Some / ip protocol gray box fuzzing method and system

Abstract

This invention discloses a gray-box fuzzing method and system for the Some / IP protocol, comprising: calculating the generation probability of each element of each seed sequence in the acquired protocol data packet; calculating the replication probability based on the seed sequence and the corresponding sensitive element sequence; extracting sensitive elements by maximizing the conditional probability of the sensitive element sequence as the objective function; constructing a corpus using ID as an index, and using sensitive elements, relative offsets, weights, and response status codes; selecting corresponding corpora from the corpus according to the protocol status for the protocol data packet to be mutated, and replacing and mutating it with the sensitive element corresponding to the maximum weight and the relative offset; and completing the fuzzing test by monitoring the execution of the test cases. The method identifies the sensitive structure of the protocol data packet to optimize the mutation strategy, thereby improving the seed generation quality, fuzzing efficiency, and vulnerability detection capabilities through a structure-sensitive mutation strategy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a some / IP protocol gray box fuzzing method and system. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute the prior art.

[0003] With the wide application of vehicle Ethernet protocol, its security risks have also increased, and attackers can exploit protocol vulnerabilities to attack vehicle systems, affecting the safety and stability of the vehicle.

[0004] At present, as an efficient vulnerability detection technology, fuzzing has been widely used in network protocol security testing. Gray box fuzzing technologies such as AFLNET, StateAFL, Ori can effectively detect network protocol vulnerabilities, but existing fuzzing methods still face the following challenges in the security testing of vehicle Ethernet protocols:

[0005] (1) Lack of lightweight state-guided fuzzing mechanism: Vehicle Ethernet protocols often have strict state sequence rules, and existing methods are difficult to apply to vehicle Ethernet protocols, such as AFL and Ori, which lack a state-guided mechanism and have low testing efficiency; AFLNET and StateAFL do not support testing SOME / IP protocols.

[0006] (2) Low data packet mutation efficiency: Vehicle Ethernet protocol data packets have strict structural constraints, and traditional fuzzing tools usually use random mutation or equal probability mutation strategies, which cannot effectively improve mutation efficiency, resulting in limited testing effectiveness. SUMMARY

[0007] To solve the above problems, the present application provides a some / IP protocol gray box fuzzing method and system, which automatically identifies sensitive structures in protocol data packets to optimize mutation strategies, improves seed generation quality through structure-sensitive mutation strategies, and improves the efficiency and vulnerability detection capability of the fuzzing process.

[0008] To achieve the above purpose, the present application adopts the following technical solutions:

[0009] In a first aspect, the present application provides a some / IP protocol gray box fuzzing method, comprising:

[0010] The generation probability of each element of each seed sequence in the obtained protocol data packet is calculated, the element with the maximum generation probability is taken as a sensitive element, thereby determining a sensitive element sequence; and the replication probability is calculated according to the seed sequence and the corresponding sensitive element sequence, the conditional probability of the sensitive element sequence is determined according to the generation probability and the replication probability, the conditional probability of the sensitive element sequence is taken as an objective function to maximize, and the extraction of the sensitive element is completed;

[0011] The relative offset of the sensitive element relative to the data packet header of the seed sequence is determined, the ID is determined according to the sensitive element and the relative offset, the weight of the sensitive element is determined according to the generation probability, the code coverage and the state coverage of the sensitive element, the corpus is constructed by taking the ID as an index, the sensitive element and the relative offset, the weight and the response status code.

[0012] For the protocol data packet to be mutated, the corresponding corpus is selected in the corpus according to the protocol state, and the sensitive element and the relative offset corresponding to the maximum weight are replaced and mutated, thereby obtaining a test case, and the execution of the test case is monitored to complete the fuzzy test process.

