Seed optimization method based on vulnerability prediction model

Abstract

The invention discloses a seed optimization method based on a vulnerability prediction model, and the method comprises the steps: building the vulnerability prediction model, enabling the vulnerability prediction model to be used for predicting the vulnerability of a function in a target program, achieving the seed optimization through the screening of seeds, and tracking the execution information of the target program through a dynamic binary detection method, and calculating a static vulnerability score SVS according to the vulnerability probability obtained by the vulnerability prediction model, and storing the test case with the score higher than a certain threshold in a seed input pool. The test cases are selected by using a seed selection strategy and stored in a seed input pool, and executed test cases capable of causing collapse are also stored in the seed input pool. Next generation inputs of the seed input pool are generated by mutating the inputs in the seed input pool. According to the method, the vulnerability prediction probability of the basic block of the target program is fully considered, effective variation aiming at the target program is favorably realized, the effectiveness of the test case is improved, and vulnerabilities are more easily mined.

Description

technical field [0001] The invention relates to the field of network security, in particular to a seed optimization method based on a vulnerability prediction model. Background technique [0002] In the field of vulnerability mining in computer technology, fuzz testing undoubtedly occupies a pivotal position. As a commonly used vulnerability mining method, fuzz testing has the advantages of high accuracy, convenient operation, and strong scalability, but it also faces the following problems: Commonly used fuzz testing tools or frameworks place the functions of the test targets in the same position , the same amount of test cases are designed for all functions of the test target, resulting in a large number of invalid use cases, which increases redundant calculations and resource consumption in the fuzzing process; mutation-based fuzzers are difficult to generate without guidance A valid test case that can cause a crash can also cause a large amount of invalid calculation an...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the problem of a large number of invalid use cases designed in the existing fuzzing testing methods in the field of vulnerability mining, resulting in a large number of redundant calculations, the present invention discloses a fuzzer improvement scheme oriented by the vulnerability prediction results, and the supporting basis The vulnerability prediction results filter the seeds in the seed pool, guide the direction of fuzz test case generation through seed optimization, improve the effectiveness of test cases, and reduce redundant calculation and resource consumption of fuzz tests

Images