Network protocol fuzz test method and system based on state machine

Abstract

The present application relates to a network protocol fuzz test method and system based on a state machine. The method comprises: determining a system under test, extracting a protocol under test of said system to which said protocol belongs, parsing interaction logic of said protocol, and obtaining an input / output combination of said system on the basis of the interaction logic; initializing a simulated annealing algorithm, and constructing a learning-based LBT system on the basis of the simulated annealing algorithm; loading the input / output combination into the LBT system to construct a state machine model of said system; and performing fuzz test on said system on the basis of the constructed state machine model.

Description

A network protocol fuzz testing method and system based on a state machine

[0001] Related applications

[0002] The present application claims priority to the Chinese patent application No. 202410857422.4, filed on June 28, 2024, entitled "A network protocol fuzz testing method and system based on a state machine", the contents of which are hereby incorporated by reference in its entirety. TECHNICAL FIELD

[0003] The present application belongs to the field of network technology and security technology, and particularly relates to a network protocol fuzz testing method and system based on a state machine. BACKGROUND

[0004] Network systems provide services to the outside through network protocols, and the stability and reliability of the system can be improved by automatically or semi-automatically generating random data to test the system.

[0005] Currently, mainstream network protocol fuzz testing tools such as Peach Fuzz, etc. all adopt manual analysis of protocols, then write corresponding test suites according to the specifications of the Fuzz tool, and finally import the test suites so that the tool can perform automatic testing. Manual writing has the problems of large test suite workload and poor test quality due to scene omission, so a method is needed to solve the above problems. SUMMARY

[0006] According to a first aspect of the present application, the present application provides a network protocol fuzz testing method based on a state machine, comprising:

[0007] S1, determining a system under test, extracting a protocol under test of the system under test, parsing the interaction logic of the protocol under test, and obtaining the input-output combination of the system under test based on the interaction logic;

[0008] S2, initializing a simulated annealing algorithm, and constructing a learning-based LBT system based on the simulated annealing algorithm;

[0009] S3, loading the input-output combination into the LBT system, and constructing a state machine model of the system under test;

[0010] S4, performing Fuzz fuzz testing on the system under test based on the constructed state machine model.

[0011] In one embodiment, the protocol under test includes a message header and a message body; and the input-output combination includes a combination of data sent by an agent to the system under test and a result or state value intercepted by the agent.

[0012] In one embodiment, the S2 initializes the simulated annealing algorithm, and constructs the learning-based LBT system according to the simulated annealing algorithm, including:

[0013] When initializing the simulated annealing algorithm, an initial temperature, an initial solution, an energy of the initial solution, and a cooling strategy parameter are defined.

[0014] Determine the features used to generate test cases as input attributes and evaluation functions for evaluating test case quality.

[0015] In one embodiment, the S3 loads the input-output combination into the LBT system, constructs a state machine model of the system under test, including:

[0016] Use an algorithm to construct the relationship between input and output, and generate an initial test case set;

[0017] Calculate the energy of the initial test case set, i.e. the quality or coverage ability of the test case set;

[0018] Randomly select and move, randomly select a test case at each step and move according to the gradient of the objective function;

[0019] If the movement can improve the quality of the objective function, accept the movement;

[0020] If the movement reduces the quality of the objective function, accept the inferior solution with a preset probability, and the acceptance probability decreases with the increase of the number of iterations, simulating the annealing process in physics.

[0021] Lower the temperature, repeat the random selection and movement steps until the termination condition is met, and output the optimal test case set and its energy.

[0022] In one embodiment, the S4 performs fuzz testing on the system under test based on the constructed state machine model, including:

[0023] Construct a state machine model of the system under test by learning and perform fuzz testing on the system under test through the learned state machine model;

[0024] Construct the fuzz testing assets of the system under test based on the input-output case set;

[0025] Construct the fuzz testing coverage evaluation of the system under test based on the input-output case set.