[0013] As an optional implementation, the generation probability p c is:

[0014] p c (SS t |SS ＜t ,S)=o(SS t-1 ,h t ,S′);h t =f(SS t-1 ,h t-t ,S′);

[0015] Wherein, h t is the hidden layer output of the GRU network at time t, h t-1 is the hidden layer output of the GRU network at time t-1, f(·) is the hidden layer calculation function of the GRU network; SS t is all sensitive element sequences extracted at time t, SS t-1 is all sensitive element sequences extracted at time t-1, o(SS t-1 ,h t ,S′) is a generation probability calculation function, specifically, at time t, the generation probability of each element of each seed sequence in the extraction vector S' is calculated, and the element with the maximum generation probability is taken as the sensitive element at time t.

[0016] As an optional implementation, the extraction vector S' is: after obtaining the protocol data packet, each seed sequence in the protocol data packet is encoded to obtain the extraction vector, and the extraction of the sensitive element is performed based on the extraction vector.

[0017] As an alternative embodiment, the replication probability p s is:

[0018]

[0019] where θ (SS t = S i ) is the output score of the seed sequence S i replicated to SS t , i.e. the seed sequence S i is determined to correspond to the element position of the sensitive element after SS t , and the output score is determined by the function θ (SS t = S i ); I is the number of sequences in SS t ; Z is the sum of all scores; hh i is the output parameter matrix operation of S i after the representation layer encoding; ω s is the weight parameter matrix; σ (·) is the tanh nonlinear activation function; and T is the matrix transpose.

[0020] As an alternative embodiment, the objective function is defined as maximizing the conditional probability of the sensitive element sequence, i.e.

[0021] P (SS t | SS ＜t , S) = p c (SS t | SS ＜t , S) + γp s (SS t | SS ＜t , S);

[0022] where SS ＜t is all sensitive element sequences extracted before time t; and γ is a harmonic parameter.

[0023] As an alternative embodiment, the weight is W (ID) = O (·) + Ψ (·) + Φ (·).

[0024] where W is the weight; O (·) is the generation probability of the sensitive element under the current ID index, Ψ (·) is the code coverage of the sensitive element under the current ID index, and Φ (·) is the state coverage of the sensitive element under the current ID index, which is obtained by dividing the number of related states of the sensitive element under the current ID index by the total number of states.

[0025] In a second aspect, the present application provides a some / ip protocol gray box fuzzing test system, comprising:

[0026] The sensitive structure extraction module is configured to calculate a generation probability of each element of each seed sequence in the acquired protocol data packet, take an element with a maximum generation probability as a sensitive element, thereby determine a sensitive element sequence, calculate a replication probability according to the seed sequence and the corresponding sensitive element sequence, determine a conditional probability of the sensitive element sequence according to the generation probability and the replication probability, take the conditional probability of the sensitive element sequence as an objective function, and complete extraction of the sensitive element;

[0027] The corpus module is configured to determine a relative offset of the sensitive element relative to a data packet header of the seed sequence, determine an ID according to the sensitive element and the relative offset, determine a weight of the sensitive element according to a generation probability, a code coverage rate and a state coverage rate of the sensitive element, index the ID, and construct a corpus according to the sensitive element, the relative offset, the weight and a response state code.

[0028] The test module is configured to select a corresponding corpus in the corpus according to a protocol state for a protocol data packet to be mutated, replace and mutate the sensitive element and the relative offset with a maximum weight, thereby obtain a test case, and complete a fuzzy test process by monitoring an execution of the test case.

[0029] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, and computer instructions stored in the memory and running on the processor, when the computer instructions are run by the processor, the method of the first aspect is completed.

[0030] In a fourth aspect, the present application provides a computer readable storage medium for storing computer instructions, when the computer instructions are executed by the processor, the method of the first aspect is completed.

[0031] In a fifth aspect, the present application provides a computer program product comprising a computer program, when the computer program is executed by the processor, the method of the first aspect is completed.

