Fuzzy test-based industrial control network protocol security detection method

Abstract

The invention discloses an industrial control network protocol security detection method based on fuzzy testing, and belongs to the technical field of detection. According to the method disclosed by the invention, the protocol information is reversely deduced through the captured network flow during protocol entity communication, and the fuzzy test case is automatically constructed, so that industrial control protocol security detection is realized; under the condition that protocol priori knowledge does not need to be mastered, sequence alignment is conducted on original data through sequence comparison and sequence alignment algorithms, protocol information and a state machine model are deduced through similarity calculation, and the problem of obtaining protocol feature information needed by industrial control protocol fuzz test case generation is solved; a random generation strategy and a data variation strategy are combined to automatically and rapidly generate a paste test case, a large number of variation random inputs are sent to a tested target, behavior actions of the tested target are analyzed to achieve safety detection of an industrial control protocol, the problem that an existing fuzzy test method depends on manual single-field random filling to generate test data, and the efficiency is low is solved, and the test efficiency is improved. And the test accuracy is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of detection technology, and in particular relates to an industrial control network protocol security detection method based on fuzzy testing. Background Art

[0002] Industrial control systems (ICs) are widely used in key sectors such as rail transit, power generation, banking, communications, critical manufacturing, and emergency services, and are a vital component of national infrastructure. Industrial control protocols are the crucial link that enables the interconnectedness of numerous IC system functions, including real-time data exchange, data collection, status monitoring, anomaly diagnosis, command issuance, and execution. They carry crucial functions for data transmission and device control, and their security is closely linked to the reliable and stable operation of IC systems. Initially, designers focused on functionality and stability, neglecting security considerations. This can lead to numerous security risks in the design of IC protocols. Industrial control fuzz testing is an automated testing technique for industrial control network protocols. Fuzz testing is generally defined as a negative testing technique that discovers security vulnerabilities by sending a large number of invalid, unexpected, mutated, or random inputs to a target system or device and monitoring for erroneous results. However, existing fuzz testing methods for IC protocols suffer from low test case generation efficiency, insufficient test coverage, and low testing efficiency.

[0003] Figure 1 This is a flow chart of a traditional mutation-based fuzz testing method for industrial control network protocols. When fuzz testing a network protocol, the normal communication data stream is captured, and the captured data packets are mutated through random or heuristic mutation strategies to generate test cases. Potential security vulnerabilities are discovered by sending a large number of invalid, mutated inputs to the target under test and monitoring the incorrect results. This type of fuzz testing method can construct test cases with little or no knowledge of the protocol format or syntax of the test target, thus saving a lot of manpower costs for researching information such as network protocol formats. However, due to the blind modification of this technology, the mutated test cases may not meet the acceptance requirements of the test target protocol stack, resulting in a significant reduction in the use case acceptance rate. It also makes it difficult to discover deeper security vulnerabilities, which in turn affects the efficiency of fuzz testing.

[0004] Existing industrial control protocol security testing often uses mutation-based fuzz testing techniques. This technique requires no prior knowledge of the protocol and instead generates test cases by mutating captured data packets through mutation strategies. While this approach offers low testing difficulty, it also exhibits a high degree of randomness, resulting in a low test data hit rate and difficulty ensuring testing efficiency. Furthermore, generation-based fuzz testing techniques analyze the protocol to obtain protocol information and state machine models, generating test cases that adhere closely to the protocol specification. This reduces the randomness of the test, but test case generation is difficult to automate and the testing process relies heavily on manual analysis. Testing efficiency is highly dependent on the tester's experience and skills, leading to high testing costs. Summary of the Invention

[0005] In response to the above technical problems existing in the prior art, the present invention proposes an industrial control network protocol security detection method based on fuzzy testing, which has a reasonable design, overcomes the shortcomings of the prior art, and has good results.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A method for detecting the security of an industrial control network protocol based on fuzz testing includes the following steps:

[0008] Step 1: Traffic capture;

[0009] Use packet capture tools to capture the real network traffic of industrial control protocols and store the protocol data packets in a specific format;

[0010] Step 2: Protocol clustering;

[0011] Through static sequence alignment, the collected data is segmented and locally aligned to complete preliminary clustering of protocols and form sequence clusters;

[0012] Step 3: Format inference;

[0013] The clustered protocol sequences are aligned by inserting padding symbols using a sequence alignment method, and the similarity of different protocol sequences is determined by the protocol edit distance calculation method, thereby parsing the protocol feature field format information;

[0014] Step 4: Use case generation;

[0015] Construct normal data packets based on the inferred protocol format information, and generate fuzzy test cases by combining random generation strategy and data mutation strategy;

[0016] Step 5: Fuzz test execution;

[0017] Use network socket to send fuzz test cases to the device under test;

[0018] Step 6: Abnormal monitoring;

[0019] Through monitoring means, monitor the abnormal conditions of the target under test and record the test cases that trigger the abnormalities.

