CN114205340A - Fuzzy test method and device based on intelligent power equipment - Google Patents

Fuzzy test method and device based on intelligent power equipment Download PDF

Info

Publication number
CN114205340A
CN114205340A CN202111591437.3A CN202111591437A CN114205340A CN 114205340 A CN114205340 A CN 114205340A CN 202111591437 A CN202111591437 A CN 202111591437A CN 114205340 A CN114205340 A CN 114205340A
Authority
CN
China
Prior art keywords
protocol
target
intelligent power
power
test case
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202111591437.3A
Other languages
Chinese (zh)
Other versions
CN114205340B (en
Inventor
汪渊博
吴俊�
李子奇
严晗
王梓豪
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nsfocus Technologies Inc
Nsfocus Technologies Group Co Ltd
Original Assignee
Nsfocus Technologies Inc
Nsfocus Technologies Group Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nsfocus Technologies Inc, Nsfocus Technologies Group Co Ltd filed Critical Nsfocus Technologies Inc
Priority to CN202111591437.3A priority Critical patent/CN114205340B/en
Publication of CN114205340A publication Critical patent/CN114205340A/en
Application granted granted Critical
Publication of CN114205340B publication Critical patent/CN114205340B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/26Special purpose or proprietary protocols or architectures
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing data switching networks
    • H04L43/06Generation of reports
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing data switching networks
    • H04L43/18Protocol analysers
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/20Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/02Protocol performance
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/18Multiprotocol handlers, e.g. single devices capable of handling multiple protocols

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Maintenance And Management Of Digital Transmission (AREA)

Abstract

The embodiment of the application provides a fuzzy test method and device based on intelligent power equipment, which are used for improving the test efficiency of the fuzzy test on the intelligent power equipment. The method comprises the following steps: determining a target power protocol corresponding to the target intelligent power equipment; performing variation on the variable field of the target power protocol according to a preset variation strategy to generate a test case; wherein the variable field of the target power protocol is determined according to protocol characteristics of the target power protocol; and sending the test case to the target intelligent power equipment so that the target intelligent power equipment executes the test case.

Description

Fuzzy test method and device based on intelligent power equipment
Technical Field
The invention relates to the technical field of industrial control, in particular to a fuzzy test method and device based on intelligent power equipment.
Background
With the continuous development of the internet of things technology and the communication technology, the power internet of things based on the industrial control system is also continuously perfected and developed, and while the power internet of things is developed, the security loopholes are continuously increased, the security threats are accelerated to permeate, and the attack means are more, more and more complex and various. Therefore, the safety of the intelligent power equipment is mainly researched through a fuzzy test mode, and in the process of the fuzzy test, because the intelligent power equipment does not support a conventional communication protocol, but uses communication protocols such as a power protocol standard and the like, when the protocol format of the power protocol is incorrect, the intelligent power equipment cannot carry out protocol analysis on the power protocol, a test case of the fuzzy test cannot be correctly executed, so that the problems of incomplete test, low test efficiency and the like are caused, and safety researchers cannot deeply dig the safety problem of the intelligent power equipment.
Disclosure of Invention
The embodiment of the application provides a fuzzy test method and device based on intelligent power equipment, which are used for solving the problem of incomplete test and improving the test efficiency of fuzzy test on the intelligent power equipment.
In a first aspect, a fuzzy test method based on intelligent power equipment is provided, and the method includes:
determining a target power protocol corresponding to the target intelligent power equipment;
performing variation on the variable field of the target power protocol according to a preset variation strategy to generate a test case; wherein the variable field of the target power protocol is determined according to protocol characteristics of the target power protocol;
and sending the test case to the target intelligent power equipment so that the target intelligent power equipment executes the test case.
Optionally, after the sending the test case to the target intelligent power device, the method further includes:
determining whether the device state of the target intelligent power device is abnormal;
if the equipment state of the target intelligent electric equipment is abnormal, acquiring an execution result of the target intelligent electric equipment aiming at the test case;
and generating a test report according to the execution result.
Optionally, before determining the target power protocol corresponding to the target intelligent power device, the method further includes:
determining connection parameters of the target intelligent power equipment; the connection parameters comprise an Internet Protocol (IP) address, a port number and a network card name;
and establishing connection with the target intelligent power equipment according to the connection parameters.
Optionally, the varying the variable field of the target power protocol according to a preset variation strategy to generate a test case includes:
acquiring network communication data of the target intelligent power equipment;
constructing power network protocol data according to the target power protocol and the network communication data;
analyzing the power network protocol data to obtain the variable fields;
and carrying out mutation on the variable field according to a preset mutation strategy to generate the test case.
Optionally, if the target power protocol is a generic event oriented GOOSE (generic event) protocol or a sampling value SV protocol, before the varying the variable field of the target power protocol according to a preset variation strategy, the method further includes:
and binding a network card, and communicating with the target intelligent power equipment based on the network card.
Optionally, if the target power protocol is a MMS protocol, before the varying the variable field of the target power protocol according to a preset variation policy, the method further includes:
encapsulating a bottom layer protocol corresponding to the MMS protocol; the bottom layer protocol comprises an application layer data transmission protocol TPKT and a connection-oriented transmission protocol COTP.
Optionally, if the target power protocol is an IEC-104 protocol, before the varying the variable field of the target power protocol according to a preset variation policy, the method further includes:
and constructing a starting byte according to a protocol rule corresponding to the IEC-104 protocol.
In a second aspect, a fuzzy test device based on intelligent power equipment is provided, the device includes:
the processing module is used for determining a target power protocol corresponding to the target intelligent power equipment;
the processing module is further used for carrying out variation on the variable fields of the target power protocol according to a preset variation strategy to generate a test case; wherein the variable field of the target power protocol is determined according to protocol characteristics of the target power protocol;
and the communication module is used for sending the test case to the target intelligent power equipment so as to enable the target intelligent power equipment to execute the test case.
Optionally, the processing module is further configured to:
determining whether the device state of the target intelligent power device is abnormal;
if the equipment state of the target intelligent electric equipment is abnormal, acquiring an execution result of the target intelligent electric equipment aiming at the test case;
and generating a test report according to the execution result.
Optionally, the processing module is further configured to:
determining connection parameters of the target intelligent power equipment; the connection parameters comprise an Internet Protocol (IP) address, a port number and a network card name;
and establishing connection with the target intelligent power equipment according to the connection parameters.
Optionally, the processing module is specifically configured to:
acquiring network communication data of the target intelligent power equipment;
constructing power network protocol data according to the target power protocol and the network communication data;
analyzing the power network protocol data to obtain the variable fields;
and carrying out mutation on the variable field according to a preset mutation strategy to generate the test case.
Optionally, the processing module is further configured to:
when the target power protocol is a general event-oriented substation event GOOSE protocol or a sampling value SV protocol, binding a network card;
the communication module is further used for communicating with the target intelligent power equipment based on the network card.
Optionally, the processing module is further configured to:
when the target power protocol is a Manufacturing Message Specification (MMS) protocol, encapsulating a bottom layer protocol corresponding to the MMS protocol; the bottom layer protocol comprises an application layer data transmission protocol TPKT and a connection-oriented transmission protocol COTP.
Optionally, the processing module is further configured to:
and when the target power protocol is the IEC-104 protocol, constructing a start byte according to a protocol rule corresponding to the IEC-104 protocol.
In a third aspect, an electronic device is provided, which includes:
a memory for storing program instructions;
a processor for calling the program instructions stored in the memory and executing the steps comprised in any of the methods of the first aspect according to the obtained program instructions.
In a fourth aspect, there is provided a computer-readable storage medium having stored thereon computer-executable instructions for causing a computer to perform the steps included in the method of any one of the first aspects.
In a fifth aspect, a computer program product containing instructions is provided, which when run on a computer causes the computer to perform the method for fuzz testing based on intelligent power devices as described in the various possible implementations above.
In the embodiment of the application, a target power protocol corresponding to a target intelligent power device is determined, a variable field of the target power protocol is varied according to a preset variation strategy, a test case is generated, wherein the variable field of the target power protocol is determined according to protocol characteristics of the target power protocol, and then the generated test case is sent to the target intelligent power device, so that the target intelligent power device executes the test case, and therefore the fuzzy test of the target intelligent power device is achieved. The variable fields are determined according to the protocol characteristics of different power protocols, so that the fields subjected to variation cannot influence the analysis of the intelligent power equipment on the power protocols, the intelligent power equipment can correctly execute the test cases generated after the fields are subjected to variation, the test is more comprehensive, and the test efficiency of the fuzzy test can be effectively improved.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application.
Fig. 1 is a flowchart of a fuzzy test method based on an intelligent power device according to an embodiment of the present disclosure;
fig. 2 is a communication schematic diagram of a GOOSE protocol according to an embodiment of the present application;
