Security verification method and device for stateful message variation of core network protocol

Abstract

The invention provides a stateful message variation security verification method and device for a core network protocol, and the method comprises the steps: obtaining a current protocol state tree, and enabling each node in the protocol state tree to correspond to a core network protocol state, the connected edge between the two nodes indicates that the protocol state corresponding to the node can trigger state transition through a protocol message corresponding to the edge; performing node search based on the score values of the nodes in the protocol state tree, and selecting a target node; selecting a target message from a message corpus of a target state corresponding to the target node; and performing variation on the target message to obtain a variation message, sending the variation message to the core network for security testing, and updating the protocol state tree based on the state change condition of the core network and a variation message execution result. According to the method and the device, the state with higher test value can be selected in various protocol states of the core network based on the comprehensive score of the test value, efficient and targeted message variation and test are carried out, and the security verification efficiency of the core network is improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and apparatus for security verification of stateful message mutations in core network protocols. Background Technology

[0002] The core network, as the hub connecting terminal devices and data networks, is crucial in mobile and satellite communications networks. While the software-defined and distributed architecture of the core network enhances network flexibility, it also expands the attack surface and introduces new security challenges. With massive terminal access, service and signaling traffic converges heavily in the core network, putting pressure on system stability and elastic scheduling. The core network control plane communicates through a single, service-based interface bus on a shared service interaction platform. This means that attackers can launch lateral movement attacks by targeting individual network elements or vulnerabilities, ultimately compromising the entire core network. Furthermore, due to the highly complex and time-dependent nature of core network protocol state interactions, ambiguities and unclear points in protocol specifications lead to security flaws in different protocol implementations, potentially causing serious security consequences such as authentication bypass and denial-of-service attacks. Such attacks can cause system process execution blockages, even leading to the failure of critical network elements and core network paralysis, severely impacting overall availability and user experience. Therefore, conducting security verification of core network protocols and ensuring the correctness of their interface protocols has become one of the key challenges in core network security research.

[0003] Protocol fuzzing, which generates and modifies packets to send a large number of legitimate and illegitimate protocol messages to core network elements to discover protocol defects and security vulnerabilities, has become a major technical approach for core network security verification. However, most fuzzing tools generate and modify packets based on rules or traffic without fully considering protocol state, making it impossible to perform efficient security verification targeting the more valuable protocol state, resulting in low efficiency for core network security verification. Summary of the Invention

[0004] This application provides a method and apparatus for security verification of stateful message mutations in core network protocols, which addresses the shortcomings of low efficiency in core network security verification in the prior art and improves the efficiency of core network security verification.

[0005] This application provides a method for security verification of stateful message mutations in core network protocols, including: Obtain the current protocol state tree. Each node in the protocol state tree corresponds to a core network protocol state. The edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state corresponding to the node can be triggered by the protocol message corresponding to the edge to initiate a state transition. Node search is performed based on the rating values ​​of nodes in the protocol state tree, and a target node is selected. The rating value is determined based on the node's depth in the protocol state tree, the node's historical search history, historical selection history, and the state change of the protocol state tree after the node is selected. Select the target message from the message corpus corresponding to the target state of the target node; The target message is mutated to obtain a mutated message, which is then sent to the core network for security testing. The protocol state tree is updated based on the state changes of the core network and the execution result of the mutated message.

[0006] According to the stateful message mutation security verification method for core network protocols provided in this application, the score value of the state node is determined based on the following formula: ; ; in, The rating value is... This represents the number of times the node has been visited. This represents the number of times a node has been selected. This represents the number of times the parent node of the node has been selected. The depth of the node in the protocol state tree. For bias weights, It's a reward parameter. For non-negative hyperparameters, To reflect whether the protocol state tree has generated new node parameters after a node is selected as the target node for testing, To reflect whether the protocol state tree has generated new edge parameters after a node is selected as the target node for testing, This parameter reflects whether an error occurs after the node is selected as the target node for testing. This reflects the proportion of new field entries generated in the mutation message after a node is selected as the target node, relative to the total number of mutation field entries.

[0007] According to the stateful message collaborative mutation security verification method for core network protocols provided in this application, the step of updating the protocol state tree based on the state changes of the core network and the execution result of the mutation message includes: Based on the state changes of the core network, determine whether to generate a new node or a new edge in the protocol state tree; The score value of the target node is updated based on whether a new node or edge is generated in the protocol state tree and the result of the mutation message execution.

[0008] According to the security verification method for stateful message mutation of core network protocols provided in this application, before sending the mutated message to the core network for security testing, the method includes: Based on the current state of the core network, the protocol state tree, and the target node, at least one candidate message sequence path is determined, and the message sequence path includes at least one edge in the protocol state tree; Based on the length, number of executions, and success rate of the candidate message sequence path, a target message sequence path is determined, which is used to restore the state of the core network to the target state.

[0009] According to the stateful message mutation security verification method for core network protocols provided in this application, the step of selecting the target message from the message corpus corresponding to the target state of the target node includes: The target message is determined based on the number of mutations and the message length of each message in the message corpus.

