Fuzz test device, fuzz test method, and fuzz test program

Abstract

An object of the present invention is to provide a fuzz test device, a fuzz test method, and a fuzz test program that can suppress interruptions of a fuzz test. The fuzz test device 1 is a device that performs fuzz testing on a test target device 3 that disconnects when normal data is not transmitted within a specified time interval, and is equipped with a fuzz test execution unit 14 that transmits fuzz data and normal data to the test target device 3, and the fuzz test execution unit transmits the normal data to the test target device 3 at least once every specified time interval.

Description

[Technical field]

[0001] The present disclosure relates to a fuzz test device, a fuzz test method, and a fuzz test program. [Background technology]

[0002] Conventional attack control devices are equipped with an attack command unit that resumes a multi-stage attack from the attack command that established an interrupted session in order to shorten the time required for testing to detect vulnerabilities and improve detection accuracy (e.g., Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2023-101201 A Summary of the Invention [Problem to be solved by the invention]

[0004] In conventional technology, a multi-stage attack may be interrupted midway. If the attack is interrupted, it must be restarted, which requires time and effort. Some test target devices may disconnect if normal data is not sent within a specified time interval. For example, if only fuzzing data is sent continuously to the test target device in a fuzzing test, the test target device will determine that a problem has occurred with the communication partner because normal data is not being sent, and will cut the connection. This will interrupt the fuzzing test. Thus, there was a problem in that the fuzzing test would be interrupted when the test target device disconnected.

[0005] The present disclosure has been made to solve the above-mentioned problems, and aims to provide a fuzz test device, a fuzz test method, and a fuzz test program that can suppress interruption of a fuzz test due to disconnection. [Means for solving the problem]

[0006] The fuzz test device according to the present disclosure performs a fuzz test on a test target device that is disconnected when normal data is not transmitted within a predetermined time interval, and includes a fuzz test execution unit that transmits fuzz data and normal data to the test target device. a time measurement unit that measures the elapsed time from when the fuzzing test execution unit transmits normal data to the test target device; , and the fuzz test execution unit is Based on the time measured by the time measurement unit, each time a predetermined time shorter than the predetermined time interval has elapsed Send normal data to the device under test. The fuzz test device of the present disclosure is a fuzz test device that performs a fuzz test on a test target device that is disconnected when normal data is not transmitted within a specified time interval, and includes a fuzz test execution unit that transmits fuzzing data and normal data to the test target device, a time measurement unit that measures the elapsed time since the fuzz test execution unit transmitted the normal data to the test target device, and a transmission flag setting unit that sets a flag indicating that normal data has been transmitted, wherein the fuzz test execution unit transmits the normal data to the test target device at least once within each specified time interval, and when the transmission flag setting unit has set a flag indicating that normal data has been transmitted, the fuzz test execution unit does not transmit the normal data to the test target device, and the transmission flag setting unit clears the flag indicating that normal data has been transmitted based on the time measured by the time measurement unit.

[0007] A fuzz testing method according to the present disclosure is a fuzz testing method for fuzz testing a test target device that disconnects when normal data is not transmitted within a predetermined time interval, the method comprising: transmitting fuzz data to the test target device; The time elapsed since the normal data was transmitted to the test target device is measured, and based on the elapsed time, each time a predetermined time shorter than the predetermined time interval has elapsed, Normal data is sent to the device under test.

[0008] A fuzz test program according to the present disclosure is a fuzz test program for fuzz testing a test target device that disconnects when normal data is not transmitted within a predetermined time interval, the program including the steps of: transmitting fuzz data to the test target device; The time elapsed since the normal data was transmitted to the test target device is measured, and based on the elapsed time, each time a predetermined time shorter than the predetermined time interval has elapsed, Normal data is sent to the device under test. Effect of the Invention

[0009] According to the present disclosure, interruption of fuzz testing due to disconnection can be suppressed. [Brief description of the drawings]

