A software fuzzy test method and device based on path record truncation

Abstract

The invention belongs to the technical field of software testing, in particular to a software fuzzy testing method and device based on path record truncation. The method comprises the steps of building a project data set, extracting a condition code structure, obtaining model input data of a classification model of a low-frequency path transfer condition code structure, and carrying out model training, adding a path truncation mark and a mark inspection instruction in the fuzzy tester instrumentation code; and for a to-be-tested program, extracting a condition code structure, acquiring model input data, transmitting the model input data to the trained classification model, identifying a low-frequency path transfer condition code structure, performing source code level instrumentation at acorresponding position in a source file, performing path truncation according to the path truncation mark, and completing a fuzzy test. According to the method, the low-frequency path transfer condition code is identified before the program is executed, the high-frequency path sample test is cancelled by adopting the path truncation strategy, the fuzzy test efficiency and the coverage rate are improved, and the engineering application prospect is very strong.

Description

technical field [0001] The invention belongs to the technical field of software testing, in particular to a software fuzzing testing method and device based on path record truncation. Background technique [0002] Fuzzing is an automated software testing technology, which is a testing method that provides semi-valid data as input to the test program and monitors whether the program is abnormal. Because of its simplicity and efficiency, it is widely used in major software manufacturers and open source software development and testing, and this technology has found a large number of vulnerabilities in various software. However, with the wide application of software security testing tools and the improvement of code security development awareness, vulnerabilities usually appear in more complex code structures. Existing fuzz tests are effective in mining code vulnerabilities with relatively simple code structures, but it is often difficult to catch exceptions when faced with co...

AI Technical Summary

Problems solved by technology

Although the above three fuzzy testing methods use different technologies to improve the test probability of low-frequency paths, the test of high-frequency path samples still exists, which not only leads to a limited increase in the test probability of low-frequency paths, but also does not significantly improve the overall test efficiency.

Images