Instant messaging private protocol vulnerability mining method and system

Abstract

The invention relates to the field of data processing, and discloses an instant messaging private protocol vulnerability mining method and system. The method comprises the following steps: collecting multi-mode communication data and carrying out fusion reverse analysis to obtain a fusion reverse output result comprising a protocol syntax tree, a protocol state machine model and protocol state information; constructing a triple response test to obtain response data; and obtaining the vulnerability of the instant messaging private protocol by analyzing the response data and fusing the reverse output result. According to the method, an instant messaging private encryption protocol can be accurately and reversely deduced by using a fusion reverse analysis mechanism of multi-mode communication data, a protocol state machine model of the instant messaging protocol is constructed, and a reverse output result and response data are compared and fused through a tentative protocol packet response mechanism, so that the instant messaging private encryption protocol can be accurately and reversely deduced. The vulnerability of the instant messaging protocol can be accurately mined, and a new thought is provided for instant messaging private protocol analysis.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically, to a method and system for vulnerability mining of private instant messaging protocols based on protocol reverse engineering and state awareness. Background Technology

[0002] Instant messaging (IM) refers to a communication technology that enables real-time (or near real-time) two-way interaction between users via the internet or dedicated networks and specific protocols. Its core characteristics include low-latency transmission (millisecond-level response), online status awareness (such as user login / offline status), session persistence (supporting multi-turn interactions), and multimodal data transmission (text, images, voice, video, files, etc.). Mainstream IM software includes WeChat, QQ, WhatsApp, Telegram, and Signal. IM relies on standardized or proprietary protocols (such as XMPP, MQTT, and Signal Protocol) for message encapsulation, routing, encryption, and session management, while combining server relay or end-to-end direct connections to achieve efficient communication. IM proprietary protocols refer to non-public standard communication protocols developed by various IM applications (such as WeChat, QQ, and Skype) to meet their own business needs. These protocols typically include proprietary data formats, encryption methods, and authentication mechanisms, aiming to improve transmission efficiency and ensure communication security.

[0003] Regarding the analysis of private protocols in instant messaging, existing technologies offer several approaches. For example, some analyze WeChat's behavioral characteristics at the traffic level, further analyzing traffic consumption in each scenario, such as login, logout, and message interaction, to establish a traffic resource consumption model. Others utilize reverse engineering and debugging techniques to analyze the WeChat 4.5 login authentication protocol and session communication protocol. Still others analyze WeChat's private protocols, detailing encryption algorithms and key derivation principles, and decrypting and restoring the WeChat database. A Skype-relay traffic identification and detection framework accurately identifies Skype traffic by setting measurement levels and thresholds. A behavioral feature-based identification method has shown good recognition rates. However, the features used in behavioral feature-based identification methods lack robustness and uniqueness, making it difficult to guarantee false positive and false negative rates. Another approach uses heartbeat packet features to identify instant messaging applications, but the similarity of heartbeat packets among instant messaging applications results in a low success rate in practice.

[0004] Current methods for analyzing proprietary instant messaging protocols face the following main challenges: (1) Current instant messaging usually uses complex private protocols. Private protocols may use adaptive byte length, and the protocol parsing function is often confused, making it difficult for simple static analysis to accurately extract the key information of the protocol. (2) Instant messaging software uses encrypted communication protocols to protect user privacy data. The encryption of communication content, dynamic generation of keys and encryption of response data increase the difficulty of protocol analysis for instant messaging. (3) Instant messaging private protocols are complex, state-dependent, and “black box”, and traditional formal analysis of protocols cannot accurately analyze the vulnerabilities of instant messaging protocols. Summary of the Invention

[0005] This invention addresses the problem that existing instant messaging protocol analysis methods cannot accurately analyze the vulnerabilities of private instant messaging encryption protocols. It provides a method and system for vulnerability mining of private instant messaging protocols based on protocol reverse engineering and state awareness, which analyzes and mines the vulnerabilities of private instant messaging protocols.

[0006] On one hand, this invention discloses a method for mining vulnerabilities in private instant messaging protocols, comprising the following steps: Collect multimodal communication data in instant messaging scenarios and preprocess the multimodal communication data; The preprocessed multimodal communication data is used to perform fusion reverse analysis to obtain fusion reverse output results; the fusion reverse output results include protocol syntax tree, protocol state machine model and protocol state information; Simultaneously, a triple response test was constructed to obtain the corresponding response data, and the response data was used to compare and analyze with the fused reverse output results to obtain the vulnerability of the instant messaging private protocol.