[0032] Compared with the prior art, the present application has the following beneficial effects:

[0033] The data packet needs to meet the state sequence constraint and the data packet format constraint simultaneously in the SOME / IP protocol communication process running in the vehicle, therefore, the fuzzy test should meet the following two requirements: 1) being able to represent the protocol state relationship and being used to schedule the fuzzy test process; 2) being able to generate the test seed conforming to the protocol syntax format specification. However, the existing fuzzy test tools, such as AFL, Ori, lack the mechanism of state guidance, and the test efficiency is low; AFLNET and StateAFL do not support the test of the SOME / IP protocol. In order to solve the problem of low efficiency of the fuzzy test of the SOME / IP protocol, the present application provides a some / ip protocol gray box fuzzy test method and system, the mutation strategy is optimized by automatically identifying the sensitive structure in the protocol data packet, the seed generation quality is improved by the structure-sensitive mutation strategy, and the efficiency and the vulnerability detection capability of the fuzzy test process are improved.

[0034] The method of the present application is aimed at the some / ip protocol, and is not to generate a complete test case, but to learn the sensitive elements in the good test case, so that the test case can trigger the field position of the new state, code coverage, crash and its characteristics, and accordingly guide the mutation, so that the obtained seed is more consistent with the protocol format specification, and the use of past test experience is more efficient and fine-grained; the protocol reverse process is not required, and the degree of limitation is small.

[0035] The advantages of the additional aspects of the present application will be partially given in the following description, partially will become obvious from the following description, or will be known by the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only are the embodiments of the present application, and for the ordinary skilled in the art, other drawings can be obtained without paying creative labor according to the provided drawings.

[0037] Figure 1 The some / ip protocol gray box fuzzy test method flow chart provided for the embodiment 1 of the present application;

[0038] Figure 2 The some / ip protocol gray box fuzzy test method principle diagram provided for the embodiment 1 of the present application;

[0039] Figure 3 The sensitive structure extraction module architecture diagram provided for the embodiment 1 of the present application;

[0040] Figure 4 The corpus entry structure schematic diagram provided for the embodiment 1 of the present application;

[0041] Figure 5 Workflow diagram provided for Embodiment 1 of the present application;

[0042] Figure 6 Experimental verification result one provided for Embodiment 1 of the present application;

[0043] Figure 7 Experimental verification result two provided for Embodiment 1 of the present application;

[0044] Figure 8 Architecture diagram of the some / ip protocol gray-box fuzz testing system provided for Embodiment 2 of the present application. DETAILED DESCRIPTION

[0045] The present application will be further described below in conjunction with the accompanying drawings and embodiments.

[0046] It should be noted that the following detailed description is exemplary in nature and is intended to provide further description of the present application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0047] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments in accordance with the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0048] The embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0049] Embodiment 1

[0050] The present embodiment provides a some / ip protocol gray-box fuzz testing method, as shown in Figure 1 The present embodiment provides a some / ip protocol gray-box fuzz testing method, as shown in

[0051] The present embodiment provides a some / ip protocol gray-box fuzz testing method, as shown in

[0052] determining a relative offset of the sensitive element relative to a data packet header of the seed sequence, determining an ID according to the sensitive element and the relative offset, determining a weight of the sensitive element according to a generation probability of the sensitive element, a code coverage and a state coverage, indexing the ID, and constructing a corpus according to the sensitive element, the relative offset, the weight and a response status code;

[0053] For a protocol data packet to be mutated, a corresponding corpus is selected in the corpus according to a protocol state, and a corresponding sensitive element and relative offset are replaced and mutated with a maximum weight, thereby obtaining a test case, and the fuzz testing process is completed by monitoring the execution of the test case.

[0054] The method of the embodiment will be described in detail below. Figure 2 The method of the embodiment will be described in detail below.

[0055] In this embodiment, protocol data packets are extracted from vehicle-mounted network traffic as seed data packets, that is, as the starting point of the fuzz testing. The protocol data packets record the message exchange between the real client and the server, and can be extracted using a network sniffer and a packet analyzer, such as tcpdump and Wireshark, thereby serving as the initial seed for the fuzz testing.