[0010] [Figure 1] 1 is a schematic diagram showing a configuration of a fuzzing test device and its surroundings in a first embodiment. [Diagram 2] 2 is a block diagram showing the functions of the fuzzing test device in the first embodiment. FIG. [Diagram 3] 1 is a block diagram showing a hardware configuration of a fuzzing test device in a first embodiment. [Figure 4] 2 is a block diagram showing functions of a test target device according to the first embodiment. FIG. [Diagram 5] 6 is a flowchart showing an operation of the test target device in the first embodiment to disconnect the fuzzing test device. [Figure 6] FIG. 4 is a diagram showing a structure of frame format information in the first embodiment. [Figure 7] FIG. 2 is a diagram showing a configuration of fuzzing test scenario information in the first embodiment. [Figure 8] 13 is a diagram showing an example of description of fuzz test scenario information in the first embodiment. FIG. [Figure 9] 3 is a schematic diagram illustrating a frame format, normal data, and fuzzing data in the first embodiment. [Figure 10] 11 is a flowchart showing the operation of a fuzzing test in the first embodiment. [Figure 11] 1 is a schematic diagram showing a process of transmitting normal data and fuzzing data in the first embodiment. FIG. [Figure 12] 5 is a flowchart showing an operation of a data transmission process by the fuzzing test device in the first embodiment. [Figure 13] FIG. 11 is a block diagram showing the functions of a fuzzing test device in a second embodiment. [Figure 14] FIG. 11 is a schematic diagram showing a process of transmitting normal data and fuzzing data in the second embodiment. [Figure 15] 13 is a flowchart showing the operation of a data transmission process by the fuzzing test device in the second embodiment. [Figure 16] FIG. 11 is a block diagram showing the functions of a fuzzing test device according to a third embodiment. [Figure 17] FIG. 11 is a schematic diagram showing a process of transmitting normal data and fuzzing data in the third embodiment. [Figure 18] 13 is a flowchart showing the operation of a data transmission process by the fuzzing test device in the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Embodiment 1 The following describes the configuration of a fuzz test device 1 in the embodiment 1. Fig. 1 is a schematic diagram showing the configuration of a fuzz test device 1 and its surroundings in the embodiment 1.

[0012] A fuzz test device 1 is connected to a test target device 3 via a network 2, and performs a fuzz test on the test target device 3. A fuzz test is a test for verifying the vulnerability of a device by providing the target device with data that is likely to cause the device to behave abnormally.

[0013] The fuzzing test equipment 1 transmits normal data and fuzzing data to the test target device 3. The fuzzing test equipment 1 transmits normal data to the test target device 3 at least once within each predetermined time interval. The normal data is data that conforms to the frame format of the communication protocol used by the test target device 3. The normal data is data that is normally assumed to be normal, and causes the test target device 3 to operate normally. The fuzzing data is abnormal data that is normally not assumed, and may cause malfunctions in the operation of the test target device 3.

[0014] The test target device 3 is a device that is the subject of the fuzz test. The test target device 3 disconnects when normal data is not transmitted within a predetermined time interval. Disconnection refers to a state in which a communication device connected to a network is no longer a communication target. Disconnection occurs, for example, when an abnormality occurs in a communication device in the network. When normal data is not transmitted from the fuzz test device 1 within a predetermined time interval, the test target device 3 determines that a problem has occurred in the fuzz test device 1, which is the communication partner, and cuts off the connection. In other words, the test target device 3 disconnects the fuzz test device 1. If the connection is disconnected during the execution of a fuzz test, the fuzz test is interrupted.

[0015] The functions of the fuzz test device 1 in the first embodiment will be described. Fig. 2 is a block diagram showing the functions of the fuzz test device 1 in the first embodiment. The fuzz test device 1 has a storage unit 11, a normal data generation unit 12, a fuzzing data generation unit 13, and a fuzzing test execution unit 14. The storage unit 11 stores frame format information 15 including information on a format for generating normal data, and fuzzing test scenario information 16 including information for generating fuzzing data.

[0016] The normal data generation unit 12 generates normal data based on the frame format information 15 and the fuzzing test scenario information 16. The fuzzing data generation unit 13 generates fuzzing data based on the frame format information 15 and the fuzzing test scenario information 16. The fuzzing test execution unit 14 transmits the normal data generated by the normal data generation unit 12 and the fuzzing data generated by the fuzzing data generation unit 13 to the test target device 3 via the network 2, and executes the fuzzing test.

[0017] The following describes the hardware configuration of the fuzz test device 1 in the embodiment 1. Fig. 3 is a block diagram showing the hardware configuration of the fuzz test device 1. The fuzz test device 1 is realized by a computer such as a personal computer or a microcontroller.

[0018] The fuzzing test device 1 includes a bus 21, a processor 22, a memory 23, an interface 24, and a secondary storage device 25. The processor 22, the memory 23, the interface 24, and the secondary storage device 25 are connected to each other via the bus 21.

[0019] The processor 22 is, for example, a CPU (Central Processing Unit). The processor 22 loads an operation program stored in the secondary storage device 25 into the memory 23 and executes the program, thereby implementing each function of the fuzz test device 1.

[0020] The memory 23 is a main storage device constituted by, for example, a RAM (Random Access Memory). The memory 23 stores the program read by the processor 22 from the secondary storage device 25. The memory 23 functions as a work memory when the processor 22 executes the program.

[0021] The interface 24 is an I / O (Input / Output) interface such as a serial port, a USB (Universal Serial Bus) port, a network interface, etc. Communication with the test target device 3 is performed via the interface 24.

[0022] The secondary storage device 25 is, for example, a flash memory, a hard disk drive (HDD), or a solid state drive (SSD). The secondary storage device 25 stores various information necessary for the operation of the fuzzing test device 1 and programs executed by the processor 22.