[0007] On the other hand, the present invention also provides a vulnerability mining system for instant messaging private protocols, comprising the following modules: The data preprocessing module is used to collect multimodal communication data in instant messaging scenarios and preprocess the multimodal communication data. The fusion reverse analysis module is used to perform fusion reverse analysis on preprocessed multimodal communication data to obtain fusion reverse output results, which include protocol syntax trees, protocol state machine models and protocol state information. The response testing module is used to build triple response tests and obtain the corresponding response data; The comparative analysis module is used to compare and analyze the response data with the fused reverse output results to obtain the vulnerability of the instant messaging private protocol.

[0008] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are as follows: 1. The vulnerability mining scheme for instant messaging private protocols proposed in this invention uses a multimodal communication data combined with a fusion reverse analysis mechanism. It uses a correlation analysis method of instant messaging user operation timing, traffic data, binary code and local data to accurately analyze instant messaging private encryption protocols.

[0009] 2. The vulnerability mining scheme for instant messaging private protocols proposed in this invention can accurately construct the state machine model of instant messaging protocols by sending triple response test data packets, comparing response status and response data, and dynamically adjusting the protocol state machine model.

[0010] 3. The vulnerability mining scheme for instant messaging private protocols proposed in this invention automatically traverses the protocol state machine path using a depth-first traversal method, and combines it with a state context awareness method to mine the vulnerabilities of instant messaging protocols, providing a new approach for the analysis of instant messaging private protocols. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating the vulnerability mining method for private instant messaging protocols provided by the present invention.

[0012] Figure 2 This is a schematic diagram of the instant messaging traffic acquisition process provided by the present invention.

[0013] Figure 3 This is a schematic diagram illustrating the construction process of the protocol state machine model provided by this invention.

[0014] Figure 4 This is a schematic diagram of the comparative analysis process of the vulnerability of instant messaging protocols provided by the present invention. Detailed Implementation

[0015] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Based on the embodiments in this application, other similar embodiments obtained by those skilled in the art without creative effort should all fall within the scope of protection of this application.

[0016] Example 1 This invention provides a method for vulnerability mining of private instant messaging protocols based on protocol reverse engineering and state awareness. This method involves reverse engineering the instant messaging software and constructing a protocol state machine model using traffic data. An active state machine learning algorithm is used to progressively infer the protocol's temporal logic and state transition rules, resulting in a protocol state machine model containing initial, intermediate, and final states, as well as transition conditions. Through deep traversal of the protocol state machine, anomaly injection tests are constructed. By analyzing and comparing response data and response states, the vulnerabilities of the private instant messaging protocol are ultimately determined.

[0017] like Figure 1 As shown, the method includes: Step S01: Collect multimodal communication data in the instant messaging scenario and preprocess the multimodal communication data.

[0018] In a preferred embodiment, the multimodal communication data includes at least traffic data and instant messaging software. The specific steps for preprocessing the multimodal communication data are as follows.

[0019] S101 First, traffic data is captured, and the captured traffic data is cleaned and organized to obtain preprocessed dynamic traffic data.

[0020] In a preferred embodiment, in real-time communication scenarios where instant messaging software is used for account login, message sending and receiving, group creation, and file transfer, a traffic capture tool is used to capture the traffic data of the instant messaging software, such as... Figure 2 As shown in the diagram, the packet capture host connects to the mobile device via USB / WIFI and uses a traffic packet capture tool to obtain the mobile device's real-time communication traffic through traffic mirroring and forwarding.

[0021] The traffic capture tools include tcpdump, wireshark, and RawCAp.

[0022] Next, the captured traffic data undergoes preprocessing such as traffic cleaning to obtain preprocessed dynamic traffic data. This dynamic flow data includes complete communication context, traffic packets associated with relevant business scenarios (user operations), and structured test cases.

[0023] In a preferred embodiment, non-protocol traffic such as advertisements and updates is first filtered out using port or domain name filtering. Then, the complete communication context and independent message data packets are reconstructed based on the TCP four-tuple (source IP, source port, destination IP, destination port). Synchronization is performed according to the timestamp of the user action (clicking the send button, message recall) and the traffic packets reconstructed in the previous step to establish an "action-traffic packet" mapping relationship, obtaining traffic packets related to the business scenario (user action). Finally, traffic is segmented by session ID, time, and action type to generate structured test cases.

