Fuzzing test device, fuzzing test method, and fuzzing test program

Abstract

The purpose of the present invention is to provide a fuzzing test device, a fuzzing test method, and a fuzzing test program that make it possible to suppress interruption of a fuzzing test.　A fuzzing test device 1 is for conducting a fuzzing test on a device 3 under test which will be disconnected if normal data is not transmitted within a predetermined time interval. The fuzzing test device 1 comprises a fuzzing test execution unit 14 that transmits fuzzing data and normal data to the device 3 under test. The fuzzing test execution unit transmits the normal data to the device 3 under test at least once every predetermined time interval.

Description

Fuzz test device, fuzz test method, and fuzz test program

[0001] The present disclosure relates to a fuzz test device, a fuzz test method, and a fuzz test program.

[0002] Conventional attack control devices are equipped with an attack command unit that resumes a multi-stage attack from the attack command that established an interrupted session in order to shorten the time required for testing to detect vulnerabilities and improve detection accuracy (e.g., Patent Document 1).

[0003] Japanese Patent Application Laid-Open No. 2023-101201

[0004] With conventional technology, a multi-stage attack could be interrupted midway. If the attack is interrupted, it must be restarted, which requires time and effort. Some devices under test may disconnect if normal data is not transmitted within a specified time interval. For example, if a fuzzing test continues to send only fuzzing data to the device under test, the device under test will determine that a problem has occurred with the communication partner because normal data is not being transmitted, and will cut the connection. This will cause the fuzzing test to be interrupted. As such, there has been an issue where the fuzzing test will be interrupted when the device under test disconnects.

[0005] The present disclosure has been made to solve the above-mentioned problems, and aims to provide a fuzz test device, a fuzz test method, and a fuzz test program that can prevent fuzz test interruptions due to disconnection.

[0006] The fuzz test device according to the present disclosure is a fuzz test device that performs a fuzz test on a test target device that disconnects when normal data is not transmitted within a predetermined time interval, and includes a fuzz test execution unit that transmits fuzz data and normal data to the test target device, and the fuzz test execution unit transmits the normal data to the test target device at least once within each predetermined time interval.

[0007] The fuzzing test method disclosed herein is a fuzzing test method for fuzzing a test target device that disconnects if normal data is not transmitted within a predetermined time interval, in which fuzzing data is transmitted to the test target device and normal data is transmitted to the test target device at least once within each predetermined time interval.

[0008] The fuzzing test program disclosed herein is a fuzzing test program that performs fuzz testing on a test target device that disconnects if normal data is not sent within a specified time interval, and has a computer send fuzzing data to the test target device and send normal data to the test target device at least once within each specified time interval.

[0009] According to the present disclosure, it is possible to prevent interruptions of fuzz testing due to disconnection.

[0010] FIG. 1 is a schematic diagram showing the configuration of a fuzz test device and its peripherals according to a first embodiment. FIG. 2 is a block diagram showing the functions of the fuzz test device according to the first embodiment. FIG. 3 is a block diagram showing the hardware configuration of the fuzz test device according to the first embodiment. FIG. 4 is a block diagram showing the functions of a test target device according to the first embodiment. FIG. 5 is a flowchart showing the operation of the test target device disconnecting the fuzz test device according to the first embodiment. FIG. 6 is a diagram showing the configuration of frame format information according to the first embodiment. FIG. 7 is a diagram showing the configuration of fuzz test scenario information according to the first embodiment. FIG. 8 is a diagram showing an example of description of fuzz test scenario information according to the first embodiment. FIG. 9 is a schematic diagram illustrating a frame format, normal data, and fuzz data according to the first embodiment. FIG. 10 is a flowchart showing the operation of a fuzz test according to the first embodiment. FIG. 11 is a schematic diagram showing the transmission process of normal data and fuzz data according to the first embodiment. FIG. 12 is a flowchart showing the operation of a data transmission process by the fuzz test device according to the first embodiment. FIG. 13 is a block diagram showing the functions of a fuzz test device according to a third embodiment. 10 is a schematic diagram showing a transmission process of normal data and fuzzing data in embodiment 3. FIG. 11 is a flowchart showing the operation of a data transmission process by a fuzzing test device in embodiment 3. FIG.

[0011] First Embodiment The configuration of a fuzz test device 1 according to the first embodiment will be described below. Fig. 1 is a schematic diagram showing the configuration of a fuzz test device 1 according to the first embodiment and its surroundings.

[0012] A fuzzing test device 1 is connected to a test target device 3 via a network 2, and performs a fuzz test on the test target device 3. A fuzzing test is a test that verifies the vulnerability of a device by providing the target device with data that is likely to cause the device to behave abnormally.

