Fuzzing apparatus and fuzzing method

Abstract

The purpose of the present invention is to provide a technology capable of improving the efficiency of executing a fuzzing test. When a monitoring unit monitors that equipment to be tested has crashed for fuzzing that uses a plurality of fuzzes, the present invention: restarts the equipment to be tested, by means of a restart control unit; after restarting the equipment to be tested, executes, by means of a fuzzing execution unit, fuzzing that uses one or more fuzzes; and on the basis of the result of monitoring, by the monitoring unit, the fuzzing that uses the one or more fuzzes, identifies one or more fuzzes including a fuzz that causes the equipment to be tested to crash.

Description

Technical Field

[0001] The present disclosure relates to a fading device and a fading method.

Background Art

[0002] In order to discover unknown vulnerabilities in devices, an inspection method called fuzzing is known. Fuzzing is a test for confirming the vulnerability of a device by causing the device to execute fuzzes, which are data that are likely to cause problems in the device, and based on the occurrence or non-occurrence of abnormalities such as crashes of the device. By its nature, in this fuzzing, if an abnormality occurs in the device during the test, the test may not be able to be carried out normally until the end.

[0003] Therefore, for example, in Patent Document 1, a technique has been proposed in which the state of a device is monitored by a fuzzing agent, and when an abnormality occurs in the device, the output of the device information and the restart of the device are automatically performed. According to such a technique, the labor of monitoring the device by a person is reduced, and a series of fuzzing operations can be automatically carried out.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] However, in the prior art, it is not configured to automatically identify the fuzz that caused the test target device to crash. Therefore, when the test target device crashes, the implementer of the fuzzing test has to manually identify the fuzz that caused the crash, and there is room for improvement in the execution efficiency of the fuzzing test.

[0006] Therefore, this disclosure has been made in view of the above-mentioned problems, and aims to provide a technology that can improve the efficiency of fuzzing tests. [Means for solving the problem]

[0007] The fuzzing apparatus according to this disclosure comprises a fuzzing execution unit that performs fuzzing on a device under test, a monitoring unit that monitors whether or not the device under test has crashed, a restart control unit that restarts the device under test, and a fuzzing control unit that controls the fuzzing execution unit and the restart control unit. The fuzzing control unit causes the fuzzing execution unit to perform fuzzing using multiple fuzzes, and if the monitoring unit detects that the device under test has crashed, it causes the restart control unit to restart the device under test. After the device under test has restarted, the fuzzing control unit causes the fuzzing execution unit to perform fuzzing using one or more fuzzes, which are fewer than the number of fuzzes, and identifies the one or more fuzzes, including the fuzz that causes the device under test to crash, based on the monitoring results of the monitoring unit for the fuzzing using one or more fuzzes. [Effects of the Invention]

[0008] According to this disclosure, based on the monitoring results of the monitoring unit for fuzzing using one or more fuzzes, one or more fuzzes, including the fuzz that crashes the equipment under test, are identified, thereby improving the efficiency of performing fuzzing tests.

[0009] The purpose, features, aspects, and advantages of this disclosure will become clearer from the following detailed description and accompanying drawings. [Brief explanation of the drawing]

[0010] [Figure 1] This is a block diagram showing the configuration of the fuzzing apparatus according to Embodiment 1. [Figure 2] This is a flowchart showing the processing of the fuzzing apparatus according to Embodiment 1. [Figure 3] This is a flowchart showing the processing of the fuzzing apparatus according to Embodiment 1. [Figure 4] This is a flowchart showing the processing of the fuzzing apparatus according to Embodiment 2. [Figure 5] This is a flowchart showing the processing of the fuzzing apparatus according to Embodiment 2. [Figure 6] This is a block diagram showing the configuration of the monitoring unit according to Embodiment 3. [Figure 7] Block diagram showing the hardware configuration of a fuzzing device relating to other variations. [Figure 8] Block diagram showing the hardware configuration of a fuzzing device relating to other variations. [Modes for carrying out the invention]

[0011] <Embodiment 1> The fuzzing device 1 according to this embodiment 1 is an automatic fuzzing device capable of continuously performing fuzzing automatically. Figure 1 is a block diagram showing the configuration of the fuzzing device 1 according to this embodiment 1. The fuzzing device 1 in Figure 1 comprises a fuzzing control unit 11, a fuzzer 12 which is a fuzzing execution unit, a monitoring unit 13, a restart control unit 14, and a fuzz storage unit 15.

