Protocol fuzz testing method for PLC program vulnerability analysis

Abstract

The invention discloses a protocol fuzz testing method for PLC program vulnerability analysis. Protocol data are input into a large language model, structured semantic output is generated by using the large language model, a protocol field semantic library is constructed, a variant test case is generated, and a target system protocol test is performed by using the test case. According to the scheme, fine-grained efficient reverse analysis of the private communication protocol is achieved through the semantic analysis capacity of the large language model, the limitation that a traditional method depends on a protocol document is relieved, the fuzzy test case generation method based on the specific semantic model is provided, key fields in the protocol can be precisely varied, and the generation efficiency of the fuzzy test case is improved. Compared with a traditional fuzzy test method, the method has the advantages that unnecessary field variation is omitted, so that the capability of finding the vulnerability of the program faster is achieved, technical support is provided for safety protection and vulnerability repair of the industrial control system, the risk of network attack is reduced, and unnecessary economic loss is avoided.

Description

Technical Field

[0001] This invention belongs to the field of industrial control system security, specifically relating to a protocol fuzzy testing method for vulnerability analysis of PLC programs. Background Technology

[0002] With the widespread application of Industrial Control Systems (ICS), PLCs (Programmable Logic Controllers), as core equipment in industrial automation, play a vital role in key sectors such as manufacturing, energy, and transportation. However, industrial devices such as PLCs typically rely on proprietary communication protocols for data exchange. These protocols often lack publicly available documentation and standardized security designs, making them vulnerable to cyberattacks. In recent years, cybersecurity threats against industrial control systems have been increasing, seriously threatening the security and stability of industrial production.

[0003] Currently, methods for detecting vulnerabilities in PLC programs mainly include static code analysis and dynamic testing. However, static analysis struggles to handle complex proprietary protocols and dynamic operating environments, while traditional dynamic testing methods (such as fuzz testing) often suffer from low test case generation efficiency and ineffective coverage of potential vulnerabilities when dealing with industrial communication protocols due to a lack of in-depth understanding of protocol semantics. Furthermore, the real-time and high reliability requirements of industrial control systems pose significant challenges to the practical application of traditional security testing methods.

[0004] In recent years, Large Language Models (LLMs) have made significant progress in the fields of natural language processing and semantic understanding, and their powerful contextual analysis capabilities have provided new possibilities for the reverse analysis of complex data structures. However, how to apply Large Language Models to the semantic analysis of industrial communication protocols and combine them with fuzz testing techniques to build an efficient vulnerability detection framework remains a technical challenge that urgently needs to be solved.

[0005] Therefore, there is an urgent need for a method that can combine large language models for protocol semantic reverse analysis and use intelligent fuzz testing to discover vulnerabilities in PLC programs, so as to improve the security and anti-attack capabilities of industrial control systems. Summary of the Invention

[0006] To address the aforementioned problems, the present invention aims to provide a protocol fuzzing test method for vulnerability analysis of PLC programs.

[0007] The specific technical solution for achieving the objective of this invention is as follows:

[0008] A protocol fuzzing method for vulnerability analysis of PLC programs includes the following steps:

[0009] Step 1: Collect protocol data and perform preprocessing;

[0010] Step 2: Input the collected protocol data into the large language model, use the large language model to generate structured semantic output, and build a protocol field semantic library;

[0011] Step 3: Generate variant test cases based on the protocol data output by the structured semantics;

[0012] Step 4: Use test cases to test the target system protocol.

[0013] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0014] (1) High-efficiency protocol reverse engineering: Due to the lack of semantic support from official documentation, traditional protocol semantic methods can only parse coarse-grained semantic content in private protocols. In response, the present invention uses the semantic analysis capabilities of a large language model to achieve fine-grained and efficient reverse engineering of private communication protocols, thereby alleviating the limitations of traditional methods that rely on protocol documentation.