[0026] According to the second aspect of the present application, the present application provides a network protocol fuzz testing system based on a state machine, including:

[0027] a logic analysis module configured to determine a system under test, extract a protocol of the system under test, analyze interaction logic of the protocol, and obtain an input-output combination of the system under test based on the interaction logic;

[0028] an LBT construction module configured to initialize a simulated annealing algorithm, and construct a learning-based LBT system based on the simulated annealing algorithm;

[0029] a state machine model construction module configured to load the input-output combination into the LBT system, and construct a state machine model of the system under test;

[0030] a fuzz testing module configured to perform fuzz testing on the system under test based on the constructed state machine model.

[0031] In an embodiment, the protocol includes a message header and a message body, and the input-output combination includes a combination of data sent by an agent to the system under test and a result or state value intercepted by the agent.

[0032] In an embodiment, the LBT construction module is further configured to:

[0033] when initializing the simulated annealing algorithm, define an initial temperature, an initial solution, an energy of the initial solution, and a cooling strategy parameter;

[0034] determine features used to generate test cases as input attributes and an evaluation function used to evaluate quality of the test cases.

[0035] In an embodiment, the state machine model construction module is further configured to:

[0036] construct a relationship between input and output using an algorithm, and generate an initial test case set;

[0037] calculate an energy of the initial test case set, i.e., quality or coverage ability of the test case set;

[0038] randomly select and move, randomly select a test case at each step and move according to a gradient of the objective function;

[0039] if the movement can improve the quality of the objective function, accept the movement;

[0040] if the movement reduces the quality of the objective function, accept a poor solution with a preset probability, and the acceptance probability decreases with an increase in the number of iterations, simulating an annealing process in physics.

[0041] reduce the temperature, and repeat the steps of random selection and movement until a termination condition is met, and output an optimal test case set and an energy thereof.

[0042] In one embodiment, the Fuzz fuzzing module is further configured to:

[0043] constructing a state machine model of the system under test by learning and fuzzing the system under test based on the state machine model by learning;

[0044] constructing a fuzzing asset of the system under test based on the input-output use case set;

[0045] constructing a fuzzing coverage evaluation of the system under test based on the input-output use case set.

[0046] The details of one or more embodiments of the application are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the application will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF DRAWINGS

[0047] The accompanying drawings are included to provide a further understanding of the application, and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments of the application and, together with the description, serve to explain the principles of the application. In the drawings:

[0048] FIG. 1 is a typical structure diagram of a network protocol of the prior art;

[0049] FIG. 2 is a typical protocol authentication flowchart of the prior art;

[0050] FIG. 3 is a flowchart of a state machine-based network protocol fuzzing method according to an embodiment of the application;

[0051] FIG. 4 is an input-output flowchart of a state machine-based network protocol fuzzing method according to an embodiment of the application;

[0052] FIG. 5 is a state model diagram of a state machine-based network protocol fuzzing method according to an embodiment of the application;

[0053] FIG. 6 is a use case diagram of a state machine-based network protocol fuzzing system according to an embodiment of the application. DETAILED DESCRIPTION

[0054] In the following, the technical solutions of the present application will be described clearly and completely in conjunction with the drawings, obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments. It should be understood that these descriptions are only exemplary, and are not intended to limit the scope of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0055] In addition, in the following description, the description of the well-known structures and techniques is omitted to avoid unnecessary confusion of the concepts disclosed in the present application.

[0056] The exemplary embodiments will be described in detail below with reference to the accompanying drawings. The following description is, unless otherwise indicated, related to the drawings described above. Identical numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments are not meant to represent all implementations consistent with the present application. Rather, they are merely examples in accordance with some aspects of the present application as detailed in the appended claims.

[0057] When a system providing network service externally through network protocol needs to be exploited, fuzz testing is a necessary means. Since the current mainstream protocol fuzz tool is not fully automated, it is necessary to manually write test suite before starting testing; how to evaluate the quality of the test suite and how to solve the inheritance and scalability of the test suite with the increasing demand have become the problems that testers need to consider.