[0012] The fuzzing control unit 11 is connected to the father 12, the monitoring unit 13, and the restart control unit 14, and controls the father 12 and the restart control unit 14. The specific control of the fuzzing control unit 11 will be described later.

[0013] The fuzz memory unit 15 stores multiple predefined fuzzes. A fuzz is data that differs from the normal data expected in the program of the device under test 2, such as data that might cause problems for the device under test 2. Each of the multiple fuzzes may be assigned an identification number.

[0014] When the father 12 receives an instruction to start the test from the fuzzing control unit 11, it retrieves a plurality of fuzzes from the fuzz memory unit 15 and transmits the plurality of fuzzes to the device under test 2. Thereby, the father 12 executes fuzzing of the device under test 2 using the plurality of fuzzes. In the first embodiment, the fact that the fuzz is used for fuzzing is substantially the same as the fact that the fuzz is transmitted to the device under test 2, and the plurality of fuzzes are sequentially used one by one for fuzzing according to a predetermined order of the plurality of fuzzes.

[0015] The monitoring unit 13 communicates with the device under test 2 periodically and monitors the state of the device under test 2 such as whether the device under test 2 has crashed. For example, when no response is received from the device under test 2 even after a preset time has elapsed since the fuzzing of the device under test 2 was executed, the monitoring unit 13 notifies the fuzzing control unit 11 of the monitoring result that the device under test 2 has crashed. In the first embodiment, the monitoring of the monitoring unit 13 is relatively slow, and when the fuzzing control unit 11 receives the monitoring result of the crash, it is assumed that not only the fuzz that crashed the device under test 2 but also some subsequent fuzzes have been executed.

[0016] When the restart control unit 14 receives an instruction to restart from the fuzzing control unit 11, it restarts the device under test 2.

[0017] Next, the fuzzing control unit 11 that controls the father 12 and the restart control unit 14 will be described. The fuzzing control unit 11 causes the father 12 to execute fuzzing using a plurality of fuzzes. While such fuzzing is being executed, the monitoring unit 13 periodically monitors whether the device under test 2 has crashed.

[0018] When the monitoring unit 13 monitors that the device under test 2 has crashed, the fading control unit 11 causes the restart control unit 14 to restart the device under test 2. In the first embodiment, when it is monitored that the device under test 2 has crashed, the fading control unit 11 controls not only the restart of the device under test 2 but also the fader 12 so that the fader 12 stops executing the fading of the device under test 2.

[0019] After the device under test 2 is restarted, the fading control unit 11 causes the fader 12 to execute fading using one or more fades that are fewer than the plurality of fades already executed. In the following description, in order to distinguish between a plurality of fades and one or more fades that are fewer than the plurality of fades, the latter fades may be referred to as "one or more re-execution fades".

[0020] In the first embodiment, the one or more re-execution fades used after the device under test 2 is restarted include the first fade to the second fade in the order in which the plurality of fades are sequentially used for fading.

[0021] The first fade is the fade used for fading when the monitoring unit 13 monitors that the device under test 2 has crashed. For example, the first fade is the fade used for fading at the time when the crash of the device under test 2 is monitored by the monitoring unit 13, or the fade used for fading at the time closest to that time.

[0022] The second fade is the fade used for fading a predetermined time before the time when the first fade is used for fading. For the predetermined time, for example, a time sufficient to include the fade that causes the device under test 2 to crash from the first fade to the second fade is applied. In the following description, the fade that causes the device under test 2 to crash may also be referred to as the "causal fade".

[0023] The fuzzing control unit 11 identifies one or more re-execution fuzzes, including the causative fuzz, based on the monitoring results of the monitoring unit 13 for fuzzing using one or more re-execution fuzzes.

[0024] In this embodiment 1, the fuzzing control unit 11 makes the time interval for using one or more re-executed fuzzes longer than the time interval for using fuzzing with multiple fuzzes. In other words, with respect to the transmission rate of fuzz from the fuzzer 12 to the device under test 2, the fuzzing control unit 11 makes the transmission rate of one or more re-executed fuzzes lower than the transmission rate of multiple fuzzes that have already been executed. This makes it possible to make the time between transmitting one fuzz and transmitting the next fuzz sufficiently long, so that the causative fuzz can be identified even if the monitoring unit 13 is relatively slow to monitor.

