A method and system for intelligent fuzz testing based on vulnerability learning
A technology of fuzz testing and vulnerability, which is applied in the field of intelligent fuzz testing methods and systems based on vulnerability learning, which can solve the problems that fuzz testing tools are difficult to achieve coverage, and achieve the effect of efficient mining
Active Publication Date: 2020-05-29
ZHEJIANG UNIV
View PDF4 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Current fuzz testing tools are mainly coverage-oriented, hoping to test all parts of the program as much as possible. This method treats all parts of the program as equal, and it is difficult for current fuzz testing tools to achieve high coverage , so fuzz testing tools need to pay more attention to the parts that are more likely to have vulnerabilities, so as to improve the efficiency of fuzz testing for mining vulnerabilities
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0056] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the following embodiments are intended to facilitate the understanding of the present invention, but do not limit it in any way.
[0057] Such as figure 1 As shown, the intelligent fuzz testing system based on vulnerability learning of the present invention includes a data preprocessing module, a neural network-based vulnerability prediction module and a vulnerability-oriented fuzz testing module, and the core lies in the vulnerability prediction module and the fuzz testing module.
[0058] The vulnerability prediction module in the present invention mainly focuses on binary programs, because the source code of the tested program cannot be obtained in many cases. Due to differences in source code implementation methods, compilation environments, optimization options, and other factors, codes similar to unsafe operations hav...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The invention discloses an intelligent fuzzy testing method and system based on vulnerability learning. The intelligent fuzzy testing system includes: a data preprocessing module, which reversely analyzes the binary program to be tested to obtain its control flow graph, and analyzes the control flow graph in the control flow graph The feature extraction of each basic block of each basic block is performed to obtain the feature vector of each basic block; the vulnerability prediction module predicts the probability of each function in the program according to the control flow graph of the binary program to be tested; the vulnerability-oriented fuzzing module treats Test the binary program, combine the execution path of an input, the probability of function loopholes in the execution path, and the execution result to calculate the fitness score of the input; use the input with a high fitness score as a seed to perform genetic mutation to generate the next generation of input , the binary program to be tested is cyclically tested until the end of the test. The intelligent fuzzing testing system of the present invention can more efficiently dig out loopholes in binary programs.
Description
technical field [0001] The invention relates to the application field of fuzz testing, in particular to an intelligent fuzz testing method and system based on vulnerability learning. Background technique [0002] Fuzz testing is a software testing technique that detects whether there are loopholes in the program by inputting a large number of unexpected inputs into the program under test and monitoring whether there are exceptions during program execution, such as crashes, assertions, etc. Compared with other vulnerability mining methods, fuzz testing has the characteristics of simplicity, low false positive rate, and good scalability, and is widely used in the actual field of vulnerability mining. According to the known information of the application under test, fuzz testing tools can be divided into white box, black box and gray box fuzz testing. White-box fuzzing is mainly for applications with known source code; black-box fuzzing is mainly for binary applications; gray-...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More Patent Type & Authority Patents(China)
IPC IPC(8): G06F21/57G06F11/36G06N3/04G06N3/08
CPCG06F11/3684G06F11/3688G06F21/577G06N3/08G06F2221/033G06N3/043G06N3/045
Inventor 纪守领李宇薇陈建海吕晨阳
Owner ZHEJIANG UNIV