax parser to generate a syntax compliance tag vector; Based on the dynamic weight matrix in the weighted state machine model, the state transition path triggered by the test case of the protocol fuzz test is verified for jump legitimacy; If the deviation value between the actual jump path of the test case and the path marked as legal in the weight matrix exceeds a preset deviation threshold, a state abnormality event is triggered; Obtaining a context cache pool of the target protocol during a session; Generate a semantic conflict identifier according to the logical contradiction of the test response data in the context buffer pool; Inputting the grammatical compliance mark vector, the state exception event and the semantic conflict identifier into a cross-level verification engine; If the verification results of at least two dimensions point to the same protocol interaction node, it is determined that a defect event exists in the protocol interaction node.

5. The automatic suspension method for protocol fuzz testing according to claim 4 is characterized in that: The step of determining the potential risk score of the defect event according to the vulnerability risk prediction model comprises: Generate a multi-dimensional threat feature vector according to the protocol stack layer identifier, attack surface diffusion coefficient and state machine backtracking path depth of the defect event; Performing pattern matching on the feature vectors through the historical vulnerability knowledge graph to obtain a baseline hazard score for similar vulnerability cases; Calculate the environment correction factor based on the resource occupancy rate of the current test environment; Perform threat propagation simulation on the variant edges associated with the defect event to generate a risk contamination index across state nodes; The baseline hazard score, environmental correction factor and risk pollution index are input into a nonlinear scoring aggregator, and the impact weights of historical vulnerabilities are dynamically reduced through a time decay function to output a potential hazard score for the defect event.

6. The automatic suspension method for protocol fuzz testing according to claim 1, characterized in that: The step of pausing the protocol fuzz test according to the intelligent suspension decision comprises: Generate a dynamic distribution graph reflecting the density of test activities based on the protocol path coverage data and field variation intensity values ​​triggered by the current test case; Based on the distribution pattern of high-density areas in the dynamic distribution graph, the state nodes occupying system resources in the weighted state machine model are prioritized to generate a phased pause queue; The target test thread is gradually released according to the priority order of the phased suspension queue, and the complete running state of the thread is saved before the release.

7. The automatic suspension method for protocol fuzz testing according to claim 6 is characterized in that: The method further comprises: Determine, according to the status data corresponding to the complete running status, a correlation matrix between the variation fields of the protocol fuzzy test and the potential risk scores; Based on the entropy distribution characteristics of the correlation matrix, reverse gradient correction is performed on the mutation edge generation rule of the weighted state machine model to generate a mutation strategy update weight table; According to the mutation strategy, the field heat attenuation factor in the weight table is updated, the probability distribution parameters of the test case generator are reconstructed, and an adaptive mutation seed pool is generated; The adaptive mutation seed pool is mapped to the resource allocation priority queue of the unpaused test thread through a dynamic scheduler, activating a closed-loop feedback mechanism of the test strategy.

8. A protocol fuzzy test automatic suspension device, characterized in that: The protocol fuzz test automatic suspension device comprises: A generation module, used to generate a dynamic threshold adaptive to the protocol characteristics and the test environment according to an initial preset value input by a user; A construction module, used for constructing a weighted state machine model of the protocol fuzzy test according to the dynamic threshold; A determination module, configured to perform multi-dimensional defect verification through the weighted state machine model to determine defect events of the protocol fuzz test; A judgment module, used to judge the potential risk score of the defect event according to the vulnerability risk prediction model; A pause module is used to pause the protocol fuzzy test according to an intelligent pause decision when the potential risk score exceeds the dynamic threshold.

9. An electronic device, characterized in that: The device comprises a memory and a processor, wherein: The processor is used to execute the computer program stored in the memory; When the processor executes the computer program, the steps in the automatic suspension method of protocol fuzz testing described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps in the automatic suspension method of protocol fuzz testing described in any one of claims 1 to 7 are implemented.

Images