[0013] The fuzzing test device 1 transmits normal data and fuzzing data to the test target device 3. The fuzzing test device 1 transmits normal data to the test target device 3 at least once within each predetermined time interval. The normal data is data that conforms to the frame format of the communication protocol used by the test target device 3. The normal data is normally assumed normal data, and causes the test target device 3 to operate normally. The fuzzing data is normally not assumed abnormal data, and may cause malfunctions in the operation of the test target device 3.

[0014] The test target device 3 is a device that is the target of the fuzzing test. The test target device 3 disconnects if normal data is not transmitted within a predetermined time interval. Disconnection refers to a state in which a communication device connected to a network is no longer a target for communication. Disconnection occurs, for example, when an abnormality occurs in a communication device within the network. If normal data is not transmitted from the fuzzing test device 1 within a predetermined time interval, the test target device 3 determines that a problem has occurred in the fuzzing test device 1, which is the communication partner, and cuts the connection. In other words, the test target device 3 disconnects from the fuzzing test device 1. If the connection is disconnected during the execution of a fuzzing test, the fuzzing test is interrupted.

[0015] The functions of the fuzz test device 1 in embodiment 1 will be described. Fig. 2 is a block diagram showing the functions of the fuzz test device 1 in embodiment 1. The fuzz test device 1 has a storage unit 11, a normal data generation unit 12, a fuzzing data generation unit 13, and a fuzzing test execution unit 14. The storage unit 11 stores frame format information 15 including information on a format for generating normal data, and fuzzing test scenario information 16 including information for generating fuzzing data.

[0016] The normal data generation unit 12 generates normal data based on the frame format information 15 and the fuzzing test scenario information 16. The fuzzing data generation unit 13 generates fuzzing data based on the frame format information 15 and the fuzzing test scenario information 16. The fuzzing test execution unit 14 transmits the normal data generated by the normal data generation unit 12 and the fuzzing data generated by the fuzzing data generation unit 13 to the test target device 3 via the network 2, and executes the fuzzing test.

[0017] A description will be given of the hardware configuration of the fuzz test device 1 in embodiment 1. Fig. 3 is a block diagram showing the hardware configuration of the fuzz test device 1. The fuzz test device 1 is realized by a computer such as a personal computer or a microcontroller.

[0018] The fuzzing test device 1 includes a bus 21, a processor 22, a memory 23, an interface 24, and a secondary storage device 25. The processor 22, the memory 23, the interface 24, and the secondary storage device 25 are connected to each other via the bus 21.

[0019] The processor 22 is, for example, a CPU (Central Processing Unit). The processor 22 loads an operation program stored in the secondary storage device 25 into the memory 23 and executes it, thereby realizing each function of the fuzz test device 1.

[0020] The memory 23 is a main storage device configured by, for example, a RAM (Random Access Memory). The memory 23 stores programs read by the processor 22 from the secondary storage device 25. The memory 23 functions as a work memory when the processor 22 executes the programs.

[0021] The interface 24 is an I / O (Input / Output) interface such as a serial port, a USB (Universal Serial Bus) port, a network interface, etc. Communication with the test target device 3 is performed via the interface 24.

[0022] The secondary storage device 25 is, for example, a flash memory, a hard disk drive (HDD), or a solid state drive (SSD). The secondary storage device 25 stores various information necessary for the operation of the fuzzing test device 1 and programs executed by the processor 22.

[0023] The following describes the functions of the test target device 3 in embodiment 1. Fig. 4 is a block diagram showing the functions of the test target device 3 in embodiment 1. The test target device 3 has a communication data analysis unit 31, a communication protocol execution unit 32, and a timeout management unit 33.

[0024] The communication data analysis unit 31 receives normal data and fuzzing data transmitted from the fuzzing test device 1 via the network 2. The communication data analysis unit 31 analyzes the received normal data and fuzzing data. If the communication data analysis unit 31 determines that the analysis target is normal data, it transmits this analysis target to the communication protocol execution unit 32. If the data analysis unit 32 determines that the analysis target is fuzzing data, it discards this analysis target.

[0025] The communication protocol execution unit 32 executes processing based on the data transmitted from the communication data analysis unit 31. Furthermore, if normal data is not transmitted within a predetermined time interval, the communication protocol execution unit 32 disconnects the connection between the test target device 3 and other devices. For example, when the test target device 3 and the fuzzing test device 1 are connected, if the next normal data is not transmitted within a predetermined time period after the last normal data was transmitted to the test target device 3, the communication protocol execution unit 32 disconnects the test target device 3 from the fuzzing test device 1.

