Data generation device, data generation method, and program

Abstract

To appropriately generate a test data group when subjecting a communication device as a detection object to fuzzing.SOLUTION: A data generation device 12 includes: a test data group generation unit 64 which generates a test data group for testing operation of a communication device which establishes communication by transmitting and receiving a data group according to a communication protocol; and a state determination unit 66 which determines a state of the communication device when the communication device has received the test data group. A test data group generation unit 65 generates a next test data group for testing operation of the communication device on the basis of the determination result of the state of the communication device.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a data generation device, a data generation method, and a program. [Background technology]

[0002] A testing method called fuzzing is sometimes used to detect vulnerabilities in devices and software. Fuzzing involves inputting a set of test data into a target to be detected, and checking the behavior of the target in response to the input. For example, Patent Document 1 describes generating a set of test data by replacing data included in a set of normal data that allows the target to operate normally with other test data. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-107284 Summary of the Invention [Problem to be solved by the invention]

[0004] When fuzzing a communication device, a test data set is sent to the device and its operation is monitored. The device communicates by sending and receiving data sets that comply with a communication protocol. In order to properly fuzz a communication device that receives data sets that comply with a communication protocol, it is necessary to properly generate the test data set.

[0005] In view of the above-mentioned problems, the present invention aims to provide a data generation device, a data generation method, and a program that can appropriately generate a set of test data when fuzzing a communication device as a detection target. [Means for solving the problem]

[0006] A data generation device according to one aspect of the present invention includes a test data group generation unit that generates test data groups for testing the operation of a communication device that communicates by sending and receiving data groups according to a communication protocol, and a state determination unit that determines the state of the communication device when the communication device receives the test data group, and the test data group generation unit generates the next test data group for testing the operation of the communication device based on the determination result of the state of the communication device.

[0007] A data generation method according to one aspect of the present invention includes the steps of generating a test data group for testing the operation of a communication device that communicates by sending and receiving data groups according to a communication protocol, determining the state of the communication device when the communication device receives the test data group, and generating a next test data group for testing the operation of the communication device based on the determination result of the state of the communication device.

[0008] A program according to one aspect of the present invention causes a computer to perform the following steps: generating a test data group for testing the operation of a communication device that communicates by sending and receiving data groups according to a communication protocol; determining the state of the communication device when the communication device receives the test data group; and generating a next test data group for testing the operation of the communication device based on the result of determining the state of the communication device. [Effects of the Invention]

[0009] According to the present invention, a test data set can be appropriately generated when fuzzing a communication device as a detection target. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a schematic diagram of a data generation system according to this embodiment. [Figure 2] FIG. 2 is a schematic block diagram of a communication device according to this embodiment. [Figure 3]FIG. 3 is a schematic diagram showing an example of the data structure of a data group received by a communication device. [Figure 4] FIG. 4 is a schematic block diagram of a monitoring device according to this embodiment. [Figure 5] FIG. 5 is a schematic block diagram of a data generating device according to this embodiment. [Figure 6] FIG. 6 is a flowchart illustrating the processing flow of fuzzing. [Figure 7] FIG. 7 is a schematic diagram illustrating an example of generating a test data group by the proximity substitution process. [Figure 8] FIG. 8 is a schematic diagram illustrating an example of generating a test data group by random permutation processing. DETAILED DESCRIPTION OF THE INVENTION

[0011] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the following embodiments.

[0012] 1 is a schematic diagram of a data generation system according to this embodiment. The fuzzing system 1 according to this embodiment is a system that executes fuzzing in real time on a communication device 10. Fuzzing is a testing method that inputs a set of test data to a test target (here, the communication device 10) to check the behavior of the test target in response to the input, thereby checking the vulnerability of the test target.

[0013] (Communication equipment) The communication device 10 is a device capable of communicating with other devices to send and receive information. In this embodiment, the communication device 10 sends and receives information by wireless communication, and more specifically, performs wireless communication by Bluetooth (registered trademark). However, the communication method used by the communication device 10 is not limited to Bluetooth, and any type of wireless communication or wired communication may be used.