fig. 3 is a flowchart of another fuzzy test method based on an intelligent power device according to an embodiment of the present disclosure;
fig. 4 is a block diagram of a fuzzy test apparatus based on an intelligent power device according to an embodiment of the present disclosure;
fig. 5 is a schematic structural diagram of a computer device in an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the accompanying drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application. In the present application, the embodiments and features of the embodiments may be arbitrarily combined with each other without conflict. Also, while a logical order is shown in the flow diagrams, in some cases, the steps shown or described may be performed in an order different than here.
The terms "first" and "second" in the description and claims of the present application and the above-described drawings are used for distinguishing between different objects and not for describing a particular order. Furthermore, the term "comprises" and any variations thereof, which are intended to cover non-exclusive protection. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those steps or elements listed, but may alternatively include other steps or elements not listed, or inherent to such process, method, article, or apparatus. The "plurality" in the present application may mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.
In addition, the term "and/or" herein is only one kind of association relationship describing an associated object, and means that there may be three kinds of relationships, for example, a and/or B, which may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" in this document generally indicates that the preceding and following related objects are in an "or" relationship unless otherwise specified.
Before describing the embodiments of the present application, some technical features of the present application will be described to facilitate understanding for those skilled in the art.
(1) Fuzzing is a method of discovering software vulnerabilities by providing unintended input to a target system and monitoring for anomalous results.
(2) Intelligent Electrical Devices (IEDs), consisting of one or more processors, have any Device that receives and transmits data from or controls an external source, i.e. Electronic multifunction meters, microcomputer protection, controllers, entities that can perform one or more logical contact tasks within the limits of the interface under certain circumstances.
(3) The black box test is mainly used for testing product interfaces and functions, and aims at the external structure of a program, and does not consider the internal logic structure.
The technical background of the embodiments of the present invention will be described.
At present, a method for performing a fuzzy test on IED equipment is mainly a black box test, and the following problems mainly exist in the process of the black box test: (1) the mechanism of the protocol is not analyzed, and useless fields are traversed, so that the IED equipment cannot normally analyze the protocol; (2) sending a test case without limit to perform a fuzzy test, and running the fuzzy test for a long time possibly causes that equipment does not respond temporarily, so that misjudgment is caused, and a risk point cannot be triggered; (3) because the mechanism of the protocol itself is not analyzed, the test cases generated after the mutation of some fields of the protocol do not accord with the protocol rules, which causes communication errors and test cases to fail.
In view of this, an embodiment of the present application provides a fuzzy test method based on an intelligent power device, which generates a test case by determining a target power protocol corresponding to the target intelligent power device and performing variation on a variable field of the target power protocol according to a preset variation strategy, where the variable field of the target power protocol is determined according to a protocol characteristic of the target power protocol, and sends the test case to the target intelligent power device, so that the intelligent power device executes the test case, thereby performing a fuzzy test on the intelligent power device. The variable fields of the target power protocol are determined according to the protocol characteristics of the target power protocol, so that the test cases generated by the variable fields are in accordance with the protocol rules, the target intelligent power equipment can analyze the protocol, and the test efficiency of the fuzzy test is effectively improved.
The fuzzy test method based on the intelligent power equipment provided by the embodiment of the application is described below with reference to the attached drawings of the specification. Referring to fig. 1, a flow of the fuzzy test method based on the intelligent power device in the embodiment of the present application is described as follows:
step 101: determining a target power protocol corresponding to the target intelligent power equipment;
the fuzzy test method based on the intelligent power equipment provided by the embodiment of the application can be applied to fuzzy test equipment, such as a computer, a server and other terminal equipment which can run programs, so that before a target power Protocol corresponding to the target intelligent power equipment is determined, connection parameters of the target intelligent power equipment, namely an Internet Protocol (IP) address, a port number and a network card name of the target intelligent power equipment, need to be determined, and the fuzzy test equipment establishes connection with the target intelligent power equipment according to the connection parameters of the target intelligent power equipment. In this embodiment of the application, determining the target power protocol corresponding to the target intelligent power device may be performed by acquiring network communication data of the target intelligent power device, analyzing the communication data, and determining the target power protocol corresponding to the target intelligent power device.
Step 102: the variable fields of the target power protocol are varied according to a preset variation strategy, and a test case is generated;
wherein the variable field of the target power protocol is determined according to the protocol characteristics of the target power protocol. The power protocols supported by the current intelligent power equipment mainly include: IEC-104, Manufacturing Message Specification (MMS) protocol, general event oriented substation event GOOSE protocol, Sampled Values (SV) protocol, Modbus protocol, and the like. Different power protocols are described below:
(1) GOOSE protocol
The GOOSE protocol is mainly used in intelligent substations to transmit real-time signals in IEDs in the substations, such as protection tripping, and is an event-based protocol. The communication principle is that a public announcement module (publisher) periodically sends messages, when events such as tripping operation, closing of a contactor and the like occur, the publisher sends a series of messages containing new data, when a receiving buffer receives the new data messages (i.e. new GOOSE messages), relevant parameters of the GOOSE messages are checked, the GOOSE messages of a current frame and the GOOSE messages of a previous frame are compared, and whether the parameters of the state numbers (StNum) of the GOOSE messages of the current frame and the GOOSE messages of the previous frame are equal or not is determined. If the StNum of the GOOSE message of the current frame is equal to that of the GOOSE message of the previous frame, continuing to compare the sequence numbers (SqNum) of the GOOSE messages of the current frame and the previous frame, if the SqNum of the GOOSE message of the current frame is larger than the SqNum of the GOOSE message of the previous frame, discarding the GOOSE message of the current frame, and otherwise, updating the data of the receiving party. If StNum of two frames of GOOSE messages is not equal, the data of the receiving party is updated, and the specific flow can refer to fig. 2. Therefore, when field mutation is performed, it is required to conform to a GOOSE security mechanism, and the stNum field and the sqNum field are kept unchanged, that is, the stNum field and the sqNum field cannot be mutated, and after the field mutation is performed on the ndsCom field, numdatsetententries field, and allData field, normal analysis of the power protocol by the intelligent power equipment will not be affected, that is, the field mutation of the GOOSE protocol, numdatsetententries field, and allData field can be determined to be a variable different field of the GOOSE protocol.
(2) SV protocol
The SV protocol generally communicates in a publish/subscribe mode, And similar to the GOOSE protocol, the adopted communication technologies are multicast communication, the SV protocol reflects the real situation of the operation of the System equipment of the intelligent substation, And is the main basis for state estimation of a Data Acquisition And monitoring System (SCADA) And an Energy Management System (EMS). Wherein, the Application Protocol Data Unit (APDU) field contains the payload of the SV message, each APDU contains up to 8 Application Specific Data Units (ASDUs), the number of the ASDUs contained in each APDU is specified by the noasd (number of ASDUs) field, and each ASDU has a unique SV identification value.
