Hypertext Transfer Protocol Parsing Ambiguity Vulnerability Detection Method and Device

Abstract

The present invention relates to the field of digital information transmission technology, and in particular to a method and device for detecting hypertext transfer protocol parsing ambiguity vulnerabilities, wherein the method comprises: screening hypertext transfer protocol messages based on gray box testing; implementing at least one mutation strategy of sequence-level mutation, message-level mutation, and byte-level mutation on target test cases; running the mutated test cases using a snapshot-based execution framework; detecting whether there are differences in the output of the target implementation under test based on coverage information and status information; optimizing fuzz testing efficiency based on coverage-guided feedback scheduling; detecting whether ambiguity is exploited as a hypertext transfer protocol parsing ambiguity vulnerability to generate a detection result for the hypertext transfer protocol parsing ambiguity vulnerability. The present invention can comprehensively explore the execution paths and branches of the tested hypertext transfer protocol implementation, automatically identify parsing differences without manual intervention, accurately locate the cause of the vulnerability, and generate a reproducible vulnerability exploitation message.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a method and device for detecting ambiguous vulnerabilities in hypertext transfer protocol parsing. Background Art

[0002] The current internet has significantly deviated from its original end-to-end design. Networks are often intertwined with various middleboxes, such as proxy servers, firewalls, and CDNs (Content Delivery Networks). Consequently, a single HTTP (Hypertext Transfer Protocol) request may be forwarded through multiple middleboxes before reaching its final destination. This multi-layered structure presents a potential threat: HTTP parsing ambiguity vulnerabilities. Developers of different HTTP implementations often implement their own HTTP parsers based on their own understanding. Consequently, these parsers may produce different parsing results when parsing the same HTTP request, resulting in parsing ambiguity. Attackers can exploit this ambiguity to desynchronize HTTP message queues, leading to message smuggling and tampering. HTTP parsing ambiguity vulnerabilities can potentially lead to serious security issues, such as cache poisoning, session hijacking, account takeover, and security policy bypass. Recently, such attacks against well-known Web (World Wide Web) services have become commonplace, demonstrating that HTTP parsing ambiguity has become a serious threat to the internet.

[0003] Previous research has developed a variety of tools for detecting HTTP request smuggling. Smuggler uses a series of predefined payloads to test websites for HTTP request smuggling vulnerabilities, but this approach lacks the ability to detect new attack variants. Alternatively, black-box fuzz testing techniques based on HTTP syntax and RFC (Request for Comments) documents have been introduced to uncover HTTP request smuggling vulnerabilities. However, these two techniques suffer from two limitations. First, because black-box testing lacks critical information such as the target's internal state, it blindly enumerates all possible inputs, failing to accurately guide vulnerability discovery, resulting in poor testing effectiveness. Furthermore, existing tools focus solely on security issues in the HTTP request process, ignoring potential HTTP parsing vulnerabilities in the HTTP response, which shares the same structure as the HTTP request. Furthermore, coverage-guided gray-box fuzz testing techniques, such as AFL (American Fuzzy Lop), an open-source fuzz testing tool, have demonstrated excellent performance in uncovering memory corruption vulnerabilities. By monitoring the coverage of code execution paths (e.g., edges, branches, and the triggered states of basic blocks) to guide test case generation, they enable a more thorough exploration of program logic. However, existing gray-box fuzz testing tools mainly target single-target memory vulnerabilities. HTTP parsing ambiguity vulnerabilities arise from parsing differences between multiple HTTP implementations, requiring simultaneous testing of multiple targets and involving the complex impact of message queues and TCP (Transmission Control Protocol) status, making existing tools difficult to directly apply. Summary of the Invention

[0004] The present invention provides a method and device for detecting Hypertext Transfer Protocol parsing ambiguity vulnerabilities, so as to solve the problems that existing tools mainly adopt black box testing methods, cannot utilize internal state information, have the natural defect of blind testing, and are difficult to discover deep-seated parsing ambiguity vulnerabilities. Existing tools mainly target HTTP request parsing vulnerabilities and have difficulty detecting HTTP response parsing vulnerabilities. In addition, HTTP parsing vulnerability attacks may destroy the message queue and TCP network stack state, affecting the stability of the fuzzy testing process, resulting in a large number of false positives and missed negatives. Existing tools lack an efficient state recovery mechanism.

[0005] A first aspect of the present invention provides a method for detecting Hypertext Transfer Protocol (HTTP) parsing ambiguity vulnerabilities, comprising the following steps: screening Hypertext Transfer Protocol (HTTP) messages based on gray-box testing to generate an initial seed library of the Hypertext Transfer Protocol (HTTP); based on the initial seed library, implementing at least one mutation strategy of sequence-level mutation, message-level mutation, and byte-level mutation on a target test case to generate a mutated test case; running the mutated test case using a snapshot-based execution framework to generate a target snapshot, and collecting coverage information of the Hypertext Transfer Protocol (HTTP) based on the target snapshot; detecting whether there is a difference in the output of a target implementation under test based on the coverage information and status information, and indicating the presence of a Hypertext Transfer Protocol (HTTP) parsing ambiguity vulnerability if the difference is detected in the target implementation under test; optimizing fuzz testing efficiency based on coverage-guided feedback scheduling to generate optimized data; based on the optimized data, generating a difference report that meets preset detailed conditions when a determiner detects ambiguity, and detecting whether the ambiguity is exploited as the Hypertext Transfer Protocol (HTTP) parsing ambiguity vulnerability based on the difference report to generate a detection result for the Hypertext Transfer Protocol (HTTP) parsing ambiguity vulnerability.

[0006] Optionally, in one embodiment of the present invention, the screening of hypertext transfer protocol messages based on gray box testing to generate an initial seed library of the hypertext transfer protocol includes: determining a test case format containing at least one message type of hypertext transfer protocol request, hypertext transfer protocol response and common gateway interface response based on hypertext transfer protocol grammar rules; and extracting initial seed test cases from network traffic based on the test case format to generate the initial seed library according to the initial seed test cases.