[0014] FIG. 2 is a schematic block diagram of a communication device according to this embodiment. As shown in FIG. 2, the communication device 10 includes a storage unit 20, a communication unit 22, and a control unit 24. The storage unit 20 is a memory that stores various information, such as the calculation contents and programs of the control unit 24, and includes at least one of a main storage device such as a random access memory (RAM), a read-only memory (ROM), and an external storage device such as an HDD (hard disk drive). The program for the control unit 24 stored in the storage unit 20 may be stored in a recording medium readable by the communication device 10. The communication unit 22 is a communication module. The control unit 24 is a calculation device, i.e., a central processing unit (CPU). The control unit 24 reads and executes software stored in the storage unit 20 to perform various processes, such as communication. The communication device 10 may also include an input unit that accepts user input and an output unit that outputs information.

[0015] FIG. 3 is a schematic diagram showing an example of the data structure of a data group received by a communication device. A communication device 10 communicates with other devices by transmitting and receiving data groups according to a communication protocol. As shown in FIG. 3, a data group DG0 received by the communication device 10 during communication is a data group (a block of data) composed of a plurality of data D arranged in a row. In the example of FIG. 3, the data D is binary data. Binary data is composed of the numerical values ​​0 and 1. However, the data D is not limited to binary data and may be numerical data composed of any of the numerical values ​​0 to 9, or character data composed of any of the letters a to z. Furthermore, the data D may be at least one of character data, numerical data, and binary data. In other words, the data group DG0 may be composed of at least one combination of character data, numerical data, and binary data.

[0016] Furthermore, the data group DG0 is divided into multiple packets DP and transmitted / received. That is, the communication device 10 sequentially receives multiple packets DP, combines them, reconstructs the information contained in the data group DG0, and executes processing for communication. Each packet DP is divided into multiple data units DU, and each data group DU contains multiple bits of data D. The data units DU within one packet DP contain different information. For example, one packet DP contains a data unit DU indicating the address of the sender, a data unit DU indicating the address of the destination, and a data unit DU related to processing content. In this way, the data group DG0 received by the communication device 10 during communication is divided into multiple packets DP, but this is not limited thereto, and one packet DP may be one data group DG0.

[0017] (Fuzzing system) The fuzzing system 1 according to this embodiment replaces at least some of the data D included in a data group DG0 conforming to a communication protocol with data different from the original data D to generate a test data group DG for testing the operation of the communication device 10. In other words, the test data group DG is a data group in which at least some of the data D in a data group DG0 (normal data group) that allows the communication device 10 to operate normally is replaced with other data. The fuzzing system 1 transmits the generated test data group DG to the communication device 10. Depending on the received test data group DG, the communication device 10 may or may not operate normally. "Operating normally" means, for example, exhibiting the same behavior as when the data group DG0 was input. On the other hand, "not operating normally" means, for example, exhibiting behavior different from the behavior when the data group DG0 was input, indicating an abnormality in the operation. In the example of this embodiment, when the communication device 10 operates normally, it transmits a response data group DR to the fuzzing system 1. The content of the response data group DR corresponds to the content of the data group DG0. Furthermore, in the example of this embodiment, if the communication device 10 is not operating normally, it does not transmit the response data group DR to the fuzzing system 1. In this case, the fuzzing system 1 determines that the communication device 10 is operating normally when it receives the response data group DR, and determines that the communication device 10 is not operating normally (that an abnormality has occurred) when it does not receive the response data group DR.

[0018] Here, the communication device 10 communicates with other devices by performing processing (sending and receiving data groups) according to a communication sequence. Furthermore, communication is performed in a stateful manner. Therefore, the communication device 10 communicates using a different communication protocol for each communication sequence. Different communication protocols result in different data structures for the data group DG0. Therefore, when fuzzing the communication device 10 in real time, the data structure of the data group DG0 changes depending on the communication sequence, which may prevent proper generation of the test data group DG. In contrast, the fuzzing system 1 according to this embodiment performs at least one of the following processes: generating the next test data group DG based on the response of the communication device 10 when the previous test data group DG is input; analyzing the communication protocol to select replacement data D; and generating the next test data group DG using a genetic algorithm, as described below. This allows proper generation of the test data group DG and proper real-time fuzzing. The configuration of the fuzzing system 1 is described below.

