CN102624587A - A detection system and method for implementation defects of IEC60870-5-101/104 communication protocol - Google Patents

Abstract

The invention provides a system and a method capable of achieving defect detection for an IEC60870-5-101/104 communication protocol. The system comprises a tester and a device to be tested, the device is connected with the tester, and the tester consists of a function point traversing unit and a protocol message variation testing unit receiving a traversing result. The method comprises the steps as follows: (1) carrying out coherence test for a message to be tested and transmitted by the device to be tested; (2) carrying out a variation test for the message to be tested; and (3) generating a test log and a statistical report. According to the system and the method provided by the invention, automatic detection to attack on a distribution power grid automatic system and terminal is achieved, so that protocol defect of the device to be tested is found out, and situation of non-disclosure and incorrect ruling of test problems can be reduced, and test process interruption is effectively prevented.

Description

A detection system and method for implementation defects of IEC60870-5-101/104 communication protocol

technical field

The invention belongs to the field of communication security of distribution network automation systems, and in particular relates to a detection system and method for realizing defects of the IEC60870-5-101/104 communication protocol.

Background technique

The intelligentization and interconnection of distribution network automation system and terminals increase the security risk of distribution network automation system communication. Traditional communication security protection can only reduce the security risks of power industrial control systems and terminals from the perspective of defense, but does not fundamentally solve the security risks of malicious Internet attacks in the process of distribution network automation system data communication. Carrying out the 101/104 protocol for communication security of distribution network automation system to realize defect detection has become an urgent need to actively eliminate potential safety hazards.

At present, the main test method for defect detection and vulnerability mining of network protocol implementation of communication equipment is the protocol robustness test based on fuzzy testing principle, and there are already mature protocol robustness testing tools. The working principle of fuzz testing is shown in Figure 1. The fuzzer uses a certain method to induce the tested object to enter the target state, by sending a pre-designed aggressive input to the target object, and then monitoring whether the returned result is abnormal. Discover the security holes of the object under test.

The fuzzer based on the protocol state machine usually consists of the protocol template of the object under test, generation of exception cases, state machine negotiation, sending of exception cases and monitoring of the object under test. Among them, the protocol template of the object under test is implemented in the form of a parameter script, which is used to describe the basic hierarchical structure and fields of the protocol message of the object under test, which is the basis of other parts; the abnormal use case generation uses a variety of algorithms to generate the final attack The use case is the core part of the fuzz test; the state machine negotiates with the object under test for normal message interaction, induces the object under test to enter the target state, so as to meet the conditions for sending the abnormal use case; the sending of the abnormal use case is based on the protocol of the object under test in the protocol stack The position in the fuzzer is used to correctly encapsulate and send the abnormal use case; the monitoring module in the fuzzer is used to collect and analyze the abnormal state of the object under test, and finally locate the vulnerability; through this method, it can be found that the object under test is in the process of network protocol processing security holes.

At present, there is no defect detection method for the implementation of the IEC60870-5-101/104 protocol. The general protocol robustness test method adopts the protocol state machine analysis based on the captured message, so that the test scope depends on the quality of the tester's captured message, which is difficult Achieve in-depth excavation of the defects in the implementation of the 101/104 protocol; and the existing protocol robustness testing method mainly relies on the analysis results of the message (message format, field type, etc.) , because general-purpose protocol analysis software cannot deeply analyze IEC60870-5-101/104 protocol messages, the applicability of abnormal test cases generated is poor, and it is difficult to guarantee the depth and efficiency of protocol robustness testing; moreover, the existing protocol robustness testing The tool cannot correctly handle 104 protocol receiving and sending serial number changes, etc., resulting in interruption of the test process or missed reports and misjudgments of test problems.

Contents of the invention

In order to overcome the above-mentioned defects, the present invention provides a detection system and method for implementing defects in the IEC60870-5-101/104 communication protocol to realize automatic detection of attacks on the distribution network automation system and terminals under test, thereby discovering the detected Flaws in the implementation of the equipment protocol can reduce the number of missed reports and misjudgments of test problems, and effectively solve the problem of interruption of the test process.

In order to achieve the above object, the present invention provides a detection system for implementing defects in the IEC60870-5-101/104 communication protocol, which includes: a tester and a device under test connected thereto; the improvement is that the tester includes A function point traversal unit and a protocol packet mutation test unit that receives the traversal result.