[0010] According to the security verification method for stateful message mutation of core network protocols provided in this application, the step of mutating the target message to obtain a mutated message and sending the mutated message to the core network for security testing includes: Through each user terminal, the mutation message corresponding to each user terminal is sent to the core network in parallel. The mutation message corresponding to each user terminal is generated based on the following steps: Based on a preset mutation strategy lookup table, the mutation decision for each field in the target message is determined sequentially, and the mutated message is generated based on the mutation decision. Specifically, when the mutation decision of the field is the first mutation decision, the field value of the field is obtained from the local sequence-level field pool corresponding to the user terminal; when the mutation decision of the field is the second mutation decision, the field is mutated. After obtaining the mutation messages corresponding to multiple user terminals, the process includes: Based on the mutation message corresponding to the user terminal, the newly added or updated mutation fields are written into the local sequence-level field pool corresponding to the user terminal and a synchronization mark is added. Add the fields that need to be synchronized from the local sequence-level field pool to the global sequence-level field pool.

[0011] This application also provides a security verification device for stateful message mutations in core network protocols, comprising: The protocol state tree acquisition module is used to acquire the current protocol state tree. Each node in the protocol state tree corresponds to a core network protocol state, and the edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state corresponding to the node can be triggered by the protocol message corresponding to the edge to initiate a state transition. The tree search module is used to search for nodes based on the rating values ​​of nodes in the protocol state tree and select target nodes. The rating values ​​are determined based on the depth of the node in the protocol state tree, the node's historical search history, its historical selection history, and the state changes of the protocol state tree after it is selected. The message selection module is used to select a target message from the message corpus corresponding to the target state of the target node; The mutation testing module is used to mutate the target message to obtain a mutated message, send the mutated message to the core network for security testing, and update the protocol state tree based on the state changes of the core network.

[0012] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the stateful message mutation security verification method for core network protocols as described above.

[0013] This application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the stateful message mutation security verification method for core network protocols as described above.

[0014] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the stateful message mutation security verification method for core network protocols as described above.

[0015] The method and apparatus for security verification of stateful message mutation in core network protocols provided in this application construct a protocol state tree that reflects various possible protocol states of the core network and the transitions between these states. Nodes in this protocol state tree correspond to a protocol state, and edges between nodes correspond to protocol messages. A connection between two nodes indicates that the protocol state of the node can be triggered by the protocol message corresponding to that edge, leading to a state transition. A score is maintained for each node in the protocol state tree, determined based on the node's depth in the tree, its historical search and selection history, and the state changes in the protocol state tree after selection. Therefore, this scoring system reflects the test value of the node's corresponding state. Based on the node's score, a target node is selected, and a target message is chosen from the message corpus corresponding to the target node's state. The target message is mutated, and the mutated message is sent to the core network for security testing. The protocol state tree is then updated based on the state changes in the core network and the execution result of the mutated message after the test. This allows for the selection of states with higher test value from various protocol states in the core network based on a comprehensive test value score, enabling efficient and targeted message mutation and testing, thus improving the efficiency of core network security verification. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the stateful message mutation security verification method for core network protocols provided in this application.

[0018] Figure 2 This is a schematic diagram of the entire security verification process in the stateful message mutation security verification method for core network protocols provided in this application.

[0019] Figure 3 This is a flowchart illustrating the message cooperative mutation process in the stateful message mutation security verification method for core network protocols provided in this application.

[0020] Figure 4 This is a schematic diagram of the state scheduling process of the protocol state tree in the stateful message mutation security verification method for core network protocols provided in this application.

[0021] Figure 5 This is an example diagram of the field pool synchronization process in the stateful message mutation security verification method for core network protocols provided in this application.

[0022] Figure 6 This is a schematic diagram of the structure of the stateful message mutation security verification device for core network protocols provided in this application.

[0023] Figure 7 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0026] It should also be understood that the terminology used in this application specification is for the purpose of describing particular embodiments only and is not intended to limit the application. As used in this application specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0027] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0028] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrases "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0029] The following is combined Figure 1-5 This application describes the security verification method for stateful message mutations in core network protocols. For example... Figure 1 As shown, this method for security verification of stateful message mutations in core network protocols includes the following steps: S110. Obtain the current protocol state tree. Each node in the protocol state tree corresponds to a core network protocol state. The edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state of the node can be triggered by the protocol message corresponding to the edge. S120. Perform node search based on the rating value of the nodes in the protocol state tree, select the target node, and determine the rating value based on the node's depth in the protocol state tree, the node's historical search history, historical selection history, and the state change of the protocol state tree after selection. S130. Select the target message from the message corpus corresponding to the target state of the target node; S140. Mutate the target message to obtain the mutated message, send the mutated message to the core network for security testing, and update the protocol state tree based on the state changes of the core network and the execution result of the mutated message.