[0025] The fuzzing control unit 11 may record or output the causative fuzz when it has identified it. Furthermore, when the fuzzing control unit 11 identifies the causative fuzz, it increases the fuzz transmission rate and then returns it to the original transmission rate, causing the fuzzer 12 to perform fuzzing using the fuzz following the first fuzz. With this configuration, the transmission rate is lowered only when one or more re-executed fuzzes, including the causative fuzz, are identified, thereby improving the efficiency of the fuzzing test.

[0026] Figure 2 is a flowchart showing the processing of the fuzzing device 1 according to this embodiment 1. In the following description, it is assumed that the time interval at which the monitoring unit 13 can identify a single fuzz that will crash the device under test 2 is 1 [s], and that the fuzz storage unit 15 stores N fuzzes.

[0027] In step S1, the fuzzing control unit 11 sets the transmission rate r[ / s] of the fuzzer 12 to the transmission rate R (where R>1)[ / s] specified by the user of the fuzzing device 1.

[0028] In step S2, the fuzzing control unit 11 sets the number of fuzz signals transmitted by the fuzzer 12, cnt, to 0.

[0029] In step S3, the fuzzing control unit 11 sets the 0th fuzz to the fuzzer 12.

[0030] In step S4, the fuzzing control unit 11 waits for 1 / r[s], which is the period during which the fuzzer 12 should transmit one fuzz signal.

[0031] In step S5, the fuzzing control unit 11 determines whether the number of fuzzes cnt transmitted by the fuzzer 12 matches the total number N of fuzzes to be transmitted. If they match, the process shown in Figure 2 ends; otherwise, the process proceeds to step S6.

[0032] In step S6, the fuzzing control unit 11 instructs the fuzz set in the fuzzer 12 to transmit the fuzz signal to the device under test 2.

[0033] In step S7, the fuzzing control unit 11 increments the number of fuzz signals cnt transmitted by the fuzzer 12.

[0034] In step S8, the fuzzing control unit 11 sets the fuzz to the next fuzz after the transmitted fuzz, i.e., the cnt-th fuzz that was changed in step S7, on the fuzzer 12.

[0035] In step S9, the fuzzing control unit 11 determines whether or not it has received notification from the monitoring unit 13, that is, whether or not the crash of the equipment under test 2 has been monitored by the monitoring unit 13. If it is determined that the crash has been monitored, the process proceeds to step S10; otherwise, the process returns to step S4.

[0036] In step S10, the fuzzing control unit 11 performs a process to narrow down the causative fuzz. After that, the process returns to step S4.

[0037] Figure 3 is a flowchart showing the process of narrowing down the causative fuzz, which is performed in step S10 of Figure 2.

[0038] In step S21, the fuzzing control unit 11 controls the fuzzer 12 to stop transmitting fuzz.

[0039] In step S22, the fuzzing control unit 11 instructs the restart control unit 14 to restart the equipment under test 2.

[0040] In step S23, the fuzzing control unit 11 sets the transmission rate r[ / s] of the fuzzer 12 to 1. In other words, the fuzzing control unit 11 lowers the transmission rate of the fuzzer 12 until the time interval allows the monitoring unit 13 to identify a single fuzz that crashes the device under test 2.

[0041] In step S24, the fuzzing control unit 11 sets the (cnt-R×m)th fuzz to the fuzzer 12. The cntth fuzz corresponds to the first fuzz, the (cnt-R×m)th fuzz corresponds to the second fuzz, and m corresponds to a predetermined time that defines the second fuzz.

[0042] In step S25, the fuzzing control unit 11 waits for 1 / r[s], which is the period during which the fuzzer 12 should transmit one fuzz signal.

[0043] In step S26, the fuzzing control unit 11 determines whether the (cnt+1)th fuzz, that is, the fuzz following the first fuzz, is set in the fuzzer 12. If it is determined that the (cnt+1)th fuzz is set, the process proceeds to step S32; otherwise, the process proceeds to step S27.

