Research on Multidimensional Mutation Strategy Method of Fuzzing Test
Tianwen Ding, Jingqi Fu, Renliang Shen · 2021
Industrial control network security has become increasingly severe and has been highly valued. This paper studies the problems of low code coverage and relatively rough mutation strategies in the generation method of industrial control network protocol fuzzing test cases, and proposes a multidimensional mutation strategy-based fuzzing test method. First, construct a multidimensional protocol field matrix according to the fields of the industrial control network protocol messages, and generate the corresponding variation factor matrix according to the characteristics of the fields. Secondly, the agreement field matrix and the mutation factor matrix are processed by the Cartesian product to generate a multidimensional mutation strategy. This strategy is used to guide the mutation of original data and test case generation. Finally, this method has undergone a comparative experiment on the Modbus/TCP protocol. Experimental results show that the proposed method not only improves the acceptance rate and coverage rate of test cases that generate malformed data, but also discovers two new "zero-day" vulnerabilities.