Vulnerability detection method, device, equipment, medium and product

Abstract

The application provides a vulnerability detection method and device, equipment, medium and product, and relates to the technical field of network security. The method comprises the following steps: obtaining a target state machine corresponding to a target protocol program, wherein the target state machine comprises a plurality of protocol states and resource consumption corresponding to each protocol state; determining a target protocol state from the plurality of protocol states; the target protocol state is a protocol state corresponding to the maximum resource consumption in the target state machine; simulating an attack on the target protocol program based on the target protocol state to determine an attack vulnerability type of the target protocol program; the attack vulnerability type is a resource exhaustion type vulnerability or a non-resource exhaustion type vulnerability. In this way, by introducing resource consumption into the state machine and determining the protocol state for attack simulation based on resource consumption, the attack vulnerability type of the target protocol program can be determined, and the attack vulnerability type of the target protocol program can be mined based on the resource consumption between the protocol states, thereby improving the accuracy of vulnerability detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a vulnerability detection method, device, equipment, medium and product. BACKGROUND

[0002] The purpose of a Denial of Service (DoS) attack is to impede the availability of a target. According to the type of vulnerability exploited by the attacker, DoS attacks can be divided into two categories: 1) Crash Attack: this type of attack exploits a vulnerability that can cause the target to crash (such as a segment error) and become unavailable. 2) Resource Exhaustion Attack: this type of attack exploits a resource exhaustion vulnerability, by sending a large number of requests to the target to exhaust its resources, thereby causing legitimate users to be unable to use the service.

[0003] In order to defend against DoS attacks, the prior art proposes a variety of preventive and mitigation measures. However, these measures are designed and tested based on known DoS vulnerabilities, but there is a lack of detection methods for unknown or new DoS vulnerabilities, resulting in inaccurate detection of vulnerabilities. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a vulnerability detection method, device, equipment, medium and product, and to improve the accuracy of vulnerability detection.

[0005] In a first aspect, the embodiments of the present application provide a vulnerability detection method, which comprises:

[0006] Obtaining a target state machine corresponding to a target protocol program, wherein the target state machine comprises a plurality of protocol states and resource consumption corresponding to each protocol state;

[0007] Determining a target protocol state from the plurality of protocol states; the target protocol state is a protocol state corresponding to the maximum resource consumption in the target state machine;

[0008] Based on the target protocol state, simulating an attack on the target protocol program to determine the attack vulnerability type of the target protocol program; the attack vulnerability type is a resource exhaustion type vulnerability or a non-resource exhaustion type vulnerability.

[0009] In some embodiments, obtaining a target state machine corresponding to a target protocol program comprises:

[0010] Based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program, determining a first protocol state from the initial state machine; the parameters include resource consumption;

[0011] fuzz test the first protocol state to obtain a second protocol state and a first resource consumption of the second protocol state; the second protocol state is obtained based on conversion of the first protocol state;

[0012] update the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine.

[0013] In some embodiments, the parameters further include: active times and selected times; and the determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program comprises:

[0014] for each protocol state in the initial state machine corresponding to the target protocol program, inputting the parameters of the protocol state into a target formula to obtain a selection probability value corresponding to the protocol state;

[0015] determining a protocol state corresponding to a maximum value in the selection probability values as the first protocol state;

[0016] wherein the target formula is:

[0017]

[0018] wherein Score(m) represents a selection probability value corresponding to an mth protocol state, MC(m) represents a resource consumption of the mth protocol state, UN(m) represents active times of the mth protocol state, SN(m) represents selected times of the mth protocol state, and m is a positive integer.

[0019] In some embodiments, the parameters further include: selected times;

[0020] the updating the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine comprises:

[0021] in a case where a first condition is met, updating the first resource consumption to the initial state machine, adding 1 to selected times corresponding to the first protocol state in the initial state machine, and returning to perform the determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program until a preset fuzz test stop condition is met to obtain the target state machine;

[0022] wherein the first condition is any one of:

[0023] the initial state machine does not contain the second protocol state;

[0024] The initial state machine includes second resource consumption of the second protocol state, and the second resource consumption is less than the first resource consumption.

