Modbus protocol fuzzy test case generation method based on genetic algorithm and logic mapping

Abstract

The application discloses a Modbus protocol fuzzy test case generation method based on a genetic algorithm and a logistic mapping, and relates to the technical field of automatic test case generation.The application accurately divides variable fields and extracts key fields through a protocol structure analysis technique, and narrows the test case generation range to the variable part.The method can ensure that the test case is not discarded by the device and improves the test efficiency.The application introduces a Logistic mapping function to guide the mutation operation, dynamically adjusts the mutation strength according to the population fitness, enhances the diversity at a high mutation rate in the early stage, improves the convergence at a low mutation rate in the later stage, and avoids population prematurity.Combined with the cross operation of the protocol format constraint, the generated test case not only meets the protocol specification, but also has differentiated characteristics.The application solves the core problems of high redundancy, low coverage and poor convergence in industrial control fuzzy testing through the "protocol analysis-intelligent generation-fuzzy testing" closed loop, improves the test efficiency, and reduces resource consumption.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of automatic test case generation, and in particular to a Modbus protocol fuzz test case generation method based on genetic algorithm and logical mapping. BACKGROUND

[0002] In the field of Modbus protocol fuzz testing, the existing test case generation methods mainly have the following defects in the technical level:

[0003] (1) The test cases generated by Peach software have high redundancy and are difficult to cover all possible test scenarios, especially complex and edge test cases. The generation method based on simple rules lacks flexibility and intelligence, and is difficult to adapt to the changing test requirements.

[0004] (2) As the test scale expands, the cost of manually writing test cases rises sharply, not only increasing the labor cost, but also prolonging the test cycle and affecting the product's time to market.

[0005] (3) The existing methods generate test cases inefficiently, which cannot meet the large-scale and high-efficiency test requirements, limiting the improvement of production efficiency and test quality.

[0006] (4) With the development of industrial automation and the Internet of Things, users' demand for Modbus protocol testing is increasingly diversified, and the existing technology cannot meet users' customized and intelligent requirements for test cases. SUMMARY

[0007] The present application provides a Modbus protocol fuzz test case generation method based on genetic algorithm and logical mapping to solve the technical problem of automatically and efficiently generating high-quality test cases in software testing. The method aims to combine the global search ability of genetic algorithm and the random exploration characteristics of fuzz testing to automatically generate test cases that can cover potential software defects, thereby improving the efficiency and effectiveness of software testing.

[0008] The technical solution adopted by the present application is: a Modbus protocol fuzz test case generation method based on genetic algorithm and logical mapping, which comprises the following steps:

[0009] Step 1: Based on the Modbus protocol structure, determine whether the fields included are variable fields to reduce the test case generation range;

[0010] Step 2: Based on the determined variable fields, iteratively optimize the input Modbus protocol data variable fields based on genetic algorithm to dynamically generate Modbus protocol fuzz test cases through selection, crossover and mutation operations;

[0011] And in the mutation operation of each variable field, the mutation operation is guided by introducing Logistic mapping to balance diversity and convergence.

[0012] Further, in step 1, the protocol identifier and unit identifier in the Modbus protocol packet header are set as immutable fields, and the remaining fields are set as variable fields.

[0013] Further, in step 2, when the genetic algorithm is used to iteratively optimize the variable fields of the input Modbus protocol data, the sum of the string similarity of all variable fields of the individual before and after optimization generation is used as the individual fitness of the genetic algorithm.

[0014] Preferably, the expression of individual fitness can be: Wherein, S im The similarity function is represented by a cosine function, respectively represent the string of the jth variable field before and after optimization generation, and K represents the number of set variable fields. In addition, when calculating the individual fitness, the similarity between the vector of the individual before and after mutation (before and after optimization generation) can also be directly obtained.

[0015] Further, in the mutation operation, the mutation probability is adjusted based on the difference between the individual fitness and the average fitness:

[0016]

[0017] D f =f-F i

[0018] Wherein, M', M are the mutation probabilities before and after updating, D f represents the difference between the average fitness f and the individual fitness F i , and subscript i is the individual number.

[0019] Further, when the genetic algorithm is used to iteratively optimize the variable fields of the input Modbus protocol data, the average Hamming distance between all individuals in the current generation population represents the diversity of the population, and the average Hamming distance is used to set the iteration convergence condition of the genetic algorithm.

