Fuzzy test method for variation protocol based on feature perception

Abstract

The invention discloses a feature-aware variation protocol fuzz testing method, which relates to the field of network protocol testing and comprises the following steps: acquiring a protocol message sequence of a protocol to be tested as an initial seed; extracting a structural feature, a behavior feature and a core field type of a to-be-tested protocol to form a protocol feature description; classifying mutation operators in the protocol fuzzy test tool to form a mutation operator category set; protocol fuzz test initialization is completed; and generating a variation message sequence, sending the variation message sequence to the server, collecting and updating server information, and returning to continue execution if the preset protocol fuzzy test duration is not reached. According to the method, the protocol features are automatically obtained by using the large language model, and the mutation operator configuration adaptive to the protocol features is selected to carry out the mutation fuzzy test on the protocol, so that the action time of a low-efficiency mutation operator is shortened, and the protocol fuzzy test efficiency and the defect discovery capability are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network protocol testing, in particular to the field of network protocol fuzz testing, and specifically to a feature-aware mutation protocol fuzz testing method. BACKGROUND

[0002] As the basis of network communication, network protocols are responsible for transmitting data and controlling network traffic. To ensure the safe and effective transmission of data, it is particularly important to conduct security testing on protocols. Mutation-based protocol fuzz testing is currently the mainstream method of automated protocol testing. However, existing protocol fuzz testing tools use a set of mutation operators that are essentially inherited directly from general-purpose fuzz testing tools, and do not select a combination of mutation operators that are suitable for the structure and behavior characteristics of the protocol under test. This results in a large number of mutation operators that are ineffective for the protocol under test, occupying a limited amount of testing time, and significantly limiting the overall testing efficiency and defect discovery capability.

[0003] Therefore, it is particularly important to extract the structural and behavioral characteristics of the protocol under test for protocol fuzz testing. The specification document of the protocol clearly describes these two characteristics of the protocol under test in natural language. However, due to the large size of the protocol specification, manual reading and understanding requires a significant amount of time and cost. In recent years, large language models have shown significant advantages in natural language understanding, and can identify relevant characteristics of the protocol under test, such as message field types and state dependencies, from these natural language descriptions of the protocol specification. Based on this, a combination of mutation operators that are more suitable for the protocol can be determined, improving the overall efficiency of protocol testing. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a feature-aware mutation protocol fuzz testing method that can extend the effective time of mutation operators and improve the relevance of mutation operations compared to traditional protocol mutation fuzz testing methods that rely on fixed operator configurations or empirical selection.

[0005] To achieve the above-mentioned purpose, the present application provides the following technical solutions:

[0006] A feature-aware mutation protocol fuzz testing method, comprising the following steps:

[0007] Step 1: Obtain a set of protocol message sequences of the protocol under test as an initial seed set;

[0008] Step 2: Apply a large language model to extract the structural and behavioral characteristics of the protocol under test and the core field types based on the protocol specification as input, forming a protocol feature description;

[0009] Step three, the mutation operators of the protocol fuzzing tool are classified, the mutation operators with fixed length as the object are divided into the fixed-length granularity mutation operator class; the mutation operators with continuous byte segments of uncertain length as the object are divided into the variable-length granularity mutation operator class; the mutation operators with complete protocol messages or segments based on message boundaries as the object are divided into the message-level mutation operator class;

[0010] Step four, according to the structural features, behavior features and core field types of the protocol, a group of mutation operators corresponding to the protocol features are selected;

[0011] Step five, the initial message sequence set of the protocol to be tested is sent to the protocol server to be tested, and the code coverage and protocol state transition information of the server are recorded to complete the protocol fuzzing initialization;

[0012] Step six, according to the code coverage and protocol state transition information fed back by the server, a message sequence to be mutated is selected from the message sequence set, and a mutation message sequence is generated by applying the group of mutation operators selected in step four to the message sequence;

[0013] Step seven, the mutation message sequence obtained in step six is sent to the protocol server to be tested, and the code coverage information and state transition information of the server are collected and updated; if the preset protocol fuzzing time is not reached, return to step six and continue to execute.