[0007] Optionally, in one embodiment of the present invention, the target test case is implemented with at least one mutation strategy of sequence-level mutation, message-level mutation and byte-level mutation to generate a mutated test case, including: in the case of adding or deleting the hypertext transfer protocol message, adjusting the sequence to trigger the message order or quantity difference, covering the ambiguity introduced by multiple messages according to the message order or the quantity difference, so as to implement the mutation strategy of the sequence-level mutation according to the ambiguity; based on the hypertext transfer protocol grammar rules, selecting the field of the hypertext transfer protocol for structured mutation, generating mutation data, and implementing the mutation strategy of the message-level mutation according to the mutation data; using at least one byte operation to cover the non-standard parsing ambiguity of the hypertext transfer protocol, generating a coverage result, and implementing the mutation strategy of the byte-level mutation according to the coverage result; generating the mutated test case based on the mutation strategy of the sequence-level mutation, the mutation strategy of the message-level mutation and the mutation strategy of the byte-level mutation.

[0008] Optionally, in one embodiment of the present invention, the snapshot-based execution framework is used to run the mutated test case, generate a target snapshot, and collect the coverage information of the hypertext transfer protocol based on the target snapshot, including: executing the mutated test case in parallel on the target tested implementation to generate parallel execution data, and creating a snapshot based on the parallel execution data after the initialization of the target tested implementation is completed to generate the target snapshot; based on the target snapshot, after the test case execution is completed, calling the corresponding application programming interface to restore the initial state of the target tested implementation; based on the initial state, using shared memory and client direct memory access to collect the coverage information.

[0009] Optionally, in one embodiment of the present invention, the detection of whether there are differences in the output of the target implementation under test based on the coverage information and the status information, and indicating the existence of a Hypertext Transfer Protocol parsing ambiguity vulnerability when the target implementation under test is detected to have the differences, includes: determining whether the number of messages, the order of messages, and the content or length of the message body in the status information meet a preset consistency condition, and detecting whether the status code in the status information is within a preset error range, and verifying whether the encoding type, header field value, and consumption length in the status information meet a preset matching condition; when the number of messages, the order of messages, and the content or length of the message body do not meet the preset consistency condition, the status code is not within a preset error range, and / or the encoding type, the header field value, and the consumption length do not meet the preset matching condition, determining that there are differences in the output of the target implementation under test; and indicating the existence of the Hypertext Transfer Protocol parsing ambiguity vulnerability when the target implementation under test has the differences.

[0010] Optionally, in one embodiment of the present invention, the coverage-guided feedback scheduling optimizes the fuzz testing efficiency to generate optimized data, including: merging the historical edge hit count table of the target tested implementation to generate merged data, and reflecting the coverage of the target tested implementation based on the merged data; based on the coverage, judging whether the input triggers the ambiguity; if the input triggers the ambiguity, discarding the input to optimize the fuzz testing efficiency and generate the optimized data.

[0011] The second aspect of the present invention provides a hypertext transfer protocol parsing ambiguity vulnerability detection device, including: a screening module for screening hypertext transfer protocol messages based on gray box testing to generate an initial seed library of the hypertext transfer protocol; a generation module for implementing at least one mutation strategy of sequence-level mutation, message-level mutation and byte-level mutation on the target test case based on the initial seed library to generate a mutated test case; a running module for running the mutated test case using a snapshot-based execution framework to generate a target snapshot, and collecting coverage information of the hypertext transfer protocol according to the target snapshot; an indication module for Based on the coverage information and the status information, it is detected whether there is a difference in the output of the target implementation under test, and when the difference is detected in the target implementation under test, it is indicated that there is a hypertext transfer protocol parsing ambiguity vulnerability; an optimization module is used to optimize the fuzz testing efficiency according to the coverage-guided feedback scheduling to generate optimization data; a detection module is used to generate a difference report that meets preset detailed conditions based on the optimization data when the determiner detects ambiguity, and detect whether the ambiguity is exploited as the hypertext transfer protocol parsing ambiguity vulnerability according to the difference report to generate a detection result of the hypertext transfer protocol parsing ambiguity vulnerability.

[0012] Optionally, in one embodiment of the present invention, the screening module includes: a determination unit for determining a test case format containing at least one message type of a Hypertext Transfer Protocol request, a Hypertext Transfer Protocol response and a Common Gateway Interface response based on Hypertext Transfer Protocol syntax rules; and an extraction unit for extracting initial seed test cases from network traffic based on the test case format to generate the initial seed library based on the initial seed test cases.

[0013] Optionally, in one embodiment of the present invention, the generation module includes: an adjustment unit, which is used to adjust the sequence to trigger message order or quantity differences when adding or deleting the hypertext transfer protocol message, and cover the ambiguity introduced by multiple messages according to the message order or the quantity difference, so as to implement the mutation strategy of the sequence-level mutation according to the ambiguity; a selection unit, which is used to select the fields of the hypertext transfer protocol for structured mutation based on the hypertext transfer protocol grammar rules, generate mutation data, and implement the mutation strategy of the message-level mutation according to the mutation data; a coverage unit, which is used to cover the non-standard parsing ambiguity of the hypertext transfer protocol using at least one byte operation, generate a coverage result, and implement the mutation strategy of the byte-level mutation according to the coverage result; a generation unit, which is used to generate the mutated test case based on the mutation strategy of the sequence-level mutation, the mutation strategy of the message-level mutation and the mutation strategy of the byte-level mutation.

[0014] Optionally, in one embodiment of the present invention, the running module includes: an execution unit, which is used to execute the mutated test case in parallel on the target tested implementation to generate parallel execution data, and create a snapshot based on the parallel execution data after the target tested implementation is initialized to generate the target snapshot; a recovery unit, which is used to call the corresponding application programming interface to restore the initial state of the target tested implementation based on the target snapshot after the test case execution is completed; and a collection unit, which is used to collect the coverage information based on the initial state using shared memory and client direct memory access.

[0015] Optionally, in one embodiment of the present invention, the indication module includes: a judgment unit, used to judge whether the number of messages, the message sequence and the message body content or length in the status information meet the preset consistency conditions, and detect whether the status code in the status information is in a preset error range, and verify whether the encoding type, header field value and consumption length in the status information meet the preset matching conditions; a judgment unit, used to determine that there is a difference in the output of the target tested implementation when the number of messages, the message sequence and the message body content or length do not meet the preset consistency conditions, the status code is not in the preset error range and / or the encoding type, the header field value and the consumption length do not meet the preset matching conditions; an indication unit, used to indicate the existence of the Hypertext Transfer Protocol parsing ambiguity vulnerability when the target tested implementation has the said difference.