In the preferred technical solution provided by the present invention, the function point traversal unit is provided with a function point traversal test sequence module; the function point traversal unit traverses the communication function points of the device under test, and records the interactive messages corresponding to each other, A function point traversal test sequence stored in the function point traversal test sequence module is generated.

In the second preferred technical solution provided by the present invention, the function point traversal unit sequentially sends the received tested message Qj to the tested device, and the tested device, after receiving the tested message Qj, A response message An is sent to the tester, and the function point traversal unit records the communication function points obtained from the response message into the function point traversal test sequence.

In the third preferred technical solution provided by the present invention, the protocol message variation test unit includes: a test case design module, a variation test sample generation and grouping module, and a variation sample group test module connected in sequence, and respectively connected with the test case The mutation algorithm module connected with the design module and the manual editing message test module.

In the fourth preferred technical solution provided by the present invention, the test case design module selects the fields in the message to be tested, and selects the test type for the field to be tested.

In the fifth preferred technical solution provided by the present invention, the mutation algorithm module includes: a basic mutation component, a buffer overflow component, a domain deletion component and a combination mutation component arranged in sequence.

In the sixth preferred technical solution provided by the present invention, the variation test sample generation and grouping module calls the basic variation component to generate a variation test sample corresponding to the field to be tested; the variation test sample generation and grouping module is for message In the self-defined field, call the buffer overflow component to construct a mutation test sample of an ultra-long field; the mutation test sample generation and grouping module calls the domain missing component to zero-fill the tested field, omitting the Field filling; the variation test sample generation and grouping module invokes the combination variation component, and according to the field variation, performs a transformation test on the field using a combination of basic variation, buffer overflow and domain loss.

In the seventh preferred technical solution provided by the present invention, the basic variation component adopts a full variation test when the field to be tested is a control field and a type identifier, and the number of variation test samples of the full variation test= ^2m , where m is The number of bits in the mutating field.

In the eighth preferred technical solution provided by the present invention, the value of the packet length field of the variation test sample tested by the buffer overflow component can be selected to be unchanged or to add an extra-long field length value.

In the ninth preferred technical solution provided by the present invention, the value of the packet length field of the mutation test sample in the domain missing component test can be chosen to be unchanged or to be omitted.

In the tenth preferred technical solution provided by the present invention, the variation test sample generation and grouping module calls the manual editing message testing module, manually inputs test messages, and sets the number and order of sending test messages.

In the preferred technical solution provided by the present invention, the variation test sample generation and grouping module divides 16 variation test samples into a test sample group, and sequentially transmits the generated test sample groups to the variation test module.

In the second preferred technical solution provided by the present invention, the variation testing module performs variation testing on the received test sample group.

In the third preferred technical solution provided by the present invention, a detection method for a detection system for implementing defects in the IEC60870-5-101/104 communication protocol is provided. The improvement is that the detection method includes the following steps:

(1).Consistency test on the tested message sent by the tested device;

(2). Carry out mutation test on the tested message;

(3). Generate test logs and statistical reports.

In the fourth preferred technical solution provided by the present invention, in the step 1, the function point traversal unit of the tester traverses the communication function points of the device under test, and records the interactive messages corresponding to each other, A function point traversal test sequence stored in the function point traversal test sequence module is generated.

In the fifth preferred technical solution provided by the present invention, the step 1 includes the following steps:

(1-1). The function point traversal unit sequentially sends the received tested message Qj to the tested device;

(1-2). The device under test sends a response message An to the tester after receiving the message Qj under test;

(1-3). The function point traversal unit records the communication function points obtained from the response message into the function point traversal test sequence.

In the sixth preferred technical solution provided by the present invention, in the step 2, the test case design module selects the field in the message to be tested, and selects the test type for the field to be tested; the variation test sample generation and grouping modules, respectively calling the mutation algorithm module and the manually edited message test module to generate a test sample group; the mutation test module performs a mutation test on the received test sample group.

