Industrial internet of things unknown protocol fuzzing method, system, device and medium

Abstract

The application belongs to the field of network space security, and discloses an unknown protocol fuzzing method, system, device and medium for an industrial Internet of Things, which comprises the following steps: acquiring an execution process log of unknown protocol data in a protocol stack based on a virtual environment; establishing a tree-shaped representation structure for each bit of the unknown protocol data according to the execution process log; acquiring each field of the unknown protocol data according to the similarity of the tree-shaped representation structures of adjacent bits; acquiring the field types of each field of the unknown protocol data by an information theory measurement method; generating fuzzing test data for each field of the unknown protocol data according to a preset variation rule of the field types; and performing fuzzing test on the unknown protocol of the industrial Internet of Things according to the fuzzing test data. The unknown protocol fuzzing method does not depend on protocol documents and expert prior knowledge of the industrial Internet of Things, can perform efficient fuzzing test on unknown protocols of the Internet of Things, can perform security detection on unknown protocols of the Internet of Things, and can find security vulnerabilities in Internet of Things devices.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security and relates to a method, system, device and medium for fuzzy testing of unknown protocols in the industrial Internet of Things. Background Technology

[0002] The Industrial Internet of Things (IIoT) industry often uses proprietary, undocumented network communication protocols. These protocols are generally improvements on traditional network communication protocols to enable communication between specific IIoT systems. Ensuring secure and stable communication within IIoT systems is crucial, as determining the robustness and security of the used IIoT communication protocols is essential. Fuzzing is an important technique for vulnerability detection and is widely used in software testing. Fuzzing primarily involves generating required test samples according to certain rules and automatically sending these samples to the test target to induce anomalies. Fuzzing methods can also be applied to vulnerability detection in IIoT protocol security testing.

[0003] Currently, there are three main methods for fuzz testing of industrial IoT protocols: (1) Obtain the documentation of the industrial IoT protocol in advance to understand the specific format of the protocol, and set different mutation rules for different fields in the protocol to realize the mutation of protocol data and the generation of test samples. (2) In the absence of industrial IoT protocol documentation, use the fingerprint matching information and network protocol matching rule information of existing network protocols to identify the fields in the IoT protocol, and generate fuzz test samples based on the identification results. (3) In the absence of industrial IoT protocol documentation, use tools such as Wireshark to capture network communication traffic in real time, and use methods such as keyword clustering to identify the field boundaries in the protocol message, thereby selecting candidate keywords, and performing mutation to generate fuzz test samples.

[0004] However, the first existing method relies on the Industrial Internet of Things (IIoT) protocol documentation and cannot perform fuzz testing on unknown IIoT protocols; the second existing method requires prior knowledge from experts, and the effectiveness of fuzz testing is highly dependent on the expert's technical level and is unstable; although the third existing method does not rely on IIoT protocol documentation or prior knowledge from experts, its accuracy in identifying field boundaries of unknown IIoT protocols is not high, resulting in a large number of invalid test cases and low testing efficiency. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, system, device and medium for fuzzy testing of unknown protocols in the Industrial Internet of Things.

[0006] To achieve the above objectives, the present invention employs the following technical solution:

[0007] In a first aspect, the present invention provides a method for fuzz testing of unknown protocols in the Industrial Internet of Things (IIoT), comprising: acquiring execution process logs of unknown protocol data in a protocol stack based on a virtual environment; establishing a tree-like representation structure of each bit of the unknown protocol data based on the execution process logs; acquiring and obtaining each field of the unknown protocol data based on the similarity of the tree-like representation structures of adjacent bits; acquiring the field type of each field of the unknown protocol data through an information-theoretic metric method; generating fuzz test data for each field of the unknown protocol data according to a preset mutation rule for the field type; and performing fuzz testing of unknown protocols in the IIoT based on the fuzz test data.

[0008] Optionally, the step of obtaining the execution process log of unknown protocol data in the protocol stack based on the virtual environment includes: constructing a virtual environment for running the protocol stack and running an unknown industrial IoT protocol; instrumenting all CPU instructions of the virtual machine in the virtual environment using instrumentation technology; recording the instruction name and the addresses of all operands for all instructions involving memory operations to obtain the protocol stack execution process log; obtaining the initial storage address of the unknown protocol data flowing into the protocol stack; searching for log entries in the protocol stack execution process log that use the initial storage address as the source operand; and recursively searching for all log entries related to the unknown protocol data flowing into the protocol stack based on the destination operand address recorded in the found log entries to obtain the execution process log of the unknown protocol data in the protocol stack.

