An automated analysis method for cross-layer interaction vulnerability of TCP / IP layered model protocol

Abstract

The application provides an automatic analysis method for cross-layer interaction vulnerabilities of TCP / IP layered model protocols, comprising: cleaning, splitting and preprocessing the source code and RFC documents of the TCP / IP protocol stack; based on the preprocessed source code and RFC documents, respectively generating intermediate representations, extracting protocol processing logic and cross-layer interaction processes from the source code to generate an intermediate representation IR-C; extracting protocol state descriptions and logical structures from the RFC documents to generate various intermediate representations IR-Ri; performing differential analysis on IR-C and IR-Ri, checking whether the descriptions of the protocol code and the RFC documents are consistent in the logical layer, identifying potential inconsistencies and adjusting; based on the consistency comparison and adjustment results, expanding from single-layer protocols to cross-layer interaction logic, and constructing a protocol cross-layer interaction state machine; using the generated state machine, automatically generating cross-layer interaction definition documents consistent with the style of the RFC documents. The cross-layer interaction behavior is clearly defined and vulnerability mining is realized, and the efficiency and accuracy of the protocol stack security analysis are improved.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and in particular to an automated analysis method for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol. Background Technology

[0002] Network protocols are the cornerstone of the normal operation of the entire cyberspace. Their main function is to regulate the information exchange methods between network devices, ensuring that messages can be successfully generated, transmitted, and correctly received and understood between devices. To reduce the complexity of development and maintenance, network protocol stacks typically adopt a layered design, with typical structures including the OSI seven-layer model and the TCP / IP four-layer model. Through layering, each protocol layer can independently perform specific functions; for example, the link layer is responsible for frame relay, the IP layer for packet routing, and the transport layer for flow control and reliable transmission. This modular design makes the network protocol stack relatively independent in function and highly scalable. It has also allowed protocols at each layer to undergo long-term development and optimization, resulting in a high degree of security that can withstand various types of network attacks.

[0003] However, the layered design of the protocol stack relies on interactions between layers during data processing, forming a dynamic cross-layer collaborative relationship. This cross-layer interaction makes the network protocol stack more efficient in processing and transmitting data, but it also introduces new security risks. During data transmission and reception, each protocol layer not only needs to complete its own function but also needs to interact with adjacent layers through function calls or interfaces. For example, in the transmission of HTTP messages, it is necessary to sequentially call DNS to resolve the domain name, establish a TCP connection, encapsulate data packets using the IP protocol, obtain the target MAC address using the ARP protocol, and possibly use the ICMP protocol for debugging or feedback. While this inter-layer collaboration improves the flexibility of the protocol stack, it also makes cross-layer call behavior unpredictable, increasing the possibility of network attacks.

[0004] Existing analysis tools and methods mostly focus on analyzing the functional implementation of a single layer of the protocol stack, typically based on the RFC documents of that single-layer protocol, performing static analysis, fuzzing, or symbolic execution. However, for automated analysis of potential security issues at the protocol stack code level and during cross-layer interactions, the following technical bottlenecks still exist:

[0005] (1) Complexity of cross-layer interaction behavior: The function call chain in cross-layer interaction can be very complex, including forward processing such as data encapsulation and routing, as well as reverse paths such as exception handling and state feedback. Traditional analysis methods cannot effectively capture the state transmission logic and dependencies in cross-layer interaction.

[0006] (2) Limitations of a single-layer perspective: Existing analysis methods often focus on the implementation of a single protocol, ignoring the dependencies and synergies between protocols. This makes it impossible to fully explore potential security vulnerabilities in the cross-layer interaction process of the protocol stack.

[0007] (3) Lack of automated analysis tools: Although existing analysis methods can perform some vulnerability mining on single-layer protocol code, there is almost no comprehensive automated analysis tool for cross-layer interaction code, especially in dynamic analysis and state machine modeling.

[0008] Currently, vulnerabilities in cross-layer interactions of network protocol stacks have gradually become a key area of ​​cybersecurity research. However, due to the complexity and uncertainty of cross-layer interactions, even if a single-layer protocol is sufficiently secure, it is difficult to avoid potential security risks arising from cross-layer interactions. Therefore, there is an urgent need for an automated analysis method for cross-layer interaction behavior of protocol stacks to efficiently discover and resolve security issues in the cross-layer interaction process. Summary of the Invention

[0009] This application aims to at least partially address one of the technical problems in the related art.