[0058] A typical structure of a network protocol is shown in Figure 1;

[0059] If the protocol needs to be fuzz tested, according to the traditional test tool, we need to build a data model:

[0060] A typical protocol authentication process is shown in Figure 2;

[0061] State model:

[0062] After the completion of the state model and the data model, i.e., the test suite, a traditional Fuzz test tool randomly varies the fields in the data model through a variation algorithm, sends abnormal data packets to the tested object, and observes the system state to mine system vulnerabilities. An intuitive problem can be found, as shown in the following figure. If the variation data in a certain time causes the rand exchange process to be interrupted, the subsequent token exchange process will be interrupted. The Fuzz tool solves this problem by varying more than ten million times or even for a long time, which is low in efficiency. If the rand is not exchanged and the token exchange is directly initiated, whether there is a vulnerability, the traditional test method will miss this case.

[0063] In view of the above deficiencies of the prior art, the purpose of the present application is to provide a network protocol Fuzz test method and system based on a state machine, which improves the effectiveness of protocol Fuzz test. The method does not need to save specific test suite assets, but only needs to construct the input case set of the state transition model again, thereby effectively avoiding the inheritance and expansion problems of the traditional test suite method.

[0064] According to some embodiments of the present application, the present application provides a network protocol Fuzz test method based on a state machine, as shown in FIG. 3, which comprises the following steps:

[0065] S1, determining a tested system, extracting a tested protocol of the tested system, analyzing the interaction logic of the tested protocol, and obtaining the input-output combination of the tested system based on the interaction logic;

[0066] S2, initializing a simulated annealing algorithm, and constructing a learning-based LBT system based on the simulated annealing algorithm;

[0067] S3, loading the input-output combination into the LBT system, and constructing a state machine model of the tested system;

[0068] S4, performing Fuzz test on the tested system based on the constructed state machine model.

[0069] In the present embodiment, the Fuzz test is performed based on the state transition model, thereby improving the effectiveness of protocol Fuzz test. Since specific test suite assets do not need to be saved, but only the input case set of the state transition model needs to be constructed again, the inheritance and expansion problems of the traditional test suite method are effectively avoided.

[0070] In one embodiment, the tested protocol comprises a message header and a message body; and the input-output combination comprises the combination of the data sent by an agent to the tested system and the result or state value intercepted by the agent.

[0071] In one embodiment, the S2 initializes the simulated annealing algorithm, and constructs the learning-based LBT system according to the simulated annealing algorithm, including:

[0072] When initializing the simulated annealing algorithm, define the initial temperature, the initial solution, the energy of the initial solution, and the cooling strategy parameters;

[0073] Determine the features used to generate test cases as input attributes and the evaluation function for evaluating the quality of test cases.

[0074] In this embodiment, the state model is not constructed manually, but a protocol state transition model is constructed for the system under test by using the simulated annealing algorithm.

[0075] Define the initial temperature, the initial solution (initial test case set), the energy of the initial solution (the quality or coverage ability of the test case set), and the cooling strategy parameters. At the same time, determine the features (input attributes) used to generate test cases and the evaluation function for evaluating the quality of test cases.

[0076] In this embodiment, a poor solution is accepted with a certain probability, which is to prevent the algorithm from being stuck in a local optimal solution too early. If the energy of the new test case set is better than the current optimal solution (i.e., the quality of the test case set is higher or the coverage is wider), the new test case set is accepted as the current optimal solution. Otherwise, a poor solution is accepted with a certain probability. The acceptance probability gradually decreases with the increase of the number of iterations, thereby simulating the annealing process in physics.

[0077] In one embodiment, the S3 loads the input and output combination into the LBT system to construct the state machine model of the system under test, including:

[0078] Use the algorithm to construct the relationship between the input and the output, and generate a set of initial test cases;

[0079] Calculate the energy of the initial test case set, i.e., the quality or coverage ability of the test case set;

[0080] Randomly select and move, randomly select a test case at each step, and move according to the gradient of the objective function;

[0081] If the movement can improve the quality of the objective function, accept the movement;

[0082] If the movement reduces the quality of the objective function, accept a poor solution with a preset probability, and the acceptance probability decreases with the increase of the number of iterations, thereby simulating the annealing process in physics.

[0083] The temperature is reduced, and the random selection and moving steps are repeatedly executed until a termination condition is met, and an optimal test case set and its energy are output.