[0009] Optionally, establishing a tree representation structure for each bit of unknown protocol data based on the execution process log includes: obtaining the initial storage address of the unknown protocol data flowing into the protocol stack, and constructing the root node of the tree based on the initial storage address of the unknown protocol data flowing into the protocol stack; traversing each log entry of the execution process log, and when the source operand address in the current log entry is equal to the value of an existing node in the tree, creating a new node and setting the value of the new node to the destination operand address in the log entry, and establishing a branch between the new node and the node with the equal value; after traversal, the tree representation structure for each bit of unknown protocol data is obtained.

[0010] Optionally, obtaining the fields of the unknown protocol data based on the similarity of the tree representation structures of adjacent bits includes: using a branch sequence alignment algorithm to obtain the number of branches that can be aligned between the tree representation structures of adjacent bits as a first quantity, and obtaining the ratio of the first quantity to the total number of branches in the tree representation structures of adjacent bits to obtain the similarity of the tree representation structures of adjacent bits; obtaining the fields of the unknown protocol data according to the following determination rules: when the similarity of the tree representation structures of adjacent bits is less than a preset similarity threshold, it is determined that the adjacent bits do not belong to the same field; otherwise, it is determined that the adjacent bits belong to the same field.

[0011] Optionally, the method of obtaining the field type of each field of the unknown protocol data through information theory measurement includes: traversing each field of the unknown protocol data; when the field value of the current field has a linear relationship with the total length of the unknown protocol data, the field type of the current field is determined to be the total length field; when the field value of the current field has a linear relationship with the length of the next field of the unknown protocol data, the field type of the current field is determined to be the next field length field; when the field value of the current field takes values ​​within a finite range, the field type of the current field is determined to be the function code field; when the field value of the current field is a constant in the unknown protocol data of the same function code, the field type of the current field is determined to be the flag field; wherein, the function code is the field value of the function code field; when the field values ​​of the current fields of different unknown protocol data show an increasing trend after sorting the unknown protocol data according to the order of flowing into the protocol stack, and the difference between the information entropy of the field value change value and 0 meets a preset difference threshold, the field type of the current field is determined to be the sequence number field; when the data of the current field are all numbers, the field type of the current field is determined to be a finite change field; and the field type of unidentified fields is determined to be a random change field.

[0012] Optionally, the field value of the current field takes values ​​within a limited range, specifically: the randomness w(V) of the field value V of the current field is between 0.2 and 0.8.

[0013]

[0014] Where H(V) is the field value information entropy of the current field; |V| is the number of field values ​​of the current field.

[0015] The field value of the current field is a constant in each unknown protocol data of the same function code. Specifically, the information entropy of the field value of the current field in each unknown protocol data of the same function code is 0.

[0016] Optionally, the preset variation rules for the field type include: when the field type is a total data length field, the field value is set to the total length of the fuzzy test data when generating fuzzy test data; when the field type is a next field length field, the field value is set to the length of the next field adjacent to the current field when generating fuzzy test data; when the field type is a function code field, the field value is set to the corresponding preset function code according to the function of the fuzzy test data when generating fuzzy test data; when the field type is a flag field, the field value is set to any one of the preset values ​​of all flag fields when generating fuzzy test data; when the field type is a sequence number field, the field values ​​of each fuzzy test data are set to an increasing relationship of σ when generating multiple fuzzy test data, where σ is the preset value change of the sequence number field; when the field type is a finite variation field, the field value is set to any value between the preset maximum and minimum field values ​​of the finite variation field when generating fuzzy test data; when the field type is a random variation field, the field value is set to a random value when generating fuzzy test data.

[0017] In a second aspect, the present invention provides an industrial IoT unknown protocol fuzzing system, comprising: a log module for acquiring execution process logs of unknown protocol data in a protocol stack based on a virtual environment; a tree construction module for establishing a tree-like representation structure of each bit of the unknown protocol data based on the execution process logs; a field delimitation module for acquiring and obtaining each field of the unknown protocol data based on the similarity of the tree-like representation structures of adjacent bits; a field identification module for acquiring the field type of each field of the unknown protocol data through an information-theoretic metric method; and a testing module for generating fuzzy test data for each field of the unknown protocol data according to a preset mutation rule for the field type, and performing fuzzy testing of the unknown protocol in the industrial IoT based on the fuzzy test data.