[0044] In step S27, the fuzzing control unit 11 instructs the fuzz set in the fuzzer 12 to transmit the fuzz signal to the device under test 2.

[0045] In step S28, the fuzzing control unit 11 determines whether or not a crash of the equipment under test 2 was monitored by the monitoring unit 13. If it is determined that a crash was monitored, the process proceeds to step S29; otherwise, the process proceeds to step S31.

[0046] In step S23, the transmission rate of the fuzzer 12 is changed to a time interval that allows the monitoring unit 13 to identify a single fuzz that crashes the device under test 2. Therefore, in step S29, the fuzzing control unit 11 identifies the last transmitted fuzz as the causative fuzz and records it.

[0047] In step S30, the fuzzing control unit 11 instructs the restart control unit 14 to restart the equipment under test 2.

[0048] In step S31, the fuzzing control unit 11 sets the next fuzz to the fuzzer 12 after the transmitted fuzz. Then the process returns to step S25.

[0049] If the process proceeds from step S26 to step S32, the fuzzing control unit 11 returns the transmission rate r[ / s] of the fuzzer 12 back to R[ / s]. After that, the process shown in Figure 3 is completed. Note that in the process shown in Figure 3, cnt itself is not changed, so after step S10 in Figure 2, fuzzing is performed using the next fuzz after the cnt-th fuzz.

[0050] <Summary of Embodiment 1> According to the fuzzing device 1 of this embodiment 1 described above, when a crash of the device under test 2 is monitored by the monitoring unit 13, the device under test 2 is restarted, and then fuzzing is performed using one or more re-executed fuzzes. Based on the monitoring results of the monitoring unit 13, one or more re-executed fuzzes, including the causative fuzz, are identified. With this configuration, it is possible to identify one or more re-executed fuzzes, including the causative fuzz, which is fewer than the number of fuzzes. Therefore, the task of manually identifying the causative fuzz by the user of the fuzzing device 1 can be reduced, and the efficiency of the fuzzing test can be increased. Note that the condition that one or more re-executed fuzzes is fewer than the number of fuzzes does not always need to be true; it is sufficient if there is a possibility that this condition will be true.

[0051] <Embodiment 2> The block diagram showing the configuration of the fuzzing device 1 according to this second embodiment is the same as that of Figure 1. Hereinafter, among the components of this second embodiment, components that are the same as or similar to the components described above will be denoted by the same or similar reference numerals, and the different components will be described mainly.

[0052] In this second embodiment, the fuzzing control unit 11 causes the fuzzer 12 to transmit all fuzzes stored in the fuzz memory unit 15 to the device under test 2. Then, similar to the first embodiment, the fuzzing control unit 11 restarts the device under test 2 when a crash of the device under test 2 is detected by the monitoring unit 13, and then performs fuzzing using one or more re-executed fuzzes, and identifies one or more re-executed fuzzes, including the causative fuzz, based on the monitoring results of the monitoring unit 13.

[0053] In this embodiment 2, one or more re-executed fuzzes selectively include the first fuzz (1st fuzz) up to the second fuzz corresponding to half of the multiple fuzzes, and the third fuzz following the second fuzz up to the last fourth fuzz, in the sequence in which the multiple fuzzes are used sequentially for fuzzing. Furthermore, if the number of multiple fuzzes is even, the second fuzz is the fuzz that is half of the multiple fuzzes, and if the number of multiple fuzzes is odd, the second fuzz is the fuzz immediately before or after half of the multiple fuzzes. The fuzzing control unit 11 recursively performs the above series of processes to identify one or more re-executed fuzzes, including the factor fuzz, using a method similar to binary search.

[0054] In this second embodiment, if it is detected that the device under test 2 has crashed, the fuzzing control unit 11 will not allow the fuzzer 12 to stop fuzzing the device under test 2.

[0055] Figure 4 is a flowchart showing the processing of the fuzzing device 1 according to this second embodiment. In the following description, it is assumed that the time interval at which the monitoring unit 13 can identify a single fuzz that will crash the device under test 2 is 1 [s], and that the fuzz storage unit 15 stores N fuzzes.

[0056] In step S41, the fuzzing control unit 11 sets the transmission rate r[ / s] of the fuzzer 12 to the transmission rate R (where R>1)[ / s] specified by the user of the fuzzing device 1.