[0015] (2) Intelligent test case generation: This invention proposes a fuzzy test case generation method based on a specific semantic model, which can accurately mutate the key fields in the protocol, and achieve the ability to discover program vulnerabilities faster than traditional fuzzy testing methods by eliminating unnecessary field mutations.

[0016] (3) Enhance the security of industrial control systems: Through the protocol semantic extraction method and fuzzy testing framework proposed in this invention, users can discover the vulnerabilities and security risks that may exist in the PLC programs they use, providing technical support for the security protection and vulnerability repair of industrial control systems, thereby reducing the risk of network attacks and avoiding unnecessary economic losses.

[0017] The solution of this invention is applicable to vulnerability analysis of various industrial control devices and their communication protocols, and has broad application prospects, especially in critical infrastructure fields such as manufacturing, energy, and transportation.

[0018] The present invention will be further described below with reference to specific embodiments. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the protocol fuzzy testing method for vulnerability analysis of PLC programs according to the present invention.

[0020] Figure 2 This is a schematic diagram illustrating a method for semantic extraction of private industrial network protocols using a large language model, as described in an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram illustrating the generation of variant test cases based on semantic guidance in an embodiment of the present invention. Detailed Implementation

[0022] Example

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not specifically refer to the singular and may also include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0025] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of this application. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following drawings denote similar items; therefore, once an item is defined in one drawing, it need not be further discussed in subsequent drawings.

[0026] Combination Figure 1 A protocol fuzzing test method for vulnerability analysis of PLC programs includes the following steps:

[0027] Step 1: Collect protocol data and perform preprocessing:

[0028] Step 1-1: Collect relevant data of the target private protocol, including protocol messages and protocol implementation code;

[0029] The protocol message refers to message data captured from actual network communication, or protocol interaction records obtained through debugging tools;

[0030] The protocol code refers to code segments related to protocol processing extracted from the source code or decompilation results of the target system, including message parsing, field definition, and processing logic;

[0031] Step 1-2: Preprocess the collected protocol messages and codes:

[0032] The protocol messages are structured to extract possible field boundaries and data features, such as fixed-length fields, flags, or delimiters.

[0033] Perform coarse-grained semantic analysis on the protocol code to identify functions, structure definitions and field descriptions related to message processing, and construct a preliminary semantic field hierarchy outline.

[0034] Step 2: Input the collected protocol data into the large language model, use the large language model to generate structured semantic output, and build a protocol field semantic library:

[0035] Step 2-1: Design prompt words to drive the large language model, such as... Figure 2 As shown, it contains the following five key input modules:

[0036] The Task Description (TD) clarifies the tasks that the LLM needs to perform, such as "inferring the protocol field format and semantics from the provided protocol messages and code, and generating test cases." The Task Description can be dynamically adjusted based on the interaction history.

[0037] The format specification (DF) is used to define the specific requirements for the output format. For example, the output format can be defined as a table, with each row containing the above attributes of the fields.

[0038] Protocol code C is used to provide code snippets related to the target protocol, including message parsing logic and field definition content;

[0039] Protocol message M is used to provide actual message data samples to help LLM understand the application of the protocol in reality;

[0040] The interaction history (H) is used to record previous interactions, optimize task descriptions, or supplement contextual information.

[0041] Step 2-2: Input the designed prompt words into the large language model, which includes the specific content of the above five modules;

[0042] The Task Description (TD) module provides the task objective and background information. The Protocol Code (C) and Protocol Message (M) modules serve as the main input data for LLM analysis of the protocol structure and field semantics. The Format Specification (DF) module guides LLM in generating an output format that meets expectations. The Interaction History (H) module is used to supplement context or adjust the task description.

[0043] When inputting prompts, ensure that the prompts are concise, clear, and unambiguous. For example, the task description should explicitly state "infer field semantics" or "generate test cases conforming to the protocol format," and the format specification should provide clear output examples.