[0016] Optionally, in one embodiment of the present invention, the optimization module includes: a merging unit, used to merge the historical edge hit count table of the target tested implementation, generate merged data, and reflect the coverage of the target tested implementation according to the merged data; a triggering unit, used to judge whether the input triggers the ambiguity based on the coverage; and an optimization unit, used to discard the input to optimize the fuzzy testing efficiency and generate the optimization data when the input triggers the ambiguity.

[0017] A third aspect of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the hypertext transfer protocol parsing ambiguity vulnerability detection method as described in the above embodiment.

[0018] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned hypertext transfer protocol parsing ambiguity vulnerability detection method.

[0019] A fifth aspect of the present invention provides a computer program product, which stores a computer program that, when executed by a processor, implements the above-mentioned method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities.

[0020] The embodiment of the present invention can use a gray-box fuzz testing method guided by code coverage for each test case during the testing process, combining a combined edge coverage table and historical coverage information to comprehensively explore the execution paths and branches of the HTTP implementation under test, ensuring the ability to detect deep-seated logical defects. During the testing process, the test case generation strategy is dynamically adjusted based on the code coverage of the implementation under test, and the seeds that are most likely to trigger HTTP parsing ambiguity vulnerabilities are adaptively selected. By comparing the parsing results of multiple HTTP implementations and combining them with internal state snapshots, the parsing differences can be automatically identified without manual intervention, the cause of the vulnerability can be accurately located, and a reproducible vulnerability exploit message can be generated. This solves the problems that existing tools mainly use black-box testing methods, cannot utilize internal state information, have the natural defects of blind testing, and have difficulty discovering deep-seated parsing ambiguity vulnerabilities. Existing tools mainly target HTTP request parsing vulnerabilities and have difficulty detecting HTTP response parsing vulnerabilities. In addition, HTTP parsing vulnerability attacks may destroy the message queue and TCP network stack state, affecting the stability of the fuzz testing process, resulting in a large number of false positives and false negatives, and existing tools lack an efficient state recovery mechanism.

[0021] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0023] Figure 1 A flowchart of a method for detecting an ambiguity vulnerability in hypertext transfer protocol parsing according to an embodiment of the present invention;

[0024] Figure 2 This is a flowchart of a method for detecting ambiguous vulnerabilities in hypertext transfer protocol parsing according to an embodiment of the present invention;

[0025] Figure 3 A schematic diagram of the structure of a device for detecting ambiguous vulnerabilities in hypertext transfer protocol parsing according to an embodiment of the present invention;

[0026] Figure 4 A schematic structural diagram of an electronic device provided according to an embodiment of the present invention.

[0027] Among them, 10-Hypertext Transfer Protocol parsing ambiguity vulnerability detection device; 100-screening module, 200-generation module, 300-operation module, 400-instruction module, 500-optimization module, 600-detection module; 401-memory, 402-processor, 403-communication interface. DETAILED DESCRIPTION

[0028] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0029] The following describes the hypertext transfer protocol parsing ambiguity vulnerability detection method and device of the embodiment of the present invention with reference to the accompanying drawings. In view of the fact that the existing tools mentioned in the above background technology mainly adopt black box testing methods, they cannot use internal state information, have the natural defect of blind testing, and are difficult to discover deep-level parsing ambiguity vulnerabilities. Existing tools mainly target HTTP request parsing vulnerabilities and are difficult to detect HTTP response parsing vulnerabilities. In addition, HTTP parsing vulnerability attacks may destroy the message queue and TCP network stack state, affecting the stability of the fuzz testing process, resulting in a large number of false positives and missed reports. The existing tools lack an efficient state recovery mechanism. The present invention provides a hypertext transfer protocol parsing ambiguity vulnerability detection method, which efficiently detects ambiguity problems in HTTP parsing and processing, guides the fuzz testing process to explore more execution paths by collecting coverage information during the execution of the target under test, and uses the coverage of multiple implementations to improve the probability of ambiguity triggering. This technology can not only discover ambiguity in HTTP request processing, but also extend to ambiguity detection in HTTP response and CGI response processing. By combining genetic algorithms with specialized strategies designed for the HTTP protocol, this approach achieves automation, efficiency, and comprehensiveness, providing network security researchers and developers with reliable tools for detecting HTTP parsing ambiguity-related vulnerabilities, with significant application prospects and commercial value. This approach addresses the inherent flaws of existing tools, which primarily rely on black-box testing methods and fail to leverage internal state information, resulting in blind testing and difficulty discovering deeper parsing ambiguity vulnerabilities. Existing tools primarily target HTTP request parsing vulnerabilities, making it difficult to detect HTTP response parsing vulnerabilities. Furthermore, HTTP parsing vulnerability attacks can disrupt the message queue and TCP network stack state, affecting the stability of the fuzz testing process and leading to numerous false positives and negatives. Furthermore, existing tools lack efficient state recovery mechanisms.

[0030] Specifically, Figure 1 A flowchart of a method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities provided by an embodiment of the present invention.

[0031] like Figure 1 As shown, the hypertext transfer protocol parsing ambiguity vulnerability detection method includes the following steps:

[0032] In step S101, hypertext transfer protocol messages based on grey box testing are screened to generate an initial seed library of the hypertext transfer protocol.

[0033] During actual execution, the embodiment of the present invention can screen Hypertext Transfer Protocol messages based on gray-box testing to generate an initial seed library of Hypertext Transfer Protocol, thereby providing diverse starting point inputs for subsequent fuzz testing.

[0034] Optionally, in one embodiment of the present invention, hypertext transfer protocol messages based on gray box testing are screened to generate an initial seed library of the hypertext transfer protocol, including: determining a test case format that includes at least one message type of hypertext transfer protocol request, hypertext transfer protocol response, and common gateway interface response based on hypertext transfer protocol grammar rules; and extracting initial seed test cases from network traffic based on the test case format to generate an initial seed library based on the initial seed test cases.