[0023] The following describes functions of the test target device 3 in the embodiment 1. Fig. 4 is a block diagram showing functions of the test target device 3 in the embodiment 1. The test target device 3 has a communication data analysis unit 31, a communication protocol execution unit 32, and a timeout management unit 33.

[0024] The communication data analysis unit 31 receives normal data and fuzzing data transmitted from the fuzzing test device 1 via the network 2. The communication data analysis unit 31 analyzes the received normal data and fuzzing data. If the communication data analysis unit 31 determines that the analysis target is normal data, it transmits this analysis target to the communication protocol execution unit 32. If the data analysis unit 32 determines that the analysis target is fuzzing data, it discards this analysis target.

[0025] The communication protocol execution unit 32 executes processing based on the data transmitted from the communication data analysis unit 31. Furthermore, if normal data is not transmitted within a predetermined time interval, the communication protocol execution unit 32 cuts off the connection between the test target device 3 and other devices. For example, in a state where the test target device 3 and the fuzzing test device 1 are connected, if the next normal data is not transmitted within a predetermined time after the last normal data was transmitted to the test target device 3, the communication protocol execution unit 32 disconnects the test target device 3 from the fuzzing test device 1.

[0026] The timeout management unit 33 manages the timeout time. The timeout time is a preset length of time. When the timeout time has elapsed, the timeout management unit 33 notifies the communication protocol execution unit 32 that a timeout has occurred. The timeout time is, for example, several times to several tens of times the time interval between the fuzzing data and normal data transmitted sequentially from the fuzzing test device 1. The fuzzing test device 1 transmits the fuzzing data and normal data several tens to several hundreds of times in total within the timeout time.

[0027] The hardware configuration of the test target device 3 is similar to that of the fuzzing test equipment 1 (see FIG. 3). In the test target device 3, the processor 22 loads an operation program stored in a secondary storage device 25 into a memory 23 and executes it, thereby realizing each function of the test target device 3. Communication with the fuzzing test equipment 1 is performed via an interface 24. The secondary storage device 25 stores various information required for the operation of the test target device 3 and the programs executed by the processor 22.

[0028] The following describes the operation of the test target device 3 to disconnect the fuzz test device 1. Fig. 5 is a flowchart showing the operation of the test target device 3 to disconnect the fuzz test device 1 in the first embodiment.

[0029] In step S 11 , the communications protocol execution unit 32 receives normal data from the communications data analysis unit 31 .

[0030] In step S12, measurement of the timeout period begins. When communications protocol execution unit 32 receives normal data, it transmits an instruction to start measuring the timeout period to timeout management unit 33. Upon receiving this instruction, timeout management unit 33 begins measuring the timeout period.

[0031] In step S13, it is determined whether the next normal data has been received. Communications protocol execution unit 32 monitors whether normal data has been received from data analysis unit 32. If it is determined in step S13 that the next normal data has been received (Yes in step S13), the process proceeds to step S14, and if it is determined that the next normal data has not been received (No in step S13), the process proceeds to step S15.

[0032] In step S14, the timeout period is reset. When communications protocol execution unit 32 receives normal data, it transmits an instruction to reset the measured time to timeout management unit 33. When timeout management unit 33 receives this instruction, it resets the measured timeout period.

[0033] In step S15, it is determined whether the timeout time has elapsed. If it is determined in step S15 that the timeout time has not elapsed (No in step S15), the process proceeds to step S13, and if it is determined that the timeout time has elapsed (Yes in step S15), the process proceeds to step S16.

[0034] In step S16, the fuzzing test device 1 is disconnected from the test target device 3. The communication protocol execution unit 32 cuts off the connection with the fuzzing device 1.

[0035] The frame format information 15 in the first embodiment will be described in detail. FIG. 6 is a diagram showing the configuration of the frame format information 15 in the first embodiment. The frame format information 15 includes a plurality of (N in FIG. 6) frame formats 41-1 to 41-N. Each of the frame formats 41-1 to 41-N is assigned a frame format number 42. Each of the frame formats 41-1 to 41-N includes a size 43 of each field, a possible value 44 of each field, and a default value 45 of each field. The frame formats 41-1 to 41-N are different in at least one of the size 43 of each field, the possible value 44 of each field, and the default value 45 of each field. In this way, the frame format information 15 includes a plurality of formats for generating normal data.

[0036] The fuzz test scenario information 16 in the first embodiment will be described in detail. FIG. 7 is a diagram showing the configuration of the fuzz test scenario information 16 in the first embodiment. The fuzz test scenario information 16 includes a plurality of (M in FIG. 7) pieces of test information 51-1 to 51-M. Each of the test information 51-1 to 51-M includes a test number 52, a frame format number 53, a field value 54, and a fuzz generation parameter 55. The field value 54 indicates a normal data value of each field of the frame format corresponding to the frame format number 53. The fuzz generation parameter 55 is a parameter for generating fuzz data, and indicates information regarding which field is to be changed and how to change it in order to generate fuzz data.

