Fuzzy test method and device based on state perception, electronic equipment and medium

Abstract

The invention discloses a fuzzy test method and device based on state perception, electronic equipment and a medium. The method comprises the following steps: preprocessing an original industrial control protocol data packet to obtain a target industrial control protocol data packet; inputting the target industrial control protocol data packet into a sequence generative adversarial model to generate an initial test case; inputting the initial test case into the tested industrial control system for fuzzy testing, and obtaining an initial protocol state coverage rate corresponding to the initial test case; screening out candidate test cases according to the initial protocol state coverage rate; recombining the candidate test cases to generate recombined test cases; repairing the recombined test case to obtain a target test case; and inputting the target test case into the tested industrial control system for fuzzy test to obtain a fuzzy test result. According to the method, the efficiency and accuracy of industrial control protocol format inference can be improved, the effectiveness of the test case is improved, potential vulnerabilities in the industrial control protocol are effectively detected, and the method can be widely applied to the technical field of computers.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a state-aware-based fuzzing method and device, electronic equipment and medium. BACKGROUND

[0002] At present, an industrial control system (ICS) occupies a vital position in the modern society, is widely applied to the fields of power, energy, rail transit and other key infrastructures, and the industrial control system faces severe network security challenges. Therefore, in the related art, there is a software vulnerability mining technology of fuzzing, that is, a technology for detecting vulnerabilities of the industrial control system and guaranteeing the safety of the industrial control system.

[0003] Among them, the fuzzing of the industrial control system is mainly the fuzzing of the industrial control system protocol, however, the fuzzing of the industrial control system protocol still faces many challenges: first, the traditional generation-based fuzzing method relies on manual extraction of protocol specifications, and the effectiveness of the generated test cases is low; second, such traditional generation-based fuzzing tools lack a reasonable utilization method for test cases, and the subsequent generation and mutation strategies are random, making it difficult to explore the deep paths of the protocol state space, and thus the potential vulnerabilities in the industrial control protocol cannot be effectively detected.

[0004] In summary, the technical problems in the related art need to be improved. SUMMARY

[0005] The embodiments of the present application aim to at least solve one of the technical problems in the related art. To this end, the main purpose of the embodiments of the present application is to propose a state-aware-based fuzzing method, device, electronic equipment and medium, which can improve the efficiency and accuracy of the industrial control protocol format inference, improve the effectiveness of the test cases, and effectively detect potential vulnerabilities in the industrial control protocol.

[0006] To achieve the above purpose, one aspect of the embodiments of the present application proposes a state-aware-based fuzzing method, which comprises the following steps:

[0007] Obtain an original industrial control protocol data packet, and preprocess the original industrial control protocol data packet to obtain a target industrial control protocol data packet;

[0008] Input the target industrial control protocol data packet into a sequence generation adversarial model to generate an initial test case;

[0009] Input the initial test case into a tested industrial control system for fuzzing, and obtain an initial protocol state coverage rate corresponding to the initial test case when the initial test case is subjected to fuzzing;

[0010] filtering candidate test cases from the initial test cases according to the initial protocol state coverage;

[0011] performing data reorganization processing on the candidate test cases to generate reorganized test cases;

[0012] performing data repair processing on the reorganized test cases to obtain target test cases;

[0013] inputting the target test cases into the industrial control system under test to perform fuzzy testing, and obtaining fuzzy testing results.

[0014] In some embodiments, the method further comprises:

[0015] monitoring the parsing process of the target test cases during the fuzzy testing of the target test cases, and obtaining protocol parsing state data;

[0016] judging whether the target test cases complete the fuzzy testing according to the protocol parsing state data;

[0017] If the target test cases complete the fuzzy testing, obtaining a target protocol state coverage corresponding to the target test cases during the fuzzy testing, and taking the target protocol state coverage as the initial protocol state coverage, returning to perform the step of filtering candidate test cases from the initial test cases according to the initial protocol state coverage until the target test cases are generated.

[0018] In some embodiments, the preprocessing of the original industrial control protocol data packet to obtain a target industrial control protocol data packet comprises:

[0019] performing structural processing on the original industrial control protocol data packet to obtain a structured protocol data packet;

[0020] performing standardization processing on the structured protocol data packet to obtain the target industrial control protocol data packet.

[0021] In some embodiments, the inputting of the target industrial control protocol data packet into a sequence generation adversarial model to generate an initial test case comprises:

[0022] inputting the target industrial control protocol data packet into a generator in the sequence generation adversarial model, and generating a candidate value set corresponding to each field in the target industrial control protocol data packet through the generator;

[0023] adopting a greedy strategy to filter out a candidate value with the highest probability from each candidate value set corresponding to each field as a target value;

[0024] generating a string sequence according to the target value corresponding to each field.

[0025] structuring processing the string sequence to generate the initial test case.

[0026] In some embodiments, the obtaining of the initial test case corresponds to an initial protocol state coverage rate when performing the fuzz testing, comprises:

[0027] In the process of the initial test case performing the fuzz testing, a stubbing technology is used to obtain the initial protocol state coverage rate corresponding to the initial test case when the industrial control system under test performs the fuzz testing, wherein the initial protocol state coverage rate is used to evaluate whether the initial test case has value.

[0028] In some embodiments, the filtering of the candidate test case from the initial test case according to the initial protocol state coverage rate comprises:

[0029] According to the initial protocol state coverage rate, it is judged whether the initial test case appears a new program execution state when performing the fuzz testing in the industrial control system under test.

[0030] If the initial test case appears the new program execution state when performing the fuzz testing in the industrial control system under test, it is determined that the initial test case has value, and the candidate test case is determined according to the initial test case with value.

[0031] In some embodiments, the data recombination processing of the candidate test case to generate a recombined test case comprises:

[0032] Data slicing processing is performed on the candidate test case to obtain a plurality of data blocks.

[0033] According to each data block, a test case corpus is constructed.

[0034] Each test case corpus in the test case corpus is subjected to corpus recombination processing to generate the recombined test case.

[0035] To achieve the above-mentioned purpose, another aspect of the embodiment of the present application proposes a fuzz testing device based on state awareness, which comprises the following modules:

[0036] A data preprocessing module is configured to obtain original industrial control protocol data packets and pre-process the original industrial control protocol data packets to obtain target industrial control protocol data packets.

[0037] An initial test case generation module is configured to input the target industrial control protocol data packet sequence into a generative adversarial model to generate an initial test case.

[0038] A protocol state coverage acquisition module is configured to input the initial test case into the industrial control system under test to perform fuzz testing, and acquire an initial protocol state coverage corresponding to the initial test case when the initial test case is used to perform fuzz testing.

[0039] A candidate test case screening module is configured to screen a candidate test case from the initial test case according to the initial protocol state coverage.

[0040] A reorganization test case generation module is configured to perform data reorganization processing on the candidate test case to generate a reorganization test case.

[0041] A target test case generation module is configured to perform data repair processing on the reorganization test case to obtain a target test case.

[0042] A fuzz testing module is configured to input the target test case into the industrial control system under test to perform fuzz testing, and obtain a fuzz testing result.

[0043] To achieve the above object, another aspect of the embodiments of the present application provides an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the above method when executing the computer program.

[0044] To achieve the above object, another aspect of the embodiments of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above method.