[0019] 1, the fuzzing system 1 according to this embodiment includes a data generator 12 and a monitoring device 14. The data generator 12 is a device that generates a test data group DG, transmits the generated test data group TG to a communication device 10, and receives a response data group TR from the communication device 10. In other words, the data generator 12 is a device that executes fuzzing. Details of the data generator 12 will be described later.

[0020] (Monitoring device 14) The monitoring device 14 is a device that detects data groups transmitted and received between the communication device 10 and the data generating device 12. The monitoring device 14 analyzes the data groups transmitted and received between the communication device 10 and the data generating device 12 and identifies the communication protocol being used.

[0021] FIG. 4 is a schematic block diagram of a monitoring device according to this embodiment. As shown in FIG. 4, the monitoring device 14 includes a storage unit 30, a communication unit 32, and a control unit 34. The storage unit 30 is a memory that stores various information such as the calculation contents and programs of the control unit 34, and includes at least one of a RAM, a main storage device such as a ROM, and an external storage device such as a HDD. The program for the control unit 34 stored in the storage unit 30 may be stored in a recording medium readable by the monitoring device 14. The communication unit 32 is a communication module. The monitoring device 14 may also include an input unit that accepts user input and an output unit that outputs information.

[0022] The control unit 34 is a computing device, i.e., a CPU. The control unit 34 includes a communication monitoring unit 40 and a protocol identification unit 42. The control unit 34 implements the communication monitoring unit 40 and the protocol identification unit 42 and executes these processes by reading and executing a program (software) from the storage unit 30. The control unit 34 may implement these processes using a single CPU, or may be provided with multiple CPUs and execute the processes using the multiple CPUs. At least a portion of the communication monitoring unit 40 and the protocol identification unit 42 may be implemented using hardware.

[0023] The communication monitoring unit 40 acquires the data groups transmitted and received between the communication device 10 and the data generating device 12 by having the communication unit 32 receive the data groups transmitted and received between the communication device 10 and the data generating device 12. For example, the communication monitoring unit 40 acquires both the data group transmitted from the data generating device 12 to the communication device 10 and the data group transmitted from the communication device 10 to the data generating device 12, but may receive at least one of them.

[0024] The protocol identification unit 42 analyzes the data group acquired by the communication monitoring unit 40 and identifies the communication protocol used in the communication between the communication device 10 and the data generating device 12. The protocol identification unit 42 may identify the communication protocol by any method, but for example, if the data group includes information indicating the communication protocol, the protocol identification unit 42 may read out the information to identify the communication protocol.

[0025] The protocol identification unit 42 identifies replaceable data based on the identified communication protocol. Replaceable data is data D that may be replaced to generate a test data group DG. The data group transmitted from the data generating device 12 to the communication device 10 includes data D that, if replaced, will not reach the destination (communication device 10) and data D that will reach the destination even after replacement. Based on the data structure of the data group conforming to the identified communication protocol, the protocol identification unit 42 identifies data D that, if replaced, will reach the destination (communication device 10) and designates the identified data D as replaceable data. In other words, the protocol identification unit 42 does not designate data D that, if replaced, will not reach the destination (communication device 10) as replaceable data. For example, the protocol identification unit 42 may designate data D that is not included in a data unit DU that indicates the addresses of the sender and the destination as replaceable data. Furthermore, the protocol identification unit 42 may treat the data D included in the data unit DU indicating the header, location, and content as replaceable data.

[0026] The protocol specifying unit 42 transmits information on the specified replaceable data to the data generating device 12 via the communication unit 32.

[0027] (Data generation device) FIG. 5 is a schematic block diagram of a data generating device according to this embodiment. As shown in FIG. 5, the data generating device 12 includes a storage unit 50, a communication unit 52, and a control unit 54. The storage unit 50 is a memory that stores various information such as the calculation contents and programs of the control unit 54, and includes at least one of a RAM, a main storage device such as a ROM, and an external storage device such as a HDD. The program for the control unit 54 stored in the storage unit 50 may be stored in a recording medium readable by the data generating device 12. The communication unit 52 is a communication module. The data generating device 12 may also include an input unit that accepts user input and an output unit that outputs information.