[0037] The normal data and the fuzzing data in the first embodiment will be described in detail. FIG. 8 is a diagram showing an example of the fuzzing test scenario information 16 in the first embodiment. In FIG. 8, for the sake of explanation, a case where there are three test cases is shown, but the number of test cases is not limited to this, and there may be tens of thousands to millions of patterns. Although only the frame format number "1" is shown, the frame format number is appropriately selected according to the frame format to be tested. For example, in FIG. 6, the frame format number is selected from "1", "2", ... "N". Although the field values ​​are specified by separating values ​​with a delimiter (a comma in FIG. 8), the values ​​may be omitted to use default values. In FIG. 8, the field values ​​are set as normal data, 0x00, 0x80, 0x14, and 0xC8, in the order of field 1, field 2, field 3, and field 4. When the fuzzing data generation parameter is "change field 1 to 0xC8", this means that "change the value of 0x00 in field 1 to 0xC8".

[0038] FIG. 9 is a schematic diagram illustrating a frame format, normal data, and fuzzing data in the first embodiment. In FIG. 9, a frame format with frame format number 53 of "1" is illustrated. In the frame format illustrated in FIG. 9, the size of each field and the possible values ​​of each field are shown for fields 1 to 4. Normal data satisfies the size of each field and the possible values ​​of each field indicated in the frame format. Fuzzing data does not satisfy at least one of these sizes of each field and the possible values ​​of each field.

[0039] In fuzzing data test number "1", the value of 0x00 in field 1 of normal data is changed to 0xC8 according to the fuzz generation parameters. This means that the regulations for field 1 are not met. Fuzzing data test number "1" is a single field fuzzed.

[0040] In fuzzing data test number "2", field 4 of the normal data was changed to 30 bytes of data (all 0xFF) according to the fuzzing generation parameters. As a result, the regulations for field 4 are not met. Fuzzing data test number "2" is a single field fuzzed.

[0041] In fuzzing data test number "3", in accordance with the fuzzing data parameters, the value of 0x00 in field 1 of normal data is changed to 0xFF, the value of 0x80 in field 2 is changed to 0x8080, and field 4 is changed to 10 bytes of data (all 0x00). As a result, the regulations for field 1, field 2, and field 4 are not met. Fuzzing data test number "3" is obtained by fuzzing multiple fields.

[0042] In this way, fuzzing data is generated by appropriately fuzzing normal data.

[0043] The following describes the operation of the fuzz test in the first embodiment. Fig. 10 is a flowchart showing the operation of the fuzz test in the first embodiment.

[0044] In step S21, the fuzzing test device 1 and the test target device 3 establish a connection in accordance with a communication protocol.

[0045] In step S22, the fuzz test scenario is referred to. The fuzz test execution unit 14 refers to the fuzz test scenario information 16.

[0046] In step S23, normal data is generated. The fuzzing test execution unit 14 refers to the fuzzing test scenario information 16 and extracts the frame format number 53 and field value 54 corresponding to the test number 52. The fuzzing test execution unit 14 transmits this information to the normal data generation unit 12. The normal data generation unit 12 extracts the frame format 41 corresponding to the transmitted frame format number 53 from the frame format information 15. The normal data generation unit 12 generates normal data based on the extracted frame format 41 and the transmitted field value 54. The normal data generation unit 14 transmits the generated normal data to the fuzzing test execution unit 14.

[0047] In step S24, fuzzing data is generated. The fuzzing test execution unit 14 extracts fuzzing generation parameters 55 corresponding to the test number 52 of the fuzzing test scenario information 16. The fuzzing test execution unit 14 transmits the frame format number 53, the fuzzing generation parameters 55, and normal data to the fuzzing data generation unit 13. The fuzzing data generation unit 13 extracts the frame format 41 corresponding to the frame format number 53 from the frame format information 15 based on the transmitted frame format number 53. The fuzzing data generation unit 13 generates fuzzing data based on the extracted frame format 41, the fuzzing generation parameters 55, and the normal data. The fuzzing data generation unit 13 transmits the generated fuzzing data to the fuzzing execution unit 14.

[0048] In step S25, a data transmission process is performed. The fuzzing test execution unit 14 sequentially transmits the normal data and the fuzzing data to the communication data analysis unit 31 at a predetermined timing.

[0049] The data transmission process (step S25) in the first embodiment will be described in detail. FIG. 11 is a schematic diagram showing a transmission process of normal data and fuzzing data in the first embodiment. The fuzzing test device 1 performs a test on a plurality of pieces of test information 51-1 to 51-N described in the fuzzing test scenario information 16 according to the test number 52. At this time, the fuzzing test execution unit 14 transmits the fuzzing data and the normal data to the test target device 3 alternately once each. For example, the fuzzing test execution unit 14 transmits the fuzzing data corresponding to the test information 51-1, the normal data corresponding to the test information 51-1, the fuzzing data corresponding to the test information 51-2, the normal data corresponding to the test information 51-2, and so on to the test target device 3. The fuzzing test execution unit 14 transmits the fuzzing data and the normal data sequentially to the test information 51-N.