[0025] In some embodiments, the parameters further include: selected times;

[0026] The updating of the initial state machine according to the second protocol state and the first resource consumption of the second protocol state comprises:

[0027] In the case where the second condition is met, the selected times corresponding to the first protocol state in the initial state machine are increased by 1, and the parameters of each protocol state in the initial state machine corresponding to the target protocol program are executed, the first protocol state is determined from the initial state machine, until a preset fuzzy test stop condition is met, and the target state machine is obtained.

[0028] The second condition is that the initial state machine includes second resource consumption of the second protocol state, and the second resource consumption is greater than or equal to the first resource consumption.

[0029] In some embodiments, the fuzzy testing of the first protocol state to obtain the second protocol state and the first resource consumption of the second protocol state comprises:

[0030] A first seed corresponding to the first protocol state is determined in an initial seed pool.

[0031] The first seed is mutated to obtain a second seed.

[0032] The second seed is input into the target protocol program to obtain the second protocol state converted from the first protocol state triggered by the second seed and the first resource consumption of the second protocol state.

[0033] In some embodiments, before the parameters of each protocol state in the initial state machine corresponding to the target protocol program are executed to determine the first protocol state from the initial state machine, the detection method further comprises:

[0034] An initial seed pool is obtained.

[0035] The seeds in the initial seed pool are input into the target protocol program in sequence, and the protocol states triggered by each seed and the resource consumption of the protocol state are extracted.

[0036] The initial state machine is constructed based on the protocol states triggered by each seed and the resource consumption of the protocol state.

[0037] In a second aspect, an embodiment of the present application provides a vulnerability detection device, and the vulnerability detection device comprises:

[0038] an obtaining module, configured to obtain a target state machine corresponding to a target protocol program, the target state machine comprising a plurality of protocol states and resource consumption corresponding to each protocol state;

[0039] a determining module, configured to determine a target protocol state from the plurality of protocol states, the target protocol state being a protocol state corresponding to maximum resource consumption in the target state machine;

[0040] a simulating module, configured to perform attack simulation on the target protocol program based on the target protocol state, and determine an attack vulnerability type of the target protocol program, the attack vulnerability type being a resource-exhausting vulnerability or a non-resource-exhausting vulnerability.

[0041] In a third aspect, an electronic device is provided, and the electronic device comprises:

[0042] a memory configured to store instructions; and

[0043] a processor configured to invoke the instructions from the memory and implement the vulnerability detection method provided in the first aspect of the embodiments of the present application when the instructions are executed.

[0044] In a fourth aspect, a machine-readable storage medium is provided, and the machine-readable storage medium stores instructions for causing a machine to perform the vulnerability detection method described above.

[0045] In a fifth aspect, a computer program product is provided, and instructions in the computer program product are executed by a processor of an electronic device to cause the electronic device to perform the vulnerability detection method described above.

[0046] In the embodiments of the present application, first, a target state machine corresponding to a target protocol program is obtained, the target state machine comprising a plurality of protocol states and resource consumption corresponding to each protocol state. Then, a target protocol state is determined from the plurality of protocol states, the target protocol state being a protocol state corresponding to maximum resource consumption in the target state machine. Finally, attack simulation is performed on the target protocol program based on the target protocol state, and an attack vulnerability type of the target protocol program is determined, the attack vulnerability type being a resource-exhausting vulnerability or a non-resource-exhausting vulnerability. In this way, by introducing resource consumption into the state machine and determining the protocol state for attack simulation based on resource consumption, the attack vulnerability type of the target protocol program can be determined, and the attack vulnerability type of the target protocol program can be mined based on resource consumption between protocol states, thereby improving the accuracy of vulnerability detection. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 is a flowchart of the vulnerability detection method provided in the embodiments of the present application;

[0048] Figure 2 is a structural schematic diagram of a vulnerability detection device provided by an embodiment of the present application.

[0049] Figure 3 is a structural schematic diagram of a vulnerability detection system provided by an embodiment of the present application.

[0050] Figure 4 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described clearly below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art belong to the scope of protection of the present application.

[0052] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than that illustrated or described herein, and the objects distinguished by "first", "second", and the like are generally of a kind and are not limited in number, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the front and rear associated objects are in an "or" relationship.