[0028] The control unit 54 is a computing device, i.e., a CPU. The control unit 54 includes a communication control unit 60, a replaceable information acquisition unit 62, a test data group generation unit 64, and a state determination unit 66. The control unit 54 implements the communication control unit 60, the replaceable information acquisition unit 62, the test data group generation unit 64, and the state determination unit 66 by reading and executing a program (software) from the storage unit 50. The control unit 54 may implement these processes using a single CPU, or may be provided with multiple CPUs and execute the processes using the multiple CPUs. At least a portion of the communication control unit 60, the replaceable information acquisition unit 62, the test data group generation unit 64, and the state determination unit 66 may be implemented using hardware.

[0029] The communication control unit 60 communicates with an external device via the communication unit 52 to send and receive information. The communication control unit 60 transmits a test data group DG to the communication device 10. The communication control unit 60 acquires a response data group DR from the communication device 10. Specific processing by the communication control unit 60 will be described later.

[0030] The replaceable information acquisition unit 62 acquires information on replaceable data (data that may be replaced to generate the test data group DG) identified based on the communication protocol. The replaceable information acquisition unit 62 may acquire the address of a replacement data group within a data group as the replaceable data information. In this embodiment, the replaceable information acquisition unit 62 acquires the replaceable data information from the monitoring device 14 via communication, but this is not limited thereto. The replaceable information acquisition unit 62 may acquire the replaceable data information by identifying the replaceable data itself based on the communication protocol. In other words, the replaceable information acquisition unit 62 may have the function of the protocol identification unit 42 of the monitoring device 14 described above.

[0031] The test data group generation unit 64 generates a test data group DG. The specific processing of the test data group generation unit 64 will be described later.

[0032] The state determination unit 66 determines the state of the communication device 10 when the communication device 10 receives the test data group DG. That is, the state determination unit 66 determines whether the communication device 10 that received the test data group DG operated normally. Specific processing by the state determination unit 66 will be described later. The state determination unit 66 may output the determination result, and may, for example, cause the determination result to be displayed on a display unit of the data generating device 12.

[0033] (Processing of data generating device) Next, the process flow of fuzzing executed by the data generating device 12 will be described. FIG. 6 is a flowchart illustrating the process flow of fuzzing. As shown in FIG. 6, the data generating device 12 selects a communication device 10 to be subjected to fuzzing (step S10). In this embodiment, the data generating device 12 executes a scan of peripheral devices to select the communication device 10 to be subjected to fuzzing. Then, the data generating device 12 transmits a pairing request to the communication device 10 selected as the fuzzing target via the communication control unit 60 (step S12). In other words, the communication control unit 60 transmits a data group including information indicating a pairing request to the communication device 10. The communication device 10 accepts the pairing request, and the communication device 10 and the data generating device 12 are ready to transmit and receive data groups in accordance with a communication protocol corresponding to the communication sequence.

[0034] The data generating device 12 acquires information on replaceable data using the replaceable information acquiring unit 62 (step S14). In this embodiment, the communication monitoring unit 40 of the monitoring device 14 acquires a group of data most recently transmitted and received between the communication device 10 and the data generating device 12, and the protocol identifying unit 42 of the monitoring device 14 analyzes the group of data acquired by the communication monitoring unit 40 to identify the communication protocol and identifies replaceable data based on the communication protocol. The replaceable information acquiring unit 62 of the data generating device 12 acquires information on the replaceable data identified by the protocol identifying unit 42 from the monitoring device 14.

[0035] The data generator 12 generates a test data group DG using the test data group generation unit 64 (step S16). The test data group generation unit 64 acquires a data group DG0 (a normal data group that allows the communication device 10 to operate normally) conforming to the communication protocol in the current communication sequence, and replaces some of the data D included in the data group DG0 with other data to generate the test data group DG. In this embodiment, the test data group generation unit 64 generates the test data group DG based on the information on replaceable data acquired by the replaceable information acquisition unit 62. Specifically, the test data group generation unit 64 replaces data identified as replaceable data (data located at the same address as the replaceable data) among the data D included in the data group DG0 with other data to generate the test data group DG. When there is a plurality of replaceable data, the test data group generation unit 64 may replace all of the data identified as replaceable data, or may replace some of the data identified as replaceable data.

