A vulnerability-oriented regional fuzzing method

Abstract

The application discloses a kind of efficient regional fuzzy test methods with vulnerability as guide, including the following steps: S1, the target program with vulnerability as guide is plugged in and is compiled, and the target program after plugging in containing code coverage information and potential vulnerability position information is obtained;S2, the target program after plugging in is run regional fuzzy test by the core link of fuzzy test based on seed selection;S3, according to the corresponding processing of regional fuzzy test running result;S4, after the end of regional fuzzy test running, target seed is screened and deduplicated, and potential vulnerability analysis is carried out to the seed after screening and deduplicating.The application can effectively reduce the number of seeds in seed queue in the process of regional fuzzy test while keeping the coverage basically unchanged, reduce the cost of fuzzy test, and then improve the efficiency of fuzzy test.

Description

Technical Field

[0001] This invention relates to the field of network security vulnerability discovery, and in particular to a vulnerability-oriented, efficient regional fuzzing method. Background Technology

[0002] With the increasing number of software developers and the growing scale of development, various software programs have become an indispensable part of people's lives, and the security risks associated with them are also increasing. Attackers can exploit security vulnerabilities in software or systems to cause serious harm to computer systems and networks. Now, due to the increasing complexity of programs, fuzzing, as a cost-effective method, has become one of the main tools for discovering vulnerabilities. Fuzzing consists of three basic components: an input generator, an executor, and a vulnerability monitor. The input generator provides the executor with a large amount of input, and the executor uses the input to run the target program. Fuzzing then monitors the execution to check for new execution states or to prevent program crashes.

[0003] Among all fuzzing solutions, Coverage-guided Greybox Fuzzing (CGF) is one method for detecting vulnerabilities. Greybox testing falls between white-box and black-box testing. It is often used in integration testing, focusing not only on the correctness of inputs and outputs but also on the internal workings of the program. While not as detailed or complete as white-box testing, greybox testing pays more attention to the program's internal logic than black-box testing, often using characteristic phenomena, events, and indicators to determine its internal operational state. To date, CGF solutions developed and deployed in the industry, such as OSSFuzz and OneFuzz, have uncovered thousands of vulnerabilities in real-world applications.

[0004] While existing gray-box fuzzing solutions based on code coverage have achieved great success in finding vulnerabilities, researchers recognize that code coverage is a fundamental, but not the only, effective feedback for vulnerability discovery. Code coverage is valued and widely used because of the strong correlation between the number of lines of code covered and the number of vulnerabilities found. However, testing every piece of code equally is inefficient because not every piece of code contains potential vulnerabilities or is vulnerable. Therefore, researchers look for suspicious code regions that are more likely to lead to vulnerabilities and allocate more energy (i.e., mutation counts) to these locations. In fuzzing, the basic unit of code region is generally a basic block (BB), and each seed corresponds to a seed execution path, with each execution path traversing one or more basic blocks. Therefore, it can be considered to some extent that fuzzing seeds and target program code regions are highly corresponding; that is, each code region corresponds to some seeds, although they may not be a one-to-one correspondence.

[0005] Patent CN115269412A proposes a directional fuzzy testing method based on target pre-region search. This method statically analyzes the pre-region basic blocks in the program targeting the target point, performs differentiated instrumentation based on whether a block is a pre-region basic block, and conducts gray-box fuzzy testing guided by coverage. During testing, it performs self-modification, changing non-pre-region basic blocks with indirect calls to pre-region basic blocks. Finally, after each test case execution, the global maturity is updated based on the coverage of the edges formed by the pre-region basic blocks. This method also employs energy scheduling, seed selection, and seed mutation methods based on global maturity to implement directional fuzzy testing. While the target pre-region search-based directional fuzzy testing method addresses the indirect call problem in current directional gray-box fuzzy testing, the global maturity-based method is not effectively integrated with directional fuzzy testing. Therefore, this method has limitations.

[0006] The solution described in patent CN107193731B addresses the problems of high time cost, incomplete test scope, and low automation in current methods for optimizing fuzz test coverage. It proposes a method for controlling mutation to generate test cases. This solution utilizes instrumentation technology to provide feedback on the test case generation process, combining random mutation and controlled mutation methods to optimize test case generation. This solution can improve code coverage to a certain extent and reduce the number of test cases required while maintaining the same code coverage. However, the correlation between the proposed mutation strategy and the solution's effectiveness is not strong enough, resulting in insufficient interpretability. This solution has limitations.

[0007] Patent CN113542299A proposes a method and system for industrial internet vulnerability mining based on fuzzing. This method captures network data packets and parses them to identify packets with known protocols and packets with unknown protocols. It then performs communication layer and link layer parsing on the unknown protocol packets to obtain the communication quintuple and payload data, thereby extracting application layer protocol data packets. These application layer protocol data packets include the header and payload of the unknown protocol. A rule file is generated based on the application layer protocol data packets. Fuzzing test cases are generated based on the rule file and encapsulated. The encapsulated fuzzing test cases are then transmitted to the target device for anomaly detection. While this technique reduces the size of the input seed, it does not maintain a high level of fuzzing efficiency, thus exhibiting limitations.