[0057] In step S42, the fuzzing control unit 11 calls a filtering flow to narrow down the causative fuzz, taking 1 and N as arguments. After that, the process shown in Figure 4 is completed.

[0058] Figure 5 is a flowchart showing the process of narrowing down the causative fuzz, which is performed in step S42 of Figure 4. In the following description, the call name for the process in Figure 5 is "narrowing down", and the process in Figure 5 takes n, which represents the first in the sequence of fuzzes to be narrowed down, and m, which represents the last (where n ≤ m), as arguments.

[0059] In step S51, the fuzzing control unit 11 determines whether n and m are equal. If they are found to be equal, the process proceeds to step S57; otherwise, the process proceeds to step S52.

[0060] In step S52, the fuzzing control unit 11 causes the fuzzer 12 to transmit the nth to mth fuzzes at a transmission rate r[ / s] to the device under test 2.

[0061] In step S53, the fuzzing control unit 11 determines whether the test equipment 2 has crashed as a result of fuzzing using the nth to mth fuzzes, and whether the crash has been monitored by the monitoring unit 13. If it is determined that a crash has been monitored, the process proceeds to step S54. If it is not determined that a crash has been monitored, the process shown in Figure 5 ends, and the process returns to the process that called the filtering flow.

[0062] In step S54, the fuzzing control unit 11 instructs the restart control unit 14 to restart the equipment under test 2.

[0063] In step S55, the fuzzing control unit 11 calls a filtering flow with n and m / 2 as arguments. This recursively performs a filtering flow with the nth fuzz corresponding to the first fuzz and the m / 2 fuzz corresponding to the second fuzz as arguments.

[0064] In step S56, the fuzzing control unit 11 calls a filtering flow with (m / 2+1) and m as arguments. This recursively performs a filtering flow with the (m / 2+1)th fuzz corresponding to the third fuzz and the mth fuzz corresponding to the fourth fuzz as arguments. After that, the process shown in Figure 5 is completed, and the process returns to the one that called the filtering flow.

[0065] If the process proceeds from step S51 to step S57, the fuzzing control unit 11 causes the fuzzer 12 to transmit the nth fuzz at a transmission rate r[ / s] to the device under test 2.

[0066] In step S58, the fuzzing control unit 11 determines whether the test equipment 2 has crashed as a result of fuzzing using the nth fuzz, and whether the monitoring unit 13 has detected the crash. If it is determined that a crash has been detected, the process proceeds to step S59. If it is determined that a crash has not been detected, the process shown in Figure 5 ends, and the process returns to the process that called the filtering flow.

[0067] In step S59, the fuzzing control unit 11 identifies the nth fuzz as the causative fuzz and records the causative fuzz.

[0068] In step S60, the fuzzing control unit 11 instructs the restart control unit 14 to restart the device under test 2. After that, the process shown in Figure 5 is completed, and the process returns to the one that called the filtering flow.

[0069] <Summary of Embodiment 2> According to the fuzzing device 1 of this second embodiment described above, when a crash of the equipment under test 2 is monitored by the monitoring unit 13, the equipment under test 2 is restarted, and then fuzzing is performed using one or more re-execution fuzzes. Based on the monitoring results of the monitoring unit 13, one or more re-execution fuzzes, including the causative fuzz, are identified. With this configuration, similar to the first embodiment, the user of the fuzzing device 1 can reduce the amount of work required to manually identify the causative fuzz, thereby increasing the efficiency of the fuzzing test.

[0070] Furthermore, in this second embodiment, one or more re-execution fuzzes, including the factor fuzz, are identified using a method similar to binary search, thus reducing the number of monitoring cycles performed by the monitoring unit 13.

[0071] <Embodiment 3> The block diagram showing the configuration of the fuzzing apparatus 1 according to this third embodiment is generally the same as that of Figure 1. Hereinafter, among the components of this third embodiment, components that are the same as or similar to the components described above will be denoted by the same or similar reference numerals, and the different components will be described mainly.