[0026] The timeout management unit 33 manages the timeout time. The timeout time is a preset length of time. When the timeout time has elapsed, the timeout management unit 33 notifies the communication protocol execution unit 32 that a timeout has occurred. The timeout time is, for example, several to several tens of times the time interval between the fuzzing data and normal data transmitted sequentially from the fuzzing test device 1. The fuzzing test device 1 transmits the fuzzing data and normal data several tens to several hundreds of times in total within the timeout time.

[0027] The hardware configuration of the test target device 3 is similar to the hardware configuration of the fuzzing test equipment 1 (see FIG. 3). In the test target device 3, the processor 22 loads an operating program stored in a secondary storage device 25 into a memory 23 and executes it, thereby realizing each function of the test target device 3. Communication with the fuzzing test equipment 1 is performed via an interface 24. The secondary storage device 25 stores various information required for the operation of the test target device 3 and the programs executed by the processor 22.

[0028] The following describes the operation of the test target device 3 to disconnect the fuzz test device 1. Fig. 5 is a flowchart showing the operation of the test target device 3 to disconnect the fuzz test device 1 in the first embodiment.

[0029] In step S 11 , the communication protocol execution unit 32 receives normal data from the communication data analysis unit 31 .

[0030] In step S12, measurement of the timeout period begins. When the communication protocol execution unit 32 receives normal data, it transmits an instruction to start measuring the timeout period to the timeout management unit 33. Upon receiving this instruction, the timeout management unit 33 starts measuring the timeout period.

[0031] In step S13, it is determined whether the next normal data has been received. The communication protocol execution unit 32 monitors whether the next normal data has been received from the data analysis unit 32. If it is determined in step S13 that the next normal data has been received (Yes in step S13), the process proceeds to step S14, and if it is determined that the next normal data has not been received (No in step S13), the process proceeds to step S15.

[0032] In step S14, the timeout period is reset. When the communication protocol execution unit 32 receives normal data, it transmits an instruction to reset the measured time to the timeout management unit 33. Upon receiving this instruction, the timeout management unit 33 resets the measured timeout period.

[0033] In step S15, it is determined whether the timeout time has elapsed. If it is determined in step S15 that the timeout time has not elapsed (No in step S15), the process proceeds to step S13, and if it is determined that the timeout time has elapsed (Yes in step S15), the process proceeds to step S16.

[0034] In step S16, the fuzzing test device 1 is disconnected from the test target device 3. The communication protocol execution unit 32 cuts off the connection with the fuzzing device 1.

[0035] Details of the frame format information 15 in the first embodiment will be described. FIG. 6 is a diagram showing the configuration of the frame format information 15 in the first embodiment. The frame format information 15 includes a plurality of (N in FIG. 6) frame formats 41-1 to 41-N. Each of the frame formats 41-1 to 41-N is assigned a frame format number 42. Each of the frame formats 41-1 to 41-N includes a size 43 of each field, a possible value 44 of each field, and a default value 45 of each field. The frame formats 41-1 to 41-N differ in at least one of the size 43 of each field, the possible value 44 of each field, and the default value 45 of each field. In this way, the frame format information 15 includes a plurality of formats for generating normal data.

[0036] The fuzzing test scenario information 16 according to the first embodiment will now be described in detail. FIG. 7 is a diagram showing the configuration of the fuzzing test scenario information 16 according to the first embodiment. The fuzzing test scenario information 16 includes multiple (M in FIG. 7 ) pieces of test information 51-1 to 51-M. Each piece of test information 51-1 to 51-M includes a test number 52, a frame format number 53, a field value 54, and fuzzing generation parameters 55. The field value 54 indicates the normal data value of each field in the frame format corresponding to the frame format number 53. The fuzzing generation parameters 55 are parameters for generating fuzzing data, and indicate information regarding which fields should be changed and how to change them in order to generate fuzzing data.

[0037] Details of the normal data and fuzzing data in the first embodiment will be described. FIG. 8 is a diagram showing an example of fuzzing test scenario information 16 in the first embodiment. For the sake of explanation, FIG. 8 shows a case where there are three test cases. However, the number of test cases is not limited to this and may be tens of thousands to millions of patterns. While only the frame format number "1" is shown, the frame format number is appropriately selected depending on the frame format to be tested. For example, in FIG. 6, the frame format number is selected from "1," "2," ... "N." While field values ​​are specified by separating them with delimiters (commas in FIG. 8), default values ​​may be used by omitting these values. In FIG. 8, the field values ​​are set as normal data, in the order of 0x00, 0x80, 0x14, and 0xC8 for field 1, field 2, field 3, and field 4. When the fuzzing data generation parameter is "change field 1 to 0xC8," this means "change the value of 0x00 in field 1 to 0xC8."

