Fuzzy test method and system based on Modbus TCP protocol

Abstract

The invention relates to a fuzzy testing method and system based on a Modbus TCP protocol, and belongs to the technical field of protocol fuzzy testing. According to the method, the problems of low code coverage rate and insufficient generation diversity caused by dependence on a preset use case or random generation in the traditional fuzzy test are solved. Automatically analyzing a Modbus TCP protocol grammar rule to distinguish a static field from a dynamic field; a dynamic scheduling function is introduced to adjust a teacher mandatory proportion, a high proportion at an initial training stage guarantees compliance, and a low proportion promotes diversity at middle and later periods; a lightweight attention module is added behind the LSTM layer of the generator to focus key field variation; a diversity discriminator is designed, and a dynamic mixed reward mechanism is adopted to evaluate the case quality; and generating a test case by using the improved CTGGAN model, inputting the test case into a Modbus TCP system for testing, and monitoring a coverage rate and a collapse index for iterative optimization. According to the method, the vulnerability mining efficiency and the system security can be remarkably improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of protocol fuzzing testing, and relates to a fuzzing test method and system based on a Modbus TCP protocol. BACKGROUND

[0002] With the deep integration of industrial automation and informatization, the industrial control protocol Modbus Transmission Control Protocol has been widely used in key infrastructure fields such as intelligent manufacturing and energy management due to its cross-platform and high expansibility advantages. However, the protocol lacks built-in security mechanisms at the beginning of design, resulting in serious security challenges in actual application. The lack of data transmission reliability and potential defects in configuration and implementation may cause malicious attacks or communication failures, seriously threatening the stable operation and security protection of industrial control systems.

[0003] In this context, the Modbus Transmission Control Protocol has become the focus of industrial control system security research due to its universality of application, openness of architecture and significant security vulnerability. In-depth fuzzing test and vulnerability mining of the protocol have important practical significance. The present application takes this as the starting point and is committed to improving the security and reliability of the Modbus Transmission Control Protocol in complex industrial environments.

[0004] Fuzzing test, as an efficient automated security detection technology, has received widespread attention in recent years. In the security analysis of the industrial control protocol Modbus Transmission Control Protocol, fuzzing test can effectively discover logical defects, configuration errors and security weak links in the protocol implementation, providing key basis for system reinforcement. However, traditional fuzzing test methods have obvious limitations when applied to such typical industrial protocols. These methods rely on pre-set test cases or random generation strategies, which not only have low test efficiency, but also are difficult to cover key edge scenarios in the protocol, such as abnormal function code, address out-of-bounds and session sequence anomalies. At the same time, the mixed characteristics of static headers and dynamic data fields in the Modbus Transmission Control Protocol message structure further increase the difficulty of manually designing high-quality test cases.

[0005] To overcome the above limitations, deep learning technology is introduced into the field of fuzzing test, providing a new idea for protocol security testing. By training the model to learn the structural features and semantic constraints of the protocol message, test cases with compliance and variability can be dynamically generated, and the generation strategy can be continuously optimized according to the test feedback. This method significantly improves the efficiency of mining deep vulnerabilities of the Modbus Transmission Control Protocol and the test coverage, providing a more intelligent and efficient solution for the deep defense of industrial control systems. SUMMARY

[0006] Therefore, the present application aims to provide a Modbus TCP protocol-based fuzzing method and system.

[0007] To achieve the above-mentioned purpose, the present application provides the following technical solutions:

[0008] A Modbus TCP protocol-based fuzzing method, comprising the following steps:

[0009] Automatically parsing the syntax rules of the Modbus TCP protocol to accurately identify and distinguish static fields and dynamic fields in the protocol message;

[0010] Based on the identification result, a dynamic scheduling function alpha(t,f) is introduced to adjust the teacher forced ratio in the training process of the generative adversarial network, wherein the teacher forced ratio is increased in the early training stage and is reduced in the later training stage;

[0011] A lightweight attention module is introduced after the Long Short-Term Memory (LSTM) layer of the generator of the generative adversarial network, and a diversity discriminator is designed to evaluate the diversity of the generated test cases by using a dynamic mixed reward mechanism;

[0012] Batch test cases are generated by using the trained improved conditional table generative adversarial network (CTGGAN) model, and the test cases are input into the Modbus TCP protocol system for fuzzing test;

[0013] The code branch coverage, line coverage and unique crash number key indicators are monitored and collected in real time, and the model is iteratively optimized according to the test results.