[0053] The vulnerability detection method, device, equipment, medium and product provided by the embodiments of the present application will be described in detail below in conjunction with the drawings and specific embodiments and their application scenarios.

[0054] Please refer to Figure 1 is a flowchart of a vulnerability detection method provided by an embodiment of the present application, which is applied to an electronic device. As shown in Figure 1 , the vulnerability detection method comprises the following steps S100 to S300.

[0055] Step S100: Obtain a target state machine corresponding to a target protocol program, wherein the target state machine comprises a plurality of protocol states and resource consumption corresponding to each protocol state.

[0056] In a vehicle system, there are tens or hundreds of electronic component devices (Electronic Control Unit, ECU), such as a car audio unit (Domain Head Unit, DHU), an antenna unit (Ternary Content Addressable Memory, TCAM), a Bluetooth module (Bluetooth Network Controller Module, BNCM), and the like. These electronic units communicate with each other and with the outside through various protocols. The logic in these electronic units that processes protocols can be referred to as a protocol program. The target protocol program can be understood as a protocol program to be subjected to vulnerability detection.

[0057] In an embodiment of the present application, the state machine can be understood as a model used to describe the transition of the vehicle system between different states. The target state machine can include multiple protocol states and resource consumption corresponding to each protocol state. The protocol state can be understood as the current state of the target protocol program. In an example, the protocol state can include a login success state, a command execution success state, and a file state normal opening data connection port state, and the like. The resource consumption corresponding to the protocol state can be understood as the resource consumption in the transition process of the protocol state. In an example, the resource consumption generated in the process of converting from a first protocol state to a second protocol state can be understood as the resource consumption of the second protocol state.

[0058] Step S200: determining a target protocol state from the multiple protocol states; the target protocol state is a protocol state corresponding to the maximum resource consumption in the target state machine.

[0059] In an embodiment of the present application, the target protocol state can be understood as a protocol state that may trigger a resource exhaustion vulnerability. In the process of protocol state conversion, resource consumption will be accompanied. Excessive resource consumption may lead to resource exhaustion of the target protocol program. Therefore, when determining the target protocol state, the protocol state corresponding to the maximum resource consumption in the target state machine can be determined as the target protocol state.

[0060] Step S300: performing attack simulation on the target protocol program based on the target protocol state, and determining an attack vulnerability type of the target protocol program; the attack vulnerability type is a resource exhaustion vulnerability or a non-resource exhaustion vulnerability.

[0061] In the embodiments of the present application, the attack simulation can be understood as simulating whether the attack input can cause the denial of service of the protocol program under test. In the attack simulation, first, an experimental environment for simulating the denial of service (DoS) is constructed, and the target protocol program is run in the experimental environment. Then, an "attacker" is created to send the constructed attack to the target protocol program. The state of the target protocol program under attack is monitored. Before the attack simulation, the attack simulation can be adjusted by configuring parameters such as system memory limit, monitoring duration, attack time, and attack strength. The system memory limit can determine the maximum memory limit of the experimental environment, the monitoring duration can determine the total time of the simulation, the attack time can determine the time when the attack starts after the experimental environment is set, and the attack strength can determine how many attack input sequences are sent to the target protocol program per second.

[0062] In the embodiments of the present application, after the target protocol state is determined, the attack vulnerability type of the target protocol program can be determined by simulating the attack on the target protocol state. The attack vulnerability type can include a resource exhaustion vulnerability and a non-resource exhaustion vulnerability. Specifically, in an environment with a given resource limit (such as a memory limit of 16G), if excessive resource consumption causes the target protocol program to crash or fail to normally respond to services, it is determined as a resource exhaustion vulnerability. On the contrary, if excessive resource consumption does not cause the target protocol program to crash or fail to normally respond to services, it is determined as a non-resource exhaustion vulnerability.

[0063] Through the above steps S100-S300, the target state machine corresponding to the target protocol program is obtained, the target state machine includes a plurality of protocol states and resource consumption corresponding to each protocol state. Then, the target protocol state is determined from the plurality of protocol states; the target protocol state is the protocol state corresponding to the maximum resource consumption in the target state machine. Finally, the attack simulation is performed on the target protocol program based on the target protocol state, and the attack vulnerability type of the target protocol program is determined; the attack vulnerability type is a resource exhaustion vulnerability or a non-resource exhaustion vulnerability. In this way, by introducing resource consumption into the state machine and determining the protocol state for attack simulation based on resource consumption, the attack vulnerability type of the target protocol program can be determined, and the attack vulnerability type of the target protocol program can be mined based on the resource consumption between the protocol states, thereby improving the accuracy of vulnerability detection.

