Network protocol fuzz testing method based on state complexity perception

Abstract

The invention discloses a network protocol fuzz testing method based on state complexity perception. The network protocol fuzz testing method comprises the steps that S1, branch information corresponding to states is recorded through dynamic symbol execution; s2, traversing the recorded branch information, and calculating branch complexity; s3, obtaining state complexity; s4, in the fuzzy test process, calculating an exploration score and a utilization score of each state; and S5, calculating the sum of the exploration score and the utilization score, and selecting the state with the highest sum of the scores to carry out fuzzy testing. The method has the advantages of being simple in principle, high in execution efficiency, good in adaptability and compatibility, better in test precision and the like.

Description

Technical Field

[0001] The present invention mainly relates to the field of network security technology, and particularly refers to a network protocol fuzz testing method based on state complexity awareness. Background Art

[0002] Network protocols are the backbone of the Internet. With the expansion of the scope of the Internet and computer technology, the complexity of implementing these protocols has increased accordingly, thus exposing many security vulnerabilities.

[0003] Taking a typical situation as an example: the Heartbleed vulnerability in the OpenSSL component affected more than 60% of the websites globally in 2014. In addition, in 2023, the distributed denial of service (DDoS) vulnerability in the HTTP / 2 protocol was widely exploited.

[0004] Currently, the network protocol fuzz testing methods are mainly stateful fuzz testing methods, which are optimized around the stateful characteristics of network protocols. Fuzzing is a popular method for testing network protocols. AFLNet first introduced a state machine construction method based on memory state inference. By interacting with the program under test, a state machine is established, and the fuzz testing is scheduled according to this state machine. Subsequent network protocol fuzz testing methods are basically based on the state machine model, focusing on the optimization of various directions such as state machine construction, acceleration, and state selection.

[0005] However, due to the complexity of network protocol states, the current work still has limitations in exploring the state space of network protocol implementations and detecting program anomalies. Compared with general programs, the implementation programs of network protocols have special code-level characteristics. In addition to discovering the essence of the states of network protocol implementations, the current methods have not deeply analyzed the code logic of network protocol implementations, resulting in insufficient ability to explore the state space of network protocol implementations. That is to say, due to insufficient consideration of the code logic of network protocol implementations, the discovery of program anomalies is insufficient, and they still have deficiencies in exploring the state space of network protocol implementations. Summary of the Invention

[0006] The technical problem to be solved by the present invention is: aiming at the technical problems existing in the prior art, the present invention provides a network protocol fuzz testing method based on state complexity awareness with simple principle, high execution efficiency, good adaptability and compatibility, and better testing accuracy.

[0007] To solve the above technical problems, the present invention adopts the following technical solutions: A network protocol fuzz testing method based on state complexity awareness, which includes: Step S1: Record branch information corresponding to the state through dynamic symbolic execution; Step S2: Traverse the recorded branch information and calculate the branch complexity; Step S3: Obtain the state complexity; Step S4: During the fuzz testing process, calculate the exploration score and exploitation score for each state; Step S5: Calculate the total sum of the exploration score and exploitation score, and select the state with the highest total score for fuzz testing.

[0008] As a further improvement of the present invention: In the said step S3, the state complexity refers to the complexity of the code snippet corresponding to a certain state.

[0009] As a further improvement of the present invention: In the said step S3, the state complexity is equal to the branch complexity divided by the number of branches plus 1, and then added to the number of branches.

[0010] As a further improvement of the present invention: In the said step S3, the code snippet corresponding to the state contains multiple branch conditions, and different state transitions will occur when different branch conditions are met.

[0011] As a further improvement of the present invention: In the said step S3, the calculation of the state complexity includes two factors: the branch length arglen and the branch depth depth; wherein, the branch length refers to the number of variables related to the branch, and the branch depth refers to the maximum depth of the subsequent branches of the branch.

[0012] As a further improvement of the present invention: In the said step S2, the calculation of the branch complexity is as follows: Step S21: For leaf node states:

[0013] Step S22: For non - leaf node states:

[0014] Wherein, represents the number of branches, represents the number of child nodes; represents the length of the branch structure, represents the depth of the branch structure, represents the state complexity of each child node.

[0015] As a further improvement of the present invention: In the said step S4, the exploration score is used to reflect the unexplored degree of the state; the exploitation score combines the complexity of the state and the number of exploration times.

[0016] As a further improvement of the present invention: The said step S4 includes: Step S41: Calculate the exploration score of the state (explorationScore); the calculation formula is:

[0017] where ρ is a weight constant, and the value of ρ needs to balance the requirements of exploring new states and exploiting discovered states, and needs to be adjusted according to specific scenarios and requirements; state.selected represents the number of times this state is selected; state.parent.selected represents the number of times its parent state is selected; Step S42: Calculate the exploitation score of the state (exploitationScore); the calculation formula is: exploitationScore(state) = state.discovered + state.complexity / state.selected where state.discovered represents the number of times this state is discovered, state.complexity represents the complexity of this state, and state.selected represents the number of times this state is selected.