[0036] After generating the test data group DG, the data generator 12 transmits the test data group DG to the communication device 10 that is the target of fuzzing via the communication control unit 60 (step S18). The communication device 10 that receives the test data group DG operates in accordance with the test data group DG. As described above, in this embodiment, the communication device 10 transmits a response data group DR when it receives a data group DG0 (normal data group) that conforms to the communication protocol in the current communication sequence. Therefore, when the communication device 10 receives the test data group DG and operates normally, it transmits the response data group DR to the data generator 12, and when it does not operate normally, it does not transmit the response data group DR.

[0037] The data generating device 12 determines the state of the communications device 10 when it receives the test data group DG using the state determining unit 66 (step S20). In this embodiment, if the data generating device 12 receives a response data group DR from the communications device 10, the state determining unit 66 determines that the communications device 10 is operating normally. On the other hand, if the data generating device 12 does not receive a response data group DR from the communications device 10, the state determining unit 66 determines that the communications device 10 is not operating normally.

[0038] As described above, in this embodiment, the state determination unit 66 determines the state of the communications device 10 when it receives the test data group DG based on the presence or absence of the response data group DR. However, the method of determining the state of the communications device 10 is not limited to this. For example, the state determination unit 66 may determine that the communications device 10 is not operating normally if it receives from the communications device 10 an abnormal data group different from the response data group DR or an error signal indicating that the communications device 10 is not operating normally. Also, for example, a device that monitors the state of the communications device 10 may be provided in advance, and the device may transmit information indicating the state of the communications device 10 to the data generating device 12. In this case, the state determination unit 66 determines the state of the communications device 10 based on the received information indicating the state of the communications device 10.

[0039] Thereafter, if fuzzing is not to be continued (step S22; No), the fuzzing process is terminated. On the other hand, if fuzzing is to be continued, the data generator 12 generates the next test data group DG using the test data group generation unit 64 (step S24), returns to step S18, and transmits the generated next test data group DG to the communications device 10. The data generator 12 repeats the process of updating the test data group DG and executing fuzzing until it is determined in step S22 that fuzzing will not be continued. Note that the determination of whether to continue fuzzing may be made by any method, and, for example, it may be determined to continue fuzzing if it is determined that the state of the communications device 10 is normal, and to terminate fuzzing if it is determined that the state of the communications device 10 is abnormal.

[0040] The process of generating the next test data group DG in step S24 will be described in detail below.

[0041] The test data group generation unit 64 generates the next test data group DG by replacing at least a part of the data D included in the previously generated test data group DG with other data. That is, the next test data group DG can be said to be a data group in which at least a part of the data D of the immediately previous test data group DG has been replaced with other data.

[0042] The test data group generation unit 64 may generate the next test data group DG based on the information on the replaceable data. That is, the test data group generation unit 64 replaces data identified as replaceable data (data located at the same address as the replaceable data) among the data included in the previous test data group DG with other data to generate the next test data group DG. If there is multiple replaceable data, the test data group generation unit 64 may replace all of the data identified as replaceable data, or may replace only a portion of the data identified as replaceable data. Note that, in this embodiment, the replaceable data is updated each time the test data group DG is transmitted to the communication device 10. That is, each time the test data group DG is transmitted to the communication device 10, the monitoring device 14 receives and analyzes the test data group DG to identify the communication protocol, and identifies replaceable data based on the communication protocol. The test data group generation unit 64 generates the next test data group DG using the replaceable data identified based on the previous test data group DG. However, the replaceable data is not limited to being updated, and the test data group generation unit 64 may generate subsequent test data DG based on the information on the replaceable data obtained in step S14, i.e., based on the information on the replaceable data used when generating the initial test data group DG.