In the seventh preferred technical solution provided by the present invention, the step 2 includes the following steps:

(2-1). Select the variation field and test type;

(2-2). Generate n variation test samples, and divide every 16 variation test samples into a test sample group, which is divided into i test sample groups, and perform variation test on the generated i test sample groups in sequence;

(2-3). The tester sends the variation test samples in the i-th test sample group to the device under test in sequence, and judges whether the response message sent by the device under test is received. , then detect the variation test sample, otherwise proceed to steps 2-4;

(2-4). The tester continues to send the variation test samples in the test sample group to the device under test;

(2-5). The tester judges whether the variation test samples in the i-th test sample group have been transmitted to the device under test, and if so, send detection messages to the device under test at intervals, otherwise return to step 2 -3;

(2-6). The tester judges whether a response message is received; if so, it will report "the state of the device under test is normal", make i=i+1, and return to step 2-3; otherwise record the problem sample and report " There is a problem with the device under test", initialize the device under test, set i=i+1, and return to step 2-3;

Among them, the initial value of i is 1.

In the eighth preferred technical solution provided by the present invention, in the step 2-3, the steps of detecting the variation test sample are as follows:

(2-3-1). The tester sends detection messages to the device under test at intervals;

(2-3-2). The tester judges whether a response message is received; if so, record the problem sample and report "the device under test is abnormal"; otherwise record the problem sample and report "the device under test has a problem", And initialize the device under test;

Wherein, the maximum number of intervals at which the tester sends detection messages to the device under test is 10.

In the ninth preferred technical solution provided by the present invention, in the step 2-5, the maximum number of intervals at which the tester sends detection messages to the device under test is 4.

In the tenth more preferred technical solution provided by the present invention, the test logs and statistical reports generated in the step 3 are used to record the actual message interaction and problem statistics of the test process; the test process records the tested messages in real time, Tested field, original message and mutated message information, test interactive message, returned message detection and device status detection results, and prompts for device initialization under test; the statistical information generated and put into the statistical report after the test includes: The total number of test cases, the total number of test samples, the number of tested cases, the number of tested samples, the failed test function points, the number of abnormalities of the tested equipment and test samples, the number of problems of the tested equipment and test samples.

Compared with the prior art, the present invention provides a detection system and method for implementing defects in the IEC60870-5-101/104 communication protocol. The setting of the test sample group greatly improves the test efficiency and reduces the number of test reports sent each time during the sample test. The detection time of the document; the setting of the equipment status detection link takes into account that some distribution automation equipment has a certain exception handling mechanism, increasing the duration of the equipment status detection can reduce the probability of misjudgment; by setting function points to traverse the test sequence, for communication Function point traversal provides test templates, and guarantees the full coverage of the 101/104 protocol to achieve defect detection and the validity of the protocol message variation test; moreover, the system and method use an automated script language to describe the test case design and test execution process , realize the automatic testing of defect detection in the 101/104 protocol; the protocol message variation test process proposed by this system and method, combined with the 101/104 protocol message structure and the interactive characteristics of question and answer, use the principle of fuzzy testing to design a variation test case And construct the mutation message to realize the attack on the distribution network automation system and terminal under test, so as to find the protocol implementation defect of the device under test; moreover, the system and method design the equipment state detection suitable for the distribution automation system test and initialization link, which can reduce the situation of missed reporting and misjudgment of test problems, and effectively solve the problem of interruption of the test process.

Description of drawings

Figure 1 is a schematic diagram of the implementation of the existing network protocol fuzzing test.

Fig. 2 is a schematic diagram of a function point traversal test sequence.

FIG. 3 is a schematic diagram of a detection method for implementation defects of the IEC60870-5-101/104 communication protocol.

Detailed ways

A detection system for implementing defects in the IEC60870-5-101/104 communication protocol, which includes: a tester and a device under test connected to it; the tester includes a function point traversal unit and a protocol message variation that receives the traversal result test unit.

The function point traversal unit is provided with a function point traversal test sequence module; the function point traversal unit traverses the communication function points of the device under test, and records the interactive messages corresponding to each other, and generates and stores them in the function point traversal test sequence module. The function points in the sequence module traverse the test sequence.

The function point traversal unit sequentially sends the received tested message Qj to the tested device, and the tested device sends a response message An to the tester after receiving the tested message Qj, The function point traversal unit records the communication function points obtained from the response message into the function point traversal test sequence.