[0018] In a third aspect, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described industrial Internet of Things unknown protocol fuzz testing method.

[0019] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described industrial Internet of Things unknown protocol fuzz testing method.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] This invention discloses a fuzz testing method for unknown protocols in the Industrial Internet of Things (IIoT). First, it acquires the execution process log of unknown protocol data within the protocol stack in a virtual environment. Then, it establishes a tree-like representation structure for each bit of the unknown protocol data based on the execution process log. Based on this tree-like representation structure, it obtains the fields of the unknown protocol data according to the similarity of the tree-like representation structures of adjacent bits. Next, it uses information theory metric methods to obtain the field types of each field of the unknown protocol data. Finally, based on preset mutation rules for the field types, it generates fuzz test data for each field of the unknown protocol data and performs fuzz testing on unknown IIoT protocols using this data. This method does not rely on IIoT protocol documents or expert prior knowledge, accurately identifies unknown protocol fields and types, and enables efficient fuzz testing of unknown IoT protocols. It can help cybersecurity engineers perform security testing on unknown IoT protocols and discover security vulnerabilities in IoT devices. Attached Figure Description

[0022] Figure 1 This is a flowchart of the industrial Internet of Things unknown protocol fuzz testing method according to an embodiment of the present invention.

[0023] Figure 2 This is a detailed flowchart of the industrial IoT unknown protocol fuzzing test method according to an embodiment of the present invention.

[0024] Figure 3 This is a schematic diagram illustrating the principle of the industrial Internet of Things unknown protocol fuzzy testing method according to an embodiment of the present invention.

[0025] Figure 4 This is a block diagram of the industrial Internet of Things unknown protocol fuzzy testing system according to an embodiment of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] The present invention will now be described in further detail with reference to the accompanying drawings:

[0029] See Figure 1 In one embodiment of the present invention, a fuzz testing method for unknown protocols of the Industrial Internet of Things (IIoT) is provided, which does not rely on IIoT protocol documents and expert prior knowledge, and achieves efficient fuzz testing.

[0030] Specifically, the industrial IoT unknown protocol fuzzing test method of the present invention includes the following steps:

[0031] S1: Obtain the execution process log of unknown protocol data in the protocol stack based on the virtual environment.

[0032] S2: Based on the execution process log, establish a tree-like representation structure for each bit of the unknown protocol data.

[0033] S3: Obtain and determine the fields of the unknown protocol data based on the similarity of the tree representation structure of adjacent bits.

[0034] S4: Obtain the field types of each field in the unknown protocol data using information theory measurement methods.

[0035] S5: Generate fuzzy test data for each field of the unknown protocol data according to the preset mutation rules of the field type, and perform fuzzy testing of unknown protocols in the Industrial Internet of Things based on the fuzzy test data.

[0036] This invention discloses a fuzz testing method for unknown protocols in the Industrial Internet of Things (IIoT). First, it acquires the execution process log of unknown protocol data within the protocol stack in a virtual environment. Then, it establishes a tree-like representation structure for each bit of the unknown protocol data based on the execution process log. Based on this tree-like representation structure, it obtains the fields of the unknown protocol data according to the similarity of the tree-like representation structures of adjacent bits. Next, it uses information theory metric methods to obtain the field types of each field of the unknown protocol data. Finally, based on preset mutation rules for the field types, it generates fuzz test data for each field of the unknown protocol data and performs fuzz testing on unknown IIoT protocols using this data. This method does not rely on IIoT protocol documents or expert prior knowledge, accurately identifies unknown protocol fields and types, and enables efficient fuzz testing of unknown IoT protocols. It can help cybersecurity engineers perform security testing on unknown IoT protocols and discover security vulnerabilities in IoT devices.

[0037] In one possible implementation, the step of obtaining the execution process log of unknown protocol data in the protocol stack based on the virtual environment includes: constructing a virtual environment for running the protocol stack and running an unknown industrial IoT protocol; instrumenting all CPU instructions of the virtual machine in the virtual environment using instrumentation technology; recording the instruction name and the addresses of all operands for all instructions involving memory operations to obtain the protocol stack execution process log; obtaining the initial storage address of the unknown protocol data flowing into the protocol stack; searching for log entries in the protocol stack execution process log that use the initial storage address as the source operand; and recursively searching for all log entries related to the unknown protocol data flowing into the protocol stack based on the destination operand address recorded in the found log entries to obtain the execution process log of the unknown protocol data in the protocol stack.