[0056] In this embodiment, based on the sensitive structure extraction module and the corpus module, the seed data packet is subjected to structure-sensitive mutation to obtain a test case, which is sent to the target system.

[0057] As shown in Figure 3 , the sensitive structure extraction module includes a Bi-GRU (Bidirectional Gated Recurrent Unit) representation layer with an additional attention mechanism and a GRU-based sensitive structure extraction layer; considering the differences in the format of the protocol data packet, the Bi-GRU representation layer with an additional attention mechanism is used to encode the seed sequence, and the GRU-based sensitive structure extraction layer is used as a decoding network for extracting sensitive elements.

[0058] Specifically:

[0059] (1) The representation layer is established on the Bi-GRU, and the protocol data packet S=(S1, S2,..., Sn) is obtained. m The protocol data packet S is a set of unordered and variable-length seed sequences, S i is the i-th seed sequence of S, and n is the total number of sequences; the protocol data packet S is automatically mapped to a high-dimensional embedding space and encoded into an extraction vector S' for the sensitive element extraction task.

[0060] Meanwhile, in natural language processing tasks, the processing of each word is usually the same. However, considering the structural sensitivity of the protocol message, the goal of the present embodiment is to capture important relationships between structures while maintaining good accuracy. Therefore, the present embodiment introduces an attention mechanism to enhance the representation layer.

[0061] It can be understood that the Bi-GRU network can realize the above-mentioned encoding process, which is a conventional means and will not be described in detail.

[0062] (2) The extraction layer decodes the high-dimensional extraction vector S' into a sensitive element sequence SS=(SS1, SS2,..., SS n ), where the i-th sensitive element sequence SS i =(ss i1 ,ss i2 ,...,ss ik ), ss ij represents the j-th sensitive element in the i-th sensitive element sequence SS i , and k is the number of sensitive elements in the i-th sensitive element sequence SS i . The sensitive element sequence SS has variable length, that is, the length of each sensitive element sequence can be different, which means that each seed sequence S i can extract different numbers of sensitive elements.

[0063] In order to guide the entire extraction process, the present embodiment designs an objective function, which takes the maximum conditional probability of the sensitive element sequence as the objective function, in order to select more sensitive elements in the seed sequence, and is defined as:

[0064] P(SS t |SS ＜t ,S)=p c (SS t |SS ＜t ,S)+γp s (SS t |SS ＜t ,S) (1);

[0065] Where SS t is all sensitive element sequences extracted at time t; P(SS t |SS ＜t ,S) is the conditional probability of the sensitive element sequence SS t at time t; SS ＜t is all sensitive element sequences extracted before time t; and γ is a harmonic parameter that controls the proportion of generation probability and replication probability.

[0066] The sensitive elements are extracted from the original seed sequence by maximizing the conditional probability of the sensitive element sequence of formula (1); meanwhile, by combining the structural attention, the position information is encoded together with the field information, and the copying probability is added in the objective function, which not only encodes the input content, but also encodes the structural information between elements, which is helpful to find the key part in the original seed sequence.

[0067] As can be seen from formula (1), by combining the structural attention, the SS t of the original seed sequence is extracted from the source input, and the copying probability p t is added in the objective function. ＜t The conditional probability p (SS c |SS t ,S) not only considers the generation probability p s of the sensitive elements generated from the extraction layer, but also includes the copying probability p c from the source input to the SS c .