[0038] FIG. 9 is a schematic diagram illustrating a frame format, normal data, and fuzzing data in the first embodiment. FIG. 9 illustrates a frame format in which the frame format number 53 is "1." In the frame format illustrated in FIG. 9, the size of each field and the values ​​that each field can take are shown for fields 1 to 4. Normal data satisfies the size and values ​​that each field can take indicated by the frame format. Fuzzing data does not satisfy at least one of these field sizes and values ​​that each field can take.

[0039] In fuzzing data test number "1", the value of 0x00 in field 1 of normal data is changed to 0xC8 according to the fuzzing generation parameters. As a result, the regulations for field 1 are not met. Fuzzing data test number "1" is a single field fuzzed.

[0040] In fuzzing data test number "2," field 4 of the normal data is changed to 30 bytes of data (all 0xFF) according to the fuzzing generation parameters. As a result, the regulations for field 4 are not met. Fuzzing data test number "2" is a single field fuzzed.

[0041] In fuzzing data test number "3", in accordance with the fuzzing data parameters, the value of 0x00 in field 1 of normal data is changed to 0xFF, the value of 0x80 in field 2 is changed to 0x8080, and field 4 is changed to 10 bytes of data (all 0x00). As a result, the specifications for field 1, field 2, and field 4 are not met. Fuzzing data test number "3" is the result of fuzzing multiple fields.

[0042] In this way, fuzzing data is generated by appropriately fuzzing normal data.

[0043] The following describes the operation of the fuzz test in embodiment 1. Fig. 10 is a flowchart showing the operation of the fuzz test in embodiment 1.

[0044] In step S21, the fuzzing test device 1 and the test target device 3 establish a connection in accordance with a communication protocol.

[0045] In step S22, the fuzzing test execution unit 14 refers to the fuzzing test scenario information 16.

[0046] In step S23, normal data is generated. The fuzzing test execution unit 14 references the fuzzing test scenario information 16 and extracts the frame format number 53 and field value 54 corresponding to the test number 52. The fuzzing test execution unit 14 transmits this information to the normal data generation unit 12. The normal data generation unit 12 extracts the frame format 41 corresponding to the transmitted frame format number 53 from the frame format information 15. The normal data generation unit 12 generates normal data based on the extracted frame format 41 and the transmitted field value 54. The normal data generation unit 14 transmits the generated normal data to the fuzzing test execution unit 14.

[0047] In step S24, fuzzing data is generated. The fuzzing test execution unit 14 extracts fuzzing generation parameters 55 corresponding to the test number 52 in the fuzzing test scenario information 16. The fuzzing test execution unit 14 transmits the frame format number 53, the fuzzing generation parameters 55, and the normal data to the fuzzing data generation unit 13. Based on the transmitted frame format number 53, the fuzzing data generation unit 13 extracts the frame format 41 corresponding to this frame format number 53 from the frame format information 15. The fuzzing data generation unit 13 generates fuzzing data based on the extracted frame format 41, fuzzing generation parameters 55, and the normal data. The fuzzing data generation unit 13 transmits the generated fuzzing data to the fuzzing execution unit 14.

[0048] In step S25, a data transmission process is performed. The fuzzing test execution unit 14 sequentially transmits the normal data and the fuzzing data to the communication data analysis unit 31 at a predetermined timing.

[0049] The data transmission process (step S25) in the first embodiment will now be described in detail. FIG. 11 is a schematic diagram showing the normal data and fuzzing data transmission process in the first embodiment. The fuzzing test device 1 performs testing on a plurality of test information 51-1 to 51-N described in the fuzzing test scenario information 16 according to the test number 52. At this time, the fuzzing test execution unit 14 alternately transmits fuzzing data and normal data to the test target device 3, one at a time. For example, the fuzzing test execution unit 14 transmits the fuzzing data corresponding to the test information 51-1, the normal data corresponding to the test information 51-1, the fuzzing data corresponding to the test information 51-2, the normal data corresponding to the test information 51-2, and so on in this order. The fuzzing test execution unit 14 transmits the fuzzing data and normal data to the test target device 3 sequentially up to the test information 51-N.

[0050] The time interval (T1-1 and T1-2 in FIG. 11) between transmitting normal data and transmitting the next normal data is shorter than the time interval at which the test target device 3 disconnects the fuzz test device 1. In other words, the fuzz test execution unit 14 transmits the fuzz data and normal data to the test target device 3 at a time interval that allows the fuzz data and normal data to be transmitted at least once each within the timeout period managed by the timeout management unit 33.