[0045] The embodiments of the present application at least have the following beneficial effects: The present application provides a state-aware-based fuzzing test method, device, electronic equipment and medium, which obtains original industrial control protocol data packets, and pre-processes the original industrial control protocol data packets to obtain target industrial control protocol data packets; inputs the target industrial control protocol data packets into a sequence generation adversarial model to generate initial test cases; inputs the initial test cases into a tested industrial control system for fuzzing test, and obtains an initial protocol state coverage rate corresponding to the initial test cases when the initial test cases are subjected to the fuzzing test; screens candidate test cases from the initial test cases according to the initial protocol state coverage rate; performs data reorganization processing on the candidate test cases to generate reorganized test cases; performs data repair processing on the reorganized test cases to obtain target test cases; inputs the target test cases into the tested industrial control system for fuzzing test to obtain a fuzzing test result. The embodiments of the present application automatically learn the industrial control protocol format through the sequence generation adversarial model, without manual intervention, can output initial test cases conforming to the industrial protocol specification, greatly improves the efficiency and accuracy of protocol format inference, effectively improves the coverage and efficiency of protocol fuzzing test, and moreover, detects the protocol state space triggered by each initial test case through the protocol state coverage rate of the initial test cases when the initial test cases are subjected to the fuzzing test, so as to screen high-value candidate test cases from the initial test cases, then slices and reorganizes the candidate test cases to construct new target test cases for fuzzing test, improves the effectiveness of the test cases, and effectively detects potential vulnerabilities in the industrial control protocol. Therefore, the embodiments of the present application can accurately locate various protocol vulnerabilities without requiring the detection personnel to have deep professional knowledge, can not only significantly reduce the security risks caused by protocol vulnerabilities, but also can provide strong protection for the stable operation of the industrial control system, and greatly improves the security and reliability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 is a flowchart of a state-aware-based fuzzing test method provided by the embodiments of the present application;

[0047] Figure 2 is a test case generation flowchart based on SeqGAN provided by the embodiments of the present application;

[0048] Figure 3 is a data packet structure diagram with different operation codes provided by the embodiments of the present application;

[0049] Figure 4 is a schematic diagram of an operation code triggered protocol state machine provided by the embodiments of the present application;

[0050] Figure 5 is a logic code diagram of a data packet slicing algorithm provided by the embodiments of the present application;

[0051] Figure 6 is a logic code schematic diagram of a test case corpus reorganization algorithm provided by an embodiment of the present application;

[0052] Figure 7 is an operation schematic diagram of a protocol state inference module provided by an embodiment of the present application;

[0053] Figure 8 is a fuzzy test system architecture schematic diagram provided by an embodiment of the present application;

[0054] Figure 9 is a structure schematic diagram of a state-aware based fuzzy test apparatus provided by an embodiment of the present application;

[0055] Figure 10 is a hardware structure schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application. When the following description refers to the accompanying drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0057] It can be understood that the terms "first", "second", and the like used in the present application can be used herein to describe various concepts, but unless specifically stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determining".

[0058] The terms "at least one", "multiple", "each", "any" and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by a person skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0060] Currently, industrial control systems (ICS) play a vital role in modern society and are widely used in power, energy, rail transportation and other critical infrastructure fields. With the advent of the Industry 4.0 era and the development of the Industrial Internet of Things (IIoT), the interconnectivity of ICS is constantly increasing, which not only improves production efficiency but also poses serious network security challenges to industrial control systems. Traditionally, ICS is considered to be a system running in isolation, but today's openness and interconnectivity have broken this assumption, making the industrial control field extremely vulnerable to cyber attacks. Once attacked, it may cause production to stop and other problems, which may cause huge losses. Therefore, in related technologies, there is a software vulnerability mining technology based on fuzz testing, which is used to detect vulnerabilities in industrial control systems and ensure the safety of industrial control systems. As an efficient software vulnerability mining technology, fuzz testing has been widely used in ICS protocol security testing.

[0061] For example, current fuzz testing techniques are mainly divided into two categories: mutation-based and generation-based. Mutation-based fuzzers, such as American Fuzzy Lop (AFL), generate test cases by randomly mutating existing inputs, but due to their lack of in-depth understanding of protocol formats, they generate fewer valid inputs and are difficult to detect deep vulnerabilities. Generation-based fuzzers, such as Peach and Sulley, allow users to define input data models and support both generation-based and mutation-based data models, but they are highly dependent on protocol specifications. In practical applications, industrial control protocols, especially proprietary protocols, often lack public specifications and documentation, which poses great difficulties for generation-based fuzz testing.

[0062] In summary, the related fuzz testing techniques have the following shortcomings: First, traditional generation-based fuzz testing methods rely on manual extraction of protocol specifications, resulting in low effectiveness of test case generation. Second, such traditional generation-based fuzz testing tools lack a reasonable way to utilize test cases, and subsequent generation and mutation strategies are random, making it difficult to explore deep paths in the protocol state space, and thus unable to effectively detect potential vulnerabilities in industrial control protocols. Moreover, mainstream fuzz testing tools usually collect code coverage, which causes the program to terminate running, affecting the efficiency of fuzz testing.

[0063] In view of this, the embodiments of the present application provide a state-aware-based fuzzing test method and device, electronic equipment and medium. The method comprises the following steps: obtaining original industrial control protocol data packets, and preprocessing the original industrial control protocol data packets to obtain target industrial control protocol data packets; inputting the target industrial control protocol data packets into a sequence generation adversarial model to generate initial test cases; inputting the initial test cases into a tested industrial control system for fuzzing test, and obtaining an initial protocol state coverage rate corresponding to the initial test cases when the initial test cases are subjected to the fuzzing test; screening candidate test cases from the initial test cases according to the initial protocol state coverage rate; performing data recombination processing on the candidate test cases to generate recombined test cases; performing data repair processing on the recombined test cases to obtain target test cases; inputting the target test cases into the tested industrial control system for fuzzing test to obtain a fuzzing test result. The embodiments of the present application automatically learn the industrial control protocol format through the sequence generation adversarial model, without manual intervention, and can output initial test cases that meet the industrial protocol specifications, greatly improving the efficiency and accuracy of protocol format inference, effectively improving the coverage and efficiency of protocol fuzzing test. Moreover, the protocol state coverage rate of the initial test cases when subjected to the fuzzing test is used to detect the protocol state space triggered by each initial test case, so as to screen high-value candidate test cases from the initial test cases, and then slice and recombine the candidate test cases to construct new target test cases for fuzzing test, improving the effectiveness of the test cases and effectively detecting potential vulnerabilities in the industrial control protocol. Therefore, the embodiments of the present application can accurately locate various protocol vulnerabilities without the need for detection personnel to have deep professional knowledge, and not only can significantly reduce the security risks caused by protocol vulnerabilities, but also can provide strong protection for the stable operation of the industrial control system, greatly improving the security and reliability of the system.

[0064] The state-aware based fuzzing test method provided by the embodiments of the present application relates to the technical field of computers. The state-aware based fuzzing test method provided by the embodiments of the present application can be applied to a terminal, can be applied to a server, and can also be software running in the terminal or the server. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle-mounted terminal, and the like, but is not limited thereto; the server end can be configured as a stand-alone physical server, can be configured as a server cluster or a distributed system composed of multiple physical servers, can be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, and the server can also be a node server in a blockchain network; the software can be an application that implements the state-aware based fuzzing test method, and the like, but is not limited to the above forms.

[0065] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs (Personal Computers), minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0066] Please refer to Figure 1 , Figure 1 is an optional flowchart of the state-aware based fuzzing test method provided by the embodiments of the present application, Figure 1 The method in the flowchart can include but is not limited to steps S101 to S107.

[0067] Step S101, obtaining original industrial control protocol data packets, and preprocessing the original industrial control protocol data packets to obtain target industrial control protocol data packets;

[0068] In some embodiments, the step of preprocessing the original industrial protocol data packet to obtain the target industrial protocol data packet can include: performing structural processing on the original industrial protocol data packet to obtain a structured protocol data packet; and performing standardization processing on the structured protocol data packet to obtain the target industrial protocol data packet.

[0069] For the original industrial protocol data packet, also referred to as the original data packet, it can include the communication traffic of the industrial protocol simulation software and the public industrial protocol communication traffic or malicious traffic samples.

[0070] In the above process, the structuring refers to extracting the initial protocol traffic payload in the original industrial protocol data packet and converting the initial protocol traffic payload from hexadecimal to decimal; and the standardization refers to filling the decimal data so that the length of all data reaches n, facilitating model training.

