Method and device for solving data imbalance of AFL test model through GAN

Abstract

The invention provides a method and device for solving data imbalance of an AFL test model through a GAN, and relates to the technical field of vulnerability mining. The method comprises the followingsteps: 1) collecting a plurality of test cases iteratively generated by the AFL according to a random mutation algorithm to form a test set; 2) preprocessing the test case data of the test set, and performing data amplification on the test set by using GAN; 3) selecting a classification model, and training the test set to obtain a test model; 4) predicting a newly generated test case of the AFL according to the test model, and judging whether a newly generated input increases a new code coverage range or not; and 5) calculating the misjudgment rate of the test model according to the program running result, and updating the prediction model when the false alarm rate of the test model is not less than a preset model false alarm rate threshold. According to the method, the fuzzy test efficiency is improved and the code coverage area is increased by predicting the availability of the newly generated test cases.

Description

technical field [0001] The invention relates to the technical field of vulnerability mining, in particular to a method and a device for solving data imbalance of an AFL test model through GAN. Background technique [0002] With the rapid development of the Internet, software security has gradually become a concern of people, and fuzz testing is one of the most important tools for testing software security. Fuzz testing works by taking a set of test inputs and expecting these inputs to maximize code coverage in a given program, and hoping that in doing so it will find bugs, crashes, or other potential vulnerabilities in the program. Fuzz testing can be divided into white box fuzz testing, gray box fuzz testing and black box fuzz testing. Black-box fuzzing is a software testing technique that does not require knowledge of the internal architecture of the target program. It only examines the fundamental aspects of the system, treating the software as a black box. White-box f...

AI Technical Summary

Problems solved by technology

However, each test case generated must be executed in the program, and each execution takes time, ranging from a few nanoseconds to more than a second, depending on the program itself, and complex programs will take longer , the whole process will waste hundreds of minutes of running time, affecting the efficiency of the fuzzer

Images