[0038] Explanatory, see Figure 2 and 3 In this embodiment, a virtual environment for analyzing the protocol stack execution process is first constructed. Then, instrumentation technology is used to instrument all CPU instructions of the virtual machine. Within the instrumentation function, for all instructions involving memory operations, the name of the operation instruction and the addresses of all operands are recorded to form a protocol stack execution process log. Simultaneously, the initial storage address of all unknown protocol data flowing into the protocol stack is recorded. Subsequently, the instruction log entry using that initial storage address as the source operand is searched in the protocol stack execution process log. Based on the destination operand address recorded in that log entry, all log barcodes related to the unknown protocol data flowing into the protocol stack are recursively searched, and irrelevant logs are removed.

[0039] For example, a virtual environment capable of running the protocol stack is constructed using the Qemu virtual machine. By monitoring the execution of network system calls such as `sys_socket`, the initial storage address of all unknown protocol data flowing into the IoT protocol stack is recorded. Simultaneously, instrumentation is performed on all CPU instructions. Within the instrumentation function, the instruction type is first determined: if the instruction involves memory operations, the name of the operation instruction and the addresses of all operands are recorded, forming a protocol stack execution process log. Specifically, for instructions with one source operand, the protocol stack execution process log is recorded in the format "addr src →addr dst For instructions with two source operands, the protocol stack execution log is recorded in the format "addr"; src1 +addr src2 →addr dst After processing the unknown protocol data currently flowing into the protocol stack, the initial storage address is first used as the lookup target. The protocol stack execution log is then searched for log entries whose source operand address matches the lookup target. Subsequently, the destination operand address in the found log entries is used as the lookup target, and this process is repeated. Finally, all log entries related to the unknown protocol data are retained, while irrelevant log entries are removed, resulting in a filtered execution log—the execution log of the unknown protocol data within the protocol stack.

[0040] In one possible implementation, establishing a tree representation structure for each bit of unknown protocol data based on the execution process log includes: obtaining the initial storage address of the unknown protocol data flowing into the protocol stack, and constructing the root node of the tree based on the initial storage address of the unknown protocol data flowing into the protocol stack; traversing each log entry of the execution process log, and when the source operand address in the current log entry is equal to the value of an existing node in the tree, creating a new node and setting the value of the new node to the destination operand address in the log entry, and establishing a branch between the new node and the node with the equal value; after traversal, the tree representation structure for each bit of unknown protocol data is obtained.

[0041] Interpretive: Nodes with equal values ​​are those in the tree whose values ​​match the address of the source operand in the current log entry. See again. Figure 2 and 3In this embodiment, the root node of the tree is constructed based on the initial storage address of the unknown protocol data flowing into the protocol stack, and the initial storage address is the value of the root node. By traversing each log entry in the execution process log of the unknown protocol data in the protocol stack, if the source operand address in the log entry is equal to the value of an existing node in the tree, a new node is created. The value of the newly created node is the destination operand address in the log entry, and a branch is established between this node and the newly created node. Finally, a tree-like representation structure is built for each bit of the unknown protocol data flowing into the protocol stack.

[0042] For example, the tree-like representation structure consists of a root node and several intermediate / leaf nodes, connected by branches. Each node carries a value to record the address of the data. During the transformation process, the root node of the tree is first constructed based on the initial storage address of the unknown protocol data flowing into the protocol stack. Then, a log entry "addr" is read from the execution process log of the unknown protocol data in the protocol stack. src →addr dst "If the source operand address addr in the log entry..." src If the value of a node is equal to that of an existing node in the tree, a new node is created, and the value of the new node is the destination operand address (addr) from the log entry. dst And establish a branch between the node and the newly created node; otherwise, continue reading the next record and repeat the above process. After traversing all the execution process logs of unknown protocol data in the protocol stack, a tree-like representation structure will be established for each bit of unknown protocol data flowing into the protocol stack.