[0030] The method provided in this application can perform multiple rounds of security testing on the core network to achieve security verification. In each round of security testing, the core network protocol state to be tested can be determined based on the current protocol state tree. The protocol state tree includes multiple nodes, each node corresponding to a core network protocol state. When a state transition can be achieved between two states, there is an edge between the two states, and this edge corresponds to the protocol message that enables the state transition. For example, when the core network protocol state is A, sending protocol message B to the core network allows the core network to transition from state A to state C. In this case, there is a connection edge between A and C in the protocol state tree, and this edge corresponds to protocol message B.

[0031] The initial state of the protocol state tree can be learned online from the input / output traffic of the core network before the test begins, for example... Figure 2 The diagram illustrates FSM (Finite State Machine) learning. During subsequent testing, new states and state transitions are obtained from the core network's state feedback information regarding core testing, and the protocol state machine is continuously updated. For example... Figure 4 As shown, the protocol state machine can be mapped to the protocol state tree.

[0032] The method provided in this application constructs a protocol state tree that reflects various possible protocol states of the core network and the transitions between these states. Nodes in this tree correspond to a protocol state, and edges between nodes correspond to protocol messages. A connection between two nodes indicates that the protocol state of the node can be triggered by the protocol message associated with that edge, leading to a state transition. Each node in the protocol state tree maintains a score value, determined based on its depth in the tree, its historical search history, its historical selection history, and the state changes in the tree after selection. Therefore, this scoring system reflects the testing value of the node's corresponding state. Based on the node's score, a target node is selected, and a target message is chosen from the message corpus corresponding to that target node's state. This target message is mutated, and the mutated message is sent to the core network for security testing. The protocol state tree is then updated based on the state changes in the core network and the execution results of the mutated message. This allows for the selection of states with higher testing value from among various protocol states in the core network based on a comprehensive test value score, enabling efficient and targeted message mutation and testing, thus improving the efficiency of core network security verification.

[0033] The method provided in this application, considering factors such as coverage, effectiveness, and efficiency, effectively selects test states, sequences reaching the target state, and variant messages to be sent for testing. It adaptively focuses on the most valuable states and transitions in the core network protocol for exploration and utilization, thereby improving the coverage of deep, valuable states. Specifically, in the protocol state tree, the node's score is determined using the following formula: ; (1) (2) in, The rating value is... This represents the number of times the node has been visited. This represents the number of times a node has been selected. This represents the number of times the parent node of the node has been selected. The depth of the node in the protocol state tree. For bias weights, It's a reward parameter. For non-negative hyperparameters, To reflect whether the protocol state tree has generated new node parameters after a node is selected as the target node for testing, To reflect whether the protocol state tree has generated new edge parameters after a node is selected as the target node for testing, This parameter reflects whether an error occurs after the node is selected as the target node for testing. This reflects the proportion of new field entries generated in the mutation message after a node is selected as the target node, relative to the total number of mutation field entries.

[0034] In this implementation, each node maintains the number of times it has been accessed. Number of times selected ,depth Number of times the parent node is selected and cumulative rewards By setting and This distinction can prevent scheduling misdirection caused by nodes being selected for testing but not actually executed. This can prevent excessive dwelling on already explored states, and increase depth. Specifically, the length selected by the node from the protocol state tree is... The depth in the path, It is a reward parameter, usually This aims to explore deeper state nodes. Non-negative hyperparameters. Used to balance exploration of unvisited states with the utilization of cumulative rewards. Cumulative rewards Use whether a new state has been found under the current node. New state transition Errors such as crashes and exceptions Proportion of new variant fields The reward results, according to The weights are calculated by weighting and normalizing. Wherein, These represent whether a new state and a state transition edge have been generated compared to the current state machine during the testing of this node. This indicates whether a crash or other error has occurred; the information is extracted from response messages and logs by the monitoring and analysis module. This represents the proportion of new field entries generated during the message mutation phase at this node to the total number of mutated field entries.

[0035] In the method provided in this application, a score value is assigned to each state node. When determining the target node, the score values ​​of the parent node and the child node are compared downwards starting from the root node. If the parent node has a higher score value, the parent node is selected as the target node. If the child node has a higher score value, the exploration continues downwards. After the selection is completed, a mutation message is generated based on the state of the selected target node and sent to the core network for testing.

[0036] After selecting the target node, i.e., choosing the target state with the optimal value, in order to perform testing against that target state, the core network's protocol state must first reach that target state. That is, before sending the mutation message to the core network for security testing, the following steps must be taken: Based on the current state of the core network, the protocol state tree, and the target node, at least one candidate message sequence path is determined, and the message sequence path includes at least one edge in the protocol state tree; Based on the length, number of executions, and success rate of the candidate message sequence path, the target message sequence path is determined. The target message sequence path is used to restore the state of the core network to the target state.

[0037] There are often multiple message sequence paths with different contexts to reach the target state. In order to reduce the time cost of reaching the target state while taking into account exploration, the target message sequence path for recovery to the target state is selected using a comprehensive scoring criterion based on the following formula. : ; (3) in, This represents the success rate of the path, specifically the number of times the target state is successfully reached and received by the core network after passing the context semantic consistency check. Indicates the number of times the path is executed. This represents the total number of executions for all paths under this target state. Indicates the path length. These represent the weights of each score. Prioritize message sequence paths with high success rates, few executions, and short sequence lengths to improve stability in reaching the target state, reduce recovery overhead due to mid-journey failures, and avoid excessive retries on the same path, thereby improving state coverage.