The statute message variation test unit includes: a test case design module connected in sequence, a variation test sample generation and grouping module and a variation sample group test module, and a variation algorithm module and a manual editing report connected to the test case design module respectively. text test module.

The test case design module selects the fields in the message to be tested, and selects the test type for the field to be tested.

The mutation algorithm module includes: a basic mutation component, a buffer overflow component, a domain missing component and a combined mutation component arranged in sequence.

The variation test sample generation and grouping module calls the basic variation component to generate a variation test sample corresponding to the field to be tested; the variation test sample generation and grouping module calls the buffer overflow for the custom field in the message Components for constructing a variation test sample of an ultra-long field; the variation test sample generation and grouping module, calling the domain missing component, performing zero-fill processing on the measured field, and omitting the filling of the field; the variation test sample generation and The grouping module invokes the combined mutation component, and performs a transformation test on the field by using a combination of basic mutation, buffer overflow and domain deletion according to the field mutation.

The basic variation component adopts a full variation test for the case where the measured field is a control field and a type identifier, and the number of variation test samples of the full variation test is 2 ^m , where m is the number of bits of the variation field.

The value of the packet length field of the mutation test sample tested by the buffer overflow component can be selected to be unchanged or to add the value of the extra-long field length.

The value of the packet length field of the mutation test sample in the domain missing component test can be selected to be unchanged or the value of the omitted field length can be selected.

The variation test sample generation and grouping module invokes the manual editing message testing module, manually inputs test messages, and sets the number and order of sending test messages.

The variation test sample generation and grouping module divides 16 variation test samples into a test sample group, and sequentially transmits the generated test sample groups to the variation test module.

The variation testing module performs variation testing on the received test sample group.

As shown in Figure 3, a kind of detection method of the detection system that realizes defect for IEC60870-5-101/104 communication protocol is provided, and described detection method comprises the following steps:

(1).Consistency test on the tested message sent by the tested device;

(2). Carry out mutation test on the tested message;

(3). Generate test logs and statistical reports.

As shown in Figure 2, in the step 1, the function point traversal unit of the tester traverses the communication function points of the device under test, and records the interactive messages corresponding to each other to generate and store in the function point The function point traversal test sequence in the point traversal test sequence module.

Described step 1 comprises the following steps:

(1-1). The function point traversal unit sequentially sends the received tested message Qj to the tested device;

(1-2). After receiving the tested message Qj, the device under test sends a response message An to the tester:

(1-3). The function point traversal unit records the communication function points obtained from the response message into the function point traversal test sequence.

As shown in Figure 3, in said step 2, said test case design module selects the field in the message to be tested, selects the test type of tested field trial use; Variation test sample generation and grouping module call said mutation algorithm module respectively and the manually edited message test module to generate a test sample group; the variation test module performs a variation test on the received test sample group.

Described step 2 comprises the following steps:

(2-1). Select the variation field and test type;

(2-2). Generate n variation test samples, and divide every 16 variation test samples into a test sample group, which is divided into i test sample groups, and perform variation test on the generated i test sample groups in sequence;

(2-3). The tester sends the variation test samples in the i-th test sample group to the device under test in sequence, and judges whether the response message sent by the device under test is received. , then detect the variation test sample, otherwise proceed to steps 2-4;

(2-4). The tester continues to send the variation test samples in the test sample group to the device under test;

(2-5). The tester judges whether the variation test samples in the i-th test sample group have been transmitted to the device under test, and if so, send detection messages to the device under test at intervals, otherwise return to step 2 -3;

(2-6). The tester judges whether a response message is received; if so, it will report "the state of the device under test is normal", make i=i+1, and return to step 2-3; otherwise record the problem sample and report " There is a problem with the device under test", initialize the device under test, set i=i+1, and return to step 2-3;

Among them, the initial value of i is 1.

In the step 2-3, the steps of detecting the variation test sample are as follows:

(2-3-1). The tester sends detection messages to the device under test at intervals;

(2-3-2). The tester judges whether a response message is received; if so, record the problem sample and report "the device under test is abnormal"; otherwise record the problem sample and report "the device under test has a problem", And initialize the device under test;

Wherein, the maximum number of intervals at which the tester sends detection messages to the device under test is 10.

In the step 2-5, the maximum number of intervals at which the tester sends detection messages to the device under test is 4.