[0014] Further, before the automatic parsing step, a data preprocessing step is further included, which comprises:

[0015] Real Modbus TCP protocol communication traffic is collected from an actual industrial Internet of Things environment, and the captured traffic is labeled;

[0016] The original data set is cleaned, including filtering based on the TCP target port number 502 and the minimum message length of 7 bytes, repairing incomplete frames, verifying whether the MBAP header protocol identifier is 0x0000, and checking the consistency of the message length field and the actual data field;

[0017] The cleaned data set is divided into a high-entropy group and a low-entropy group based on field-level entropy values;

[0018] The packet is three-dimensionally mixed and encoded, including integer encoding, floating point number normalization, one-hot encoding and illegal function code encoding;

[0019] And a protocol-compatible dynamic padding strategy is adopted, the maximum length is set according to the protocol syntax decision tree, and the MBAP header length field is corrected.

[0020] Further, the dynamic scheduling function a(t,f) is defined for static fields and dynamic fields respectively, for static fields, alpha(t,f) = 0.9e -0.1t , for dynamic fields, Where t represents the training time step, f represents the field type, the static field set is F static , and the dynamic field set is F dynamic .

[0021] Further, the diversity discriminator adopts a dynamic hybrid reward mechanism, and its reward function R is represented as R = 0.6R real +0.3(1-Self.BLEU)+0.1E f , wherein R real represents the authenticity probability of the generated case, Self.BLEU represents the similarity between the generated sample and the historical sample, E f represents the information entropy of the dynamic field, and the weights alpha = 0.6, beta = 0.3 and eta = 0.1 can be dynamically adjusted.

[0022] Further, the generator adopts an Attention-LSTM-based structure, and its generation process applies a binary mask vector of the protocol syntax rule to constrain the output probability distribution, ensuring the compliance of the generated sequence, and the mask vector is defined according to the static field and dynamic field type.

[0023] An improved CTGGAN model-based fuzzy testing system, comprising:

[0024] A test case generation part for generating ModbusTCP protocol fuzzy test cases by using the improved CTGGAN model;

[0025] A fuzzy testing execution system for executing the test cases and monitoring the response of the ModbusTCP protocol system;

[0026] And a log system for recording and analyzing test result indicators, including pass rate, unique message and coverage.

[0027] Further, the test case generation part comprises a data collection module, a data preprocessing module, a model training module and a test generation module, the data preprocessing module is used for encoding and padding Modbus TCP protocol messages, the model training module is used for training the improved CTGGAN model, and the test generation module is used for outputting test cases to the fuzzy test execution system.

[0028] Further, the fuzzy test execution system comprises a test client, a communication relay and monitoring module and a listener, the test client is used for simulating a Modbus TCP client to send test cases, the communication relay and monitoring module ensures stable connection, and the listener is used for triggering and recording abnormal behaviors in real time.

[0029] Further, the log system is used for calculating the pass rate of test cases, recording unique messages and analyzing code coverage, and providing feedback for model optimization according to the coverage.

[0030] Further, the improved CTGGAN model comprises a generator, a reality discriminator and a diversity discriminator, the generator adopts an Attention-LSTM structure, the reality discriminator is used for evaluating the reality of the test case, and the diversity discriminator is used for evaluating the diversity of the test case, and the generator is guided to optimize through a dynamic reward signal.

[0031] The beneficial effects of the present application are:

[0032] The present application can significantly improve the quality of the generated test cases by introducing protocol structure perception automatic analysis and dynamic scheduling strategy. The method makes the generator not only understand and follow the core syntax and structure specification of Modbus TCP protocol, ensures the basic compliance of the test case, but also intelligently and accurately varies the key dynamic fields, thereby effectively overcoming the problems of poor compliance and many invalid inputs caused by blind random variation in traditional methods, and laying a solid foundation for in-depth testing.