[0038] For each protocol state, a corresponding message corpus can be maintained. This corpus stores multiple messages, and the messages in the message corpus corresponding to that protocol state are the messages that the core network might accept in that protocol state. In one possible implementation, a message can be randomly selected from the message corpus as the target message for mutation. In another possible implementation, the target message is selected from the message corpus of the target state corresponding to the target node, including: The target message is determined based on the number of mutations and the length of each message in the message corpus.

[0039] Specifically, in this implementation, the target message is selected based on the following formula: ; (4) in, Indicates the number of mutations in the message. Indicates message length. The cumulative reward in the current state, weighted by parameters. Prioritize messages with fewer mutations and shorter lengths, combined with feedback from cumulative rewards. Fewer mutations mean the message has not been fully explored; shorter messages have fewer protocol fields and weaker constraints, resulting in lower processing overhead, higher controllability of mutations, and are less likely to be discarded at shallow parsing levels, thus increasing the probability of reaching deeper state branches. Therefore, this approach ensures a balance between exploration and exploitation while maximizing mutation and testing efficiency.

[0040] Taking the security verification of the core network non-access stratum (NAS) protocol as an example, based on existing automata learning algorithms, the initial state machine of the core network NAS protocol is learned during normal communication between the UE and the core network, such as... Figure 4 As shown in (a), 10 nodes represent 10 protocol states. The directed edges between the nodes in each state represent the protocol state transitions generated by the core network after receiving messages of a specific type. For example, in the node 0 state, the core network can transition to the node 1 state after receiving the “registration request / authentication request (regReq / authReq)” message.

[0041] Next, the core network NAS protocol state machine is mapped to a protocol state tree, such as... Figure 4As shown in (b), consistent with the state machine, nodes represent protocol states, and edges represent protocol state transitions. Circular nodes represent internal nodes of protocol states that still have expandable actions or unexplored sub-states; square nodes represent leaf nodes that have no expandable actions or have reached the protocol termination / absorption state. Solid-line nodes and edges represent state nodes and state transition paths that have been covered and integrated into the tree during actual execution; dashed-line nodes and edges represent state nodes and state transition paths that have not yet been observed during actual execution. Then, state selection and protocol state tree updates are performed through a search iterative process of "selection, simulation, expansion, and backpropagation," with different colored nodes and lines distinguishing the operations at each stage. Starting from "root node 0," the state selection algorithm is recursively applied. First, "node 1" with the highest score among its child nodes is selected for fuzzy testing. Then, after testing "node 1," "node 6" with the highest score in the set of child nodes is selected for testing. Secondly, when selecting and testing node 1, test message sequences are used for rapid probing simulations. Various candidate paths composed of state nodes are "simulated" in the protocol state tree, such as "node 1-node 4-node 7", "node 1-node 4-node 8", "node 1-node 5-node 9-node 5...", "node 1-node 5-node 9-node 9...", etc., shown as dashed lines. These paths are not immediately written into the protocol state tree structure, but are used to evaluate which path will be actually executed and is more valuable, before deciding to formally expand that path and invest more testing resources. Then, based on the actual execution trajectory observed in the current test, new state nodes and paths in the protocol state tree that are consistent with the actual execution and have not appeared before are "expanded" and updated. For example, "node 1-node 5-node 9-node 5..." becomes a path generated by actual execution, shown as a solid line. Finally, based on the actual execution and feedback information, the cumulative reward and UCT score of each node are calculated and updated along the direction of "backpropagation" to the root node of this execution path.

[0042] The UCT score for each state node is calculated according to formulas (1) and (2). Taking "Node 1" as an example, in a certain test, its number of visits, number of selections, depth, and number of parent node selections are 0, 0, 1, and 2, respectively. Since a new state, a new state transition, a crash error, and a new mutation field were found under "Node 1", its cumulative reward and final UCT score calculation results are the highest, and it is selected for testing. After determining the target state "Node 1", the possible message sequence paths from the initial state "Node 0" to the target state "Node 1" include "Registration request / Authentication request (regReq / idReq) - Authentication response / Authentication request (idRes / authReq)", "Registration request / Authentication request (regReq / authReq) - Go to registration request / Go to registration acceptance (deregReq / deregAc) - Registration request / Authentication request (regReq / authReq)..." and "Registration request / Authentication request (regReq / authReq)". Among them, the success rate, number of executions and path length of the message sequence path composed of the "Registration request / Authentication request (regReq / authReq)" protocol message are 1, 0 and 2 respectively. Among the message sequence paths of "Node 1", it has the highest score calculated according to formula (3). Therefore, this sequence is selected to execute to reach "Node 1". After reaching the target state "Node 1", the mutation count, message length and cumulative reward of the "Safety Mode Complete (smCom)" message are 0, 32 and 0.34 respectively. According to formula (4), the highest score among all candidate messages is calculated. Therefore, this message is selected for mutation and sent to the core network for testing.