[0020] Preferably, in step 2, the collected data is segmented using a rule from short to long, and the protocol sequences are locally aligned pairwise until all sequences have participated in the alignment.

[0021] Preferably, in step 3, the similarity calculation steps are as follows:

[0022] Step 3.1: Calculate the protocol sequence similarity score P1;

[0023] According to formula (1), calculate the two protocol sequences m i and m j The similarity calculation score K i,j :

[0024]

[0025] Among them, d(m i ,m j ) represents m i and m j The minimum number of addition, deletion, and replacement operations required to convert two identical sequences, max(m i ,m j ) represents the length of the longest message sequence between the two sequences; N represents the number of clusters;

[0026] Step 3.2: Calculate the intra-cluster agreement sequence structure similarity score P2;

[0027] Structural similarity was determined by calculating the average number of “-” symbols within each cluster;

[0028]

[0029] in, Indicates the total amount of “-” symbols in the group;

[0030] Step 3.3: Calculate the keyword position field score P3;

[0031] After sequence alignment, the keyword with the highest score is selected based on the two metrics of protocol sequence similarity score P1 and intra-cluster protocol sequence structure similarity score P2, and the field offset value d is calculated. c and d s , and the field length l c and l s , calculate the keyword position field score P3 through formula (3);

[0032]

[0033] Step 3.4: Multiply the three metrics (protocol sequence similarity score P1, intra-cluster protocol sequence structure similarity score P2, and keyword position field score P3) to obtain the probability of each candidate keyword being the actual keyword. The candidate keyword with the largest probability value is the most likely keyword.

[0034] Step 3.5: After determining the keywords, cluster the messages with the same keywords and infer the protocol format and state machine model based on them.

[0035] Preferably, in step 4, the data mutation strategy includes random filling, boundary value replacement and format destruction operations on the protocol field.

[0036] Preferably, in step 5, data packets are sent to the device under test in the form of "address + port" through the network Socket interface, and the device under test receives and parses these data packets and then performs corresponding operations; the data parsing process is assisted by directly reading the memory or capturing the network packet.

[0037] Preferably, in step 6, the monitoring means include monitoring package mode, process monitoring, behavior monitoring, and logs; the monitoring package mode determines whether the target is abnormal based on the returned data: if the returned data is normal, it means that the target being measured is normal; if no data is returned or abnormal data is returned, it is necessary to judge the status of the target based on the results.

[0038] The beneficial technical effects brought about by the present invention are:

[0039] The present invention proposes a method for industrial control network protocol security detection based on fuzzy testing. By capturing the network traffic during communication between protocol entities, the protocol information is reversely inferred, and fuzzy test cases are automatically constructed to achieve industrial control protocol security detection. Without the need to master prior knowledge of the protocol, the present invention uses sequence comparison and sequence alignment algorithms to align the original data, and infers the protocol information and state machine model through similarity calculation, solving the problem of obtaining the protocol feature information required for the generation of industrial control protocol fuzzy test cases. Combining random generation strategies and data mutation strategies, fuzzy test cases are automatically and quickly generated. By sending a large number of mutated random inputs to the target under test and analyzing the behavior of the target under test, the security detection of the industrial control protocol is achieved, solving the problem of low efficiency of the existing fuzzy testing method that relies on manual single-field random filling to generate test data, while improving test efficiency and ensuring high test accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A diagram for traditional mutation-based fuzz testing of industrial control network protocols;

[0041] Figure 2 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0043] The present invention designs a method for industrial control network protocol security detection based on fuzzy testing, the process of which is as follows: Figure 2 The specific steps are as follows:

[0044] Step 1: Use Wireshark to capture real traffic as the raw data for the next step of data processing, and store the protocol data packets in a specific format;

[0045] Step 2: Through static sequence alignment, the collected data is first segmented using the rule of short to long, and the protocol sequences are locally aligned pairwise until all sequences have participated in the alignment, completing the preliminary clustering of protocols and forming sequence clusters;

[0046] Step 3: Use the Needleman-Wunsch algorithm to align the clustered protocol sequences by inserting the "-" symbol. Use the protocol edit distance calculation method to determine the similarity of different protocol sequences, and then parse the protocol feature field format information. The similarity calculation steps are as follows:

[0047] (1) Protocol sequence similarity score

[0048] Two protocol sequences m i and m j The calculation formula for the similarity calculation score is as follows:

[0049]

[0050] Where d(m i ,m j ) represents m i and m j The minimum number of addition, deletion, and replacement operations required to convert two identical sequences, max(m i ,m j ) represents the length of the longest message sequence among the two sequences.

[0051] (2) Structural similarity score of protocol sequences within the cluster;

[0052] The structural similarity was determined using the average number of “one” symbols within each cluster.

[0053]

[0054] in, represents the total amount of “one” symbols in the group, and N represents the number of clusters.

