Batch fuzzing method, device, computer equipment and readable storage medium

Abstract

This application relates to a batch fuzz testing method, apparatus, computer device, and readable storage medium. The method includes: for each round of testing, obtaining the mutated packets required for that round of testing; generating abnormal test packets required by the corresponding device under test for that round of testing based on the mutated packets and the network address of each device under test; sending each abnormal test packet to the corresponding device under test through the switch; and monitoring the response of each device under test to the received abnormal test packets; and determining the anomaly resistance capability of the corresponding device under test based on the response of each device under test in each round of testing. This application can reduce hardware costs and achieve batch parallel testing to improve testing efficiency.

Description

Technical Field

[0001] This application relates to the field of testing technology, and in particular to a batch fuzz testing method, apparatus, computer equipment, and readable storage medium. Background Technology

[0002] Fuzz testing is an automated testing technique that involves inputting unexpected, abnormal, or mutated test messages into the device under test (DUT) and observing its operational status to discover potential vulnerabilities and abnormal behaviors. Fuzz testing is one of the core methods for security verification of network devices, servers, and other products. In practical applications, it is often necessary to perform batch fuzz testing on multiple DUT devices of the same or different models to verify their stability and security.

[0003] Currently, batch fuzz testing mainly uses test equipment with multiple network ports to send test messages to each device under test, or the test equipment sends messages to different devices under test in a loop through a single network port. The above two methods have the following drawbacks: First, the hardware cost of test equipment with multiple network ports is high; second, the method of sending messages in a loop through a single network port cannot achieve true batch parallel testing, resulting in low testing efficiency.

[0004] Therefore, there is an urgent need for a batch fuzzing test solution that reduces hardware costs and enables batch parallel testing to improve testing efficiency. Summary of the Invention

[0005] Therefore, it is necessary to provide a batch fuzzing method, apparatus, computer equipment, and readable storage medium that reduces hardware costs and enables batch parallel testing to improve testing efficiency, thereby addressing the aforementioned technical problems.

[0006] Firstly, this application provides a batch fuzz testing method. The method is applied to a test device, which is connected to a switch via a single port. The switch is connected to multiple devices under test (DUTs) via multiple ports, one-to-one. The method includes: for each round of testing, obtaining the mutated packets required for that round of testing; generating abnormal test packets required by the DUT for that round of testing based on the mutated packets and the network address of each DUT; sending each abnormal test packet to the corresponding DUT via the switch; and monitoring the response of each DUT to the received abnormal test packets; determining the anomaly resistance of each DUT based on its response in each round of testing, wherein the anomaly resistance of each DUT is negatively correlated with the number of abnormal responses in each round of testing.

[0007] In one embodiment, the mutated message includes at least one anomalous target; the method further includes: selecting a target anomalous target corresponding to the current test from the at least one anomalous target included in the mutated message according to the anomalous response in each response situation; performing anomalous enhancement on the mutated message according to the target anomalous target corresponding to the current test, and using the anomalously enhanced mutated message as the mutated message required for the next round of testing.

[0008] In one embodiment, based on the target anomaly point corresponding to the current test, the mutated message is anomaly enhanced, including: replacing the current anomaly point of the target anomaly point in the mutated message with other anomaly values ​​of the target anomaly point corresponding to the current test, to obtain the anomaly enhanced mutated message.

[0009] In one embodiment, the mutated message is abnormally enhanced based on the target anomaly point corresponding to the current test, including: abnormally enhancing the mutated message based on the target anomaly point corresponding to the current test and a reference anomaly point; wherein, the current test is not the first test, and the reference anomaly point is the target anomaly point corresponding to each test before the current test.

[0010] In one embodiment, based on the target anomaly point and reference anomaly point corresponding to the current test, the mutated message is anomaly-enhanced, including: if the target anomaly point and reference anomaly point corresponding to the current test are different, replacing the current anomaly point in the mutated message with other anomaly values ​​of the target anomaly point corresponding to the current test; and replacing the current anomaly point in the mutated message with other anomaly values ​​of the reference anomaly point, to obtain the anomaly-enhanced mutated message; wherein, the other anomaly values ​​of the reference anomaly point are anomaly values ​​that have not been used by the reference anomaly point in previous rounds of testing.

[0011] In one embodiment, the method further includes: outputting an address editing page; generating network addresses equal to the number of devices under test based on the network address range obtained from the address editing page; and assigning each network address to each device under test; wherein each network address corresponds one-to-one with each device under test.