[0068] Specifically, the generation probability p c is:

[0069] p c (SS t |SS <t ,S)=o(SS t-1 ,h t ,S′);

[0070] h t =f(SS t-1 ,h t-1 ,S′);

[0071] Where h t is the hidden layer output of the GRU network at time t, h t-1 is the hidden layer output of the GRU network at time t-1, and f(·) is the hidden layer calculation function of the GRU network; SS t is all sensitive element sequences extracted at time t, SS t-1 is all sensitive element sequences extracted at time t-1, and o(SS t-1 ,h t ,S′) is a generation probability calculation function, which specifically calculates the generation probability of each element of each seed sequence in the extraction vector S' at time t, and takes the element with the maximum generation probability as the sensitive element at time t.

[0072] It can be understood that the calculation of the generation probability adopts the GRU network, and the specific intermediate processing process is the processing of the GRU network, which is not described in detail, and the output of the last layer is taken as the target output.

[0073] The copying probability p s only considers the elements in the source input, and is expressed as:

[0074]

[0075] where θ (SS t = S i ) is the output score of the seed sequence S i after copying to SS t , i.e., the element position of S i corresponding to the sensitive element after copying to SS t , and the output score is determined by the function θ (SS t = S i ); I is the number of sequences in SS t ; Z is the sum of all scores for normalization; hh i is the output parameter matrix operation of S i after representation layer encoding; ω s is the weight parameter matrix; σ (·) is a tanh nonlinear activation function, which helps to map h t and hh i into the same semantic space; and T is the matrix transpose.

[0076] For the sensitive element extraction task, the objective function is to maximize the conditional probability of the sensitive element sequence. In simple terms, according to the training batch of the seed sequence S and the corresponding sensitive element sequence SS, the model is trained by minimizing the negative log-likelihood, which is defined as:

[0077]

[0078] where, is the sensitive element sequence extracted at time t of the jth training batch; is the sensitive element sequence extracted at time t-1 of the jth training batch; S j is the seed sequence of the jth training batch; N is the total number of training batches; and T is the number of time points.

[0079] In this embodiment, the module uses Bi-GRU combined with an attention mechanism to encode the protocol data packet, automatically learns the importance of data elements, enhances the understanding of structural information, and extracts key sensitive elements, which will be used to guide mutation in the fuzzing process to improve test efficiency. At the same time, the model is optimized through incremental learning, and as the fuzzing process progresses, the extraction strategy of sensitive structures is dynamically adjusted to improve the recognition accuracy.

[0080] (3) Corpus module: for example, Figure 4As shown, each corpus entry in the corpus module is represented in the structure of a five-tuple [ID, sensitive element, relative offset, weight, related state]; ensuring the uniqueness of data and preventing redundancy, to achieve the weight setting of sensitive elements and lightweight state relationship representation.

[0081] wherein the sensitive element is the output of the sensitive structure extraction module.

[0082] The relative offset represents the byte offset of the sensitive element in the original seed sequence relative to the packet header of the seed sequence where it is located.

[0083] In order to ensure uniqueness, the hash value of the sensitive element and the relative offset is calculated as the ID of the corpus entry, which helps to avoid too much redundancy in the corpus and affect the mutation efficiency.

[0084] The weight represents the possibility of selecting the corpus entry, specifically,

[0085] W(ID)=O(·)+Ψ(·)+Φ(·);

[0086] wherein W is the weight; O(·) is the generation probability of the sensitive element under the current ID index by the sensitive element extraction module, Ψ(·) is the code coverage of the sensitive element under the current ID index, which is collected by source code instrumentation, which is prior art and will not be described; Φ(·) is the state coverage of the sensitive element under the current ID index, which is obtained by dividing the number of related states of the sensitive element under the current ID index by the total number of states.

[0087] The related state R represents the state range of the sensitive element under the current ID index, which is identified by the response status code (such as 404 Not Found: URL corresponding resource does not exist (path error or resource has been deleted) and the like), so as to realize lightweight representation of the state relationship, to assist structure-sensitive mutation.

[0088] wherein the state sequence rule (protocol state relationship) is the protocol state machine and its transition relationship defined when the network protocol is implemented, indicating the workflow and response of the network protocol after receiving the seed. The related state field in the corpus stores the protocol state information that the corpus can reach, thereby lightweightly representing the relationship between states, and through searching the related state, the corpus causing the state change can be quickly found for mutation.