[0014] Further, the step two includes:

[0015] 2a, the structural features of the protocol, by a large language model combined with the protocol specification, determine whether the structural features of the protocol to be tested are text type, binary type or mixed type;

[0016] 2b, the behavior features of the protocol, by a large language model combined with the protocol specification, determine whether the behavior features of the protocol to be tested belong to state-related or state-independent;

[0017] 2c, when the structural features of the protocol are mixed type, by a large language model combined with the protocol specification, determine the type of the core field of the protocol to be tested.

[0018] Further, the step of determining the structural features of the protocol to be tested includes the following steps:

[0019] 2a1, when all message fields of the protocol are text, output the structural features as text type;

[0020] 2a2, when all message fields of the protocol are numerical values, bitmaps or binary data, output the structural features as binary type;

[0021] 2a3, when the message fields of the protocol have both text fields and numerical or binary fields, output the structural features as mixed type.

[0022] The process of determining the behavioral characteristics of the protocol under test includes the following steps:

[0023] 2b1 sets the protocol's behavioral characteristics to be state-independent;

[0024] 2b2, If the keywords "session", "state machine" or "session lifecycle" exist in the protocol specification directory, then modify the behavioral characteristics of the protocol under test to be state-dependent, and step 2b ends;

[0025] 2b3, If the protocol message field contains a session identifier related field, then modify the behavior characteristics of the protocol under test to be state-related, and step 2b ends;

[0026] 2b4. If the protocol specification defines a state phase with explicit multi-step dependencies in the protocol interaction process, then modify the behavior characteristics of the protocol under test to be state-dependent.

[0027] Determining the type of the core fields of the protocol under test includes the following steps:

[0028] 2c1, extract the request command fields supported by the protocol under test, and determine whether the request command field type is text or binary;

[0029] 2c2, extract the request command operation object field of the protocol under test, and determine whether the request command operation object field type is text or binary;

[0030] 2c3, If the behavior characteristics of the protocol under test are state-related, then set the core field type of the protocol under test to the type of the protocol request command field; if the behavior characteristics of the protocol under test are state-independent, then set the core field type of the protocol under test to the type of the protocol request command operation object field.

[0031] Furthermore, step four specifically includes:

[0032] 4a. When the structural feature of the protocol to be tested is text-based, the variable-length granularity mutation operator class is used as a mutation operator group, and the process jumps to step 4d.

[0033] 4b. When the protocol structure feature is binary, the fixed-length granularity mutation operator class is taken as the mutation operator group, and the process jumps to step 4d.

[0034] 4c. When the protocol structure feature is a hybrid type, the core field type of the protocol is used for judgment: if the core field type is text, the variable-length granularity mutation operator class is used as the mutation operator group; if the core field type is binary, the fixed-length granularity mutation operator class is used as the mutation operator group, and the process jumps to step 4d.

[0035] 4d. When the protocol behavior characteristics are state-dependent, enable the message-level mutation operator class; when the protocol behavior characteristics are state-independent, stop enabling the message-level mutation operator class.

[0036] As can be seen from the above technical solution, compared with the prior art, the present invention provides a feature-aware fuzzing method for mutated protocols. Addressing the shortcomings of traditional protocol fuzzing, which typically employs fixed mutation operator configurations and struggles to fully leverage the effectiveness of mutation operators, the present invention combines the structural and behavioral characteristics of the protocol under test to selectively select and apply mutation operators, extending the effective mutation operator's duration and improving the targeting and effectiveness of mutation operations. This significantly enhances the efficiency and defect detection capability of protocol fuzzing. Attached Figure Description

[0037] Figure 1 This is a flowchart of the method of the present invention;

[0038] Figure 2 Flowchart of a method for extracting protocol features from large models;

[0039] Figure 3 A screenshot of the JSON object containing the IPP protocol feature results extracted from the large model. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] This invention provides a feature-aware mutation protocol fuzz testing method, comprising the following steps:

[0042] A feature-aware mutation protocol fuzz testing method includes the following steps:

[0043] Step 1: Obtain the set of protocol message sequences of the protocol to be tested, as the initial seed set;

[0044] Step Two: Using the protocol specification as input, apply a large language model to extract the structural features, behavioral features, and core field types of the protocol under test, forming a protocol feature description, specifically including:

[0045] 2a. The structural characteristics of the protocol are determined by combining the large language model with the protocol specification to determine whether the structural characteristics of the protocol under test are text-based, binary-based, or hybrid-based.