[0012] In one embodiment, based on the mutated message and the network address of each device under test, an abnormal test message required by the device under test in this round of testing is generated, including: for each device under test, adding the network address of the device under test to the destination address field of the mutated message; and encapsulating the mutated message with the added network address to obtain the abnormal test message of the device under test.

[0013] Secondly, this application also provides a batch fuzz testing apparatus. The apparatus is applied to a testing device, which is connected to a switch via a single port. The switch is connected to multiple devices under test (DUTs) via multiple ports, one-to-one. The apparatus includes: a message acquisition module for acquiring mutated messages required for each round of testing; a message generation module for generating abnormal test messages required by the DUT for each DUT in this round of testing based on the mutated messages and the network address of each DUT; a message sending module for sending each abnormal test message to the corresponding DUT via the switch; a response monitoring module for monitoring the response of each DUT to the received abnormal test messages; and a capability determination module for determining the anomaly resistance capability of each DUT based on its response in each round of testing, wherein the anomaly resistance capability of each DUT is negatively correlated with the number of abnormal responses in each round of testing.

[0014] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method provided in the first aspect.

[0015] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method provided in the first aspect.

[0016] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method provided in the first aspect.

[0017] The aforementioned batch fuzzing method, apparatus, computer equipment, and readable storage medium describe a batch fuzzing method applied to a test device. The test device connects to a switch via a single port, and the switch connects to multiple devices under test (DUTs) via multiple ports, one-to-one. This embodiment leverages the multiple ports of the switch, using it as a bridge between the test device and the DUTs to achieve batch parallel testing of multiple DUTs by a single test device, thus improving testing efficiency. Furthermore, the test device in this embodiment only needs a single port, reducing hardware costs. The test device can execute at least one round of testing. In each round, the test device generates an abnormal test message required by the DUT for that round based on the mutated message and the network address of each DUT. This abnormal test message is then sent to the corresponding DUT via the switch, allowing each DUT to receive the appropriate abnormal test message. The test device monitors the response of each DUT to the received abnormal test messages to determine its anomaly resistance. For each device under test, the response of the device under test in each round of testing can provide a more comprehensive and accurate understanding of the device's ability to resist anomalies. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a diagram illustrating the application environment of a batch fuzz testing method in one embodiment.

[0020] Figure 2 This is a flowchart illustrating a batch fuzz testing method in one embodiment;

[0021] Figure 3 This is a flowchart illustrating the anomaly enhancement steps in one embodiment;

[0022] Figure 4 This is a flowchart illustrating the anomaly enhancement steps in one embodiment;

[0023] Figure 5 This is a flowchart illustrating the anomaly enhancement steps in one embodiment;

[0024] Figure 6 This is a flowchart illustrating the anomaly enhancement steps in one embodiment;

[0025] Figure 7 This is a flowchart illustrating the network address configuration steps in one embodiment;

[0026] Figure 8 This is a flowchart illustrating the steps for generating an abnormal test message in one embodiment;

[0027] Figure 9 This is a flowchart illustrating a batch fuzz testing method in one embodiment;

[0028] Figure 10 This is a structural block diagram of a batch fuzz testing device in one embodiment;

[0029] Figure 11 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0031] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0032] In one embodiment, an application environment is provided. See also Figure 1 This application environment includes a test device, a switch, and multiple devices under test (DUTs). The test device connects to the switch via a single port (e.g., a gigabit Ethernet port), and the switch connects to each DUT via multiple ports (i.e., downstream ports as referred to below). In other words, the test device only needs a single port; multiple ports are not required.

[0033] The switch includes one uplink port and multiple downlink ports. The uplink port of the switch connects to a single port of the test device, thus establishing a connection between the switch and the test device. The multiple downlink ports of the switch connect one-to-one with multiple devices under test, thus establishing a connection between the switch and multiple devices under test.

[0034] The test equipment is used to execute batch fuzz testing methods, the switch is used to transmit information (e.g., abnormal test messages, response status) between the test equipment and the device under test, and the device under test is responsible for responding to the received abnormal test messages.

[0035] The testing equipment can be an industrial-grade test host or other types of testing equipment.

[0036] The device under test (DUT) can be a Modbus RTU (Remote Terminal Unit) controller (e.g., network device, server, embedded terminal) or other types of DUTs. A Modbus RTU controller refers to a controller based on the Modbus RTU protocol.