[0043] In the following explanation, unless otherwise specified, it is preferable that the test data group generation unit 64 selects data to be replaced with other data from among the data identified as replaceable data (from among the data located at the same address as the replaceable data) and generates the next test data group DG.

[0044] The test data group generation unit 64 may generate the next test data group DG based on the state determination result of the communications device 10 by the state determination unit 66. That is, the test data group generation unit 64 generates the next test data group DG based on the state of the communications device 10 when the previous test data group DG was received. For example, the test data group generation unit 64 may generate the next test data group DG using different methods depending on whether the communications device 10 operates normally or abnormally. For example, if the communications device 10 does not operate normally, the test data group generation unit 64 may replace data D within a predetermined range in the previous test data group DG with different data relative to the data replaced when generating the previous test data group DG. This allows for appropriate detection of related errors at addresses close to the data in which an error occurred. On the other hand, if the communications device 10 does not operate normally, the test data group generation unit 64 may replace data D within a predetermined range in the previous test data group DG with different data relative to the data replaced when generating the previous test data group DG. This allows for widespread error detection. The term "predetermined range" used here refers to addresses within a predetermined range within the test data group DG. For example, an address may be said to be within a predetermined range if the Euclidean distance in cluster analysis in data science is within a predetermined range, or an address may be said to be within a predetermined range if the Hamming distance in coding theory is within a predetermined range. Furthermore, for example, if the test data group DG is divided into multiple packets DP and transmitted, data D included in another packet DP may be said to have an address outside the predetermined range.

[0045] The test data group generation unit 64 may generate the next test data group DG based on the data structure of the previous test data group DG. For example, the test data group generation unit 64 may generate the next test data group DG using a genetic algorithm. More specifically, the test data group generation unit 64 may generate the next test data group DG by a proximity substitution process. FIG. 7 is a schematic diagram illustrating an example of generating a test data group by a proximity substitution process. The proximity substitution process refers to a process of generating the next test data group DG by replacing data D within a predetermined range in the previous test data group DG with other data relative to the data substituted when generating the previous test data group DG. In the proximity substitution process, the next test data group TG may be generated by partial crossover, as shown in the example of FIG. 7. Partial crossover refers to the process of combining the genetic sequences of two seeds with a certain probability to create a new seed. In generating a test data group DG, it refers to the process of swapping the positions (addresses) of data D at different positions (addresses) in the previous test data group DG to generate the next test data group DG. In FIG. 7, the previous test data group DG is the test data group DGa, and the next test data group DG to be generated is the test data group DGb. In this case, in the example of FIG. 7, data D ("1001" in the example of FIG. 7) within a predetermined range of data Da1 replaced when generating the test data group DGa is swapped with data D ("0110" in the example of FIG. 7) within a predetermined range of data Da2 replaced when generating the test data group DGa, thereby generating the test data group DGb.

[0046] The data generation device 12 preferably repeats the process of generating a test data group DG using the proximity substitution process and the process of transmitting the test data group DG to the communication device 10 and determining the state of the communication device 10. The test data group generation unit 64 then determines whether the evaluation (determination result) of the state of the communication device 10 that received the test data group DG generated by the proximity substitution process has converged. If the evaluation has not converged, the proximity substitution process is further repeated. If the evaluation has converged, the random substitution process is executed. The random substitution process refers to a process of randomly selecting data to be replaced from the data D included in the previous test data group DG and replacing the selected data with other data to generate the next test data group DG. Note that any method may be used to determine whether the evaluation has converged in the proximity substitution process. For example, the evaluation in the proximity substitution process may be determined to have converged if the number of times that the state of the communication device 10 that received the test data group DG generated by the proximity substitution process is determined to be normal reaches a predetermined number or more. Alternatively, for example, a method such as K-means may be used to analyze the similarity between test data groups DG, and if the data density within the clusters of the test data groups DG generated by the proximity permutation process exceeds a predetermined threshold, it may be determined that the evaluation has converged. Furthermore, when machine learning is used, for example, the gradient angle or extreme value may be calculated using the gradient method or Newton's method from the distance between the permuted data and the data value, and it may be determined that the evaluation has converged if it exceeds a predetermined threshold.