And the IEC 61850-9-2LE protocol defines that each ASDU must contain SV identifier (svID), SV message counter (smpCnt), configuration version number (confRev), synchronization mechanism (smpSynch) field defining the clock for transmitting SV messages, and since the IEC 61850 standard working on intelligent substations does not itself specify a security policy nor does it enforce the use of any authentication or encryption techniques, it cannot resist various network attacks. Therefore, when field mutation is performed, the ASDU structure conforming to the SV definition needs to be maintained, and the svID and smpCnt fields need to be maintained, while the fields of confRef, smpSynch, seqData, etc. after the field mutation will not affect the normal analysis of the power protocol by the smart power device, i.e., the fields of confRef, smpSynch, seqData, etc. can be determined as the variable fields of the SV protocol.
(3) MMS protocol
The MMS is a set of international message specifications which are provided by the ISO TC184 and are used for realizing real-time data exchange and monitoring between intelligent power equipment in a heterogeneous network environment, and the service provided by the MMS has strong universality and is widely applied to the industrial automation fields of automobile manufacturing, aviation, chemical engineering, electric power and the like. MMS is encapsulated by a Transmission Control Protocol (TCP) with a port number of 102. The protocol of each layer from top to bottom is shown in table 1:
Figure BDA0003430007500000091
TABLE 1
On the basis of TCP, the MMS Protocol also encapsulates a Transport Service on top of the TCP (Transmission Protocol Data Unit) and a Connection-Oriented Transport Protocol (COTP), the TPKT Protocol uses a simple packet scheme to divide a Transport Protocol Data Unit (TPDU), each packet is regarded as an object consisting of an integer number of variable-length bytes, and the header format of the TPKT comprises a version number, a first single-byte reserved field and two byte lengths, wherein the two byte lengths are the total length of a TPKT Protocol Data Unit (PDU) comprising a header, the TPKTPDU is transmitted through the TCP, and the destination port is 102; the COTP protocol defines several messages, MMS mainly uses Connection Request (CR) (i.e. field TPDU code 0xd0), Connection Confirm (CC) (i.e. field TPDU code0xe0) and Data (Data, DT) (i.e. field TPDU code 0xf0) messages, and when connection is established, CR and CC messages are used, and in the normal operation phase, DT messages are used to transmit user Data; the first single byte represents the head length, not including the length of the data portion; when a TCP session is established using COTP, its srcoref is first sent by the sender, at which time DstRef is not initialized, and then after confirmation by the CC message, both srcoref and DstRef are established, and as soon as the session is established, COTP transmits data using DT, COTP DT having a fixed length size (2 bytes), TPDU code 0xf 0. The analysis shows that the MMS protocol interaction process is all plaintext transmission, and no verification authentication mechanism exists when the protocol is connected, so that the transformer substation based on MMS protocol communication is very vulnerable under most network attacks. Therefore, the field mutation needs to conform to the MMS-defined ASDU structure, and since most MMS communications are obtained through acknowledgement request and acknowledgement response messages, the acknowledgement request PDU includes a request-specific identifier invoke id and a type of ConfirmedServiceRequest, and it is determined that the fields such as status, getNameList, read, write, etc. are the variable fields of the MMS protocol.
(4) IEC-104 protocol
The IEC-104 is a power protocol based on TCP/IP, and is mainly used for remote data monitoring and the like, the communication of the IEC-104 is generally mainly composed of a slave station server side for sending data and receiving commands and a master station client side for receiving the data and sending the commands, and response type data transmission is adopted, generally uplink data is remote signaling and remote measuring, and downlink data is remote control and remote regulating. The process for selecting application functions and user processes is shown in table 2:
Figure BDA0003430007500000101
Figure BDA0003430007500000111
TABLE 2
Wherein, the APCI is a control information part, the ASDU is a storage data unit, and the APDU is a length equal to APCI + ASDU-2, namely subtracting the start byte and the APDU length byte. Each APCI starts with a start byte with a value of 0x68 followed by an 8-bit length of the APDU and four 8-bit Control Fields (CF). The APDU contains one APCI or one APCI with an ASDU, and the length of the APCI is generally 6 bytes. The APDU comprises data packets with fixed length and variable length, the frame format is determined by the last two bits of the first control field (CF1), the standard defines three frame formats, namely a U frame (control message frame), an S frame (monitoring frame) and an I frame (information transmission frame), wherein the last bit of the CF1 of the I frame is 0 for number information transmission between the master station and the controlled station, the APDU of the I frame has variable length and always comprises an ASDU, the control field of the I frame indicates the message direction and comprises two 15-bit sequence numbers, and the sequence number is increased by 1 for each APDU and each direction; s-frames, the last bit of CF1 being 01, for performing a numbered supervision function, having a fixed length, the APDUs of an S-frame always containing only one APCI, in any case data being transmitted in only a single direction, the S-frame APDUs being sent in the other direction upon timeout, buffer overflow or exceeding the maximum number of allowed I-frame APDUs without acknowledgement; the last bit of the U frame, CF1, is 11, for performing unnumbered control functions, and has a fixed length. Therefore, when performing field mutation, it is necessary to satisfy length message detection and control field frame format of the APDU, that is, it is able to determine various fields (such as COT and IOA fields) in the ASDU as the variable field.
In the embodiment of the application, after the network communication data of the target intelligent power device can be acquired, power network protocol data can be constructed according to the target power protocol and the network communication data, the power network protocol data is analyzed, the variable fields are acquired, the variable fields are varied according to a preset strategy, and a test case is generated. For example, if the target power protocol corresponding to the target intelligent power device is a GOOSE protocol, the power network protocol data constructed based on the GOOSE protocol and the communication data of the target intelligent power device may be analyzed to obtain fields such as ndsCom, numDatSetEntries, allData, etc., generate relevant parameters outside the preset range corresponding to the fields, and implement variation of the fields (for example, a preset range corresponding to a certain field is a number between 10 and 20, and when variation is performed, a number between 0 and 10 or a number between 20 and 100 is generated).
In a possible implementation manner, if the target power protocol is a GOOSE protocol or an SV protocol, at this time, because the GOOSE protocol and the SV protocol belong to a bottom layer protocol (i.e., a protocol that does not communicate through TCP/IP), a network card needs to be bound before a variable different field of the GOOSE protocol or the SV protocol is mutated, and the network card communicates with the target intelligent power device based on the bound network card, specifically, the network card may be bound by using a python socket mechanism to generate a two-layer network data packet; if the target power protocol is an MMS protocol, the MMS message can be normally constructed only by the TPKT protocol and the COTP protocol at the bottom layer of the MMS protocol, so the TPKT protocol and the COTP protocol are required to be packaged before the variable fields of the MMS protocol are subjected to variation; if the target power protocol is the IEC-104 protocol, since the APCI in the protocol rule corresponding to the IEC-104 protocol requires 0x68 as the start byte, the start byte 0x68 needs to be constructed before the variation field of the IEC-104 protocol is varied.
Step 103: and sending the test case to the target intelligent power equipment.
In the embodiment of the application, the fuzzy test equipment mutates a variable field of a target power protocol, generates a test case, and then sends the test case to the target intelligent power equipment, and the target power equipment executes the test case after receiving the test case.
In a specific implementation process, points needing attention and variable fields when a test case is generated are pointed out, when constructed power network protocol data are analyzed, only the variable fields can be analyzed, compared with traversing each field in a black box test, the variable field analyzing method effectively reduces the analyzing time needed in the fuzzy test process, reduces the probability of risk false alarm to a certain extent, improves the accuracy rate of risk point identification, and accordingly effectively improves the test efficiency of the fuzzy test.
In order to better understand the technical solution of the present application, the following explains the fuzz testing method based on the intelligent power device provided by the present application with reference to specific embodiments.
Examples