[0044] Steps 2-3: The large language model analyzes and infers based on the input prompts, extracts field definitions, parsing logic and related semantic information from the protocol code, and infers field boundaries, data types and possible semantics from the protocol messages;

[0045] Combining code and message information, a structured description of the protocol fields is generated, including field name, position, whether it is fixed, and semantic explanation. The protocol field semantic library V is built based on the structured semantic output generated by the large language model, and contains the mapping relationship between the protocol fields and the corresponding field semantics extracted by the large language model {V→{(N,P,J,E)}}, where N is the field name, P is the field position, J is whether the field is fixed, and E is the field description.

[0046] Specifically, the large language model analyzes and infers based on the input prompt words, as follows:

[0047] Step 2-3-1: The large language model analyzes and infers the protocol fields based on the prompt words, and generates structured output according to the format specification (DF). The output includes the name N of each field, its position in the message P, whether it is a fixed field J, and the semantic description E of the field.

[0048] Examples are shown in the table below:

[0049] Field Name Agreement location Is it fixed? Field Description Header 0-3 yes Message header identifier Length 4-5 no Total message length

[0050] Step 2-3-2: Compare the generated field descriptions with the actual protocol messages to check whether the field division is accurate. Use the generated field descriptions to construct test cases and run the test cases through the target system to verify whether they conform to the protocol logic.

[0051] Step 2-3-3, Iterative Optimization: If the field segmentation or semantic inference is inaccurate, supplement more protocol message samples or code snippets, update the protocol message M and protocol code C. If the output format does not meet expectations, modify the format specification DF, and record each judgment and the content of the supplement and modification, update the interaction history H for subsequent task optimization, and repeat this step until the generated field description meets the requirements.

[0052] Step 3: Based on the protocol data output by the structured semantics, generate variant test cases, such as... Figure 3 As shown:

[0053] Step 3-1: Select the target string sequence to be mutated:

[0054] A＝(‘ <g>’,c1,c2,…,c t ,…,c T ,‘ <h>')

[0055] Among them, c t This represents the value of the t-th message field, where T is the maximum number of fields in the message. <g>"Indicates the start character of the protocol message," <h>" indicates the end of the message;

[0056] Each field in the target string sequence is matched and selected from the protocol field semantic library V based on the field's position, identifier, or type to obtain the corresponding mapping relationship for that field;

[0057] Step 3-2: Generate the message content of the test cases according to the field order:

[0058] For each field c in the selected target string sequence t Check whether it is a fixed field based on the obtained field mapping relationship:

[0059] If it is a fixed field, the fixed value of the field is generated directly; if it is a non-fixed field, multiple candidate values ​​are selected sequentially from the matching results of semantic library V as the final output.

[0060] For example, for the Function Codes field of the S7 protocol, if it is classified as a non-fixed field, the generator will sequentially select candidate values ​​(such as 0x00, 0xF0, etc.) from the semantic library V to fill the field.

[0061] Go to the next field c t+1 Continue generating field values ​​according to step 6-2 until the field value is " <h>"Or when the maximum number of fields T is reached, when the message generation is complete, the generator will output the generated test cases with complete protocol structure to the user for subsequent testing."

[0062] Step 3-3: Calculate the uncertainty of the generated field values ​​using the information entropy measurement model to determine key locations in the protocol for mutation.

[0063] For each field, calculate the probability distribution P = (p(x1), p(x2), ..., p(x...)) for the model to generate the next field value. i ),...,p(x n )), where x i ∈V, p(x i ) indicates that the generated value is x i The probability of n is the number of candidate values ​​selected in this part of the semantic library V.

