A method for fuzz testing of industrial control protocols

Abstract

This invention proposes a fuzz testing method for industrial control protocols, comprising: a protocol parsing module that uses a large model and OCR to convert the original multimodal protocol document into a text document and protocol syntax document that can be read by the large model; a test case generation module that uses prompt word engineering to generate an initial seed based on the parsed document of the protocol under test, and parses the initial seed to construct a test case pool and a test message pool, and constructs test cases through a built-in scheduling mutation algorithm; a test case execution module that receives test cases from the test case generation module and sends them to the target under test for execution, while monitoring the running status of the target under test, and feeding back to the test case generation module if a new branch or new state is found, and feeding back to the vulnerability test oracle module if a suspicious vulnerability is found; and a vulnerability test oracle module that performs specific error detection and determines whether the current test case will trigger a vulnerability based on the program execution status information.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security, and more particularly to a fuzzy testing method for industrial control protocols. Background Technology

[0002] With the rapid advancement of the digital economy and industrial revolution, fundamental industrial sectors such as energy and manufacturing have begun their networked and digital transformation, becoming a crucial component of the nation's new infrastructure development. However, due to their fundamental and strategic nature, the widespread application of new technologies has not only brought enormous potential advantages but also increased security threats, making the Industrial Internet a new battleground for global cyberspace warfare. Industrial control protocols are vital links in enabling the organic linkage of numerous functions within industrial control systems, including real-time data exchange, data acquisition, parameter configuration, and status monitoring. Early industrial control systems operated in physically isolated environments, and many protocols lacked security mechanisms such as authentication and encryption in their design. Furthermore, their implementation often failed to adequately address abnormal protocol data, leaving vulnerabilities. In fact, in recent years, attacks exploiting vulnerabilities in the design, implementation, or application of industrial control protocols to target the Industrial Internet have become increasingly frequent. The security of industrial control protocols is closely related to the reliable and stable operation of industrial control systems.

[0003] Current methods for vulnerability discovery in industrial control protocols primarily utilize fuzzing techniques. This involves inputting automatically or semi-automatically generated random data into the program and monitoring for anomalies to identify potential defects and vulnerabilities. However, current fuzzing tools suffer from drawbacks such as low-quality test seeds and poor scalability. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] Therefore, the purpose of this invention is to propose a fuzz testing method for industrial control protocols, so that network security personnel can quickly perform vulnerability discovery and risk detection on the software implementation of industrial control protocols with only industrial control protocol documentation, without spending a lot of time to understand and learn the syntax and semantic rules and state machine construction of the relevant protocols, thereby significantly improving the work efficiency of network security personnel.

[0006] To achieve the above objectives, embodiments of the present invention propose a fuzz testing method for industrial control protocols, comprising: The protocol parsing module uses large models and OCR to convert the original multimodal protocol documents into text documents and protocol syntax documents that can be read by large models; The test case generation module uses the prompt word project to generate an initial seed based on the parsed document of the protocol under test, and parses the initial seed to build a test case pool and a test message pool. It then uses the built-in scheduling mutation algorithm to build test cases. The test case execution module receives test cases from the test case generation module and sends them to the target under test for execution. At the same time, it monitors the running status of the target under test. If a new branch or new status is found, it reports back to the test case generation module. If a suspicious vulnerability is found, it reports back to the vulnerability test oracle module. The vulnerability testing oracle module performs specific error detection and determines whether the current test case will trigger a vulnerability based on the program execution status information.

[0007] Optionally, the protocol parsing module includes components for document segmentation, document transformation, content filtering, syntax extraction, and syntax validation, wherein: The document segmentation component divides the initial industrial control protocol document into multiple sub-documents according to natural boundaries, in order to adapt to the size that large models can support; The document conversion component uses OCR and large model technology to convert the multimodal document into a large model-readable text document, while retaining its tables and images. The content filtering component uses a large model to read and understand multiple text documents generated in the above steps, and removes content that is irrelevant to the fuzz test; The syntax extraction component parses the filtered protocol document and stores the protocol syntax in a predetermined format, including protocol format-related information and protocol state machine-related information.

[0008] The syntax validation component performs a second validation on the generated protocol syntax to ensure its correctness.