[0020] Preferably, when the average Hamming distance reaches a preset value, the iterative optimization generation based on the genetic algorithm is stopped.

[0021] Further, the introduction of Logistic mapping to guide the mutation operation specifically includes:

[0022] A random number between 0 and 1 is generated as an initial value of the Logistic mapping, and then a chaotic value is generated through multiple iterations based on the Logistic mapping;

[0023] The chaotic value generated in the last iteration is scaled to the range of 0-255 and replaces the corresponding gene in the current variable field of the individual.

[0024] The technical solution provided by the present application at least brings the following beneficial effects:

[0025] (1) Significantly reduce test case redundancy and improve test efficiency

[0026] Traditional industrial control protocol fuzzing test methods usually use full-field random generation or fixed template coverage strategies, resulting in a large number of redundant test cases, wasting computing resources and being inefficient. The present application uses protocol structure analysis technology to accurately divide the variable field and extract the key field (such as the check bit, function code, etc.), reducing the test case generation range to the variable part. This method can ensure that the test cases are not discarded by the device and improve the test efficiency.

[0027] (2) Enhance test case diversity and protocol compatibility, and improve the depth of vulnerability mining

[0028] Existing genetic algorithm-based fuzzing test methods often use a fixed mutation probability, which can easily fall into local optimization or generate invalid protocol format data, resulting in insufficient test coverage. The present application introduces a Logistic mapping function to guide the mutation operation, dynamically adjusts the mutation strength according to the population fitness: high mutation rate in the early stage to enhance diversity, low mutation rate in the later stage to improve convergence, and avoid population prematureness. Combined with the cross operation of the protocol format constraint, it ensures that the generated test cases not only meet the protocol specification, but also have differentiated characteristics. Comparative experiments show that this method improves the coverage rate of industrial control protocol boundary conditions and abnormal states by 35% compared with traditional genetic algorithms, effectively triggering deep protocol parsing vulnerabilities.

[0029] In summary, the method of the present application solves the core problems of high redundancy, low coverage, and poor convergence in industrial control fuzzing test through the "protocol analysis-intelligent generation-fuzzing test" closed loop, improves the test efficiency while reducing resource consumption, provides an efficient and lightweight new approach for industrial control system security detection, and has important social value for protecting critical infrastructure security. BRIEF DESCRIPTION OF DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creating any creative labor.

[0031] Figure 1 The flow chart of the Modbus protocol fuzzy test case generation method based on a genetic algorithm and logical mapping provided by the embodiment of the present application.

[0032] Figure 2 The overall framework diagram of the Modbus protocol fuzzy test case generation method based on a genetic algorithm and logical mapping provided by the embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described in detail and completely below by combining the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings can be arranged and designed using different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not only to limit the scope of the claimed present application, but only to represent selected embodiments of the present application.

[0034] The embodiment of the present application provides a Modbus protocol fuzzy test case generation method based on a genetic algorithm and logical mapping, which aims to automatically generate test cases with wide coverage and diversity through the optimization ability of the genetic algorithm and the flexibility of the logical mapping, so as to improve the test efficiency and quality, meet the customized needs of users for test cases, and solve the problems of low test case generation efficiency and limited coverage range in the prior art.

[0035] The core of the method provided by the embodiment of the present application is to improve the efficiency and security of industrial control protocol data processing by in-depth analysis and application of the Modbus TCP protocol. That is, the embodiment of the present application realizes the protocol fuzzy test case generation based on a genetic algorithm and logical mapping on the basis of in-depth analysis of the Modbus TCP protocol.

[0036] In the protocol analysis research phase, the function modules and data transmission of the Modbus TCP protocol are analyzed in detail. After in-depth study of the protocol specification format, detailed field variation rules are formulated based on this, the original data is divided into variable and fixed parts to avoid the variation data being discarded by the device under test, thereby improving the test efficiency. After entering the protocol fuzz test case research phase, the Modbus TCP protocol is comprehensively applied and explored. In this embodiment, genetic algorithm is used to generate fuzzy test cases, and the mutation operation of genetic algorithm is realized by combining with logical mapping, thereby improving the efficiency and accuracy of test case generation. Through these processing means, the data processing capability of the Modbus TCP protocol is improved, and the data security and the efficiency of the redundancy processing are enhanced.