Referring to fig. 3, when performing a fuzzy test on a target intelligent power device, first, a normal power network protocol data is constructed based on a target power protocol (i.e., a power system communication protocol) used by the target intelligent power device and acquired network communication data of the target intelligent power device, then the power network protocol data is analyzed to acquire a variable field, the variable field is varied according to a preset variation strategy to generate a test case (i.e., a malformed data packet), the malformed data packet is sent to the target intelligent power device (i.e., a tested industrial control target) by a network packet sending tool, so that the tested industrial control target executes the malformed data packet, and the state of the tested industrial control target is monitored by a monitor to determine whether the target intelligent power device is abnormal, if so, a test report is generated, if so, and changing the content of the variable field and continuing to perform the fuzz test on the intelligent power equipment.
Based on the same inventive concept, the embodiment of the application provides a fuzzy test device based on intelligent power equipment, and the fuzzy test device based on the intelligent power equipment can realize the corresponding functions of the fuzzy test method based on the intelligent power equipment. The fuzzy test device based on the intelligent power equipment can be a hardware structure, a software module or a hardware structure and a software module. The fuzzy test device based on the intelligent power equipment can be realized by a chip system, and the chip system can be formed by a chip and can also comprise the chip and other discrete devices. Referring to fig. 4, the fuzz testing apparatus based on the intelligent power device includes a processing module 401 and a communication module 402. Wherein:
the processing module 401 is configured to determine a target power protocol corresponding to a target intelligent power device;
the processing module 401 is further configured to perform variation on the variable field of the target power protocol according to a preset variation strategy, so as to generate a test case; wherein the variable field of the target power protocol is determined according to protocol characteristics of the target power protocol;
a communication module 402, configured to send the test case to the target intelligent power device, so that the target intelligent power device executes the test case.
Optionally, the processing module 401 is further configured to:
determining whether the device state of the target intelligent power device is abnormal;
if the equipment state of the target intelligent electric equipment is abnormal, acquiring an execution result of the target intelligent electric equipment aiming at the test case;
and generating a test report according to the execution result.
Optionally, the processing module 401 is further configured to:
determining connection parameters of the target intelligent power equipment; the connection parameters comprise an Internet Protocol (IP) address, a port number and a network card name;
and establishing connection with the target intelligent power equipment according to the connection parameters.
Optionally, the processing module 401 is specifically configured to:
acquiring network communication data of the target intelligent power equipment;
constructing power network protocol data according to the target power protocol and the network communication data;
analyzing the power network protocol data to obtain the variable fields;
and carrying out mutation on the variable field according to a preset mutation strategy to generate the test case.
Optionally, the processing module 401 is further configured to:
when the target power protocol is a general event-oriented substation event GOOSE protocol or a sampling value SV protocol, binding a network card;
the communication module 402 is further configured to communicate with the target smart power device based on the network card.
Optionally, the processing module 401 is further configured to:
when the target power protocol is a Manufacturing Message Specification (MMS) protocol, encapsulating a bottom layer protocol corresponding to the MMS protocol; the bottom layer protocol comprises an application layer data transmission protocol TPKT and a connection-oriented transmission protocol COTP.
Optionally, the processing module 401 is further configured to:
and when the target power protocol is the IEC-104 protocol, constructing a start byte according to a protocol rule corresponding to the IEC-104 protocol.
All relevant contents of each step related to the foregoing embodiment of the fuzzy test method based on the intelligent power device may be cited to the functional description of the functional module corresponding to the fuzzy test apparatus based on the intelligent power device in the embodiment of the present application, and are not described herein again.
The division of the modules in the embodiments of the present application is schematic, and only one logical function division is provided, and in actual implementation, there may be another division manner, and in addition, each functional module in each embodiment of the present application may be integrated in one processor, may also exist alone physically, or may also be integrated in one module by two or more modules. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode.
Based on the same inventive concept, the embodiment of the application provides electronic equipment. Referring to fig. 5, the electronic device includes at least one processor 501 and a memory 502 connected to the at least one processor, in this embodiment, a specific connection medium between the processor 501 and the memory 502 is not limited in this application, in fig. 5, the processor 501 and the memory 502 are connected through a bus 500 as an example, the bus 500 is represented by a thick line in fig. 5, and connection manners between other components are only schematically illustrated and not limited. The bus 500 may be divided into an address bus, a data bus, a control bus, etc., and is shown with only one thick line in fig. 5 for ease of illustration, but does not represent only one bus or one type of bus.
In the embodiment of the present application, the memory 502 stores instructions executable by the at least one processor 501, and the at least one processor 501 may execute the steps included in the foregoing method for fuzz testing based on an intelligent power device by executing the instructions stored in the memory 502.
The processor 501 is a control center of the electronic device, and may connect various parts of the whole electronic device by using various interfaces and lines, and perform various functions and process data of the electronic device by operating or executing instructions stored in the memory 502 and calling data stored in the memory 502, thereby performing overall monitoring on the electronic device. Optionally, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly handles operating systems, application programs, and the like, and the modem processor mainly handles wireless communication. It will be appreciated that the modem processor described above may not be integrated into the processor 501. In some embodiments, processor 501 and memory 502 may be implemented on the same chip, or in some embodiments, they may be implemented separately on separate chips.
The processor 501 may be a general-purpose processor, such as a Central Processing Unit (CPU), digital signal processor, application specific integrated circuit, field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, that may implement or perform the methods, steps, and logic blocks disclosed in embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the fuzzy test method based on the intelligent power equipment disclosed by the embodiment of the application can be directly embodied as the execution of a hardware processor, or the execution of the steps can be completed by the combination of hardware and software modules in the processor.
Memory 502, which is a non-volatile computer-readable storage medium, may be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The Memory 502 may include at least one type of storage medium, and may include, for example, a flash Memory, a hard disk, a multimedia card, a card-type Memory, a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a Programmable Read Only Memory (PROM), a Read Only Memory (ROM), a charge Erasable Programmable Read Only Memory (EEPROM), a magnetic Memory, a magnetic disk, an optical disk, and so on. The memory 502 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. The memory 502 in the embodiments of the present application may also be circuitry or any other device capable of performing a storage function for storing program instructions and/or data.
By programming the processor 501, the code corresponding to the fuzzy test method based on the intelligent power device described in the foregoing embodiment may be solidified into a chip, so that the chip can execute the steps of the fuzzy test method based on the intelligent power device when running.
Based on the same inventive concept, the embodiment of the present application further provides a computer-readable storage medium, which stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the steps of the intelligent power device-based fuzz testing method as described above.
In some possible embodiments, the various aspects of the intelligent power device based fuzz testing method provided by the present application can also be implemented in the form of a program product, which includes program code for causing the detection device to perform the steps of the intelligent power device based fuzz testing method according to various exemplary embodiments of the present application described above in this specification, when the program product is run on an electronic device.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims (10)