[0051] FIG. 12 is a flowchart showing the operation of the data transmission process by the fuzzing test device 1 according to the first embodiment.

[0052] In step S31, it is determined whether or not there is unsent fuzzing data. The fuzzing test execution unit 14 determines whether or not there is unsent fuzzing data in the fuzzing test scenario information 16. In step S31, if it is determined that there is unsent fuzzing data (Yes in step S31), the process proceeds to step S32, and if it is determined that there is no unsent fuzzing data (No in step S31), the process ends.

[0053] In step S32, the fuzzing data is transmitted from the fuzzing test execution unit 14 to the test target device 3.

[0054] In step S33, the normal data is transmitted from the fuzzing test execution unit 14 to the test target device 3.

[0055] In this way, according to the first embodiment, normal data is transmitted within a predetermined time interval to the test target device 3, which disconnects if normal data is not transmitted within the predetermined time interval, thereby preventing interruptions of the fuzz test due to disconnection. According to the first embodiment, the time required for the fuzz test is shorter than when the fuzz test is restarted every time it is interrupted due to disconnection.

[0056] Some fuzzing tests require the transmission of a huge amount of fuzzing data. In particular, in such fuzzing tests, if the test is restarted every time it is interrupted due to disconnection, it may take an excessive amount of time to complete the test. According to the first embodiment, interruptions due to disconnection are suppressed, so that even when a huge amount of fuzzing data needs to be transmitted, the fuzzing test can be completed without an excessive amount of time.

[0057] Second Embodiment A fuzzing test device 61 according to the second embodiment will be described. The fuzzing test device 61 according to the second embodiment differs from the fuzzing test device 1 according to the first embodiment in that it transmits normal data based on time. The same components as those in the first embodiment are denoted by the same reference numerals, and their description will be omitted.

[0058] 13 is a block diagram showing the functions of a fuzzing test device 61 according to embodiment 2. The fuzzing test device 61 includes a storage unit 11, a normal data generation unit 12, a fuzzing data generation unit 13, a fuzzing test execution unit 64, a transmission flag setting unit 65, and a time measurement unit 66.

[0059] The fuzzing test execution unit 64 transmits the normal data generated by the normal data generation unit 12 and the fuzzing data generated by the fuzzing data generation unit 13 to the test target device 3 and executes a fuzzing test.

[0060] The transmission flag setting unit 65 sets a flag indicating that the fuzzing test execution unit 64 has transmitted normal data to the test target device 3 .

[0061] The time measurement unit 66 measures time. Specifically, it measures the time that has elapsed since the fuzzing test execution unit 64 sent normal data to the test target device 3. When a predetermined time has elapsed since the fuzzing test execution unit 64 sent normal data to the test target device 3, the time measurement unit 66 notifies the fuzzing test execution unit 64 that the predetermined time has elapsed. The predetermined time since the normal data was sent is shorter than the timeout time managed by the timeout management unit 33.

[0062] The data transmission process (step S25) in the second embodiment will now be described in detail. FIG. 14 is a schematic diagram showing the normal data and fuzzing data transmission process in the second embodiment. The fuzzing test device 61 tests the multiple pieces of test information 51-1 to 51-N described in the fuzzing test scenario information 16 according to the test number 52. At this time, the fuzzing test execution unit 64 continuously transmits the fuzzing data multiple times to the test target device 3. The fuzzing test execution unit 64 transmits the normal data to the test target device 3 based on the time measured by the time measurement unit 66. The fuzzing test execution unit 64 transmits the normal data to the test target device 3 every time a predetermined time has elapsed. For example, the fuzzing test execution unit 64 transmits the fuzzing data corresponding to test information 51-1, the fuzzing data corresponding to test information 51-2, the fuzzing data corresponding to test information 51-3, ... the fuzzing data corresponding to test information 51-N1, the normal data corresponding to 51-N1, ... to the test target device 3 (N1 is a value between 4 and N). The fuzzing test execution unit 64 transmits the fuzzing data to the test target device 3 multiple times, and then transmits the normal data to the test target device 3. The fuzzing test execution unit 64 transmits the fuzzing data and normal data sequentially up to the test information 51-N.

[0063] The time interval between transmitting normal data and transmitting the next normal data (T2-1 and T2-2 in FIG. 14) is shorter than the time interval at which the test target device 3 disconnects the fuzzing test device 61. In other words, the fuzzing test execution unit 64 transmits fuzzing data and normal data to the test target device 3 at a time interval that allows at least one combination of multiple fuzzing data and one normal data to be included within the timeout period managed by the timeout management unit 33.