[0037] Referring to Figure 1 In one embodiment, the genetic algorithm and logical mapping based Modbus protocol fuzzy test case generation method provided by the embodiment of the present application comprises:

[0038] Step 1, variable field division based on protocol structure analysis, key variable fields are extracted by analyzing the protocol format to narrow the test case generation range; that is, based on the Modbus protocol structure, whether the fields included are variable fields is divided;

[0039] Step 2, global optimization generation mechanism based on genetic algorithm, high-coverage test cases are dynamically generated through selection, crossover and mutation operations; that is, according to the determined variable fields, the variable fields of the input Modbus protocol data are optimized and generated based on the genetic algorithm, and the Modbus protocol fuzzy test cases are dynamically generated through selection, crossover and mutation operations;

[0040] Step 3, introducing Logistic mapping to guide the mutation operation to realize the mutation of the population and balance the diversity and convergence.

[0041] The method provided by the embodiment of the application first deeply analyzes an industrial control protocol, extracts variable fields and constructs an initial test case pool; secondly, the method combines a Logistic function to dynamically adjust mutation strength through genetic algorithm iteration optimization, and enhances the diversity and protocol compatibility of test cases; subsequently, the method uses similarity calculation to evaluate individual fitness, and preferentially retains test cases with significant differences and high abnormal triggering probability, and suppresses redundant data generation. In specific implementation, in view of the problem of high redundancy of generated test cases in industrial control protocol fuzz testing, the method uses genetic algorithm to guide the generation of fuzz test cases based on the variable fields of the divided industrial control protocol, and uses Logistic to complete the mutation operation in the genetic algorithm, so that the generated test cases are more optimized, and the similarity calculation idea is used to design the individual fitness value, and finally the effectiveness of the method is compared and analyzed through experiments, as shown in Figure 2

[0042] In one embodiment, the method for generating Modbus protocol fuzz test cases based on genetic algorithm and logic mapping provided by the embodiment of the application includes the following processes:

[0043] (1) Extracting variable fields in Modbus protocol data;

[0044] That is, determining which fields in the Modbus protocol are identified as variable fields. The Modbus protocol data includes an MBAP protocol message header (packet header) and a protocol data unit, and the protocol data unit includes a function code and data. The MBAP protocol message header includes a transaction identifier, a protocol identifier, a length unit, and a unit identifier; the protocol identifier and the unit identifier are not variable, and the remaining part is a variable part.

[0045] (2) Constructing an initial test case pool

[0046] In constructing the initial test case pool, the above-mentioned variable fields are extracted and corresponding processing is performed.

[0047] The initial test case is actually collected by software collection of Modbus protocol data, and then before mutation, the variable and non-variable parts are set, and then the genetic algorithm is used for fuzz test case generation.

[0048] (3) Generating fuzz test cases based on genetic algorithm.

[0049] The genetic algorithm generally includes coding, fitness function, selection, crossover, mutation and other processes. In the embodiment of the application, the coding, selection and crossover steps are not specifically limited, and in the mutation operation, the embodiment of the application introduces logic mapping to guide how the test cases are mutated.

[0050] ​(4) Similarity calculation evaluates individual fitness.

[0051] To prove that the finally generated test case population is better, the embodiment uses the average Hamming distance between individuals to express, the average Hamming distance is used to measure the diversity of the population, the greater the average Hamming distance, the higher the population diversity; the smaller the average Hamming distance, the lower the population diversity. The higher the population diversity, the more diverse the test cases, and the more opportunities to test whether there are vulnerabilities.

[0052] When generating fuzzy test cases based on genetic algorithms, the embodiment of the application introduces a logic mapping to guide the specific processing process of how the test case is mutated as follows:

[0053] The logistic mapping is the most common type of chaotic mapping, which refers to a function or rule that maps the input space to the output space, and can produce chaotic phenomena. Chaotic phenomena refer to the extreme sensitivity of system state to initial conditions, long-term behavior that is unpredictable but still maintains some inherent regularity. The corresponding difference equation formula mathematical model is as follows:

[0054] x n+1 =f(x n ,μ)=μx n (1-x n )

[0055] Wherein, μ is a control parameter, and n is the number of iterations. When 3.569946≤μ≤4, the logistic mapping is in a chaotic state, and the closer μ is to 4, the more obvious its pseudo-random distribution characteristics. f(x n , μ) represents a chaotic mapping function, x n represents the input variable at the nth iteration, i.e. the corresponding mapped object, and x n+1 represents the mapped object at the n+1th iteration. After a certain number of iterations of the logistic mapping, a large number of chaotic points are distributed on the line segment (0, 1), and the analytical expression of the probability density p(t) is:

[0056]

[0057] Wherein, t represents a sampling point.