[0043] In one possible implementation, obtaining the fields of the unknown protocol data based on the similarity of the tree representation structures of adjacent bits includes: using a branch sequence alignment algorithm to obtain the number of branches that can be aligned between the tree representation structures of adjacent bits as a first quantity, and obtaining the ratio of the first quantity to the total number of branches in the tree representation structures of adjacent bits to obtain the similarity of the tree representation structures of adjacent bits; obtaining the fields of the unknown protocol data according to the following determination rules: when the similarity of the tree representation structures of adjacent bits is less than a preset similarity threshold, it is determined that the adjacent bits do not belong to the same field; otherwise, it is determined that the adjacent bits belong to the same field.

[0044] Explanatory, see again Figure 2 and 3In this embodiment, the unknown protocol data flowing into the protocol stack is grouped into a discrimination group for every two adjacent bits. Then, two tree-like representation structures corresponding to the two bits in a discrimination group are found. Finally, a sequence alignment algorithm is used to calculate the similarity between the two tree-like representation structures. If the similarity is lower than a threshold (for example, the number of nodes that can be aligned is less than 70% of the total number of nodes in the tree), then the two bits in this discrimination group are considered not to belong to the same field, that is, the boundary of the field has been found.

[0045] For example, the unknown protocol data flowing into the protocol stack is grouped into a discrimination group for every two adjacent bits. Next, two tree-like representation structures are found corresponding to two bits in a discrimination group. Then, a branch sequence alignment algorithm is used to find alignable branches between the branches of the two tree-like representation structures. During the branch sequence alignment process, for both branches to be aligned, traversal begins from the root node: if the two nodes (x...)... i y i If the values ​​of (x) differ by less than 1, then the two nodes are considered aligned; otherwise, try adding an empty node to a branch and re-verify whether alignment is possible, i.e., verify (x) i With y i+1 (x) between or (x) i+1 With y i If the difference between the node values ​​of x is less than 1, and they can be aligned, then continue trying to align subsequent nodes. If alignment still fails after adding an empty node, then the two nodes at the corresponding positions are considered misaligned. Skip the misaligned nodes and continue trying to align subsequent nodes, i.e., continue trying to align x. i+1 With y i+1 Once two branches are aligned, the number of alignable nodes in those branches is calculated. If the number of alignable nodes is less than 70% of the total number of nodes in the two branches, then the two branches cannot be aligned. This process is repeated until all alignable branches are found. Then, the number of alignable branches is calculated and divided by the total number of branches in the two tree representation structures to obtain the similarity between the two tree representation structures. Finally, based on the similarity, it is determined whether two adjacent bits in the discrimination group belong to the same field. For example, if a similarity threshold of 70% is set, if the similarity of the tree representation structures of two adjacent bits in the discrimination group is less than 70%, then the two bits in this discrimination group are considered not to belong to the same field, meaning there is a field boundary between the bits.

[0046] In one possible implementation, obtaining the field types of each field of the unknown protocol data using information-theoretic metric methods includes: traversing each field of the unknown protocol data:

[0047] When the value of the current field has a linear relationship with the total length of the unknown protocol data, the field type of the current field is determined to be the total length field; when the value of the current field has a linear relationship with the length of the next field of the unknown protocol data, the field type of the current field is determined to be the next field length field; when the value of the current field takes values ​​within a finite range, the field type of the current field is determined to be the function code field; when the value of the current field is a constant among the unknown protocol data of the same function code, the field type of the current field is determined to be the flag field; where the function code is the field value of the function code field; when the field values ​​of the current fields of different unknown protocol data show an increasing trend after sorting the unknown protocol data according to the order of flowing into the protocol stack, and the difference between the information entropy of the field value change and 0 meets the preset difference threshold, the field type of the current field is determined to be the sequence number field; when the data of the current field are all numbers, the field type of the current field is determined to be a finite change field; the field type of unidentified fields is determined to be a random change field.

[0048] Explanatory, see again Figure 2 and 3 In this implementation, for field type identification, if the field value of a certain field has a linear relationship with the total length of the unknown protocol data, that is, satisfies the following formula, then the field type of that field is inferred to be the total data length field:

[0049] MsgLen=α×V+β

[0050] Where MsgLen is the total length of the unknown protocol data, V is the field value, and α and β are both real numbers.

[0051] If the value of a certain field has a linear relationship with the length of the next field in the unknown protocol data, i.e., it satisfies the following formula, then it is inferred that the field type of that field is the next field length field:

[0052] FieldLen=α1×V+β1

[0053] Where FieldLen is the length of the next field, and α1 and β1 are both real numbers.