[0050] The time interval (T1-1 and T1-2 in FIG. 11) between transmitting normal data and transmitting the next normal data is shorter than the time interval at which the test target device 3 disconnects the fuzz test device 1. In other words, the fuzz test execution unit 14 transmits the fuzz data and the normal data to the test target device 3 at a time interval that allows the fuzz data and the normal data to be transmitted at least once each within the timeout time managed by the timeout management unit 33.

[0051] FIG. 12 is a flowchart showing the operation of the data transmission process by the fuzzing test device 1 in the first embodiment.

[0052] In step S31, it is determined whether or not there is untransmitted fuzzing data. The fuzzing test execution unit 14 determines whether or not there is untransmitted fuzzing data in the fuzzing test scenario information 16. In step S31, if it is determined that there is untransmitted fuzzing data (Yes in step S31), the process proceeds to step S32, and if it is determined that there is no untransmitted fuzzing data (No in step S31), the process ends.

[0053] In step S32, the fuzzing data is transmitted. The fuzzing test execution unit 14 transmits the fuzzing data to the test target device 3.

[0054] In step S33, the normal data is transmitted. The fuzzing test execution unit 14 transmits the normal data to the test target device 3.

[0055] In this way, according to the first embodiment, normal data is transmitted within a predetermined time interval to the test target device 3 that disconnects if normal data is not transmitted within the predetermined time interval, so that interruption of the fuzz test due to disconnection is suppressed. According to the first embodiment, the time required for the fuzz test is shortened compared to the case where the fuzz test is restarted every time it is interrupted due to disconnection.

[0056] Some fuzz tests require the transmission of a huge amount of fuzz data. In particular, in such fuzz tests, if the fuzz test is resumed every time it is interrupted due to disconnection, it may take an excessive amount of time to complete the fuzz test. According to the first embodiment, interruptions due to disconnection are suppressed, so that even when a huge amount of fuzz data needs to be transmitted, the fuzz test can be completed without an excessive amount of time.

[0057] Embodiment 2 A fuzz test device 61 in the second embodiment will be described. The fuzz test device 61 in the second embodiment differs from the fuzz test device 1 in the first embodiment in that it transmits normal data based on time. The same components as those in the first embodiment are given the same reference numerals, and the description thereof will be omitted.

[0058] 13 is a block diagram showing functions of a fuzz test device 61 in embodiment 2. The fuzz test device 61 includes a storage unit 11, a normal data generation unit 12, a fuzz data generation unit 13, a fuzz test execution unit 64, a transmission flag setting unit 65, and a time measurement unit 66.

[0059] The fuzzing test execution unit 64 transmits the normal data generated by the normal data generation unit 12 and the fuzzing data generated by the fuzzing data generation unit 13 to the test target device 3, and executes the fuzzing test.

[0060] The transmission flag setting unit 65 sets a flag indicating that the fuzzing test execution unit 64 has transmitted normal data to the test target device 3 .

[0061] The time measurement unit 66 measures time. Specifically, it measures the time that has elapsed since the fuzzing test execution unit 64 transmitted normal data to the test target device 3. When a predetermined time has elapsed since the fuzzing test execution unit 64 transmitted normal data to the test target device 3, the time measurement unit 66 notifies the fuzzing test execution unit 64 that the predetermined time has elapsed. The predetermined time from the transmission of normal data is shorter than the timeout time managed by the timeout management unit 33.

[0062] The data transmission process (step S25) in the second embodiment will be described in detail. FIG. 14 is a schematic diagram showing the transmission process of normal data and fuzzing data in the second embodiment. The fuzzing test device 61 tests a plurality of pieces of test information 51-1 to 51-N described in the fuzzing test scenario information 16 according to the test number 52. At this time, the fuzzing test execution unit 64 transmits the fuzzing data to the test target device 3 a plurality of times in succession. The fuzzing test execution unit 64 transmits the normal data to the test target device 3 based on the time measured by the time measurement unit 66. The fuzzing test execution unit 64 transmits the normal data to the test target device 3 every time a predetermined time has elapsed. For example, the fuzzing test execution unit 64 transmits to the test target device 3 in the following order (N1 is a value between 4 and N): fuzzing data corresponding to test information 51-1, fuzzing data corresponding to test information 51-2, fuzzing data corresponding to test information 51-3, ... fuzzing data corresponding to test information 51-N1, normal data corresponding to 51-N1, ... (N1 is a value between 4 and N). The fuzzing test execution unit 64 transmits the fuzzing data to the test target device 3 multiple times, and then transmits the normal data to the test target device 3. The fuzzing test execution unit 64 transmits the fuzzing data and normal data sequentially up to the test information 51-N.