[0037] It is understood that the batch fuzzing methods provided in the embodiments below do not require the type of device under test, have strong test versatility, do not require separate test plans for different types of devices under test, and reduce the test cost and complexity of batch fuzzing methods.

[0038] Understandably, hardware deployment is required before performing the batch fuzzing methods provided in the embodiments below, i.e., completing the hardware connection between the test equipment, the switch and multiple devices under test.

[0039] In this embodiment, no complex configuration of the switch is required; only basic port startup configuration is needed, which reduces the deployment difficulty. The working principle of the switch is based on the MAC (Media Access Control) address forwarding mechanism of the data link layer. By learning the correspondence between the MAC address of the device under test and the downstream port, it can accurately forward abnormal test packets.

[0040] Of course, before executing the batch fuzzing method, the test parameters need to be configured in the test equipment. Test parameters include at least one of the following: message sending rate (e.g., 100 frames / second), mutation probability (e.g., 0.05), test duration (e.g., 2 hours, meaning the test ends after 2 hours), and anomaly detection threshold (e.g., 3 seconds, meaning if there is no feedback 3 seconds after the test equipment receives an abnormal test message, it is considered an abnormal response). Other parameters can also be configured, which are not limited here. The message protocol corresponding to the abnormal test message can also be configured to be the Modbus RTU protocol. Initial mutated messages can also be generated.

[0041] In one exemplary embodiment, a batch fuzzing method is provided, see [link to example]. Figure 2 This batch fuzzing method includes:

[0042] S210: For each round of testing, obtain the mutation messages required for that round of testing.

[0043] The mutation message includes at least one mutation target.

[0044] For example, the mutation targets in the mutated message may include function code anomaly targets and / or abnormal check code targets, and of course may include other types of anomaly targets, which are not limited here.

[0045] The variant messages required for different rounds of testing vary. The variant messages required for the first round of testing can be the initial variant messages set according to the type of the device under test and / or testing requirements. The variant messages required for subsequent rounds of testing can be determined based on the response of the previous round of testing, or even based on the response of previous rounds of testing. Other methods can also be used to determine the variant messages required for this round of testing, which are not limited here.

[0046] The initial mutated message includes, but is not limited to, network protocol messages and application layer messages. The protocol type, data length, and field parameters of the initial mutated message can be set as needed.

[0047] S220 generates the abnormal test message required by the device under test in this round of testing based on the mutated message and the network address of each device under test.

[0048] Network addresses include IP (Internet Protocol) addresses.

[0049] Understandably, the abnormal test message is generated based on the mutated message and the network address of the device under test. Therefore, the abnormal test message includes the same abnormal target and the network address of the device under test as the mutated message.

[0050] S230 sends each abnormal test message to the corresponding device under test through the switch.

[0051] That is, the test equipment sends the abnormal test messages required for this round of testing to the uplink port of the switch, and the switch sends the abnormal test messages required for this round of testing to the corresponding devices under test through the downlink port, so that each device under test receives the corresponding abnormal test messages.

[0052] S240 monitors the response of each device under test to received abnormal test messages.

[0053] In real-world scenarios, heartbeat detection is used to determine if the connection between the device under test (DUT) and the testing device is functioning correctly. If the connection is normal, message response detection is used to obtain the response status of each DUT to abnormal test messages. Combining heartbeat and message response detection methods ensures rapid acquisition and handling of abnormal responses.

[0054] Understandably, the response of the device under test (DUT) to an abnormal test message reflects its ability to handle the abnormal situation represented by the abnormal target in the abnormal test message, i.e., the DUT's ability to resist anomalies.

[0055] S250 determines the anomaly resistance of each device under test based on its response during each round of testing.

[0056] This can include limiting the test duration, for example, ending the test when it reaches 2 hours. It can also limit the number of test rounds, for example, ending the test when it reaches 100 rounds. Of course, other methods can also be used as conditions for ending the test, which are not limited here.

[0057] Understandably, the more abnormal responses a device under test (DUT) exhibits in each round of testing, the weaker its anomaly resistance. Therefore, the anomaly resistance of a DUT is negatively correlated with the number of abnormal responses. In other words, the anomaly resistance of each DUT is negatively correlated with the number of abnormal responses it exhibits in each round of testing.