[0071] Please refer to Figure 2 , Figure 2 is a test case generation process based on SeqGAN provided by the embodiments of the present application, as shown in Figure 2 The process of collecting the original data packet (protocol data) is as follows: first, the original data packet is obtained in two ways, one is to capture the communication traffic of the industrial protocol simulation software by using Wireshark, and the other is to use public industrial protocol communication traffic or malicious traffic samples; then, the original protocol traffic is saved in the PCAP file format in hexadecimal, thereby obtaining real protocol data.

[0072] Specifically, the process of protocol data preprocessing is as follows: first, according to the PCAP file format, the payload part of the original industrial control protocol traffic in the original data packet is extracted. Since the original protocol data is in hexadecimal, it cannot be directly processed by the SeqGAN model, and therefore it is necessary to convert the hexadecimal data into decimal data. For the extracted protocol data payload, the protocol message is divided according to characters, and the value range of each protocol character is 0x00 to 0x0F, corresponding to 0 to 15 in decimal. Secondly, in order to facilitate training, each extracted protocol data segment is padded to the maximum length n allowed by the protocol, so that the SeqGAN model can generate as many test cases as possible. At the same time, for sequences that do not meet the length, the padding characters "S", " / S" and "Pad" are used, where "S" represents the start character with a decimal value of 16, "\S" represents the end character with a decimal value of 17, and "Pad" represents the padding character with a decimal value of 18. At this point, the data preprocessing is completed, and the SeqGAN model can be trained using the preprocessed data to make the SeqGAN model learn the protocol specification, and finally the trained SeqGAN model is obtained. In the actual application or test stage, the trained SeqGAN model can be directly used to generate test cases for the preprocessed protocol data.

[0073] Step S102, inputting the target industrial control protocol data packet into the sequence generation adversarial model to generate an initial test case;

[0074] In some embodiments, step S102 can include: inputting the target industrial control protocol data packet into the generator in the sequence generation adversarial model, generating a candidate value set corresponding to each field in the target industrial control protocol data packet through the generator; using a greedy strategy to select the candidate value with the highest probability from each candidate value set as a target value; generating a string sequence according to the target value corresponding to each field; and performing structured processing on the string sequence to generate an initial test case.

[0075] Optionally, the sequence generation adversarial model in step S102 refers to a trained SeqGAN model, and the content in step S102 corresponds to the content in the model application stage, that is, the process of generating a new test case using the trained SeqGAN (generator) model.

[0076] Wherein, the structured processing here refers to the process of combining all generated characters by bytes and converting the string sequence from decimal to hexadecimal.

[0077] Before the SeqGAN model is applied, there is a training process of the SeqGAN model, specifically, as shown in Figure 2As shown, the training process of the SeqGAN model is as follows: the SeqGAN model takes the starting character as the initial input, generates the target string sequence C = ( ′ s ′ ,c1,c2,…,c t ,…,c T , ′ / s ′ ), where c t is the t-th character in the target string sequence C, c t ∈V, V is a set containing all possible values (candidate values). In a specific implementation, when the SeqGAN model generates c t , the generator model takes the previously generated string C = ( ′ s ′ ,c1,c2,…,c t-1 ) as input and outputs multiple optional values for c t . If the output character c t is ′ / s ′ or t = T, it indicates that the string output is complete, at which time the complete string is input to the discriminator to obtain the reward value to update the generator model; otherwise, if the output character c t is not ′ / s ′ or t≠T, it indicates that the string output is not complete, and the SeqGAN model uses the Monte Carlo tree search algorithm to sample the subsequent characters to obtain the complete string sequence, and then outputs the reward value of the complete string to update the generator model; finally, the trained SeqGAN (generator) model is obtained.

[0078] As shown in Figure 2 , the generation process of the SeqGAN model is as follows: a new test case is generated using the trained SeqGAN (generator) model. In a specific implementation, the trained SeqGAN model continues to take the starting character as the initial input, i.e., when the trained SeqGAN model generates c t , the generator model takes the previously generated string C = ( ′ s ′ ,c1,c2,…,c t-1 ) as input and outputs multiple optional values for c t ; then, the trained SeqGAN model adopts a greedy strategy to select the optional value with the highest probability as the final output until the string output is complete; finally, all generated characters are combined and converted to hexadecimal, thereby generating a complete test case.

[0079] The "start character" generally refers to an initial input character for starting a sequence generation process, which is a starting point for the generator to start generating a sequence of strings, such as the start character "S" described in step S101.

[0080] Step S103, inputting the initial test case into the industrial control system under test for fuzz testing, and obtaining an initial protocol state coverage rate corresponding to the initial test case when the initial test case is subjected to the fuzz testing;

[0081] In some embodiments, step S103 can include: in the process of the initial test case subjected to the fuzz testing, obtaining the initial protocol state coverage rate corresponding to the initial test case when the initial test case is subjected to the fuzz testing by using a patching technique; wherein the initial protocol state coverage rate is used to evaluate whether the initial test case is valuable.

[0082] In a specific implementation, the process of obtaining the initial protocol state coverage rate is as follows: inputting the initial test case generated by the SeqGAN model into the industrial control protocol (i.e., the software system under test) to perform fuzz testing on the industrial control protocol, and in the software system of the industrial control protocol, it is considered that the initial test case triggers a new state for each operation of the protocol. Therefore, the present application adds a feedback information in the generated fuzz testing, and uses the state coverage rate of the protocol as the feedback information to evaluate whether a test case is valuable. Specifically, an assembly code is inserted at a branch point of the target protocol program to obtain the coverage rate information:

[0083] cur_location = <COMPILE_TIME_RANDOM>;

[0084] shared_mem[cur_location ^ prev_location]++;

[0085] prev_location = cur_location >> 1.

[0086] Step S104, screening a candidate test case from the initial test case according to the initial protocol state coverage rate;

[0087] In some embodiments, step S104 can include: judging whether a new program execution state appears in the initial test case subjected to the fuzz testing in the industrial control system under test according to the initial protocol state coverage rate; if the new program execution state appears in the initial test case subjected to the fuzz testing in the industrial control system under test, it is determined that the initial test case is valuable, and a candidate test case is determined according to the initial test case with value.

[0088] The candidate test case refers to the initial test case with value.

[0089] In a specific implementation, by means of the instrumentation technology described in step S103, the protocol state space triggered by the newly generated test case can be tracked, and it is determined whether the test case reaches a new program execution state that has never appeared before. If the test case reaches a new program execution state that has never appeared before, the test case is considered valuable, and the subsequent packet slicing process will be performed; if the test case does not reach a new program execution state that has never appeared before, the test case is considered not valuable, and the subsequent packet slicing process does not need to be performed.

[0090] In step S105, data reorganization processing is performed on the candidate test case to generate a reorganized test case.

[0091] In some embodiments, step S105 can include: performing data slicing processing on the candidate test case to obtain a plurality of data blocks; constructing a test case corpus according to each data block; and performing corpus reorganization processing on each test case corpus in the test case corpus to generate a reorganized test case.

[0092] In a specific implementation, the industrial control protocol uses a special field to identify different valuable protocol data packets (valuable test cases), where the special field is referred to as a "function code" field (or an "operation code" field), which encodes the instructions to be executed by the device. By studying the input model of the industrial control protocol, it can be found that different types of test case data packets trigger different protocol state spaces, but different types of test case data packets share similar data blocks, and these data blocks trigger similar parsing code, and the data blocks belonging to different types of data packets may follow similar or identical construction rules. Different types of data packets cause the protocol to execute different state machines, but these paths may contain some shared code blocks for decoding corresponding data blocks. The code blocks of different paths may not be completely identical, but the functions of the code blocks of different paths may be similar, because the code blocks of different paths are used to parse data blocks generated by similar rules. Different types of data packets are sliced according to their data models, i.e., the legal values of the operation code field. If a test case is marked as valuable, the valuable test case will be sliced, and based on the similarity of different data blocks, the data blocks decomposed when generating test cases using other data models can be used to help optimize protocol state space exploration.

