Unlock instant, AI-driven research and patent intelligence for your innovation.

Distributed parallel fuzzy test method and system based on dynamic centralized scheduling

A fuzz testing and centralized technology, applied in the field of computer security, can solve the problems of lack of algorithm diversity, unsupported distributed parallelism, and uneven distribution of computing power, so as to improve fault tolerance and scalability, and improve the efficiency of parallel fuzz testing , to ensure dynamic and rational effects

Pending Publication Date: 2021-11-02
NAT UNIV OF DEFENSE TECH
View PDF2 Cites 1 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

For example, in the parallel mode of AFL, multiple processes are enabled on a stand-alone system to increase the fuzzing rate, and information synchronization is realized through the file system, but it cannot be extended to multiple machines and the work repetition rate is high
PAFL divides the test task into multiple subtasks according to the bitmap to reduce repetitive work, but it does not support distributed parallelism, and the information sharing mechanism is highly coupled with its algorithm, making it difficult to expand
Enfuzz implements a fully scalable platform that integrates multiple representative test tools, but is limited by the file sharing system and cannot be extended to large-scale computing platforms
In industrial applications, the Clusterfuzz framework proposed by Google supports two coverage-driven fuzzing tools, AFL and LibFuzzer, and relies on the massive computing resources of the Google Cloud Platform to achieve remarkable results in vulnerability mining. On the other hand, because of its information synchronization mechanism There is a lack of necessary information, which leads to an increase in the workload of each node in information synchronization, and the same fuzzer is run on each computing node, lacking algorithm diversity
[0004] To sum up, the existing fuzzing parallel optimization work mainly has the following problems: (1) cannot be extended to a distributed environment; (2) the global energy scheduling optimization problem in parallel fuzzing has not been solved, resulting in task conflicts and waste of resources; (3) Static allocation of tasks leads to uneven distribution of computing power, which cannot cope with changes in the scale of computing resources, resulting in problems such as high overhead and unbalanced load; (4) Single-machine multi-core fuzz is mainly carried out through local file systems and other methods Multi-thread synchronization, and their task allocation method is one-size-fits-all. Before the program starts, x cores are determined, and tasks are divided into x parts for these cores to execute.
In this process, the number of cores cannot be increased (because the division of tasks has been determined), and if a certain core stops unexpectedly, it will also affect the overall test

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Distributed parallel fuzzy test method and system based on dynamic centralized scheduling
  • Distributed parallel fuzzy test method and system based on dynamic centralized scheduling
  • Distributed parallel fuzzy test method and system based on dynamic centralized scheduling

Examples

Experimental program
Comparison scheme
Effect test

Embodiment 1

[0041] Such as figure 1 As shown, the distributed parallel fuzz testing method based on dynamic centralized scheduling in this embodiment includes:

[0042] 1) The scheduler reads the initial seed and its status information from the database;

[0043] 2) The scheduler will read all the seeds, perform the priority evaluation and energy allocation before the fuzz test in sequence, and sort all the seeds based on the priority obtained by the evaluation to generate a seed queue;

[0044] 3) The scheduler detects the request initiated by any child node. If the received request is a task request, it will assign the fuzzing task corresponding to the seed to the child node that initiated the request according to the priority of the seed; if the received request is executed by the child node For the update request after the fuzzing task is completed, the scheduler reads the new seeds generated by the sub-nodes that have executed the fuzzing task from the database, performs deduplicati...

Embodiment 2

[0075] This embodiment is basically the same as Embodiment 1, and the main difference is that both the scheduler and the database in Embodiment 1 are integrated in the same central server, while the scheduler and database in this embodiment have independent server. In addition to the form of the above-mentioned integrated or split server (physical machine), both the scheduler and the database can also be implemented in other forms, including the same or different virtual machines, the same or different containers, and physical machines, virtual It can be realized by the combination of machines and containers, etc., which can be selected according to needs.

[0076] It should be noted that the database is essentially used for centralized storage of seeds and their status information, so the database here generally refers to all storage devices that can realize the function of storing seeds and their status information. It can be a chivalrous database, such as Various relationa...

Embodiment 3

[0079] This embodiment is basically the same as Embodiment 1, and the main difference is: the computing power of the scheduler in steps 2.1) to 2.2) in Embodiment 1 is based on the number of seeds evaluated according to the priority required, and the priority of the scheduler to complete a seed The time required for evaluation calculates the total time N required for the scheduler to complete all seed priority evaluations that require priority evaluation, and judges whether the total time N exceeds the preset threshold to determine whether the computing power meets the standard. However, in this embodiment, whether the average CPU usage rate of the computer (central server) where the scheduler is located is lower than the preset threshold is used to determine whether the computing power reaches the standard. In this embodiment, in step 2), the steps of evaluating priority before performing fuzz testing include:

[0080] 2.1A) The scheduler judges the average CPU usage rate of ...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention discloses a distributed parallel fuzzy test method and system based on dynamic centralized scheduling, and the method comprises the following steps: a scheduler reads initial seeds and state information thereof from a database, carries out the priority evaluation and energy distribution of all seeds before fuzzy test in sequence, and carries out the sorting to generate a seed queue; the scheduler detects a request initiated by any child node, and if the received request is a task request, a fuzzy test task corresponding to a seed is allocated to the child node initiating the request according to the priority of the seed; and if the received request is an update request after the child node executes the fuzzy test task, the scheduler reads a new seed generated by the child node executing the fuzzy test task from the database, and after de-duplication is executed on all the seeds, priority evaluation and energy distribution are continued to maintain a seed queue. The fuzzy testing efficiency can be effectively improved, sub-nodes with different computing power differences can be fully utilized, and the method has the advantages of high expandability, high flexibility and the like.

Description

technical field [0001] The invention relates to a vulnerability mining technology in the field of computer security, in particular to a distributed parallel fuzz testing method and system based on dynamic centralized scheduling. Background technique [0002] At present, the research on fuzzing technology at home and abroad has become mature, and the research aimed at improving the efficiency of fuzzing is mainly carried out from two dimensions: algorithm optimization and parallel optimization. Among them, algorithm optimization involves scheduling algorithm, mutation strategy, coverage feedback, etc., and research on parallel optimization focuses on key links such as multi-machine interconnection and information synchronization. [0003] In recent years, with the development and progress of hardware resources and the efficiency of vulnerability mining, parallelization of fuzz testing has gradually become a new focus of research. For example, in the parallel mode of AFL, mul...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
IPC IPC(8): G06F9/48G06F9/50G06F21/57
CPCG06F9/4881G06F9/505G06F9/4806G06F21/577
Inventor 周旭王鹏飞刘陈一帆尹启迪刘莹莹韩绪乐泰宋丛溪
Owner NAT UNIV OF DEFENSE TECH