[0058] In this embodiment, the batch fuzzing testing method is applied to the test equipment. The test equipment is connected to the switch through a single port, and the switch is connected to multiple devices under test (DUTs) one-to-one through multiple ports. This embodiment leverages the multi-port feature of the switch and simplifies deployment by requiring only port configuration. Therefore, the switch acts as a bridge between the test equipment and the DUTs, enabling batch parallel testing of multiple DUTs by a single test equipment, thus improving testing efficiency. Furthermore, the test equipment in this embodiment only needs a single port, reducing hardware costs. The test equipment can execute at least one round of testing. In each round, the test equipment generates the corresponding abnormal test packets required by the DUT for that round based on the mutated packets and the network address of each DUT. These abnormal test packets are then sent to the corresponding DUTs via the switch, allowing each DUT to receive them. The test equipment monitors the responses of each DUT to the received abnormal test packets to determine their resilience. For each device under test, the response of the device under test in each round of testing can provide a more comprehensive and accurate understanding of the device's ability to resist anomalies.

[0059] Based on the technical solutions provided in the above embodiments, an optional embodiment is provided, in which the mutated message includes at least one abnormal target, and the batch fuzzing method is refined to include an anomaly enhancement step.

[0060] See Figure 3 The abnormal enhancement steps include:

[0061] S310, based on the abnormal response situation in each response situation, select the target abnormal target corresponding to this round of testing from at least one abnormal target included in the mutation message.

[0062] That is, based on the abnormal response during this round of testing, the target abnormality point corresponding to this round of testing is determined.

[0063] Understandably, a target is considered a normal target if its value is legal, and an abnormal target if its value is abnormal. Therefore, an abnormal target is a target with an abnormal value.

[0064] For example, the abnormal test message includes a function code anomaly target. When a device under test (DUT) with weak anomaly resistance receives the abnormal test message, it cannot parse it normally and therefore will not send feedback to the test device, resulting in an abnormal response. Furthermore, this abnormal response is caused by the function code anomaly target. Therefore, the function code anomaly target is taken as the target anomaly target for this round of testing.

[0065] For example, the abnormal test message includes an abnormal checksum target. When a device under test with weak anomaly resistance receives the abnormal test message, it will experience data corruption, i.e., an abnormal response. Moreover, this abnormal response is caused by the abnormal checksum target. Therefore, the abnormal checksum target is taken as the target abnormality for this round of testing.

[0066] S320 performs anomaly enhancement on the mutated message based on the target anomaly point corresponding to this round of testing, and uses the anomaly-enhanced mutated message as the mutated message required for the next round of testing.

[0067] In this context, enhancing mutated messages can be understood as mutating the target anomalous points within the mutated message. There are various mutation methods available, which can be selected as needed and are not limited here.

[0068] Understandably, the abnormally enhanced mutated packets from the current test round can be used as the mutated packets required for the next test round. For example, in S210 of the (i+1)th test round, the abnormally enhanced mutated packets from the i-th test round can be used as the mutated packets required for the (i+1)th test round, thereby achieving the acquisition of the mutated packets required for the (i+1)th test round.

[0069] In this embodiment, based on the abnormal response during the current test, the target abnormal point corresponding to the current test is determined. Then, based on the target abnormal point corresponding to the current test, the mutated message is abnormally enhanced, and the abnormally enhanced mutated message is used as the mutated message required for the next test. In this way, in the next test, each device under test can be targeted to the target abnormal point corresponding to the current test, which solves the problem of blind testing, improves the targeting and depth of vulnerability discovery, and can significantly improve the vulnerability discovery capability.

[0070] Based on the technical solutions provided in the above embodiments, an optional embodiment is provided, in which the anomaly enhancement steps in S320 are refined.

[0071] See Figure 4 The detailed anomaly enhancement steps include:

[0072] S410: Use other abnormal values ​​of the target abnormal point corresponding to this round of testing to replace the current abnormal value of the target abnormal point in the mutated message, and obtain the abnormal enhanced mutated message.

[0073] Other abnormal values ​​are those that are not part of the current abnormal value.

[0074] For example, the target anomalous point corresponding to this round of testing is anomalous point A. The current anomalous value of anomalous point A in the mutated message is 0x80. The value of anomalous point A in the mutated message is changed from 0x80 to other anomalous values, such as 0xFF, so as to obtain the anomalously enhanced mutated message.