[0018] Compared with the prior art, the advantages of the present invention are as follows: The network protocol fuzzing test method based on state complexity perception of the present invention has simple principle, high execution efficiency, good adaptability and compatibility, and better test accuracy. The method of the present invention can automatically calculate the complexity of protocol states, and guide the fuzzing process to comprehensively explore the state space according to the complexity. After adopting the method of the present invention, a tool is implemented to evaluate and verify the method. The results show that compared with existing tools, the method of the present invention has achieved a 2.8-fold increase in discovering long state transition paths and a 21.2-fold increase in discovering program exceptions. Brief Description of the Drawings

[0019] Figure 1 is a schematic flowchart of the present invention in a specific embodiment.

[0020] Figure 2 is a schematic principle diagram of the corresponding branch information of another state in a specific embodiment of the present invention.

[0021] Figure 3 is a schematic diagram of the branch complexity calculation result in a specific embodiment of the present invention.

[0022] Figure 4 is an example value corresponding to State2 and State3 in a specific embodiment of the present invention. Detailed Embodiment

[0023] The present invention will be further described in detail below in conjunction with the accompanying drawings of the specification and specific embodiments.

[0024] The present invention provides a network protocol fuzz testing method based on state complexity awareness, which adopts a state selection algorithm based on state complexity to guide the fuzz testing process to explore high-complexity states in order to discover longer state transition paths and more program exceptions.

[0025] As Figure 1 shown, the network protocol fuzz testing method based on state complexity awareness of the present invention includes: Step S1: Record the branch information corresponding to the state through dynamic symbolic execution; Step S2: Traverse the recorded branch information and calculate the branch complexity; Step S3: The state complexity is equal to the branch complexity divided by the number of branches plus 1, and then added to the number of branches; this can ensure that even if the code segment corresponding to certain states has no branches, its complexity will not be too low.

[0026] Step S4: During the fuzz testing process, calculate the exploration score (explorationScore) and exploitation score (exploitationScore) for each state; wherein, the exploration score reflects the unexplored degree of the state; the exploitation score combines the complexity of the state and the number of exploration times.

[0027] Step S5: Calculate the sum of the exploration score and the exploitation score, and select the state with the highest sum of scores for fuzz testing.

[0028] In the above method of the present invention, the state complexity refers to the complexity of the code segment corresponding to a certain state.

[0029] In the specific application process, the code segment corresponding to the state generally contains multiple branch conditions, and different branch conditions will cause the state to transfer to different states.

[0030] Therefore, as a preferred embodiment, the calculation of the state complexity in this example considers two factors: the branch length (arglen) and the branch depth (depth). Among them, the branch length refers to the number of variables related to the branch, and the branch depth refers to the maximum depth of the subsequent branches of the branch. In principle, the longer the branch length and the greater the branch depth, the more complex the branch logic, and the higher the complexity of the corresponding state.

[0031] Specifically, in the specific application example, the specific calculation formula of the branch complexity is as follows: Step S21: For the leaf node state:

[0032] Step S22: For non-leaf node states:

[0033] where, represents the number of branches, represents the number of child nodes; represents the length of the branch structure, represents the depth of the branch structure, represents the state complexity of each child node.

[0034] In a specific application example, step S4 may include, according to actual needs: Step S41: Calculate the exploration score (explorationScore) of the state; The calculation formula is:

[0035] where ρ is a weight constant, and the value of ρ needs to balance the needs of exploring new states and exploiting discovered states, and needs to be adjusted according to specific scenarios and requirements; state.selected represents the number of times the state has been selected; state.parent.selected represents the number of times its parent state has been selected.

[0036] Step S42: Calculate the exploitation score (exploitationScore) of the state; The calculation formula is: exploitationScore(state) = state.discovered + state.complexity / state.selected where state.discovered represents the number of times the state has been discovered, state.complexity represents the complexity of the state, and state.selected represents the number of times the state has been selected.

[0037] In a specific application example, the specific execution process of the above method of the present invention is: Step S100: Start dynamic symbolic execution at the state State1 of the program, and record the branch information corresponding to the state through dynamic symbolic execution, including branch length and branch depth information, as specifically shown in Figure 2 shown.

