CN107517199A - A kind of method for generating test case and system for being used for 376.1 protocol security defects detections - Google Patents

Abstract

The invention discloses a test case generation method for 376.1 protocol safety defect detection: the 376.1 protocol is abstracted into a network protocol classification tree, including the five-tuple PT<test target network protocol P, protocol field F of the target network protocol, The disjoint attribute A of the protocol domain, the attribute value V of the protocol domain, the relationship R> between the parent node and the child node in the protocol classification tree; analyze F to determine the variable protocol domain, and the attributes and values of the variable protocol domain The attribute value corresponding to the attribute; use the mutated attribute value to generate the test data set of the variable protocol field; replace each mutated attribute value in the test data set, and obtain the legal packet test of the variable protocol field after the mutated attribute value is replaced Use case collection; fill in malformed data according to the attributes of the variable protocol field to generate a collection of illegal message test cases; combine the collection of legal message test cases and the collection of illegal message test cases to generate a set of test cases for 376.1 protocol specifications.

Description

A test case generation method for 376.1 protocol security defect detection and system

technical field

The present invention relates to the technical field of information security, and more specifically, relates to a test case generation method and system for 376.1 protocol security defect detection.

Background technique

The power consumption information collection system is a system that collects, processes and monitors power consumption information of power users in real time. Smart energy monitoring, information interaction of smart electrical equipment and other functions. The electricity consumption information collection system has a high degree of information integration and integration, strong system dependence, frequent real-time interactions between business systems, business systems and external users, and a large number and variety of terminals connected to the system. At the same time, it also undertakes the supporting role of providing data for other systems, and its role is becoming more and more important.

As the working environment of the electricity information collection system is becoming more and more complex, the access methods and environment are complicated, and the amount of concurrency is large, there are also many information security threats from internal and external networks. This type of security vulnerability is used to infiltrate and attack the mining system, and the main station of the system is controlled through Trojan horses, viruses, malicious codes, etc. At the end of 2015, the Ukrainian power grid suffered the world's first large-scale power outage caused by hacker attacks. Hackers used the security holes in the power system to implant malicious codes to carry out network attacks and destroy the control systems of some substations, causing large-scale power outages. Some 1.4 million people were affected by the disruption for several hours. Then in 2016, Israel’s power grid also suffered from large-scale cyber attacks. Frequent power grid security incidents show that attacks on industrial control system vulnerabilities show a trend of organized and diverse attack methods. Through the analysis of such security incidents, the various hacking methods and concealed intrusion methods are one reason, but the essence is that there are security loopholes in the power system, which are discovered and exploited by attackers. Illegal personnel can further engage in sabotage work after controlling the main station of the system through system loopholes, such as deleting important information, destroying the server of the main station, issuing illegal instructions, etc., which can cause system paralysis, large-scale power outages and other major security incidents. At the same time, the information involved in the collection, transmission, storage, processing and use of the electricity consumption information collection system has high confidentiality, and the illegal use and leakage of information may bring greater threats to national security, social economy and power grid operation. Therefore, in the current situation of severe information security and complex and diverse network attack methods, how to detect potential security flaws in the power consumption information collection system, and conduct vulnerability mining from the main station, terminal, communication protocol, etc., has become an urgent need for evaluation. solved problem.

Therefore, a technique is needed to solve the problem related to the generation of test cases for 376.1 protocol security defect detection.

Contents of the invention

The application provides a test case generation method and method for 376.1 protocol security defect detection to solve the problem of how to generate test cases for 376.1 protocol security defect detection.

In order to solve the above problems, the present invention provides a method for generating test cases for 376.1 protocol security defect detection, the method comprising:

According to the 376.1 protocol specification, the 376.1 protocol is abstracted into a network protocol classification tree, and the protocol classification tree includes the five-tuple PT<the target network protocol P of the test, the protocol field F of the target network protocol, and the protocol fields that are mutually disjoint Attribute A, the attribute value V of the protocol domain, the relationship R> between the parent node and the child node in the protocol classification tree;

Analyzing the protocol domain F of the target network protocol, determining a variable protocol domain, attributes of the variable protocol domain, and attribute values corresponding to the attributes of the variable protocol domain;

Combining the attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol, and using the mutated attribute value to generate a test data set for the variable protocol domain;

Using the mutated attribute value to replace the variable protocol field corresponding to the test data set in the protocol sequence, each of the mutated attribute values in the test data set is replaced, and the mutated attribute value is obtained after replacement The legal packet test case set of the variable protocol domain;

According to the set malformed message generation principle, for the variable protocol field with limit value in the 376.1 protocol message, fill the malformed data according to the attribute of the variable protocol field to generate an illegal message test case set;

Combining the legal packet test case set and the illegal packet test case set to generate the 376.1 protocol specification test case set.