[0075] This round of testing can be either the first round or a subsequent round.

[0076] In real-world scenarios, besides using the method of changing abnormal values ​​for mutation enhancement, we can also modify the format of the current abnormal value of the target abnormal point to an abnormal format, or modify the length of the current abnormal value of the target abnormal point to an abnormal length. Of course, other abnormal enhancement methods can also be used, which are not limited here.

[0077] In this embodiment, other abnormal values ​​of the target abnormal target corresponding to this round of testing are used to replace the current abnormal value of the target abnormal target in the mutated message, thereby obtaining an abnormal enhanced mutated message. In the next round of testing, the device under test's resistance to other abnormal values ​​of the target abnormal target can be tested. Thus, after the test is completed, the device under test's resistance to multiple abnormal values ​​of the target abnormal target can be determined, thereby increasing the comprehensiveness of the test.

[0078] Based on the technical solutions provided in the above embodiments, an optional embodiment is provided, in which the anomaly enhancement steps in S320 are refined.

[0079] See Figure 5 The detailed anomaly enhancement steps include:

[0080] S510 performs anomaly enhancement on the mutated message based on the target anomaly point and reference anomaly point corresponding to this round of testing.

[0081] This round of testing is not the first round of testing.

[0082] Among them, the reference abnormal target points are the target abnormal targets corresponding to the previous rounds of testing.

[0083] For example, during the first round of testing, if one device under test exhibits an abnormal response, and the corresponding target anomalous point is anomalous point A, then the mutated message is augmented based on anomalous point A. During the second round of testing, if another device under test exhibits an abnormal response, and the corresponding target anomalous point is anomalous point B, then the mutated message is augmented based on both anomalous point A and anomalous point B.

[0084] In this embodiment, during the anomaly enhancement process in non-first rounds of testing, in addition to the target anomaly points corresponding to this round of testing, the target anomaly points corresponding to previous rounds of testing are also used. This achieves joint mutation of the target anomaly points determined in this round of testing and previous rounds of testing, increasing the richness of mutations. This allows for targeted testing of each device under test on the target anomaly points determined in this round of testing and previous rounds of testing in the next round of testing, thereby improving the targeting of vulnerability triggering.

[0085] Based on the technical solutions provided in the above embodiments, an optional embodiment is provided, in which the anomaly enhancement step in S510 is refined.

[0086] See Figure 6 The detailed anomaly enhancement steps include:

[0087] S610, if the target anomalous point and the reference anomalous point corresponding to this round of testing are different, use other anomalous values ​​of the target anomalous point corresponding to this round of testing to replace the current anomalous value of the target anomalous point corresponding to this round of testing in the mutation message.

[0088] S620: Use other abnormal values ​​of the reference abnormal target to replace the current abnormal value of the reference abnormal target in the mutated message, and obtain the mutated message after abnormal enhancement.

[0089] Among them, other abnormal values ​​of the reference abnormal target point are abnormal values ​​that have not been used in previous rounds of testing.

[0090] For example, the target anomaly for this round of testing includes target anomalous point A, and the target anomaly for each round of testing prior to this round includes target anomalous point B. Target anomalous point A and target anomalous point B are different types of mutation targets. The current anomaly value of target anomalous point A in the mutation message is 0x80. This value is changed from 0x80 to another anomaly value, such as 0xFF. The current anomaly value of target anomalous point B is 0x90. This value is changed from 0x90 to another anomaly value, such as 0xEF. 0xEF is different from the anomaly values ​​of target anomalous point B in each round of testing prior to this round, thus avoiding duplicate values ​​for target anomalous point B. This results in the anomaly-enhanced mutation message.

[0091] In real-world scenarios, if the target anomaly point and the reference anomaly point are the same in this round of testing, the current value of the target anomaly point in the mutation message is replaced with another anomaly value that has not been used for the target anomaly point in this round of testing or in previous rounds of testing, thus avoiding duplicate values.

[0092] In this embodiment, when the target anomaly point and the reference anomaly point corresponding to the current test are different, other anomaly values ​​of the target anomaly point corresponding to the current test are used to replace the current anomaly value of the target anomaly point corresponding to the current test in the mutated message, and other anomaly values ​​of the reference anomaly point are used to replace the current anomaly value of the reference anomaly point in the mutated message, so as to obtain anomaly-enhanced mutated messages. This is so that in the next round of testing, the anomaly resistance capability of each target anomaly point determined by the current test and the previous rounds of testing can be determined. Thus, after the test is completed, the anomaly resistance capability of the device under test to multiple anomaly values ​​of each target anomaly point determined by the current test and the previous rounds of testing can be determined, thereby increasing the comprehensiveness of the test.