[0093] Please refer to Figure 3 , Figure 3 is a data packet structure diagram provided by the embodiments of the present application with different operation codes, as Figure 3As shown, a, b, c respectively represent three different protocol data packets; Ruleγ, Ruleβ1, Ruleβ2, Ruleα1, Ruleα2 all represent data block construction rules in the protocol data model, and the data blocks belonging to different types of data packets can follow similar or identical construction rules, and the data blocks with the same color in the figure mean that they follow similar construction rules.

[0094] Referring to Figure 4 , Figure 4 is a schematic diagram of an operation code triggered protocol state machine provided by the embodiment of the present application, as Figure 4 shown, Figure 4 different types of data packets cause the protocol execution state machine (indicated by different colors), but these paths can include some shared code blocks for decoding the corresponding data blocks. The code blocks of different paths can not be completely identical, but the functions of the code blocks of different paths can be similar, because the code blocks of different paths are used to parse the data blocks generated by similar rules.

[0095] The implementation process of the test case slice and reorganization is as follows: first, the valuable candidate test case is subjected to data slicing processing according to the data packet slicing algorithm, to obtain a plurality of data blocks (data packet slices); then, a test case corpus is constructed according to the data packet slice; and then, a new high-quality test case is obtained by reorganizing the test case corpus according to the position based on the test case corpus reorganization algorithm and the data packet structure and the test case corpus.

[0096] Referring to Figure 5 , Figure 5 is a schematic diagram of the logic code of the data packet slicing algorithm provided by the embodiment of the present application, as Figure 5 shown, in the data packet slicing algorithm, for a given format specification G, first, a detailed data model set M_{set} is extracted, and then these models are used to slice the valuable test case data packet T_v one by one. Specifically, for the selected data model M, the valuable test case data packet T_v is parsed using the PARSE method and an instantiation tree InsTree (an instantiation of the data model tree structure, each node corresponds to a data block) is obtained, if it is a legal InsTree, then the depth-first search (DFS) algorithm is used to traverse the instantiation tree InsTree, and the data packet slice corpus is collected from each subtree. For the subtree with the root node TreeNode, if it is a single node, then the slice represented by this subtree is the data block content of the node itself; otherwise, if it is an internal node, then the slice is the combination of all child node slices. After obtaining the corpus of the valuable seed T_v, the test case corpus reorganization will be performed based on the high-quality corpus subsequently.

[0097] Referring toFigure 6 , Figure 6 is a logical code schematic diagram of a test case corpus reorganization algorithm provided by an embodiment of the present application, as shown in Figure 6 , the test case corpus reorganization algorithm is as shown in Figure 6 , given a linear data model M_L (i.e. as shown in Figure 6 ) and a constructed data packet fragment corpus, first, the number of data blocks to be generated is obtained, and then the test case is reorganized according to the recursive module implemented in the Construct process: each data block is sequentially constructed until each data block is assigned a value. For each data block to be generated, the construction rule is extracted from the linear data model M_L, and the subset of puzzles in the data packet fragment corpus that meet the rule is marked as the candidate set (Candidates). When the candidate set is not empty, the fragments in the candidate set are used in turn to initialize the data block field, otherwise the inherent rule is used to provide the content of the field.

[0098] In step S106, data repair processing is performed on the reorganized test case to obtain a target test case.

[0099] In a specific implementation, since the newly generated test case after reorganization (i.e. the reorganized test case) must meet the file format requirements, the reorganized test case needs to be repaired, i.e. after reorganization to obtain the reorganized test case, the "Fixup" and "Relation" mechanisms provided by the Peach fuzzer can be used to repair the file to meet the integrity constraint conditions of the file, and finally the new high-quality test case obtained after repair (i.e. the target test case) is sent to the industrial control protocol under test for fuzz testing.

[0100] The content of the file repair can include, but is not limited to, file size, length, and check integrity constraint conditions.

[0101] In step S107, the target test case is input into the industrial control system under test for fuzz testing to obtain a fuzz testing result.

[0102] In some embodiments, the process of analyzing the target test case can also be monitored to obtain protocol analysis state data, and the protocol analysis state data is used to determine whether the target test case has completed the fuzz testing. If the target test case has completed the fuzz testing, the target protocol state coverage corresponding to the target test case during the fuzz testing is obtained, and the target protocol state coverage is used as the initial protocol state coverage. The process returns to the step of filtering the candidate test case from the initial test case according to the initial protocol state coverage until the target test case is generated.

[0103] The protocol analysis state data can include coverage checking data, network checking data, and log checking data. The coverage checking tracks the protocol analysis progress, the network checking analyzes real-time traffic response characteristics, and the log checking analyzes protocol processing results.

[0104] Exemplarily, in the process of performing the fuzzy test on the target test case, first, the protocol analysis process of the target test case is monitored to obtain protocol analysis state data; then, whether the target test case completes the fuzzy test is judged according to the protocol analysis state data, that is, whether the target test case has completed a fuzzy test cycle is judged; if the target test case has completed a fuzzy test cycle, the target protocol state coverage corresponding to the target test case in the process of performing the fuzzy test is obtained, and the target protocol state coverage is taken as an initial protocol state coverage, and the step of screening the candidate test case from the initial test case according to the initial protocol state coverage is returned to execute, that is, the target protocol state coverage can be understood as being compared with the historical protocol state coverage collected by the tested system in the running of the previous test case to obtain valuable test cases; then, the valuable test cases are sliced and reorganized and repaired based on the test case reorganization strategy of the protocol state coverage to generate a next new target test case; and the new target test case is sent to the tested industrial control protocol to perform the next round of fuzzy test. It should be noted that the fuzzy test will be looped until the user manually stops running to obtain the final fuzzy test result.

[0105] Please refer to Figure 7 , Figure 7 is an operation schematic diagram of the protocol state inference module provided in the embodiments of the present application, as shown in Figure 7As shown, the implementation process of the protocol state inference is as follows: during the interval between each sending of a target test case (i.e. a newly generated protocol data packet after recombination and repair) to the industrial control protocol under test (for example, the interval between the current test case being executed on the system under test and the next test case not being sent), the fuzzer calls the protocol state inference module to monitor the analysis process of the target test case using three checking strategies to determine whether the target test case has completed a fuzzy test cycle in the system under test; when all three checking strategies conclude that the target test case has been completely processed, it means that the target test case has completed a fuzzy test cycle in the system under test, then the fuzzer continues to collect feedback for the target test case (the collected is the protocol state coverage), compares the target protocol state coverage collected when the target test case is subjected to fuzzy testing with the historical protocol state coverage collected when the previous test case is subjected to fuzzy testing, obtains valuable test cases, and then performs slice recombination and repair processing on the valuable test cases based on the test case recombination strategy of protocol state coverage to generate the next industrial control protocol data packet (i.e. a new target test case), and then sends the new target test case to the industrial control protocol under test for the next round of fuzzy testing.

[0106] Specifically, during the interval between sending the current target test case to the industrial control protocol under test, the fuzzer calls the protocol state inference module to monitor the analysis process of the current target test case using three checking strategies; when all three checking strategies conclude that the current target test case has been completely processed, it means that the current target test case has completed a fuzzy test cycle in the system under test, the fuzzer continues to collect feedback for the current target test case to obtain the current protocol state coverage; then, the current protocol state coverage collected when the current target test case is run is compared with the historical protocol state coverage collected when the previous target test case is run, if the current protocol state coverage indicates that a new program execution state occurs when the current target test case is subjected to fuzzy testing in the industrial control system under test, it is considered that the current target test case is valuable, and the current protocol state coverage is used to replace the historical protocol state coverage, and then the current target test case is subjected to slice recombination and repair processing based on the test case recombination strategy of protocol state coverage to generate the next new target test case, and then the new target test case is sent to the industrial control protocol under test for the next round of fuzzy testing; otherwise, if the current protocol state coverage indicates that no new program execution state occurs when the current target test case is subjected to fuzzy testing in the industrial control system under test, it is considered that the current target test case is not valuable, and the next new target test case is generated by performing slice recombination and repair processing on the test case corresponding to the historical protocol state coverage, and then the new target test case is sent to the industrial control protocol under test for the next round of fuzzy testing.

