Granted Patent B2

US 12,407,708 · App. 18/016,877 · Granted Sep 2, 2025

Inventors: Jin Wang (Hubei, CN); Yu Shen (Hubei, CN); Chang Liu (Hubei, CN); Jiangpei Xu (Hubei, CN); Chang Liu (Hubei, CN); Xiao Yu (Hubei, CN); Li Tian (Hubei, CN); Jie Wang (Hubei, CN); Liang Zhou (Hubei, CN); Feng Long (Hubei, CN)

Assignee: State Grid Hubei Electric Power Research Institute

H04L63/1433

Abstract

Claims (70)

1. A system for detecting a vulnerability of an Internet of Things in Power Systems (IOTIPS) protocol based on fuzz testing, comprising:

a protocol configuration module configured to configure a protocol to be detected and a data frame of the protocol to be detected;

a sample generation module configured to: after loading the protocol and the data frame configured by the protocol configuration module, configure a mutation strategy based on the loaded protocol, and generate a test sample based on the configured mutation strategy; and

an execution monitoring module configured to transfer the test sample generated by the sample generation module to a device to be detected for testing, perform link management, perform test execution, store a test result, and generate a detection report;

wherein a method of triggering the sample generation module comprises generating a test task or transferring in an abnormal sample after a round of testing, which is specifically as follows: responsive to executing the test task, determining and configuring protocol information by means of the sample generation module, determining whether to use a single-byte mode or a double-byte mode, determining a start position of the data frame where mutation needs to be started, selecting a predefined or custom sample, and then generating, based on the configured mutation strategy, the test sample to be delivered to an execution monitoring system for a first round of testing by means of the sample generation module; and after the first round of testing, a second method of triggering the sample generation module comprises transferring the test sample generated in the first round of testing to a secondary learning model of the sample generation module, and generating a test sample to be delivered to the execution monitoring system for a second round of testing; and

a Seq2Seq model of an Attention mechanism introduced is used in secondary learning, wherein the Seq2Seq model mainly comprises an Encoder and a Decoder; after primary detection is completed for the generated sample, the secondary learning is performed on a marked abnormal sample by using the Seq2Seq model and then secondary detection is conducted to obtain more abnormal data frames with a higher hit ratio; and in a model training process, a mean absolute error (MAE) is configured to express a difference between a predicted data frame and an actual data frame, wherein assuming that x 1 , x 2 , . . . , x i is configured to represent a predicted data sequence, and y 1 , y 2 , . . . , y i is configured to represent an actual data sequence, the MAE is expressed as follows:

MAE

=

∑

i

=

1

n

⁢

❘

"\[LeftBracketingBar]"

y

i

-

x

i

❘

"\[RightBracketingBar]"

n

wherein the MAE is more directly expressed as follows:

MAE

=

1

n

⁢

∑

i

=

1

n

⁢

❘

"\[LeftBracketingBar]"

(

y

1

-

x

1

)

❘

"\[RightBracketingBar]"

+

…

+

❘

"\[LeftBracketingBar]"

(

y

i

-

x

i

)

❘

"\[RightBracketingBar]"

;

in the model training process, a loss function is optimized by using a stochastic gradient descent method, wherein X represents the predicted data sequence x 1 , x 2 , . . . , x i assumed above, and Y represents the actual data sequence y 1 , y 2 , . . . , y i ; and responsive to logMAE(X, Y) is obtained reaches a minimum value, values of the variables X, Y are expressed as follows as a whole:

argmin logMAE(X, Y).

2. The system for detecting a vulnerability of an IOTIPS protocol based on fuzz testing according to claim 1 , wherein the protocol configuration module configuring the protocol to be detected and the data frame of the protocol to be detected specifically comprises: determining a protocol name, adding a protocol description while creating the protocol name, adding, based on a test need after determining the protocol, a data frame that needs to be tested, and determining a function name and a frame format of the configured data frame.

3. The system for detecting a vulnerability of an IOTIPS protocol based on fuzz testing according to claim 1 , wherein the configuring a mutation strategy comprises configuring a strategy name, a protocol name, a function name, a frame preview, a mutation mode, the start position, and a mutation sample, wherein the strategy name, the protocol name, the function name, and the frame preview belong to description fields.

4. The system for detecting a vulnerability of an IOTIPS protocol based on fuzz testing according to claim 3 , wherein the mutation mode comprises the single-byte mode and the double-byte mode, and whether to use the single-byte mode or the double-byte mode is customized based on a semantic need of a field.

5. The system for detecting a vulnerability of an IOTIPS protocol based on fuzz testing according to claim 3 , wherein the start position is configured to accurately describe a position where mutation needs to be performed, so as to avoid meaningless redundancy caused by performing mutation on all positions.

6. The system for detecting a vulnerability of an IOTIPS protocol based on fuzz testing according to claim 3 , wherein the mutation sample is set to a system sample, a custom fixed value, or a custom range, the system sample has built-in typical mutation values corresponding to the single-byte mode and the double-byte mode respectively, the custom fixed value and the custom range are configured to generate targeted test-specific mutation sample content for semantically-free industrial control communication protocols of various private IOTIPSs after semantic analysis.

7. The system for detecting a vulnerability of an IOTIPS protocol based on fuzz testing according to claim 1 , wherein the link management performed by the execution monitoring module is to manage a connection between a test system and the device to be detected, comprising a link name, a link type, and specific content; the test execution is responsible for selecting a test item to start the test task, comprising setting a task name, selecting a link, and selecting the mutation strategy; and during the test execution, currently completed test content is viewed at any time through status monitoring, comprising a selected protocol name, a function name, packet sending and receiving time, an original data frame, a mutated data frame, and a response result, and the system stores the test result, and marks a data frame with an abnormal response result in an exported report as a main basis for vulnerability analysis.

Assignments (2)

Priority Claims (1)

Continuity (1)

References Cited (13)