[0033] By integrating a lightweight attention mechanism and a new diversity discriminator, the present application effectively enhances the generation diversity and variation targeting of test cases. The generator can automatically focus on the dynamic fields and key areas of the protocol message and preferentially apply variation, and the dynamic hybrid reward mechanism can encourage the generator to explore a wider range of abnormal and edge scenarios from multiple dimensions. This mechanism effectively avoids the mode collapse problem that is prone to occur in traditional generative adversarial networks, and can continuously generate a large number of heterogeneous and novel test cases, greatly improving the coverage and detection depth of potential abnormal conditions.

[0034] The closed-loop intelligent test framework constructed by the application integrates the generation, execution and feedback optimization of test cases, thereby greatly improving the overall efficiency and automation degree of vulnerability mining.

[0035] Additional advantages, objects, and features of the application will be set forth in part by the description that follows, and in part will become apparent to those skilled in the art upon examination of same, or can be learned by practice of the application. The objects and other advantages of the application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to make the objects, technical solutions and advantages of the present application clearer, the preferred embodiments of the present application will be described in detail below with reference to the drawings, in which:

[0037] Figure 1 To combat network models;

[0038] Figure 2 For LSTM layer network structure;

[0039] Figure 3 For Attention-LSTM layer network structure;

[0040] Figure 4 For improved CTGGAN training process;

[0041] Figure 5 For fuzzy test framework based on improved CTGGAN model;

[0042] Figure 6 For recording and analyzing test flowchart. DETAILED DESCRIPTION

[0043] The embodiments of the present application are described below through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the disclosure. The present application can also be implemented or applied by different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the present application. It should be noted that the diagrams provided in the following examples only illustrate the basic concept of the present application in a schematic manner, and the following examples and features in the examples can be combined with each other without conflict.

[0044] Wherein, the drawing is only for example description, the representation is only schematic diagram, and cannot be understood as the limitation to the present application;In order to better illustrate the embodiment of the present application, some components in the drawing will be omitted, enlarged or reduced, and do not represent the size of actual product;For those skilled in the art, it is understandable that some well-known structures in the drawing and their description can be omitted.

[0045] The same or similar reference numerals in the drawings of the embodiments of the present application correspond to the same or similar components;In the description of the present application, it should be understood that if the orientation or position relationship indicated by the terms "upper", "lower", "left", "right", "front", "back" and the like is based on the orientation or position relationship shown in the drawing, it is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, therefore the terms describing the position relationship in the drawing are only for example description, and cannot be understood as the limitation to the present application, for those skilled in the art, the specific meaning of the above terms can be understood according to the specific situation.

[0046] The present application proposes an improved CTGGAN framework for protocol fuzz testing, which combines protocol structure perception training strategy and diversity enhancement mechanism, significantly improves diversity and code coverage under the premise of ensuring use case compliance. In order to achieve the above purpose, the present application provides the following technical scheme, the method is specifically as follows:

[0047] S1, the syntax rules of Modbus TCP protocol are automatically parsed, and the static fields and dynamic fields in the protocol message are accurately identified and distinguished. This step provides prior knowledge for subsequent targeted mutation.

[0048] S2, based on the identification result of S1, a dynamic scheduling function alpha (t, f) is introduced. The function increases the proportion of teacher forcing in the early stage of model training, uses real sample label to guide the generator to learn the basic structure of the protocol quickly, and ensures the basic compliance of the generated use case;In the later stage of training, the proportion is dynamically reduced, the space for generator to explore freely is increased, and the generator is encouraged to generate more diverse and more deviated test cases to improve coverage and vulnerability discovery ability.

[0049] S3, a lightweight attention module is introduced after the LSTM layer of the generator. The module enables the model to give higher attention weight to the key dynamic fields identified in S1, guiding the generator to preferentially and accurately mutate these key fields. At the same time, a new type of diversity discriminator is designed, which adopts a dynamic mixed reward mechanism to comprehensively evaluate the quality of the generated use case from multiple dimensions, replacing the traditional discriminator which only judges true or false. By dynamically adjusting the weight of the above reward of the discriminator, and generating a comprehensive reward signal feedback to the generator.

[0050] S4, batch generate test cases using the trained improved CTGGAN model, input into the Modbus TCP protocol system for testing. Real-time monitoring and collecting code branch coverage, line coverage and unique crash number and other key indicators, and according to the test results, the model is iteratively optimized to form a closed loop feedback.