[0008] The solution described in patent CN114444084A proposes a fuzzing method and a computer-readable storage medium. This invention provides a fuzzing method and a computer-readable storage medium. The method includes the following steps when generating mutation input: S1: Performing byte analysis on each seed in the seed queue to identify bytes related to verification checks, the byte analysis including attempting mutations on all bytes in the seed, and obtaining a score value for the byte based on the path change of the mutation input; S2: Determining whether to mutate the byte based on the score value. This invention uses a novel lightweight mutation strategy to increase the probability of generating legitimate mutation inputs. However, since this solution only optimizes mutations for code coverage, it may incorporate a large number of similar or even completely duplicated legitimate inputs, reducing the space consumption of fuzzing. This solution has limitations.

[0009] The solution described in patent CN111881039B proposes a seed processing method, fuzzing method, system, and storage medium for fuzzing. This application is in software testing technology. The seed processing method includes obtaining the static weights of each program block; statistically analyzing the number of times each program block is run during fuzzing, and obtaining the dynamic weights of each program block based on the statistically analyzed number of runs in each fuzzing test; scoring the seeds in the seed library based on the static and dynamic weights; selecting seeds for mutation, where higher seed scores result in test cases; and statistically analyzing code coverage, updating the seed library with test cases based on the code coverage of the test cases. Although this method uses a new scoring mechanism to prioritize fuzzing of seeds with higher scores, it is prone to repeatedly selecting seeds with the same or similar execution paths for fuzzing because they have higher scores. Therefore, this solution has limitations.

[0010] Software programs and applications are becoming increasingly diverse and numerous, with most programs containing hundreds, thousands, or even tens of thousands of lines of code. These lines or blocks of code are not equal; some blocks are more dangerous and more likely to contain potential vulnerabilities. It's important to note that most blocks of code are not vulnerable. If fuzzing treats all blocks equally, assigning them the same weight, it's clearly unreasonable. Targeted fuzzing has developed significantly, and its advantages have been increasingly recognized. Even some non-DGF (Directed Geometric Foundry) fuzzing systems incorporate some of these advantages, allowing for faster homing to the defined target location. However, targeted fuzzing also has obvious drawbacks. The most significant drawback is its low efficiency (excessive overhead). Other shortcomings include inadequate seed energy allocation and target location selection, preventing targeted fuzzing from becoming a mainstream fuzzing tool in industry. Summary of the Invention

[0011] To address the issues of excessive seed count and low efficiency in existing fuzzing tools, the present invention aims to provide a vulnerability-oriented, high-efficiency regional fuzzing method.

[0012] This invention is achieved through the following technical solution:

[0013] A vulnerability-oriented, high-efficiency area fuzzing method includes the following steps:

[0014] S1. Instrument the vulnerability-oriented target program to obtain the instrumented target program containing code coverage information and potential vulnerability location information.

[0015] S2. Fuzz testing of the target program's runtime area after instrumentation is performed through the core step of fuzz testing based on seed selection.

[0016] S3. Process the results of the regional fuzzy test accordingly.

[0017] S4. After the regional fuzz test is completed, the target seeds are filtered and deduplicated, and the deduplicated seeds are analyzed for potential vulnerabilities.

[0018] In some embodiments, in step S1, the instrumentation compilation involves using different memory error detection tools (sanitizers) to mark and record potential vulnerabilities in the target program and their locations.

[0019] In some embodiments, the vulnerabilities include vulnerabilities related to out-of-bounds access, vulnerabilities related to unauthorized access to freed memory, vulnerabilities related to unauthorized access to returned memory, and vulnerabilities related to memory release.

[0020] In some embodiments, step S2 includes the following steps:

[0021] S2-1. Construct a map showing the locations of potential vulnerabilities in the target program;

[0022] S2-2. Calculate the seed vulnerability discovery capability score based on the distance to the location of the potential vulnerability;

[0023] S2-3. Based on the SNMS algorithm, the pre-scored seeds are screened and filtered.

[0024] In some embodiments, step S2-1 specifically includes:

[0025] S2-1-1, The target program is modeled as a directed unweighted graph, with basic blocks as the unit. ;

[0026] S2-1-2, For each subgraph By using appropriate optimization algorithms, the target vertex is found so that each subgraph contains exactly one target vertex, and the potential vulnerability locations in the target program are finally constructed.

[0027] In some embodiments, the directed unweighted graph ,Include vertices and Each vertex represents a basic block of code, and each edge represents the program execution flow between code blocks;

[0028] The subgraph ,in , , ;

[0029]

[0030] in It is a set of vertices consisting of k target vertices.

[0031] In some embodiments, step S2-2 specifically involves: using a distance calculation method, calculating the score of each seed based on the distance from the seed to the potential vulnerability location, with the closer the seed, the higher the score, and vice versa. At the same time, different weights are assigned to different types of potential vulnerabilities, with the weight of potential vulnerability locations that are close to each other decreasing.

[0032] In some embodiments, the specific flow of the SNMS algorithm in steps S2-3 is as follows:

[0033] S2-3-1, SNMS algorithm begins;

[0034] S2-3-2. Sort the seeds according to their scores.