[0010] Therefore, the first objective of this application is to propose an automated analysis method for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol.

[0011] The second objective of this application is to propose an automated analysis device for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol.

[0012] The third objective of this application is to propose an electronic device.

[0013] The fourth objective of this application is to provide a computer-readable storage medium.

[0014] The fifth objective of this application is to provide a computer program product.

[0015] To achieve the above objectives, the first aspect of this application proposes an automated analysis method for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol, characterized by comprising the following steps:

[0016] The source code and RFC documents of the TCP / IP protocol stack are cleaned, disassembled, and preprocessed to extract the core information of protocol design and implementation;

[0017] Based on the preprocessed source code and RFC documents, intermediate representations are generated respectively. Specifically, the protocol processing logic and cross-layer interaction process are extracted from the source code to generate the protocol processing intermediate representation IR-C; the protocol state description and logical structure are extracted from the RFC documents to generate multiple intermediate representations IR-Ri.

[0018] Perform differential analysis on IR-C and IR-Ri to check whether the descriptions of the protocol code and RFC documents are consistent at the logical level, identify potential inconsistencies between the code and the documents, and make corresponding adjustments.

[0019] Based on the results of consistency comparison and adjustment, the protocol is extended from single-layer protocol to cross-layer protocol interaction, and a protocol cross-layer interaction state machine describing the cross-layer interaction logic is constructed.

[0020] Using the cross-layer interaction state machine of the aforementioned protocol, a cross-layer interaction definition document conforming to the style of an RFC document is generated.

[0021] Optionally, the cleaning, splitting, and preprocessing of the TCP / IP protocol stack source code and RFC documents includes:

[0022] The source code is parsed by functional module to extract the data packet structure, state definition, event handling function and state transition logic related to the protocol implementation;

[0023] The RFC document is broken down into state definitions, packet structures, event handling logic, and state transition diagrams, and content irrelevant to the protocol design is filtered out.

[0024] Optionally, the intermediate representations generated based on the preprocessed source code and RFC document include:

[0025] For the source code, by designing a Prompt adapted to the characteristics of the network protocol stack, and using the text analysis capabilities of a large language model to extract key logical information from the kernel protocol stack code, an intermediate representation IR-C representing the protocol processing and cross-layer interaction process is constructed.

[0026] For RFC documents, domain-specific language and syntax analysis techniques are used to parse the protocol logic and detect ambiguities in the description, generating multiple intermediate representations IR-Ri to address ambiguity.

[0027] Optionally, the extraction of key logical information from the kernel protocol stack code using the text analysis capabilities of a large language model includes:

[0028] Extract the packet header structure and field information of the protocol, and generate the corresponding packet header status information;

[0029] Analyze the logic of the protocol processing functions and extract the processes related to protocol state transitions;

[0030] Identify the key code paths in the protocol implementation that interact with other protocol layers, and extract the logic for cross-layer information transmission.

[0031] Optionally, the differential analysis of IR-C and IR-Ri, checking whether the logical descriptions of the protocol code and RFC documents are consistent, identifying potential inconsistencies between the code and the documents and making corresponding adjustments, includes:

[0032] Using a large language model combined with Prompt, differential analysis was performed on IR-C and IR-Ri. By comparing their symbols, logic structures and control flow graphs, the consistency between the protocol code and the RFC document at the logical level was checked.

[0033] Logical discrepancies discovered in labeled differential analysis;

[0034] Adjustments were made to the ambiguous descriptions in the RFC documents to eliminate inconsistencies caused by the ambiguity of natural language, and the implementation logic of the source code was modified as needed to ensure consistency between IR-C and IR-Ri at the logical level.

[0035] Optionally, the logical differences detected during the differential analysis process include:

[0036] The logical descriptions defined in the RFC document are misaligned with the symbols used in the code implementation;

[0037] Ambiguity issues arising from natural language ambiguity in RFC documents;

[0038] Protocol logic vulnerabilities not covered in the code implementation.

[0039] Optionally, based on the results of consistency comparison and adjustment, the process extends from single-layer protocol to cross-layer protocol interaction, constructing a protocol cross-layer interaction state machine describing the cross-layer interaction logic, including:

[0040] Based on the intermediate representation IR-R of the RFC specification obtained after consistency adjustment, supervised model training from IR-C to IR-R is performed.