[0009] Optionally, the test case generation module includes an initial seed generation component, an initial seed parsing component, and a test case mutation component, wherein: The initial seed generation component uses the parsed protocol document to generate initial seeds. First, it uses the prompt word project to generate as many initial seeds as possible based on the parsed protocol document and protocol syntax. Then, it uses a seed optimization tool to further optimize the initial seeds generated in the previous step, removing duplicate and incorrect seeds. The initial seed parsing component automatically generates protocol parsing code using the protocol parsing document, which is then manually checked and verified. The test case mutation component selects a test sequence based on the constructed state machine and the selection algorithm to generate new test cases. In addition to traditional mutation, the built-in mutation algorithm also performs controlled mutation on the function code field to improve the efficiency of mutation. Optionally, the test case execution module includes an inconsistency information collection component, wherein: The inconsistency information collection component is used to record the interaction message sequence of the current test round when a new branch is triggered or a new state is discovered in the current test case, and to feed it back to the vulnerability test oracle module. When no branch is triggered, it records the interaction message sequence of the current test round by sampling and feeds it back.

[0010] Optionally, the vulnerability testing oracle module includes an inconsistent vulnerability detection component, wherein: After obtaining feedback information from the test sample execution, the inconsistency vulnerability detection component inputs the interaction message sequence of the current test round and protocol-related documents into the large model. It uses the prompt word project to call the large model for inference. If the large model finds an inconsistency, it records and outputs the interaction message sequence of the current test round.

[0011] The technical solutions provided by the embodiments of the present invention bring at least the following beneficial effects: 1) Large model technology was used to parse multimodal industrial control protocol documents, enabling fuzzing to fully utilize document information and improving the overall efficiency of fuzzing; 2) Large model technology was used to generate initial seeds, improving the diversity and quality of initial seeds and making up for the shortcomings of existing methods in generating seeds of low quality; 3) Large model technology was used to assist in the generation of protocol analyzers, solving the current dilemma of requiring a lot of manual intervention in fuzzing and making the fuzzer more scalable; 4) Large model technology was used to optimize the vulnerability testing oracle module, improving the types of vulnerabilities detected and filling the gap in the current fuzzer's inability to detect semantic vulnerabilities.

[0012] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0013] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a schematic diagram of the architecture of a fuzz testing method for industrial control protocols provided in an embodiment of the present invention; Figure 2 This is an example of constructing a prompt word for detecting inconsistencies using ChatGPT, provided in an embodiment of the present invention. Figure 3 This is a complete flowchart illustrating a fuzz testing method for industrial control protocols provided in an embodiment of the present invention. Detailed Implementation

[0014] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0015] This invention provides a fuzzing method for industrial control protocols. It uses large model technology and protocol documentation to optimize the fuzzing process, thereby improving vulnerability detection rate and code coverage. The method is implemented through a fuzzing system for industrial control protocols, which includes four main modules: a protocol parsing module, a test case generation module, a test case execution module, and a vulnerability test oracle module.

[0016] Figure 1 This is a schematic diagram illustrating the architecture of a fuzz testing method for industrial control protocols provided in an embodiment of the present invention. (Refer to...) Figure 1 The method includes the following steps: S1, based on the protocol parsing module, uses a large model and OCR to convert the original multimodal protocol documents into text documents and protocol syntax documents that can be read by the large model.

[0017] In this invention, the module uses prompt word engineering to take industrial control protocol documents as input. It parses multimodal industrial control protocol documents through five stages: document segmentation, document conversion, content filtering, syntax extraction, and syntax verification, generating protocol documents and protocol syntax information that can be used in subsequent stages.

[0018] Specifically, the protocol parsing module includes components for document segmentation, document conversion, content filtering, syntax extraction, and syntax validation, among which: The document segmentation component divides the initial industrial control protocol document into multiple sub-documents according to natural boundaries, in order to adapt to the size that large models can support; The document conversion component uses OCR and large model technology to convert the multimodal document into a large model-readable text document, while retaining its tables and images. The content filtering component uses a large model to read and understand multiple text documents generated in the above steps, and removes content that is irrelevant to the fuzz test; The syntax extraction component parses the filtered protocol document and stores the protocol syntax in a predetermined format, including protocol format-related information and protocol state machine-related information.

[0019] The syntax validation component performs a second validation on the generated protocol syntax to ensure its correctness.

[0020] S2, the test case generation module, uses the prompt word project to generate an initial seed based on the parsing document of the protocol under test, and parses the initial seed to build a test case pool and a test message pool. It then constructs test cases through the built-in scheduling mutation algorithm.

[0021] In this embodiment of the invention, the test case generation module is mainly used to generate an initial seed based on the protocol document under test, parse the initial seed to build a test case pool and a test message pool, construct test cases through a built-in scheduling mutation algorithm, and collect test feedback operation information and vulnerability information to construct a protocol state machine model to guide the generation of the next test case.

[0022] Furthermore, the method proposed in this embodiment of the invention adds the following functional components to the traditional fuzzer: a) Initial Seed Generation Component: This invention generates initial seeds based on the parsed protocol document. First, it utilizes a prompt word engineering approach to generate as many initial seeds as possible based on the parsed protocol document and protocol syntax. Then, it uses a seed optimization tool to further optimize the initial seeds generated in the previous step, removing duplicate and erroneous seeds. This embodiment of the invention employs a prompt word engineering approach using a large model, specifically constructed through methods such as thought chaining, small-sample learning, and emphasis.