[0035] In this embodiment, a universal test case format is designed based on the HTTP syntax rules defined in the RFC specification, covering three message types: HTTP requests, HTTP responses, and CGI (Common Gateway Interface) responses. Each test case can contain multiple HTTP messages, each consisting of a start line, a field line, and a message body. The message body supports both unencoded and block-encoded formats. Test cases are stored in a dynamic tree structure, following the ABNF (Augmented Backus-Naur Form) syntax definition extracted from the RFC. Manually marking the data type of each field in the ABNF (Augmented Backus-Naur Form) facilitates the design of subsequent mutation strategies. Initial seed test cases are manually extracted from network traffic and converted to HTTP request, HTTP response, or CGI response formats as needed to generate an initial seed library to meet the needs of different test scenarios. This step provides diverse starting input for subsequent fuzz testing.

[0036] Compared with other automated detection solutions that only focus on a single type of vulnerability, this invention covers multiple attack scenarios such as request obfuscation, response theft, and response forgery by systematically testing HTTP requests, responses, and CGI (Common Gateway Interface) responses, significantly expanding the breadth of vulnerability detection. It can not only detect ambiguities in HTTP request processing, but also extend to ambiguity detection in HTTP response and CGI response processing.

[0037] In step S102, based on the initial seed library, at least one mutation strategy among sequence-level mutation, message-level mutation and byte-level mutation is implemented on the target test case to generate a mutated test case.

[0038] During the actual execution process, the embodiment of the present invention can implement at least one mutation strategy of sequence-level mutation, message-level mutation and byte-level mutation on the target test case based on the initial seed library to generate mutated test cases, provide support for generating diverse malformed HTTP messages, and significantly increase the possibility of triggering ambiguity.

[0039] Optionally, in one embodiment of the present invention, at least one mutation strategy among sequence-level mutation, message-level mutation and byte-level mutation is implemented on the target test case to generate a mutated test case, including: in the case of adding or deleting a hypertext transfer protocol message, adjusting the sequence to trigger the message order or quantity difference, covering the ambiguity introduced by multiple messages according to the message order or quantity difference, so as to implement the mutation strategy of sequence-level mutation according to the ambiguity; based on the hypertext transfer protocol grammar rules, selecting the fields of the hypertext transfer protocol for structured mutation, generating mutation data, and implementing the mutation strategy of message-level mutation according to the mutation data; using at least one byte operation to cover the non-standard parsing ambiguity of the hypertext transfer protocol, generating a coverage result, and implementing the mutation strategy of byte-level mutation according to the coverage result; generating a mutated test case based on the mutation strategy of sequence-level mutation, the mutation strategy of message-level mutation and the mutation strategy of byte-level mutation.

[0040] Specifically, in order to fully traverse the HTTP input space and trigger potential ambiguities, the embodiment of the present invention designs a three-level mutation strategy: (1) Sequence-level mutation: In view of the long connection and pipeline characteristics of HTTP, by randomly adding or deleting Hypertext Transfer Protocol messages, the sequence is adjusted to trigger message order or quantity differences, covering potential ambiguities introduced by multiple messages; (2) Message-level mutation: Based on HTTP grammar rules, fields are randomly selected for structured mutation, such as copying and deleting field rows, swapping or replacing values, and replacing block-encoded tail fields, which reduces the target space and improves the mutation quality, but weakens the data type requirements in the grammar definition; (3) Byte-level mutation: Introducing randomness, through byte operations (such as inserting, deleting, copying characters, or inserting seed library characters), covers non-standard parsing ambiguities caused by the "robustness principle". Each test case can be mutated multiple times through multiple mutation strategies in one run, thereby generating a variety of deformed HTTP messages, significantly improving the possibility of triggering ambiguity.

[0041] The embodiment of the present invention can generate mutated test cases based on sequence-level mutation strategies, message-level mutation strategies, and byte-level mutation strategies to provide support for subsequent operations.

[0042] In step S103, the mutated test case is run using a snapshot-based execution framework to generate a target snapshot, and coverage information of the Hypertext Transfer Protocol is collected based on the target snapshot.

[0043] During the actual execution process, the embodiment of the present invention can use a snapshot-based execution framework to run the mutated test case, generate a target snapshot, and collect the coverage information of the Hypertext Transfer Protocol based on the target snapshot, thereby using an automated gray-box fuzz testing framework combined with a snapshot executor to greatly improve the test speed, significantly reduce manpower and time costs, and maintain high detection accuracy.

[0044] The embodiments of the present invention guide the fuzz testing process to explore more execution paths by collecting coverage information during the execution of the target under test, and use the coverage of multiple implementations to improve the probability of ambiguous triggering. In addition, the present invention can use a snapshot-based execution framework to efficiently reset the network status using virtualized snapshots, avoiding the time-consuming operation of restarting the target, thereby ensuring the stability and reproducibility of the test process and solving the problem of inefficient state management in traditional technologies.

[0045] Optionally, in one embodiment of the present invention, a snapshot-based execution framework is used to run the mutated test case, generate a target snapshot, and collect coverage information of the hypertext transfer protocol based on the target snapshot, including: executing the mutated test case in parallel on the target tested implementation to generate parallel execution data, and creating a snapshot based on the parallel execution data after the target tested implementation is initialized to generate a target snapshot; based on the target snapshot, after the test case execution is completed, calling the corresponding application programming interface to restore the initial state of the target tested implementation; based on the initial state, using shared memory and client direct memory access to collect coverage information.

[0046] Specifically, the embodiment of the present invention can use a "snapshot-based execution framework" to run mutated test cases. The executor executes the input in parallel on two tested implementations to generate parallel execution data. The test controller communicates with the tested target through the Linux native socket API and uses the API (Application Programming Interface) of Nyx (fuzz testing tool or framework) to create a snapshot after the target initialization is completed. After the test case execution is completed, the test controller immediately calls the corresponding API to restore the initial state. For HTTP requests, the test controller directly sends the test case; for HTTP responses and CGI responses, the test controller listens to the port, receives the request forwarded by the tested target, and responds with the test case. During the execution process, coverage information is collected to the host machine through shared memory and client direct memory access. For the tested target implemented in an interpreted language, coverage is collected by modifying the interpreter bytecode; for compiled languages, Clang's SanitizerCoverage tool (code coverage tool) is used.

[0047] In step S104, whether there is a difference in the output of the target implementation under test is detected based on the coverage information and the status information, and if a difference is detected in the target implementation under test, it is indicated that there is a Hypertext Transfer Protocol parsing ambiguity vulnerability.

[0048] It can be understood that the embodiments of the present invention can simultaneously utilize coverage and internal state to generate test cases, thereby maximizing the triggering of HTTP parsing ambiguity vulnerabilities under multiple HTTP implementations, solving the problems of low test efficiency and incomplete coverage, and providing an HTTP parsing ambiguity vulnerability detection mechanism. By inserting code into the implementation under test, its internal state at runtime is extracted in real time, and parsing ambiguity vulnerabilities of HTTP requests and HTTP responses can be accurately detected at the same time, thereby comprehensively improving the efficiency, accuracy and stability of vulnerability mining, so as to solve the problems of limited test scope, lack of judgment mechanism and unstable test process in traditional technologies.

[0049] During actual execution, embodiments of the present invention can detect differences in the output of the target implementation under test based on coverage information and status information. If a difference is detected, it indicates the presence of a Hypertext Transfer Protocol parsing ambiguity vulnerability. During testing, a gray-box fuzzing approach guided by code coverage can be used for each test case, combining a combined edge coverage table and historical coverage information to comprehensively explore the execution paths and branches of the HTTP implementation under test, ensuring the ability to detect deep-seated logical defects. During testing, the test case generation strategy is dynamically adjusted based on the code coverage of the implementation under test, adaptively selecting the seeds most likely to trigger the HTTP parsing ambiguity vulnerability.

[0050] The detection solution in this embodiment of the present invention can trigger deep-seated code logic issues. It integrates multiple technical approaches, including an HTTP syntax-based test case generator, a coverage-guided seed scheduler, and a snapshot executor. This allows for the generation of complex and diverse test data, enabling in-depth exploration of the underlying logic of HTTP implementations. For example, coverage-guided discovery revealed novel differences in trailer field handling and response TE (Transfer-Encoding) / CL (Content-Length) processing, revealing vulnerabilities that were difficult to access using traditional methods.

[0051] Optionally, in one embodiment of the present invention, whether there are differences in the output of the target implementation under test is detected based on coverage information and status information, and when differences are detected in the target implementation under test, an indication is given of a Hypertext Transfer Protocol parsing ambiguity vulnerability, including: determining whether the number of messages, message sequence, and message body content or length in the status information meet preset consistency conditions, and detecting whether the status code in the status information is within a preset error range, and verifying whether the encoding type, header field value, and consumption length in the status information meet preset matching conditions; when the number of messages, message sequence, and message body content or length do not meet the preset consistency conditions, the status code is not within the preset error range, and / or the encoding type, header field value, and consumption length do not meet the preset matching conditions, determining that there are differences in the output of the target implementation under test; when differences are detected in the target implementation under test, an indication is given of a Hypertext Transfer Protocol parsing ambiguity vulnerability.

[0052] The determiner in this embodiment of the present invention can determine whether there are differences in the output of the two tested implementations based on the status information collected during execution. This status information is extracted in the form of a seven-tuple: Count (number of messages), Consumed (consumed length), Body (message body content or length), Encoding (encoding type), CL, Order (message order), and Status (status code). The determination rules include: first, comparing the Count, Body, and Order for consistency; then, checking whether the Status is within the error range (400-599); and finally, verifying whether the Encoding, CL, and Consumed match. If any of these rules are not met, the determination is ambiguous, potentially indicating an HTTP parsing ambiguity vulnerability.

[0053] It should be noted that the preset consistency condition, the preset error range and the preset matching condition can be set by those skilled in the art according to actual conditions and are not specifically limited here.

[0054] In step S105 , the fuzz testing efficiency is optimized according to the coverage-guided feedback scheduling to generate optimized data.

[0055] During actual execution, the embodiments of the present invention can optimize the fuzz testing efficiency according to coverage-guided feedback scheduling to generate optimized data, thereby providing a basis for continuously improving the quality of test cases.

[0056] Optionally, in one embodiment of the present invention, fuzz testing efficiency is optimized according to coverage-guided feedback scheduling to generate optimized data, including: merging the historical edge hit count table of the target tested implementation to generate merged data, and reflecting the coverage of the target tested implementation based on the merged data; based on the coverage, judging whether the input triggers ambiguity; if the input triggers ambiguity, discarding the input to optimize the fuzz testing efficiency and generate optimized data.

[0057] It can be understood that the target implementation under test in the embodiment of the present invention may be two implementations under test.

[0058] Among them, the embodiment of the present invention can reuse AFL's coverage guidance mechanism to reflect the coverage of the two tested targets by merging the historical edge hit count tables of the two tested implementations. If the input increases the coverage and does not trigger ambiguity, it is added to the seed library for subsequent mutation; if it triggers ambiguity, the input is discarded to avoid repeated detection, thereby optimizing fuzz testing efficiency. The feedback mechanism updates and maintains the seed library by prioritizing test cases that can explore new paths, continuously improving the quality of test cases.

[0059] In step S106, based on the optimized data, when the determiner detects ambiguity, a difference report that meets the preset detailed conditions is generated, and based on the difference report, it is detected whether the ambiguity is exploited as a hypertext transfer protocol parsing ambiguity vulnerability to generate a detection result of the hypertext transfer protocol parsing ambiguity vulnerability.

[0060] During actual implementation, embodiments of the present invention can generate a detailed difference report based on optimized data when the determiner detects ambiguity, and detect whether the ambiguity is exploited as a Hypertext Transfer Protocol parsing ambiguity vulnerability based on the difference report, thereby generating a detection result for the Hypertext Transfer Protocol parsing ambiguity vulnerability and improving the efficiency and accuracy of vulnerability discovery. The present invention can compare the parsing results of multiple HTTP implementations and combine them with internal state snapshots to automatically identify parsing differences without manual intervention, accurately locate the cause of the vulnerability, and generate a reproducible vulnerability exploit message.

[0061] Embodiments of the present invention, based on gray-box fuzz testing technology, can efficiently detect HTTP parsing ambiguity vulnerabilities caused by differences in parsing between HTTP implementations, such as request smuggling and response forgery. This significantly improves detection efficiency and enhances network security, quickly and accurately locating HTTP parsing ambiguity vulnerabilities, helping HTTP implementation developers identify and fix parsing discrepancies and improving server security. By combining genetic algorithms with specialized strategies designed for the HTTP protocol, the present invention achieves automation, efficiency, and comprehensiveness, providing network security researchers and developers with a reliable tool for detecting HTTP parsing ambiguity-related vulnerabilities, with significant application prospects and commercial value.

[0062] It should be noted that the preset detailed conditions can be set by those skilled in the art according to actual conditions and are not specifically limited here.

[0063] Specifically, it can be combined Figure 2 As shown, the working principle of the method for detecting ambiguous vulnerabilities in hypertext transfer protocol parsing in the embodiment of the present invention is described in detail with a specific embodiment.

[0064] like Figure 2 As shown, the workflow in the embodiment of the present invention is divided into the following steps:

[0065] Initial seed screening: Use tcpdump (a command-line network packet capture and analysis tool) to capture real network traffic on the router. Select a certain number of HTTP messages that cover different HTTP syntax rules, such as block encoding or no encoding of header fields, and URL (Uniform Resource Locator) encoding, form encoding, JSON (JavaScript Object Notation, data interchange format), or binary format of message body content.

[0066] Test case generation and mutation: The seeds in the seed library are fed into the mutator to generate test cases through three mutation methods: sequence level, message level, and character level.

[0067] Test Case Execution: Test cases were sent to two pairs of HTTP implementations (test subjects A and B) and executed using snapshot technology. Code was instrumented to extract state seven-tuples, monitor the internal state of each implementation, and collect coverage information. Furthermore, to minimize multi-threaded interference, all implementations were configured to run in single-threaded mode.

[0068] Coverage Feedback and Seed Scheduling: The executor feeds coverage information and the detector feeds ambiguity resolution results back to the feedback module. The feedback module evaluates the effectiveness of the test cases based on the coverage information (using a combined edge coverage table) and ambiguity resolution results, generates new seeds, and stores them back in the seed library to optimize the generation of subsequent test cases.

[0069] Parsing discrepancy detection and reporting: The detector compares the state seven-tuples of two HTTP implementations, detects parsing ambiguities, generates reports, and records potential HTTP parsing ambiguity vulnerabilities.

[0070] Manual analysis and vulnerability confirmation: Detected parsing ambiguities are further manually analyzed to confirm whether there are any vulnerabilities.

[0071] The Hypertext Transfer Protocol parsing ambiguity vulnerability detection method proposed in accordance with the embodiment of the present invention implements differential fuzz testing guided by HTTP grammar rules and coverage, and makes full use of technical means such as snapshot execution, mutators and feedback mechanisms to adaptively generate high-quality test cases. At the same time, by detecting the ambiguity of HTTP parsing between two implementations, potential vulnerabilities are successfully identified, solving the problems of limited test scope and lack of coverage of HTTP responses and CGI responses in the prior art. The present invention can comprehensively test the edge cases and unexpected behaviors of the HTTP parser, providing an innovative solution for improving network security protection capabilities. As a result, it solves the problems that existing tools mainly use black box testing methods, cannot utilize internal state information, have the natural defects of blind testing, and are difficult to discover deep-seated parsing ambiguity vulnerabilities. Existing tools mainly target HTTP request parsing vulnerabilities and are difficult to detect HTTP response parsing vulnerabilities. In addition, HTTP parsing vulnerability attacks may destroy the message queue and TCP network stack state, affecting the stability of the fuzz testing process, resulting in a large number of false positives and false negatives, and existing tools lack an efficient state recovery mechanism.

[0072] Next, a device for detecting ambiguous vulnerabilities in hypertext transfer protocol parsing according to an embodiment of the present invention will be described with reference to the accompanying drawings.

[0073] Figure 3 It is a structural diagram of a device for detecting ambiguous vulnerabilities in hypertext transfer protocol parsing according to an embodiment of the present invention.

[0074] like Figure 3 As shown, the hypertext transfer protocol parsing ambiguity vulnerability detection device 10 includes: a screening module 100, a generation module 200, an operation module 300, an instruction module 400, an optimization module 500 and a detection module 600.

[0075] Specifically, the screening module 100 is used to screen hypertext transfer protocol messages based on gray box testing to generate an initial seed library of the hypertext transfer protocol.

[0076] The generation module 200 is used to implement at least one mutation strategy of sequence-level mutation, message-level mutation and byte-level mutation on the target test case based on the initial seed library to generate a mutated test case.

[0077] The running module 300 is used to run the mutated test case using the snapshot-based execution framework, generate a target snapshot, and collect coverage information of the Hypertext Transfer Protocol according to the target snapshot.

[0078] The indication module 400 is configured to detect whether there is a difference in the output of the target implementation under test based on the coverage information and the status information, and indicate the existence of a Hypertext Transfer Protocol parsing ambiguity vulnerability if a difference is detected in the target implementation under test.

[0079] The optimization module 500 is used to optimize the fuzz testing efficiency according to the coverage-guided feedback scheduling to generate optimization data.

[0080] The detection module 600 is used to generate a difference report that meets preset detailed conditions based on the optimized data when the determiner detects ambiguity, and detect whether the ambiguity is exploited as a hypertext transfer protocol parsing ambiguity vulnerability based on the difference report to generate a detection result of the hypertext transfer protocol parsing ambiguity vulnerability.

[0081] Optionally, in one embodiment of the present invention, the screening module 100 includes: a determination unit and an extraction unit.

[0082] The determining unit is configured to determine a test case format including at least one message type of a hypertext transfer protocol request, a hypertext transfer protocol response, and a universal gateway interface response based on a hypertext transfer protocol grammar rule.

[0083] The extraction unit is used to extract initial seed test cases from network traffic based on a test case format, so as to generate an initial seed library according to the initial seed test cases.

[0084] Optionally, in one embodiment of the present invention, the generation module 200 includes: an adjustment unit, a selection unit, a covering unit and a generation unit.