[0058] The evolution formula of the chaotic variable is:

[0059]

[0060] C(x n+1 )=4C(x n ) i ·(1-C(x n ) i ) i=1,2,...,N

[0061] where C(x n ) i represents the i-th chaotic variable After the n-th step of chaotic transformation, N represents the number of chaotic variables. When and will be iterated within (0, 1) to produce chaotic phenomena. The optimization variable x i ∈ [a i ,n i ] in the above formula can be bidirectionally mapped with the chaotic variable by the following formula:

[0062]

[0063] where x i , is the value obtained after the i-th chaotic variable after chaotic mapping is converted into a regular optimization variable, a i ,b i are the upper and lower limits of the value range of x i , respectively.

[0064] Based on the above theory, the flow of the genetic algorithm mutation operation using logistic mapping in this embodiment is as follows:

[0065] In the mutation operation, a new mutation value is generated using the Logistic mapping. First, a random number between 0 and 1 is generated as the initial value of the Logistic mapping, then multiple iterations are performed to ensure chaotic behavior, and finally the chaotic value generated by the last iteration is scaled to the range of 0-255 and replaces the corresponding gene in the individual.

[0066] In this way, the chaotic mapping provides a new deterministic random source for the mutation operation, which helps the genetic algorithm to maintain diversity and exploration ability in the search process.

[0067] When calculating the difference between the individual fitness and the average fitness, that is, the difference between the average fitness and the individual fitness. The corresponding expression is as follows:

[0068]

[0069] D f =f-F i

[0070] where f represents the tie fitness, F i represents the individual fitness, and D f represents the difference between the tie fitness and the individual fitness.

[0071] If the individual fitness is lower than the average fitness, the mutation probability is increased to increase the diversity in the search process. The updated mutation probability is expressed as:

[0072]

[0073] In the above formula, M', M are the mutation probabilities before and after updating respectively.

[0074] Finally, the mutation operation uses the Logistic mapping to generate a new gene value for replacement, and the expression is:

[0075] X n+1 = r x x n (1 - x n )

[0076] d n+1 = int(255 x X n+1 )

[0077] In the above formula, x n represents the current iteration value, r represents the control parameter, and X n+1 is the value of the next iteration. In the mutation operation, first generate a random number between 0 and 1 as the initial value X0 of the Logistic mapping, and then iterate the Logistic mapping multiple times to ensure its chaotic behavior, that is, calculate X n+1 multiple times. Finally, scale the generated chaotic value d n+1 to the range of 0 to 255 and replace the corresponding gene in the individual.

[0078] In an embodiment of the present application, in order to better express the diversity within the population, the Hamming distance is used to represent the diversity, that is, the number of different characters between two strings (S1, S2) is calculated. By comparing the corresponding positions of the two strings character by character, the number of different characters between them can be calculated. The expression involved is as follows:

[0079]

[0080] Where S1, S2 represent two equal-length strings, with a length of L. S1[i], S2[i] represent the ith character of strings S1, S2 respectively.

[0081] Based on the above expression, the average Hamming distance between all individuals in the population is calculated. First, the Hamming distance between each pair of individuals is calculated, and then these distances are added. Next, the sum is divided by the number of all pairs (i.e. the number of individual pairings) to obtain the average Hamming distance, and the calculation process can be represented as follows:

[0082]

[0083] Wherein, n represents the number of individuals.

[0084] The average Hamming distance is used to measure the diversity of the population, the greater the average Hamming distance, the higher the population diversity; the smaller the average Hamming distance, the lower the population diversity.

[0085] The application aims to solve the problems of low test case generation efficiency, incomplete protocol state coverage and insufficient abnormal trigger capability in the existing Modbus protocol fuzz testing, and constructs an intelligent test case generation method based on a genetic algorithm and a logical mapping, which can more targetedly realize test case generation by fusing the mutation mode of chaotic mapping and the directional evolution strategy of the genetic algorithm, and effectively improves the mining depth of industrial control system protocol vulnerabilities.