[0089] When the sensitive structure extraction module generates new output sent to the corpus, the fuzzer calculates the hash value of the sensitive element and the relative offset to check whether the corpus entry already exists through the ID, if it exists, update the weight and the related state of the corresponding five-tuple; if not, create a new five-tuple to store the new corpus entry.

[0090] In the embodiment, in the structure-sensitive fuzz testing, the corpus module enhances the effectiveness of mutation, the higher the weight of the corpus entry, the higher the structure sensitivity, and the more likely to be selected for seed mutation; when using the corpus to enhance the seed mutation effect, first collect the relevant corpus entries according to the current execution state, then select the sensitive element corresponding to the maximum weight, and replace the current seed sequence according to the corresponding relative offset; with the progress of the fuzz testing, a benign cycle of mutation-storage-mutation is established, and the corpus becomes more perfect, which can better guide the fuzz testing.

[0091] In the embodiment, by using the corpus module, instead of equally mutating each data element, sensitive elements are selected from the corpus to replace part of the elements of the original seed sequence in a strategic manner, and this process follows strict data format constraints. In this way, element positions that play a more important role in the fuzz testing process can be automatically identified and replaced with elements with higher value, thereby improving the efficiency of the fuzz testing.

[0092] In the embodiment, as shown in Figure 5 , after the structure-sensitive seed mutation is completed, the execution of the target system is monitored, and crash, abnormal behavior and code coverage information are recorded; if the current seed is interesting, that is, a new state or new coverage or crash is generated, the sensitive elements are extracted and stored in the corpus to guide subsequent mutation; if the current seed is not interesting, the next round of fuzz testing is performed; the above process is repeatedly performed to optimize the quality of the seed and improve the vulnerability detection capability.

[0093] In order to evaluate the effectiveness of the method of the embodiment in guiding the fuzz testing using the structure sensitivity of the seed, based on the implementation example of some / ip protocol, the number of crashes triggered in the same time by the method of the embodiment and the ORI method is evaluated. The more the number of crashes triggered, the stronger the vulnerability detection capability of the fuzz testing tool. The detailed results of the experiment are shown in Figure 6 and Figure 7 . The two cases represent different structure sensitivity requirements, which are used to more comprehensively evaluate the vulnerability detection capability of the method of the embodiment.

[0094] Figure 6 represents a simple crash triggering condition, which can trigger a crash as long as one byte meets the expected structure constraint. Figure 7Represent a complex crash trigger condition, only multiple bytes in different positions meet the expected structure constraint can trigger a crash. Experimental results show that compared with Ori, the method of the embodiment achieves the best effect in two cases. Among them, in the case of more strict structure constraint, the effect of the embodiment is better, and the number of triggered crashes is 59.18% more than that of Ori. This shows that the structure-sensitive variation implemented by the embodiment can better generate seeds that meet the structure constraints of the vehicle Ethernet protocol, so as to more likely trigger a crash and achieve more efficient fuzz testing.

[0095] It should be noted that all data acquisition is based on compliance with laws and regulations and user consent, and legal application is made to the data.

[0096] Embodiment 2

[0097] As Figure 8 shown, the embodiment provides a some / ip protocol gray box fuzz testing system, which includes:

[0098] The sensitive structure extraction module is configured to calculate the generation probability of each element of each seed sequence in the acquired protocol data packet, take the element with the maximum generation probability as the sensitive element, and thus determine the sensitive element sequence; and calculate the replication probability according to the seed sequence and the corresponding sensitive element sequence, determine the conditional probability of the sensitive element sequence according to the generation probability and the replication probability, take maximizing the conditional probability of the sensitive element sequence as the objective function, and complete the extraction of the sensitive element;