[0064] In some embodiments, obtaining the target state machine corresponding to the target protocol program includes:

[0065] determining a first protocol state from the initial state machine based on parameters of each protocol state in the initial state machine corresponding to the target protocol program; the parameters include resource consumption;

[0066] fuzz test the first protocol state to obtain a second protocol state and a first resource consumption of the second protocol state; the second protocol state is obtained based on a transition from the first protocol state;

[0067] update the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine.

[0068] Specifically, the initial state machine can be understood as inputting an initial seed in an initial seed pool into a target program for execution, extracting a triggered protocol state, and monitoring resource consumption in each state transition process, and constructing a state machine according to the protocol state and the resource consumption information. In the state machine, a node represents a protocol state, and an edge represents a state transition. An attribute is additionally attached to the initial state machine, which represents the maximum resource consumption in the state transition process.

[0069] In an embodiment of the present application, the first protocol state can be understood as a protocol state selected from the initial state machine. When selecting the first protocol state, selection can be based on parameters of each protocol state in the initial state machine. The parameters of each protocol state in the initial state machine can include, but are not limited to, resource consumption, etc.

[0070] In an embodiment of the present application, fuzz testing can be understood as a testing method for discovering vulnerabilities, crashes, errors, and security weaknesses in a program by providing a large amount of random, invalid, or malformed input data to a protocol program.

[0071] In an embodiment of the present application, resource consumption is introduced into the process of fuzz testing. In addition to observing the execution state of the program, resource consumption in each state transition process is also monitored. When fuzz testing the first protocol state, a seed corresponding to the first protocol state is obtained, and the seed is mutated. Then, the mutated seed is input into the target protocol program, and a second protocol state and a first resource consumption of the second protocol state can be obtained. The first resource consumption of the second protocol state can be understood as resource consumption in the process of transitioning from the first protocol state to the second protocol state.

[0072] In the embodiments of the present application, after obtaining the second protocol state and the first resource consumption of the second protocol state through the fuzzing test, the initial state machine can be updated according to the second protocol state and the first resource consumption of the second protocol state. The initial state machine includes a plurality of protocol states and resource consumptions of the protocol states stored after the fuzzing test based on the seeds in the initial seed pool. In the case that the initial state machine does not include the second protocol state and the first resource consumption of the second protocol state, the second protocol state and the first resource consumption of the second protocol state are added to the initial state machine to obtain an updated state machine, and the protocol state is reselected for the fuzzing test until a preset fuzzing test stop condition is met to obtain a target state machine. The preset fuzzing test stop condition can include, but is not limited to, a preset test number and a preset time.

[0073] In this embodiment, by constructing the target state machine combined with the resource consumption, the protocol state that can cause the resource-exhaustion-type vulnerability can be mined based on the resource consumption between the protocol states.

[0074] In some embodiments, the parameters further include: the active number and the selected number; and the determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program includes:

[0075] For each protocol state in the initial state machine corresponding to the target protocol program, the parameter of the protocol state is input into a target formula to obtain a selection probability value corresponding to the protocol state;

[0076] The protocol state corresponding to the maximum value in the selection probability value is determined as the first protocol state;

[0077] The target formula is:

[0078]

[0079] In the formula, Score(m) represents the selection probability value corresponding to the mth protocol state, MC(m) represents the resource consumption of the mth protocol state, UN(m) represents the active number of the mth protocol state, SN(m) represents the selected number of the mth protocol state, and m is a positive integer.

[0080] Specifically, the parameters of each protocol state in the initial state machine corresponding to the target protocol program can include the active number and the selected number in addition to the resource consumption.

[0081] The resource consumption can be understood as the maximum resource consumption in the protocol state transition process. Intuitively, the seed corresponding to the protocol state with higher resource consumption is more likely to be mutated to find larger resource consumption.