[0064] FIG. 15 is a flowchart showing the operation of the data transmission process by the fuzzing test device 61 according to the second embodiment.

[0065] In step S41, it is determined whether the transmitted flag is set. The fuzzing test execution unit 64 determines whether a flag indicating that normal data has been transmitted is set by referring to the transmission flag setting unit 65. If it is determined in step S41 that the transmitted flag is not set (No in step S41), the process proceeds to step S42, and if it is determined that the transmitted flag is set (Yes in step S41), the process proceeds to step S45.

[0066] In step S42, the normal data is transmitted. The fuzzing test execution unit 64 transmits the normal data to the test target device 3.

[0067] In step S43, a transmission flag is set. The fuzzing test execution unit 64 notifies the transmission flag setting unit 65 that normal data has been transmitted to the test target device 3. Upon receiving this notification, the transmission flag setting unit 65 sets a flag indicating that normal data has been transmitted.

[0068] In step S44, time measurement is started. The fuzzing test execution unit 64 notifies the time measurement unit 66 that normal data has been sent to the test target device 3. Upon receiving this notification, the time measurement unit 66 starts measuring time.

[0069] In step S45, it is determined whether there is any unsent fuzzing data. The fuzzing test execution unit 64 determines whether there is any unsent fuzzing data in the fuzzing test scenario information 16. In step S45, if it is determined that there is any unsent fuzzing data (Yes in step S45), the process proceeds to step S46, and if it is determined that there is no unsent fuzzing data (No in step S45), the process ends.

[0070] In step S46, the fuzzing data is transmitted. The fuzzing test execution unit 64 transmits the fuzzing data to the test target device 3.

[0071] In step S47, it is determined whether a predetermined time has elapsed. The fuzzing test execution unit 64 determines whether the predetermined time has elapsed based on whether or not there has been a notification from the time measurement unit 66. In step S47, if it is determined that the predetermined time has not elapsed (No in step S47), the process proceeds to step S45, and if it is determined that the predetermined time has elapsed (Yes in step S47), the process proceeds to step S48.

[0072] In step S48, the transmitted flag is cleared. The fuzzing test execution unit 64 notifies the transmission flag setting unit 65 that the flag indicating transmission has been cleared. Upon receiving this notification, the transmission flag setting unit 65 clears the flag indicating transmission. As a result, the transmission flag setting unit 65 enters a state in which the transmitted flag is not set.

[0073] In step S49, the time is reset. The fuzzing test execution unit 64 notifies the time measurement unit 66 that the time should be reset. Upon receiving this notification, the time measurement unit 66 resets the time that is being measured.

[0074] In the second embodiment, if the transmission flag setting unit 65 sets a flag indicating that normal data has been transmitted, the fuzzing test execution unit 64 does not transmit the normal data to the test target device 3 .

[0075] In the second embodiment, normal data is transmitted to the test target device 3 when a predetermined time has elapsed. By lengthening the predetermined time before transmitting normal data within the timeout time managed by the timeout management unit 33, the frequency with which normal data is transmitted is reduced. This increases the number of times fuzzing data can be transmitted compared to the case where fuzzing data and normal data are transmitted alternately, thereby shortening the time required for fuzz testing for the same amount of fuzzing data. By making the timeout time managed by the timeout management unit 33 approximately equal to the predetermined time for transmitting normal data, within the range in which the fuzzing test device 61 does not disconnect, the frequency with which normal data is transmitted can be minimized and the number of times fuzzing data is transmitted can be maximized.

[0076] Embodiment 3. A fuzz test device 71 in embodiment 3 will be described. The fuzz test device 71 in embodiment 3 differs from the fuzz test device 1 in embodiment 1 in that it transmits normal data based on the total number of times that fuzz data and normal data have been transmitted. The same components as in embodiment 1 are assigned the same reference numerals, and their description will be omitted.

[0077] 16 is a block diagram showing the functions of a fuzzing test device 71 according to embodiment 3. The fuzzing test device 71 includes a storage unit 11, a normal data generation unit 12, a fuzzing data generation unit 13, a fuzzing test execution unit 74, and a transmission count unit 75.

[0078] The fuzzing test execution unit 74 transmits the normal data generated by the normal data generation unit 12 and the fuzzing data generated by the fuzzing data generation unit 13 to the test target device 3 and executes a fuzzing test.

[0079] The transmission counting unit 75 counts the number of times that fuzzing data and normal data are transmitted to the test target device 3 .

