Abstract:

To address the limits of the existing fuzz testing techniques in deep semantic modeling and feature representation of Industrial Control Protocols （ICPs）， leading to high test case redundancy and low acceptance rates， an ICP fuzz testing method based on dual-channel semantic feature fusion， DCSFFuzzer， was proposed. In the method， dual-channel parallel architecture was adopted to perform multi-level semantic modeling for ICPs， and a Generative Adversarial Network （GAN） was used to generate diverse test cases. First， global semantic features were extracted by capturing global dependencies in protocol sequences with a Transformer encoder， and local field features were extracted by capturing relationships among adjacent bytes or fields with a multi-scale one-dimensional Convolutional Neural Network （CNN） encoder. Second， the extracted multi-level semantic features were fused by a Gated Recurrent Unit （GRU） adaptively to enhance key semantic feature representation， thereby increasing the acceptance rate of test cases. Finally， a “relativistic discriminator” training strategy was introduced in the GAN to enhance diversity of test cases by comparing relative authenticity of real and generated samples to alleviate mode collapse. Based on the above methods， the fuzz testing framework DCSFFuzzer was designed， and experiments were conducted on three ICPs： Modbus/TCP， S7comm， and Ethernet/IP. Experimental results show that compared with five models： TDRFuzzer， MLFRFuzzer， WGANFuzzer， GANFuzzer， and PeachFuzzer， DCSFFuzzer has the Test Case Acceptance Rate （TCAR） and Diversity of Generated Data （DGD） improved， and the Test Target Anomaly Rate （TTAR） increased by 0.016， 0.024， 0.069， 0.130， and 0.172 percentage points， respectively， validating the method’s effectiveness. It can be seen that by fusing multi-level semantic features， DCSFFuzzer covers more ICP vulnerabilities， improving the security detection capability of industrial control systems.

Key words: fuzz testing, Transformer, multi-scale one-dimensional Convolutional Neural Network (CNN), dual-channel, feature fusion, Industrial Control Protocol (ICP), vulnerability mining

摘要：

针对现有模糊测试技术在工业控制协议（ICP）深层语义建模与特征表达方面的不足，导致测试用例重复率高和接受率低等问题，提出一种融合双通道语义特征的ICP模糊测试方法DCSFFuzzer。该方法采用双通道并行架构对ICP进行多层次语义建模，并借助生成对抗网络（GAN）生成多样化的测试用例。首先，通过Transformer编码器捕获协议序列中的全局依赖关系，以提取全局语义特征，利用多尺度一维卷积神经网络（CNN）编码器捕捉局部相邻字节或字段之间的关系，以提取局部字段特征；其次，利用门控循环单元（GRU）对提取的多层次语义特征实现自适应特征融合，增强关键语义特征表达，从而提高测试用例的接受率；最后，在GAN中引入“相对判别”训练策略，通过比较真实样本与生成样本的相对真实性以缓解模式崩溃，从而增强测试用例的多样性。基于上述方法，设计模糊测试框架DCSFFuzzer，并针对Modbus/TCP、S7comm和Ethernet/IP 3种ICP进行实验评估。实验结果表明，相较于WGANFuzzer、TDRFuzzer、MLFRFuzzer、GANFuzzer和PeachFuzzer 5种模型，DCSFFuzzer的测试用例接受率（TCAR）和生成数据的多样性（DGD）更优，且测试目标异常率（TTAR）分别提升了0.016、0.024、0.069、0.130和0.172个百分点，验证了该方法的有效性。DCSFFuzzer通过融合多层次语义特征，在ICP漏洞上覆盖更广，提升了工业控制系统的安全检测能力。

关键词: 模糊测试, Transformer, 多尺度一维卷积神经网络, 双通道, 特征融合, 工业控制协议, 漏洞挖掘