The test log and statistical report generated in the step 3 are used to record the actual message interaction and problem statistics of the test process; the test process records the tested message, the measured field, the original message and the variation message information in real time , test interactive messages, return message detection and device status detection results, and prompts for the initialization of the device under test; the statistical information generated and put into the statistical report after the test includes: the total number of test cases, the total number of test samples, the number of tested The number of use cases, the number of tested samples, the failed test function points, the number of abnormalities in the tested equipment and test samples, the number of problems in the tested equipment and the test samples.

The present invention aims at the existing protocol robustness test method in the IEC60870-5-101/104 statute robustness test, the test coverage is limited by the experience of the testers, the problem of false positives and misjudgments, the test depth and low efficiency and other applicability problems, cannot It is achieved to provide a defect detection method for 101/104 statute which is suitable for distribution network automation system. Based on the IEC60870-5-101/104 protocol consistency test to realize the full coverage of distribution network automation system protocol messages and function points, the present invention introduces the technical principle of fuzzy testing, and provides a communication security system for distribution network automation systems. The 101/104 protocol implements defect detection methods.

The testing process includes the following steps:

Test environment setup:

Connect the object under test with the 101/104 protocol analysis and message construction tool, and select the protocol and set up the channel for the object under test and the test tool.

Device function point message traversal:

After the test channel is established, conduct the IEC60870-5-101/104 protocol conformance test on the tested equipment, pass the IEC60870-5-101/104 protocol conformance test, realize the traversal of the communication function points of the tested object, and record the corresponding normal Interactive message. Combined with the requirements of the function points in the pre-state, optimize the sorting and describe it through an automated script language to generate a "function point traversal test sequence" (as shown in Figure 2). The setting of "function point traversal test sequence" provides a test template for communication function point traversal, which is convenient for testers who lack experience in protocol testing to automate the test and design test cases for subsequent protocol mutation tests.

Through the device function point message traversal test, ensure that the protocol message of the device is consistent with the 101 and 104 protocols, as the premise of the subsequent protocol message variation test.

Protocol packet mutation test

This part is the core of the 101/104 protocol proposed in this patent to realize the defect detection method. The distribution automation equipment passes the 101 and 104 protocol messages of the protocol consistency test in the "communication function point traversal", and completes the defect detection of the device under test in the implementation of the 101/104 protocol by performing the message variation test. The test process is shown in Figure 3 below: the mutation test is roughly divided into three links: test case design, mutation test sample generation and grouping, and mutation sample group testing.

Test case design: select the field in the message to be tested, and select the test type for the field to be tested based on the tester's understanding of the protocol. The main test types and methods are:

(a) Basic mutation: By calling the mutation algorithm, generate a mutation test sample corresponding to the measured field. It is recommended that fields such as the control domain and type identification adopt full mutation (that is, the number of mutation samples = 2 ^m , m is the number of digits in the mutation field), and fields larger than 1 byte can be controlled by adjusting the fuzzy algorithm called by the message mutation according to the test requirements Test granularity.

(b) Buffer overflow: mainly for the custom fields in the message, the mutation test samples of super-long fields are constructed through the mutation algorithm. The packet length field of the mutation test sample in the buffer overflow test can be selected unchanged or adjusted accordingly with the extra-long field.

(c) Missing field: zero padding is performed on the field, and the padding of this field is intentionally omitted. The packet length field of the mutation test sample for the domain missing test can be selected to remain unchanged or to be adjusted accordingly with the length of the omitted field.

(d) Combined mutation: For the case of simultaneous mutation of multiple fields, the specific change method will be transformed by combining basic mutation, buffer overflow, and domain deletion according to the type of the selected field.

Generation and grouping of mutation test samples: test cases invoke the mutation algorithm to generate a large number of mutation test samples, and every 16 samples are divided into a test sample group. The setting of this link can greatly improve the test efficiency and reduce the detection time of each sent detection message for each sample test.

Mutation sample group test: The mutation test performs sequential testing by sample group, and each sample group sends 16 abnormal packets in sequence. During the sending of a group of abnormal messages, if the device under test does not reply a response message (the correct processing of the device under test for the abnormal message is to discard the message and not reply the response message), after sending 16 abnormal messages Then perform device status detection; if the device under test replies with a response message, it will stop sending abnormal messages, and after performing device status detection, send subsequent abnormal messages.