[0072] In this third embodiment, the monitoring unit 13 monitors whether the response from the device under test 2 is normal. The fuzzing control unit 11 causes the fuzzer 12 to send all the fuzzes stored in the fuzz memory unit 15 to the device under test 2. Then, if the monitoring unit 13 detects that the response from the device under test 2 is abnormal, the fuzzing control unit 11 restarts the device under test 2. After that, the fuzzing control unit 11 performs fuzzing using one or more re-execution fuzzes and identifies one or more re-execution fuzzes, including the fuzz that causes the response from the device under test 2 to be abnormal, based on the monitoring results from the monitoring unit 13.

[0073] Figure 6 is a block diagram showing the configuration of the monitoring unit 13 of the fuzzing device 1 according to this third embodiment. The monitoring unit 13 in Figure 6 includes a monitoring control unit 131, a packet generation unit 132, a packet transmission / reception unit 133, and an anomaly determination unit 134.

[0074] The monitoring control unit 131 controls the monitoring. The packet generation unit 132 generates arbitrary packets under control from the monitoring control unit 131. The packet transmission / reception unit 133 transmits the packets generated by the packet generation unit 132 to the device under test 2 and receives packets from the device under test 2. The abnormality determination unit 134 determines whether the response from the device under test 2 is abnormal based on the information of the packets received by the packet transmission / reception unit 133. The monitoring unit 13 configured in this way is capable of performing the following first to third monitoring.

[0075] <1st monitoring> The monitoring unit 13's monitoring includes sequentially sending packets to the device under test 2 at arbitrary intervals and monitoring whether a response is received from the device under test 2 within a predetermined response time. The monitoring unit 13 determines that the response is normal if a response is received within the time, and determines that the response is abnormal if a response is not received within the time. This configuration will be described in detail below.

[0076] The anomaly detection unit 134 defines a threshold for the response time to the transmitted bucket. The monitoring control unit 131 notifies the packet generation unit 132 of the generation of a packet, and the packet generation unit 132 generates the packet upon receiving the notification. The packet generation unit 132 sequentially outputs the generated packet to the packet transmission / reception unit 133, and the packet transmission / reception unit 133 sequentially transmits the packet to the device under test 2. Simultaneously with transmitting the packet to the device under test 2, the packet transmission / reception unit 133 notifies the anomaly detection unit 134 of the packet transmission time. Subsequently, the packet transmission / reception unit 133, having received a response from the device under test 2, notifies the anomaly detection unit 134 of the packet reception time. The anomaly detection unit 134 calculates the response time of the device under test 2 from the packet transmission time and reception time, and compares the response time with a predefined threshold. The anomaly detection unit 134 then determines that the response from the device under test 2 is normal if the response time is less than the threshold, and that the response from the device under test 2 is abnormal if it is greater than the threshold.

[0077] <Second monitoring> The monitoring unit 13's monitoring includes checking whether the test device 2 is sending a response indicating the correct content to the packets transmitted from the packet transmission / reception unit 133. The monitoring unit 13 determines that the response is normal as long as the packet transmission / reception unit 133 is sending a response indicating the correct content, and determines that the response is abnormal as long as the response deviates from the correct content. This configuration will be described in detail below.

[0078] The anomaly detection unit 134 pre-defines and maintains a table of correct response combinations for the content of transmitted packets. The monitoring control unit 131 notifies the packet generation unit 132 of the generation of a packet, and the packet generation unit 132 generates the packet upon receiving the notification. The packet generation unit 132 sequentially outputs the generated packet to the packet transmission / reception unit 133, and the packet transmission / reception unit 133 sequentially transmits the packet to the device under test 2. Subsequently, the packet transmission / reception unit 133, having received the response from the device under test 2, i.e., the packet, outputs the received packet to the anomaly detection unit 134. The anomaly detection unit 134 refers to the pre-defined table and checks whether there is a correspondence between the content of the transmitted packet and the content of the received packet. Then, the anomaly detection unit 134 determines that the response from the device under test 2 is normal if there is a correspondence, and determines that the response from the device under test 2 is abnormal if there is no correspondence.

[0079] <3rd monitoring> The monitoring unit 13's monitoring includes checking whether the device under test 2 is sending a response indicating a correct communication state transition. The monitoring unit 13 determines that the response is normal when the device under test 2 is sending a response indicating a correct state transition via communication, and determines that the response is abnormal when the device under test 2 is sending a response indicating an inappropriate state transition. This configuration will be described in detail below.