[0063] The time interval (T2-1 and T2-2 in FIG. 14) between transmitting normal data and transmitting the next normal data is shorter than the time interval at which the test target device 3 disconnects the fuzz test device 61. In other words, the fuzz test execution unit 64 transmits the fuzz data and normal data to the test target device 3 at a time interval that allows at least one combination of multiple fuzz data and one normal data to be included within the timeout time managed by the timeout management unit 33.

[0064] FIG. 15 is a flowchart showing the operation of the data transmission process by the fuzzing test device 61 in the second embodiment.

[0065] In step S41, it is determined whether or not the transmitted flag is set. The fuzzing test execution unit 64 determines whether or not a flag indicating that normal data has been transmitted is set by referring to the transmission flag setting unit 65. In step S41, if it is determined that the transmitted flag is not set (No in step S41), the process proceeds to step S42, and if it is determined that the transmitted flag is set (Yes in step S41), the process proceeds to step S45.

[0066] In step S42, the normal data is transmitted. The fuzzing test execution unit 64 transmits the normal data to the test target device 3.

[0067] In step S43, a transmission flag is set. The fuzzing test execution unit 64 notifies the transmission flag setting unit 65 that normal data has been transmitted to the test target device 3. Upon receiving this notification, the transmission flag setting unit 65 sets a flag indicating that normal data has been transmitted.

[0068] In step S44, time measurement is started. The fuzzing test execution unit 64 notifies the time measurement unit 66 that normal data has been transmitted to the test target device 3. Upon receiving this notification, the time measurement unit 66 starts measuring time.

[0069] In step S45, it is determined whether there is any untransmitted fuzzing data. The fuzzing test execution unit 64 determines whether there is any untransmitted fuzzing data in the fuzzing test scenario information 16. In step S45, if it is determined that there is any untransmitted fuzzing data (Yes in step S45), the process proceeds to step S46, and if it is determined that there is no untransmitted fuzzing data (No in step S45), the process ends.

[0070] In step S46, the fuzzing data is transmitted. The fuzzing test execution unit 64 transmits the fuzzing data to the test target device 3.

[0071] In step S47, it is determined whether or not a predetermined time has elapsed. The fuzzing test execution unit 64 determines whether or not the predetermined time has elapsed based on the presence or absence of a notification from the time measurement unit 66. In step S47, if it is determined that the predetermined time has not elapsed (No in step S47), the process proceeds to step S45, and if it is determined that the predetermined time has elapsed (Yes in step S47), the process proceeds to step S48.

[0072] In step S48, the transmitted flag is cleared. The fuzzing test execution unit 64 notifies the transmission flag setting unit 65 that the flag indicating transmission has been cleared. Upon receiving this notification, the transmission flag setting unit 65 clears the flag indicating transmission. As a result, the transmission flag setting unit 65 enters a state in which the transmitted flag is not set.

[0073] In step S49, the time is reset. The fuzzing test execution unit 64 notifies the time measurement unit 66 that the time is to be reset. Upon receiving this notification, the time measurement unit 66 resets the time being measured.

[0074] In the second embodiment, the fuzzing test execution section 64 does not transmit the normal data to the test target device 3 when the transmission flag setting section 65 has set a flag indicating that normal data has been transmitted.

[0075] In the second embodiment, normal data is transmitted to the test target device 3 when a predetermined time has elapsed. By lengthening the predetermined time until normal data is transmitted within the timeout time managed by the timeout management unit 33, the frequency of transmitting normal data is reduced. This increases the number of times fuzzing data can be transmitted compared to the case where fuzzing data and normal data are transmitted alternately, thereby shortening the time required for fuzz testing performed for the same amount of fuzzing data. By making the timeout time managed by the timeout management unit 33 approximately equal to the predetermined time for transmitting normal data within the range in which the fuzzing test device 61 does not disconnect, the frequency of transmitting normal data can be minimized and the number of times fuzzing data is transmitted can be maximized.

[0076] Embodiment 3 A fuzz test device 71 in the third embodiment will be described. The fuzz test device 71 in the third embodiment differs from the fuzz test device 1 in the first embodiment in that it transmits normal data based on the total number of times that fuzz data and normal data have been transmitted. The same components as those in the first embodiment are denoted by the same reference numerals, and the description thereof will be omitted.

[0077] 16 is a block diagram showing functions of a fuzz test device 71 in embodiment 3. The fuzz test device 71 includes a storage unit 11, a normal data generation unit 12, a fuzz data generation unit 13, a fuzz test execution unit 74, and a transmission count unit 75.

[0078] The fuzzing test execution unit 74 transmits the normal data generated by the normal data generation unit 12 and the fuzzing data generated by the fuzzing data generation unit 13 to the test target device 3, and executes the fuzzing test.

[0079] The transmission counting unit 75 counts the number of times that the fuzzing data and normal data are transmitted to the test target device 3 .