[0047] Fig. 8 is a schematic diagram illustrating an example of generating a test data group by random permutation. In the random permutation, the next test data group TG may be generated by mutation, as shown in the example of Fig. 8. Mutation refers to the inversion of a specific bit in a genetic sequence with a certain probability to become a different seed. In generating a test data group DG, as shown in the example of Fig. 8, mutation refers to the process of randomly permuting data D in the previous test data group DGa to generate the next test data group TGb.

[0048] The test data group generation unit 64 is not limited to using partial crossover in the proximity permutation process, and is not limited to using mutation in the random permutation process. In this case, it can be said that the test data group generation unit 64 does not need to use a genetic algorithm.

[0049] (effect) As described above, the data generation device 12 according to this embodiment includes a test data group generation unit 64 and a state determination unit 66. The test data group generation unit 64 generates a test data group DG for testing the operation of the communication device 10, which communicates by transmitting and receiving data groups according to a communication protocol. The state determination unit 66 determines the state of the communication device 10 when the communication device 10 receives the test data group DG. Furthermore, the test data group generation unit 64 generates a next test data group DG for testing the operation of the communication device 10 based on the determination result of the state of the communication device 10. When fuzzing a communication device 10 that receives data groups according to a communication protocol, it is necessary to appropriately generate the test data group DG. In contrast, the data generation device 12 according to this embodiment generates the next test data group DG based on the operational state of the communication device 10 in response to the previous test data group DG, thereby enabling appropriate generation of test data DG for fuzzing in accordance with the reaction of the communication device 10. Furthermore, since the communication device 10 transmits and receives data groups according to a communication sequence, the data structure of the data groups changes depending on the communication sequence. In contrast, the data generator 12 generates the next test data group DG based on the operating state of the communication device 10 for the previous test data group DG, so it can generate an appropriate test data group DG according to the communication sequence and perform appropriate fuzzing in real time.

[0050] Furthermore, the test data group generation unit 64 generates the next test data group DG by replacing at least a portion of the data D included in the previous test data group DG with other data. Since the data generation device 12 generates the next test data group DG by replacing a portion of the data, it can generate an appropriate test data group DG that conforms to the communication sequence, and can perform fuzzing appropriately in real time.

[0051] Furthermore, the test data group generation unit 64 performs a proximity substitution process in which data within a predetermined range of the replaced data in the immediately preceding test data group DG is selected as the replacement data, and the selected data is substituted for the immediately preceding test data group DG to generate the next test data group DG. By performing the proximity substitution process, the data generation device 12 can appropriately detect related errors.

[0052] Furthermore, the test data group generation unit 64 repeats the proximity substitution process, and when the determination of the state of the communication device 10 upon receiving each test data group DG generated by the proximity substitution process converges, the test data group generation unit 64 randomly selects data to be substituted from the data included in the immediately preceding test data group DG to generate the next test data group DG. By switching to random substitution process once the determination by the proximity substitution process converges, the data generation device 12 can appropriately detect unexpected errors.

[0053] Furthermore, the test data group generation unit 64 uses a genetic algorithm to generate the following test data group DG: By using a genetic algorithm, the data generation device 12 can generate an appropriate test data group DG in accordance with the communication sequence, and can perform fuzzing appropriately in real time.

[0054] The data generation device 12 further includes a replaceable information acquisition unit 62. The replaceable information acquisition unit 62 acquires information on replaceable data, which is data that can be replaced based on the communication protocol. The test data group generation unit 64 generates a test data group DG by replacing data included in the data group DG0 in which the communication device 10 operates normally with other data based on the replaceable data information. The data structure of the data group received by the communication device 10 changes depending on the communication sequence. Therefore, it is difficult to determine in advance which data to replace to generate the test data group DG. For example, if data to be replaced is selected randomly, data indicating the sender or destination address may be replaced, which could prevent the test data group DG from being delivered to the communication device 10. In contrast, the data generation device 12 acquires information on replaceable data identified based on the communication protocol and selects data to be replaced based on that information. This allows for the generation of an appropriate test data group DG in real time, even when the data structure changes depending on the communication sequence.