[0064]

[0065] Where, count(x) i ) is a candidate value x i The number of times it appears in the collected protocol message data;

[0066] The information entropy H(X) is calculated to quantify the uncertainty, and then normalized to map it to the interval between 0 and 1:

[0067] H(X)=E(-logp(x i ))

[0068]

[0069] The logarithm is base 2;

[0070] Steps 3-4: Select the mutation field based on the normalized information entropy value:

[0071] If the normalized information entropy H of the field norm (X) is greater than the set threshold p FUZZ If the range is 0 to 1, then mark the field as a mutation location;

[0072] Fields with high uncertainty are usually non-fixed fields. Mutating such fields can improve the acceptance rate and diversity of test cases. Areas with high information entropy are considered non-fixed areas and are suitable for mutation operations; areas with low information entropy are considered fixed areas and are not subject to mutation operations to ensure the basic correctness of test cases.

[0073] Steps 3-5: Select a mutation strategy based on the type of the field at the mutation location, apply the mutation, and generate mutated test cases:

[0074] By reverse engineering the protocol, semantic triples of fields are extracted to generate structured information templates, which include field names, data types, value ranges, and related dependencies. For example, when creating an S7comm protocol template, the Address field is defined as a numeric type (0x000000-0x0F423F), the Function field is a function code type, and it forms a dependency chain with TransportSize and Data.

[0075] When the field type at the mutation location is a numeric parameter, the mutation will be the minimum value of the interval (0x000000), the maximum value of the interval (0x0F423F), the abnormal boundary value (0xFFFFFFFF), or a randomly generated value (0x000002).

[0076] When the field type at the mutation position is ParameterLength, the difference in the number of bytes of the subsequent Data field is calculated in real time. When the difference length increases, random bytes are padded to the end of the Data field. When the difference length decreases, the data at the end of the Data field is truncated.

[0077] When the field type at the mutation location is an enumeration field, a candidate value mapping table is constructed, and a non-current value is randomly selected for replacement using the Monte Carlo algorithm, for example, replacing 0x83 with 0x84;

[0078] When the field type at the mutation location is a primary function field, the associated fields are automatically corrected and dynamically adapted. This means deleting fields unique to the original function, adding a required field for the target function and assigning a default value, and generating a data block that conforms to the type constraints to ensure the consistency of the protocol logic. For example, when the Function field changes from ReadVar (0x04) to WriteVar (0x05): a) the ReturnCode field unique to the original ReadVar is deleted; b) the TransportSize field required by WriteVar is added and assigned a default value of 0x03; c) a Data field data block conforming to the BIT type is generated.

[0079] Step 4: Use test cases to test the target system protocol.

[0080] Apply the mutated test cases to the target system, execute protocol tests, and record the test results (such as whether they are accepted or whether an exception is triggered). Analyze the acceptance rate and vulnerability detection capability of the mutated test cases to evaluate the effectiveness of the mutation strategy.

[0081] This invention's solution is based on semantic reverse analysis of proprietary protocols using a large language model. It captures communication data streams from industrial control equipment such as PLCs during operation, collects data packets of proprietary communication protocols, and performs formatted preprocessing on the data to provide structured input for subsequent semantic analysis. Furthermore, it leverages the contextual understanding and pattern recognition capabilities of the large language model to perform semantic parsing on the collected proprietary communication protocol data, inferring the function, structure, and interaction logic of protocol fields, and constructing a semantic model of the protocol. This solves the problem of lack of documentation support for proprietary protocols in traditional reverse analysis.

[0082] Subsequently, based on the protocol semantic model obtained from reverse analysis and combined with the generation capability of large language models, targeted fuzzy test cases are intelligently constructed to ensure the effectiveness of the test cases and their coverage of the PLC program's functions. The generated fuzzy test cases are then injected into the target PLC device or a simulated environment to monitor the device's operating status and response behavior, detecting any abnormal execution of external devices controlled by the PLC. The detection results are then used for risk assessment and classification, providing a basis for the security hardening of industrial control systems.

[0083] This solution also provides a protocol fuzz testing system for PLC program vulnerability analysis, including the following modules:

[0084] Preprocessing module: Used to collect protocol data and perform preprocessing;

[0085] Structured semantic output module: This module is used to input the collected protocol data into the large language model, generate structured semantic output using the large language model, and build a protocol field semantic library.