[0099] The corpus module is configured to determine the relative offset of the sensitive element relative to the data packet header of the seed sequence where the sensitive element is located, determine the ID according to the sensitive element and the relative offset, determine the weight of the sensitive element according to the generation probability, code coverage and state coverage of the sensitive element, index the ID, and construct the corpus with the sensitive element, the relative offset, the weight and the response status code;

[0100] The test module is configured to select the corresponding corpus in the corpus according to the protocol state for the protocol data packet to be mutated, replace and mutate the sensitive element and the relative offset corresponding to the maximum weight, thereby obtaining the test case, and complete the fuzz testing process by monitoring the execution of the test case.

[0101] It should be noted that the above modules correspond to the steps described in embodiment 1, and the above modules have the same examples and application scenarios as the corresponding steps, but are not limited to the content disclosed in the above embodiment 1. It should be noted that the above modules as part of the system can be executed in a computer system such as a set of computer executable instructions.

[0102] In more embodiments, there are also provided:

[0103] An electronic device includes a memory and a processor and computer instructions stored on the memory and running on the processor, when the computer instructions are run by the processor, the method described in embodiment 1 is completed. For the sake of brevity, it will not be repeated here.

[0104] It should be understood that in the embodiments, the processor can be a central processing unit CPU, and the processor can also be other general-purpose processors, digital signal processors DSPs, application-specific integrated circuits ASICs, ready-to-program gate arrays FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0105] The memory can include read-only memory and random access memory, and provide instructions and data to the processor, and a part of the memory can also include non-volatile random access memory. For example, the memory can also store device type information.

[0106] A computer readable storage medium for storing computer instructions, when the computer instructions are executed by the processor, the method described in embodiment 1 is completed.

[0107] The method in embodiment 1 can be directly embodied as hardware processor execution completion, or executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above method. To avoid repetition, it will not be described in detail here.

[0108] A computer program product includes a computer program, which is executed by the processor to realize the method described in embodiment 1.

[0109] The present application also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer executable instructions, such as instructions included in program modules, which are executed in devices on target real or virtual processors to perform processes / methods as described above. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform specific tasks or implement specific abstract data types. In various embodiments, the functions of the program modules can be combined or divided as needed among the program modules. Machine executable instructions for program modules can be executed within a local or distributed device. In a distributed device, program modules can be located in local and remote storage media.

[0110] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages. The computer program code can execute entirely on a computer, a special purpose computer, or other programmable apparatus to produce the functions / acts specified in the flow diagrams and / or block diagrams. The program code can execute entirely on a computer, a special purpose computer, or other programmable apparatus, as a stand-alone software package, partly on the computer and partly on a remote computer, or entirely on the remote computer or server.

[0111] In the context of the present application, the computer program code or related data can be carried by any suitable carrier to enable the device, apparatus or processor to perform the various processes and operations described above. Examples of carriers include signals, computer readable media, and the like. Examples of signals can include electrical, optical, radio, sound or other forms of propagated signals, such as carrier waves, infrared signals, and the like.

[0112] Those skilled in the art can realize that the units and algorithm steps of the examples described in conjunction with the present embodiments can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0113] The above describes the specific embodiments of the present application in conjunction with the accompanying drawings, but is not a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications or variations made by those skilled in the art on the basis of the technical solutions of the present application without inventive labor are still within the scope of protection of the present application.

Claims

1. A gray-box fuzzy testing method for the Some / IP protocol, characterized in that, include: Calculate the generation probability for each element of each seed sequence in the acquired protocol data packet, and select the element with the highest generation probability as the sensitive element, thereby determining the sensitive element sequence; The replication probability is calculated based on the seed sequence and the corresponding sensitive element sequence. The conditional probability of the sensitive element sequence is determined based on the generation probability and replication probability. The objective function is to maximize the conditional probability of the sensitive element sequence to complete the extraction of sensitive elements. Determine the relative offset of the sensitive element with respect to the header of the data packet in the seed sequence, determine the ID based on the sensitive element and the relative offset, determine the weight of the sensitive element based on the generation probability, code coverage and state coverage, and construct a corpus with the ID as the index, the sensitive element and its relative offset, weight and response status code. For mutated protocol data packets, the corresponding corpus is selected from the corpus according to the protocol state, and the mutated data is replaced with the sensitive element with the highest weight and the relative offset. This yields test cases. By monitoring the execution of the test cases, the fuzzing process is completed.