[0035] S2-3-3: Traverse each seed from highest to lowest score;

[0036] S2-3-4. Calculate the intersection degree (IoU) of the execution paths of the current traversal seed and all remaining seeds;

[0037] S2-3-5, Filter out all seeds whose IoU (Intersection over Union) with the current traversal seed is greater than the threshold p; wherein, the The calculation formula is as follows:

[0038]

[0039] in, Indicates the path coverage of the seed. , This represents the corresponding seed; the threshold p is set to 0.9 by default, indicating that when two seeds... If the value is greater than the threshold p, the execution paths of the two seeds are considered to be too close.

[0040] S2-3-6. Determine if there are any pairs of execution paths with an IoU greater than the threshold p in the remaining seeds. If they exist, repeat step S3-3; otherwise, return the remaining seeds.

[0041] S2-3-7, SNMS algorithm ends.

[0042] In some embodiments, step S3, the corresponding processing based on the results of the regional fuzz test, specifically involves: in a target program that is running a regional fuzz test, if a new code coverage is found, the seed for the new code coverage is retained and added to the seed queue; if a seed that causes the target program to crash or time out is found, the process proceeds directly to step S4.

[0043] The present invention also proposes a computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps of the above-described method.

[0044] The beneficial effects of this invention compared to the prior art include:

[0045] This invention divides the potential vulnerability locations in the target program into regions and, based on the core step of regional fuzzing with seed selection, efficiently evaluates the ability of seeds to discover potential vulnerabilities in the target location. It retains the seeds with stronger vulnerability discovery capabilities and the highest scores in their respective regions, while selecting the minimum number of seeds that can reach most potential vulnerability distribution sub-regions. This effectively reduces the number of seeds in the seed queue during regional fuzzing while maintaining a relatively constant coverage rate, thereby reducing the overhead of fuzzing and improving the efficiency of fuzzing.

[0046] Other beneficial effects of the embodiments of the present invention will be further described below. Attached Figure Description

[0047] Figure 1 This is a flowchart of a vulnerability-oriented, high-efficiency regional fuzzing testing method in an embodiment of the present invention;

[0048] Figure 2 This is a schematic diagram of the target program region division in an embodiment of the present invention;

[0049] Figure 3 This is a flowchart illustrating the specific implementation of the vulnerability-oriented, high-efficiency regional fuzzy testing method in this invention.

[0050] Figure 4 This is a flowchart of the SNMS algorithm in an embodiment of the present invention; Detailed Implementation

[0051] The present invention will be further described below with reference to the accompanying drawings and preferred embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0052] It should be noted that the directional terms such as left, right, up, down, top, and bottom in this embodiment are only relative concepts or are based on the normal use of the product, and should not be considered as restrictive.

[0053] Current mainstream fuzzing tools still have some limitations, failing to consider the large number of similar or duplicate cases in the seed pool, which significantly impacts fuzzing efficiency. Therefore, this invention addresses the problem of excessive seed quantity and low efficiency in existing fuzzing tools by combining the dispersed distribution of vulnerabilities in various large and medium-sized software programs. It proposes an adaptive and more efficient regional fuzzing technique. Based on seed selection, a core aspect of fuzzing, the ability of seeds to discover potential vulnerabilities in target locations is efficiently evaluated. This allows for the selection of the minimum number of seeds that can reach the majority of potential vulnerability distribution sub-regions, significantly reducing the number of seeds in the seed queue. This allows more representative seeds, which are more likely to discover vulnerabilities, to have more opportunities for mutation, thereby improving the overall efficiency of the seed pool and enhancing fuzzing efficiency. Simultaneously, the adaptive seed scheduling strategy dynamically updates relevant algorithm parameter values ​​for different target programs, ultimately improving fuzzing efficiency.

[0054] A vulnerability-oriented, high-efficiency regional fuzzing method, such as Figure 1 As shown, it includes the following steps:

[0055] S1. Instrument the vulnerability-oriented target program to obtain the instrumented target program containing code coverage information and potential vulnerability location information.

[0056] Instrumentation compilation involves using various memory error detection tools (sanitizers) to mark and record potential vulnerabilities in the target program and their locations. For example, the LLVM instrumentation tool can be used to mark and record the locations of these potential vulnerabilities. Vulnerabilities include those related to out-of-bounds access, unauthorized access to freed memory, unauthorized access to returned memory, and memory release.

[0057] S2. Perform fuzz testing on the instrumented target program's runtime region using the seed-selection-based fuzz testing core step; step S2 also includes the following steps:

[0058] S2-1. Construct a map showing the locations of potential vulnerabilities in the target program;

[0059] Specifically, step S2-1 includes the following steps:

[0060] S2-1-1, The target program is modeled as a directed unweighted graph, with basic blocks as the unit. ;

[0061] S2-1-2, For each subgraph By using appropriate optimization algorithms, the target vertex is found so that each subgraph contains exactly one target vertex, and the potential vulnerability locations in the target program are finally constructed.

[0062] Among them, directed unweighted graphs ,Include vertices and Each vertex represents a basic block of code, and each edge represents the program execution flow between code blocks;

[0063] The subgraph ,in , , ;

[0064]

[0065] in It is a set of vertices consisting of k target vertices.