[0093] Based on the technical solutions provided in the above embodiments, an optional embodiment is provided, in which the batch fuzz testing method is further refined to include a network address configuration step.

[0094] See Figure 7 The network address configuration steps include:

[0095] S710, Output Address Editing Page.

[0096] For example, an address editing page is displayed on the display interface, allowing users to enter a range of network addresses.

[0097] The S720 generates the same number of network addresses as the device under test, based on the network address range obtained from the address editing page.

[0098] For example, the network address range entered by the user is 192.168.1.10-192.168.1.19, the number of devices under test is 10, the test device parses the network address range, generates 10 network addresses, and checks whether the 10 network addresses are duplicates or abnormal network addresses. After the checks are passed, 10 legal and non-duplicate network addresses are obtained.

[0099] In practical scenarios, besides entering the network address range in the address editing page, you can also enter the network segment (e.g., 192.168.1.0 / 24) or a user-specified network address, offering the advantage of flexible configuration. The network address range, network segment, and user-specified network address are all address configuration data, and the three methods can be flexibly selected as needed.

[0100] The S730 assigns network addresses to each device under test.

[0101] Each network address corresponds one-to-one with each device under test.

[0102] For example, 10 network addresses are sent to 10 devices under test, and each device under test receives a network address, ensuring the uniqueness of the network address of each device under test.

[0103] In this embodiment, the test device outputs an address editing page, allowing users to input a network address range as needed. The test device then generates the required network address based on this range, enabling flexible network address configuration. This reduces the complexity of network address configuration, improves the ease of use and adaptability of the batch fuzzing test method, and makes it suitable for test scenarios of different scales.

[0104] Based on the technical solutions provided in the above embodiments, an optional embodiment is provided, in which the abnormal test message generation step in S220 is refined.

[0105] See Figure 8 The detailed steps for generating exception test messages include:

[0106] S810 adds the network address of each device under test to the destination address field of the mutated message.

[0107] The S820 encapsulates the mutated message with the added network address to obtain the abnormal test message of the device under test.

[0108] For example, if the number of devices under test is 10, then for each device under test, the network address of the device under test is added to the destination address field of the mutated packet, and the mutated packet with the network address added is encapsulated to obtain the abnormal test packet of that device under test. In this way, 10 abnormal test packets can be obtained.

[0109] In this embodiment, the network address of each device under test is added to the destination address field of the mutated packet. The mutated packet with the added network address is then encapsulated to obtain the abnormal test packet of the device under test. This ensures that when the abnormal test packet is subsequently sent through the switch, the switch can correctly send the abnormal test packet to the corresponding device under test using the network address in the destination address field of the abnormal test packet, thus guaranteeing the correct transmission of the abnormal test packet.

[0110] Based on the technical solutions provided in the above embodiments, an optional embodiment is provided, in which a batch fuzz testing method is provided, which is applied to a testing device.

[0111] See Figure 9 The method includes:

[0112] S901, Output Address Editing Page.

[0113] S902 generates the same number of network addresses as the device under test based on the network address range obtained from the address editing page.

[0114] S903 assigns network addresses to each device under test.

[0115] Each network address corresponds one-to-one with each device under test.

[0116] S904, for each round of testing, obtains the mutation messages required for that round of testing.

[0117] In the case of this round of testing being the first round, the required variant messages for this round of testing are generated based on the type of device under test and the testing requirements, resulting in initial variant messages.

[0118] In cases where this round of testing is not the first round of testing, the mutated messages required for this round of testing are the mutated and enhanced mutated messages from the previous round of testing.

[0119] S905 adds the network address of each device under test to the destination address field of the mutated message.

[0120] S906 encapsulates the mutated message with the added network address to obtain the abnormal test message of the device under test.

[0121] The S907 sends each abnormal test message to the corresponding device under test through the switch.

[0122] S908 monitors the response of each device under test to received abnormal test messages.

[0123] S909, based on the abnormal response situation in each response situation, select the target abnormal target corresponding to this round of testing from at least one abnormal target included in the mutation message.