[0107] The steps S101 to S107 shown in the embodiments of the present application are as follows: obtaining original industrial control protocol data packets, and preprocessing the original industrial control protocol data packets to obtain target industrial control protocol data packets; inputting the target industrial control protocol data packets into a sequence generation adversarial model to generate initial test cases; inputting the initial test cases into a tested industrial control system for fuzzy testing, and obtaining an initial protocol state coverage rate corresponding to the initial test cases when the initial test cases are subjected to fuzzy testing; screening candidate test cases from the initial test cases according to the initial protocol state coverage rate; performing data reorganization processing on the candidate test cases to generate reorganized test cases; performing data repair processing on the reorganized test cases to obtain target test cases; and inputting the target test cases into the tested industrial control system for fuzzy testing to obtain a fuzzy testing result. The embodiments of the present application automatically learn the industrial control protocol format through the sequence generation adversarial model, without manual intervention, and can output initial test cases that meet the industrial protocol specifications, greatly improving the efficiency and accuracy of protocol format inference, effectively improving the coverage and efficiency of protocol fuzzy testing. In addition, the protocol state space triggered by each initial test case is detected through the protocol state coverage rate of the initial test cases when subjected to fuzzy testing, so that high-value candidate test cases can be screened from the initial test cases. Then, the candidate test cases are sliced and reorganized to construct new target test cases for fuzzy testing, improving the effectiveness of the test cases and effectively detecting potential vulnerabilities in the industrial control protocol. Therefore, the embodiments of the present application can accurately locate various protocol vulnerabilities without requiring the detection personnel to have deep professional knowledge, and not only can significantly reduce the security risks caused by protocol vulnerabilities, but also can provide strong protection for the stable operation of the industrial control system, greatly improving the security and reliability of the system.

[0108] In addition, the present application also provides a multi-dimensional state monitoring mechanism, which tracks the protocol analysis progress through coverage checking, analyzes real-time traffic response characteristics through network checking, analyzes protocol processing results through log checking, and cooperatively infers the complete processing time of the data packet. The protocol running state can be dynamically perceived, the fuzzy feedback collection instruction can be accurately triggered, the limitations of traditional frequent protocol restarts can be broken through, non-intrusive state monitoring under the continuous operation of the industrial control system can be realized, the timeliness of abnormal capture can be effectively improved, accurate feedback triggering nodes for fuzzy testing can be provided, test resource consumption can be reduced, and the stability and efficiency of long-period testing can be enhanced.

[0109] To explain the principle of the technical scheme of the present application in detail, the overall process of the present application will be described below in combination with some specific embodiments. It should be easily understood that the following is an explanation of the technical principle of the present application and cannot be regarded as a limitation of the present application.

[0110] In the embodiments of the present application, a fuzz testing tool or method for an industrial control system specific communication protocol is provided to effectively solve the problems of low test case generation effectiveness, lack of rational use of test cases, and low fuzz testing efficiency caused by collection of coverage feedback in the related art. Through the state-aware fuzz testing method provided in the embodiments of the present application, the industrial control protocol format and specification can be intelligently learned, test cases close to real protocol traffic can be automatically generated, and efficient fuzz testing can be performed to discover potential vulnerabilities and risks. Furthermore, high-value test cases that trigger new protocol state spaces can be identified through lightweight instrumentation, and then the high-value test cases are sliced to construct a corpus. Finally, data blocks of different protocol states are reorganized based on the corpus, and high-quality test cases that are semantically legal are generated in combination with protocol constraint conditions. Efficient fuzz testing is then performed based on the new high-quality test cases, thereby improving the accuracy and efficiency of discovering potential vulnerabilities and risks and ensuring the safety of the industrial control system. In addition, the time when the target industrial control protocol completely processes a data packet is inferred, and then the fuzzer is notified to collect feedback information, thereby avoiding frequent system restarts and improving the overall fuzz testing efficiency. In a specific implementation, in the threat model in which an attacker may exploit vulnerabilities in the communication protocol between the monitoring software and the PLC device to perform attacks, the present application is committed to discovering these vulnerabilities before the attacker performs attacks, preventing catastrophic attacks such as monitoring software crashes and remote code execution caused by protocol vulnerabilities, maintaining the stable operation of the industrial control system, protecting the safety of critical infrastructure, and reducing the loss and impact caused by network attacks.

[0111] Please refer to Figure 8 , Figure 8 is a schematic diagram of a fuzz testing system provided by the embodiments of the present application, as shown in Figure 8 The fuzz testing system provided by the embodiments of the present application mainly includes four modules, namely an initial test case generation module, a monitor module, a fuzz (test) loop module, and a protocol state inference module, and the working contents of each module are as follows:

[0112] (1) Initial test case generation module: This module uses a sequence generation adversarial network (SeqGAN) to construct an industrial control protocol test case generation model. Through an adversarial training mechanism, the generator in the sequence generation adversarial network learns the potential distribution law of the protocol field sequence, and the discriminator evaluates the protocol compliance of the generated data. In combination with the policy gradient optimization of reinforcement learning, the context association generation of the protocol message structure is realized. Compared with traditional methods, the sequence generation adversarial network can adapt to the protocol syntax and semantic constraints, generate high-quality test cases covering normal / abnormal scenarios, and support multi-dimensional test requirements such as boundary values and format errors. Finally, a test case set that conforms to the industrial protocol specification is output, effectively improving the coverage and efficiency of protocol fuzz testing.

[0113] (2)Monitor module: This module uses a compilation insertion technology to monitor the running state of the measured industrial control protocol in real time, captures fine-grained data such as code coverage and memory access traces, and generates a tracking feedback stream to guide the test direction. Among them, after the fuzz testing in the measured industrial control protocol, potential system vulnerabilities (BUG) can be found based on the fuzz testing results.

[0114] (3)Fuzz cycle module: This module continuously optimizes the test process through a dynamic closed-loop mechanism, including the following core functions: selecting high-value test cases from the initial test cases based on tracking feedback, slicing and extracting protocol features from high-value test case data packets, and then constructing a structured corpus based on the sliced and extracted protocol features to support iterative testing, followed by reorganizing abnormal cases to explore potential vulnerabilities, and repairing defect files to ensure test effectiveness. Each link is connected through a visual flowchart, and this module forms a self-iterative cycle of "generation-execution-analysis-optimization" with the initial test case generation module and the monitor module. Using a data-driven strategy adjustment and resource reuse mechanism, it effectively improves the coverage and test efficiency of protocol exception scenarios, and ensures the long-period running stability of the industrial control system.

[0115] (4)Protocol state inference module: Based on a multi-dimensional state monitoring mechanism, this module tracks the protocol parsing progress through coverage checking, analyzes real-time traffic response characteristics through network checking, and parses protocol processing results through log checking, to cooperatively infer the complete processing time of the data packet. Adopting a blue-tinted modular design, it dynamically perceives the protocol running state and accurately triggers the fuzz feedback collection instruction. This module breaks through the limitations of traditional frequent protocol restarts, realizes non-intrusive state monitoring under the continuous running of the industrial control system, effectively improves the timeliness of exception capture, provides accurate feedback trigger nodes for fuzz testing, reduces test resource consumption, and enhances the stability and efficiency of long-period testing.