[0051] Step one, data set preprocessing

[0052] S1, data collection and labeling

[0053] Collect real Modbus TCP protocol communication traffic from actual industrial Internet of Things environment, use a combination of public industrial datasets and self-built simulation environment to build the original dataset. Use Wireshark tool to capture network traffic, which covers standard function code operations and abnormal operations to ensure data diversity. Label the captured traffic, use automated tools to mark each byte belonging to the protocol field type, and provide a supervision signal for model training.

[0054] S2, data cleaning

[0055] The original data set is cleaned, specifically including:

[0056] 1. Based on the TCP target port number 502 and the minimum length of 7 bytes, preliminary screening is carried out to exclude ARP, TCP handshake connection and other non-Modbus TCP protocol traffic;

[0057] 2. Repair incomplete frames through length field verification, and filter duplicate messages and incomplete frames, CRC error damaged frames caused by network conflicts;

[0058] 3. Verify whether the protocol identifier of the MBAP header is 0x0000, and exclude mis-matched messages;

[0059] 4. Check the consistency of the length field declared in the message with the actual data field, truncate the message with a declared length greater than the actual data, and perform a zero-fill operation based on the function code type for the message with a declared length less than the actual data.

[0060] S3, data set division

[0061] To prevent data leakage and overfitting in model evaluation, a dynamic division method based on field-level entropy is used to divide the cleaned data set into high-entropy and low-entropy groups to optimize the training effect of the diversity discriminator; wherein:

[0062] The high-entropy group contains messages with high function code variability and / or strong data field randomness as positive samples of diversity;

[0063] The low-entropy group contains messages with single function code and / or high data field repetition, as negative samples of diversity.

[0064] S4, data encoding scheme

[0065] The messages in the divided data set are three-dimensionally mixed encoded to accurately represent the structured features of the Modbus TCP protocol. The encoding scheme includes:

[0066] The original message bytes are integer-encoded from 0 to 255 to retain physical layer information.

[0067] The function code, starting address, register quantity, and other fields of Modbus / TCP are converted into integers or normalized floating-point numbers, respectively.

[0068] A one-hot encoding vector is introduced to mark the protocol role of each byte, and protocol syntax knowledge is explicitly constructed.

[0069] Illegal function codes are uniformly encoded as a specific value of 255, which is semantically isolated from standard function codes.

[0070] S5, dynamic padding strategy

[0071] A protocol-compatible dynamic padding strategy is adopted according to the characteristics of Modbus TCP variable-length messages, which includes:

[0072] 1. According to the protocol RFC document, a syntax decision tree is constructed to automatically identify fixed format fields, variable content fields, and separator fields.

[0073] 2. Set the maximum length (e.g. 260 bytes), strictly protect the integrity of the MBAP header structure during padding, and only perform zero padding on the tail of the data field, and simultaneously update the length field in the message.

[0074] 3. Generate an attention mask to mask the padding position, ensuring that the model only processes valid data fields.

[0075] Given a message sequence x = (x0,...,x n-1 ), the target length L, the padding process is:

[0076]

[0077] Where the dynamic field padding function is:

[0078]

[0079] V valid is the set of legal values for the field (e.g. function code takes {1, 2, 3, 4, 5, 6});

[0080] The MBAP header length field needs to be corrected after padding:

[0081] Length'=min(||x'||-6,65535) Bytes (3)

[0082] where ||x|| is the total length after padding, and -6 means deducting the MBAP header.

[0083] The core purpose is to ensure that the generator can only generate fields that are syntactically valid and compliant in the current context at each step, thereby improving the pass rate of generated test cases. This can be reflected in the following formula:

[0084] Generate attention mask M∈{0,1} L×L :

[0085]

[0086] where m is a mask matrix with dimensions LxL. M ij represents the element in the i-th row and j-th column of the mask matrix.

[0087] Step two: model construction

[0088] An improved CTGGAN model is constructed, which consists of a generator and two discriminators (authenticity discriminator and diversity discriminator). The adversarial network model is shown in Figure 1 .

[0089] This module has the following steps:

[0090] S1, the generator G α uses an Attention-LSTM-based deep neural network structure. The generator outputs each time step symbol in a step-by-step generation manner, ensuring the time sequence of the generated sequence. It introduces a lightweight attention mechanism module after the LSTM layer, enabling the model to automatically focus on the key fields in the Modbus TCP protocol message and prioritize precise variation of these fields, thereby significantly improving the protocol consistency and training stability of the generated sequence.

[0091] S2, the authenticity discriminator D λ is used to evaluate the overall authenticity of the generated sequence, i.e., whether it conforms to the structure and distribution of the real Modbus TCP protocol message.

[0092] S3, the diversity discriminator D γThe diversity of the generated sequence is evaluated, which adopts a dynamic hybrid reward mechanism, comprehensively evaluates multi-dimensional indicators such as field variation degree and semantic effectiveness, dynamically adjusts the weights of each dimension alpha, beta and eta, and generates a reward signal to guide the generator to explore a more diverse variation space.

[0093] The specific operation steps are as follows:

[0094] Construction of Attention-LSTM generation model based on protocol structure perception

[0095] The input data is real Modbus TCP protocol sample data, which is first input to the embedding layer to map discrete characters to continuous low-dimensional vector space. Specifically, the embedding layer converts discrete symbols into continuous variables.

[0096] The continuous vector processed by the embedding layer is passed as input to the LSTM layer for learning of time sequence features. The LSTM layer can capture the time sequence dependency relationship between the request and response messages in the Modbus TCP protocol message, thereby effectively processing and generating control commands or data frames corresponding to the protocol. This process can accurately combine the discrete symbols of the protocol and map them to a low-dimensional continuous space through the embedding layer, and further learn the time sequence features using LSTM, as shown in Figure 2 .

[0097] The LSTM unit internally introduces a gate mechanism to protect and control information, including a forget gate, an input gate and an output gate. Among them, the input gate is used to control the amount of information updated by the memory unit; the forget gate is used to control the amount of information retained by the memory unit at the previous moment; the output gate is used to control the amount of information output to the next hidden state; and the Cell realizes information storage and deletion by controlling different gates:

[0098] f t =σ(W f *[h t-1 ,X t ]+b f ) (5)

[0099] i t =σ(W i *[h t-1 ,X t ]+b i ) (6)

[0100] o t =σ(W o *[h t-1 ,X t ]+b o ) (7)

[0101] where f t , i t , o t represent the forget, input, and output gates, respectively, obtained by linear transformation and nonlinear activation of the hidden state h t-1 from the previous time step and the input x t from the current time step. * represents element-wise multiplication, and σ represents the sigmoid activation function, which limits the output between 0 and 1. W f , W i , W o represent weight matrices, and b f , b i , b o represent biases.

[0102] The corresponding gates are multiplied element-wise with the previous cell state C t-1 and the current new cell state C t to preserve historical information and filter current information. In LSTM, the cell state update is defined in the following formula, decomposed into historical information preservation and input information selection.

[0103]

[0104] h t = o t *tanh(C t ) (10)

[0105] The formula expresses the cell state controlled by the output gate, which determines how much information in the current time cell state C t should be output.

[0106] After the LSTM network, a fully connected layer (Dense layer) and a sigmoid activation function are usually connected to output the conversion to a probability distribution

[0107] The output vector of the LSTM layer is taken as the input of the Attention layer. Here, the multiplication attention mechanism is used, which consists of three steps:

[0108] Calculate the weight by taking the dot product of the query and each key.

[0109] Normalize the weight using the Softmax function.

[0110] Weighted sum of the weight and the corresponding value to obtain Attention.

[0111] In summary, the calculation formula of the Attention layer output is as follows:

[0112]

[0113] Where Q is the query vector sequence, k is the key vector sequence, V is the value vector sequence, dk is the dimension of Q, K, V vector.

[0114]

[0115] Firstly, according to the field structure analysis of the message data, the field type is divided into (static / dynamic), different attention weights are given to different field types,

[0116] Dynamic teacher forced scheduling

[0117] In order to further optimize the generator training process and balance the syntax compliance and variation diversity of test cases, the application proposes a dynamic teacher forced scheduling strategy based on protocol field type:

[0118] For dynamic and static fields, the application designs an independent teacher forced proportion scheduling function alpha (t, f) which changes with time step t, as shown in formula (13):

[0119]

[0120] This formula defines how much probability alpha (t, f) should be used to adopt the forced strategy for field f at the tth time step of training.