In the equipment status detection link, the tester sends the detection message 10 times at intervals until it receives the response message and stops; this setting is mainly to consider that some power distribution automation equipment has a certain exception handling mechanism, and to increase the duration of equipment status detection can be Reduce the chance of misjudgment of the problem.

The setting of the device status detection message is used to detect the operating status of the device after the device under test receives abnormal messages continuously. Usually, the message that does not require the device to enter the pre-state is selected. The test 101 protocol can be performed through the U format-test frame Device status detection, the test 104 protocol can perform device status detection by requesting secondary data frames (the two alternate use can avoid the problem of sending and receiving serial numbers). If a correct response is not made to the device status detection message, the device may have been down, and the device under test needs to be initialized (such as re-establishing the channel) to ensure the execution of subsequent tests.

The test case design and test execution process are described by an automated script language, and the test suite is saved or loaded to realize the automation of the protocol packet mutation test.

Test log and statistical report

The test log and statistical report are used to record the actual message interaction and problem statistics during the test process, which is convenient for testers to quickly and conveniently discover and locate problems. During the test process, the information such as the tested message, the tested field, the original message, and the mutated message are recorded in real time, the interactive message is tested, the message detection and device status detection results are returned, and the device under test is initialized and other prompts. A statistical report is generated at the end of the test. The statistical information can include the total number of test cases, the total number of test samples, the number of tested cases, the number of tested samples, the failed test function points, the number of abnormalities of the tested equipment and test samples, and the tested equipment The number of problems and test samples, etc.

Manually edit message test

The manual editing message test is mainly used for: the packet variation test that cannot be covered by the protocol packet variation test, and the recurrence verification of the problems found in the protocol packet variation test. Testers can manually edit messages, set the number and sequence of message sending, and describe through automated scripting language to complete automated test execution. This link enables the testers to maximize their testing skills and achieve a deeper level of protocol implementation vulnerability mining.

It should be declared that the contents and specific implementation methods of the present invention are intended to prove the practical application of the technical solutions provided by the present invention, and should not be construed as limiting the protection scope of the present invention. Those skilled in the art may make various modifications, equivalent replacements, or improvements under the inspiration of the spirit and principles of the present invention. But these changes or modifications are all within the protection scope of the pending application.

Claims (21)