1. A fuzzy test method based on intelligent power equipment is characterized by comprising the following steps:
determining a target power protocol corresponding to the target intelligent power equipment;
performing variation on the variable field of the target power protocol according to a preset variation strategy to generate a test case; wherein the variable field of the target power protocol is determined according to protocol characteristics of the target power protocol;
and sending the test case to the target intelligent power equipment so that the target intelligent power equipment executes the test case.
2. The method of claim 1, wherein after the sending the test case to the target smart power device, further comprising:
determining whether the device state of the target intelligent power device is abnormal;
if the equipment state of the target intelligent electric equipment is abnormal, acquiring an execution result of the target intelligent electric equipment aiming at the test case;
and generating a test report according to the execution result.
3. The method of claim 1, wherein before determining the target power protocol corresponding to the target smart power device, further comprising:
determining connection parameters of the target intelligent power equipment; the connection parameters comprise an Internet Protocol (IP) address, a port number and a network card name;
and establishing connection with the target intelligent power equipment according to the connection parameters.
4. The method of claim 1, wherein the mutating the variable field of the target power protocol according to a preset mutation policy to generate a test case comprises:
acquiring network communication data of the target intelligent power equipment;
constructing power network protocol data according to the target power protocol and the network communication data;
analyzing the power network protocol data to obtain the variable fields;
and carrying out mutation on the variable field according to a preset mutation strategy to generate the test case.
5. The method of claim 1, wherein if the target power protocol is a generic event oriented substation event GOOSE protocol or a sampled value SV protocol, before mutating the variable field of the target power protocol according to a preset mutation policy, the method further comprises:
and binding a network card, and communicating with the target intelligent power equipment based on the network card.
6. The method of claim 1, wherein if the target power protocol is a Manufacturing Message Specification (MMS) protocol, before mutating the variable field of the target power protocol according to a predetermined mutation policy, the method further comprises:
encapsulating a bottom layer protocol corresponding to the MMS protocol; the bottom layer protocol comprises an application layer data transmission protocol TPKT and a connection-oriented transmission protocol COTP.
7. The method of claim 1, wherein before the varying the variable field of the target power protocol according to a predetermined variation strategy if the target power protocol is IEC-104, further comprising:
and constructing a starting byte according to a protocol rule corresponding to the IEC-104 protocol.
8. A fuzzy test device based on intelligent power equipment is characterized in that the device comprises:
the processing module is used for determining a target power protocol corresponding to the target intelligent power equipment;
the processing module is further used for carrying out variation on the variable fields of the target power protocol according to a preset variation strategy to generate a test case; wherein the variable field of the target power protocol is determined according to protocol characteristics of the target power protocol;
and the communication module is used for sending the test case to the target intelligent power equipment so as to enable the target intelligent power equipment to execute the test case.
9. An electronic device, comprising:
a memory for storing program instructions;
a processor for calling program instructions stored in said memory and for executing the steps comprised by the method of any one of claims 1 to 7 in accordance with the obtained program instructions.
10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program comprising program instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1-7.
CN202111591437.3A 2021-12-23 2021-12-23 Fuzzy test method and device based on intelligent power equipment Active CN114205340B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111591437.3A CN114205340B (en) 2021-12-23 2021-12-23 Fuzzy test method and device based on intelligent power equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111591437.3A CN114205340B (en) 2021-12-23 2021-12-23 Fuzzy test method and device based on intelligent power equipment