[0085] The adjustment unit is used to adjust the sequence to trigger message order or quantity differences when adding or deleting Hypertext Transfer Protocol messages, and to cover the ambiguity introduced by multiple messages according to the message order or quantity differences, so as to implement a mutation strategy of sequence-level mutation according to the ambiguity.

[0086] The selection unit is used to select fields of the hypertext transfer protocol for structural mutation based on the hypertext transfer protocol syntax rules, generate mutation data, and implement a mutation strategy of message-level mutation according to the mutation data.

[0087] The covering unit is used for covering the non-standard parsing ambiguity of the hypertext transfer protocol by using at least one byte operation, generating a covering result, and implementing a mutation strategy of byte-level mutation according to the covering result.

[0088] The generation unit is used to generate mutated test cases based on the mutation strategy of sequence-level mutation, message-level mutation and byte-level mutation.

[0089] Optionally, in one embodiment of the present invention, the running module 300 includes: an execution unit, a recovery unit, and a collection unit.

[0090] The execution unit is used to execute the mutated test case in parallel on the target implementation under test to generate parallel execution data, and create a snapshot based on the parallel execution data after the target implementation under test is initialized to generate a target snapshot.

[0091] The recovery unit is used to call the corresponding application programming interface to restore the initial state of the target under test implementation based on the target snapshot after the test case execution is completed.

[0092] The collecting unit is used for collecting coverage information based on an initial state by utilizing shared memory and client direct memory access.

[0093] Optionally, in one embodiment of the present invention, the indication module 400 includes: a judgment unit, a determination unit and an indication unit.

[0094] Among them, the judgment unit is used to judge whether the number of messages, message order and message body content or length in the status information meet the preset consistency conditions, and detect whether the status code in the status information is within the preset error range, and verify whether the encoding type, header field value and consumption length in the status information meet the preset matching conditions.

[0095] The determination unit is used to determine that there is a difference in the output of the target tested implementation when the number of messages, message sequence and message body content or length do not meet the preset consistency conditions, the status code is not within the preset error range and / or the encoding type, header field value and consumption length do not meet the preset matching conditions.

[0096] An indication unit is used to indicate the existence of a hypertext transfer protocol parsing ambiguity vulnerability when there are differences in the target tested implementation.

[0097] Optionally, in one embodiment of the present invention, the optimization module 500 includes: a merging unit, a triggering unit, and an optimization unit.

[0098] The merging unit is used to merge the historical edge hit count tables of the target implementation under test, generate merged data, and reflect the coverage of the target implementation under test according to the merged data.

[0099] The trigger unit is used to determine whether the input triggers ambiguity based on the coverage situation.

[0100] The optimization unit is used to discard input when input triggers ambiguity to optimize fuzz testing efficiency and generate optimized data.

[0101] It should be noted that the above explanation of the embodiment of the hypertext transfer protocol parsing ambiguity vulnerability detection method is also applicable to the hypertext transfer protocol parsing ambiguity vulnerability detection device of this embodiment, and will not be repeated here.

[0102] The Hypertext Transfer Protocol parsing ambiguity vulnerability detection device proposed in an embodiment of the present invention can use a code coverage-guided gray-box fuzzing approach for each test case during testing, combining a combined edge coverage table and historical coverage information to comprehensively explore the execution paths and branches of the HTTP implementation under test, ensuring the ability to detect deep-seated logical defects. During testing, the test case generation strategy is dynamically adjusted based on the code coverage of the tested implementation, adaptively selecting seeds that are most likely to trigger HTTP parsing ambiguity vulnerabilities. By comparing the parsing results of multiple HTTP implementations and combining them with internal state snapshots, it can automatically identify parsing differences without manual intervention, accurately locate the cause of the vulnerability, and generate reproducible vulnerability exploit packets. This solves the problems of existing tools that mainly use black-box testing methods, cannot utilize internal state information, suffer from the inherent defects of blind testing, and have difficulty discovering deep-seated parsing ambiguity vulnerabilities. Existing tools mainly target HTTP request parsing vulnerabilities, but have difficulty detecting HTTP response parsing vulnerabilities. HTTP parsing vulnerability attacks can damage the message queue and TCP network stack state, affecting the stability of the fuzzing process, resulting in a large number of false positives and false negatives. Existing tools also lack efficient state recovery mechanisms.

[0103] Figure 4 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device may include:

[0104] Memory 401 , processor 402 , and computer programs stored in the memory 401 and executable on the processor 402 .

[0105] When the processor 402 executes the program, the method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities provided in the above embodiment is implemented.

[0106] Furthermore, the electronic device further includes:

[0107] The communication interface 403 is used for communication between the memory 401 and the processor 402 .

[0108] The memory 401 is used to store computer programs that can be run on the processor 402 .

[0109] The memory 401 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0110] If the memory 401, processor 402, and communication interface 403 are implemented independently, the communication interface 403, memory 401, and processor 402 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0111] Optionally, in a specific implementation, if the memory 401 , the processor 402 and the communication interface 403 are integrated on a chip, the memory 401 , the processor 402 and the communication interface 403 can communicate with each other through an internal interface.

[0112] The processor 402 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0113] This embodiment also provides a computer-readable storage medium having a computer program stored thereon. When the program is executed by a processor, the method for detecting an ambiguity vulnerability in hypertext transfer protocol parsing is implemented as described above.

[0114] An embodiment of the present invention further provides a computer program product, which stores a computer program. When the program is executed by a processor, the method for detecting an ambiguity vulnerability in hypertext transfer protocol parsing is implemented.

[0115] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0116] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "N" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0117] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or N executable instructions for implementing a custom logical function or step of a process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0118] The logic and / or steps represented in a flowchart or otherwise described herein, for example, can be considered a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" is any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (not exhaustive) of computer-readable media include: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program can be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing it in other suitable ways as necessary, and then storing it in a computer memory.

[0119] It should be understood that various components of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiment, the N steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having logic gate circuits for implementing logical functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field-programmable gate array (FPGA), etc.