[0046] 2b, The behavioral characteristics of the protocol are determined by combining the large language model with the protocol specification to determine whether the behavioral characteristics of the protocol under test are state-dependent or state-independent;

[0047] 2c. When the structural characteristics of the protocol are hybrid, the type of the core field of the protocol under test is determined by combining the large language model with the protocol specification.

[0048] Furthermore, the determination of the structural features of the protocol under test includes:

[0049] 2a1: When all message fields in the protocol are text, the output structure is text-based;

[0050] 2a2: When all message fields in the protocol are numeric, bitmap, or binary data, the output structure is binary.

[0051] 2a3: When the message fields of the protocol contain both text fields and numerical or binary fields, the output structure characteristic is mixed.

[0052] The determination of the behavioral characteristics of the protocol under test includes:

[0053] 2b1: Set the protocol's behavioral characteristics to be state-independent;

[0054] 2b2: If the keywords "session", "state machine" or "session lifecycle" exist in the protocol specification directory, modify the behavioral characteristics of the protocol under test to be state-dependent, and step 2b ends;

[0055] 2b3: If the protocol message fields contain session identifier related fields, then modify the behavior characteristics of the protocol under test to be state-related, and step 2b ends;

[0056] 2b4: If the protocol specification defines a state phase with explicit multi-step dependencies in the protocol interaction process, then modify the behavior characteristics of the protocol under test to be state-dependent.

[0057] The determination of the type of the core fields of the protocol under test includes:

[0058] 2c1: Extract the request command fields supported by the protocol under test, and determine whether the request command field type is text or binary;

[0059] 2c2: Extract the request command operation object field of the protocol under test, and determine whether the request command operation object field type is text or binary;

[0060] 2c3: If the behavior of the protocol under test is state-dependent, then set the core field type of the protocol under test to the type of the protocol request command field; if the behavior of the protocol under test is state-independent, then set the core field type of the protocol under test to the type of the protocol request command operation object field.

[0061] Step 3: Classify the mutation operators of the protocol fuzzing tool. Mutation operators that act on fixed-length segments are classified into fixed-length granularity mutation operators; mutation operators that act on continuous byte segments of uncertain length are classified into variable-length granularity mutation operators; and mutation operators that act on complete protocol messages or segments divided based on message boundaries are classified into message-level mutation operators.

[0062] Step 4: Based on the protocol's structural characteristics, behavioral characteristics, and core field types, select the mutation operator group corresponding to the protocol's characteristics; specifically including:

[0063] 4a: When the structural feature of the protocol under test is text-based, the variable-length granularity mutation operator class is used as the mutation operator group, and the process jumps to step 4d;

[0064] 4b: When the protocol structure feature is binary, the fixed-length granularity mutation operator class is taken as the mutation operator group, and the process jumps to step 4d;

[0065] 4c: When the protocol structure feature is a hybrid type, the core field type of the protocol is used for judgment: if the core field type is text, the variable-length granularity mutation operator class is used as the mutation operator group; if the core field type is binary, the fixed-length granularity mutation operator class is used as the mutation operator group, and the process jumps to step 4d.

[0066] 4d: When the protocol behavior characteristics are state-dependent, enable the message-level mutation operator class; when the protocol behavior characteristics are state-independent, stop enabling the message-level mutation operator class.

[0067] Step 5: Send the initial message sequence set of the protocol under test to the protocol server, record the server's code coverage and protocol state transition information, and complete the protocol fuzz test initialization;

[0068] Step Six: Based on the code coverage and protocol state transition information fed back by the server, select the message sequence to be mutated from the message sequence set, and apply the mutation operator group selected in Step Four to the message sequence to generate a mutated message sequence;

[0069] Step 7: Send the mutation message sequence obtained in Step 6 to the protocol server under test, collect and update the server's code coverage information and state transition information; if the preset protocol fuzzing time has not been reached, return to Step 6 to continue execution.