[0124] S910 performs anomaly enhancement on the mutated message based on the target anomaly point corresponding to this round of testing, and uses the anomaly-enhanced mutated message as the mutated message required for the next round of testing.

[0125] In cases where this round of testing is not the first round of testing, the mutated message can be abnormally enhanced based on the target anomaly point and reference anomaly point corresponding to this round of testing. The reference anomaly point is the target anomaly point corresponding to each round of testing before this round of testing.

[0126] S911 determines the anomaly resistance of each device under test based on its response during each round of testing after each round of testing.

[0127] In real-world scenarios, a test report can be generated after the test concludes. For example, if the test ends after two hours, a test report can be generated based on at least one of the following: network address configuration parameters, network addresses of each device under test (especially those corresponding to abnormal responses), response status of each device under test (especially abnormal responses), mutated packets, abnormal test packets (especially those corresponding to abnormal responses), the mutation enhancement process, and the anomaly resistance capability of each device under test. Furthermore, test logs can be retained for data traceability.

[0128] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0129] Based on the same inventive concept, this application also provides a batch fuzzing apparatus for implementing the batch fuzzing method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more batch fuzzing apparatus embodiments provided below can be found in the limitations of the batch fuzzing method described above, and will not be repeated here.

[0130] In one exemplary embodiment, a batch fuzz testing apparatus is provided. The apparatus is applied to a testing device, which is connected to a switch via a single port. The switch is connected to multiple devices under test via multiple ports in a one-to-one correspondence.

[0131] like Figure 10 As shown, the device includes: a message acquisition module 1010, a message generation module 1020, a message sending module 1030, a response monitoring module 1040, and a capability determination module 1050, wherein:

[0132] The message acquisition module 1010 is used to acquire the mutated messages required for each round of testing.

[0133] The message generation module 1020 is used to generate the abnormal test message required by the device under test in this round of testing based on the mutated message and the network address of each device under test.

[0134] The message sending module 1030 is used to send each abnormal test message to the corresponding device under test through the switch; and,

[0135] The response monitoring module 1040 is used to monitor the response of each device under test to received abnormal test messages;

[0136] The capability determination module 1050 is used to determine the anomaly resistance capability of each device under test based on the response of each device under test in each round of testing, wherein the anomaly resistance capability of each device under test is negatively correlated with the number of abnormal response situations in the response situation of the device under test in each round of testing.

[0137] In one embodiment, the mutated message includes at least one anomalous target; the apparatus further includes: a target selection module, configured to select a target anomalous target corresponding to the current test from at least one anomalous target included in the mutated message according to the anomalous response in each response situation; and an anomalous enhancement module, configured to enhance the mutated message according to the target anomalous target corresponding to the current test, and use the anomalously enhanced mutated message as the mutated message required for the next round of testing.

[0138] In one embodiment, the anomaly enhancement module is specifically used to: replace the current anomaly value of the target anomaly in the mutated message with other anomaly values ​​of the target anomaly corresponding to the current test, so as to obtain an anomaly-enhanced mutated message; wherein, the other anomaly values ​​are anomaly values ​​other than the current anomaly value.

[0139] In one embodiment, the anomaly enhancement module includes: a mutation enhancement unit, used to perform anomaly enhancement on the mutated message based on the target anomaly point and the reference anomaly point corresponding to the current test; wherein, the current test is not the first test, and the reference anomaly point is the target anomaly point corresponding to each test in previous rounds.

[0140] In one embodiment, the mutation enhancement unit is specifically used to: when the target anomaly point corresponding to the current test and the reference anomaly point are different, replace the current anomaly point of the target anomaly point corresponding to the current test in the mutation message with other anomaly values ​​of the target anomaly point corresponding to the current test; and replace the current anomaly value of the reference anomaly point in the mutation message with other anomaly values ​​of the reference anomaly point to obtain the anomaly-enhanced mutation message; wherein, the other anomaly values ​​of the reference anomaly point are anomaly values ​​that have not been used by the reference anomaly point in previous rounds of testing.

[0141] In one embodiment, the apparatus further includes: an address configuration module, configured to output an address editing page; generate network addresses equal to the number of devices under test based on the network address range obtained from the address editing page; and assign each network address to each device under test; wherein each network address corresponds one-to-one with each device under test.

[0142] In one embodiment, the message generation module is specifically used to: add the network address of each device under test to the destination address field of the mutated message for each device under test; and encapsulate the mutated message with the added network address to obtain the abnormal test message of the device under test.