[0024] S102, perform disassembly analysis on the instant messaging software to obtain the corresponding disassembly data.

[0025] Specifically, the instant messaging software is disassembled, and the required disassembled data is identified through the disassembled code. This disassembled data includes, but is not limited to, string constants in the program (such as CMD_LOGIN, cipher, error codes), function parameter characteristics, and cryptographic algorithm identifiers (such as hard-coded keys, S-boxes), which can be used as "semantic tags" for protocol fields. The disassembled data also includes key functions of the protocol located through static analysis: such as network communication modules (send() / recv() call chains), protocol parsers (such as parsePacket()), and state management modules (session state machine, authentication state machine), etc.

[0026] Step S02: Perform fusion reverse analysis on the preprocessed multimodal communication data to obtain the fusion reverse output result.

[0027] The fusion reverse output includes a protocol syntax tree, a protocol state machine model, and protocol state information. Specifically, the fusion reverse analysis of multimodal communication data includes at least: performing reverse semantic inference on protocol fields based on the multimodal communication data to obtain static analysis results and dynamic verification results; generating a protocol syntax tree by combining the static analysis results and dynamic verification results; combining the protocol syntax tree with an active state machine learning machine to perform logical rule inference and parameter adjustment to construct a protocol state machine model; and performing a depth-first traversal of the protocol state machine model to obtain protocol state information.

[0028] Before constructing the protocol state machine model, the corresponding protocol syntax tree must first be generated, such as... Figure 3 As shown.

[0029] S201, perform reverse semantic inference on the protocol fields, and combine the obtained static analysis results with the dynamic verification results to generate a protocol syntax tree.

[0030] First, static analysis is performed on the disassembled data obtained in step S102 to obtain the static analysis results. Then, the dynamic traffic data obtained in step S101 is compared with the static analysis results to verify the consistency of protocol field types, lengths, etc., and abnormal protocol fields are marked for further analysis.

[0031] The static analysis results include extracting field-related information from the protocol parsing function to locate the offset, data type (e.g., integer, string, bitmask), and length of the protocol fields. Simultaneously, the possible semantics of the protocol fields are preliminarily inferred through code comments or constant definitions (e.g., CMD_LOGIN = 0x01). Abnormal fields include those with mismatched lengths or conflicting type values.

[0032] Secondly, by constructing regular probing data packets to actively trigger specific regular operations, the regular probing data packets are sent to the instant messaging server for first response testing, and the differences in the instant messaging server's response are observed to obtain first response data for first response data analysis.

[0033] The first response data analysis specifically involves logically cross-comparing the first response data with the static analysis results, gradually verifying and improving the semantics of the protocol fields, and obtaining dynamic verification results.

[0034] The first response data includes echo field values, error messages, etc. The semantics of the protocol fields include, for example, CMD_LOGIN, USERNAME, CHECKSUM, etc.

[0035] In a preferred embodiment, the first response data analysis further includes extracting explicit constraints (such as field length limits) and implicit dependencies of the fields. For example, if the value of the CMD field is modified to 0x06 (outside the range of 0x01-0x05 defined by static analysis), and the system returns error code 0x01, the value range constraint of the CMD field can be confirmed; if the increment rule of the SEQ_NUM field is modified and the system refuses to process it, its semantics are further verified as a sequence number field.

[0036] Finally, by combining the static analysis results and the dynamic verification results, a protocol syntax tree is generated, in which the protocol syntax tree clearly defines the type, length, value range and dependencies of each protocol field.

[0037] For example, the field CMD is defined as an enumeration type, the field SEQ_NUM is an incrementing uint32 type, and the field PAYLOAD must have a length between 0 and 1024 bytes. Simultaneously, a field dependency graph is constructed (e.g., CMD_LOGIN depends on the existence of the USERNAME and PASSWORD fields), and a constraint rule base for protocol behavior is formed, such as returning a specific error code when field validation fails. This process ensures accurate inference of field semantics and provides an interpretable syntactic foundation for the subsequent construction of the state machine model.

[0038] Step S202: Combine the protocol syntax tree with the active state machine learning algorithm to perform logical rule inference and parameter adjustment, and obtain the constructed protocol state machine model.

[0039] Specifically, an active learning state machine inference algorithm is used to infer logic and rules based on the protocol syntax tree, generating a protocol state machine model. During the construction of the protocol state machine model, the active learning state machine algorithm gradually infers the protocol's temporal logic and state transition rules by combining labeled protocol interaction data packets with dynamic tentative interactions.