[0080] The data transmission process (step S25) in the third embodiment will now be described in detail. FIG. 17 is a schematic diagram showing the normal data and fuzzing data transmission process in the third embodiment. The fuzzing test device 71 performs testing on multiple pieces of test information 51-1 to 51-N described in the fuzzing test scenario information 16 according to the test number 52. At this time, the fuzzing test execution unit 74 continuously transmits fuzzing data to the test target device 3 multiple times. The fuzzing test execution unit 74 transmits normal data to the test target device 3 when the number of times counted by the transmission counting unit 75 reaches a predetermined value. For example, the fuzzing test execution unit 74 transmits normal data to the test target device 3 in the following order: normal data corresponding to test information 51-1, fuzzing data corresponding to test information 51-1, fuzzing data corresponding to test information 51-2, fuzzing data corresponding to test information 51-3, and so on. The fuzzing test execution unit 74 transmits fuzzing data and normal data sequentially up to test information 51-N.

[0081] The time interval between transmitting normal data and transmitting the next normal data (T3-1 and T3-2 in FIG. 17) is shorter than the time interval at which the test target device 3 disconnects the fuzzing test device 71. The number of times fuzzing data is transmitted during the time interval between transmitting normal data and transmitting the next normal data is equal to or less than the number of times that can be transmitted within the timeout period managed by the timeout management unit 33. In other words, the fuzzing test execution unit 74 transmits fuzzing data and normal data to the test target device 3 a number of times that will include at least one combination of one normal data and multiple fuzzing data within the timeout period managed by the timeout management unit 33.

[0082] 18 is a flowchart showing the operation of the data transmission process by the fuzzing test device 71 in embodiment 3. Here, an example will be described in which normal data is transmitted when the number of times counted by the transmission counting unit 75 (hereinafter also referred to as the transmission count) is 0 (zero), and the number of times counted by the transmission counting unit 75 is reset when the transmission count reaches a threshold value (for example, 10).

[0083] In step S51, it is determined whether the transmission count is 0. The fuzzing test execution unit 74 determines whether the number of times counted by the transmission counting unit 75 is 0. In step S51, if the transmission count is 0 (Yes in step S51), the process proceeds to step S52, and if the transmission count is not 0 (No in step S51), the process proceeds to step S54.

[0084] In step S52, the normal data is transmitted. The fuzzing test execution unit 74 transmits the normal data to the test target device 3.

[0085] In step S53, the transmission count is incremented by one. The fuzzing test execution unit 74 notifies the transmission count unit 75 that normal data has been transmitted. Upon receiving this notification, the transmission count unit 75 increments the transmission count by one. Here, the transmission count is changed from "0" to "1."

[0086] In step S54, it is determined whether there is any unsent fuzzing data. The fuzzing test execution unit 74 determines whether there is any unsent fuzzing data in the fuzzing test scenario information 16. In step S54, if it is determined that there is any unsent fuzzing data (Yes in step S54), the process proceeds to step S55, and if it is determined that there is no unsent fuzzing data (No in step S54), the process ends.

[0087] In step S55, the fuzzing data is transmitted. The fuzzing test execution unit 74 transmits the fuzzing data to the test target device 3.

[0088] In step S56, the transmission count is incremented by 1. The fuzzing test execution unit 74 notifies the transmission count unit 75 that the fuzzing data has been transmitted. Upon receiving this notification, the transmission count unit 75 increments the transmission count by 1.

[0089] In step S57, it is determined whether the transmission count is less than a threshold value. The fuzzing test execution unit 74 determines whether the number of times counted by the transmission count unit 75 is less than the threshold value. In step S57, if the transmission count is less than the threshold value (Yes in step S57), the process proceeds to step S54, and if the transmission count is equal to or greater than the threshold value (No in step S57), the process proceeds to step S58.

[0090] In step S58, the transmission count is reset. The fuzzing test execution unit 74 notifies the transmission count unit 75 that the transmission count should be reset. Upon receiving this notification, the transmission count unit 75 resets the transmission count. Here, the transmission count is changed from "100" to "0."

[0091] In the third embodiment, normal data is transmitted to the test target device 3 based on the number of times fuzzing data and normal data have been transmitted. The number of times fuzzing data and normal data can be transmitted within this timeout time is determined taking into account the timeout time managed by the timeout management unit 33. By reducing the frequency at which normal data is transmitted within the timeout time managed by the timeout management unit 33, the number of times fuzzing data can be transmitted increases. Increasing the number of times fuzzing data can be transmitted shortens the time required for fuzz testing for the same amount of fuzzing data. By making the maximum number of times fuzzing data that the fuzzing test execution unit 74 can transmit within the timeout time managed by the timeout out management unit 33 approximately equal to the threshold for resetting the transmission count, within the range in which the fuzzing test device 71 does not disconnect, the frequency at which normal data is transmitted can be minimized and the number of times fuzzing data is transmitted can be maximized.

