| Fuzzing is currently one of the mainstream automated vulnerability detection techniques in both academia and industry,aimed at triggering program crashes by inputting arbitrary test cases to uncover hidden vulnerabilities in target programs.Existing public industrial control network protocol fuzzing tools use deep learning algorithms or custom mutation strategies to optimize seed queues and have achieved good results.However,there are still some problems limiting their effectiveness in vulnerability detection:(1)low proportion of effective test cases resulting in difficulty in improving edge coverage;(2)pursuit of high edge coverage seeds leads to missing vulnerabilities related to low edge coverage seeds;(3)inability to provide multiple inputs in a specific order resulting in difficulty in testing deep logic code;(4)support for only a single industrial control network protocol resulting in poor scalability.To address these issues,this thesis proposes a state transition coverage guided public industrial control network protocol fuzzing tool,Multi-protocol PSO State Transition Fuzzer(MULPTF).MULPTF conducts research work in the following three aspects.(1)To solve the problem of low proportion of effective test cases and information omission caused by pursuing high edge coverage seeds,a novel individual mutation strategy based on simulated annealing combined with particle swarm optimization(PSO)algorithm is proposed.This strategy uses simulated annealing algorithm for population update,structural mutation strategy for individual update,and PSO algorithm for population scheduling.Experimental results show that compared with Evolutionary Protocol-Aware and Coverage-Guided Network Fuzzing Framework(EPF),MULPTF’s exploration of the optimal solution is 15.43% faster and edge coverage increases by 3.33%.This strategy can increase the proportion of effective test cases,reduce information omission,and converge to the optimal solution faster.(2)A new code coverage calculation method called state transition coverage is proposed to address the issue of multiple input that cannot be provided in a specific order.Based on this,a state transition coverage guided population selection strategy is implemented.Experimental results on the IEC 104 protocol show that compared with American Fuzzy Lop Plus Plus(AFL++),MULPTF increases edge coverage by 492.13%,adds 58,470 more crashes and achieves a state transition coverage rate of 8.63%.In addition,thi s experiment discovers an undisclosed vulnerability in the IEC 104 protocol,which has been confirmed by the vendor and included in the Common Vulnerabilities and Exposures(CVE)vulnerability database with the identifier CVE-2023-23205.This strategy can effectively generate input sequences with a specific order to improve the probability of triggering vulnerabilities.(3)A multi-coverage mechanism cooperative guided fuzzing method is proposed to address the problem of poor scalability.The method combines traditional edge coverage and the state transition coverage proposed in(2)to guide the fuzzing process.It also introduces a modular design to support multiple industrial control network protocols.On the premise of having completed support for the International Electrotechnical Commission(IEC)104protocol,MULPTF verifies its scalability by adding support for the IEC 61850 protocol.Experimental results on the IEC 61850 protocol show that compared with AFL++,MULPTF increases edge coverage by 58.39%,adds 2,630 more crashes and achieves a state transition coverage rate of 2.75%.In addition,this experiment discovers two undisclosed vulnerabilities in the IEC 61850 protocol,which have been confirmed and fixed by the vendor.One of them has been included in the CVE vulnerability database with the identifier CVE-2023-27772. |