[0054] If the value of a field takes only a limited range of values, for example, if the randomness w(V) of the field value is between 0.2 and 0.8 after calculation using the following formula, then it is inferred that the field type is a function code field:

[0055]

[0056] Where H(V) is the field value information entropy of the current field; |V| is the number of field values ​​of the current field.

[0057] For example, in this embodiment, all field values ​​that have appeared in all unknown protocol data fields of type function code will also be recorded and used as different function codes to correspond to different functions.

[0058] Based on the identified function code field, all unknown protocol data flowing into the protocol stack is grouped, with unknown protocol data belonging to the same function code grouped together. For each group of unknown protocol data, each field is traversed from left to right. If the value of a certain field is a constant, for example, if the field value information entropy H(V) calculated by the following formula is 0, then it is inferred that the field type is a flag field:

[0059]

[0060] Where p(x) is the probability of the field value appearing.

[0061] For example, in this embodiment, all field values ​​that have appeared in all unknown protocol data fields of type flag field will also be recorded as the field values ​​of all preset flag fields in the future.

[0062] Since the sequence number field is strongly correlated with the order in which data flows into the protocol stack, the unknown protocol data is sorted according to the order of flow into the protocol stack. If a certain field shows an increasing trend, the change value σ of all field values ​​for that field is calculated, and the information entropy H(σ) of σ is calculated. If H(σ) is close to 0 (for example, the difference between H(σ) and 0 meets a preset difference threshold), that is, the growth value of the field value is constant, then it is inferred that the field type of that field is a sequence number field.

[0063] For example, in this embodiment, the changes in the field values ​​of the serial number field in all unknown protocol data will also be recorded as the subsequent preset changes in the field values ​​of the serial number field.

[0064] For fields where all values ​​are numeric, it is inferred that the field type is a finitely variable field.

[0065] For example, in this embodiment, the maximum and minimum values ​​of the field values ​​of the field type finite change field in all unknown protocol data will also be recorded as the preset maximum and minimum field values ​​of the finite change field.

[0066] Apart from the fields mentioned above, fields that are not identified are classified as randomly changing fields.

[0067] For example, when identifying the field type, the identification is performed in the following order: total data length field, next field length field, function code field, flag field, sequence number field, finite variation field, and random variation field.

[0068] In one possible implementation, the preset variation rules for the field type include: when the field type is a total data length field, the field value is set to the total length of the fuzzy test data when generating fuzzy test data; when the field type is a next field length field, the field value is set to the length of the next field adjacent to the current field when generating fuzzy test data; when the field type is a function code field, the field value is set to the corresponding function code preset according to the function of the fuzzy test data when generating fuzzy test data; when the field type is a flag field, the field value is set to any one of the preset values ​​of all flag fields when generating fuzzy test data; when the field type is a sequence number field, the field values ​​of each fuzzy test data are set to an increasing relationship of σ when generating multiple fuzzy test data, where σ is the preset value change value of the sequence number field; when the field type is a finite variation field, the field value is set to any value between the preset maximum and minimum field values ​​of the finite variation field when generating fuzzy test data; when the field type is a random variation field, the field value is set to a random value when generating fuzzy test data.

[0069] Explanatory, see again Figure 2 and 3 In this embodiment, different mutation strategies are formulated for fields of different field types, and fuzzy test data is generated by mutating unknown protocol data. Specific mutation strategies can be found in the preset mutation rules for the field types mentioned above.

[0070] Finally, the generated fuzz test data is sent to the target under test, and the running results of the target under test are monitored, thereby realizing fuzz testing for unknown protocols of the Industrial Internet of Things.

[0071] In summary, the fuzz testing method for unknown industrial IoT protocols of this invention aims to achieve efficient fuzz testing without relying on industrial IoT protocol documents and expert prior knowledge. First, the protocol stack of the unknown industrial IoT protocol is executed in a virtual environment, and binary instrumentation technology is used to obtain the execution process log of the unknown protocol data within the protocol stack. Then, a custom tree structure is used to represent the execution process of the unknown protocol data within the protocol stack, and tree similarity calculation technology is used to identify the field boundaries of the unknown protocol data to achieve field partitioning. Subsequently, information theory metrics are used to infer the field type of each field. Finally, based on the field boundaries and field types, specific mutation rules are formulated for each field, and fuzz test cases for the unknown industrial IoT protocol are generated according to the mutation rules.