[0070] Example

[0071] This embodiment discloses the application of a feature-aware mutation protocol fuzzing method in fuzzing tools for the IPP (Internet Printing Protocol) and AFLNet protocols. For example... Figure 1 As shown, the application process of this method on the IPP protocol includes seven steps: obtaining the message sequence set of the protocol to be tested (step 1), extracting protocol features (step 2), classifying mutation operators using the AFLNet protocol fuzzing tool (step 3), selecting the appropriate mutation operator group configuration according to the protocol characteristics (step 4), and testing the IPP protocol using the AFLNet protocol fuzzing tool with the selected mutation operator group configuration (steps 5-7).

[0072] 1) The AFLNet tool already provides a set of message sequences for testing the IPP protocol, so it can be directly used as the initial seed set for protocol fuzzing.

[0073] 2) Figure 2 The flowchart of the method for automatically extracting IPP protocol features using a large language model in this embodiment is shown.

[0074] The user first provides the IPP protocol specification document and selects a pre-constructed protocol feature analysis prompt template, issuing a command to the large language model to perform feature analysis on the IPP protocol. The large language model parses the IPP protocol specification and automatically extracts three types of protocol features relevant to this invention:

[0075] Structural characteristics: Based on the definition of message format in the IPP protocol specification, the large language model identifies that IPP messages contain both text fields (such as certain string attributes and name fields) and numerical or binary fields such as length fields and encoding identifiers. Therefore, the structural characteristics of IPP are determined to be "hybrid".

[0076] Behavioral characteristics: The large language model analysis of the interaction process of print job creation, query, cancellation, etc. in the IPP protocol specification reveals that different messages are associated through fields such as job identifier. The protocol interaction has obvious multi-step dependencies and state evolution process. Therefore, the behavioral characteristics of IPP are judged as "state-related".

[0077] Core Field Type: The large language model extracts the request command field, which represents the type of request operation, and the object of the request operation, from the IPP protocol specification, and determines that the request command field of this protocol uses binary encoding to represent the request of this protocol. Since IPP is determined to be a state-related protocol, this embodiment takes the "request command field" as the core field of the protocol, and accordingly determines the core field type of IPP to be "binary".

[0078] Finally, this step outputs: a description of the protocol characteristics of the IPP protocol (e.g., Figure 3 As shown in the figure, this includes structural features: hybrid; behavioral features: state-dependent; and core field type: binary. This feature description will serve as input for subsequent mutation operator group configuration.

[0079] 3) Next, the mutation operators in AFLNet need to be classified according to the method provided in step 3.

[0080] Table 1 shows the functions of all mutation operators in AFLNet, summarized after reviewing the publicly available source code, and named M1 to M20.

[0081] Table 1

[0082]

[0083] Subsequently, based on the functions of each mutation operator listed in Table 1, they were classified according to the method in step three, resulting in the classification results shown in Table 2:

[0084] Table 2

[0085]

[0086] 4) Combining Figure 3 The IPP protocol features shown are used to select the corresponding set of mutation operators. Figure 3 The document illustrates the characteristics of IPP, which is a hybrid protocol in structure, with core fields in binary encoding and state-dependent behavior. Therefore, based on step four, the mutation operator configuration for the IPP protocol can be determined as the fixed-length mutation operator set and message-level mutation operator set shown in Table 2.

[0087] 5) Based on the mutation operator configuration obtained above, AFLNet was used to conduct 5 rounds of 24-hour protocol fuzzing tests on IPP. The final result was the average edge coverage values ​​of the 5 rounds of protocol fuzzing tests, and the number of protocol application crashes was counted after 5 rounds of testing. The results of 5 rounds of testing of the IPP protocol using AFLNet with the selected mutation operator configuration were as follows: an average of 3183 edge coverages were obtained, and a total of 2 program defects were found.

[0088] Finally, it should be noted that the above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A feature-aware mutation protocol fuzzy testing method, characterized in that, Includes the following steps: Step 1: Obtain the set of protocol message sequences of the protocol to be tested, as the initial seed set; Step 2: Using the protocol specification as input, apply a large language model to extract the structural features, behavioral features, and core field types of the protocol under test, forming a protocol feature description; Step 3: Classify the mutation operators of the protocol fuzzing tool. Mutation operators that act on fixed-length segments are classified into fixed-length granularity mutation operators; mutation operators that act on continuous byte segments of uncertain length are classified into variable-length granularity mutation operators; and mutation operators that act on complete protocol messages or segments divided based on message boundaries are classified into message-level mutation operators. Step 4: Select the mutation operator group corresponding to the protocol characteristics based on the protocol's structural features, behavioral features, and core field types; Step 5: Send the initial message sequence set of the protocol under test to the protocol server, record the server's code coverage and protocol state transition information, and complete the protocol fuzz test initialization. Step 6: Based on the code overwrite and protocol state transition information fed back by the server, select the message sequence to be mutated from the message sequence set, and apply the mutation operator group selected in Step 4 to the message sequence to generate a mutated message sequence. Step 7: Send the mutation message sequence obtained in Step 6 to the protocol server under test, and collect and update the server's code coverage information and state transition information; If the preset protocol fuzz test duration is not reached, return to step six to continue execution.

2. The feature-aware mutation protocol fuzzy testing method according to claim 1, characterized in that, Step two includes: 2a. The structural characteristics of the protocol are determined by combining the large language model with the protocol specification to determine whether the structural characteristics of the protocol under test are text-based, binary-based, or hybrid-based. 2b, The behavioral characteristics of the protocol are determined by combining the large language model with the protocol specification to determine whether the behavioral characteristics of the protocol under test are state-dependent or state-independent; 2c. When the structural characteristics of the protocol are hybrid, the type of the core field of the protocol under test is determined by combining the large language model with the protocol specification.

3. The feature-aware mutation protocol fuzzy testing method according to claim 2, characterized in that, The process of determining the structural characteristics of the protocol under test includes the following steps: 2a1, When all message fields in the protocol are text, the output structure is text-based; 2a2, When all message fields of the protocol are numerical, bitmap, or binary data, the output structure characteristic is binary; 2a3, When the message fields of the protocol contain both text fields and numerical or binary fields, the output structure characteristic is mixed.

4. The feature-aware mutation protocol fuzzy testing method according to claim 2, characterized in that, The process of determining the behavioral characteristics of the protocol under test includes the following steps: 2b1 sets the protocol's behavioral characteristics to be state-independent; 2b2, If the keywords "session", "state machine" or "session lifecycle" exist in the protocol specification directory, then modify the behavioral characteristics of the protocol under test to be state-dependent, and step 2b ends; 2b3, If the protocol message field contains a session identifier related field, then modify the behavior characteristics of the protocol under test to be state-related, and step 2b ends; 2b4. If the protocol specification defines a state phase with explicit multi-step dependencies in the protocol interaction process, then modify the behavior characteristics of the protocol under test to be state-dependent.

5. The feature-aware mutation protocol fuzzy testing method according to claim 2, characterized in that, Determining the type of the core fields of the protocol under test includes the following steps: 2c1, extract the request command fields supported by the protocol under test, and determine whether the request command field type is text or binary; 2c2, extract the request command operation object field of the protocol under test, and determine whether the request command operation object field type is text or binary; 2c3, If the behavior characteristics of the protocol under test are state-related, then set the core field type of the protocol under test to the type of the protocol request command field; if the behavior characteristics of the protocol under test are state-independent, then set the core field type of the protocol under test to the type of the protocol request command operation object field.

6. The method according to claim 1, characterized in that, Step four specifically includes: 4a. When the structural feature of the protocol to be tested is text-based, the variable-length granularity mutation operator class is used as a mutation operator group, and the process jumps to step 4d. 4b. When the protocol structure feature is binary, the fixed-length granularity mutation operator class is taken as the mutation operator group, and the process jumps to step 4d. 4c. When the protocol structure feature is a hybrid type, the core field type of the protocol is used for judgment: if the core field type is text, the variable-length granularity mutation operator class is used as the mutation operator group; if the core field type is binary, the fixed-length granularity mutation operator class is used as the mutation operator group, and the process jumps to step 4d. 4d. When the protocol behavior characteristics are state-dependent, enable the message-level mutation operator class; when the protocol behavior characteristics are state-independent, stop enabling the message-level mutation operator class.

Images