[0041] Based on the trained model, the intermediate representation IR-C of cross-layer interaction is generated by taking the cross-layer interaction code of the protocol stack as input.

[0042] The generated IR-C is used as a representation of the protocol's cross-layer interaction state machine to describe the protocol's cross-layer interaction logic.

[0043] Optional, also includes:

[0044] The cross-layer interaction state machine of the protocol is visualized using visualization tools.

[0045] Optionally, generating a cross-layer interaction definition document conforming to the RFC document style using the cross-layer interaction state machine of the protocol includes:

[0046] Based on the generated cross-layer interaction state machine of the protocol, IR-C is processed through a large language model to generate a cross-layer interaction definition document consistent with the style of RFC documents.

[0047] To achieve the above objectives, a second aspect of this application provides an automated analysis apparatus for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol, comprising:

[0048] The source code and RFC document parsing module is used to clean, split, and preprocess the source code and RFC documents of the TCP / IP protocol stack, and extract the core information of the protocol design and implementation.

[0049] The intermediate representation generation module is used to generate intermediate representations based on the preprocessed source code and RFC documents, respectively. Specifically, it extracts the protocol processing logic and cross-layer interaction flow from the source code to generate the protocol processing intermediate representation IR-C; and it extracts the protocol state description and logical structure from the RFC documents to generate multiple intermediate representations IR-Ri.

[0050] The middle section represents the consistency detection module, which performs differential analysis on IR-C and IR-Ri to check whether the descriptions of the protocol code and RFC documents are consistent at the logical level, identify potential inconsistencies between the code and the documents, and make corresponding adjustments.

[0051] The cross-layer interaction state machine generation module is used to extend from single-layer protocols to cross-layer protocol interactions based on the results of consistency comparison and adjustment, and to construct a protocol cross-layer interaction state machine that describes the cross-layer interaction logic.

[0052] The cross-layer interaction document generation module is used to generate a cross-layer interaction definition document that conforms to the RFC document style by utilizing the cross-layer interaction state machine of the protocol.

[0053] To achieve the above objectives, a third aspect of this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0054] The memory stores computer-executed instructions;

[0055] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0056] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0057] To achieve the above objectives, a fifth aspect of this application provides a computer program product that, when executed by a processor, implements the method described in any one of the first aspects.

[0058] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0059] This application proposes an automated method for analyzing cross-layer interaction vulnerabilities in network protocol stacks by combining Large Language Model (LLM) and fuzzing techniques. By cleaning and preprocessing the protocol stack source code and RFC documents, intermediate representations IR-C and IR-Ri are generated, and consistency checks and adjustments are performed to identify and fix inconsistencies between the protocol code and the RFC documents. This application constructs a cross-layer interaction state machine, explicitly describing the cross-layer interaction logic, and automatically generates cross-layer interaction definition documents consistent with the style of the RFC documents. Through automated scanning and analysis, hidden high-risk vulnerabilities in the target protocol stack can be effectively discovered and fixed, significantly improving the security and robustness of the protocol stack. This method is applicable to the security analysis of TCP / IP protocol stacks and other complex network protocols.

[0060] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0061] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0062] Figure 1 A flowchart illustrating an automated analysis method for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol, provided as an embodiment of this application;

[0063] Figure 2 This is a schematic diagram of the structure of an automated analysis device for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol, provided in an embodiment of this application. Detailed Implementation

[0064] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0065] To address the problems existing in the prior art, embodiments of this application provide an automated analysis method for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol. Figure 1 This is a flowchart illustrating an automated analysis method for cross-layer interaction vulnerabilities in the TCP / IP layered model, provided as an embodiment of this application. Figure 1 As shown, the method includes the following steps:

[0066] Step 101 involves cleaning, splitting, and preprocessing the source code and RFC documents of the TCP / IP protocol stack to extract the core information of the protocol design and implementation.

[0067] This step mainly involves systematically cleaning, disassembling, and preprocessing the source code and RFC documents of the TCP / IP protocol stack to extract key information from the protocol design and implementation, laying the data foundation for the subsequent generation of intermediate representations and consistency checks.