[0043] After identifying the target message, it is mutated to obtain the mutated message, which is then sent to the core network for security testing. For example... Figure 2 As shown, in one possible implementation, the method provided in this application allows for core network testing based on multiple resource-isolated user terminal (UE) processes, thereby achieving efficient and reliable parallel testing of the core network. Specifically, the method involves mutating the target message to obtain a mutated message, and then sending the mutated message to the core network for security testing, including: Through each of the user terminals, the mutation messages corresponding to each user terminal are sent to the core network in parallel. The mutation message corresponding to each user terminal is generated based on the following steps: Based on a preset mutation strategy lookup table, the mutation decision for each field in the target message is determined sequentially, and the mutated message is generated based on the mutation decision. Specifically, when the mutation decision of the field is the first mutation decision, the field value of the field is obtained from the local sequence-level field pool corresponding to the user terminal; when the mutation decision of the field is the second mutation decision, the field is mutated. After obtaining the mutation messages corresponding to multiple user terminals, the process includes: Based on the mutation message corresponding to the user terminal, the newly added or updated mutation fields are written into the local sequence-level field pool corresponding to the user terminal and a synchronization mark is added. Add fields that need to be synchronized from the local sequence-level field pool to the global sequence-level field pool.

[0044] Parallel fuzzing frameworks help improve testing speed, complete more state path verifications with the same resources, detect crashes and anomalies faster, and quickly locate vulnerabilities and defects. For example... Figure 3 As shown, in this implementation of the method provided in this application, relying on the synchronous sharing mechanism of the three-level field pool, effective test cases are generated through collaborative mutation within and between multiple parallel UE processes. This maintains the consistency constraints within a single mutation message while enabling cross-test case sharing and mutation diversification of key fields, driving fuzz testing to continuously advance towards high-value paths.

[0045] Specifically, to support collaborative mutation within a parallel fuzzing framework, a three-level field synchronization pool is designed, including a message-level field pool, a local sequence-level field pool, and a global sequence-level field pool. The message-level field pool maintains the set of key fields that satisfy semantic constraints for a single protocol message under a given protocol state; the local sequence-level field pool maintains the set of key fields within a single UE process's parallel test case sequence, as well as field synchronization identifiers, indicating the necessity of synchronization with the global sequence-level field pool; the global sequence-level field pool maintains the set of key fields for the entire fuzzing run phase's parallel test case sequence, used to share mutation information of key fields among different parallel fuzzing test cases. Based on this, a field synchronization sharing and collaborative mutation algorithm is proposed, the algorithm flow of which is as follows: Figure 3 As shown, incremental exploration with low overhead can be achieved while maintaining the validity of test cases.

[0046] Before starting the parallel fuzz test, the global sequence-level field pool is initialized according to the predefined key field model shown in formula (5), including field types. This is used to distinguish the differences between the same fields in different message types, as well as the field names. and field values .

[0047] ; (5) When the fuzzing process starts in each parallel UE process, a downlink synchronization operation is performed. This operation pulls the key field set from the global sequence-level field pool to the UE's local sequence-level field pool, and sets the synchronization flags of the corresponding fields in the local sequence-level field pool. For a single protocol message to be mutated, a temporary message-level field pool is established to store the mutated values ​​of each key field in the message, in order to maintain the semantic consistency of key fields within the same data packet.

[0048] During the message mutation phase, the selected message is sequentially matched against the key field sets in the message-level field pool and the local sequence-level field pool. Based on the message type and key field types, a decision is made regarding whether to prioritize reusing to maintain consistency or to adopt a semantically aware mutation strategy. The semantically aware mutation strategy refers to a strategy that modifies message fields to trigger exception handling while satisfying protocol semantics and state context. This strategy is divided into packet-level mutation strategies and sequence-level mutation strategies. Packet-level mutation strategies operate within a single message and can deliberately violate the context of that message. Specific examples include omitting encryption or using incorrect keys to verify integrity and authentication logic, triggering boundary handling conditions through abnormal field types / out-of-bounds lengths / unexpected enumeration values, or performing bit flipping and boundary value replacement on the encoded byte stream. Sequence-level mutation strategies refer to combined mutation strategies between multiple messages, including performing mutation operations such as deletion / insertion / replacement that change the execution order of data packets.

[0049] Based on message type and key field type, the mutation decision for message fields is determined. This can be achieved by pre-classifying all possible messages and key fields in the protocol to obtain various message types and key field types, and then determining the corresponding mutation decisions for different message types and key field types, generating a mutation strategy lookup table. In practical applications, based on the message type and key fields of the current target message, the corresponding mutation decision is looked up in the mutation strategy lookup table.

[0050] Specifically, in the method provided in this application, the mutation strategy is divided into two categories: a first mutation decision and a second mutation decision. The first mutation decision corresponds to maintaining consistency, that is, adopting the same field value as the existing field value. The second mutation decision corresponds to performing semantically aware mutation, that is, mutation generates a new field value.