[0040] First, the algorithm uses labeled protocol interaction data packets (such as HTTP request-response sequences and custom protocol field combinations) as initial training samples. Combined with the generated protocol syntax tree, it generates a preliminary framework for the protocol state machine model by parsing the field types, lengths, and dependencies.

[0041] Subsequently, a boundary probing packet is constructed based on the protocol syntax tree. This boundary probing packet is sent to the instant messaging server, and the server's second response data is captured. By comparing the first and second response data, the parameters of the protocol state machine model are dynamically adjusted.

[0042] The boundary probing data packet is a protocol packet containing a specific combination of fields, outliers, or boundary conditions. Outliers or boundary conditions include, for example, modifying field order, inserting redundant fields, or triggering error codes.

[0043] The parameters of the dynamically adjusted protocol model include: merging similar states, for example, merging two similar states when the response pattern similarity to the same input is ≥95%; assigning field weights, with key fields such as CMD having a higher weight than the checksum field; and mining the statistical probability of state transitions, such as the confidence calculation of S1→S2.

[0044] Finally, a protocol state machine model is output, including initial state, intermediate state, termination state, and transition conditions. Its accuracy and robustness are verified through confusion matrix and fuzz testing to ensure the model can accurately identify legitimate protocol behavior and detect abnormal state transitions. Abnormal state transitions include operations such as unauthorized field modification or skipping critical steps.

[0045] Step S203: Perform a depth-first traversal of the protocol state machine model to obtain the protocol state information, such as... Figure 4 As shown.

[0046] The depth-first traversal algorithm is used to perform a depth-first traversal (DFS) on the protocol state machine model generated in the previous step, thereby optimizing the traversal path. Specifically, firstly, the risk level of each protocol interaction path is marked according to the protocol state machine model obtained in the previous step.

[0047] Paths involving sensitive operations are marked as high-risk paths, paths involving data reading and state updates are marked as medium-risk paths, and paths involving only heartbeats, no-state operations, etc., without state changes are marked as low-risk paths.

[0048] The sensitive operations include authentication, key negotiation, permission changes, and data deletion. The status updates include message sending and friend adding.

[0049] Next, dynamic pruning and loop detection were applied to adjust all paths.

[0050] Specifically, during the traversal, if the response pattern of a certain path has converged (e.g., three consecutive heartbeat packets trigger the same response), the path is determined to be a low-risk path and pruned; if the response patterns of two paths are highly similar, the two paths are merged into a single path and pruned; if the path is determined to be a redundant path, it is pruned.

[0051] For example, if the response patterns of the two paths, CMD_SEND_MSG followed by CMD_ACK and CMD_SEND_MSG followed by CMD_NACK, are ≥95% similar, then the two paths are considered highly similar.

[0052] Simultaneously, a state fingerprint needs to be generated for each path to identify its cyclic state. The state fingerprint consists of protocol field values ​​(msg_id, group_id) and context variables (session key hash, MD5 value of the member list). During depth-first traversal, if the current state fingerprint duplicates a state fingerprint in the historical records, the path is determined to be a cyclic path. Furthermore, if the cyclic path is a valid path, traversal is allowed, but the recursion depth is limited; if the cyclic state of the path is invalid, the path is pruned.

[0053] Then, a priority queue is used to dynamically adjust the traversal order, prioritizing the exploration of high-risk paths involving sensitive operations, ensuring that high-risk paths are covered first, and improving vulnerability detection efficiency.

[0054] After the depth-optimized traversal is completed, the protocol status information of all paths is obtained, and the protocol status information corresponding to each path is stored.

[0055] In a preferred embodiment, the protocol state information includes protocol field values ​​(such as real-time values ​​of fields like msg_id, group_id, timestamp, etc.), state-dependent variables (such as context data like session keys, group member lists, user permission levels, etc.), timestamps, and sequence numbers (used to trace back vulnerabilities in time dependencies).

[0056] In another preferred embodiment, the protocol status information can be stored using a lightweight database to store snapshots, and each protocol status information snapshot is bound to a unique identifier, supporting queries by path, field, and other dimensions.

[0057] Step S03: Compare and analyze the third response data with the fused reverse output results, and perform vulnerability mining and analysis of the private communication protocol based on state awareness.

[0058] The third response data was obtained by performing anomaly injection testing using a mutation test data package, as detailed below.

