Software fuzz testing method and device, electronic device and storage medium

Abstract

The present invention provides a software fuzzy testing method and device, electronic equipment and storage medium, wherein the method includes: identifying the state of the program under test from the source code of the program under test, and the state of the program under test includes state variables and state variables Range of value range; based on state variables, code instrumentation is performed when the source code of the program under test is compiled, and the program under test after instrumentation is obtained; based on the program under test after instrumentation, the feedback information of code instrumentation and feedback information are obtained Including code coverage information and state variable writing information; based on feedback information and the state of the program under test, perform multi-dimensional feedback fuzz testing on the source code of the program under test. In the process of software fuzzy testing, the present invention tracks state variables and screens input test cases through genetic algorithm, so as to cover more state variable value ranges, so as to traverse the code and program state of the software under test as much as possible, and discover more potential security vulnerabilities, increasing the probability of vulnerability discovery.

Description

technical field [0001] The present invention relates to the field of computers, and in particular, to a software fuzzy testing method and device, an electronic device and a storage medium. Background technique [0002] With the continuous popularization of informatization, program software has been applied to all aspects of society, and people have put forward higher requirements for software security. Once there is a security loophole in the software, it will cause huge economic losses and even threaten to life safety. For example, now that autonomous driving is gradually put into practical application, once the security loopholes in the autonomous driving system are exploited by hackers, causing abnormal driving of the vehicle, while damaging the vehicle, it may also cause the safety of drivers and pedestrians. Therefore, it is very important for today's society to find software security vulnerabilities in advance and fix them immediately. [0003] Software fuzzing is on...

AI Technical Summary

Problems solved by technology

State-insensitive fuzz testing cannot effectively discover security vulnerabilities related to the state, either because the program state cannot be satisfied and the corresponding code cannot be executed, thereby failing to trigger the security hole; or even if the corresponding code is executed, the program state is not satisfied. Unable to trigger the security hole

Therefore, it is difficult to effectively discover security vulnerabilities related to state

Images