[0038] Step S200: Traverse the recorded branch information and calculate the branch complexity according to the formulas for leaf node states and non-leaf node states. The result is asFigure 3 as shown

[0039] Step S300: The state complexity is equal to the branch complexity divided by the number of branches plus 1, and then added to the number of branches. That is: For state State2, its state complexity is: (8 / (2 + 1)) + 2 = 4.7 For state State3, its state complexity is: (4.3 / (2 + 1)) + 2 = 3.4 Step S400: State State1 has two branches: Branch 1 and Branch 2, and the corresponding states are State2 and State3 respectively. If the values of state.selected, state.parent.selected, and state.discovered corresponding to State2 and State3 are as Figure 4 as shown

[0040] If the ρ value is 0.5, the exploration scores of State2 and State3 are calculated as:

[0041]

[0042] The exploitation scores of State2 and State3 are calculated as: exploitationScore(State2) = 4 + 4.7 / 3 = 5.5667 exploitationScore(State3) = 6 + 3.4 / 5 = 6.68 Step S500: Calculate the sum of the exploration score and the exploitation score, and select the state with the highest sum of scores for fuzz testing.

[0043] The sum of the score and the exploitation score of State2 is 0.3873 + 5.5667 = 5.954, and the sum of the score and the exploitation score of State3 is 0.5547 + 6.68 = 7.2347. Then, select State3 for fuzz testing.

[0044] As can be seen from the above, by analyzing the relationship between the states and the program code in the implementation of network protocols, the present invention finds that the more complex the code segment corresponding to a state is, the more conducive it is to discovering longer state transition paths and program exceptions. Based on this, the above-mentioned state selection algorithm based on state complexity proposed by the present invention guides the fuzz testing process to explore high-complexity states, so as to discover longer state transition paths and more program exceptions.

[0045] The present invention has tested this method on five real programs, and it has found that the state transition path is 2.8 times longer than that of the best-performing method, and the number of program exceptions identified is 21.2 times more, which proves the superiority of the method of the present invention.

[0046] The above is only the preferred implementation manner of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions falling within the idea of the present invention belong to the protection scope of the present invention. It should be noted that for those of ordinary skill in the art, several improvements and refinements made without departing from the principle of the present invention should be regarded as within the protection scope of the present invention.

Claims

1. A network protocol fuzz testing method based on state complexity awareness, characterized in that Including: Step S1: Record branch information corresponding to the state through dynamic symbolic execution; Step S2: Traverse the recorded branch information and calculate the branch complexity; Step S3: Obtain the state complexity; Step S4: During the fuzz testing process, calculate the exploration score and exploitation score for each state; Step S5: Calculate the total sum of the exploration score and exploitation score, and select the state with the highest total sum of scores for fuzz testing.

2. The network protocol fuzz testing method based on state complexity awareness according to claim 1, wherein In the said Step S3, the state complexity refers to the complexity of the code snippet corresponding to a certain state.

3. The network protocol fuzzing test method based on state complexity awareness according to claim 2, characterized in that, In the said Step S3, the state complexity is equal to the branch complexity divided by the number of branches plus 1, and then added to the number of branches.

4. The network protocol fuzzing test method based on state complexity awareness according to claim 2, wherein In the said Step S3, the code snippet corresponding to the state contains multiple branch conditions, and satisfying different branch conditions will cause the state to transfer to different states.

5. The network protocol fuzz testing method based on state complexity awareness according to claim 2, characterized in that In the said Step S3, the calculation of the state complexity includes two factors: the branch length arglen and the branch depth depth; among them, the branch length arglen refers to the number of variables related to the branch, and the branch depth depth refers to the maximum depth of the subsequent branches of the branch.

6. The network protocol fuzzing test method based on state complexity perception according to any one of claims 1-5, characterized in that In the said Step S2, the calculation of the branch complexity is as follows: Step S21: For the leaf node status :[[]]END]] Step S22: For non-leaf node states :[[]]END]] Among them, represents the number of branches, represents the number of child nodes; represents the length of the branch structure, represents the depth of the branch structure, represents the state complexity of each child node.

7. The network protocol fuzz testing method based on state complexity awareness according to any one of claims 1-5, characterized in that In the said Step S4, the exploration score is used to reflect the unexplored degree of the state; the exploitation score combines the complexity and exploration times of the state.

8. The network protocol fuzz testing method based on state complexity awareness according to claim 7, characterized in that The said Step S4 includes: Step S41: Calculate the exploration score (explorationScore) of the state; the calculation formula is: where ρ is a weight constant, and the value of ρ is adjusted according to specific scenarios and requirements; state.selected represents the number of times this state is selected; state.parent.selected represents the number of times its parent state is selected; Step S42: Calculate the exploitation score (exploitationScore) of the state; the calculation formula is: exploitationScore(state) = state.discovered + state.complexity / state.selected where state.discovered represents the number of times this state is discovered, state.complexity represents the complexity of this state, and state.selected represents the number of times this state is selected.

Images