[0059] First, field constraints and context data are extracted from the protocol syntax tree and protocol state information to generate mutation test cases (such as state transitions, rollbacks, tampering, and concurrency conflicts). The field constraints refer to the range of values ​​a field can take. The context data refers to the permissions, ID values, etc., corresponding to the fields.

[0060] Next, a mutation test data package is constructed based on different mutation test cases. The mutation test data package includes at least state transition test, state rollback test, state variable tampering test and concurrent conflict test.

[0061] The state transition test involves constructing a request with an incomplete preceding state, such as sending a message without logging in; the state rollback test involves constructing a rollback request, such as rolling back to the key negotiation state after sending a message; the state variable tampering test involves modifying key state variables, such as msg_id being a historical value; and the concurrency conflict test involves injecting mutual exclusion operation requests into multiple threads, such as simultaneously sending "add friend" and "delete friend".

[0062] The constructed mutation test data packet is then sent to the instant messaging server, and the corresponding third-party response data from the server is captured.

[0063] Finally, the third response data is compared with the field constraints of the protocol status information and the context data to determine whether a vulnerability exists and to classify the vulnerability.

[0064] Determining whether a vulnerability exists and classifying vulnerabilities includes: If a sensitive operation (such as sending a message without being logged in) is performed without prior confirmation, it is considered a privilege escalation vulnerability. If the rollback request does not properly clean up the context (e.g., the key is not cleared), it is identified as a state dependency vulnerability. If tampering with state variables leads to protocol logic errors (such as unvalidated incrementing of msg_id), it is identified as a context consistency vulnerability. If concurrent operations lead to data inconsistency (such as a conflict in the friend list), it is identified as a race condition vulnerability.

[0065] This embodiment constructs a protocol state machine model of the instant messaging protocol through a multimodal communication data fusion reverse analysis mechanism and a tentative protocol packet response mechanism, thereby accurately uncovering the vulnerabilities of the instant messaging protocol.

[0066] Example 2 This embodiment is a vulnerability mining system for instant messaging private protocols. The system is used to implement any of the aforementioned vulnerability mining methods for instant messaging private protocols. The system includes the following modules: The data preprocessing module is used to collect multimodal communication data in instant messaging scenarios and preprocess the multimodal communication data. The fusion reverse analysis module is used to perform fusion reverse analysis on preprocessed multimodal communication data to obtain fusion reverse output results, which include protocol syntax trees, protocol state machine models and protocol state information. The response testing module is used to build triple response tests and obtain the corresponding response data; The comparative analysis module is used to compare and analyze the response data with the fused reverse output results to obtain the vulnerability of the instant messaging private protocol.

[0067] Example 3 This embodiment provides a non-transitory computer-readable storage medium storing computer instructions that cause a computer to implement the instant messaging private protocol vulnerability mining method described in any of the foregoing embodiments.

[0068] Example 4 This embodiment provides a computer program product, which includes a computer program that, when executed by a processor, is used for the instant messaging private protocol vulnerability mining method described in any of the foregoing embodiments.

[0069] The present invention has been described in detail above with reference to the accompanying drawings. However, it should be noted that the examples described above are merely preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of the claims of the present invention.

[0070] All features disclosed in this specification, or steps in all disclosed methods or processes, may be combined in any way, except for mutually exclusive features and / or steps. This invention is not limited to the specific embodiments described above. This invention extends to any new feature or any new combination disclosed in this specification, as well as any new step or any new combination of any disclosed method or process.

Claims

1. A method for vulnerability mining of instant messaging private protocols, characterized in that, Includes the following steps: Collect multimodal communication data in instant messaging scenarios and preprocess the multimodal communication data; The preprocessed multimodal communication data is used to perform fusion reverse analysis to obtain the fusion reverse output results; The fusion reverse output includes a protocol syntax tree, a protocol state machine model, and protocol state information; Simultaneously, a triple response test was constructed to obtain the corresponding response data, and the response data was used to compare and analyze with the fused reverse output results to obtain the vulnerability of the instant messaging private protocol.

2. The method for vulnerability mining of instant messaging private protocols as described in claim 1, characterized in that, Collect multimodal communication data in instant messaging scenarios and preprocess the multimodal communication data. include, Collect traffic data in instant messaging scenarios, clean and organize the traffic data to obtain dynamic traffic data; Disassemble and analyze instant messaging software to obtain disassembled data.

