Efficient protocol client vulnerability mining method and system

Abstract

The invention relates to an efficient protocol client vulnerability mining method and system. The method includes the following steps: protocol structure identification; test data packet generation; test engine; test agent; and test target monitoring, wherein the protocol structure identification is to perform automatic analysis on a protocol data packet based on a gene sequence comparison algorithm in bioinformatics and divide the data packet structure into a session-related data domain, a data packet length data domain, a fixed data domain and a fuzzy test data domain; the test data packet generation is to adopt different processing methods to generate a test data packet based on the data packet structure obtained in the foregoing part; the test engine calls related programs, and the test agent monitors the state of a vulnerability mining system; and the test target monitoring is to save configuration site information for triggering protocol client vulnerabilities, position the datapacket that causes an exception, and finally trigger the type of vulnerability that is triggered. The scheme of the invention is high in test efficiency and accuracy, can discover security vulnerabilities as early as possible, and can take corresponding security remedies.

Description

technical field [0001] The present invention relates to the field of computer network security, and more specifically, to an efficient method and system for discovering loopholes in protocol clients. Background technique [0002] With the increasing popularity of the network, a large number of clients access the network, resulting in an explosive growth in the number of clients, which brings great convenience to daily life, but also poses great security risks. Need a tool that can efficiently test the protocol client, discover the vulnerabilities in the client in time, and take corresponding security remedial measures. The current fuzz testing is mainly concentrated on the server side, resulting in a blind spot in the discovery of client software security vulnerabilities. If a single vulnerability is discovered, it could affect a significant number of client devices. If the vulnerability cannot be discovered in time, once it is exploited by an attacker, it will cause huge ...

AI Technical Summary

Problems solved by technology

The patent for fuzz testing of the industrial control protocol Modbus is CN105721230A. This patent first divides the Modbus protocol domain into static and dynamic parts through expert knowledge, and the dynamic part uses the abnormal variation tree method to construct the test data set. However, the granularity of the patent division is relatively coarse and cannot Realize fine-grained testing; only test the server side, and cannot test the client connected to it; and only for the public Modbus protocol, the method is not universal

The patent for fuzzy testing method of industrial control protocol based on protocol state is CN105763392A, which includes protocol state machine extraction, message sequence library construction, protocol state guidance, test case sending and storage, heartbeat-based abnormality monitoring, and abnormality-causing Test message positioning, but this patent requires a large number of data packet samples to accurately extract the protocol state machine, cannot effectively identify the protocol, and cannot achieve effective testing of the client

[0004] To sum up, there are generally four problems in the existing vulnerability discovery for protocol clients: (1) Universality

Insufficient support for client protocols, most tools can only be tested for public protocols, and cannot be universal; (2) timeout limit

Some communication protocols have obvious session periodicity and short session duration, which makes some test tools unable to respond to client requests in a timely manner; (3) takes a long time

The number of malformed data packets in the current test tool is too large, and it is impossible to streamline the collection of data packets and test efficiently; (4) Inefficiency

The mutation of the whole data field causes a large number of invalid data packets to be rejected in the early data packet simple verification, and cannot reach the internal processing logic of the client

Images