[0086] Test case generation module: used to generate variant test cases based on protocol data output by structured semantics;

[0087] Test module: Used to perform target system protocol testing using test cases.

[0088] This solution also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0089] Step 1: Collect protocol data and perform preprocessing;

[0090] Step 2: Input the collected protocol data into the large language model, use the large language model to generate structured semantic output, and build a protocol field semantic library;

[0091] Step 3: Generate variant test cases based on the protocol data output by the structured semantics;

[0092] Step 4: Use test cases to test the target system protocol.

[0093] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.< / h> < / h> < / g> < / h> < / g>

Claims

1. A protocol fuzzy testing method for vulnerability analysis of PLC programs, characterized in that, Includes the following steps: Step 1: Collect protocol data and perform preprocessing; Step 2: Input the collected protocol data into the large language model, use the large language model to generate structured semantic output, and build a protocol field semantic library; Step 3: Generate variant test cases based on the protocol data output by the structured semantics; Step 4: Use test cases to test the target system protocol.

2. The protocol fuzzy testing method for PLC program vulnerability analysis according to claim 1, characterized in that, The acquisition and preprocessing of protocol data in step 1 specifically includes: Step 1-1: Collect relevant data of the target private protocol, including protocol messages and protocol implementation code; The protocol message refers to message data captured from actual network communication, or protocol interaction records obtained through debugging tools; The protocol code refers to code segments related to protocol processing extracted from the source code or decompilation results of the target system, including message parsing, field definition, and processing logic; Step 1-2: Preprocess the collected protocol messages and codes: The protocol messages are structured to extract possible field boundaries and data features; Perform coarse-grained semantic analysis on the protocol code to identify functions, structure definitions and field descriptions related to message processing, and construct a preliminary semantic field hierarchy outline.

3. The protocol fuzzy testing method for PLC program vulnerability analysis according to claim 2, characterized in that, Step 2, which involves generating structured semantic output using a large language model, specifically includes: Step 2-1: Design prompt words to drive the large language model; Step 2-2: Input the designed prompt words into the large language model; Steps 2-3: The large language model analyzes and infers based on the input prompts, extracts field definitions, parsing logic and related semantic information from the protocol code, and infers field boundaries, data types and possible semantics from the protocol messages; By combining code and message information, a structured description of the protocol fields is generated, including the field name, location, whether it is fixed, and semantic explanation.

4. The protocol fuzzy testing method for PLC program vulnerability analysis according to claim 3, characterized in that, The prompt words used to drive the large language model in step 2-1 include: Task Description (TD) is used to specify the tasks that the LLM needs to perform; The format specification (DF) is used to define the specific requirements for the output format. Protocol code C is used to provide code snippets related to the target protocol, including message parsing logic and field definition content; Protocol message M is used to provide actual message data samples to help LLM understand the application of the protocol in reality; The interaction history (H) is used to record previous interactions, optimize task descriptions, or supplement contextual information.

5. The protocol fuzzy testing method for PLC program vulnerability analysis according to claim 3, characterized in that, The large language model in steps 2-3 analyzes and infers based on the input prompt words, specifically as follows: Step 2-3-1: The large language model analyzes and infers the protocol fields based on the prompt words, and generates structured output. The output includes the name N of each field, its position in the message P, whether it is a fixed field J, and the semantic description E of the field. Step 2-3-2: Compare the generated field descriptions with the actual protocol messages to check whether the field division is accurate. Use the generated field descriptions to construct test cases and run the test cases through the target system to verify whether they conform to the protocol logic. Step 2-3-3: If the field segmentation or semantic inference is inaccurate, supplement more protocol message samples or code snippets, update the protocol message M and protocol code C. If the output format does not meet expectations, modify the format specification DF, and record each judgment and the content of the supplement and modification, update the interaction history H for subsequent task optimization, until the generated field description meets the requirements.