[0068] First, for the source code, we analyze its functional modules to extract the core content directly related to the protocol implementation. Specifically, this includes: extracting the protocol's data packet structure, such as the definition of header fields, field types, and their logical relationships; extracting the protocol's state definitions, including the protocol's initial state, event triggering conditions, and transition relationships between states; parsing the protocol's event handling functions, such as handler functions for parsing and processing different message types; and extracting the protocol's state transition logic, such as explicit or implicit state switching in function calls.

[0069] Taking the ICMP protocol as an example, the source code can be further divided into four parts: ICMP type & code, ICMP control handler, processing functions, and transfer functions. Through cleaning and preprocessing, redundant code unrelated to the protocol logic is eliminated, retaining only the core functional implementation parts, providing high-quality data input for the subsequent generation of the intermediate representation IR-C.

[0070] Secondly, the RFC document section is broken down and extracted based on state definitions, packet structure, event handling logic, and state transition diagrams. RFC documents typically contain protocol specifications, design principles, and reference information; some content is irrelevant to the analysis, therefore irrelevant sections such as the table of contents, author information, acknowledgments, and references need to be filtered out. When extracting effective information, a heuristic search method is used to quickly locate core content by filtering specific text features (such as "_handler", "+-----+", etc.). Specific processing includes: extracting protocol states and their logical relationships defined in the RFC, such as the state descriptions of different message types (e.g., Echo Request and Echo Reply) in the ICMP protocol; extracting packet structure information, such as the definitions and logic of header fields (e.g., Type, Code, Checksum); extracting event handling logic, such as the complete process of message reception, verification, processing, and response; and extracting state transition diagrams (data flow diagrams), such as the triggering conditions and path relationships between different protocol states.

[0071] Taking the ICMP protocol as an example, the RFC document can be divided into four parts: state definition, packet structure, event handling, and state transition diagram, which are then cleaned and segmented. The state definition section describes the states of different ICMP messages and their triggering conditions; the packet structure section clarifies the functions and logical relationships of the fields in the ICMP header; the event handling section defines in detail the specific behaviors of ICMP messages during reception and processing; and the state transition diagram section provides a complete description of the transition process of ICMP messages between various states.

[0072] Through the above steps, the source code and RFC documents are cleaned, split, and preprocessed, and the core logic and design elements of the protocol are extracted into standardized input data. This ensures that the intermediate representation IR-C generated from the source code and the intermediate representation IR-Ri generated from the RFC documents have a high-quality content foundation, providing a reliable guarantee for subsequent consistency testing and vulnerability analysis.

[0073] Step 102: Based on the preprocessed source code and RFC document, generate intermediate representations respectively, including: extracting the protocol processing logic and cross-layer interaction process from the source code to generate the protocol processing intermediate representation IR-C; and extracting the protocol state description and logical structure from the RFC document to generate multiple intermediate representations IR-Ri.

[0074] After preprocessing the source code and RFC documents, the goal of this step is to generate two types of intermediate representations by using Prompt and syntax analysis techniques adapted to the characteristics of the network protocol stack: IR-C is used to represent the protocol processing logic and cross-layer interaction flow, and IR-Ri is used to represent the protocol state and logical structure in the RFC documents, providing a foundation for subsequent consistency checks.

[0075] In this embodiment, for the source code, a Prompt adapted to the characteristics of the network protocol stack is designed, and the text analysis capabilities of the Large Language Model (LLM) are used to extract key logical information from the kernel protocol stack code to construct the intermediate representation IR-C. The extracted content includes the following three core aspects:

[0076] (1) Extract the header structure and field information of the protocol: Analyze the protocol header definition, extract the function and data type of each field, and generate the header status information of the protocol.

[0077] (2) Analyze the logic of the protocol processing function: Analyze the protocol processing function, extract the process related to state transition in the protocol implementation, and clarify the input and output conditions of different states.

[0078] (3) Identify the key code paths that interact with other protocol layers in the protocol: For function calls involving cross-layer interaction in the protocol, extract the logical paths of cross-layer information transmission, including the dependencies between upper and lower layers and the interface call methods.

[0079] In practical implementation, the Prompt design requires layer-by-layer parsing of different code sections (such as packet headers, state transition logic, and cross-layer interaction functions). LLM extracts key information step by step through iterative interactions. To address the input length limitations of LLM, the code needs to be reasonably divided into blocks based on the token size during code cleaning, and the results are then merged after extraction. Ultimately, IR-C clearly describes the core logic of the protocol code through a comprehensive analysis of packet header state information, protocol processing logic, and cross-layer interaction processes.