[0023] b) Initial Seed Parsing Component: Before testing the protocol, a parser for the protocol's request and response messages needs to be added. This embodiment of the invention utilizes a large model to assist in generating the protocol parser component. Specifically, it automatically generates parsing code for request message segmentation using the extracted protocol format, automatically generates parsing code for extracted function codes using the extracted state machine, and then manually verifies the results. This section employs a large model for the prompt word project, specifically constructed using methods such as thought chains, small-sample learning, and emphasis to build prompt words.

[0024] c) Industrial Control System Protocol (ICS) Mutation Component: ICS has different characteristics from Internet protocols. This embodiment of the invention improves the mutation efficiency by modifying the mutation algorithm. First, since ICS is controlled precisely to the "bit" level, we mutate the relevant fields bit by bit during mutation. Second, ICS has a function code field. Frequent mutation of the function code will generate many useless test cases. Therefore, we perform controlled mutation on the function code field.

[0025] S3, the test case execution module, receives test cases from the test case generation module and sends them to the target under test for execution. At the same time, it monitors the running status of the target under test. If a new branch or a new status is found, it reports back to the test case generation module. If a suspicious vulnerability is found, it reports back to the vulnerability test oracle module.

[0026] In this embodiment of the invention, the test sample execution module is mainly used to receive test samples from the test sample generation module and send them to the target under test for execution. At the same time, it monitors the running status of the target under test. If a new branch or a new status is found, it is fed back to the test sample generation module. If a suspicious vulnerability is found, it is fed back to the vulnerability test oracle module.

[0027] It should be noted that the method proposed in this embodiment of the invention proposes an inconsistency information collection component based on the traditional fuzzer. The function of this component is: if the current test case triggers a new branch or discovers a new state, it records the interaction message sequence of the current test round and feeds it back to the vulnerability test oracle module; and if it does not trigger, it records the interaction message sequence of the current test round by sampling and feeds it back.

[0028] S4, the vulnerability testing oracle module, performs specific error detection and determines whether the current test case will trigger a vulnerability based on program execution status information.

[0029] In this embodiment of the invention, the vulnerability test oracle module is mainly used to determine whether a vulnerability exists based on the feedback information from the execution of test samples and to record the interaction messages that trigger the vulnerability. The method proposed in this embodiment of the invention can detect not only memory security vulnerabilities that can be detected by traditional fuzzers, but also inconsistency vulnerabilities. The proposed method makes the following modifications based on traditional fuzzers: Inconsistency Vulnerability Detection Component: An inconsistency vulnerability refers to a discrepancy between the protocol's implementation code and the specifications outlined in the protocol documentation. This embodiment of the invention infers inconsistency vulnerabilities by analyzing current interaction behavior. Specifically, after the inconsistency vulnerability detection component receives feedback information from test sample execution, it inputs the interaction message sequence of the current test round and the protocol parsing document into a large model. It then uses a prompt word engineering approach to call the large model for inference. If the large model detects an inconsistency, it records and outputs the interaction message sequence of the current test round. This implementation uses a prompt word engineering approach with the large model, specifically constructed through methods such as thought chaining, learning from a small number of samples, and emphasis.

[0030] It should be noted that the large model used in the embodiments of this invention is a large language model. Closed-source large models such as ChatGPT and Kimi can be used, as well as open-source large models that have been optimized and fine-tuned, such as LLaMA and DeepSeek. This invention does not specifically limit them. Regardless of the model used, the construction method of the prompt words is similar. An example is given here: when using ChatGPT to detect inconsistency vulnerabilities, the prompt word construction example is as follows... Figure 2 As shown.

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solution of this invention will be described in more detail below through a complete flowchart. In practical use, the embodiments of this invention only require manual completion of the preparation stage; the steps of the fuzzing test stage will be automatically completed by the fuzzer. The flowchart is as follows: Figure 3 As shown.

[0032] Step 1: Preparation stage.

[0033] 1. Prepare the implementation program of the protocol under test and the original documentation of the protocol under test. The implementation program of the protocol under test must run based on the TCP / IP protocol stack. Configure the API of the large model being called.

[0034] 2. Input the original protocol document into the protocol parsing module to generate the parsed text document and protocol syntax.

[0035] 3. Verify the fuzzer's support for the protocol: If the fuzzer supports the protocol under test, skip to step 2; if the simulator does not support the protocol, add an initial sub-parser. Specifically, construct parser prompts, input the relevant parts of the protocol document and the prompts into the large model, generate parser code, add the parser code to the designated location in the fuzzer, and perform manual checking and verification.