6. The protocol fuzzy testing method for PLC program vulnerability analysis according to claim 3, characterized in that, The protocol field semantic library V is built based on the structured semantic output generated by the large language model. It contains the mapping relationship between protocol fields and the corresponding field semantics extracted by the large language model: {V→{(N,P,J,E)}}, where N is the field name, P is the field position, J is whether the field is fixed, and E is the field description.

7. The protocol fuzzy testing method for PLC program vulnerability analysis according to claim 6, characterized in that, In step 3, generating variant test cases based on the protocol data output by structured semantics specifically involves: Step 3-1: Select the target string sequence to be mutated: A＝(‘ <g>’,c1,c2,…,c t ,…,c T ,‘ <h> ’)< / h> < / g> Among them, c t This represents the value of the t-th message field, where T is the maximum number of fields in the message. <g>"Indicates the start character of the protocol message," <h> " indicates the end of the message;< / h> < / g> Each field in the target string sequence is matched and selected from the protocol field semantic library V based on the field's position, identifier, or type to obtain the corresponding mapping relationship for that field; Step 3-2: Generate the message content of the test cases according to the field order: For each field c in the selected target string sequence t Check whether it is a fixed field based on the obtained field mapping relationship: If it is a fixed field, the fixed value of the field is generated directly; if it is a non-fixed field, multiple candidate values ​​are selected sequentially from the matching results of semantic library V as the final output. Step 3-3: Calculate the uncertainty of the generated field values ​​using the information entropy measurement model to determine key locations in the protocol for mutation. For each field, calculate the probability distribution P = (p(x1), p(x2), ..., p(x...)) for the model to generate the next field value. i ),...,p(x n )), where x i ∈V, p(x i ) indicates that the generated value is x i The probability of n is the number of candidate values ​​selected in this part of the semantic library V. Where, count(x) i ) is a candidate value x i The number of times it appears in the collected protocol message data; The information entropy H(X) is calculated to quantify uncertainty and then normalized: H(X)=E(-logp(x i )) Steps 3-4: Select the mutation field based on the normalized information entropy value: If the normalized information entropy H of the field norm (X) is greater than the set threshold p FUZZ If so, then mark the field as the mutation location; Steps 3-5: Select a mutation strategy based on the type of the field at the mutation location marked, apply the mutation, and generate mutated test cases.

8. The protocol fuzzy testing method for PLC program vulnerability analysis according to claim 6, characterized in that, The selection of mutation strategy based on the type of the field at the mutation location in steps 3-5 is specifically as follows: When the field type of the mutation location is a numeric parameter, the mutation will be the minimum value of the interval, the maximum value of the interval, the abnormal boundary value, or a randomly generated value. When the field type at the mutation position is ParameterLength, the difference in the number of bytes of the subsequent Data field is calculated in real time. When the difference length increases, random bytes are padded to the end of the Data field. When the difference length decreases, the data at the end of the Data field is truncated. When the field type at the mutation location is an enumeration field, a candidate value mapping table is constructed, and a non-current value is randomly selected for replacement using the Monte Carlo algorithm; When the field type at the mutation location is a primary function field, the associated fields are dynamically adapted. This means deleting the original function-specific fields, adding a required field for the target function and assigning a default value, and generating a data block that conforms to the type constraints to ensure the consistency of the protocol logic.

9. A protocol fuzzy testing system for vulnerability analysis of PLC programs, characterized in that, Includes the following modules: Preprocessing module: Used to collect protocol data and perform preprocessing; Structured semantic output module: This module is used to input the collected protocol data into the large language model, generate structured semantic output using the large language model, and build a protocol field semantic library. Test case generation module: used to generate variant test cases based on protocol data output by structured semantics; Test module: Used to perform target system protocol testing using test cases.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-8.

Images