[0082] The number of times of being active can be understood as the number of times that the resource consumption attribute of the protocol state has been updated. The logic is that if the resource consumption attribute of the protocol state is often updated, it is more likely to generate new resource consumption by mutating the seed corresponding to the protocol state.

[0083] The number of times of being selected can be understood as the number of times that the protocol state is selected, or the number of times that the seed corresponding to the protocol state has been selected for mutation. If the protocol state has been selected many times, the protocol state should be avoided from being selected too much to prevent the opportunity of selecting other protocol states from being exhausted.

[0084] In the embodiments of the present application, the selection probability values of the protocol states can be determined according to the resource consumption, the number of times of being active, and the number of times of being selected of the protocol states, and the protocol state corresponding to the maximum value in the selection probability values is determined as the first protocol state. When calculating the selection probability values, the resource consumption, the number of times of being active, and the number of times of being selected of the protocol states can be substituted into formula (1), that is, the target formula:

[0085]

[0086] In the embodiments of the present application, the protocol state with the maximum resource consumption can also be directly determined as the first protocol state.

[0087] In this embodiment, by determining the first protocol state according to the resource consumption, the number of times of being active, and the number of times of being selected of the protocol states, the first protocol state can be determined to be a more optimal protocol state by combining multiple factors.

[0088] In some embodiments, the parameters further include the number of times of being selected;

[0089] The updating of the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain a target state machine includes:

[0090] In the case of satisfying a first condition, the first resource consumption is updated in the initial state machine, the number of times of being selected corresponding to the first protocol state in the initial state machine is incremented by 1, and the parameters of each protocol state in the initial state machine corresponding to the target protocol program are executed, the first protocol state is determined from the initial state machine, until a preset fuzzy test stop condition is satisfied, and the target state machine is obtained;

[0091] The first condition is any one of the following:

[0092] The initial state machine does not contain the second protocol state;

[0093] The initial state machine includes a second resource consumption of the second protocol state, and the second resource consumption is less than the first resource consumption.

[0094] Specifically, the initial state machine includes a plurality of protocol states and resource consumptions of the protocol states stored after the fuzz testing based on the seeds in the initial seed pool. After the second protocol state and the first resource consumption of the second protocol state are obtained through the fuzz testing, it can be determined whether the initial state machine needs to be updated by judging whether the initial state machine includes the second protocol state and the first resource consumption of the second protocol state.

[0095] In the embodiments of the present application, in the case where the initial state machine does not include the second protocol state, the second protocol state and the first resource consumption of the second protocol state are added to the initial state machine. In the updated initial state machine, in addition to the plurality of protocol states and the resource consumptions of the protocol states included in the initial state machine, the second protocol state and the first resource consumption of the second protocol state are also included.

[0096] In the case where the initial state machine includes the second protocol state, in the case where the second resource consumption of the second protocol state included in the initial state machine is less than the first resource consumption generated through the fuzz testing, the first resource consumption is updated to the initial state machine. In the updated initial state machine, in addition to the plurality of protocol states and the resource consumptions of the protocol states included in the initial state machine, the first resource consumption of the second protocol state is also included.

[0097] After the updated initial state machine is obtained, the parameters of each protocol state in the initial state machine corresponding to the target protocol program are returned to determine the first protocol state from the initial state machine. That is, the protocol state is determined based on the updated initial state machine. At this time, in the determination of the new protocol state, the selection frequency of the first protocol state is increased by 1, and the activity frequency of the second protocol state is increased by 1. And the fuzz testing is performed. Until the preset fuzz testing stop condition is met, the target state machine is obtained. The preset fuzz testing stop condition can include but is not limited to a preset test number and a preset time.

[0098] In this embodiment, by updating the initial state machine and performing the loop fuzz testing in the case where the initial state machine does not include the second protocol state or the first resource consumption of the second protocol state, the accuracy of each fuzz testing can be improved.

[0099] In some embodiments, the parameters further include: a selection frequency;

[0100] The updating the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine includes:

[0101] In the case of satisfying the second condition, the selected times corresponding to the first protocol state in the initial state machine is added by 1, and the parameters of each protocol state in the initial state machine corresponding to the target protocol program are returned to determine the first protocol state from the initial state machine until a preset fuzzy test stop condition is satisfied, and the target state machine is obtained.