[0072] This method does not rely on industrial IoT protocol documents or expert prior knowledge. It can perform efficient fuzz testing on unknown IoT protocols, helping cybersecurity engineers to perform security testing on unknown IoT protocols and discover security vulnerabilities in IoT devices.

[0073] For example, this invention can be applied to fuzzing tools, vulnerability discovery systems, and penetration testing tools. In a fuzzing tool example, security testers can use mature products to fuzz test known IoT protocols while simultaneously using the method of this invention to test unknown IoT protocols; the two complement each other to improve test coverage. In a vulnerability discovery system example, security experts can use the method of this invention to fuzz test unknown IoT protocols and further analyze data that may cause anomalies in the IoT protocol stack to discover cybersecurity vulnerabilities in the test target. In a penetration testing tool example, penetration testers can use the method of this invention to discover data that causes anomalies in the IoT protocol stack and use this data as attack payload to complete penetration testing.

[0074] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0075] See Figure 4 In another embodiment of the present invention, an industrial Internet of Things (IoT) unknown protocol fuzz testing system is provided, which can be used to implement the above-mentioned industrial IoT unknown protocol fuzz testing method. Specifically, the industrial IoT unknown protocol fuzz testing system includes a log module, a tree construction module, a field delimitation module, a field recognition module, and a testing module.

[0076] The system comprises the following modules: a log module for acquiring execution logs of unknown protocol data within the protocol stack in a virtual environment; a tree construction module for establishing a tree-like representation structure for each bit of the unknown protocol data based on the execution logs; a field delimitation module for obtaining and determining the fields of the unknown protocol data based on the similarity of the tree-like representation structures of adjacent bits; a field identification module for obtaining the field types of each field of the unknown protocol data using information theory metrics; and a testing module for generating fuzzy test data for each field of the unknown protocol data based on preset mutation rules for the field types, and performing fuzzy testing of unknown protocols in the Industrial Internet of Things based on the fuzzy test data.

[0077] All relevant content of each step involved in the aforementioned embodiments of the industrial IoT unknown protocol fuzzing test method can be referenced from the functional description of the corresponding functional module of the industrial IoT unknown protocol fuzzing test system in the embodiments of the present invention, and will not be repeated here.

[0078] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0079] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of an unknown protocol fuzzy testing method in the Industrial Internet of Things (IIoT).

[0080] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the fuzz testing method for unknown protocols in the Industrial Internet of Things described in the above embodiments.

[0081] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0082] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0083] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0084] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A fuzz testing method for unknown protocols in the Industrial Internet of Things, characterized in that, include: Obtain the execution process log of unknown protocol data in the protocol stack based on a virtual environment; Based on the execution process log, establish a tree-like representation structure for each bit of the unknown protocol data; Obtain and determine the fields of the unknown protocol data based on the similarity of the tree-like representation structure of adjacent bits; The field types of each field in the unknown protocol data are obtained using information-theoretic measurement methods. Based on the preset mutation rules of the field type, generate fuzzy test data for each field of the unknown protocol data, and perform fuzzy testing of the unknown protocol of the Industrial Internet of Things based on the fuzzy test data. The field types for obtaining each field of the unknown protocol data using the information-theoretic metric method include: Iterate through the fields of the unknown protocol data: If the value of the current field has a linear relationship with the total length of the unknown protocol data, the field type of the current field is determined to be the total length field. If the value of the current field has a linear relationship with the length of the next field in the unknown protocol data, the field type of the current field is determined to be the length field of the next field. If the value of the current field is within a limited range, the field type of the current field is determined to be a function code field; When the value of the current field is a constant in the unknown protocol data of the same function code, the field type of the current field is determined to be a flag field; where the function code is the field value of the function code field. When the field values ​​of the current fields of different unknown protocol data show an increasing trend after sorting the unknown protocol data according to the order of flow into the protocol stack, and the difference between the information entropy of the field value change and 0 meets the preset difference threshold, the field type of the current field is determined to be a sequence number field. When all data in the current field are numbers, the field type of the current field is determined to be a finite-change field; The field type of the unrecognized field is determined to be a randomly changing field; The field value of the current field takes on a limited range of values ​​specifically as follows: The value of the current field randomness Between 0.2 and 0.8: in, The field value information entropy of the current field; This represents the number of field values ​​for the current field. The field value of the current field is a constant in each unknown protocol data of the same function code. Specifically, the information entropy of the field value of the current field in each unknown protocol data of the same function code is 0.