[0066] S2-2. Calculate the seed vulnerability discovery capability score based on the distance to the location of the potential vulnerability;

[0067] Specifically, the method involves using a distance calculation approach to calculate the score of each seed based on its distance from the potential vulnerability location. Seeds that are closer to the potential vulnerability location receive a higher score, while seeds that are farther away receive a lower score. At the same time, different weights are assigned to different types of potential vulnerabilities, with the weight of potential vulnerability locations that are close to the potential vulnerability location decreasing.

[0068] S2-3. Based on the SNMS algorithm, the pre-scored seeds are screened and filtered.

[0069] The specific process of the SNMS algorithm is as follows: Figure 4 As shown, it includes:

[0070] S2-3-1, SNMS algorithm begins;

[0071] S2-3-2. Sort the seeds according to their scores.

[0072] S2-3-3: Traverse each seed from highest to lowest score;

[0073] S2-3-4. Calculate the intersection degree (IoU) of the execution paths of the current traversal seed and all remaining seeds;

[0074] S2-3-5. Filter out all seeds whose IoU (Intersection over Union) with the current traversal seed is greater than the threshold p;

[0075] S2-3-6. Determine if there are any pairs of execution paths with an IoU greater than the threshold p in the remaining seeds. If they exist, repeat step S3-3; otherwise, return the remaining seeds.

[0076] S2-3-7, SNMS algorithm ends.

[0077] S3. Process the results of the regional fuzzy test accordingly.

[0078] The specific processing based on the results of the regional fuzz test is as follows: In a target program that is running a regional fuzz test, if a new code coverage is found, the seed of the new code coverage is retained and added to the seed queue; if a seed that causes the target program to crash or time out is found, proceed directly to step S4.

[0079] S4. After the regional fuzz test is completed, the target seeds are filtered and deduplicated, and the deduplicated seeds are analyzed for potential vulnerabilities.

[0080] The embodiments of this invention propose the following mechanisms or strategies:

[0081] 1. Seed scoring mechanism based on seed vulnerability discovery capabilities

[0082] Seed priority scheduling is a core component of fuzzing. Before prioritizing seeds in the seed pool, it's necessary to know the vulnerability discovery capabilities of the seeds to be scheduled, i.e., the "potential" of each seed. This embodiment of the invention analyzes the execution path of the seeds and other relevant metrics, using an algorithm similar to that in targeted fuzzing to calculate the vulnerability discovery capability of each seed. It then efficiently scores the vulnerability discovery capability of each seed, thereby reducing performance loss before fuzzing and laying the foundation for designing algorithms related to seed priority scheduling and energy allocation in subsequent fuzzing.

[0083] 2. Seed selection strategy based on SNMS (Seed Nonmaximum Suppression) algorithm

[0084] In this embodiment of the invention, the nonmaximum suppression (NMS) algorithm, commonly used in the field of object detection in computer vision, is used to screen and filter the seeds in the seed pool according to code regions. Seeds with similar execution paths but insufficient vulnerability discovery capabilities are filtered out, thereby reducing the number of effective seeds and ultimately improving the efficiency of fuzz testing.

[0085] 3. Adaptive seed scheduling strategies for different target programs

[0086] While existing research has yielded numerous improvements to seed scheduling strategies, these solutions generally lack specificity for the target program. Because the vulnerability distribution and code region characteristics vary significantly across different target programs, a more targeted seed scheduling strategy is needed. In this invention, by setting multiple adaptive and adjustable parameters related to the target program and the overall fuzzing process, and dynamically and efficiently updating these parameter values ​​during fuzzing, more program-specific seed priority scheduling can be achieved. This allows seeds with greater potential for finding potential vulnerabilities in the target program to receive higher priority, thereby improving the overall efficiency of the fuzzing process.

[0087] Example:

[0088] This embodiment is planned to proceed in two steps. The first step is to theoretically demonstrate the feasibility of region fuzz testing. This theoretical demonstration requires certain prior knowledge. The second step, based on that prior knowledge, is to further prove that the graph partitioning process corresponding to the region fuzz testing process can transform the entire non-convex problem into a convex problem for each sub-region through sub-region partitioning.

[0089] The prior knowledge for the first step includes:

[0090] (1) The fuzzing process can be modeled as a pathfinding process of a graph that can start from multiple nodes, where the basic block where the vulnerability is located corresponds to some vertices in the graph.

[0091] (2) The vulnerabilities are relatively scattered in the code of large and medium-sized programs or projects, corresponding to several target vertices in the figure.

[0092] (3) Since there may be multiple vulnerabilities in the program, that is, there are multiple local extrema in the feasible region of the model solution. Therefore, the fuzzing process needs to find as many local extrema as possible, but it should not get stuck in local extrema and be unable to get out.

[0093] (4) Perform regional fuzzy testing, which requires dividing the large graph into sub-regions and ensuring that each sub-region has one and only one potential vulnerability.

