【作者】 张勇；

【导师】 陈永乐； 白宏钢；

【作者基本信息】 太原理工大学 ， 计算机技术（专业学位）， 2023， 硕士

【摘要】 工业控制系统被广泛应用于交通、能源、化工和先进制造等关乎经济发展去和生命安全的关键基础设施中,智能制造的发展更是打破了其物理隔离性,使其面临来自网络的安全风险。而工业控制协议则是系统间通信的基石,因此保障其安全性对于工控系统稳定运行至关重要,这不仅需要对已知漏洞进行防范,还需要对潜在漏洞进行挖掘,模糊测试因为具有一定通用性便成为了主要方法。但是对于没有公开规范的协议,传统模糊测试方法需要专业的人工分析,该过程耗时且费力。因此,本文从通用性方面着手,探索深度学习技术在对未知规范的工控协议进行模糊测试方面的应用,通过深入分析现有基于深度学习技术的模糊测试方法,发现其在测试用例生成方面不能同时具备较高的准确性和多样性,由此本文提出了基于隐空间特征匹配的测试用例生成方法,并从隐向量分布约束和隐向量表征形式两个方面展开了研究。本文首先提出了一种基于隐向量分布约束的测试用例生成方法,该方法使用自编码器模型自动学习到协议的格式规范,并使编码器生成的隐向量在隐空间中具有一定的分布,通过在这个分布中进行随机采样,再利用解码器就可以重构得到与真实的协议消息结构相似且具多样性的测试用例。为了可以从一个简单分布采样然后生成具有真实性的测试用例,递进设计了三个模型实现,分别引入了生成对抗网络的判别器和生成器,在不同程度上对隐向量的分布进行了约束。本文在不同的实验环境对提出的模型进行了验证,实验结果表明,与传统模糊测试方法和现有基于深度学习的测试用例生成方法相比,该方法不仅提高了测试用例接受率和漏洞发掘能力,在漏洞触发速度方面也有明显提升。其次针对隐向量在复杂工控协议中表达力不足的问题,本文提出了基于隐向量表征依赖关系的测试用例生成方法,该方法利用自注意力机制使隐向量表征协议序列的长距离依赖关系,可以在重构测试用例时更好地复现格式细节,同时引入了更精准的距离判别算法,使模型具有更强的泛化能力从而适用于复杂工控协议。最后,为了使得生成的测试用例更有攻击性以触发更多漏洞,又对生成的测试用例引入了数据域变异策略。实验证明,在复杂的工控协议中,与现有基于深度学习的测试用例生成方法相比,本文提出的方法在用例接受率、测试效率方面均有优势,同时证明了本文方法对工控协议具有通用性。更多还原

【Abstract】 Industrial control systems are widely used in key infrastructures related to economic development and life safety,such as transportation,energy,chemical industry and advanced manufacturing,the development of manufacturing has also broken its physical isolation,making it face security risks from the network.The industrial control protocol is the cornerstone of communication between systems,so ensuring its security is crucial to the stable operation of the industrial control system.This requires not only preventing known vulnerabilities,but also mining potential vulnerabilities.Fuzzing has a certain versatility became the main approach.However,for protocols without public specifications,traditional fuzzing methods require professional manual analysis,which is time-consuming and laborious.Therefore,from the aspect of universality,this thesis explores the application of deep learning technology in fuzzing of industrial control protocols with unknown specifications.Through in-depth analysis of existing fuzzing methods based on deep learning technology,this thesis found that it cannot have high accuracy and diversity in test case generation at the same time.Therefore,this thesis proposes a test case generation method based on latent space feature matching,and conducts research from two aspects,including latent vector distribution constraints and latent vector representation form.This thesis first proposes a test case generation method based on latent vector distribution constraints.This method uses the autoencoder model to automatically learn the specification of the protocol,and makes the latent vector generated by the encoder have a certain distribution in the latent space.Through random sampling is carried out in this distribution,and then the decoder can be used to reconstruct the test cases that are similar to the real protocol message structure but have diversity.In order to sample from a simple distribution and then generate realistic test cases,this thesis progressively designs three model implementations,respectively introduces the discriminator and generator of the generative confrontation network,and controls the distribution of latent vectors to varying degrees.constraint.In this thesis,the proposed model is verified in different experimental environments.The experimental results show that,compared with traditional fuzzing methods and existing deep learning-based test case generation methods,this method not only improves the test case acceptance rate and vulnerability discovery ability,but also significantly improves the vulnerability triggering speed.Secondly,aiming at the problem of insufficient expressiveness of latent vectors in complex industrial control protocols,this paper proposes a test case generation method based on latent vectors to represent dependencies.This method uses the self-attention mechanism to make latent vectors represent long-distance dependencies of protocol sequences,which can better reproduction of format details when reconstructing test cases.A more accurate distance discrimination algorithm is introduced,which makes the model have stronger generalization ability and is suitable for complex industrial control protocols.Finally,in order to make the generated test cases more aggressive and trigger more vulnerabilities,this thesis introduces a data domain mutation strategy to the generated test cases.Experiments show that in complex industrial control protocols,compared with the existing test case generation methods based on deep learning,the method proposed in this thesis has advantages in test case accuracy and test efficiency,it also proves that the method in this paper is universal to industrial control protocols at the same time.更多还原