[0084] In this embodiment, by the above method, we construct an LBT (learning based test) system, and in order to generate a complete state machine model, we need to provide sufficient input and output for the LBT, as shown in FIG. 4 for an input and output flow;

[0085] The following input and output can be provided:

[0086] Table 1 Input and Output Table

[0087] It should be noted that the input and output are one-to-one and the output is a determined value. If the output is a variable value, the state machine model cannot be constructed.

[0088] Finally, a state model as shown in FIG. 5 can be constructed by LBT;

[0089] An arrow in FIG. 5 points to a state transition mode, and 1-5 represents an initial state, a random number has been sent, a random number has been received, a token has been sent, and a token has been received. In combination with the existing data model, all state transition modes in FIG. 5 can be used to carry out fuzz test;

[0090] In one embodiment, the S4 performs Fuzz test on the system under test based on the constructed state machine model, including:

[0091] The state machine model of the system under test is constructed by learning, and the system under test is tested by learning the state machine model;

[0092] The input and output case set is used to construct the fuzz test asset of the system under test;

[0093] The input and output case set is used to construct the fuzz test coverage evaluation of the system under test.

[0094] According to a second aspect of the present application, referring to FIG. 6, the present application provides a network protocol fuzz test system based on a state machine, including:

[0095] A logic analysis module is configured to determine a system under test, extract a protocol under test of the system under test, analyze the interaction logic of the protocol under test, and obtain the input and output combination of the system under test based on the interaction logic.

[0096] An LBT construction module is configured to initialize a simulated annealing algorithm and construct a learning-based LBT system according to the simulated annealing algorithm.

[0097] a state machine model construction module, configured to load the input-output combination into the LBT system, and construct a state machine model of the system under test;

[0098] a fuzz testing module, configured to perform fuzz testing on the system under test based on the constructed state machine model.

[0099] In one embodiment, the protocol under test comprises a message header and a message body; and the input-output combination comprises a combination of data sent by an agent to the system under test and a result or state value intercepted by the agent.

[0100] In one embodiment, the LBT construction module is further configured to:

[0101] when initializing the simulated annealing algorithm, define an initial temperature, an initial solution, an energy of the initial solution, and a cooling strategy parameter;

[0102] determine features used to generate test cases as input attributes and an evaluation function used to evaluate the quality of the test cases.

[0103] In one embodiment, the state machine model construction module is further configured to:

[0104] construct a relationship between the input and the output using an algorithm, and generate an initial test case set;

[0105] calculate an energy of the initial test case set, i.e., a quality or coverage capability of the test case set;

[0106] randomly select and move, randomly select a test case at each step, and move according to a gradient of the objective function;

[0107] if the movement can improve the quality of the objective function, accept the movement;

[0108] if the movement reduces the quality of the objective function, accept a poor solution with a preset probability, and the probability of acceptance decreases with an increase in the number of iterations, simulating an annealing process in physics.

[0109] reduce the temperature, and repeat the steps of random selection and movement until a termination condition is met, and output an optimal test case set and an energy thereof.

[0110] In one embodiment, the fuzz testing module is further configured to:

[0111] construct a state machine model of the system under test in a learning manner, and perform fuzz testing on the protocol under test through the state machine model.

[0112] constructing the fuzz test asset for the protocol under test based on the input-output use case set;

[0113] constructing the fuzz test coverage assessment for the protocol under test based on the input-output use case set.

[0114] The applicant of the present application has made a detailed description and explanation of the embodiments of the present application in combination with the drawings of the specification, but those skilled in the art should understand that the above embodiments are only preferred embodiments of the present application, and the detailed description is only to help the reader better understand the spirit of the present application, and is not a limitation on the protection scope of the present application. On the contrary, any improvement or modification based on the spirit of the present application should fall within the protection scope of the present application.

[0115] Finally, it should be pointed out that the above examples are only used to illustrate the technical solutions of the embodiments of the present application, and not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. Any changes or replacements easily thought of by those skilled in the art within the technical scope disclosed by the present application should be covered within the protection scope of the present application.