[0102] The second condition is that the initial state machine contains the second resource consumption of the second protocol state, and the second resource consumption is greater than or equal to the first resource consumption.

[0103] Specifically, the parameters of each protocol state further include selected times. The selected times can be understood as the number of times that the protocol state is selected, or the number of times that the seed corresponding to the protocol state has been selected for mutation. If the protocol state has been selected many times, the protocol state should be avoided from being selected too much to prevent the opportunity of selecting other protocol states from being exhausted.

[0104] In the embodiments of the present application, in the case that the initial state machine contains the second resource consumption of the second protocol state, and the second resource consumption is greater than or equal to the first resource consumption, that is, the resource consumption in the new state transition process is less than the resource consumption stored in the state machine, the initial state machine does not need to be updated. The selected times corresponding to the first protocol state in the initial state machine are added by 1.

[0105] In the embodiments of the present application, after the selected times corresponding to the first protocol state in the initial state machine are added by 1, the parameters of each protocol state in the initial state machine corresponding to the target protocol program are returned to determine the first protocol state from the initial state machine. That is, the first protocol state is determined according to the updated parameters until a preset fuzzy test stop condition is satisfied, and the target state machine is obtained.

[0106] In this embodiment, by updating the parameters of each protocol state in real time, the accuracy of each fuzzy test can be improved.

[0107] In some embodiments, the fuzzy test on the first protocol state to obtain the second protocol state and the first resource consumption of the second protocol state includes:

[0108] A first seed corresponding to the first protocol state is determined in an initial seed pool;

[0109] The first seed is mutated to obtain a second seed;

[0110] The second seed is input into the target protocol program to obtain the second protocol state triggered by the first protocol state and the first resource consumption of the second protocol state.

[0111] Specifically, the embodiment of the present application introduces resource consumption into the process of fuzz testing. When fuzz testing the first protocol state, a first seed corresponding to the first protocol state is first obtained from an initial seed pool. The first seed is then mutated to obtain a mutated seed, i.e., a second seed. The second seed is then input into the target protocol program, and the execution state of the target protocol program is observed. The protocol state triggered by the second seed, i.e., the second protocol state, and the first resource consumption of the second protocol state are extracted.

[0112] In this embodiment, by introducing resource consumption into the framework of fuzz testing, the resource consumption between protocol states in the protocol program can be explored based on resource consumption feedback, and potential resource consumption vulnerabilities can be mined.

[0113] In some embodiments, before determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program, the detection method further comprises:

[0114] obtaining an initial seed pool;

[0115] sequentially inputting the seeds in the initial seed pool into the target protocol program, and extracting the protocol state triggered by each seed and the resource consumption of the protocol state;

[0116] constructing the initial state machine based on the protocol state triggered by each seed and the resource consumption of the protocol state.

[0117] Specifically, before determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program, the initial state machine can be constructed.

[0118] In the embodiment of the present application, before constructing the initial state machine, the materials required for fuzz testing are obtained. These materials can include but are not limited to the target protocol program to be tested, the initial seed pool for fuzz testing, and the state extractor code for extracting the protocol state. First, the seeds in the initial seed pool are sequentially input into the target protocol program, and the protocol state triggered thereby is extracted through the state extractor code, and the resource consumption in each state transition process is monitored. The protocol state and resource consumption corresponding to each seed are used to construct the initial state machine. In the initial state machine, the nodes represent the protocol states, the edges represent the state transitions, and an attribute is attached to represent the maximum resource consumption in the state transition process, thereby improving the accuracy of vulnerability detection.

[0119] In this embodiment, by combining resource consumption to construct the state machine, the accuracy of fuzz testing can be improved.

[0120] See Figure 2FIG. 1 is a structural schematic diagram of a vulnerability detection device provided by an embodiment of the present application. The second aspect of the present application provides a vulnerability detection device 20, which comprises:

[0121] An acquisition module 21 is configured to acquire a target state machine corresponding to a target protocol program, wherein the target state machine comprises a plurality of protocol states and resource consumption corresponding to each protocol state.