[0080] For RFC documents, this application embodiment uses a domain-specific language (DSL) and syntax analysis techniques to parse the logical structure of the protocol and construct multiple intermediate representations IR-Ri. Specific implementations include:

[0081] (1) The protocol state definitions, event responses, data packet structures and state transition diagrams described in the RFC document are parsed in blocks to extract the core content.

[0082] (2) Detect natural language ambiguity in the document, such as the ambiguity of the same field in different scenarios, and generate multiple possible interpretation versions through LLM.

[0083] (3) For ambiguous sentences, multiple intermediate representations (IR-Ri) are generated by combining domain-specific languages ​​and LLM syntax analysis functions to ensure coverage of all possible logical branches in the RFC document.

[0084] It should be noted that, in order to maintain the consistency of IR-C and IR-Ri at the logical level during the generation of intermediate representations, this step uses LLM to uniformly generate the two types of intermediate representations, rather than using other intermediate representation methods (such as LLVM IR). IR-C and IR-Ri can be represented in the form of data flow graphs and control flow graphs, which facilitates subsequent differential analysis and consistency checks.

[0085] Using the methods described above, the generated IR-C comprehensively describes the processing logic and cross-layer interaction flow of the protocol source code, while IR-Ri extracts the protocol's state description and logical structure from the RFC document. This unified modeling lays the foundation for subsequent steps such as differential analysis, consistency checks, and vulnerability discovery.

[0086] Step 103: Perform differential analysis on IR-C and IR-Ri to check whether the descriptions of the protocol code and RFC documents are consistent at the logical level, identify potential inconsistencies between the code and the documents, and make corresponding adjustments.

[0087] This step involves performing differential analysis on the intermediate representation IR-C generated from the source code and the intermediate representation IR-Ri generated from the RFC document. This checks whether their logical descriptions are consistent, marks potential inconsistencies, and adjusts the RFC document and code implementation as needed to ensure logical consistency in the protocol design and implementation.

[0088] Although IR-C and IR-Ri originate from code and RFC documents respectively, and belong to the same logical level, they often suffer from symbol misalignment. For example, in the ICMP protocol, the RFC document might define the "redirect" operation as an explanatory description, while the code implements it as the icmp_redirect function. Differential analysis can identify this symbolic inconsistency, and by combining a Large Language Model (LLM) and Prompt, the symbolic relationship between the two can be gradually aligned.

[0089] First, using a large language model combined with Prompt, a logical comparison is performed between IR-C and IR-Ri to analyze their differences in protocol state definitions, event handling logic, and control flow graphs. For example, in the ICMP protocol, the RFC document might use "redirect" to describe an operation, while the code implements it as the `icmp_redirect` function. This misalignment of symbols needs to be marked through comparison, and corresponding symbol mapping relationships generated. Furthermore, differential analysis addresses the ambiguity of natural language descriptions in RFC documents; for example, the same logical description might be interpreted in different ways. By comparing the generation of multiple IR-Ris, a clear logical version can be generated, eliminating ambiguity in the documents.

[0090] In addition, differential analysis also compares the logical flow, examining the control flow graph in IR-C and the state transition graph in IR-Ri to identify potential logical omissions in the code implementation. For example, some state transition paths defined in RFC documents may not be implemented in the code, or some states may not be handled correctly. These differences will be marked as potential vulnerabilities, prompting developers to make improvements.

[0091] For any detected inconsistencies, this application embodiment will correct them through corresponding adjustment measures. On the one hand, ambiguous sentences in the RFC document will be modified to clarify their logical meaning, thereby avoiding misunderstandings in the code implementation. On the other hand, any missing or deviating logic in the code implementation will be supplemented or modified to ensure full compliance with the RFC document specifications. For example, by adjusting the ambiguous description in the RFC document, "redirect" will be clarified as an operation logic consistent with the icmp_redirect function; at the same time, unhandled state transition conditions in the code will be supplemented and implemented. In this way, IR-C and IR-Ri can maintain consistency at the logical level, providing high-quality input for the subsequent generation of cross-layer interactive state machines.