[0121] For static fields, the initial value is set to 0.9, wherein e -0.1t is an exponential decay function; for dynamic fields, the baseline is set to 0.2, wherein is a sine wave with an amplitude of 0.1.

[0122] Construct a discriminator model based on double-channel diversity evaluation

[0123] The double discriminator proposed in the application undertakes three major functions: first, it judges whether the sample comes from the real data distribution; then it quantifies the novelty and diversity of the generated sample, and finally it fuses the above evaluation results into a comprehensive reward signal to guide the evolution direction of the generator. Formula (14) reflects the field entropy evaluation:

[0124] E f = -∑ v∈V(f) p(v)logp(v),f∈F dynamic (14)

[0125] Where E fEntropy of field f, v(f) represents the set of all possible values of field f, p(v) is the probability of field f taking value v in the current batch of generated samples.

[0126] In addition, a dynamic hybrid reward mechanism is set up, which combines the authenticity, global diversity and field variability three indicators by weighted fusion, to provide accurate composite optimization target for the generator. The weighted comprehensive reward function is shown in formula (15):

[0127]

[0128] Where R real represents the probability that the sample comes from the real data from the discriminator. Self.BLEU represents the evaluation of diversity by calculating the similarity between the generated sample and the previously generated sample. E f represents the field variability of the field entropy mentioned above. Where 0.6, 0.3, 0.1 are the initial weights of the three items, as shown in formula (16). Figure 3

[0129] Step three: model training

[0130] The application proposes a test case generation method based on a double discriminator generative adversarial network. The generator learns the protocol syntax under the guidance of a dynamic teacher strategy, and distinguishes the static and dynamic field weights. During the training process, the authenticity discriminator and the diversity discriminator respectively evaluate the compliance and variability of the generated test cases, and the outputs of the two are fused into a comprehensive signal by a dynamic reward function and fed back to the generator. The reward weight can be dynamically adjusted: in the early stage of training, the authenticity is emphasized to stabilize the generation, and in the later stage, the diversity is biased to promote exploration, so that the generator is continuously optimized, and finally a high-quality test case that meets the protocol specification and has high diversity is output. The training process is shown in formula (17). Figure 4 .

[0131] The model training process specifically includes the following steps:

[0132] S1, generator initialization: a sequence generator Ga based on LSTM-Attention structure is constructed, which is used to generate test cases according to the input initial sample.

[0133] S2, double discriminator design:

[0134] Pass rate discriminator D γ : a discriminator based on neural network is constructed, which quantifies the authenticity of the generated test case relative to ModbusTCP distribution, and the evaluation content includes the compliance of protocol syntax, field value domain, logical constraints and check code, etc. The discriminator output represents the confidence of the test case passing the protocol verification, and the effective training is realized based on the differentiable ModbusTCP protocol rule checking function.

[0135] ​

[0136] v i is the actual value of the i-th field.1 i and u i are the legal value domain boundaries of the field, and β is the smoothing coefficient. The soft constraint check of the field value domain is realized by the differentiable sigmoid threshold function, and the output value represents the Modbus TCP compliance probability.

[0137] Diversity discriminator D λ : A neural network-based diversity discriminator is constructed to evaluate the similarity between the generated test case and the historical case library, and output the novelty degree of the test case. The discriminator aims to maximize the variation dimension and coverage of the generated test case, and prevent pattern collapse.

[0138] S3, the generator generates test cases:

[0139] Generator G a , the preprocessed protocol sequence s and the random noise vector z are taken as input, the internal multi-layer long short-term memory network (LSTM) is used to learn the context-dependent relationship of the Modbus TCP protocol, and the lightweight attention mechanism is integrated to enhance the representation of key protocol fields. The model generates candidate test cases in an autoregressive manner The mathematical expression is:

[0140]

[0141] where θ g is the trainable parameter of the generator. In the generation process at each time step t, a binary mask vector m t∈ {0, 1} V is applied based on the protocol syntax rules, and the probability distribution p t of the output is constrained:

[0142] p' t = softmax(p t + log(m t )) (19)

[0143] From the root, the structural compliance and effectiveness of the generated Modbus TCP protocol test cases are guaranteed.