[0055] (3) Keyword position field scoring

[0056] After sequence alignment, the keyword with the highest score is selected based on the above two metrics, and the field offset value d is calculated. c and d s , and the field length l c and l s , calculate the keyword position field score P3 through formula (3).

[0057]

[0058] The probability of a candidate keyword being the actual keyword is the product of the three metrics above. The highest value is the most likely keyword. After the keyword is determined, messages with the same keyword are clustered and the protocol format and state machine model are inferred to guide test case generation.

[0059] Step 4: Construct a normal data packet based on the protocol format information inferred in step 3, and generate fuzzy test cases by combining the random generation strategy and data mutation strategy;

[0060] Step 5: Fuzz test execution, using the network Socket method, sending data packets through the "address + port" method. The device under test parses the data packets and performs related operations by receiving data packets, directly reading and capturing packets.

[0061] Step 6: Monitor the target for abnormalities and record the test cases that trigger them. Monitoring methods include package monitoring, process monitoring, behavior monitoring, and logging. The package monitoring method determines whether the target is abnormal based on the returned data: if the returned data is normal, the target is normal. If no data is returned or abnormal data is returned, the target's status must be determined based on the results.

[0062] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Changes, modifications, additions or substitutions made by technicians in this technical field within the essential scope of the present invention should also fall within the scope of protection of the present invention.

Claims

1. A method for industrial control network protocol security detection based on fuzzy testing, characterized in that: The following steps are involved: Step 1: Traffic capture; Use packet capture tools to capture the real network traffic of industrial control protocols and store the protocol data packets in a specific format; Step 2: Protocol clustering; Through static sequence alignment, the collected data is segmented and locally aligned to complete preliminary clustering of protocols and form sequence clusters; Step 3: Format inference; The clustered protocol sequences are aligned by inserting padding symbols using a sequence alignment method, and the similarity of different protocol sequences is determined by the protocol edit distance calculation method, thereby parsing the protocol feature field format information; Step 4: Use case generation; Construct normal data packets based on the inferred protocol format information, and generate fuzzy test cases by combining random generation strategy and data mutation strategy; Step 5: Fuzz test execution; Use network socket to send fuzz test cases to the device under test; Step 6: Abnormal monitoring; Through monitoring means, monitor the abnormal conditions of the target under test and record the test cases that trigger the abnormalities.

2. The industrial control network protocol security detection method based on fuzzy testing according to claim 1 is characterized in that: In step 2, the collected data is segmented using the short-to-long rule, and the protocol sequences are partially compared pairwise until all sequences have been compared.

3. The industrial control network protocol security detection method based on fuzzy testing according to claim 1 is characterized in that: In step 3, the similarity calculation steps are as follows: Step 3.1: Calculate the protocol sequence similarity score P1; According to formula (1), calculate the two protocol sequences m i and m j The similarity calculation score K i,j : Among them, d(m i ,m j ) represents m i and m j The minimum number of addition, deletion, and replacement operations required to convert two identical sequences, max(m i ,m j ) represents the length of the longest message sequence between the two sequences; N represents the number of clusters; Step 3.2: Calculate the intra-cluster agreement sequence structure similarity score P2; Structural similarity was determined by calculating the average number of "-" symbols within each cluster; in, Indicates the total amount of "-" symbols in the group; Step 3.3: Calculate the keyword position field score P3; After sequence alignment, the keyword with the highest score is selected based on the two metrics of protocol sequence similarity score P1 and intra-cluster protocol sequence structure similarity score P2, and the field offset value d is calculated. c and d s , and the field length l c and l s , calculate the keyword position field score P3 through formula (3); Step 3.4: Multiply the three metrics (protocol sequence similarity score P1, intra-cluster protocol sequence structure similarity score P2, and keyword position field score P3) to obtain the probability of each candidate keyword being the actual keyword. The candidate keyword with the largest probability value is the most likely keyword. Step 3.5: After determining the keywords, cluster the messages with the same keywords and infer the protocol format and state machine model based on them.

4. The industrial control network protocol security detection method based on fuzzy testing according to claim 1 is characterized in that: In step 4, the data mutation strategy includes random padding, boundary value replacement, and format destruction operations on the protocol field.

5. The industrial control network protocol security detection method based on fuzzy testing according to claim 1 is characterized in that: In step 5, data packets are sent to the device under test in the form of "address + port" through the network socket interface. The device under test receives and parses these data packets and then performs corresponding operations. The data parsing process is assisted by directly reading memory or network packet capture.

6. The industrial control network protocol security detection method based on fuzzy testing according to claim 1 is characterized in that: In step 6, monitoring methods include monitoring package mode, process monitoring, behavior monitoring, and logs; the monitoring package mode determines whether the target is abnormal based on the returned data: if the returned data is normal, it means that the target is normal; if no data is returned or abnormal data is returned, it is necessary to judge the status of the target based on the results.

Images