Publications (2)

Publication Number Publication Date
CN114205340A true CN114205340A (en) 2022-03-18
CN114205340B CN114205340B (en) 2024-04-02

Family

ID=80656267

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111591437.3A Active CN114205340B (en) 2021-12-23 2021-12-23 Fuzzy test method and device based on intelligent power equipment

Country Status (1)

Country Link
CN (1) CN114205340B (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117156022A (en) * 2023-11-01 2023-12-01 中国电子科技集团公司第三十研究所 Variation data generation method for fuzzy test
CN117170350A (en) * 2023-11-02 2023-12-05 国汽(北京)智能网联汽车研究院有限公司 Service testing method and device, electronic equipment and storage medium

Citations (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070006153A1 (en) * 2005-05-25 2007-01-04 Microsoft Corporation Extensible testing framework
CN102087631A (en) * 2011-03-09 2011-06-08 中国人民解放军国发科学技术大学 Method for realizing fuzzing of software on the basis of state protocol
JP2014179705A (en) * 2013-03-13 2014-09-25 Hitachi Ltd Protocol test method and system
CN106506280A (en) * 2016-11-24 2017-03-15 工业和信息化部电信研究院 The communication protocol method of testing of intelligent home device and system
EP3370372A1 (en) * 2017-03-01 2018-09-05 Wipro Limited System and method for testing a device using a light weight device validation protocol
CN109922063A (en) * 2019-03-05 2019-06-21 南方电网科学研究院有限责任公司 The dirty data creation method of multifunction electric meter communication protocol fuzz testing
CN110336827A (en) * 2019-07-15 2019-10-15 北京工业大学 A kind of Modbus Transmission Control Protocol fuzz testing method based on exception field positioning
CN110505111A (en) * 2019-07-09 2019-11-26 杭州电子科技大学 The industry control agreement fuzz testing method reset based on flow
CN110677273A (en) * 2019-08-19 2020-01-10 浙江大学 Fuzzy test method for GOOSE protocol of intelligent substation
CN110752966A (en) * 2019-10-08 2020-02-04 南京南瑞继保电气有限公司 Network protocol security test method and device, electronic equipment and storage medium
CN111123888A (en) * 2019-12-19 2020-05-08 江苏中天科技软件技术有限公司 Industrial control protocol testing method and system, electronic equipment and storage medium
CN111628900A (en) * 2019-02-28 2020-09-04 西门子股份公司 Fuzzy test method and device based on network protocol and computer readable medium
CN112055003A (en) * 2020-08-26 2020-12-08 上海电力大学 Method for generating private protocol fuzzy test case based on byte length classification
CN112187585A (en) * 2020-09-30 2021-01-05 腾讯科技(深圳)有限公司 Network protocol testing method and device
CN112395209A (en) * 2021-01-21 2021-02-23 博智安全科技股份有限公司 Industrial control protocol fuzzy test case generation method, device, equipment and storage medium
CN113326181A (en) * 2020-02-29 2021-08-31 华为技术有限公司 Fuzzy test method, device and storage medium for stateful network protocol
CN113392402A (en) * 2021-05-24 2021-09-14 国网湖北省电力有限公司电力科学研究院 Power Internet of things protocol vulnerability detection system and method based on fuzzy test
CN113507436A (en) * 2021-06-02 2021-10-15 中国人民解放军63880部队 Power grid embedded terminal fuzzy test method aiming at GOOSE protocol
CN113542299A (en) * 2021-07-29 2021-10-22 国家工业信息安全发展研究中心 Industrial internet vulnerability mining method and system based on fuzzy test