[0051] For example, key fields in core network NAS protocol messages are categorized into three types: Resource Binding (RB), Behavior Control (CB), and Security Context (SC). Specifically, fields related to Resource Binding are responsible for binding entity resources such as UEs, slices, and sessions, determining whether the network identifies and routes to the correct context; examples include PLMN / SUCI / TMSI / NSSAI / PSI / DNN / SSC. Fields related to Behavior Control control the flow branches of network elements and triggered additional interactions; examples include IMEISV / RegType / EPS / QoS / AMBR. Fields related to Security Context determine whether to enter a protected channel, algorithm negotiation, and count synchronization, strongly influencing whether subsequent messages can be accepted and whether deep states are reachable; examples include SHT / KSI. A table showing the variation decision for these message types and key field types is provided in Table 1.

[0052] Table 1

[0053] Setting corresponding mutation decisions for different fields can increase the probability that the mutated message will be accepted by the core network and reduce the probability of meaningless testing.

[0054] For each key field of the target message, the field values ​​are mutated based on the corresponding mutation decisions to obtain the mutated message. For example, for the core network NAS protocol, according to... Figure 3 The given flowcharts for field synchronization sharing and co-mutation algorithms are as follows: Figure 5 The given example diagram of the three-level field pool synchronization process is used for message mutation. Downlink synchronization is performed when the fuzzing process starts, fetching the key field "Registration Type (RegType)" and all its values ​​from the global sequence-level field pool to its own local sequence-level field pool, and recording the synchronization flag. Next, for the selected "Security Mode Complete (smCom)" message, the key field sets in the message-level field pool and the local sequence-level field pool are matched sequentially. Combining field type and message semantics, it is determined whether to prioritize reusing different key fields to maintain consistency or to perform semantic-aware mutation.

[0055] The mutation decisions for some key message field types in the core network NAS protocol messages are shown in Table 1 above. For example, in the "Security Mode Complete (smCom)" message, different values ​​for the "Terminal Device Identity (IMEISV)" field are preferentially generated through mutation to avoid concurrent task conflicts and expand coverage. Simultaneously, existing "Security Header Type (SHT)" field values ​​are systematically reused to create collisions and facilitate the exposure of erroneous associations. At the end of the message mutation, the newly mutated field "SHT" and its value are written back from the message-level sequence pool to the local sequence-level field pool, and the synchronization flag is set to "No". After the fuzz test for the "Security Mode Complete (smCom)" message is completed, the "SHT" field and its value are synchronized uplink to the global sequence-level field pool, and the synchronization flag is set to "Yes". At the same time, the number of newly mutated field entries "1" is written to the database as the proportion of new mutated fields used in the composite reward protocol state tree algorithm to calculate the cumulative reward of state nodes. Feedback and reward items.

[0056] At the end of message mutation, newly added or updated mutated fields are written back from the message-level sequence pool to the local sequence-level field pool, and the synchronization flag is set to "No," indicating that uplink synchronization is required but not yet complete. After the message fuzzing test for each test case is completed, only the field values ​​newly added in this round and marked with "No" are incrementally synchronized to the global sequence-level field pool via uplink synchronization, and the synchronization flag is set to "Yes," indicating that uplink synchronization is complete. This ensures accurate aggregation and dissemination of key field information across test cases with low synchronization overhead. Furthermore, the number of newly added mutated fields is written to the database as the proportion of new mutated fields in the composite reward protocol state tree algorithm. Feedback rewards encourage the state selection algorithm to adaptively favor states that can generate new mutated field values.

[0057] After generating the mutation message, it is sent to the core network for testing. For example... Figure 2 As shown, in one possible implementation, the co-mutated message is stably sent to the core network in a high-concurrency manner by multiple UE processes. Combined with real-time survival detection and crash feedback results, as well as an automated environment reset mechanism, efficient parallel message transmission is ensured that faults are perceptible, results are attributable, and there is no interference between them.

[0058] Specifically, after each message undergoes co-mutation, it is efficiently and concurrently sent to the core network under test through multiple resource-isolated UE processes. Immediately, the UE probe process is invoked to perform liveness checks on network elements in the core network, based on log information extraction. If a crash occurs, feedback is sent to the main control process, which extracts and records anomalies and errors from the gNB logs. Once an anomaly is identified, it is immediately reported to the system, and message transmission by the UE is quickly suspended. Testing resumes after the environment is reset. If necessary, a serialized restart window is executed for network elements severely affected by crashes, thus preventing interference between UE processes from affecting the accuracy of the results. Simultaneously, it avoids control port contention caused by persistent connections in concurrent scenarios and out-of-order reception during the restart window.

[0059] After sending the mutation message to the core network, the protocol state tree is updated based on the core network's state changes and the mutation message's execution status, including: Based on the changes in the core network state, determine whether to generate new nodes or new edges in the protocol state tree; The score of the target node is updated based on whether a new node or edge is generated in the protocol state tree and the execution result of the mutation message.