3. The method for vulnerability mining of instant messaging private protocols as described in claim 2, characterized in that, Based on the preprocessed multimodal communication data, reverse semantic inference is performed on the protocol fields to obtain static analysis results and dynamic verification results. The protocol syntax tree is generated by combining the static analysis results and dynamic verification results. By combining the protocol syntax tree with an active state machine learning machine for logical rule inference and parameter adjustment, a protocol state machine model is constructed. A depth-first traversal of the protocol state machine model is performed to obtain the protocol state information.

4. The method for vulnerability mining of instant messaging private protocols as described in claim 3, characterized in that, Perform static analysis on the disassembled data to obtain the static analysis results; By comparing dynamic traffic data with static analysis results, the consistency of protocol fields is verified, and a preliminary protocol syntax tree is obtained. Construct a regular probing data packet, send the regular probing data packet to the instant messaging server to perform a first response test, observe the differences in the instant messaging server's response, and obtain the first response data; The first response data is logically cross-compared with the static analysis results to gradually verify and improve the semantics of the protocol fields and obtain dynamic verification results. By combining the results of static analysis and dynamic verification, a protocol syntax tree is generated.

5. The method for vulnerability mining of instant messaging private protocols as described in claim 4, characterized in that, The protocol syntax tree clearly defines the type, length, value range, and dependencies of each protocol field.

6. The method for vulnerability mining of instant messaging private protocols as described in claim 4, characterized in that, Using labeled protocol interaction data packets as initial training samples, and combining them with the protocol syntax tree, a preliminary framework for the protocol state machine model is generated by parsing field types, lengths, and dependencies. A boundary probing data packet is constructed based on the protocol syntax tree. The boundary probing data packet is sent to the instant messaging server for a second response test. The difference in the instant messaging server's response is observed to obtain the second response data. By comparing the first response data with the second response data, the parameters of the protocol state machine model are dynamically adjusted to infer the protocol's temporal logic and state transition rules. The output is a protocol state machine model that includes the initial state, intermediate states, termination state, and transition conditions.

7. The method for vulnerability mining of instant messaging private protocols as described in claim 5, characterized in that, A depth-first traversal of the protocol state machine model is performed to obtain protocol state information, including: Each protocol interaction path is labeled according to its risk level, which includes high risk, medium risk, and low risk. Dynamically prune and adjust all paths. If the current path is a low-risk path or a redundant path, then prune that path. Perform loop checks on all paths. If the current path is a loop path and it is a valid loop path, traversal of the loop path is allowed, but the recursion depth is limited. If the loop path is an invalid path, the path is pruned. Use a priority queue to dynamically adjust the traversal order of paths, prioritizing the traversal of high-risk paths; After the depth-optimized traversal is completed, the protocol status information of all paths is obtained.

8. The method for vulnerability mining of instant messaging private protocols as described in claim 3, characterized in that, Extract field constraints and context data from the protocol syntax tree and protocol state information to generate mutation test cases; Based on different mutation test cases, construct mutation test data packets, send mutation test data packets to the instant messaging server for third-party response testing, observe the differences in the instant messaging server's response, and obtain third-party response data. The third-party response data is compared with the protocol status information to determine whether a vulnerability exists and to classify the vulnerability.

9. The method for vulnerability mining of instant messaging private protocols as described in claim 8, characterized in that, Determine if vulnerabilities exist and classify them, including: If a sensitive operation is executed without prior setup, it is considered a privilege escalation vulnerability. If the rollback request does not properly clean up the context, it is identified as a state dependency vulnerability; If tampering with state variables leads to a protocol logic error, it is identified as a context consistency vulnerability. If concurrent operations lead to data inconsistency, it is identified as a race condition vulnerability.

10. A vulnerability mining system for instant messaging proprietary protocols, characterized in that, The system is used to implement the vulnerability mining method for instant messaging private protocols according to any one of claims 1-9, and includes the following modules: The data preprocessing module is used to collect multimodal communication data in instant messaging scenarios and preprocess the multimodal communication data. The fusion reverse analysis module is used to perform fusion reverse analysis on preprocessed multimodal communication data to obtain fusion reverse output results, which include protocol syntax trees, protocol state machine models and protocol state information. The response testing module is used to build triple response tests and obtain the corresponding response data; The comparative analysis module is used to compare and analyze the response data with the fused reverse output results to obtain the vulnerability of the instant messaging private protocol.

Images