[0094] The second step involves the graph partitioning process corresponding to the region fuzzy testing process, as described in detail below:

[0095] First, the target program is modeled as a directed unweighted graph, with each basic block as a unit. ,Include vertices and An edge is a basic block of code within a vertex in the program. Each edge represents the program execution flow (such as control flow or data flow) between code blocks. Assume there are k potential vulnerability locations in the target program, corresponding to k target vertices in graph G.

[0096] In this embodiment of the invention, graph G is divided into k subgraphs. ,in , , This ensures that each subgraph ideally contains one and only one target vertex.

[0097]

[0098] in It is a set of vertices consisting of k target vertices.

[0099] Then for each subgraph The corresponding local extrema, i.e., the target vertex, are found using appropriate optimization algorithms (such as the algorithm used in the directional fuzzing tool AFLGO). Since each vertex corresponds to a basic code block, seeds that can reach the location of that basic block can also be found. Finally, vulnerability analysis is performed on the found seeds.

[0100] The second step is to design a low-overhead fuzzing plugin based on existing theoretical findings. This plugin is expected to achieve the following functions:

[0101] (1) Based on the theoretical foundation in the first step, design a specific algorithm to divide the seed into regions according to the corresponding execution path, that is, to perform graph segmentation on the graph modeled by the target program.

[0102] (2) The seeds in the seed pool are scored based on their ability to discover vulnerabilities according to the optimization algorithm after subgraph partitioning mentioned above.

[0103] (3) Prioritize filtering based on scores to select seeds that are more likely to discover vulnerabilities.

[0104] (4) The algorithm in this plugin can adaptively learn and change the parameters according to the different target programs. That is, different target programs have different parameters to achieve a better division method, and thus better adapt to different target programs.

[0105] (5) This plugin can be adapted to many cutting-edge fuzzing frameworks and tools and improve their fuzzing performance.

[0106] In this embodiment, the target program is divided into regions as follows: Figure 2As shown, the target program's code is organized in basic blocks, and therefore can be divided into many smaller basic blocks. Then, using these basic blocks as units, a region partitioning algorithm is used to divide the target program code into several sub-regions, with each region containing, as far as possible, only one potential vulnerability.

[0107] In gray-box fuzzing, the source code of the target program can be obtained, and then static instrumentation tools, such as LLVM (Low Level Virtual Machine, a framework system for compilers), can be used to instrument the target program at the level of basic code blocks. In most current gray-box fuzzing frameworks, seed generation is largely based on code coverage. When the fuzzing tool discovers a new basic block, i.e., a new code coverage, the seed for this new code coverage is saved and added to the seed queue.

[0108] This invention proposes the concept of a code region, which treats adjacent basic code blocks as a single code region, such as... Figure 2 As shown. Different code regions may have different sizes and contain different numbers of basic blocks. Similarly, for seeds, seeds with very similar execution paths are also considered to be in the same code region.

[0109] Based on the above observations and assumptions, it can be assumed that vulnerabilities are relatively dispersed in medium to large-sized programs or projects, thus suggesting they are more likely to appear in different code regions. Therefore, within each large code region, we aim to focus only on the basic blocks most likely to contain vulnerabilities. Correspondingly, for seeds, we aim to select those with similar execution paths that are more likely to contain vulnerabilities for mutation, while ignoring the remaining seeds to improve the efficiency of fuzz testing.

[0110] This requires, first and foremost, an efficient algorithm to effectively evaluate the vulnerability discovery capabilities of different basic blocks, i.e., different seeds. For example... Figure 2 As shown, colored basic blocks in different code regions indicate potential vulnerabilities. The darker the color, the greater the likelihood of finding a vulnerability in the corresponding seed. Within the same region, multiple basic blocks may contain potential vulnerabilities, but according to an effective scoring mechanism, only the seed most likely to contain a vulnerability can be selected, such as the darkest seed in region 4. After such code region partitioning and seed selection, the number of seeds is significantly reduced, and the mutation count of a single seed is correspondingly greatly increased, further enhancing the vulnerability-finding capability of the fuzzing tool.

[0111] This invention proposes a vulnerability-oriented, high-efficiency regional fuzzing testing method, as described in this embodiment. Figure 1 As shown, it includes the following steps:

[0112] S1. Instrument the vulnerability-oriented target program to obtain the instrumented target program containing code coverage information and potential vulnerability location information.

[0113] S2. Fuzz testing of the target program's runtime area after instrumentation is performed through the core step of fuzz testing based on seed selection.

[0114] S3. Process the results of the regional fuzzy test accordingly.

[0115] S4. After the regional fuzz test is completed, the target seeds are filtered and deduplicated, and the deduplicated seeds are analyzed for potential vulnerabilities.

[0116] The specific description of this embodiment is as follows:

[0117] S1. Instrument the vulnerability-oriented target program to obtain the instrumented target program containing code coverage information and potential vulnerability location information.

[0118] Instrumentation compilation involves using different sanitizers (memory error detection tools) to locate "dangerous areas" (the locations of) potential vulnerabilities in a target program. For example, the AddressSanitizer provided by LLVM can identify the following four types of potential vulnerabilities and their locations within the program:

[0119] (1) Out-of-bounds accesses to heap, stack and globals (related vulnerabilities);

[0120] (2) Use-after-free (illegal access to freed memory related vulnerability);

[0121] (3) Use-after-return (illegal access to memory that has already been returned)

[0122] (4) Double-free, invalid free (memory release related vulnerabilities);

[0123] Then, using the instrumentation tools provided by LLVM, the locations of these potential vulnerabilities were marked and recorded.