[0122] A determination module 22 is configured to determine a target protocol state from the plurality of protocol states, wherein the target protocol state is a protocol state corresponding to maximum resource consumption in the target state machine.

[0123] An emulation module 23 is configured to perform attack emulation on the target protocol program based on the target protocol state, and determine an attack vulnerability type of the target protocol program, wherein the attack vulnerability type is a resource-exhausting vulnerability or a non-resource-exhausting vulnerability.

[0124] The vulnerability detection device 20 provided by the second aspect of the present application can realize each process achieved by the method embodiments and achieve the same beneficial effects. To avoid repetition, details are not described herein.

[0125] FIG. 2 is a structural schematic diagram of a vulnerability detection system provided by an embodiment of the present application. As shown in FIG. 2, the vulnerability detection system comprises the vulnerability detection device 20 and a fuzzing test device 10. Figure 3 Figure 3 As shown in FIG. 2, the vulnerability detection is divided into three stages: before fuzzing test, during fuzzing test and after fuzzing test. Before fuzzing test, a target protocol program to be tested, an initial seed for fuzzing test, a state extractor code for extracting protocol states and a format parser code for parsing a sending request message are acquired. During fuzzing test, a seed is selected by a seed selection module, and the seed is mutated. The mutated seed is input into the target protocol program for execution. The triggered protocol states are extracted by the state extractor code, and the resource consumption in each state transition process is monitored by a monitoring module. The state machine is updated according to the triggered protocol states and the resource consumption of the protocol states, and a state machine combined with resource consumption is obtained. After the fuzzing test ends, the resource consumption state machine describes the resource consumption of the target protocol program in each protocol state. The resource consumption state machine can be used to generate a protocol state that may cause a resource-exhausting DoS attack, and the DoS attack is simulated in a simulation environment to verify whether there is a resource-exhausting vulnerability of the DoS attack.

[0126] FIG. 3 is a structural schematic diagram of a vulnerability detection system provided by another embodiment of the present application. As shown in FIG. 3, the vulnerability detection system comprises the vulnerability detection device 20 and the fuzzing test device 10. Figure 4 ​FIG. 4 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. An embodiment of the present application provides an electronic device 4000, which comprises a processor 4100 and a memory 4200. The memory 4200 stores machine executable instructions capable of being executed by the processor 4100. The processor 4100 can execute the machine executable instructions to implement the vulnerability detection method described above.

[0127] In some embodiments, an embodiment of the present application further provides a machine readable storage medium, which stores instructions. The instructions are executed by a processor to enable the processor to implement the vulnerability detection method described above.

[0128] In some embodiments, an embodiment of the present application further provides a computer program product, which comprises a computer program. The computer program is executed by a processor to implement the vulnerability detection method according to the embodiments described above.

[0129] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage media, etc.) containing computer usable program code.

[0130] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions, which are executed via the processor of the computer or other programmable data processing apparatus, generate a means for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product comprising an instruction means, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0131] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0132] The memory can include non-persistent memory and / or persistent memory, such as flash memory, read-only memory (ROM), and / or other types of nonvolatile memory. The memory is an example of computer-readable media.

[0133] Computer-readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile discs (DVDs) or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0134] It should also be noted that the terms "comprising," "including," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by an "including a" statement does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0135] The above merely provides examples of the present application, but is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of claims of the present application.

[0136] Furthermore, any combination of the various embodiments of the present application can be made, as long as it does not deviate from the idea of the present application, it shall be considered as disclosed by the present application.

Claims

1. A vulnerability detection method characterized by, The vulnerability detection method comprises: obtaining a target state machine corresponding to a target protocol program, wherein the target state machine comprises a plurality of protocol states and resource consumption corresponding to each protocol state; determining a target protocol state from the plurality of protocol states; the target protocol state is a protocol state corresponding to the maximum resource consumption in the target state machine; based on the target protocol state, simulating an attack on the target protocol program to determine the attack vulnerability type of the target protocol program; the attack vulnerability type is a resource exhaustion type vulnerability or a non-resource exhaustion type vulnerability; wherein, the target state machine corresponding to the target protocol program comprises: determining a first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program; the parameters include resource consumption; fuzz testing the first protocol state to obtain a second protocol state and a first resource consumption of the second protocol state; the second protocol state is obtained by converting the first protocol state; updating the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine.