[0060] After sending the mutation message targeting the target state to the core network for testing, the core network's operating status is uniformly monitored and evidence is archived. Response messages and abnormal error information from the core network logs are extracted in real time, and feedback rewards such as metric coverage are calculated. This information is used for the next round of decision-making in the state sequence message selection algorithm and drives the online incremental update of the state machine. At the same time, after the test, vulnerability analysis, clustering, and minimizing reproducible location are completed, thereby achieving accurate attribution and closed-loop optimization of error crashes.

[0061] Specifically, during fuzzing, response messages and system logs are continuously retrieved from the gNB and core network elements. After time alignment and session association, these are denoised and standardized to extract anomalies and error signals such as error codes, assertions, restarts, or timeouts. Indicators such as state coverage and the percentage of valid test inputs are recorded simultaneously. Based on this, a feedback reward vector is constructed for the next round of state sequence message selection. Simultaneously, the state machine is incrementally expanded based on newly added states or state transition edges. Specific test case information leading to anomalies or crashes is recorded. After fuzzing, anomalies and crashes are clustered and deduplicated. Message sequence path replay is used for minimization and reproducibility verification. Combined with code analysis tools and comparison with protocol specifications, potential vulnerability root cause localization and protocol violation determination are completed.

[0062] Taking the core network NAS protocol as an example, multiple UE processes perform message mutation and packet transmission in parallel. Immediately after transmission, the UE probe process is invoked to extract core network log information and detect the liveness status of core network AMF and SMF elements. If a network element crash is detected, feedback is sent to the main control process and recorded. After the environment is reset, parallel testing is performed again, thus avoiding inter-process interference and ensuring that the results are attributable and reproducible. Error feedback from response messages and gNB log information is then extracted and, combined with state coverage information, the feedback reward required for the state selection algorithm is calculated in real time. This reward is used for online learning of newly emerging state nodes and transition edges in the extended state machine, thereby incrementally updating the state machine. The state sequence message selection algorithm is then invoked again to start the next round of test iterations. After the entire fuzzing test is completed, based on the recorded anomalies and errors, code analysis tools and professional knowledge are used to cluster and reproduce crash errors and logical errors, analyzing and locating potential vulnerabilities and protocol violations.

[0063] The following describes the stateful message mutation security verification device for core network protocols provided in this application. The stateful message mutation security verification device for core network protocols described below can be referred to in correspondence with the stateful message mutation security verification method for core network protocols described above. For example... Figure 6 As shown, the stateful message mutation security verification device for core network protocols provided in this application includes: The protocol state tree acquisition module 610 is used to acquire the current protocol state tree. Each node in the protocol state tree corresponds to a core network protocol state. The edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state of the node can be triggered by the protocol message corresponding to the edge. The tree search module 620 is used to search for nodes based on the rating values ​​of nodes in the protocol state tree and select target nodes. The rating value is determined based on the depth of the node in the protocol state tree, the node's historical search history, historical selection history, and the state change of the protocol state tree after selection. The message selection module 630 is used to select a target message from the message corpus corresponding to the target state of the target node. The mutation test module 640 is used to mutate the target message to obtain the mutated message, send the mutated message to the core network for security testing, and update the protocol state tree based on the state changes of the core network and the execution result of the mutated message.

[0064] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communications bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other through the communications bus 740. The processor 710 can call logical instructions in the memory 730 to execute a stateful message mutation security verification method for core network protocols. This method includes: obtaining the current protocol state tree, where each node in the protocol state tree corresponds to a core network protocol state, and edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state corresponding to the node can trigger a state transition through the protocol message corresponding to the edge; performing node search based on the node's score value in the protocol state tree, selecting a target node, where the score value is determined based on the node's depth in the protocol state tree, the node's historical search history, historical selection history, and the state changes in the protocol state tree after selection; selecting a target message from the message corpus corresponding to the target state of the target node; mutating the target message to obtain a mutated message; sending the mutated message to the core network for security testing; and updating the protocol state tree based on the state changes in the core network and the execution result of the mutated message.

[0065] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0066] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the stateful message mutation security verification method for core network protocols provided by the above methods. The method includes: obtaining the current protocol state tree, where each node in the protocol state tree corresponds to a core network protocol state, and the edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state corresponding to the node can trigger a state transition through the protocol message corresponding to the edge; performing node search based on the node's score value in the protocol state tree, selecting a target node, where the score value is determined based on the node's depth in the protocol state tree, the node's historical search history, historical selection history, and the state change of the protocol state tree after selection; selecting a target message from the message corpus of the target state corresponding to the target node; mutating the target message to obtain a mutated message; sending the mutated message to the core network for security testing; and updating the protocol state tree based on the state change of the core network and the execution result of the mutated message.