[0124] S2. Fuzz testing of the target program's runtime area after instrumentation is performed through the core step of fuzz testing based on seed selection.

[0125] S2-1. Construct a map showing the locations of potential vulnerabilities in the target program;

[0126] Specifically, step S2-1 includes the following steps:

[0127] S2-1-1, The target program is modeled as a directed unweighted graph, with basic blocks as the unit. ;

[0128] S2-1-2, For each subgraph By using appropriate optimization algorithms, the target vertex is found so that each subgraph contains exactly one target vertex, and the potential vulnerability locations in the target program are finally constructed.

[0129] Among them, directed unweighted graphs ,Include vertices and Each vertex represents a basic block of code, and each edge represents the program execution flow between code blocks;

[0130] The subgraph ,in , , ;

[0131]

[0132] in It is a set of vertices consisting of k target vertices.

[0133] S2-2. Calculate the seed vulnerability discovery capability score based on the distance to the location of the potential vulnerability;

[0134] Specifically, the distance calculation method in the Directed Graybox Fuzzing (DGF) tool is used, with appropriate targeted optimizations and improvements. Based on the distance from the seed to the potential vulnerability location, a score is calculated for each seed. Seeds closer to the location receive higher scores, while those farther away receive lower scores. Different weights are assigned to different types of vulnerabilities, with the weight of nearby potential vulnerability locations appropriately reduced.

[0135] Based on the existing seed scoring algorithm, appropriate modifications were made to make it more targeted to different types of vulnerabilities. Specifically, different weights were assigned to different types of vulnerabilities, and the weight of potential vulnerability locations that are close to each other was appropriately reduced.

[0136] S2-3. Based on the SNMS algorithm, the pre-scored seeds are screened and filtered.

[0137] The existing pre-scored seeds are screened and filtered using the advanced and efficient adaptive SNMS algorithm proposed in this embodiment of the invention. The SNMS algorithm framework is as follows: Figure 3As shown, this effectively reduces the length of the seed queue and allows seeds in the seed pool that are more likely to discover vulnerabilities to receive more energy and mutation opportunities, ultimately improving the efficiency of fuzz testing.

[0138] The specific process of the SNMS algorithm is as follows:

[0139] S2-3-1, SNMS algorithm begins;

[0140] S2-3-2. Sort the seeds according to their scores.

[0141] S2-3-3: Traverse each seed from highest to lowest score;

[0142] S2-3-4. Calculate the intersection degree (IoU) of the execution paths of the current traversal seed and all remaining seeds;

[0143] S2-3-5, Filter out all seeds whose IoU (Intersection over Union) with the current traversal seed is greater than the threshold p; wherein, the The calculation formula is as follows:

[0144]

[0145] in, Indicates the path coverage of the seed. , This represents the corresponding seed; the threshold p is set to 0.9 by default, indicating that when two seeds... If the value is greater than the threshold p, the execution paths of the two seeds are considered to be too close.

[0146] S2-3-6. Determine if there are any pairs of execution paths with an IoU greater than the threshold p in the remaining seeds. If they exist, repeat step S3-3; otherwise, return the remaining seeds.

[0147] S2-3-7, SNMS algorithm ends.

[0148] S3. Process the results of the regional fuzzy test accordingly.

[0149] The specific processing based on the results of the regional fuzz test is as follows: In a target program that is running the regional fuzz test, if a new code coverage is found, the seed for the new code coverage is retained and added to the seed queue; if a seed that causes the target program to crash or time out is found, proceed directly to step S4.

[0150] S4. After the regional fuzz test is completed, the target seeds are filtered and deduplicated, and the deduplicated seeds are analyzed for potential vulnerabilities.

[0151] The embodiments of the present invention have the following beneficial results:

[0152] This invention addresses the dispersed distribution of vulnerabilities in various large and medium-sized software programs by proposing an adaptive and more efficient regional fuzzing technique to overcome the problems of excessive seed quantity and low efficiency in existing fuzzing tools. Based on seed selection, a core aspect of fuzzing, the technique efficiently evaluates the ability of seeds to discover potential vulnerabilities at target locations, thereby selecting the minimum number of seeds capable of reaching most potential vulnerability distribution sub-regions. This significantly reduces the number of seeds in the seed queue. Furthermore, the adaptive seed scheduling strategy in this invention dynamically updates relevant algorithm parameter values ​​for different target programs, ultimately improving fuzzing efficiency.

[0153] like Figure 4 Table 1 shows a comparison of the number of AFL++-SNMS and AFL++ seeds achieving the corresponding edge coverage rates under multiple target programs. Each cell represents the percentage of the number of AFL++-SNMS seeds to the number of AFL++ seeds, where the percentage in parentheses represents the corresponding edge coverage rate.

[0154] For example, in the line readelf, the cell 56.5 (25%) indicates that when achieving 10% edge coverage, the method proposed in this embodiment of the invention only needs 56.5% of the code coverage compared to AFL++.