[0080] The anomaly detection unit 134 pre-defines the order of packets to be sent to the device under test 2 and the correct order of responses to them, and maintains this in a table. The monitoring control unit 131 notifies the packet generation unit 132 to generate a packet corresponding to the current state according to the table. The packet generation unit 132 generates a packet corresponding to the current state. The packet generation unit 132 sequentially outputs the generated packets to the packet transmission / reception unit 133, and the packet transmission / reception unit 133 sequentially transmits the packets to the device under test 2. Subsequently, the packet transmission / reception unit 133, having received a response from the device under test 2, i.e., a packet, outputs the received packet to the anomaly detection unit 134. The anomaly detection unit 134 refers to the pre-defined table and checks whether the response has arrived in the correct content and order for the transmitted packets. The anomaly detection unit 134 then determines that the response from the device under test 2 is normal if the response has the correct content and order, and that the response from the device under test 2 is abnormal if the response has incorrect content and order.

[0081] <Summary of Embodiment 3> According to the fuzzing device 1 of this embodiment 3 described above, if the monitoring unit 13 detects that the response from the device under test 2 is abnormal, the device under test 2 is restarted, and then fuzzing is performed using one or more re-executed fuzzes. Based on the monitoring results of the monitoring unit 13, one or more re-executed fuzzes, including the causative fuzz, are identified. With this configuration, similar to embodiments 1 and 2, the user of the fuzzing device 1 can reduce the work required to manually identify the causative fuzz, thereby improving the efficiency of the fuzzing test.

[0082] Furthermore, in this embodiment 3, it is possible to handle cases that could not be detected in embodiments 1 and 2, such as when the device under test 2 has not crashed, but there is an abnormality in the response from the device under test 2, thus enabling more accurate testing.

[0083] <Other variations> The father 12, monitoring unit 13, restart control unit 14, and fuzzing control unit 11 shown in Figure 1 above will be referred to as "father 12, etc." below. The father 12, etc. is implemented by the processing circuit 81 shown in Figure 7. Specifically, the processing circuit 81 includes a father 12 that performs fuzzing on the device under test 2, a monitoring unit 13 that monitors whether or not the device under test 2 has crashed, a restart control unit 14 that restarts the device under test 2, and a fuzzing control unit 11 that controls the father 12 and the restart control unit 14 as described above. Dedicated hardware may be applied to the processing circuit 81, or a processor that executes a program stored in memory may be applied. Examples of processors include central processing units, processing units, arithmetic units, microprocessors, microcomputers, and DSPs (Digital Signal Processors).

[0084] If the processing circuit 81 is dedicated hardware, it may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. Each function of the father 12 and other parts may be implemented by a circuit with distributed processing circuits, or the functions of each part may be implemented by a single processing circuit.

[0085] When the processing circuit 81 is a processor, the functions of the fuzzer 12, etc., are realized in combination with software, etc. Software, etc., may include, for example, software, firmware, or both. The software, etc., is written as a program and stored in memory. As shown in Figure 8, the processor 82 applied to the processing circuit 81 realizes the functions of each part by reading and executing the program stored in memory 83. That is, the fuzzing device 1, when executed by the processing circuit 81, includes memory 83 for storing a program that will ultimately execute the following steps: executing fuzzing using multiple fuzzes; restarting the device under test 2 if it is monitored to be crashed; executing fuzzing using one or more fuzzes, fewer than the total number of fuzzes, after the device under test 2 has been restarted; and identifying one or more fuzzes, including the fuzz that causes the device under test 2 to crash, based on the monitoring results for the crash of the device under test 2. In other words, this program can be said to cause the computer to execute the procedures and methods of the fuzzer 12, etc. Here, memory 83 may be, for example, non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read Only Memory), HDD (Hard Disk Drive), magnetic disk, flexible disk, optical disk, compact disk, minidisc, DVD (Digital Versatile Disc), their drive devices, or any storage medium used in the future.

[0086] The above describes a configuration in which each function of Father 12, etc., is realized by either hardware or software. However, this is not the only configuration; some parts of Father 12, etc., may be realized by dedicated hardware, and other parts by software. For example, Father 12 can be realized by a processing circuit 81 as dedicated hardware, while the other functions can be realized by a processing circuit 81 as a processor 82 reading and executing a program stored in memory 83.