2. The vulnerability detection method of claim 1, wherein, The parameters also include: the number of active times and the number of selected times; determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program comprises: for each protocol state in the initial state machine corresponding to the target protocol program, inputting the parameters of the protocol state into a target formula to obtain a selection probability value corresponding to the protocol state; determining the protocol state corresponding to the maximum value in the selection probability value as the first protocol state; wherein, the target formula is: wherein, Score(m) represents the selection probability value corresponding to the mth protocol state, MC(m) represents the resource consumption of the mth protocol state, UN(m) represents the number of active times of the mth protocol state, SN(m) represents the number of selected times of the mth protocol state, and m is a positive integer.

3. The vulnerability detection method of claim 1, wherein, The parameters also include: the number of selected times; updating the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine comprises: in the case of satisfying a first condition, updating the first resource consumption to the initial state machine, adding 1 to the number of selected times corresponding to the first protocol state in the initial state machine, and returning to execute the step of determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program until a preset fuzz testing stop condition is met to obtain the target state machine; wherein, the first condition is any one of the following: the initial state machine does not contain the second protocol state; the initial state machine contains a second resource consumption of the second protocol state, and the second resource consumption is less than the first resource consumption.

4. The vulnerability detection method of claim 1, wherein, The parameters also include: the number of selected times; updating the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine comprises: In the case of meeting the second condition, the selected number of times corresponding to the first protocol state in the initial state machine is increased by 1, and each protocol state in the initial state machine corresponding to the target protocol program is returned to execute the parameter, the first protocol state is determined from the initial state machine until a preset fuzzy test stop condition is met, and the target state machine is obtained; The second condition is that the initial state machine contains a second resource consumption of the second protocol state, and the second resource consumption is greater than or equal to the first resource consumption.

5. The vulnerability detection method of claim 1, wherein, The fuzzy test on the first protocol state to obtain the second protocol state and the first resource consumption of the second protocol state comprises: Determining a first seed corresponding to the first protocol state in an initial seed pool; Mutating the first seed to obtain a second seed; Inputting the second seed into the target protocol program to obtain the second protocol state triggered by the first protocol state and the first resource consumption of the second protocol state.

6. The vulnerability detection method of claim 1, wherein, Before determining the first protocol state from the initial state machine based on the parameters of each protocol state in the initial state machine corresponding to the target protocol program, the detection method further comprises: Obtaining an initial seed pool; In turn, inputting the seeds in the initial seed pool into the target protocol program to extract the protocol state triggered by each seed and the resource consumption of the protocol state; Based on the protocol state triggered by each seed and the resource consumption of the protocol state, the initial state machine is constructed.

7. A vulnerability detection apparatus characterized by comprising: The vulnerability detection device comprises: An acquisition module configured to acquire a target state machine corresponding to a target protocol program, the target state machine comprising a plurality of protocol states and resource consumption corresponding to each protocol state; A determination module configured to determine a target protocol state from the plurality of protocol states; the target protocol state is the protocol state corresponding to the maximum resource consumption in the target state machine; An simulation module configured to simulate an attack on the target protocol program based on the target protocol state to determine an attack vulnerability type of the target protocol program; the attack vulnerability type is a resource exhaustion type vulnerability or a non-resource exhaustion type vulnerability; The acquisition module is further configured to: Determine a first protocol state from an initial state machine based on parameters of each protocol state in the initial state machine corresponding to the target protocol program; the parameters comprise resource consumption; Perform a fuzzy test on the first protocol state to obtain a second protocol state and a first resource consumption of the second protocol state; the second protocol state is obtained based on the conversion of the first protocol state; Update the initial state machine according to the second protocol state and the first resource consumption of the second protocol state to obtain the target state machine.

8. An electronic device, characterized in that: Comprise: A memory configured to store instructions; And A processor configured to call the instructions from the memory and capable of implementing the vulnerability detection method according to any one of claims 1 to 6 when executing the instructions.

9. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing a machine to perform the vulnerability detection method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, The instructions in the computer program product, when executed by a processor of an electronic device, cause the electronic device to perform the vulnerability detection method of any one of claims 1-6.

Images