2. The industrial IoT unknown protocol fuzzy testing method according to claim 1, characterized in that, The execution process log of acquiring unknown protocol data in the protocol stack based on the virtual environment includes: Construct a virtual environment to run the protocol stack and run unknown industrial IoT protocols. Use instrumentation technology to instrument all CPU instructions of the virtual machine in the virtual environment, and record the name of the instruction and the address of all operands for all instructions involving memory operations to obtain the protocol stack execution process log. Obtain the initial storage address of the unknown protocol data flowing into the protocol stack, and search for log entries in the protocol stack execution process log that use the initial storage address as the source operand. Based on the destination operand address recorded in the found log entries, recursively search for all log entries related to the unknown protocol data flowing into the protocol stack to obtain the execution process log of the unknown protocol data in the protocol stack.

3. The industrial IoT unknown protocol fuzzy testing method according to claim 1, characterized in that, The step of establishing a tree-like representation structure for each bit of unknown protocol data based on the execution process log includes: Obtain the initial storage address of the unknown protocol data flowing into the protocol stack, and construct the root node of the tree based on the initial storage address of the unknown protocol data flowing into the protocol stack; Iterate through each log entry in the execution process log, and when the source operand address in the current log entry is equal to the value of an existing node in the tree, create a new node and set the value of the new node to the destination operand address in the log entry, and establish a branch between the new node and the node with the equal value; After traversal, a tree-like representation structure of each bit of the unknown protocol data is obtained.

4. The industrial IoT unknown protocol fuzzy testing method according to claim 1, characterized in that, The process of obtaining and determining the fields of the unknown protocol data based on the similarity of the tree-like representation structure of adjacent bits includes: The number of branches that can be aligned between the tree representation structures of adjacent bits is obtained by using the branch sequence alignment algorithm as the first quantity, and the ratio of the first quantity to the total number of branches in the tree representation structures of adjacent bits is obtained to obtain the similarity of the tree representation structures of adjacent bits. According to the following determination rules, the fields of the unknown protocol data are obtained: when the similarity of the tree representation structure of adjacent bits is less than the preset similarity threshold, it is determined that the adjacent bits do not belong to the same field; otherwise, it is determined that the adjacent bits belong to the same field.

5. The industrial IoT unknown protocol fuzzy testing method according to claim 1, characterized in that, The preset variation rules for the field type include: When the field type is a total data length field, the field value is set to the total length of the fuzzy test data when generating fuzzy test data; When the field type is "next field length", the field value is set to the length of the next field adjacent to the current field when generating fuzzy test data; When the field type is a function code field, when generating fuzzy test data, the field value is set to the corresponding function code preset according to the function of the fuzzy test data; When the field type is a flag field, the field value is set to any one of the preset flag field values ​​when generating fuzzy test data; When the field type is a sequence number field, when generating multiple fuzzy test data sets, the field values ​​of each fuzzy test data set should be set to increment. The relationship; among them, This refers to the change in the value of the preset serial number field; When the field type is a finite variation field, when generating fuzzy test data, the field value is set to any value between the preset maximum and minimum field value of the finite variation field; When the field type is a randomly variable field, the field value is set to a random value when generating fuzzy test data.

6. An industrial IoT unknown protocol fuzzing system based on the industrial IoT unknown protocol fuzzing method of claim 1, characterized in that, include: The logging module is used to obtain the execution process logs of unknown protocol data in the protocol stack based on the virtual environment; The tree building module is used to build a tree-like representation structure for each bit of unknown protocol data based on the execution process log; The field delimitation module is used to obtain and determine the fields of unknown protocol data based on the similarity of the tree representation structure of adjacent bits. The field identification module is used to obtain the field type of each field in unknown protocol data through information theory measurement methods; The testing module is used to generate fuzzy test data for each field of unknown protocol data according to the preset mutation rules of the field type, and to perform fuzzy testing of unknown protocols in the Industrial Internet of Things based on the fuzzy test data.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the industrial Internet of Things unknown protocol fuzz testing method as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the industrial Internet of Things unknown protocol fuzz testing method as described in any one of claims 1 to 5.

Images