[0144] S4, the discriminator evaluates the generated test cases:

[0145] Generator G a produces test cases. Two discriminators are used to evaluate them:

[0146] The pass rate discriminator D γ outputs a score sγ :

[0147]

[0148] Diversity discriminator D λ Outputs a score s λ :

[0149]

[0150] S5, Gradient update of the generator:

[0151] Generator G a aims to maximize a composite reward R composed of the dual discriminator scores:

[0152] R = a · s γ + b · s λ (22)

[0153] where a, b, h are dynamically adjusted weights to balance compliance and diversity.

[0154] The generator updates its parameters q by a policy gradient method g :

[0155]

[0156] This step encourages the generator to produce test cases that can achieve higher rewards (i.e. higher s γ and s λ ).

[0157] S6, Gradient update of the discriminators:

[0158] The two discriminators are updated independently by reducing the prediction error;

[0159] The update goal of the pass rate discriminator D γ is to minimize its loss function

[0160]

[0161] Parameter update formula:

[0162]

[0163] The update goal of the diversity discriminator D λ is to minimize its loss function

[0164]

[0165] Parameter update formula:

[0166]

[0167] where x represents real samples, x hist represents historical generated samples, represents current generated samples.

[0168] Step four: fuzzy testing framework based on improved CTGGAN model

[0169] The overall framework is divided into three main parts: test case generation part, fuzzy testing execution system and log system. The overall fuzzy testing framework is as shown in Figure 5 .

[0170] S1, test case generation part

[0171] The core of the test case generation part is to generate effective fuzzy test cases based on the improved CTGGAN model. This part is responsible for generating test cases for Modbus TCP protocol fuzzy testing, which includes the following steps:

[0172] 1. Data collection: Collect real protocol messages from the actual Modbus TCP communication environment, and use the existing message library to ensure that the data is real and diverse.

[0173] 2. Data preprocessing: Encode and fill the original data to enhance the model's ability to capture the context relationship of the protocol.

[0174] 3. Model training: Use the improved CTGGAN framework, combined with protocol structure perception and diversity enhancement mechanism for training, so that the generator fully understands the Modbus TCP protocol structure and produces diverse cases.

[0175] 4. Test generation: Use the trained model to generate fuzzy test cases that meet the Modbus TCP protocol specifications and output them to the test execution system for security verification.

[0176] S2, fuzzy testing execution system

[0177] This part is responsible for executing the generated Modbus TCP test cases and performing actual fuzzy testing, which includes the following components:

[0178] 1. Test client: Build a Modbus TCP client to simulate real devices to send test cases and receive responses.

[0179] 2. Communication relay and monitoring: Ensure stable connection between the client and the server and agent, and ensure efficient transmission of test cases and feedback.

[0180] 3. Listener: Real-time trigger and record any abnormal behavior such as service crash, protocol violation, no response timeout and memory leak signs by analyzing response message, return code and system status.

[0181] S3. Log system

[0182] The system is responsible for recording and analyzing test results, mainly including the following indicators:

[0183] 1. Pass rate: Calculate the pass rate of the sent ModbusTCP test cases by analyzing the return code feedback of the agent, and evaluate the effectiveness of the fuzz testing.

[0184] 2. Unique message: Record the unique message feedback by the agent, which is used to evaluate the diversity of the test cases.

[0185] 3. Coverage rate: Analyze the code coverage to provide basis for subsequent test optimization, as shown in the following table. Figure 6

[0186] Finally, it should be pointed out that the above embodiments are only used to illustrate the technical solutions of the present application and are not limiting. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all should be covered in the scope of the claims of the present application.​

Claims

1. A fuzz testing method based on the Modbus TCP protocol, characterized in that: Includes the following steps: Automated parsing of the Modbus TCP protocol syntax rules to accurately identify and distinguish static and dynamic fields in protocol messages; Based on the identification results, a dynamic scheduling function α(t,f) is introduced to adjust the teacher-forced ratio during the training process of the generative adversarial network, wherein the teacher-forced ratio is increased in the early stage of training and decreased in the middle and late stages of training. A lightweight attention module is introduced after the Long Short-Term Memory (LSTM) layer of the generator in the generative adversarial network, and a diversity discriminator is designed to evaluate the diversity of generated use cases using a dynamic hybrid reward mechanism. Test cases are generated in batches using a trained improved condition table generative adversarial network (CTGGAN) model, and the test cases are then input into a Modbus TCP protocol system for fuzz testing. Real-time monitoring and collection of key metrics such as code branch coverage, line coverage, and number of unique crashes, and iterative optimization of the model based on test results.