[0092] The final results of the differential analysis include symbol alignment relationships, differences in the control flow graph, and the marking of potential security vulnerabilities. These results provide guidance for further optimization of protocol design and code implementation, and lay a solid foundation for the subsequent generation of cross-layer interactive state machines. Through consistency checks, this application not only eliminates hidden vulnerabilities but also ensures the robustness and security of the protocol stack, thereby improving the reliability of the protocol in practical applications.

[0093] Step 104: Based on the results of consistency comparison and adjustment, extend from single-layer protocol to cross-layer protocol interaction, and construct a protocol cross-layer interaction state machine that describes the cross-layer interaction logic.

[0094] After completing the consistency check and adjustment, this embodiment of the application utilizes the intermediate representation IR-R of the consistent adjusted RFC specification, combined with the intermediate representation IR-C generated from the source code, to further construct the cross-layer interaction state machine of the protocol, so as to fully describe the cross-layer interaction logic of the protocol.

[0095] First, supervised model training from IR-C to IR-R is conducted based on the intermediate representation IR-R of the consistent RFC specification. Through model training, a mapping relationship is established between the protocol logic extracted from the code (IR-C) and the protocol logic described in the RFC document (IR-R), ensuring that the generated IR-C matches the logical requirements of the RFC document. During training, the model is iteratively optimized to improve the accuracy and consistency of IR-C generation, especially when dealing with complex cross-layer interaction logic, enabling the model to more accurately extract and reconstruct the behavior of the state machine.

[0096] Subsequently, based on the trained model, and using the cross-layer interaction code of the protocol stack as input, an intermediate representation (IR-C) of cross-layer interaction is generated. Through the model's logical mapping capabilities, the cross-layer interaction process of the protocol stack is extracted from the code, including the calling, transmission, and processing logic of data packets between different protocol layers, generating a complete cross-layer interaction IR-C. This intermediate representation covers key information such as interface call relationships, data flow paths, and state transitions between different protocol layers in the protocol stack.

[0097] Finally, the generated IR-C is used as the representation of the protocol cross-layer interaction state machine. The state machine clearly describes the protocol cross-layer interaction logic in a graphical way, presenting the entire process from data generation to transmission and processing. The state machine includes key nodes of different protocol layers, call paths of cross-layer interfaces, and transition relationships between states, thus providing a complete description of the cross-layer interaction logic.

[0098] This step expands the processing flow from a single-layer protocol to the cross-layer interaction flow between multiple protocols, constructing a cross-layer interaction state machine. Building upon this, and combining the intermediate representation IR-R (after eliminating RFC ambiguity), further ensures that the state machine accurately reflects the logical behavior of the protocol stack. The construction of the cross-layer interaction state machine not only provides a logical model for subsequent vulnerability detection but also provides reliable input data for generating cross-layer interaction documentation consistent with the RFC style.

[0099] Furthermore, after constructing the protocol cross-layer interaction state machine, to facilitate intuitive analysis and verification of the protocol logic, visualization tools can be used to graphically output the protocol cross-layer interaction state machine. The visualization output can clearly show the logical relationships of cross-layer interactions, critical paths, and state transition behaviors. During implementation, tools such as pygraphviz and graphviz can be used to directly convert the state machine's data structure (such as the intermediate representation IR-C) into a visual graph. This application does not specifically describe or limit the visualization tools used.

[0100] Step 105: Utilize the protocol cross-layer interaction state machine to generate a cross-layer interaction definition document that conforms to the RFC document style.

[0101] After constructing the protocol's cross-layer interaction state machine, the intermediate representation IR-C can be processed using a Large Language Model (LLM) based on the generated state machine to automatically generate a cross-layer interaction definition document consistent with the RFC document style. This step aims to explicitly describe the protocol's cross-layer interaction logic in natural language, addressing the current problem of a lack of documented definitions for cross-layer interaction behavior in network protocols.

[0102] Specifically, IR-C, as an intermediate representation of the state machine, contains key information about cross-layer interaction logic, including protocol layer states, event triggering conditions, state transition paths, and interface call relationships. Leveraging the text generation capabilities of a large language model, and utilizing Prompt and in-context learning techniques, this information is transformed into natural language descriptions conforming to the style of RFC documents.