[0080] The data transmission process (step S25) in the third embodiment will be described in detail. FIG. 17 is a schematic diagram showing a transmission process of normal data and fuzzing data in the third embodiment. The fuzzing test device 71 performs a test on a plurality of pieces of test information 51-1 to 51-N described in the fuzzing test scenario information 16 according to the test number 52. At this time, the fuzzing test execution unit 74 transmits the fuzzing data to the test target device 3 a plurality of times in succession. When the number of times counted by the transmission number counting unit 75 is a predetermined value, the fuzzing test execution unit 74 transmits the normal data to the test target device 3. For example, the fuzzing test execution unit 74 transmits the normal data corresponding to the test information 51-1, the fuzzing data corresponding to the test information 51-1, the fuzzing data corresponding to the test information 51-2, the fuzzing data corresponding to the test information 51-3, and so on in this order to the test target device 3. The fuzz test execution unit 74 transmits fuzz data and normal data in sequence up to the test information 51-N.

[0081] The time interval (T3-1 and T3-2 in FIG. 17) between the transmission of normal data and the transmission of the next normal data is shorter than the time interval at which the test target device 3 disconnects the fuzzing test device 71. The number of times that fuzzing data is transmitted during the time interval between the transmission of normal data and the transmission of the next normal data is equal to or less than the number of times that can be transmitted within the timeout time managed by the timeout management unit 33. In other words, the fuzzing test execution unit 74 transmits fuzzing data and normal data to the test target device 3 a number of times that can include at least one combination of one normal data and multiple fuzzing data within the timeout time managed by the timeout management unit 33.

[0082] 18 is a flowchart showing the operation of the data transmission process by the fuzzing test device 71 in the embodiment 3. Here, a case will be described as an example in which normal data is transmitted when the number of times counted by the transmission counting unit 75 (hereinafter also referred to as the transmission count) is 0 (zero), and the number of times counted by the transmission counting unit 75 is reset when the transmission count reaches a threshold value (for example, 10).

[0083] In step S51, it is determined whether the transmission count is 0. The fuzzing test execution unit 74 determines whether the number of times counted by the transmission count unit 75 is 0. In step S51, if the transmission count is 0 (Yes in step S51), the process proceeds to step S52, and if the transmission count is not 0 (No in step S51), the process proceeds to step S54.

[0084] In step S52, the normal data is transmitted. The fuzzing test execution unit 74 transmits the normal data to the test target device 3.

[0085] In step S53, the transmission count is incremented by one. The fuzzing test execution unit 74 notifies the transmission count unit 75 that normal data has been transmitted. Upon receiving this notification, the transmission count unit 75 increments the transmission count by one. Here, the transmission count is changed from "0" to "1."

[0086] In step S54, it is determined whether there is any untransmitted fuzzing data. The fuzzing test execution unit 74 determines whether there is any untransmitted fuzzing data in the fuzzing test scenario information 16. In step S54, if it is determined that there is any untransmitted fuzzing data (Yes in step S54), the process proceeds to step S55, and if it is determined that there is no untransmitted fuzzing data (No in step S54), the process ends.

[0087] In step S55, the fuzzing data is transmitted. The fuzzing test execution unit 74 transmits the fuzzing data to the test target device 3.

[0088] In step S56, the transmission count is incremented by 1. The fuzzing test execution unit 74 notifies the transmission count unit 75 that it has transmitted the fuzzing data. Upon receiving this notification, the transmission count unit 75 increments the transmission count by 1.

[0089] In step S57, it is determined whether the transmission count is less than a threshold. The fuzzing test execution unit 74 determines whether the number of times counted by the transmission count unit 75 is less than the threshold. In step S57, if the transmission count is less than the threshold (Yes in step S57), the process proceeds to step S54, and if the transmission count is equal to or greater than the threshold (No in step S57), the process proceeds to step S58.

[0090] In step S58, the transmission count is reset. The fuzzing test execution unit 74 notifies the transmission count unit 75 that the transmission count is to be reset. Upon receiving this notification, the transmission count unit 75 resets the transmission count. Here, the transmission count is changed from "100" to "0".

[0091] In the third embodiment, normal data is transmitted to the test target device 3 based on the number of times fuzzing data and normal data have been transmitted. Taking into consideration the timeout time managed by the timeout management unit 33, the number of times fuzzing data and normal data can be transmitted within this timeout time is determined. By reducing the frequency of transmitting normal data within the timeout time managed by the timeout management unit 33, the number of times fuzzing data can be transmitted increases. When the number of times fuzzing data can be transmitted increases, the time required for fuzz testing performed for the same amount of fuzzing data is shortened. By making the maximum number of times fuzzing data that the fuzzing test execution unit 74 can transmit within the timeout time managed by the timeout out management unit 33 approximately equal to the threshold value for resetting the transmission count within the range in which the fuzzing test device 71 does not disconnect, the frequency of transmitting normal data can be minimized and the number of times fuzzing data can be transmitted can be maximized.