[0155] The experimental results show that the method proposed in this embodiment of the invention can effectively reduce the number of seeds in the seed queue during fuzzing while maintaining a basically unchanged coverage rate, thereby reducing the overhead of fuzzing and improving the efficiency of fuzzing.

[0156] Table 1

[0157]

[0158] In some other embodiments, the seed scoring mechanism for seed vulnerability discovery capability does not adequately consider the relevant factors affecting different seed scores. More influencing factors can be added to make the seed scoring mechanism more reasonable and efficient.

[0159] In other embodiments, while the seed screening strategy can effectively control the number of seeds in the seed queue, it may still filter out some seeds that are very likely to find vulnerabilities. Therefore, a recycling mechanism can be designed to perform a secondary screening on the filtered seeds, retaining the batch of seeds with the highest potential for vulnerability discovery and adding them to the seed queue.

[0160] In other embodiments, the adaptive seed scheduling strategy for different target programs can further introduce more adaptive parameters related to the target program itself and the target program seed input, thereby improving the suitability of the scheduling strategy for different target programs.

[0161] Experimental example:

[0162] The specific implementation method of this experimental example is as follows: Figure 3 As shown, it includes the following steps:

[0163] S1. Instrument the vulnerability-oriented target program to obtain the instrumented target program containing code coverage information and potential vulnerability location information.

[0164] Select an open-source target program for vulnerability discovery using fuzzing, and use the LLVM static instrumentation compilation tool. This is done in conjunction with an appropriate sanitizer (such as AddressSanitizer). The sanitizer can be conveniently used during compilation by adding compilation options (e.g., adding the option "-fsanitize=address" to include AddressSanitizer). After compilation, you will obtain the instrumented target program, which includes code coverage information and potential vulnerability locations.

[0165] After obtaining the instrumented target program, it is necessary to find a suitable initial seed to use with the target program. This step can be done by obtaining some input files that meet the format requirements of the target program as the initial seed library.

[0166] S2. Fuzz testing of the target program's runtime area after instrumentation is performed through the core step of fuzz testing based on seed selection.

[0167] Next is the core process of fuzz testing, which is the stage of formally conducting fuzz testing.

[0168] S2-1. Construct a map showing the locations of potential vulnerabilities in the target program;

[0169] S2-1-1, The target program is modeled as a directed unweighted graph, with basic blocks as the unit. ;

[0170] S2-1-2, For each subgraph By using appropriate optimization algorithms, the target vertex is found so that each subgraph contains exactly one target vertex, and the potential vulnerability locations in the target program are finally constructed.

[0171] Among them, directed unweighted graphs ,Include vertices and Each vertex represents a basic block of code, and each edge represents the program execution flow between code blocks;

[0172] The subgraph ,in , , ;

[0173]

[0174] in It is a set of vertices consisting of k target vertices.

[0175] S2-2. This experimental example utilizes the distance calculation method in the Directed Graybox Fuzzing (DGF) tool, with appropriate targeted optimizations and improvements.

[0176] The specific steps are as follows:

[0177] Using a distance calculation method, a score is calculated for each seed based on its distance to the potential vulnerability locations. Seeds closer to the source have higher scores, while those farther away have lower scores. Different weights are assigned to different types of vulnerabilities, with slightly lower weights for nearby vulnerabilities. For details on the distance calculation method, please refer to the paper AFLGo, which is a common distance calculation method in the field.

[0178] S2-3. The existing scored seeds are screened and filtered using the adaptive SNMS algorithm proposed in the experimental example of this invention. The SNMS algorithm framework is as follows: Figure 4 As shown, the specific process of the SNMS algorithm is as follows:

[0179] S2-3-1, SNMS algorithm begins;

[0180] S2-3-2. Sort the seeds according to their scores.

[0181] S2-3-3: Traverse each seed from highest to lowest score;

[0182] S2-3-4. Calculate the intersection degree (IoU) of the execution paths of the current traversal seed and all remaining seeds;

[0183] S2-3-5, Filter out all seeds whose IoU (Intersection over Union) with the current traversal seed is greater than the threshold p; wherein, the The calculation formula is as follows:

[0184]

[0185] in, Indicates the path coverage of the seed. , This represents the corresponding seed; the threshold p is set to 0.9 by default, indicating that when two seeds... If the value is greater than the threshold p, the execution paths of the two seeds are considered to be too close.

[0186] S2-3-6. Determine if there are any pairs of execution paths with an IoU greater than the threshold p in the remaining seeds. If they exist, repeat step S3-3; otherwise, return the remaining seeds.

[0187] S2-3-7, SNMS algorithm ends.

[0188] S3. Process the results of the regional fuzzy test accordingly.

[0189] This experimental example calculates the Intersection over Union (IoU) of execution paths for different seeds and filters out those that are too close and have low scores. This allows seeds with stronger vulnerability discovery capabilities and higher scores to gain more power in subsequent mutation stages. Simultaneously, by effectively reducing the number of seeds, the overhead of fuzzing is correspondingly reduced, thus improving fuzzing efficiency.

