基于模糊测试的工控网络协议漏洞挖掘方法

Vulnerability mining method for industrial control network protocol based on fuzz testing

为解决传统漏洞挖掘方法不能在工控系统中直接应用的问题,提出一种基于模糊测试的工控网络协议漏洞挖掘方法。使用工控网络协议测试用例变异因子生成协议特征值,每个变异因子代表一类工控系统漏洞的特征。变异因子结合Modbus TCP协议特征生成不同的测试用例。通过Modbus TCP请求与响应的协议特征对应关系和旁路监听方法解决难以确定测试用例是否有效的问题。为对工控私有协议进行模糊测试,建立了工控私有协议树,并对私有协议数据集进行了分类。采用可变字节值概率统计方法、长度域学习方法、Apriori和Needleman/Wunsch算法学习私有协议特征,有效提高了私有协议的测试用例接收率。通过对真实工控设备的实验分析,证明了该方法能够有效检测工控公有、私有协议的漏洞。

To solve the difficulties that traditional vulnerability mining method can t be directly applied to Industrial Control System(ICS),a vulnerability mining method for industrial control network protocol based on fuzz testing was proposed.Protocol feature values were generated by testing cases variation factors for industrial control network protocol,each of which represented a type of ICS vulnerability features.Different test cases were generated by Modbus TCP protocol features and variation factors.Through bypass monitoring method and Modbus TCP protocol features relation between request and response,the difficult problem of determining the validity of testing cases was solved.Aiming at fuzzing industrial control private protocol,the industrial control private protocol tree was established,and the private protocol data set was classified.The private protocol features were learned by probability statistical method of variable byte values,length field learning method,Apriori and Needleman/Wunsch algorithm,which effectively improved the acceptance rate of testing cases for private protocol.Experimental analysis on real industrial control equipment proved that the proposed method could effectively detect vulnerabilities of industrial control public and private protocol.