TDRFuzzer: fuzzy testing method for industrial control protocols based on adaptive dynamic interval strategy

doi:10.11772/j.issn.1001-9081.2024091331

Journal of Computer Applications

TDRFuzzer: fuzzy testing method for industrial control protocols based on adaptive dynamic interval strategy

ZONG Xuejun^1,2, HAN Bing^1,2, WANG Guogang^1,2, NING Bowei^2,3, HE Kan^1,2, LIAN Lian^1,2

1.College of Information Engineering, Shenyang Chemical University 2.Liaoning Key Laboratory of Information Security for Petrochemical Industry (Shenyang Chemical University) 3.College of Artificial Intelligence，Shenyang University of Technology

Received:2024-09-18 Revised:2024-12-13 Online:2025-01-14 Published:2025-01-14
About author:ZONG Xuejun, born in 1970, M. S., professor. His research interests include industrial information security. HAN Bing, born in 1998, M. S. candidate. His research interests include industrial information security, vulnerability mining. WANG Guogang, born in 1977, Ph. D., professor. His research interests include industrial automation optimization control, industrial information security. NING Bowi, born in 1998, Ph.D. candidate. His research interests include industrial information security. LIAN Lian, born in 1981, Ph. D., professor. Her research interests include control theory, control engineering, industrial information security.
Supported by:
Liaoning Provincial Science and Technology Plan Project (2023JH1/10400082); Liaoning Provincial Artificial Intelligence Innovation Development Plan Project (2023JH26/1030008); Liaoning Provincial Science and Technology Innovation Platform Construction Plan Project ([2022] No. 36); Liaoning Provincial Natural Science Foundation Project (2023-MSLH-273)

TDRFuzzer:基于自适应动态区间策略的工业控制协议模糊测试方法

宗学军^1,2，韩冰^1,2，王国刚^1,2，宁博伟^2,3，何戡^1,2，连莲^1,2

1.沈阳化工大学信息工程学院 2.辽宁省石油化工行业信息安全重点实验室（沈阳化工大学） 3.沈阳工业大学人工智能学院

通讯作者: 宗学军
作者简介:宗学军(1970—)，男，辽宁沈阳人，教授，硕士，主要研究方向：工业信息安全；韩冰(1998—)，男，辽宁朝阳人，硕士研究生，主要研究方向：工业信息安全、漏洞挖掘；王国刚(1977—)，男，山东青岛人，教授，博士，主要研究方向：工业自动化优化控制、工业信息安全；宁博伟(1998—)，男，辽宁大连人，博士研究生，主要研究方向：工业信息安全；连莲(1981—)，女，辽宁丹东人，教授，博士，主要研究方向：控制理论与控制工程、工业信息安全。
基金资助:
辽宁省科学技术计划项目(2023JH1/10400082)；辽宁省人工智能创新发展计划项目(2023JH26/1030008)；辽宁省科技创新平台建设计划项目([2022]36号)；辽宁省自然科学基金资助项目(2023-MSLH-273)。

Abstract

Abstract: Aiming at the problems of low acceptance rate of test cases and lack of diversity in the application of fuzzy testing in industrial control protocols, a fuzzy testing method for industrial control protocols based on adaptive dynamic interval strategy is proposed. The method adds Recurrent Neural Network (RNN) to Transformer's Self-Attention mechanism to construct a protocol feature extraction model. RNN extracts local features of the data through a sliding window, and inputs the Self-Attention mechanism to carry out global feature extraction to ensure the acceptance rate of test cases. The residual connection was added between the attention blocks to transfer the weight scores and improve the computational efficiency. The generation process defines a dynamic interval strategy to adjust the sampling range of the model at any time step to increase the diversity of test cases. The testing process constructs the field adaptive importance function to locate the variant key fields. Based on the above methodology, the fuzzy test framework TDRFuzzer was designed and experimentally evaluated using three industrial protocols, Modbus TCP, S7 comm, and Ethernet/IP: compared to the three models GANFuzzer, WGANFuzzer, and PeachFuzzer, the Test Case Acceptance Rate (TCAR) of the TDRFuzzer testing framework is significantly increase, and the Vulnerability Detection Rate (VDR) increases by 0.073, 0.035, and 0.150 percentage points, respectively. This indicates that TDRFuzzer has stronger vulnerability mining capability for industrial control protocols.