[0103] It's worth noting that the large language model was chosen as the implementation method in this process because of its powerful language generation capabilities, especially its informative ability. It can generate accurate and coherent text output with minimal contextual cues, requiring no additional training. By designing a Prompt that adapts to the protocol logic, the model can extract key information from the IR-C and generate cross-layer interaction definition documents according to the organizational structure of the RFC document.

[0104] Ultimately, the generated documentation maintains a style consistent with the RFC, including the title, body, and standardized description of the protocol interaction flow. In this way, the generated cross-layer interaction definition document not only addresses the shortcomings of existing protocols in describing cross-layer interactions in detail but also provides developers with clear behavioral guidelines, facilitating implementation and maintenance. Furthermore, the document can be directly used as a reference for security analysis, vulnerability investigation, and subsequent protocol extensions.

[0105] To implement the above embodiments, this application also proposes an automated analysis device for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol. Figure 2 This is a schematic diagram of the structure of an automated analysis device for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol, provided as an embodiment of this application. Figure 2 As shown, the device includes:

[0106] The source code and RFC document parsing module 100 is used to clean, split, and preprocess the source code and RFC documents of the TCP / IP protocol stack, and extract the core information of the protocol design and implementation.

[0107] The intermediate representation generation module 200 is used to generate intermediate representations based on the preprocessed source code and RFC document, respectively. Specifically, it extracts the protocol processing logic and cross-layer interaction process from the source code to generate the protocol processing intermediate representation IR-C; and extracts the protocol state description and logical structure from the RFC document to generate multiple intermediate representations IR-Ri.

[0108] The intermediate consistency detection module 300 is used to perform differential analysis on IR-C and IR-Ri, check whether the descriptions of the protocol code and RFC documents are consistent at the logical level, identify potential inconsistencies between the code and the documents, and make corresponding adjustments.

[0109] The cross-layer interaction state machine generation module 400 is used to extend from single-layer protocol to cross-layer protocol interaction based on the results of consistency comparison and adjustment, and to construct a protocol cross-layer interaction state machine that describes the cross-layer interaction logic.

[0110] The cross-layer interaction document generation module 500 is used to generate cross-layer interaction definition documents that conform to the RFC document style by utilizing the protocol cross-layer interaction state machine.

[0111] To implement the above embodiments, this application also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0112] To implement the above embodiments, this application also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0113] To implement the above embodiments, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0114] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0115] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0116] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0117] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0118] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0119] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0120] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0121] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0122] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0123] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0124] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

[0125] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0126] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An automated analysis method for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol, characterized in that, Includes the following steps: The source code and RFC documents of the TCP / IP protocol stack are cleaned, disassembled, and preprocessed to extract the core information of protocol design and implementation; Based on the preprocessed source code and RFC documents, intermediate representations are generated respectively. Specifically, the protocol processing logic and cross-layer interaction process are extracted from the source code to generate the protocol processing intermediate representation IR-C; the protocol state description and logical structure are extracted from the RFC documents to generate multiple intermediate representations IR-Ri. Perform differential analysis on IR-C and IR-Ri to check whether the descriptions of the protocol code and RFC documents are consistent at the logical level, identify potential inconsistencies between the code and the documents, and make corresponding adjustments. Based on the results of consistency comparison and adjustment, the protocol is extended from single-layer protocol to cross-layer protocol interaction, and a protocol cross-layer interaction state machine describing the cross-layer interaction logic is constructed. Using the cross-layer interaction state machine of the aforementioned protocol, a cross-layer interaction definition document conforming to the RFC document style is generated; Based on the results of consistency comparison and adjustment, the protocol extends from single-layer protocol interaction to cross-layer protocol interaction, constructing a protocol cross-layer interaction state machine describing the cross-layer interaction logic, including: Based on the intermediate representation IR-R of the RFC specification obtained after consistency adjustment, supervised model training from IR-C to IR-R is performed. Based on the trained model, the intermediate representation IR-C of cross-layer interaction is generated by taking the cross-layer interaction code of the protocol stack as input. The generated IR-C is used as a representation of the protocol's cross-layer interaction state machine to describe the protocol's cross-layer interaction logic.

2. The method according to claim 1, characterized in that, The cleaning, splitting, and preprocessing of the TCP / IP protocol stack source code and RFC documents includes: The source code is parsed by functional module to extract the data packet structure, state definition, event handling function and state transition logic related to the protocol implementation; The RFC document is broken down into state definitions, packet structures, event handling logic, and state transition diagrams, and content irrelevant to the protocol design is filtered out.

3. The method according to claim 2, characterized in that, The intermediate representations generated based on the preprocessed source code and RFC document include: For the source code, by designing a Prompt adapted to the characteristics of the network protocol stack, and using the text analysis capabilities of a large language model to extract key logical information from the kernel protocol stack code, an intermediate representation IR-C representing the protocol processing and cross-layer interaction process is constructed. For RFC documents, domain-specific language and syntax analysis techniques are used to parse the protocol logic and detect ambiguities in the description, generating multiple intermediate representations IR-Ri to address ambiguity.

4. The method according to claim 3, characterized in that, The extraction of key logical information from the kernel protocol stack code using the text analysis capabilities of a large language model includes: Extract the packet header structure and field information of the protocol, and generate the corresponding packet header status information; Analyze the logic of the protocol processing functions and extract the processes related to protocol state transitions; Identify the key code paths in the protocol implementation that interact with other protocol layers, and extract the logic for cross-layer information transmission.

5. The method according to claim 4, characterized in that, The differential analysis of IR-C and IR-Ri, checking whether the logical descriptions of the protocol code and RFC documents are consistent, identifying potential inconsistencies between the code and the documentation, and making corresponding adjustments, includes: Using a large language model combined with Prompt, differential analysis was performed on IR-C and IR-Ri. By comparing their symbols, logic structures and control flow graphs, the consistency between the protocol code and the RFC document at the logical level was checked. Logical discrepancies discovered in labeled differential analysis; Adjustments were made to the ambiguous descriptions in the RFC documents to eliminate inconsistencies caused by the ambiguity of natural language, and the implementation logic of the source code was modified as needed to ensure consistency between IR-C and IR-Ri at the logical level.

6. The method according to claim 5, characterized in that, The logical differences detected during the differential analysis process include: The logical descriptions defined in the RFC document are misaligned with the symbols used in the code implementation; Ambiguity issues arising from natural language ambiguity in RFC documents; Protocol logic vulnerabilities not covered in the code implementation.

7. The method according to claim 6, characterized in that, Also includes: The cross-layer interaction state machine of the protocol is visualized using visualization tools.

8. The method according to claim 7, characterized in that, The step of generating a cross-layer interaction definition document conforming to the RFC document style using the cross-layer interaction state machine of the protocol includes: Based on the generated cross-layer interaction state machine of the protocol, IR-C is processed through a large language model to generate a cross-layer interaction definition document consistent with the style of RFC documents.

9. An automated analysis device for cross-layer interaction vulnerabilities in the TCP / IP layered model protocol, characterized in that, include: The source code and RFC document parsing module is used to clean, split, and preprocess the source code and RFC documents of the TCP / IP protocol stack, and extract the core information of the protocol design and implementation. The intermediate representation generation module is used to generate intermediate representations based on the preprocessed source code and RFC documents, respectively. Specifically, it extracts the protocol processing logic and cross-layer interaction flow from the source code to generate the protocol processing intermediate representation IR-C; and it extracts the protocol state description and logical structure from the RFC documents to generate multiple intermediate representations IR-Ri. The middle section represents the consistency detection module, which performs differential analysis on IR-C and IR-Ri to check whether the descriptions of the protocol code and RFC documents are consistent at the logical level, identify potential inconsistencies between the code and the documents, and make corresponding adjustments. The cross-layer interaction state machine generation module is used to extend from single-layer protocols to cross-layer protocol interactions based on the results of consistency comparison and adjustment, and to construct a protocol cross-layer interaction state machine that describes the cross-layer interaction logic. The cross-layer interaction document generation module is used to generate a cross-layer interaction definition document that conforms to the RFC document style by utilizing the cross-layer interaction state machine of the protocol. The cross-layer interactive state machine generation module is specifically used for: Based on the intermediate representation IR-R of the RFC specification obtained after consistency adjustment, supervised model training from IR-C to IR-R is performed. Based on the trained model, the intermediate representation IR-C of cross-layer interaction is generated by taking the cross-layer interaction code of the protocol stack as input. The generated IR-C is used as a representation of the protocol's cross-layer interaction state machine to describe the protocol's cross-layer interaction logic.

Images