[0116] The specific implementation process of the state-aware fuzz testing method provided by the embodiments of the present application includes the following steps (steps S1 to S3):

[0117] Step S1, test case generation technology based on SeqGAN model: automatically learn the industrial control protocol format and specification through the SeqGAN model, and automatically generate high-quality test cases close to real protocol traffic. The specific content includes steps S11-S13:

[0118] Step S11, protocol data acquisition: Obtain the original data packet in two ways, one is to capture the communication traffic of the industrial control protocol simulation software using Wireshark, and the other is to use public industrial control protocol communication traffic or malicious traffic samples. Save the original protocol traffic as a PCAP file format in hexadecimal.

[0119] Step S12, protocol data preprocessing: first, according to the PCAP file format, the payload part of the original industrial control protocol traffic in the original data packet is extracted, since the original protocol data is hexadecimal, it cannot be directly processed by the SeqGAN model, therefore, it is necessary to convert the hexadecimal data into decimal data representation, for the extracted protocol data payload, the protocol message will be divided according to the characters, the value range of each protocol character is 0x00 to 0x0F, and the corresponding decimal is 0 to 15. Secondly, in order to facilitate training, each extracted protocol data segment is filled to the maximum length n allowed by the protocol, so that the SeqGAN model can generate as many test cases as possible; at the same time, for the sequence that does not meet the length, the padding characters "S", " / S" and "Pad" are used, wherein "S" represents the start character, and the decimal value is 16; "\S" represents the end character, and the decimal value is 17; "Pad" represents the padding character, and the decimal is 18. At this point, the data preprocessing is completed, and the SeqGAN model can be trained using the preprocessed data, so that the SeqGAN model learns the protocol specification, and finally the trained SeqGAN model is obtained.

[0120] Step S13, test case generation: the trained SeqGAN generator model generates test cases with the start character as the initial input. In the generation process, the generator outputs multiple optional values for each field, and selects the optional value with the highest probability as the final output using the greedy strategy until a complete string sequence is generated; then, all generated characters are combined and converted to hexadecimal to obtain a complete initial test case.

[0121] Step S2, test case recombination strategy based on protocol state coverage: through lightweight instrumentation, the program execution path triggered by each initial test case, i.e. the reached protocol state space, is detected to identify valuable test cases; then, based on the data model, the valuable test case data packets are sliced, these data packet slices can be used to build a corpus to find some meaningful operation fragments; suitable combinations are selected from the data packet slices in the corpus for recombination to build new high-quality test cases, the specific contents include steps S21-S23:

[0122] Step S21, high-value test case identification: the initial test cases generated in step S1 are input into the tested industrial control protocol, and the tested industrial control protocol is subjected to fuzz testing. In the software system of the industrial control protocol, the initial test case is considered to trigger a new state every time the protocol performs an operation. Therefore, the application adds a feedback information in the generated fuzz testing, and uses the state coverage of the protocol as the feedback information to evaluate whether a test case is valuable. Specifically, an assembly code is inserted at the branch point of the target protocol program to obtain coverage information: cur_location = <COMPILE_TIME_RANDOM>; shared_mem[cur_location ^ prev_location] ++; prev_location = cur_location >> 1. With the help of the insertion technology, the protocol state space triggered by the newly generated test case can be tracked, and it can be judged whether the test case reaches a new program execution state that has never appeared before. If the test case reaches a new program execution state that has never appeared before, the test case is considered to be valuable, and the subsequent data packet slicing process will be performed; if the test case does not reach a new program execution state that has never appeared before, the test case is considered to be not valuable, and the subsequent data packet slicing process does not need to be performed.

[0123] Step S22, data packet slicing: the industrial control protocol uses a special field to identify different data packets, which is called "function code" field (or "operation code" field). Based on this field, the instructions to be executed by the device are encoded. By studying the input model of the industrial control protocol, it can be found that different types of test case data packets will trigger different protocol state spaces, but different types of test case data packets will share similar data blocks, and these data blocks will trigger similar parsing code. The data blocks belonging to different types of data packets may follow similar or identical construction rules. Different types of data packets will cause the protocol to execute different state machines, but these paths may contain some shared code blocks for decoding corresponding data blocks. The code blocks of different paths may not be exactly the same, but the functions of the code blocks of different paths may be similar, because the code blocks of different paths are used to parse data blocks generated by similar rules. Different types of data packets are sliced according to their data models, i.e. the legal values of the operation code field. If a test case is marked as valuable, the valuable test case will be sliced. Based on the similarity of different data blocks, the data blocks decomposed when generating test cases using other data models can be used to help optimize the exploration of protocol state space.

[0124] Step S23, test case corpus reorganization: the data packet slices in step S22 are used to construct a test case corpus, and then the test case corpus is reorganized according to the data packet structure and the test case corpus to obtain a new test case. After reorganization, the "fixup" and "relation" mechanisms of the Peach fuzzer are used to repair the new test case to meet the integrity constraints of the file, and finally the repaired new high-quality test case is sent to the tested industrial protocol for fuzz testing.

[0125] Step S3, fuzz testing performance optimization strategy based on protocol state inference: the time when the target industrial protocol completely processes a data packet is inferred, and then the fuzzer is notified to collect feedback information to avoid frequent restarts and improve the overall fuzz testing efficiency. The specific content includes steps S31-S32.

[0126] Step S31, protocol state inference: during the interval between each transmission of the protocol data packet (new high-quality test case) generated after reorganization and repair in step S2, the fuzzer calls the protocol state inference module to monitor the data packet parsing process. This module uses three checking strategies to make inferences, of which the main strategy is runtime coverage checking, and the other two auxiliary strategies are network checking and log checking.

[0127] Step S32, feedback collection: when the three checking strategies in step S31 all conclude that the protocol data packet generated after reorganization and repair in step S2 has been completely processed, the fuzzer will continue to collect the feedback of the data packet, and then compare the target protocol state coverage collected when the data packet is fuzz tested with the historical protocol state coverage collected when the previous test case protocol data packet is fuzz tested to obtain valuable test cases. Then, based on the test case reorganization strategy of protocol state coverage, the valuable test cases are reorganized and repaired by slicing to generate the next new industrial protocol data packet, and the new industrial protocol data packet is sent to the tested industrial protocol for the next round of fuzz testing.

[0128] It can be understood that (1) for the problem that the conventional generation-based fuzzing method relies on manual extraction of protocol specifications, resulting in insufficient test case effectiveness, the application proposes an automatic test case generation method based on sequence generation adversarial network (SeqGAN). The original protocol data packet is preprocessed into structured sequence data, and standardized processing is performed to construct a training set, and then the SeqGAN model is used to learn the protocol specification to automatically generate initial high-quality test cases. (2) For the problem that related fuzzing tools lack effective use of test cases and have high variability strategy blindness, the application proposes a test case reorganization strategy based on protocol state coverage. Through lightweight instrumentation, high-value test cases that trigger new protocol state spaces are identified, and then they are sliced to construct a corpus, and finally the data blocks of different protocol states are reorganized based on the corpus, and combined with the protocol constraint conditions to generate new semantic legal high-quality test cases. (3) For the problem that related fuzzing tools have low throughput due to collecting code coverage, which causes the tested program to restart, the application designs an intelligent protocol state inference module, which accurately judges the protocol processing completion node through multi-dimensional dynamic monitoring (code coverage checking, network flow analysis, log analysis); At the same time, lightweight instrumentation technology is used to record coverage information in real time through shared memory, and combined with response timing and log events to dynamically infer state transitions, avoiding program restart. In addition, the state inference result is fed back to the fuzzing loop to form an adaptive closed loop of "generation-execution-analysis-optimization".

[0129] It should be noted that the present embodiment only briefly illustrates the general process of the state-aware fuzzing method, and the detailed description of each step can refer to the related content in the foregoing embodiments, which will not be repeated here. It can be understood that the present application does not limit this.