2. The fuzzing method based on the Modbus TCP protocol according to claim 1, characterized in that: Prior to the automated parsing step, a data preprocessing step is also included, which includes: Collect real Modbus TCP protocol communication traffic from actual industrial IoT environments and label the captured traffic; The original dataset is cleaned, including filtering based on the TCP destination port number 502 and the minimum packet length of 7 bytes, repairing incomplete frames, verifying whether the MBAP header protocol identifier is 0x0000, and verifying the consistency between the packet length field and the actual data field. The cleaned dataset is divided into high-entropy and low-entropy groups based on field-level entropy values. The message is encoded using a three-dimensional hybrid encoding method, including integer encoding, floating-point normalization, one-hot encoding, and illegal function code encoding. It also employs a protocol-compatible dynamic padding strategy, setting the maximum length based on the protocol syntax decision tree and correcting the MBAP header length field.

3. The fuzzing method based on the Modbus TCP protocol according to claim 1, characterized in that: The dynamic scheduling function a(t,f) is defined for both static and dynamic fields. For static fields, α(t,f) = 0.9·e -0.1t For dynamic fields, Where t represents the training time step, f represents the field type, and the static field set is F. static The dynamic field set is F dynamic .

4. The fuzzing method based on the Modbus TCP protocol according to claim 1, characterized in that: The diversity discriminator employs a dynamic hybrid reward mechanism, and its reward function R is expressed as R = 0.6R. real +0.3(1-Self.BLEU)+0.1E f , where R real E represents the probability of the generated use case being realistic, Self.BLEU represents the similarity between the generated sample and historical samples, and E represents the similarity between the generated sample and historical samples. f The information entropy of the dynamic field is represented by weights α = 0.6, β = 0.3, and η = 0.1, which can be dynamically adjusted.

5. The fuzzing method based on the Modbus TCP protocol according to claim 1, characterized in that: The generator adopts an Attention-LSTM-based structure. During its generation process, a binary mask vector based on protocol syntax rules is used to constrain the output probability distribution, ensuring the compliance of the generated sequence. The mask vector is defined according to the static and dynamic field types.

6. A fuzz testing system based on an improved CTGGAN model, characterized in that: include: The test case generation section is used to generate fuzzy test cases for the ModbusTCP protocol using the improved CTGGAN model. A fuzz test execution system is used to execute the test cases and monitor the response of the ModbusTCP protocol system; And a logging system for recording and analyzing test result metrics, including pass rate, uniqueness messages, and coverage.

7. The fuzz testing system based on the improved CTGGAN model according to claim 6, characterized in that: The test case generation section includes a data collection module, a data preprocessing module, a model training module, and a test generation module. The data preprocessing module is used to encode and fill Modbus TCP protocol messages. The model training module is used to train an improved CTGGAN model. The test generation module is used to output test cases to the fuzz test execution system.

8. The fuzz testing system based on the improved CTGGAN model according to claim 6, characterized in that: The fuzz test execution system includes a test client, a communication relay and monitoring module, and a listener. The test client is used to simulate a Modbus TCP client to send test cases. The communication relay and monitoring module ensures stable connection. The listener is used to trigger and record abnormal behavior in real time.

9. The fuzz testing system based on the improved CTGGAN model according to claim 6, characterized in that: The logging system is used to calculate the pass rate of test cases, record unique messages, and analyze code coverage, and provides feedback for model optimization based on the coverage.

10. The fuzz testing system based on the improved CTGGAN model according to claim 6, characterized in that: The improved CTGGAN model includes a generator, a authenticity discriminator, and a diversity discriminator. The generator adopts an Attention-LSTM structure, the authenticity discriminator is used to evaluate the authenticity of the use cases, the diversity discriminator is used to evaluate the diversity of the use cases, and the generator is guided to optimize through dynamic reward signals.

Images