Software fuzzy test method

Abstract

The invention provides a software fuzzy test method, which comprises the following steps of: extracting and establishing a detection data sample based on an adaptive approximation vulnerability model(AAMV) based on historical data, test cases and log information acquired in a software test stage; dynamically analyzing vulnerability-related input elements in the detection data sample based on thefine-grained stain, and generating input data based on the detection data sample; and generating high coverage probe data based on mixed symbols of the input data. An adaptive approximation vulnerability model AAMV based on a tree structure is provided, detection data generation is guided, and the software vulnerability analysis effect is improved. Fine-grained stain analysis is carried out to find out fragile point related input elements, and variation space of the input elements is reduced. The code coverage rate of the fuzzy test technology is improved. According to the multi-dimensional detection data generation technology based on the OMMutator operator, the detection data scale is greatly reduced under the condition that the hit rates of fragile points are the same.

Description

technical field [0001] The invention belongs to the field of software fuzzy detection and relates to a fuzzy testing method based on an adaptive approximation vulnerability model. Background technique [0002] Fuzz testing has discovered a large number of unknown security vulnerabilities. It is a fast and effective dynamic vulnerability analysis technology and has been widely used in the industry. According to a survey by BSIMM, the nine leading security product teams they surveyed are all using fuzzing technology. The survey in the field of commercial fuzzing also shows that 80% of leading service providers and equipment manufacturers are using fuzzing technology. testing technology. For example, in Microsoft's products, 20%-25% of the security vulnerabilities found before the official release are analyzed by fuzz testing. [0003] At present, there is no uniform definition of fuzz testing. Some people call it fuzz testing, while others call it hash testing. The present ...

AI Technical Summary

Problems solved by technology

[0005] (1) The test efficiency is low, because the fuzz test cannot clearly understand the internal logic of the target under test, resulting in a large amount of invalid test data

[0006] (2) The code coverage rate is low, and the generation of existing fuzzy test cases depends on a limited production technology, and the test data cases are not optimized once they are generated

Images