[0130] The embodiment of the application obtains original industrial control protocol data packets, and pre-processes the original industrial control protocol data packets to obtain target industrial control protocol data packets; inputs the target industrial control protocol data packets into a sequence generation adversarial model to generate initial test cases; inputs the initial test cases into a measured industrial control system for fuzzy testing, and obtains an initial protocol state coverage rate corresponding to the initial test cases when the initial test cases are subjected to fuzzy testing; screens candidate test cases from the initial test cases according to the initial protocol state coverage rate; performs data reorganization processing on the candidate test cases to generate reorganized test cases; performs data repair processing on the reorganized test cases to obtain target test cases; inputs the target test cases into the measured industrial control system for fuzzy testing to obtain a fuzzy testing result. The embodiment of the application automatically learns an industrial control protocol format through a sequence generation adversarial model, without manual intervention, can output initial test cases conforming to an industrial protocol specification, greatly improves the efficiency and accuracy of protocol format inference, effectively improves the coverage and efficiency of protocol fuzzy testing, and moreover, detects a protocol state space triggered by each initial test case through a protocol state coverage rate of the initial test cases when the initial test cases are subjected to fuzzy testing, so as to be able to screen high-value candidate test cases from the initial test cases, then slice and reorganize the candidate test cases to construct new target test cases for fuzzy testing, improves the effectiveness of the test cases, and can effectively detect potential vulnerabilities in the industrial control protocol. Therefore, the embodiment of the application can accurately locate various protocol vulnerabilities without requiring detection personnel to have deep professional knowledge, can not only significantly reduce security risks caused by protocol vulnerabilities, but also can provide strong protection for stable operation of the industrial control system, and greatly improves the security and reliability of the system.

[0131] Moreover, the application also provides a multi-dimensional state monitoring mechanism, traces protocol analysis progress through coverage checking, analyzes real-time traffic response characteristics through network checking, analyzes protocol processing results through log checking, cooperatively infers a complete data packet processing time, can dynamically perceive a protocol running state, accurately triggers a fuzzer to feed back and collect instructions, breaks through the limitation of traditional frequent protocol restarts, realizes non-intrusive state monitoring under continuous operation of the industrial control system, effectively improves timeliness of abnormal capture, provides accurate feedback triggering nodes for fuzzy testing, reduces test resource consumption, and enhances stability and efficiency of long-period testing.

[0132] In summary, the key advantages of the embodiment of the application are as follows:

[0133] (1) Automatic protocol format inference and test case generation: based on the SeqGAN model, the application can automatically learn the protocol format specification without manual reverse engineering, greatly improving the efficiency and accuracy of protocol format inference. This enables the rapid and accurate generation of test cases that conform to the protocol format when facing private protocols, effectively solving the problem of private protocol reverse difficulty in related technologies.

[0134] In terms of protocol format inference, related fuzzy testing techniques rely on manual reverse engineering or known protocol specifications. However, the application uses the SeqGAN model to automatically learn the protocol format, eliminating the need for manual intervention, making it more efficient and suitable for closed-source protocols.

[0135] (2) Efficient mutation strategy: through lightweight instrumentation, the protocol state space triggered by each test case is detected, and valuable test cases are identified. Based on the data model, the valuable data packets are sliced and reorganized to construct new test cases, improving the effectiveness of test cases and increasing the likelihood of discovering potential vulnerabilities in the protocol.

[0136] In terms of mutation strategy, related fuzzy testing techniques ignore the correlation between test cases. However, the application identifies high-value test cases in the initial test cases through protocol state coverage, and then slices and reorganizes them to obtain new test cases, significantly improving the quality of test cases generated in subsequent fuzzy testing cycles.

[0137] (3) Fuzzy testing throughput: through the protocol state inference module during the interval between sending protocol data packets, three checking strategies (coverage checking to track protocol parsing progress, network checking to analyze real-time traffic response characteristics, and log checking to analyze protocol processing results) are used to infer whether the data packet is completely processed. If the data packet is completely processed, feedback collection is performed, and then the next industrial control protocol data packet is generated, improving the throughput and speed of fuzzy testing.

[0138] The state-aware industrial control system protocol fuzzing method provided by the embodiment can effectively detect potential vulnerabilities in the protocol, and does not need to make complex modifications to the target system. Compared with the traditional vulnerability detection method, the state-aware industrial control system protocol fuzzing method provided by the embodiment is more efficient and comprehensive, can accurately locate various protocol vulnerabilities, and does not require the detection personnel to have deep professional knowledge. It can be understood that the state-aware industrial control system protocol fuzzing method provided by the embodiment can not only significantly reduce the security risks caused by protocol vulnerabilities, but also can provide strong protection for the stable operation of the industrial control system, greatly improve the security and reliability of the system, and can be widely applied to various industrial control systems, and has broad application prospects. Specifically, the test case generation, data packet slicing and recombination, and performance optimization strategy used in the embodiment can dynamically generate diversified test data during the fuzzing process, and intelligently mutate and reasonably combine the test data, so as to timely discover and locate protocol vulnerabilities. The state-aware industrial control system protocol fuzzing method provided by the embodiment can also identify and prevent various types of protocol vulnerabilities, including but not limited to data format errors, protocol logic defects, boundary condition abnormalities, and the like. In addition, the state-aware industrial control system protocol fuzzing method provided by the embodiment can flexibly adjust the test parameters and strategies according to actual needs, meet the safety testing needs of different industrial control systems, and can be applied to the field of network security technology of industrial control systems, and mainly solves the safety testing problem of the industrial control system protocol.

[0139] In terms of fuzzing efficiency, the state-aware industrial control system protocol fuzzing method provided by the embodiment designs an intelligent protocol state inference module to accurately determine the protocol processing completion node through multi-dimensional dynamic monitoring. At the same time, a lightweight instrumentation technology is used to record coverage information in real time through shared memory, avoiding frequent program restarts and improving the efficiency of the fuzzing.

[0140] Referring to Figure 9 The state-aware industrial control system protocol fuzzing method provided by the embodiment also provides a state-aware fuzzing device 900, which can implement the above-mentioned state-aware fuzzing method. The device includes the following modules:

[0141] The data preprocessing module 901 is configured to obtain an original industrial control protocol data packet, and preprocess the original industrial control protocol data packet to obtain a target industrial control protocol data packet.

[0142] The initial test case generation module 902 is configured to input the target industrial control protocol data packet into a sequence generation adversarial model to generate an initial test case.

[0143] The protocol state coverage acquisition module 903 is configured to input the initial test case into a measured industrial control system for fuzzing, and acquire an initial protocol state coverage corresponding to the initial test case when the initial test case is subjected to fuzzing.

[0144] The candidate test case screening module 904 is configured to screen candidate test cases from the initial test cases according to the initial protocol state coverage;

[0145] The recombination test case generation module 905 is configured to perform data recombination processing on the candidate test cases to generate recombination test cases;

[0146] The target test case generation module 906 is configured to perform data repair processing on the recombination test cases to obtain target test cases;

[0147] The fuzzing test module 907 is configured to input the target test cases into the industrial control system under test to perform fuzzing test to obtain fuzzing test results.

[0148] It can be understood that the content in the above method embodiments is applicable to the device embodiments, the device embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0149] The embodiment of the present application further provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the above state-aware fuzzing test method when executing the computer program. The electronic device can be any intelligent terminal, such as a tablet computer or a vehicle-mounted computer.

[0150] It can be understood that the content in the above method embodiments is applicable to the device embodiments, the device embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0151] Please refer to Figure 10 , Figure 10 The hardware structure of the electronic device of another embodiment is illustrated, which includes:

[0152] The processor 1001 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute related programs to implement the technical solutions provided by the embodiments of the present application.

[0153] The memory 1002 can be implemented in the form of a Read-Only Memory (ROM), a static storage device, a dynamic storage device, or a Random Access Memory (RAM), etc. The memory 1002 can store an operating system and other application programs, and when the technical solutions provided in the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 1002 and are called and executed by the processor 1001 to implement the state-aware fuzzing method provided in the embodiments of the present application;

[0154] The input / output interface 1003 is configured to realize information input and output.