Patent Citations (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070006153A1 (en) * 2005-05-25 2007-01-04 Microsoft Corporation Extensible testing framework
CN102087631A (en) * 2011-03-09 2011-06-08 中国人民解放军国发科学技术大学 Method for realizing fuzzing of software on the basis of state protocol
JP2014179705A (en) * 2013-03-13 2014-09-25 Hitachi Ltd Protocol test method and system
CN106506280A (en) * 2016-11-24 2017-03-15 工业和信息化部电信研究院 The communication protocol method of testing of intelligent home device and system
EP3370372A1 (en) * 2017-03-01 2018-09-05 Wipro Limited System and method for testing a device using a light weight device validation protocol
CN111628900A (en) * 2019-02-28 2020-09-04 西门子股份公司 Fuzzy test method and device based on network protocol and computer readable medium
CN109922063A (en) * 2019-03-05 2019-06-21 南方电网科学研究院有限责任公司 The dirty data creation method of multifunction electric meter communication protocol fuzz testing
CN110505111A (en) * 2019-07-09 2019-11-26 杭州电子科技大学 The industry control agreement fuzz testing method reset based on flow
CN110336827A (en) * 2019-07-15 2019-10-15 北京工业大学 A kind of Modbus Transmission Control Protocol fuzz testing method based on exception field positioning
CN110677273A (en) * 2019-08-19 2020-01-10 浙江大学 Fuzzy test method for GOOSE protocol of intelligent substation
CN110752966A (en) * 2019-10-08 2020-02-04 南京南瑞继保电气有限公司 Network protocol security test method and device, electronic equipment and storage medium
CN111123888A (en) * 2019-12-19 2020-05-08 江苏中天科技软件技术有限公司 Industrial control protocol testing method and system, electronic equipment and storage medium
CN113326181A (en) * 2020-02-29 2021-08-31 华为技术有限公司 Fuzzy test method, device and storage medium for stateful network protocol
CN112055003A (en) * 2020-08-26 2020-12-08 上海电力大学 Method for generating private protocol fuzzy test case based on byte length classification
CN112187585A (en) * 2020-09-30 2021-01-05 腾讯科技(深圳)有限公司 Network protocol testing method and device
CN112395209A (en) * 2021-01-21 2021-02-23 博智安全科技股份有限公司 Industrial control protocol fuzzy test case generation method, device, equipment and storage medium
CN113392402A (en) * 2021-05-24 2021-09-14 国网湖北省电力有限公司电力科学研究院 Power Internet of things protocol vulnerability detection system and method based on fuzzy test
CN113507436A (en) * 2021-06-02 2021-10-15 中国人民解放军63880部队 Power grid embedded terminal fuzzy test method aiming at GOOSE protocol
CN113542299A (en) * 2021-07-29 2021-10-22 国家工业信息安全发展研究中心 Industrial internet vulnerability mining method and system based on fuzzy test

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117156022A (en) * 2023-11-01 2023-12-01 中国电子科技集团公司第三十研究所 Variation data generation method for fuzzy test
CN117170350A (en) * 2023-11-02 2023-12-05 国汽(北京)智能网联汽车研究院有限公司 Service testing method and device, electronic equipment and storage medium
CN117170350B (en) * 2023-11-02 2024-03-22 国汽(北京)智能网联汽车研究院有限公司 Service testing method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN114205340B (en) 2024-04-02

Similar Documents

Publication Publication Date Title
Radoglou-Grammatikis et al. Securing the smart grid: A comprehensive compilation of intrusion detection and prevention systems
CN112714193B (en) Community data processing system, method, device and equipment based on Internet of things platform
CN114205340B (en) Fuzzy test method and device based on intelligent power equipment
Li et al. SCADAWall: A CPI-enabled firewall model for SCADA security
EP2633433B1 (en) A method and a system for managing communications in industrial supervision and control systems
CN113765713A (en) Data interaction method based on Internet of things equipment acquisition
CN112822276B (en) Substation control layer communication method and system, electronic equipment and storage medium
CN110636075A (en) Operation and maintenance management and control and operation and maintenance analysis method and device
Vollmer et al. Autonomic intelligent cyber-sensor to support industrial control network awareness
CN114143068B (en) Electric power internet of things gateway equipment container safety protection system and method thereof
CN108429820A (en) A kind of communication means of internet of things application layer, system and terminal device
CN115988038B (en) Data management method and system based on Internet of things platform
Jain et al. SCADA security: a review and enhancement for DNP3 based systems
Mai et al. Uncharted networks: A first measurement study of the bulk power system
Sun et al. Research on distributed feeder automation communication based on XMPP and GOOSE
CN112437087A (en) Encryption and decryption method and system for gas meter with safety chip and gas meter system
US11606366B2 (en) Using CRC for sender authentication in a serial network
Kerkers Assessing the security of IEC 60870-5-104 implementations using automata learning
EP3078167B1 (en) Method, secure element and system for monitoring controller area network devices
Sharma et al. SCADA Communication Protocols: Modbus & IEC 60870–5
Lemay et al. A timing-based covert channel for SCADA networks
Ortiz et al. A Taxonomy of Industrial Control Protocols and Networks in the Power Grid
US11303468B2 (en) Equipment adapted for being connected to an AMM system
Murvay et al. A brief look at the security of DeviceNet communication in industrial control systems
Lekbich et al. A Secure Machine-to-Machine Wireless Communication Using DNP3 Protocol for Feeder Automation in Smart Grid

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant