A fuzzy test case generation method and system based on genetic variation

Abstract

The invention discloses a fuzzy test case generation method and system based on genetic variation. The method comprises the following steps: selecting two seed test cases, aiming at a data position ofa new test case, if the two seed data are the same, inheriting the data to the current data position of the new test case; and if the two pieces of seed data are different and belong to any characterstring comparison set for static analysis and extraction of the target binary file, randomly mutating the data into data in the preset character string comparison set, or else randomly selecting thedata of one seed to be inherited to the current data position of the new test case. According to the invention, respective advantages of the test case generation method based on generation and the test case generation method based on variation are inherited; and meanwhile, the corresponding defects are avoided, the core code of the large-scale fuzzing target program without manual operation can berealized, and the method has the advantages that the generation of the test case has higher possibility, the path coverage rate is increased, and the collapse is easy to trigger.

Description

technical field [0001] The invention relates to the field of vulnerability mining in the field of computers, in particular to a method and system for generating fuzzy test cases based on genetic variation, which are used to provide fuzzy test cases for vulnerability mining for target programs of vulnerability mining. Background technique [0002] Test case generation methods can be roughly divided into two categories, generation-based test case generation and mutation-based test case generation. The existing test case generation method based on generation is to manually write the test case generation rules, so that the test cases can be generated according to the target rules, and ensure that the generated test cases can bypass the error checking code of the target program, so that fuzzing (based on defect injection) automatic software testing technology) the core function code of the target program; however, this test case generation method requires a lot of manual interven...

AI Technical Summary

Problems solved by technology

The existing test case generation method based on generation is to manually write the test case generation rules, so that the test cases can be generated according to the target rules, and ensure that the generated test cases can bypass the error checking code of the target program, so that fuzzing (based on defect injection) automatic software testing technology) the core function code of the target program; however, this test case generation method requires a lot of manual intervention, resulting in high labor costs, and at the same time, the rules of different target programs are not the same, which will lead to The generated test case generation method has poor scalability and is not suitable for fuzzing a large number of different target programs

The existing mutation-based test case generation method is to generate new test cases by randomly mutating the existing normal input, so that the generated test cases can use some information in the existing normal input to bypass the error checking code , and it can be run directly without manual operation. For different programs, it only needs to replace the normal input to achieve a high scalability effect; however, the test cases generated by this test case generation method can only be fuzzed to the normal test Some codes near the reachable code of the use case are relatively far away or the code with strict entry conditions is difficult to reach, which makes it difficult for the generated test cases to fuzz all the code of the target program

Images