[0155] The communication interface 1004 is configured to realize the communication interaction between the device and other devices, and the communication can be realized by a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0156] The bus 1005 is configured to transmit information between various components (for example, the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004) of the device.

[0157] The processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 are connected to each other through the bus 1005 to realize the communication connection between the devices.

[0158] The computer readable storage medium provided in the embodiments of the present application stores a computer program, and the computer program is executed by the processor to implement the state-aware fuzzing method described above.

[0159] It can be understood that the contents in the above method embodiments are applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved by the present storage medium embodiments are also the same as those of the above method embodiments.

[0160] The memory is a non-transitory computer readable storage medium, which can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0161] The method and device for state-aware fuzz testing, the electronic device and the medium provided by the embodiments of the present application obtain original industrial control protocol data packets, preprocess the original industrial control protocol data packets to obtain target industrial control protocol data packets, input the target industrial control protocol data packets into a sequence generation adversarial model to generate initial test cases, input the initial test cases into the industrial control system under test for fuzz testing, and obtain the initial protocol state coverage of the initial test cases during the fuzz testing. The initial test cases are screened from the initial test cases according to the initial protocol state coverage. The candidate test cases are subjected to data reorganization processing to generate reorganized test cases. The reorganized test cases are subjected to data repair processing to obtain target test cases. The target test cases are input into the industrial control system under test for fuzz testing to obtain fuzz testing results. The embodiments of the present application automatically learn the industrial control protocol format through the sequence generation adversarial model without manual intervention, can output initial test cases that meet the industrial protocol specifications, greatly improve the efficiency and accuracy of protocol format inference, effectively improve the coverage and efficiency of protocol fuzz testing, and detect the protocol state space triggered by each initial test case through the protocol state coverage of the initial test cases during the fuzz testing, so as to screen high-value candidate test cases from the initial test cases. The candidate test cases are then sliced and reorganized to construct new target test cases for fuzz testing, which improves the effectiveness of the test cases and effectively detects potential vulnerabilities in the industrial control protocol. Therefore, the embodiments of the present application can accurately locate various protocol vulnerabilities without requiring the detection personnel to have deep professional knowledge, can significantly reduce the security risks caused by protocol vulnerabilities, can provide strong protection for the stable operation of the industrial control system, and greatly improves the security and reliability of the system.

[0162] The embodiments described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0163] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than the figures shown, or combine certain steps or different steps.

[0164] The device embodiments described above are only schematic, and the units illustrated as separate components can or can not be physically separated, that is, can be located in one place or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0165] Those skilled in the art can understand that all or some of the steps in the method disclosed above, the function modules / units in the system and the device can be implemented as software, firmware, hardware and appropriate combinations thereof.

[0166] The terms "first", "second", "third", "fourth" and the like in the description of the application and in the claims hereof, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the use of the terms so termed herein is to be interpreted to only cover the embodiments of the application described herein and not a prior art. Moreover, the terms "comprising", "having", "including", and "containing" are to be construed open-ended terms (i.e., meaning "including, but not limited to,") unless otherwise noted to exclude such terms in context. The terms "a", "an", and "the" are used interchangeably with "one or more" or "at least one" unless otherwise indicated in context.

[0167] It should be understood that, in the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the relationship between associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that there are three cases: only A, only B, and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be singular or plural.

[0168] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above-mentioned units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be omitted or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed objects can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0169] The units described as separate components above can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0170] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0171] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application, essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0172] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, and the scope of the rights of the embodiments of the present application is not limited thereto. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the rights of the embodiments of the present application.

Claims

1. A state-aware based fuzzing method, characterized in that, The method comprises the following steps: Obtaining an original industrial control protocol data packet, and preprocessing the original industrial control protocol data packet to obtain a target industrial control protocol data packet; Input the target industrial control protocol data packet into a sequence generation adversarial model to generate an initial test case; Inputting the initial test case into the industrial control system under test for fuzz testing, and obtaining the initial protocol state coverage corresponding to the initial test case during the fuzz testing; Screening candidate test cases from the initial test cases according to the initial protocol state coverage; Performing data reorganization processing on the candidate test cases to generate reorganized test cases; Performing data repair processing on the reconstructed test case to obtain a target test case; The target test case is input into the industrial control system under test to perform fuzz testing and obtain a fuzz testing result.

2. The method of claim 1, wherein, The method further comprises: During the fuzz testing of the target test case, monitoring the parsing process of the target test case to obtain protocol parsing status data; Determining whether the target test case has completed fuzz testing based on the protocol parsing status data; If the target test case completes the fuzz test, the target protocol state coverage corresponding to the target test case during the fuzz test is obtained, and the target protocol state coverage is used as the initial protocol state coverage, and the step of filtering out candidate test cases from the initial test case according to the initial protocol state coverage is returned to execute until the target test case is generated.

3. The method of claim 1, wherein, The preprocessing of the original industrial control protocol data packet to obtain a target industrial control protocol data packet includes: Structuring the original industrial control protocol data packet to obtain a structured protocol data packet; The structured protocol data packet is standardized to obtain the target industrial control protocol data packet.

4. The method of claim 1, wherein, The step of inputting the target industrial control protocol data packet into a sequence to generate an adversarial model and generate an initial test case includes: Inputting the target industrial control protocol data packet into the generator in the sequence generative adversarial model, and generating a set of candidate values ​​corresponding to each field in the target industrial control protocol data packet by the generator; Adopting a greedy strategy, the candidate value with the highest probability is selected from the candidate value set corresponding to each field as the target value; Generate a character string sequence according to the target value corresponding to each of the fields; The character string sequence is structured to generate the initial test case.

5. The method according to claim 1, characterized in that The obtaining of the initial protocol state coverage corresponding to the initial test case during the fuzz test includes: During the fuzz testing of the initial test case, the instrumentation technology is used to obtain the initial protocol state coverage corresponding to the initial test case when the fuzz testing is performed on the industrial control system under test; wherein, the initial protocol state coverage is used to evaluate whether the initial test case is valuable.

6. The method of claim 1, wherein, The step of selecting candidate test cases from the initial test cases according to the initial protocol state coverage includes: determine whether the initial test case has a new program execution state when the initial test case is used for fuzz testing in the industrial control system to be tested according to the initial protocol state coverage; if the initial test case has the new program execution state when the initial test case is used for fuzz testing in the industrial control system to be tested, it is determined that the initial test case has value, and the candidate test case is determined according to the initial test case with value.

7. The method of claim 1, wherein, The data reorganization processing of the candidate test case includes: data slicing processing of the candidate test case to obtain a plurality of data blocks; constructing a test case corpus according to each data block; performing corpus reorganization processing on each test case corpus in the test case corpus to generate the reorganized test case.

8. A state-aware fuzzing apparatus, characterized in that, The apparatus includes the following modules: a data preprocessing module configured to obtain original industrial control protocol data packets and perform preprocessing on the original industrial control protocol data packets to obtain target industrial control protocol data packets; an initial test case generation module configured to input the target industrial control protocol data packets into a sequence generation adversarial model to generate initial test cases; a protocol state coverage acquisition module configured to input the initial test cases into an industrial control system to be tested for fuzz testing and acquire initial protocol state coverages corresponding to the initial test cases when the initial test cases are used for fuzz testing; a candidate test case screening module configured to screen candidate test cases from the initial test cases according to the initial protocol state coverages; a reorganized test case generation module configured to perform data reorganization processing on the candidate test cases to generate reorganized test cases; a target test case generation module configured to perform data repair processing on the reorganized test cases to obtain target test cases; a fuzz testing module configured to input the target test cases into the industrial control system to be tested for fuzz testing to obtain fuzz testing results.

9. An electronic device, comprising: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method of any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program is executed by the processor to implement the method of any one of claims 1 to 7.

Images