[0086] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the specification and the features of the different embodiments or examples without contradiction.

[0087] In addition, the terms "first", "second" and the like are used only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" and the like can explicitly or implicitly include at least one of the features.

[0088] Any process or method descriptions in the specification can be understood as representing modules, segments or portions of code that include executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of the present application includes additional implementations in which the functions described are performed in different orders, including essentially simultaneously or in reverse order, according to the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0089] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiment method can be instructed by a program to complete the relevant hardware, and the program can be stored in a computer readable storage medium. When the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0090] Note that all features disclosed in this specification may be replaced by alternative features serving the same, equivalent or similar purpose, unless otherwise stated. Thus, unless expressly stated otherwise, each feature disclosed is only one example of a generic series of equivalent or similar features. Further, any of the described features can be claimed in any combination, unless two or more alternatives of a feature cannot be used together, in which case a specific combination is implied. In the claims, any of the cited documents is incorporated by reference to the same extent as if each such document was individually and specifically incorporated by reference. In the case of inconsistencies between the disclosure of the documents and the disclosure contained herein, present disclosure will prevail. Where reference is made to a method comprising two or more defined steps, the implicit assumption exists that unless otherwise stated, between the completion of one step and the initiation of the next step, intermediate actions can be undertaken, including actions that allow the equipment to operate in a non-productive mode, for example, allowing reagents to migrate between containers by gravity.

[0091] Finally, it should be noted that the above-mentioned embodiments are merely intended to illustrate the technical solutions of the present application, rather than limit the technical solutions of the present application; even though the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features thereof can be replaced by equivalent features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

[0092] The above only describes some embodiments of the present application. For those skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the protection scope of the present application.

Claims

1. A method for generating fuzzy test cases for the Modbus protocol based on genetic algorithms and logical mapping, characterized in that, Includes the following steps: Step 1: Based on the Modbus protocol structure, classify its fields as either variable fields or not. Step 2: Based on the determined variable fields, iteratively optimize and generate the variable fields of the input Modbus protocol data using a genetic algorithm, and dynamically generate Modbus protocol fuzzy test cases through selection, crossover, and mutation operations. Furthermore, in the mutation operation for each variable field, a Logistic mapping is introduced to guide the mutation operation; In the mutation operation, the mutation probability is adjusted based on the difference between the individual fitness and the average fitness: ； ； ； in, , These represent the mutation probabilities before and after the update. Indicates average fitness Individual fitness The difference, where the subscript i is the individual number; The specific aspects of guiding mutation operations by introducing Logistic mapping include: A random number between 0 and 1 is generated as the initial value of the Logistic mapping, and then chaotic values ​​are generated through multiple iterations based on the Logistic mapping. The chaotic value generated in the last iteration is scaled to the range of 0-255 and replaced with the corresponding gene in the individual's current variable field.

2. The method as described in claim 1, characterized in that, In step 1, the protocol identifier and cell identifier fields in the Modbus protocol header are set to immutable fields, while the remaining fields are set to mutable fields.

3. The method as described in claim 1, characterized in that, In step 2, when iteratively optimizing the variable fields of the input Modbus protocol data based on the genetic algorithm, the sum of the string similarities of all variable fields of an individual before and after optimization is used as the individual fitness of the genetic algorithm.

4. The method as described in claim 3, characterized in that, The expression for individual fitness is: ,in, This represents the individual fitness of individual i. Represents the similarity function. This represents the string of the j-th variable field before and after optimization, and K represents the number of variable fields set.

5. The method as described in claim 1, characterized in that, In step 2, when iteratively optimizing the variable fields of the input Modbus protocol data based on the genetic algorithm, the fitness of an individual is set as the similarity between the encoded vectors of the individuals before and after optimization.

6. The method as described in claim 1, characterized in that, When iteratively optimizing the variable fields of the input Modbus protocol data using a genetic algorithm, the diversity of the population is characterized by the average Hamming distance between all individuals in the current generation, and the iterative convergence condition of the genetic algorithm is set based on the average Hamming distance.

7. The method as described in claim 6, characterized in that, When the average Hamming distance reaches the preset value, the iterative optimization generation based on the genetic algorithm is stopped.

Images