Cloud deployment automatic vulnerability mining system based on fuzzy testing

Abstract

The invention provides a cloud deployment automatic vulnerability mining system based on fuzz testing, which comprises a fuzz testing access device and a fuzz testing engine management device which are respectively used for receiving and acquiring test configuration parameters, test target program files and test control instructions; the fuzzy test engine device is used for obtaining a test target program file to carry out instrumentation compilation and executing a vulnerability mining test on the program subjected to instrumentation compilation by using a test configuration parameter according to a test control instruction; the fuzz test result device is used for acquiring test data of an abnormal program and displaying the test data to the test user through a visual interface; and the system resource probe device is used for acquiring cluster resources and reporting the cluster resources to the fuzzy test engine management device. According to the cloud deployment automatic vulnerability mining system based on the fuzzy test, cloud deployment of the fuzzy test system is realized, the test time is saved, and the iteration efficiency is accelerated.

Description

technical field [0001] The embodiment of the present invention relates to the technical field of fuzz testing, in particular to a fuzz testing-based automated vulnerability mining system for cloud deployment. Background technique [0002] The current software testing technology can only find and identify specific types of errors and defects. It matches the reported CVE (Common Vulnerabilities and Exposures) with the current software to determine whether there are "known types" in the software. loophole. In fact, the "known" vulnerabilities reported on the market may only be the tip of the iceberg of all vulnerabilities, and more hidden "unknown" vulnerabilities are often unpredictable in the software. Therefore, even if the software is tested by strict traditional testing schemes, which can only ensure that there are no known vulnerabilities, it will still face more unknown vulnerabilities exposed after it is put into operation. [0003] Some software testing methods, such...

AI Technical Summary

Problems solved by technology

[0003] Some software testing methods, such as dynamic testing and other vulnerability mining techniques, test products by artificially simulating hackers’ malicious intrusions, but this testing method is very dependent on manual heuristic operations

An excellent tester can execute no more than dozens of test cases a day, the labor cost is high, and he is helpless when dealing with very complex and huge systems

[0004] At present, the vulnerability mining software based on fuzz testing is developing rapidly, but the fuzz testing systems in the prior art are all single-node independent deployment structures, and cannot dynamically scale out the system according to the needs of the test scale and test environment. The time required is greatly increased, which requires a huge cost of testing time for complex projects

Moreover, the existing test system exists independently as a tool. After the development work is completed, the developer needs to manually import the target to be tested into the test system for testing. It is conducive to the continuous tracking and continuous improvement of the loopholes found in the test in the software testing process

Images