2. The SOIP protocol gray-box fuzzy testing method as described in claim 1, characterized in that, Generation probability for: ； ； in, It is the hidden layer output of the GRU network at time t. It is the hidden layer output of the GRU network at time t-1. This is the function for calculating the hidden layers of the GRU network; This represents the sequence of all sensitive elements extracted at time t. This represents the sequence of all sensitive elements extracted at time t-1. To generate the probability calculation function, specifically at time t, the extraction vector is calculated. Each element in each seed sequence represents the generation probability of a sensitive element, and the element with the highest generation probability is taken as the sensitive element at time t.

3. The SOIP protocol gray-box fuzzy testing method as described in claim 1, characterized in that, Extract vector The process involves: after acquiring the protocol data packet, encoding each seed sequence in the protocol data packet to obtain an extraction vector, and then extracting sensitive elements based on the extraction vector.

4. The SOIP protocol gray-box fuzzy testing method as described in claim 2, characterized in that, Replication probability for: ； ； in, It is to calculate the seed sequence Copy to The output score is used to determine the seed sequence. Corresponding to The position of the element that is a sensitive element is then used to perform a function. Determine the output score; for The number of sequences in the sequence; Z is the sum of all scores; yes Operations on the output parameter matrix after representation layer encoding; It is a weight parameter matrix; It is the tanh nonlinear activation function; This is the matrix transpose. For protocol data packets The Seed sequences.

5. The SOIP protocol gray-box fuzzy testing method as described in claim 4, characterized in that, The objective function, which maximizes the conditional probability of the sensitive element sequence, is defined as follows: ； in, This refers to the sequence of all sensitive elements extracted before time t; For harmonic parameters.

6. The SOIP protocol gray-box fuzzy testing method as described in claim 1, characterized in that, The weights are: ; in, As weight; This represents the probability of generating a sensitive element under the current ID index. This represents the code coverage of sensitive elements under the current ID index. The state coverage of sensitive elements under the current ID index is obtained by dividing the number of relevant states of sensitive elements under the current ID index by the total number of states.

7. A gray-box fuzzy testing system for the Some / IP protocol, characterized in that, include: The sensitive structure extraction module is configured to calculate the generation probability of each element of each seed sequence in the acquired protocol data packet, and select the element with the highest generation probability as the sensitive element, thereby determining the sensitive element sequence; The replication probability is calculated based on the seed sequence and the corresponding sensitive element sequence. The conditional probability of the sensitive element sequence is determined based on the generation probability and replication probability. The objective function is to maximize the conditional probability of the sensitive element sequence to complete the extraction of sensitive elements. The corpus module is configured to determine the relative offset of sensitive elements relative to the header of the data packets in the seed sequence, determine the ID based on the sensitive element and the relative offset, determine the weight of the sensitive element based on the generation probability, code coverage and state coverage, and construct the corpus using the ID as the index, the sensitive element and its relative offset, weight and response status code. The testing module is configured to select the corresponding corpus from the corpus based on the protocol state for the protocol data packets to be mutated, and replace and mutate the sensitive elements with the highest weight and the relative offset, thereby obtaining test cases. By monitoring the execution of the test cases, the fuzzing process is completed.

8. An electronic device, characterized in that, It includes a memory and a processor, as well as computer instructions stored in the memory and running on the processor, which, when executed by the processor, perform the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, perform the method described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the method described in any one of claims 1-6.

Images