[0120] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0121] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

[0122] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and are not to be construed as limiting the present invention. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities, characterized in that: The following steps are involved: Screening Hypertext Transfer Protocol messages based on grey-box testing to generate an initial seed library of Hypertext Transfer Protocol; Based on the initial seed library, performing at least one mutation strategy of sequence-level mutation, message-level mutation, and byte-level mutation on the target test case to generate a mutated test case; Adopting a snapshot-based execution framework to run the mutated test case, generate a target snapshot, and collect coverage information of the hypertext transfer protocol according to the target snapshot, wherein adopting a snapshot-based execution framework to run the mutated test case, generate a target snapshot, and collect coverage information of the hypertext transfer protocol according to the target snapshot includes: executing the mutated test case in parallel on a target implementation under test to generate parallel execution data, and creating a snapshot based on the parallel execution data after the initialization of the target implementation under test is completed to generate a target snapshot; based on the target snapshot, after the test case execution is completed, calling a corresponding application programming interface to restore the initial state of the target implementation under test; based on the initial state, using shared memory and client direct memory access to collect the coverage information; detecting whether there is a difference in output of the target implementation under test based on the coverage information and the status information, and indicating the presence of a Hypertext Transfer Protocol parsing ambiguity vulnerability if the difference is detected in the target implementation under test; Optimize fuzz testing efficiency based on coverage-guided feedback scheduling to generate optimized data; Based on the optimized data, when the determiner detects ambiguity, a difference report that meets preset detailed conditions is generated, and according to the difference report, it is detected whether the ambiguity is exploited as the hypertext transfer protocol parsing ambiguity vulnerability, so as to generate a detection result of the hypertext transfer protocol parsing ambiguity vulnerability.

2. The method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities according to claim 1, characterized in that: The screening of hypertext transfer protocol messages based on gray box testing to generate an initial seed library of the hypertext transfer protocol includes: Determining, based on a hypertext transfer protocol grammar rule, a test case format including at least one message type of a hypertext transfer protocol request, a hypertext transfer protocol response, and a common gateway interface response; Based on the test case format, initial seed test cases are extracted from network traffic to generate the initial seed library according to the initial seed test cases.

3. The method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities according to claim 1, wherein: The step of implementing at least one mutation strategy of sequence-level mutation, message-level mutation, and byte-level mutation on the target test case to generate a mutated test case includes: In the case of adding or deleting the hypertext transfer protocol message, adjusting the sequence to trigger a message order or quantity difference, covering the ambiguity introduced by multiple messages according to the message order or the quantity difference, so as to implement the mutation strategy of the sequence-level mutation according to the ambiguity; Based on the syntax rules of the Hypertext Transfer Protocol, select the fields of the Hypertext Transfer Protocol for structural mutation, generate mutation data, and implement the mutation strategy of the message-level mutation according to the mutation data; Using at least one byte operation to cover the non-standard parsing ambiguity of the hypertext transfer protocol, generating a coverage result, and implementing the mutation strategy of the byte-level mutation according to the coverage result; Based on the mutation strategy of the sequence-level mutation, the mutation strategy of the message-level mutation, and the mutation strategy of the byte-level mutation, the mutated test case is generated.

4. The method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities according to claim 1, wherein: The detecting whether there is a difference in the output of the target implementation under test based on the coverage information and the status information, and indicating the existence of a Hypertext Transfer Protocol parsing ambiguity vulnerability when the target implementation under test is detected to have the difference, includes: Determine whether the number of messages, message order, and message body content or length in the status information meet preset consistency conditions, detect whether the status code in the status information is within a preset error range, and verify whether the encoding type, header field value, and consumption length in the status information meet preset matching conditions; If the number of messages, the message sequence, and the message body content or length do not satisfy the preset consistency condition, the status code is not within a preset error range, and / or the encoding type, the header field value, and the consumption length do not satisfy the preset matching condition, determining that there is a difference in the output of the target tested implementation; When the target tested implementation has the difference, it indicates that the hypertext transfer protocol parsing ambiguity vulnerability exists.

5. The method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities according to claim 1, wherein: The optimization of fuzz testing efficiency based on coverage-guided feedback scheduling to generate optimized data includes: Merging the historical edge hit count tables of the target implementation under test to generate merged data, and obtaining coverage of the target implementation under test based on the merged data; Based on the coverage situation, determining whether the input triggers the ambiguity; If the input triggers the ambiguity, the input is discarded to optimize the fuzz testing efficiency and generate the optimized data.

6. A hypertext transfer protocol parsing ambiguity vulnerability detection device, characterized in that: include: A screening module, for screening hypertext transfer protocol messages based on grey box testing to generate an initial seed library of the hypertext transfer protocol; A generation module, configured to implement at least one mutation strategy of sequence-level mutation, message-level mutation, and byte-level mutation on a target test case based on the initial seed library to generate a mutated test case; A running module, configured to run the mutated test case using a snapshot-based execution framework, generate a target snapshot, and collect coverage information of the hypertext transfer protocol based on the target snapshot, wherein the running module includes: an execution unit, configured to execute the mutated test case in parallel on a target implementation under test, generate parallel execution data, and create a snapshot based on the parallel execution data after the target implementation under test is initialized to generate a target snapshot; a recovery unit, configured to call a corresponding application programming interface to restore the initial state of the target implementation under test based on the target snapshot after the test case is executed; and a collection unit, configured to collect the coverage information based on the initial state using shared memory and client direct memory access; an indication module, configured to detect whether there is a difference in the output of the target tested implementation based on the coverage information and the status information, and indicate the existence of a Hypertext Transfer Protocol parsing ambiguity vulnerability if the difference is detected in the target tested implementation; An optimization module, for optimizing fuzz testing efficiency based on coverage-guided feedback scheduling to generate optimization data; A detection module is configured to generate, based on the optimization data, a difference report that satisfies preset detailed conditions when the determiner detects ambiguity, and detect, based on the difference report, whether the ambiguity is exploited as the hypertext transfer protocol parsing ambiguity vulnerability, so as to generate a detection result of the hypertext transfer protocol parsing ambiguity vulnerability.

7. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the hypertext transfer protocol parsing ambiguity vulnerability detection method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that The computer program is executed to implement the method for detecting hypertext transfer protocol parsing ambiguity vulnerabilities according to any one of claims 1 to 5.

Images