[0055] The data generation device 12 also includes a communication control unit 60. The communication control unit 60 transmits a test data group DG to the communication device 10, and receives a response data group DR that the communication device 10 transmits when it receives the test data group DG. The data generation device 12 can appropriately perform fuzzing on the communication device 10 by transmitting and receiving the data group using the communication control unit 60.

[0056] In this embodiment, the fuzzing system 1 includes two pieces of hardware: a monitoring device 14 that identifies a communication protocol, and a data generator 12 that executes fuzzing. However, the present invention is not limited to this, and any number of pieces of hardware may be used to implement the functions of the fuzzing system 1. For example, the data generator 12 may also have the functions of the monitoring device 14, thereby implementing the fuzzing system 1 with a single piece of hardware. Alternatively, the functions of the data generator 12 may be implemented with multiple pieces of hardware. In this case, for example, a data generator that generates test data DG and a fuzzing execution device that transmits the generated test data DG to the communication device 10 and executes fuzzing may be provided.

[0057] Although the embodiments of the present invention have been described above, the embodiments are not limited to the contents of these embodiments. Furthermore, the above-described components include those that can be easily imagined by a person skilled in the art, those that are substantially the same, and those that are within the so-called equivalent range. Furthermore, the above-described components can be appropriately combined, and the configurations of each embodiment can also be combined. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the spirit of the above-described embodiments. [Explanation of symbols]

[0058] 1. Fuzzing System 10. Communications equipment 12 Data generation device 14 Monitoring equipment 60 Communication control unit 62 Replaceable information acquisition part 64 Test data set generation unit 66 Status determination unit DG test data set

Claims

1. a test data group generation unit that generates a test data group for testing the operation of a communication device that communicates by transmitting and receiving a data group according to a communication protocol; a state determination unit that determines a state of the communication device when the communication device receives the test data group; Including, the test data group generation unit generates a next test data group for testing the operation of the communication device based on the determination result of the state of the communication device; the test data group generation unit generates a next test data group by replacing at least a part of data included in a previous test data group with other data; the test data group generation unit performs a proximity substitution process to select data within a predetermined range as replacement data for the replaced data in the immediately preceding test data group, and to replace the selected data included in the immediately preceding test data group to generate a next test data group; the test data group generation unit repeats the proximity substitution process, and when a determination of the state of the communication device upon receiving each test data group generated by the proximity substitution process converges, randomly selects data to be substituted from the data included in the previous test data group to generate a next test data group. Data generation device.

2. A data generation device, generating a test data set for testing the operation of a communication device that communicates by transmitting and receiving a data set according to a communication protocol; determining a state of the communication device when the communication device receives the test data set; generating a next set of test data for testing the operation of the communication device based on the determined state of the communication device; Including, In the step of generating the test data group, a next test data group is generated by replacing at least a part of data included in a previous test data group with other data; In the step of generating the test data group, data within a predetermined range of the replaced data in the immediately preceding test data group is selected as replacement data, and the selected data included in the immediately preceding test data group is replaced, thereby performing a proximity replacement process to generate a next test data group; In the step of generating the test data group, the proximity substitution process is repeated, and when the determination of the state of the communication device when receiving each test data group generated by the proximity substitution process converges, data to be substituted is randomly selected from data included in the previous test data group to generate a next test data group. Data generation method.

3. generating a test data set for testing the operation of a communication device that communicates by transmitting and receiving a data set according to a communication protocol; determining a state of the communication device when the communication device receives the test data set; generating a next set of test data for testing the operation of the communication device based on the determined state of the communication device; The computer executes the following. In the step of generating the test data group, a next test data group is generated by replacing at least a part of data included in a previous test data group with other data; In the step of generating the test data group, data within a predetermined range of the replaced data in the immediately preceding test data group is selected as replacement data, and the selected data included in the immediately preceding test data group is replaced, thereby performing a proximity replacement process to generate a next test data group; In the step of generating the test data group, the proximity substitution process is repeated, and when the determination of the state of the communication device when receiving each test data group generated by the proximity substitution process converges, data to be substituted is randomly selected from data included in the previous test data group to generate a next test data group. program.

Images