Kernel fuzzy test sequence generation method based on deep learning

Abstract

The invention relates to deep learning in the field of artificial intelligence, in particular to learning of a system call sequence. The method comprises: data collection and processing, model construction, model training, model evaluation and sequence generation. The data collection and processing comprises the following steps: firstly, collecting a system call sequence with parameters and a sequence in a trace format, and then coding the sequences into input data suitable for model training. The model construction comprises: selecting RNN and LSTM neural network models, and determining a network structure as an input layer, a hidden layer and an output layer. Model training includes batching input data, initializing network parameters, calculating a value of a loss function to adjust the network parameters. Model evaluation includes calculating a normalized edit distance between test sequence data and a prediction sequence. The sequence generation comprises the following steps: randomly selecting initial system call and sequence length, generating an integer sequence according to a model obtained by training, and decoding the integer sequence into a system call sequence. And the generated sequence is used as the input of the kernel fuzzy test, so that the vulnerability mining efficiency is improved. The process is shown in Figure 1.

Description

technical field [0001] The invention relates to deep learning in the field of artificial intelligence, in particular to the learning of system call sequences. Specifically, the processed system call sequence is used as the input of the neural network, which is trained to obtain a model, and then a new system call sequence is generated by using the model. Subsequently, the generated system call sequence is used as the input of the kernel fuzzing test, so as to improve the efficiency of the kernel fuzzing test. Background technique [0002] The modern operating system kernel divides the virtual address space into two parts, one part is user space and the other part is kernel space. Applications such as browsers and video players run in user space; operating system codes such as process management and memory management run in kernel space. For security purposes, this design prevents user space programs from directly accessing and executing kernel space data and codes. The sy...

AI Technical Summary

Problems solved by technology

Using traditional machine learning methods to manually extract data with high feature complexity is not only a heavy workload and error-prone, but also has the problem of low algorithm accuracy.

Images