[0143] Each module in the aforementioned batch fuzzy testing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0144] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 11 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a batch fuzzy testing method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0145] Those skilled in the art will understand that Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0146] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the batch fuzz testing method provided in the above embodiments.

[0147] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the batch fuzzing method provided in the above embodiments.

[0148] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the batch fuzz testing method provided in the above embodiments.

[0149] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0150] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0151] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A batch fuzz testing method, characterized in that, The method is applied to a test device, which is connected to a switch via a single port, and the switch is connected to multiple devices under test (DUTs) via multiple ports in a one-to-one correspondence; the method includes: For each round of testing, obtain the mutation messages required for that round of testing; Based on the mutated message and the network address of each device under test, generate the abnormal test message required by the device under test in this round of testing. The switch sends each abnormal test message to the corresponding device under test; and... Monitor the response of each device under test to received abnormal test messages; Based on the response of each device under test in each round of testing, the anomaly resistance capability of the corresponding device under test is determined; wherein, the anomaly resistance capability of each device under test is negatively correlated with the number of abnormal response situations in the response situation of the device under test in each round of testing.

2. The method according to claim 1, characterized in that, The mutation message includes at least one anomalous target; the method further includes: Based on the abnormal response in each of the aforementioned response situations, select the target abnormal target corresponding to this round of testing from at least one abnormal target included in the mutated message; Based on the target anomaly point corresponding to this round of testing, the mutated message is abnormally enhanced, and the abnormally enhanced mutated message is used as the mutated message required for the next round of testing.

3. The method according to claim 2, characterized in that, The step of performing anomaly enhancement on the mutated message based on the target anomaly point corresponding to this round of testing includes: The current abnormal value of the target abnormal point in the mutated message is replaced with other abnormal values ​​corresponding to the target abnormal point in this round of testing to obtain the abnormal enhanced mutated message; wherein, the other abnormal values ​​are abnormal values ​​other than the current abnormal value.

4. The method according to claim 2, characterized in that, The step of performing anomaly enhancement on the mutated message based on the target anomaly point corresponding to this round of testing includes: Based on the target anomaly point and reference anomaly point corresponding to this round of testing, the mutated message is abnormally enhanced; In this test, the current test is not the first test, and the reference abnormal target point is the target abnormal target point corresponding to each test before this test.

5. The method according to claim 4, characterized in that, The step of performing anomaly enhancement on the mutated message based on the target anomaly point and reference anomaly point corresponding to this round of testing includes: If the target anomaly point and the reference anomaly point for this round of testing are different, other anomaly values ​​of the target anomaly point for this round of testing will be used to replace the current anomaly value of the target anomaly point for this round of testing in the mutation message; and... The current abnormal value of the reference abnormal target in the mutated message is replaced with other abnormal values ​​of the reference abnormal target to obtain the abnormal enhanced mutated message. Among them, the other abnormal values ​​of the reference abnormal target point are abnormal values ​​that have not been used in the previous rounds of testing.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Output address editing page; Based on the network address range obtained from the address editing page, generate the same number of network addresses as the device under test; Each of the network addresses is assigned to each of the devices under test; wherein each of the network addresses and each of the devices under test corresponds one-to-one.

7. The method according to any one of claims 1 to 5, characterized in that, The step of generating the abnormal test message required by the device under test in this round of testing based on the mutated message and the network address of each device under test includes: For each device under test, the network address of the device under test is added to the destination address field of the mutated packet; and, The modified message with the added network address is encapsulated to obtain the abnormal test message of the device under test.

8. A batch fuzzy testing device, characterized in that, The device is used in a testing equipment, which is connected to a switch via a single port, and the switch is connected to multiple devices under test (DUTs) via multiple ports, one-to-one; the device includes: The message acquisition module is used to acquire the mutated messages required for each round of testing. The message generation module is used to generate the abnormal test message required by the device under test in this round of testing based on the mutated message and the network address of each device under test; The message sending module is used to send each abnormal test message to the corresponding device under test through the switch; and, The response monitoring module is used to monitor the response of each of the devices under test to the received abnormal test messages; The capability determination module is used to determine the anomaly resistance capability of each device under test based on its response in each round of testing; wherein, the anomaly resistance capability of each device under test is negatively correlated with the number of abnormal response situations in the response situation of the device under test in each round of testing.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images