The invention discloses an industrial control protocol difference fuzzy test method and
system based
on protocol consistency
verification. The method comprises the following steps: firstly, based on an official
specification document of a target industrial control protocol, constructing a formalized baseline protocol finite-state
machine, and generating a consistency
verification sequence set covering protocol core logic; secondly, performing consistency testing on a plurality of tested protocol implementation entities, identifying and recording behavior deviation between each entity and the
baseline model, and generating inconsistency judgment information; further, a differential fuzzy
test case is constructed by utilizing the judgment information to generate an auxiliary vector, a targeted variation strategy is designed, and a final differential fuzzy
test case set is generated and optimized; and finally, executing testing in parallel in an isolated
virtualization environment, and automatically judging abnormal entities and
vulnerability trigger points corresponding to the abnormal entities by performing vectorization
processing and
similarity analysis on response logs of the entities. According to the method, the problems of target fuzziness, low efficiency and high
false alarm rate of an existing fuzzy test method are effectively solved, and the accuracy, the efficiency and the
automation level of industrial control protocol
security testing are remarkably improved.