Claims

1. A fuzz testing method for network protocols based on state machines, comprising: S1. Determine the system under test, extract the protocol under test of the system under test, parse the interaction logic of the protocol under test, and obtain the input-output combination of the system under test based on the interaction logic. S2, Initialize the simulated annealing algorithm, and construct a learning-based LBT system based on the simulated annealing algorithm; S3, load the input-output combination into the LBT system to construct the state machine model of the system under test; S4. Perform fuzz testing on the system under test based on the constructed state machine model.

2. The method according to claim 1, wherein The protocol under test includes a message header and a message body; The input-output combination includes the combination of data sent by the agent to the system under test and the results or status values ​​intercepted and returned by the agent.

3. The method according to claim 1, wherein initializing the simulated annealing algorithm in S2 and constructing a learning-based LBT system based on the simulated annealing algorithm further includes: When initializing the simulated annealing algorithm, define the initial temperature, initial solution, energy of the initial solution, and cooling strategy parameters; Determine the features used to generate test cases as input attributes and the evaluation function to assess the quality of the test cases.

4. The method according to claim 1, wherein step S3, loading the input-output combination into the LBT system to construct a state machine model of the system under test, includes: The algorithm is used to construct the relationship between input and output, generating a set of initial test cases. Calculate the energy of the initial test case set, i.e., the quality or coverage of the test case set; Random selection and movement: In each step, a test case is randomly selected and moved according to the gradient of the objective function; If the move improves the quality of the objective function, then the move is accepted; If the movement reduces the quality of the objective function, a poor solution is accepted with a preset probability. The probability of acceptance decreases as the number of iterations increases, simulating the annealing process in physics. Lower the temperature, repeat the random selection and movement steps until the termination condition is met, and output the optimal set of test cases and its energy.

5. The method according to claim 1, wherein S4, performing fuzz testing on the system under test based on the constructed state machine model, includes: A state machine model of the system under test is constructed through learning, and the protocol under test is then subjected to fuzz testing using the learned state machine model. Construct the fuzz test asset of the protocol under test based on the input and output test case set; The fuzz test coverage evaluation of the protocol under test is constructed based on the input and output test case sets.

6. A state machine-based network protocol fuzz testing system, comprising: The logic parsing module is used to determine the system under test, extract the protocol under test of the system under test, parse the interaction logic of the protocol under test, and obtain the input-output combination of the system under test based on the interaction logic. The LBT building module is used to initialize the simulated annealing algorithm and build a learning-based LBT system based on the simulated annealing algorithm. The state machine model construction module is used to load the input-output combination into the LBT system and construct the state machine model of the system under test. The fuzz testing module is used to perform fuzz testing on the system under test based on the constructed state machine model.

7. The system according to claim 6, wherein: The protocol under test includes a message header and a message body; The input-output combination includes the combination of data sent by the agent to the system under test and the results or status values ​​intercepted and returned by the agent.

8. The system according to claim 7, wherein the LBT building module is further configured to: When initializing the simulated annealing algorithm, define the initial temperature, initial solution, energy of the initial solution, and cooling strategy parameters; Determine the features used to generate test cases as input attributes and the evaluation function to assess the quality of the test cases.

9. The system according to claim 6, wherein the state machine model construction module is further configured to: The algorithm is used to construct the relationship between input and output, generating a set of initial test cases. Calculate the energy of the initial test case set, i.e., the quality or coverage of the test case set; Random selection and movement: In each step, a test case is randomly selected and moved according to the gradient of the objective function; If the move improves the quality of the objective function, then the move is accepted; If the movement reduces the quality of the objective function, a poor solution is accepted with a preset probability. The probability of acceptance decreases as the number of iterations increases, simulating the annealing process in physics. Lower the temperature, repeat the random selection and movement steps until the termination condition is met, and output the optimal set of test cases and its energy.

10. The system according to claim 6, wherein the fuzz testing module is further configured to: A state machine model of the system under test is constructed through learning, and the protocol under test is then subjected to fuzz testing using the learned state machine model. Construct the fuzz test asset of the protocol under test based on the input and output test case set; The fuzz test coverage evaluation of the protocol under test is constructed based on the input and output test case sets.

Images