[0087] As described above, the processing circuit 81 can realize each of the above-mentioned functions by hardware, software, or a combination thereof. The same applies to embodiments 2 and 3.

[0088] Furthermore, it is possible to freely combine each embodiment and each variation, or to modify or omit each embodiment and each variation as appropriate.

[0089] The above explanation is illustrative and not limiting in all respects. It should be understood that countless variations not illustrated are conceivable. [Explanation of Symbols]

[0090] 1 Fuzzing device, 2 Equipment under test, 11 Fuzzing control unit, 12 Fuzzer, 13 Monitoring unit, 14 Restart control unit.

Claims

1. A fuzzing execution unit that performs fuzzing on the equipment under test, A monitoring unit that monitors whether or not the equipment under test has crashed, A restart control unit for restarting the equipment under test, The fuzzing execution unit and the fuzzing control unit that controls the restart control unit Equipped with, The fuzzing control unit, The fuzzing operation unit is made to perform the fuzzing using multiple fuzzes. If the monitoring unit detects that the equipment under test has crashed, the restart control unit will instruct the equipment under test to restart. After restarting the equipment under test, the fuzzing execution unit is instructed to perform the fuzzing using one or more fuzzes from the plurality of fuzzes, which is fewer than the plurality of fuzzes. A fuzzing device that identifies one or more fuzzes, including one that crashes the equipment under test, based on the monitoring results of the monitoring unit for the fuzzing using the one or more fuzzes.

2. A fuzzing apparatus according to claim 1, The one or more fuzz devices mentioned above are A fuzzing device in which the plurality of fuzzes are used sequentially for fuzzing, including a first fuzz used for fuzzing when the monitoring unit detects that the equipment under test is crashing, up to a second fuzz used for fuzzing at a predetermined time before the first fuzz was used for fuzzing.

3. A fuzzing apparatus according to claim 1 or claim 2, The fuzzing control unit, A fuzzing device that makes the time interval in which one or more fuzzes are used longer than the time interval in which multiple fuzzes are used.

4. A fuzzing apparatus according to claim 1, The one or more fuzz devices mentioned above are A fuzzing device in which the sequence in which the plurality of fuzzes are used sequentially for the fuzzing selectively includes the first fuzz to the second fuzz corresponding to half of the plurality of fuzzes, and the third fuzz following the second fuzz to the last fourth fuzz.

5. A fuzzing method for performing fuzzing on a device under test, The fuzzing execution unit performs the fuzzing using multiple fuzzes, If the restart control unit detects that the device under test has crashed, it restarts the device under test. After the test equipment is restarted, the fuzzing execution unit performs the fuzzing using one or more fuzzes from the plurality of fuzzes, which is fewer than the plurality of fuzzes. A fuzzing method in which a fuzzing control unit identifies one or more fuzzes, including a fuzz that causes the device under test to crash, based on the results of monitoring whether the device under test is crashing with respect to the fuzzing using the one or more fuzzes.

6. A fuzzing execution unit that performs fuzzing on the equipment under test, A monitoring unit that monitors whether the response from the equipment under test is normal, A restart control unit for restarting the equipment under test, The fuzzing execution unit and the fuzzing control unit that controls the restart control unit Equipped with, The fuzzing control unit, The fuzzing operation unit is made to perform the fuzzing using multiple fuzzes. If the monitoring unit detects that the response from the equipment under test is abnormal, the restart control unit will restart the equipment under test. After restarting the equipment under test, the fuzzing execution unit is instructed to perform the fuzzing using one or more fuzzes from the plurality of fuzzes, which is fewer than the plurality of fuzzes. A fuzzing device that identifies one or more fuzzes, including one that causes an abnormal response from the equipment under test, based on the monitoring results of the monitoring unit for the fuzzing using the one or more fuzzes.

7. A fuzzing apparatus according to claim 6, The monitoring of the aforementioned monitoring unit is To monitor whether a response is received within a predetermined time from the device under test, from which packets are sequentially transmitted. To monitor whether a response indicating the correct content is received from the aforementioned test equipment, and, To monitor whether the device under test is receiving a response indicating a correct state transition. A fuzzing apparatus comprising at least one of the following.

Images