[0190] S4. After the fuzzing process finishes its pre-set runtime, it filters and removes duplicate target seeds, then performs actual vulnerability analysis on the filtered and deduplicated seeds. Potential vulnerability locations are identified in the target program; fuzzing is then used to obtain seed files causing crashes; these seed files are then analyzed to determine the specific actual vulnerabilities. Target seeds are the seed files that cause the target program to crash or time out.

[0191] The final results show that the embodiments of the present invention can effectively divide the potential vulnerability locations in the target program into regions, and filter the seeds that have passed through these regions using the SNMS algorithm in the embodiments of the present invention. This effectively filters out the seeds in the seed pool that have lower vulnerability discovery capabilities, and retains the seeds that have stronger vulnerability discovery capabilities and the highest scores in their respective regions. This effectively reduces the number of seeds in the seed queue, improves the vulnerability discovery capability of seeds, reduces fuzzing overhead, and improves fuzzing efficiency.

[0192] The embodiments of this invention have the following market value for the vulnerability discovery industry in the software and network security fields:

[0193] (1) It can effectively reduce the number of seeds in the seed pool during fuzz testing, thereby helping users improve the efficiency of the product's fuzz testing framework;

[0194] (2) It helps developers to conduct more targeted vulnerability discovery for different programs and helps them fix potential security issues in the code in a timely manner.

[0195] The embodiments of the present invention have the following significant differences and technological advantages compared with the prior art:

[0196] (1) It can perform efficient regional fuzzy testing through a new seed priority scheduling strategy;

[0197] (2) It can perform efficient fuzz testing on different target programs by dynamically updating the adaptive parameters in the fuzz testing framework.

[0198] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, several equivalent substitutions or obvious modifications can be made without departing from the concept of the present invention, and all such modifications, achieving the same performance or purpose, should be considered within the scope of protection of the present invention.

Claims

1. A vulnerability-oriented area fuzzing method, characterized in that, Includes the following steps: S1. Instrument the vulnerability-oriented target program to obtain the instrumented target program containing code coverage information and potential vulnerability location information. S2. Fuzz testing of the target program's runtime area after instrumentation is performed through the core step of fuzz testing based on seed selection. S3. Process the results of the regional fuzzy test accordingly. S4. After the regional fuzz test is completed, the target seeds are filtered and deduplicated, and the deduplicated seeds are analyzed for potential vulnerabilities. Step S2 includes the following steps: S2-1. Construct a map showing the locations of potential vulnerabilities in the target program; S2-2. Calculate the seed vulnerability discovery capability score based on the distance to the location of the potential vulnerability; S2-3. Screening and filtering of pre-scored seeds based on the SNMS algorithm; Step S2-1 specifically involves: S2-1-1, The target program is modeled as a directed unweighted graph, with basic blocks as the unit. The directed unweighted graph Include vertices and Edge; S2-1-2, For each subgraph The corresponding target vertex is found by using the appropriate optimization algorithm, so that each subgraph contains only one target vertex, and the potential vulnerability location in the target program is finally constructed. In steps S2-3, the specific process of the SNMS algorithm is as follows: S2-3-1, SNMS algorithm begins; S2-3-2. Sort the seeds according to their scores. S2-3-3: Traverse each seed from highest to lowest score; S2-3-4. Calculate the intersection degree (IoU) of the execution paths of the current traversal seed and all remaining seeds; S2-3-5. Filter out all seeds whose IoU (Intersection over Union) with the current traversal seed is greater than the threshold p; where... The calculation formula is as follows: ； in, Indicates the path coverage of the seed. , Indicates the corresponding seed; S2-3-6. Determine if there are any pairs of execution paths with an IoU greater than the threshold p in the remaining seeds. If they exist, repeat step S3-3; otherwise, return the remaining seeds. S2-3-7, SNMS algorithm ends; In step S3, the corresponding processing based on the results of the regional fuzz test is as follows: if a new code coverage is found in a certain input target program during the regional fuzz test, the seed that found the new code coverage is retained and added to the seed queue; if a seed that causes the target program to crash or time out is found, the process proceeds directly to step S4.

2. The vulnerability-oriented area fuzzing method as described in claim 1, characterized in that, In step S1, the instrumentation compilation involves using different memory error detection tools, such as sanitizer, to mark and record potential vulnerabilities in the target program and their locations.

3. The vulnerability-oriented area fuzzing method as described in claim 1 or 2, characterized in that, The vulnerabilities include those related to out-of-bounds access, unauthorized access to freed memory, unauthorized access to returned memory, and memory release.

4. The vulnerability-oriented area fuzzing method as described in claim 1, characterized in that, Each vertex represents a basic block of code, and each edge represents the program execution flow between code blocks; The subgraph ,in , , ; ； in It is a set of vertices consisting of k target vertices.

5. The vulnerability-oriented area fuzzing method as described in claim 1, characterized in that, Step S2-2 specifically involves: using a distance calculation method, calculating the score of each seed based on the distance from the seed to the potential vulnerability location. Seeds that are closer to the potential vulnerability location have a higher score, while seeds that are farther away have a lower score. At the same time, different weights are assigned to different types of potential vulnerabilities, with the weight of potential vulnerability locations that are close to the potential vulnerability location being reduced.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-5.

Images