[0036] Step 2: Fuzz testing phase.

[0037] 4. Generate Initial Seed: Construct prompts for generating the initial seed. Input the protocol parsing document, protocol syntax, and prompts into the large model to generate the initial seed required for fuzz testing. Then, use a seed optimization tool to optimize the quality of the initial seed.

[0038] 5. The initial seed parser automatically parses the initial seed.

[0039] 6. Generate test cases based on the initial seed parsing results, test feedback information, and built-in mutation algorithms.

[0040] 7. The test case execution component interacts with the implementation program of the protocol under test, runs test cases, monitors the program's running status, and collects program running information. If a new branch or new state is found during the current run, the relevant interaction information is saved and output for use in step 8; if the program crashes or hangs during the current run, the relevant interaction information is saved and output for use in step 9; if a test termination instruction is received, the process jumps to step 10; otherwise, after the run ends, it returns to step 6 to continuously receive new test cases and perform cyclical testing on the target under test.

[0041] 8. Determine if an inconsistency vulnerability exists: Construct a prompt word to determine if an inconsistency vulnerability exists. Input the protocol state machine and the prompt word into the large model, and output whether an inconsistency vulnerability exists. If an inconsistency vulnerability exists, report the vulnerability.

[0042] 9. Determine if a memory security vulnerability exists: Use debugging tools and replay test cases to determine if it is a real vulnerability.

[0043] 10. End the test.

[0044] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0045] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for fuzz testing of an industrial control protocol, the method comprising: receiving a fuzzed input; generating a fuzzed message based on the fuzzed input; and sending the fuzzed message to a target device. include: The protocol parsing module uses large models and OCR to convert the original multimodal protocol documents into text documents and protocol syntax documents that can be read by large models; The test case generation module uses the prompt word project to generate an initial seed based on the parsing document of the protocol under test, and parses the initial seed to build a test case pool and a test message pool. It then uses the built-in scheduling mutation algorithm to build test cases. The test case execution module receives test cases from the test case generation module and sends them to the target under test for execution. At the same time, it monitors the running status of the target under test. If a new branch or new status is found, it reports back to the test case generation module. If a suspicious vulnerability is found, it reports back to the vulnerability test oracle module. The vulnerability testing oracle module performs specific error detection and determines whether the current test case will trigger a vulnerability based on the program execution status information.

2. The method according to claim 1, characterized in that, The protocol parsing module includes components for document segmentation, document conversion, content filtering, syntax extraction, and syntax validation, among which: The document segmentation component divides the initial industrial control protocol document into multiple sub-documents according to natural boundaries, in order to adapt to the size that large models can support; The document conversion component uses OCR and large model technology to convert the multimodal document into a large model-readable text document, while retaining its tables and images. The content filtering component uses a large model to read and understand multiple text documents generated in the above steps, and removes content that is irrelevant to the fuzz test; The syntax extraction component parses the filtered protocol document and stores the protocol syntax in a predetermined format, including protocol format-related information and protocol state machine-related information. The syntax validation component performs a second validation on the generated protocol syntax to ensure its correctness.

3. The method according to claim 2, characterized in that, The test case generation module includes an initial seed generation component, an initial seed parsing component, and a test case mutation component, wherein: The initial seed generation component uses the parsed protocol document to generate initial seeds. First, it uses the prompt word project to generate as many initial seeds as possible based on the parsed protocol document and protocol syntax. Then, it uses a seed optimization tool to further optimize the initial seeds generated in the previous step, removing duplicate and incorrect seeds. The initial seed parsing component automatically generates protocol parsing code using the protocol parsing document, which is then manually verified. The test case mutation component selects a test sequence based on the constructed state machine and a selection algorithm to generate new test cases. In addition to traditional mutation, the built-in mutation algorithm also performs controlled mutation on the function code field to improve mutation efficiency.

4. The method according to claim 3, characterized in that, The test case execution module includes an inconsistency information collection component, wherein: The inconsistency information collection component is used to record the interaction message sequence of the current test round when a new branch is triggered or a new state is discovered in the current test case, and to feed it back to the vulnerability test oracle module. When no branch is triggered, it records the interaction message sequence of the current test round by sampling and feeds it back.

5. The method according to claim 4, characterized in that, The vulnerability testing oracle module includes an inconsistent vulnerability detection component, wherein: After obtaining feedback information from the test sample execution, the inconsistency vulnerability detection component inputs the interaction message sequence of the current test round and protocol-related documents into the large model. It uses the prompt word project to call the large model for inference. If the large model finds an inconsistency, it records and outputs the interaction message sequence of the current test round.

Images