[0092] In the third embodiment, normal data is transmitted when the transmission count is 0, and the transmission count is reset when the transmission count is equal to or greater than a threshold value. However, the timing for transmitting normal data and the timing for resetting the transmission count are not limited to this. For example, normal data may be transmitted and the transmission count may be reset when the transmission count reaches a certain threshold value.

[0093] In the first to third embodiments, we have described a configuration in which multiple normal data are generated and sent to the test target device 3 as appropriate, but as long as the test target device 3 can recognize that normal data has been sent, it is also possible to send a single normal data or appropriately selected normal data to the test target device 3.

[0094] In the first to third embodiments, the fuzzing data generation unit 13 generates fuzzing data based on the frame format 41, the fuzzing generation parameters 55, and normal data. However, this is not limiting, and fuzzing data may be generated without using the generated normal data. For example, the fuzzing data generation unit 13 may generate fuzzing data based on the frame format 41, the field values ​​54, and the fuzzing generation parameters 55.

[0095] By applying a program that specifies the operation of the fuzzing data device in embodiments 1 to 3 to an existing personal computer or information terminal device, the personal computer or information terminal device can be made to function as the fuzzing data device in embodiments 1 to 3.

[0096] Such a program may be distributed in any manner, for example, by storing it on a computer-readable recording medium such as a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), or a memory card, or by distributing it via a communication network such as the Internet.

[0097] In a fuzz test, the data that the fuzz test device 1 first transmits to the test target device 3 may be either fuzz data or normal data, and the data that the fuzz test device 1 last transmits may be either fuzz data or normal data.

[0098] The normal data may include data for establishing a connection between the fuzzing test device 1 and the test target device 3. After establishing a connection with the fuzzing test device 1, the test target device 3 may be configured to disconnect if the next normal data is not transmitted within a predetermined time interval.

[0099] It should be noted that appropriate combinations, modifications, and omissions of the respective embodiments are also included within the scope of the technical ideas shown in the embodiments.

[0100] 1, 61, 71 Fuzzing test device 2 Network 3 Test target device 11 Storage unit 12 Normal data generation unit 13 Fuzzing data generation unit 14, 64, 74 Fuzzing test execution unit 15 Frame format information 16 Fuzzing test scenario information 21 Bus 22 Processor 23 Memory 24 Interface 25 Secondary storage device 31 Communication data analysis unit 32 Communication protocol execution unit 33 Timeout management unit 65 Transmission flag setting unit 66 Time measurement unit 75 Transmission count count unit

Claims

1. A fuzz test device that performs a fuzz test on a test target device that disconnects when normal data is not sent within a specified time interval, comprising: a fuzz test execution unit that sends fuzz data and normal data to the test target device, and the fuzz test execution unit sends the normal data to the test target device at least once within each specified time interval.

2. The fuzz test device according to claim 1, wherein the fuzz test execution unit transmits fuzz data to the test target device multiple times in succession.

3. The fuzz test device according to claim 1, wherein the fuzz test execution unit alternately transmits fuzz data and normal data once each to the test target device.

4. A fuzz test device according to claim 1 or 2, further comprising a time measurement unit that measures the elapsed time since the fuzz test execution unit sent normal data to the test target device, and the fuzz test execution unit sends the normal data to the test target device based on the time measured by the time measurement unit.

5. A fuzz test device as described in claim 4, further comprising a transmission flag setting unit that sets a flag indicating that normal data has been sent, wherein the fuzz test execution unit does not send normal data to the test target device if the transmission flag setting unit has set a flag indicating that normal data has been sent, and the transmission flag setting unit clears the flag indicating that normal data has been sent based on the time measured by the time measurement unit.

6. A fuzz test device according to claim 1 or 2, further comprising a transmission counting unit that counts the number of times fuzzing data and normal data are sent to the test target device, and wherein the fuzz test execution unit sends normal data to the test target device when the number of times counted by the transmission counting unit reaches a predetermined value.

7. A fuzz testing method for fuzz testing a test target device that disconnects when normal data is not transmitted within a predetermined time interval, the fuzz testing method comprising: transmitting fuzzing data to the test target device; and transmitting normal data to the test target device at least once within each predetermined time interval.

8. A fuzzing test program for fuzz testing a test target device that disconnects when normal data is not sent within a specified time interval, the fuzzing test program causing a computer to execute the following process: send fuzzing data to the test target device; and send normal data to the test target device at least once within each specified time interval.

Images