Preferably, the set of protocol domains F={filed ₁ , filed ₂ , filed ₃ ...filed _n } of the target network protocol, the target protocol includes n-tuples <filed ₁ , filed ₂ , filed ₃ ...filed _n > .

Preferably, determine the attribute set of the protocol domain field _i Each attribute attribute _ij takes a value (1≤i≤n, 1≤j≤m _i ) in a discrete attribute value set V _ij respectively.

Preferably, the different attribute values of each protocol domain field _i are combined to obtain a test data set for the protocol domain

Preferably, values are sequentially selected from the test data set S _i oriented to the protocol domain field _i , and the n-tuple sequence <filed ₁ , filed ₂ , filed ₃ ... filed _n > describing the target protocol is expanded to obtain the target-oriented network protocol A collection of legal packet test cases.

Preferably, the malformed data filling according to the attribute of the variable protocol field includes:

Boundary value padding, string padding, mandatory type conversion padding, super long string padding.

Preferably, before performing the combination operation on the attribute values of the attributes in the variable protocol domain, it further includes filtering the attribute values corresponding to the attributes of the variable protocol domain.

Preferably, the combination operation includes: performing a combination operation on the filtered attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol.

Based on another aspect of the present invention, there is provided a test case generation system for 376.1 protocol security defect detection, the system includes:

A classification unit, configured to abstract the 376.1 protocol into a network protocol classification tree according to the 376.1 protocol specification, and the protocol classification tree includes the five-tuple PT<tested target network protocol P, protocol field F of the target network protocol, protocol Domain disjoint attribute A, protocol domain attribute value V, relationship between parent node and child node in the protocol classification tree R>;

An analyzing unit, configured to analyze the protocol domain F of the target network protocol, determine the variable protocol domain, and the attributes of the variable protocol domain and the attribute values corresponding to the attributes of the variable protocol domain;

A combination unit, configured to perform a combined operation on the attribute values of each attribute in the variable protocol domain, obtain the mutated attribute value of each attribute in the variable protocol, and use the mutated attribute value to generate the variable protocol domain test data set;

The first generating unit uses the variable attribute value to replace the variable protocol field corresponding to the test data set in the protocol sequence, and replaces each of the variable attribute values in the test data set to obtain the A set of legal packet test cases in the variable protocol domain after the mutation attribute value is replaced;

The second generation unit, according to the set malformed message generation principle, for the variable protocol field with limit value in the 376.1 protocol message, fills the malformed data according to the attribute of the variable protocol field, and generates an illegal message Text test case collection;

The third generating unit is configured to combine the set of legal message test cases and the set of illegal message test cases to generate the test case set of the 376.1 protocol specification.

Preferably, the set of protocol domains F={filed ₁ , filed ₂ , filed ₃ ...filed _n } of the target network protocol, the target protocol includes n-tuples <filed ₁ , filed ₂ , filed ₃ ...filed _n > .

Preferably, determine the attribute set of the protocol domain field _i Each attribute attribute _ij takes a value (1≤i≤n, 1≤j≤m _i ) in a discrete attribute value set V _ij respectively.

Preferably, the different attribute values of each protocol domain field _i are combined to obtain a test data set for the protocol domain

Preferably, values are sequentially selected from the test data set S _i oriented to the protocol domain field _i , and the n-tuple sequence <filed ₁ , filed ₂ , filed ₃ ... filed _n > describing the target protocol is expanded to obtain the target-oriented network protocol A collection of legal packet test cases.

Preferably, the malformed data filling according to the attribute of the variable protocol field includes:

Boundary value padding, string padding, mandatory type conversion padding, super long string padding.

Preferably, before performing the combination operation on the attribute values of the attributes in the variable protocol domain, it further includes filtering the attribute values corresponding to the attributes of the variable protocol domain.

Preferably, the combination operation includes: performing a combination operation on the filtered attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol.

The technical solution of the present application first abstracts the 376.1 protocol of the electricity consumption information collection system into a network protocol classification tree according to the 376.1 protocol specification, analyzes the abstracted protocol domain, and determines the variable protocol domain. For each variable protocol domain, determine the attribute and attribute value of the variable protocol domain, and combine the attribute values of each attribute in the protocol domain to obtain the variable attribute value, and use the variable attribute value to generate the variable protocol domain test data set; and replace the variable protocol field corresponding to the test data set in the protocol sequence group by using the variable attribute value, replace each variable attribute value in the test data set, and obtain the variable protocol field after the variable attribute value is replaced A collection of combined method message test cases. At the same time, design appropriate malformed message generation principles, generate malformed data values for each variable protocol field, and increase the set of illegal message test cases. The technical solution of the present application can intelligently generate test cases for 376.1 protocol security defect detection, introduce a heuristic algorithm to filter attribute values, and simplify the test case set.

Description of drawings

A more complete understanding of the exemplary embodiments of the present invention can be had by referring to the following drawings:

Fig. 1 is a flow chart of a method for generating test cases for 376.1 protocol security defect detection according to an embodiment of the present invention;

2 is a schematic diagram of a 376.1 protocol classification tree according to an embodiment of the present invention; and

FIG. 3 is a structural diagram of a test case generation system for 376.1 protocol security defect detection according to an embodiment of the present invention.

detailed description

Exemplary embodiments of the present invention will now be described with reference to the drawings; however, the present invention may be embodied in many different forms and are not limited to the embodiments described herein, which are provided for the purpose of exhaustively and completely disclosing the present invention. invention and fully convey the scope of the invention to those skilled in the art. The terms used in the exemplary embodiments shown in the drawings do not limit the present invention. In the figures, the same units/elements are given the same reference numerals.

Unless otherwise specified, the terms (including scientific and technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it can be understood that terms defined by commonly used dictionaries should be understood to have consistent meanings in the context of their related fields, and should not be understood as idealized or overly formal meanings.

FIG. 1 is a flowchart of a test case generation method for 376.1 protocol security defect detection according to an embodiment of the present invention. The embodiment of the present application first abstracts the 376.1 protocol of the electricity consumption information collection system into a network protocol classification tree according to the 376.1 protocol specification, analyzes the abstracted protocol domain, and determines the variable protocol domain. For each variable protocol domain, determine the attribute and attribute value of the variable protocol domain, and combine the attribute values of each attribute in the protocol domain to obtain the variable attribute value, and use the variable attribute value to generate the variable protocol domain test data set; and replace the variable protocol field corresponding to the test data set in the protocol sequence group by using the variable attribute value, replace each variable attribute value in the test data set, and obtain the variable protocol field after the variable attribute value is replaced A collection of combined method message test cases. At the same time, design appropriate malformed message generation principles, generate malformed data values for each variable protocol field, and increase the set of illegal message test cases. The embodiment of the present application combines the legal message test case set and the illegal message test case set to generate a 376.1 protocol specification test case set. The implementation of the present invention can intelligently generate test cases for 376.1 protocol security defect detection, as shown in Figure 1, the method 100 starts from step 101:

Preferably, in step 101: the 376.1 protocol is abstracted into a network protocol classification tree according to the 376.1 protocol specification, the protocol classification tree includes the target network protocol P of the quintuple PT<test, the protocol domain F of the target network protocol, and the protocol domains are mutually disjoint The attribute A of the protocol domain, the attribute value V of the protocol domain, and the relationship R> between the parent node and the child node in the protocol classification tree. The relationship R between the parent node and the child node in the protocol classification tree includes the relationship between the target network protocol P and the protocol domain F, the relationship between the protocol domain F and the attribute A and the attribute value V, and so on.

Preferably, the set _of protocol domains F _{= {} filed ₁ , _{filed 2} , _{filed 3} .

Preferably, determine the attribute set of the protocol domain field _i Each attribute attribute _ij takes a value (1≤i≤n, 1≤j≤m _i ) in a discrete attribute value set V _ij respectively.

FIG. 2 is a schematic diagram of abstracting the 376.1 protocol into a network protocol classification tree. f ₁ , f ₂ ...f _n is the protocol domain, the attribute set of f ₁ is a ₁₁ , a ₁₂ , a ₁₃ ...a _1m1 , the attribute set of f ₂ is a ₂₁ , a ₂₁ , a ₂₂ , a ₂₃ ...a _2m2 , the attribute set of f _n is a _n1 , a _n2 …a _nmn . The attribute values of attribute a ₁₁ are v ₁ , v ₂ . . . v _k1m1 .

Preferably, in step 102: analyze the protocol field F of the target network protocol, determine the variable protocol field, the attributes of the variable protocol field, and the attribute values corresponding to the attributes of the variable protocol field. For example, the attribute corresponding to the variable protocol field f ₁ is a ₁₁ , and the attribute value corresponding to the attribute a ₁₁ is v ₁ .

Preferably, in step 103: perform a combined operation on the attribute values of each attribute in the variable protocol domain, obtain the mutated attribute values of each attribute in the variable protocol, and use the mutated attribute values to generate a test data set for the variable protocol domain.

Preferably, the different attribute values of each protocol domain field _i are combined to obtain a test data set for the protocol domain

Preferably, before combining the attribute values of the attributes in the variable protocol field, the method further includes filtering the attribute values corresponding to the attributes of the variable protocol field.

Preferably, the combination operation includes: performing a combination operation on the filtered attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol.

Preferably, in step 104: use the variable attribute value to replace the variable protocol field corresponding to the test data set in the protocol sequence, replace each variable attribute value in the test data set, and obtain the variable A collection of test cases for legitimate packets in the protocol domain. For each variation value in each test data set, this application uses the variation value to replace the protocol field corresponding to the test data set in the protocol sequence group, and obtains the replaced protocol field sequence group instance, that is, the legality of the 376.1 protocol A collection of packet test cases.

Preferably, values are sequentially selected from the test data set S _i oriented to the protocol domain field _i , and the n-tuple sequence <filed ₁ , filed ₂ , filed ₃ ... filed _n > describing the target protocol is expanded to obtain the target-oriented network protocol A collection of legal packet test cases.

Preferably, in step 105: according to the set malformed message generation principle, for the variable protocol field with limit value in the 376.1 protocol message, fill the malformed data according to the attributes of the variable protocol field, and generate an illegal message test Collection of use cases.

Preferably, malformed data padding is performed according to the attributes of the variable protocol domain, including: padding with boundary values, string padding, forced type conversion padding, and super-long string padding.

Preferably, in step 106: combining the legal message test case set and the illegal message test case set to generate a 376.1 protocol specification test case set.

The embodiment of the present invention is described by way of example below:

The steps involved in constructing a 376.1 network protocol classification tree according to method 100 are as follows:

(1) Select the test target network protocol P, that is, the 376.1 protocol, and divide according to its specification to obtain the protocol domain set F={filed ₁ , filed ₂ ,filed ₃ ...filed _n }, the target protocol can use n-tuple sequence group < filed ₁ , filed ₂ , filed ₃ ... filed _n > means.

(2) Classify the attributes of each protocol obtained in step (1), and obtain a set of attributes describing the protocol domain field _i Each attribute attribute _ij takes a value (1≤i≤n, 1≤j≤m _i ) in a discrete attribute value set V _ij respectively.

(3) Combine the different attribute values of each protocol domain field _i to obtain the test data set for the protocol domain

(4) Sequentially take values from the test data set S _i oriented to the protocol domain field _i , expand the n-tuple sequence group <filed ₁ , filed ₂ , filed ₃ …filed _n > describing the target protocol, and obtain the target-oriented network protocol test case.

In the method 100 of the present application, before the attribute value of each attribute in the protocol domain is combined and operated, a heuristic algorithm needs to be designed, and the attribute value of each attribute is filtered according to the heuristic algorithm. In the present application, performing a combination operation on each attribute value in the protocol domain includes: performing a combination operation on attribute values filtered by each attribute in the protocol domain to obtain a variation value. The heuristic algorithm can be obtained according to the protocol specification or calculated by third-party tools.

In the method 100 of the present application, the generation of the illegal message test case in step 105 is based on the following rules: for the protocol fields with value restrictions in the protocol 376.1 message, malformed data needs to be filled for the protocol field attributes, and the filling rules have boundary values Value, string padding, mandatory type conversion, super long string, etc.

The implementation of the present application can intelligently generate test cases for 376.1 protocol security defect detection, introduce heuristic algorithm to filter attribute values, and simplify the test case set.

The test case generation method for 376.1 protocol security defect detection proposed in the implementation mode of this application comprehensively considers legal messages and illegal abnormal messages that meet the protocol specification, takes into account the comprehensiveness of the test case collection, and also designs for the goal of security defect detection A collection of illegal exception packets. By constructing the 376.1 network protocol classification tree, the attribute value of each attribute in the variable protocol field is combined to obtain a comprehensive collection of legal message test cases. This application obtains a set of targeted illegal message test cases by designing the principle of malformed message generation and filling the variable protocol field with illegal data. By constructing a comprehensive and reasonable set of test cases, this application can efficiently discover the information security flaws in the 376.1 protocol, and ensure the safe interaction and reliable operation of the power consumption information collection system from the communication protocol level.

FIG. 3 is a structural diagram of a test case generation system for 376.1 protocol security defect detection according to an embodiment of the present invention. As shown in Figure 3, a test case generation system 300 for 376.1 protocol security defect detection includes:

The classification unit is used to abstract the 376.1 protocol into a network protocol classification tree according to the 376.1 protocol specification. The protocol classification tree includes the five-tuple PT<test target network protocol P, the protocol domain F of the target network protocol, and the attribute that the protocol domains are mutually disjoint A, the attribute value V of the protocol domain, and the relationship R> between the parent node and the child node in the protocol classification tree.

Preferably, the set _of protocol domains F _{= {} filed ₁ , _{filed 2} , _{filed 3} .

Preferably, determine the attribute set of the protocol domain field _i Each attribute attribute _ij takes a value (1≤i≤n, 1≤j≤m _i ) in a discrete attribute value set V _ij respectively.

The analysis unit is configured to analyze the protocol field F of the target network protocol, and determine the variable protocol field, the attributes of the variable protocol field, and the attribute values corresponding to the attributes of the variable protocol field.

The combination unit is used to combine and operate the attribute values of each attribute in the variable protocol domain, obtain the variation attribute value of each attribute in the variable protocol, and use the variation attribute value to generate the test data set of the variable protocol domain.

Preferably, the different attribute values of each protocol domain field _i are combined to obtain a test data set for the protocol domain

Preferably, the combination operation includes: performing a combination operation on the filtered attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol.

Preferably, before performing the combination operation on the attribute values of the attributes in the variable protocol domain, it further includes filtering the attribute values corresponding to the attributes of the variable protocol domain.

The first generation unit replaces the variable protocol field corresponding to the test data set in the protocol sequence with the variable attribute value, replaces each variable attribute value in the test data set, and obtains the variable protocol field after the variable attribute value is replaced. A collection of legal packet test cases.

Preferably, values are sequentially selected from the test data set S _i oriented to the protocol domain field _i , and the n-tuple sequence <filed ₁ , filed ₂ , filed ₃ ... filed _n > describing the target protocol is expanded to obtain the target-oriented network protocol A collection of legal packet test cases.

The second generation unit, according to the set malformed message generation principle, for the variable protocol field with limit value in the 376.1 protocol message, fills the malformed data according to the attributes of the variable protocol field, and generates an illegal message test case set .

Preferably, the malformed data padding is performed according to the attributes of the variable protocol domain, including: border value padding, character string padding, forced type conversion padding, and super long string padding.

The third generation unit combines the legal packet test case set and the illegal packet test case set to generate a 376.1 protocol specification test case set.

A test case generation system 300 for 376.1 protocol security defect detection in one embodiment of the invention corresponds to a test case generation method 100 for 376.1 protocol security defect detection in another embodiment of the invention, and will not be repeated here repeat.

The invention has been described with reference to a small number of embodiments. However, it is clear to a person skilled in the art that other embodiments than the invention disclosed above are equally within the scope of the invention, as defined by the appended patent claims.

Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise therein. All references to "a/the/the [means, component, etc.]" are openly construed to mean at least one instance of said means, component, etc., unless expressly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

Claims (16)

1. A test case generation method for 376.1 protocol security defect detection, said method comprising: According to the 376.1 protocol specification, the 376.1 protocol is abstracted into a network protocol classification tree, and the protocol classification tree includes the five-tuple PT<the target network protocol P of the test, the protocol field F of the target network protocol, and the protocol fields that are mutually disjoint Attribute A, the attribute value V of the protocol domain, the relationship R> between the parent node and the child node in the protocol classification tree; Analyzing the protocol domain F of the target network protocol, determining a variable protocol domain, attributes of the variable protocol domain, and attribute values corresponding to the attributes of the variable protocol domain; Combining the attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol, and using the mutated attribute value to generate a test data set for the variable protocol domain; Using the mutated attribute value to replace the variable protocol field corresponding to the test data set in the protocol sequence, each of the mutated attribute values in the test data set is replaced, and the mutated attribute value is obtained after replacement The legal packet test case set of the variable protocol domain; According to the set malformed message generation principle, for the variable protocol field with limit value in the 376.1 protocol message, fill the malformed data according to the attribute of the variable protocol field to generate an illegal message test case set; Combining the legal packet test case set and the illegal packet test case set to generate the 376.1 protocol specification test case set. 2. The method according to claim ₁ , the protocol domain set F= _{ filed ₁ , filed ₂ , filed ₃ . ₂ , filed ₃ ... filed _n >. 3. The method according to claim 1, determining the attribute set of the protocol domain field _i Each attribute attribute _ij takes a value (1≤i≤n, 1≤j≤m _i ) in a discrete attribute value set V _ij respectively. 4. according to the method for claim 1, each protocol domain field _i different attribute values are combined mutually, obtain the test data set facing this protocol domain 5. The method according to claim 1, taking values sequentially from the test data set S _i facing the protocol domain field _i , and describing the n-element sequence group <filed ₁ , filed ₂ , filed ₃ ... filed _n > of the target protocol Expand to obtain a set of legal packet test cases oriented to the target network protocol. 6. The method according to claim 1, wherein the filling of deformed data according to the attribute of the variable protocol field comprises: Boundary value padding, string padding, mandatory type conversion padding, super long string padding. 7. The method according to claim 1, further comprising filtering the attribute values corresponding to the attributes of the variable protocol domain before performing the combination operation on the attribute values of the attributes in the variable protocol domain. 8. The method according to claim 7, wherein the combination operation comprises: performing a combination operation on the filtered attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol. 9. A test case generation system for 376.1 protocol security defect detection, said system comprising: A classification unit, configured to abstract the 376.1 protocol into a network protocol classification tree according to the 376.1 protocol specification, and the protocol classification tree includes the five-tuple PT<tested target network protocol P, protocol field F of the target network protocol, protocol Domain disjoint attribute A, protocol domain attribute value V, relationship between parent node and child node in the protocol classification tree R>; An analyzing unit, configured to analyze the protocol domain F of the target network protocol, determine the variable protocol domain, and the attributes of the variable protocol domain and the attribute values corresponding to the attributes of the variable protocol domain; A combination unit, configured to perform a combined operation on the attribute values of each attribute in the variable protocol domain, obtain the mutated attribute value of each attribute in the variable protocol, and use the mutated attribute value to generate the variable protocol domain test data set; The first generating unit uses the variable attribute value to replace the variable protocol field corresponding to the test data set in the protocol sequence, and replaces each of the variable attribute values in the test data set to obtain the A set of legal packet test cases in the variable protocol domain after the mutation attribute value is replaced; The second generation unit, according to the set malformed message generation principle, for the variable protocol field with limit value in the 376.1 protocol message, fills the malformed data according to the attribute of the variable protocol field, and generates an illegal message Text test case collection; The third generating unit is configured to combine the set of legal message test cases and the set of illegal message test cases to generate the test case set of the 376.1 protocol specification. 10. The system according to claim 9, the protocol domain set F _{= {} filed ₁ , filed ₂ , filed ₃ . ₂ , filed ₃ ... filed _n >. 11. The system according to claim 9, determining the attribute set of the protocol domain field _i Each attribute attribute _ij takes a value (1≤i≤n, 1≤j≤m _i ) in a discrete attribute value set V _ij respectively. 12. The system according to claim 9, combining the different attribute values of each protocol domain field _i to obtain the test data set facing the protocol domain 13. The system according to claim 9, taking values sequentially from the test data set S _i oriented to the protocol domain field _i , for the n-element sequence group <filed ₁ , filed ₂ , filed ₃ ...filed _n > describing the target protocol Expand to obtain a set of legal packet test cases oriented to the target network protocol. 14. The system according to claim 9, wherein the filling of malformed data according to the attribute of the variable protocol field comprises: Boundary value padding, string padding, mandatory type conversion padding, super long string padding. 15. The system according to claim 9, further comprising filtering the attribute values corresponding to the attributes of the variable protocol domain before performing the combination operation on the attribute values of the attributes in the variable protocol domain. 16. The system according to claim 9, wherein the combination operation comprises: performing a combination operation on the filtered attribute values of each attribute in the variable protocol domain to obtain the mutated attribute value of each attribute in the variable protocol.