[0067] Furthermore, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, this computer program is implemented to perform the stateful message mutation security verification method for core network protocols provided by the methods described above. The method includes: obtaining the current protocol state tree, where each node in the protocol state tree corresponds to a core network protocol state, and the edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state corresponding to the node can trigger a state transition through the protocol message corresponding to the edge; performing node search based on the node's score value in the protocol state tree, selecting a target node, where the score value is determined based on the node's depth in the protocol state tree, the node's historical search history, historical selection history, and the state change of the protocol state tree after selection; selecting a target message from the message corpus of the target state corresponding to the target node; mutating the target message to obtain a mutated message; sending the mutated message to the core network for security testing; and updating the protocol state tree based on the state change of the core network and the execution result of the mutated message.

[0068] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0069] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for security verification of stateful message mutations in core network protocols, characterized in that, include: Obtain the current protocol state tree. Each node in the protocol state tree corresponds to a core network protocol state. The edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state corresponding to the node can be triggered by the protocol message corresponding to the edge to initiate a state transition. Node search is performed based on the rating values ​​of nodes in the protocol state tree, and a target node is selected. The rating value is determined based on the node's depth in the protocol state tree, the node's historical search history, historical selection history, and the state change of the protocol state tree after the node is selected. Select the target message from the message corpus corresponding to the target state of the target node; The target message is mutated to obtain a mutated message, which is then sent to the core network for security testing. The protocol state tree is updated based on the state changes of the core network and the execution result of the mutated message.

2. The method for secure verification of stateful message mutations in core network protocols according to claim 1, characterized in that, The node's score is determined based on the following formula: ； ； in, The rating value is... This represents the number of times the node has been visited. This represents the number of times a node has been selected. This represents the number of times the parent node of the node has been selected. The depth of the node in the protocol state tree. For bias weights, It's a reward parameter. For non-negative hyperparameters, To reflect whether the protocol state tree has generated new node parameters after a node is selected as the target node for testing, To reflect whether the protocol state tree has generated new edge parameters after a node is selected as the target node for testing, This parameter reflects whether an error occurs after the node is selected as the target node for testing. This reflects the proportion of new field entries generated in the mutation message after a node is selected as the target node, relative to the total number of mutation field entries.

3. The method for secure verification of stateful message mutations in core network protocols according to claim 2, characterized in that, The step of updating the protocol state tree based on the state changes of the core network and the execution results of the mutation messages includes: Based on the state changes of the core network, determine whether to generate a new node or a new edge in the protocol state tree; The score value of the target node is updated based on whether a new node or edge is generated in the protocol state tree and the result of the mutation message execution.

4. The method for security verification of stateful message mutations in core network protocols according to claim 1, characterized in that, Before sending the mutation message to the core network for security testing, the following steps are included: Based on the current state of the core network, the protocol state tree, and the target node, at least one candidate message sequence path is determined, and the message sequence path includes at least one edge in the protocol state tree; Based on the length, number of executions, and success rate of the candidate message sequence path, a target message sequence path is determined, which is used to restore the state of the core network to the target state.

5. The method for secure verification of stateful message mutations in core network protocols according to claim 1, characterized in that, Selecting the target message from the message corpus corresponding to the target state of the target node includes: The target message is determined based on the number of mutations and the message length of each message in the message corpus.

6. The method for secure verification of stateful message mutations in core network protocols according to claim 1, characterized in that, The process of modifying the target message to obtain a modified message and sending the modified message to the core network for security testing includes: Through each user terminal, the mutation message corresponding to each user terminal is sent to the core network in parallel. The mutation message corresponding to each user terminal is generated based on the following steps: Based on a preset mutation strategy lookup table, the mutation decision for each field in the target message is determined sequentially, and the mutated message is generated based on the mutation decision. Specifically, when the mutation decision of the field is the first mutation decision, the field value of the field is obtained from the local sequence-level field pool corresponding to the user terminal; when the mutation decision of the field is the second mutation decision, the field is mutated. After obtaining the mutation messages corresponding to multiple user terminals, the process includes: Based on the mutation message corresponding to the user terminal, the newly added or updated mutation fields are written into the local sequence-level field pool corresponding to the user terminal and a synchronization mark is added; Add the fields that need to be synchronized from the local sequence-level field pool to the global sequence-level field pool.

7. A security verification device for stateful message mutations in core network protocols, characterized in that, include: The protocol state tree acquisition module is used to acquire the current protocol state tree. Each node in the protocol state tree corresponds to a core network protocol state, and the edges between nodes correspond to protocol messages. An edge connecting two nodes indicates that the protocol state corresponding to the node can be triggered by the protocol message corresponding to the edge to initiate a state transition. The tree search module is used to search for nodes based on the rating values ​​of nodes in the protocol state tree and select target nodes. The rating values ​​are determined based on the depth of the node in the protocol state tree, the node's historical search history, its historical selection history, and the state changes of the protocol state tree after it is selected. The message selection module is used to select a target message from the message corpus corresponding to the target state of the target node; The mutation testing module is used to mutate the target message to obtain a mutated message, send the mutated message to the core network for security testing, and update the protocol state tree based on the state changes of the core network and the execution result of the mutated message.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the stateful message mutation security verification method for core network protocols as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the stateful message mutation security verification method for core network protocols as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the stateful message mutation security verification method for core network protocols as described in any one of claims 1 to 6.

Images