Key words: fuzzing test, Industrial Control Protocol (ICP), vulnerability mining, Transformer, Recurrent Neural Network (RNN)

摘要： 针对模糊测试在工业控制协议应用中存在测试用例接受率(TCAR)低、多样性不足等问题，提出一种基于自适应动态区间策略的工业控制协议模糊测试方法。该方法将循环神经网络(RNN)加入Transformer的自注意力(Self-Attention)机制，构建协议特征提取模型，RNN通过滑动窗口提取数据的局部特征，输入自注意力机制进行全局特征提取，保证测试用例的接受率。注意力块间添加残差连接传递权重分数，提高计算效率。生成过程定义动态区间策略，调节模型在任意时间步的采样范围，增加测试用例的多样性。测试过程中构建字段自适应重要性函数，定位变异关键字段。基于上述方法，设计了模糊测试框架TDRFuzzer，采用Modbus TCP、S7 comm和Ethernet/IP 3种工业协议进行实验评估：相较于GANFuzzer、WGANFuzzer、PeachFuzzer 3种模型，TDRFuzzer模糊测试框架的TCAR指标显著提高，且漏洞检测率(VDR)分别提高了0.073、0.035、0.150个百分点。表明TDRFuzzer具备更强的工控协议漏洞挖掘能力。

关键词: 模糊测试, 工业控制协议, 漏洞挖掘, Transformer, 循环神经网络

CLC Number:

TP393

ZONG Xuejun, HAN Bing, WANG Guogang, NING Bowei, HE Kan, LIAN Lian. TDRFuzzer: fuzzy testing method for industrial control protocols based on adaptive dynamic interval strategy[J]. Journal of Computer Applications, DOI: 10.11772/j.issn.1001-9081.2024091331.

宗学军韩冰王国刚宁博伟何戡连莲. TDRFuzzer:基于自适应动态区间策略的工业控制协议模糊测试方法[J]. 《计算机应用》唯一官方网站, DOI: 10.11772/j.issn.1001-9081.2024091331.

[1]	Baohua YUAN, Jialu CHEN, Huan WANG. Medical image segmentation network integrating multi-scale semantics and parallel double-branch [J]. Journal of Computer Applications, 2025, 45(3): 988-995.
[2]	Yalun WANG, Yangsen ZHANG, Siwen ZHU. Headline generation model with position embedding for knowledge reasoning [J]. Journal of Computer Applications, 2025, 45(2): 345-353.
[3]	Jietao LIANG, Bing LUO, Lanhui FU, Qingling CHANG, Nannan LI, Ningbo YI, Qi FENG, Xin HE, Fuqin DENG. Point cloud registration method based on coordinate geometric sampling [J]. Journal of Computer Applications, 2025, 45(1): 214-222.
[4]	Liehong REN, Lyuwen HUANG, Xu TIAN, Fei DUAN. Multivariate long-term series forecasting method with DFT-based frequency-sensitive dual-branch Transformer [J]. Journal of Computer Applications, 2024, 44(9): 2739-2746.
[5]	Jiepo FANG, Chongben TAO. Hybrid internet of vehicles intrusion detection system for zero-day attacks [J]. Journal of Computer Applications, 2024, 44(9): 2763-2769.
[6]	Yunchuan HUANG, Yongquan JIANG, Juntao HUANG, Yan YANG. Molecular toxicity prediction based on meta graph isomorphism network [J]. Journal of Computer Applications, 2024, 44(9): 2964-2969.
[7]	Xin YANG, Xueni CHEN, Chunjiang WU, Shijie ZHOU. Short-term traffic flow prediction of urban highway based on variant residual model and Transformer [J]. Journal of Computer Applications, 2024, 44(9): 2947-2951.
[8]	Jinjin LI, Guoming SANG, Yijia ZHANG. Multi-domain fake news detection model enhanced by APK-CNN and Transformer [J]. Journal of Computer Applications, 2024, 44(9): 2674-2682.
[9]	Jieru JIA, Jianchao YANG, Shuorui ZHANG, Tao YAN, Bin CHEN. Unsupervised person re-identification based on self-distilled vision Transformer [J]. Journal of Computer Applications, 2024, 44(9): 2893-2902.
[10]	Hang XU, Zhi YANG, Xingyuan CHEN, Bing HAN, Xuehui DU. Coverage-guided fuzzing based on adaptive sensitive region mutation [J]. Journal of Computer Applications, 2024, 44(8): 2528-2535.
[11]	Yuwei DING, Hongbo SHI, Jie LI, Min LIANG. Image denoising network based on local and global feature decoupling [J]. Journal of Computer Applications, 2024, 44(8): 2571-2579.
[12]	Kaili DENG, Weibo WEI, Zhenkuan PAN. Industrial defect detection method with improved masked autoencoder [J]. Journal of Computer Applications, 2024, 44(8): 2595-2603.
[13]	Fan YANG, Yao ZOU, Mingzhi ZHU, Zhenwei MA, Dawei CHENG, Changjun JIANG. Credit card fraud detection model based on graph attention Transformation neural network [J]. Journal of Computer Applications, 2024, 44(8): 2634-2642.
[14]	Dahai LI, Zhonghua WANG, Zhendong WANG. Dual-branch low-light image enhancement network combining spatial and frequency domain information [J]. Journal of Computer Applications, 2024, 44(7): 2175-2182.
[15]	Shibin LI, Jun GONG, Shengjun TANG. Semi-supervised heterophilic graph representation learning model based on Graph Transformer [J]. Journal of Computer Applications, 2024, 44(6): 1816-1823.

TDRFuzzer: fuzzy testing method for industrial control protocols based on adaptive dynamic interval strategy

TDRFuzzer:基于自适应动态区间策略的工业控制协议模糊测试方法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics