Vulnerability mining for DoIP based on weighted mutation for combined fields

Abstract:
Remote diagnostic services based on DoIP protocols provide convenience for vehicle bootloader and diagnostics but inevitably posing a potential risk to automotive information security. Therefore, it is of practical importance to perform the security testing of DoIP implementations. The use of existing fuzzing frameworks for network protocol is blind and requires high computing resources for vehicle devices. To address the above problems, a weighted mutation for combined fields is proposed, combined with depth-first search algorithm for protocol state machine traversal to form a two-layer data generation strategy. Further, the weight matrix is adjusted during test iterations based on a feedback mechanism to optimize the quality of the test case set, ultimately ensuring fuzz efficiency despite limited test resources.