[0092] In the third embodiment, normal data is transmitted when the transmission count is 0, and the transmission count is reset when the transmission count is equal to or greater than a threshold value, but the timing of transmitting normal data and the timing of resetting the transmission count are not limited to this. For example, it is also possible to transmit normal data and reset the transmission count when the transmission count reaches a certain threshold value.

[0093] In the first to third embodiments, a configuration has been described in which multiple normal data are generated and appropriately transmitted to the test target device 3. However, as long as the test target device 3 can recognize that normal data has been transmitted, a single normal data or appropriately selected normal data may be transmitted to the test target device 3.

[0094] In the first to third embodiments, the fuzzing data generation unit 13 generates fuzzing data based on the frame format 41, the fuzzing generation parameters 55, and normal data, but the present invention is not limited to this, and fuzzing data may be generated without using the generated normal data. For example, the fuzzing data generation unit 13 may generate fuzzing data based on the frame format 41, the field value 54, and the fuzzing generation parameters 55.

[0095] By applying a program that defines the operation of the fuzzing data device in any one of the first to third embodiments to an existing personal computer or information terminal device, the personal computer or information terminal device can be made to function as the fuzzing data device in any one of the first to third embodiments.

[0096] Such a program may be distributed in any manner, for example, by storing it on a computer-readable recording medium such as a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), or a memory card, or by distributing it via a communications network such as the Internet.

[0097] In a fuzz test, the data that the fuzz test device 1 transmits first to the test target device 3 may be either fuzz data or normal data, and the data that the fuzz test device 1 transmits last may be either fuzz data or normal data.

[0098] The normal data may include data for establishing a connection between the fuzz test device 1 and the test target device 3. After establishing a connection with the fuzz test device 1, the test target device 3 may be configured to disconnect if the next normal data is not transmitted within a predetermined time interval.

[0099] In addition, appropriate combinations, modifications, and omissions of the respective embodiments are also included within the scope of the technical ideas presented in the embodiments. [Explanation of symbols]

[0100] 1, 61, 71 Fuzzing test equipment 2 Network 3. Test device 11 Storage section 12 Normal data generation section 13 Fuzzing Data Generation Section 14, 64, 74 Fuzzing test execution unit 15 Frame format information 16 Fuzzing test scenario information 21 Bus 22 processors 23 Memory 24 Interface 25 Secondary storage 31 Communication Data Analysis Unit 32 Communication protocol execution unit 33 Timeout Management Department 65 Transmission flag setting section 66 Time Measurement Section 75 Transmission count unit

Claims

1. A fuzzing test device that performs a fuzzing test on a device under test, which disconnects if normal data is not transmitted within a predetermined time interval, A fuzzing test execution unit that transmits fuzzing data and normal data to the device under test, A time measurement unit measures the elapsed time since the fuzzing test execution unit transmitted normal data to the device under test, Equipped with, The fuzzing test execution unit transmits normal data to the device under test each time a predetermined time shorter than the predetermined time interval has elapsed, based on the elapsed time measured by the time measurement unit. Fuzzing test device.

2. The fuzzing test execution unit transmits fuzzing data to the device under test multiple times in succession. The fuzzing test apparatus according to claim 1.

3. The fuzzing test execution unit transmits fuzzing data and normal data alternately to the device under test, once each. The fuzzing test apparatus according to claim 1.

4. A fuzzing test method for fuzzing a device under test that disconnects if normal data is not transmitted within a predetermined time interval, The fuzzing data is transmitted to the device under test, The elapsed time since normal data was transmitted to the device under test is measured, and based on the elapsed time, normal data is transmitted to the device under test every time a predetermined time shorter than the predetermined time interval has elapsed. Fuzzing test method.

5. A fuzzing test program that fuzzes a device under test, which disconnects if normal data is not transmitted within a predetermined time interval, On the computer, The fuzzing data is transmitted to the device under test, The elapsed time since normal data was transmitted to the device under test is measured, and based on the elapsed time, normal data is transmitted to the device under test every time a predetermined time shorter than the predetermined time interval has elapsed. A fuzzing test program that executes a process.

6. A fuzzing test device for fuzzing test a device under test which disconnects if normal data is not transmitted within a predetermined time interval, A fuzzing test execution unit that transmits fuzzing data and normal data to the device under test, A time measurement unit measures the elapsed time since the fuzzing test execution unit transmitted normal data to the device under test, A transmission flag setting unit that sets a flag indicating that normal data has been transmitted, Equipped with, The fuzzing test execution unit transmits normal data to the device under test at least once within the predetermined time interval. If the transmission flag setting unit has set a flag indicating that normal data has been transmitted, the fuzzing test execution unit will not transmit normal data to the device under test. The transmission flag setting unit clears the flag indicating that normal data has been transmitted, based on the time measured by the time measurement unit. Fuzzing test device.

Images