1. A detection system for implementing defects in the IEC60870-5-101/104 communication protocol, comprising: a tester and a device under test connected thereto; it is characterized in that the tester includes a function point traversal unit and receives its traversal The resulting protocol packet mutation test unit. 2. detection system according to claim 1, is characterized in that, described function point traversal unit is provided with function point traversal test sequence module; Described function point traversal unit traverses the communication function point of equipment under test, and records The interaction messages corresponding to each other generate a function point traversal test sequence stored in the function point traversal test sequence module. 3. The detection system according to claim 2, wherein the function point traversal unit sends the received test message Qj to the device under test sequentially, and the device under test receives the measured message Qj after receiving the After the message Qj, send a response message An to the tester, and the function point traversal unit records the communication function points obtained from the response message into the function point traversal test sequence. 4. detection system according to claim 1, is characterized in that, described stipulation message variation test unit comprises: the test case design module, variation test sample generation and grouping module and variation sample group test module connected successively, and respectively A mutation algorithm module and a manual editing message test module connected with the test case design module. 5. The detection system according to claim 4, wherein the test case design module selects the field in the message to be tested, and selects the test type for trial use of the field to be tested. 6 . The detection system according to claim 5 , wherein the mutation algorithm module includes: a basic mutation component, a buffer overflow component, a domain missing component and a combination mutation component arranged in sequence. 7. The detection system according to claim 6, wherein the variation test sample generation and grouping module calls the basic variation component to generate a variation test sample corresponding to the field to be tested; the variation test sample generation and grouping module, for the self-defined field in the message, call the buffer overflow component, and construct the mutation test sample of the super long field; the mutation test sample generation and grouping module, call the domain missing component, and zero Filling processing, omitting the filling of this field; the variation test sample generation and grouping module calls the combined variation component, and according to the situation of field variation, transforms the field using a combination of basic variation, buffer overflow and domain loss. . 8. The detection system according to claim 7, wherein the basic variation component is a control field and a type identifier for the field to be tested, and adopts a full variation test, and the number of variation test samples of the full variation test=2 ^m , m is the number of digits of the variable field. 9. The detection system according to claim 7, characterized in that, the value of the variation test sample message length field of the buffer overflow component test is chosen to be unchanged or to add an extra-long field length value. 10. The detection system according to claim 7, characterized in that, the value of the packet length field of the mutation test sample in the domain missing component test is chosen to be unchanged or to omit the field length value. 11. detection system according to claim 4, is characterized in that, described variation test sample generation and grouping module, call described manual editing message test module, manually input test message, and the number of times that test message is sent and order. 12. The detection system according to claim 4, wherein the variation test sample generation and grouping module divides 16 variation test samples into a test sample group, and transmits the generated test sample group to the test sample group sequentially. The variation test module described above. 13. The detection system according to claim 4, wherein the variation testing module performs variation testing on the received test sample group. 14. According to any one of claims 1-13, the detection method of the detection system for implementing defects in the IEC60870-5-101/104 communication protocol is characterized in that the detection method comprises the following steps: (1).Consistency test on the tested message sent by the tested device; (2). Carry out mutation test on the tested message; (3). Generate test logs and statistical reports. 15. The detection method according to claim 14, characterized in that, in the step 1, the function point traversal unit of the tester traverses the communication function points of the device under test, and records the corresponding An interactive message is used to generate a function point traversal test sequence stored in the function point traversal test sequence module. 16. detection method according to claim 15, is characterized in that, described step 1 comprises the steps: (1-1). The function point traversal unit sequentially sends the received tested message Qj to the tested device; (1-2). The device under test sends a response message An to the tester after receiving the message Qj under test; (1-3). The function point traversal unit records the communication function points obtained from the response message into the function point traversal test sequence. 17. detection method according to claim 14, is characterized in that, in described step 2, described test case design module selects the field in the message under test, selects the test type of field under test for trial use; Variation test sample generation and The grouping module calls the variation algorithm module and the manually edited message testing module to generate a test sample group respectively; the variation testing module performs a variation test on the received test sample group. 18. detection method according to claim 17, is characterized in that, described step 2 comprises the steps: (2-1). Select the variation field and test type; (2-2). Generate n variation test samples, and divide every 16 variation test samples into a test sample group, which is divided into i test sample groups, and perform variation test on the generated i test sample groups in sequence; (2-3). The tester sends the variation test samples in the i-th test sample group to the device under test in sequence, and judges whether the response message sent by the device under test is received. , then detect the variation test sample, otherwise proceed to steps 2-4; (2-4). The tester continues to send the variation test samples in the test sample group to the device under test; (2-5). The tester judges whether the variation test samples in the i-th test sample group have been transmitted to the device under test, and if so, send detection messages to the device under test at intervals, otherwise return to step 2 -3; (2-6). The tester judges whether a response message is received; if so, it will report "the state of the device under test is normal", make i=i+1, and return to step 2-3; otherwise record the problem sample and report " There is a problem with the device under test", initialize the device under test, set i=i+1, and return to step 2-3; Among them, the initial value of i is 1. 19. The detection method according to claim 18, characterized in that, in the step 2-3, the step of detecting the variation test sample is as follows: (2-3-1). The tester sends detection messages to the device under test at intervals; (2-3-2). The tester judges whether a response message is received; if so, record the problem sample and report "the device under test is abnormal"; otherwise record the problem sample and report "the device under test has a problem", And initialize the device under test; Wherein, the maximum number of intervals at which the tester sends detection messages to the device under test is 10. 20. The detection method according to claim 18, characterized in that, in the step 2-5, the maximum number of intervals at which the tester sends detection messages to the device under test is 4. 21. The detection method according to claim 14, characterized in that, the test logs and statistical reports generated in said step 3 are used to record the actual message interaction and problem statistics of the test process; the real-time records of the test process are recorded Test messages, tested fields, original messages and mutated message information, test interactive messages, return message detection and device status detection results, and prompts for the initialization of the device under test; after the test is completed, generate and put in the statistical report Statistical information includes: total number of test cases, total number of test samples, number of tested cases, number of tested samples, failed test function points, number of abnormalities in the tested device and test samples, number of problems in the tested device and test samples .

Images