Kernel fuzzy testing method and system based on large language model

Abstract

The invention discloses a kernel fuzz testing method and system based on a large language model, and belongs to the technical field of kernel fuzz testing. The method comprises the following steps: constructing a mapping relationship between system calling of a target operating system and a kernel object; based on the mapping relationship between the system call and the kernel object, generating a test case by using a large language model; and under the condition that the test case passes the verification, obtaining a fuzzy test result of the target operating system based on the test case. According to the method, the reasoning generalization ability of the LLM is utilized to generate a large number of effective system call sequences which conform to the dependency relationship and are wide in coverage range, so that the ability of a fuzzy test tool to generate test cases is enhanced, and potential vulnerabilities are mined.

Description

Technical Field

[0001] The present invention relates to the technical field of kernel fuzz testing, and in particular to a kernel fuzz testing method and system based on a large language model. Background Art

[0002] With the rapid development of Internet technology, software has become an indispensable part of people's lives and work. However, in recent years, the number of attacks using software vulnerabilities has increased, posing a serious security threat to society. According to the definition of RFC 2828, a vulnerability is a defect or weakness in system design, implementation, or operational management that may be exploited to undermine the security policy of the system. Zero-day vulnerability attacks have great potential for destructive power. For example, the WannaCry ransomware attack in May 2017 exploited a vulnerability in the Server Message Block (SMB) protocol and infected more than 230,000 computers in more than 150 countries around the world in a short period of time, causing huge economic losses in industries such as finance, energy, and medical care. In addition, the Log4Shell vulnerability discovered at the end of 2021 is considered a catastrophic security vulnerability because it is easy to exploit and affects the widely used Apache Log4j library, resulting in a 34% surge in the number of cyber attacks. The operating system kernel is the core of the operating system, directly accesses physical memory, is responsible for managing hardware resources and providing system services, and therefore becomes the main target of attackers. Vulnerabilities in the kernel, such as Use-After-Free (UAF), can be used for local privilege escalation or remote code execution attacks, posing a serious threat to system security. Therefore, ensuring the robustness and security of the kernel is of vital importance.

[0003] Kernel fuzz testing is one of the main methods for discovering kernel vulnerabilities. By sending a large number of constructed system call sequences to the kernel and observing the kernel's running status, researchers can discover potential problems in the kernel. In recent years, a variety of kernel fuzz testing tools such as PeriScope, KAFL, and Syzkaller have been developed. Since the kernel provides nearly 400 system calls and there are dependencies between these calls, how to effectively generate system call sequences has become a research hotspot.

[0004] Most of the current work relies on traditional tools, which have high barriers to use and high resource consumption. Template-based methods, such as syzkaller, require a lot of professional knowledge and a lot of manpower to write templates, and often fail to achieve comprehensive coverage. Artificial intelligence-related technologies have been widely used in other fields, but their application in kernel fuzz testing is still in its infancy. For example, KernelGPT uses LLM to generate Syzkaller's system call description template, filling the gap in system calls that the tool was not originally designed for. However, this work only improves the coverage, and no further exploration is conducted on the relationship between system calls and the depth of kernel testing. It can be seen that the current LLM-based tools are mostly used to generate peripheral knowledge such as templates, and have not directly attempted to use the Linux kernel system call knowledge, and have not exerted the reasoning ability of LLM. Summary of the invention

[0005] The present invention discloses a kernel fuzzy testing method and system based on a large language model, which utilizes the reasoning and generalization capability of LLM to generate a large number of effective system call sequences that conform to dependency relationships and have a wide coverage, thereby enhancing the ability of fuzzy testing tools to generate test cases and explore potential vulnerabilities.

[0006] To achieve the above objectives, the technical solution of the present invention includes the following contents.

[0007] A kernel fuzz testing method based on a large language model, the method comprising:

[0008] Construct the mapping relationship between the target operating system's system calls and kernel objects;

[0009] Based on the mapping relationship between the system call and the kernel object, a test case is generated by using a large language model;

[0010] When the test case passes verification, a fuzzy test result of the target operating system is obtained based on the test case.

[0011] Furthermore, the mapping relationship between the system call and the kernel object of the target operating system is constructed, including:

[0012] Obtaining a compilation command record in the process of compiling a target operating system kernel, and extracting a .c file and a .h file in the compilation command record as a target file;

[0013] Convert the code in the target file into an abstract syntax tree, and determine the code structure based on the abstract syntax tree, and obtain function and structure objects by extracting source code defined by functions and structures;

[0014] Scan the system call sequence, mark the structure objects that meet the characteristics of kernel objects as kernel objects, and generate a mapping relationship between system calls and kernel objects based on the structure objects called or returned by the function;

[0015] Static pointer analysis is performed on the source code of the kernel object, and the mapping relationship between the system call and the kernel object is updated by obtaining the kernel object indirectly operated by the system call through the pointer.

[0016] Furthermore, based on the mapping relationship between the system call and the kernel object, a test case is generated using a large language model, including:

[0017] Selecting a kernel object, and acquiring a function having a dependency relationship based on a mapping relationship between the system call and the kernel object;

[0018] Fill the kernel object and the functions with dependencies into the kernel object initialization code prompt template, and use the large language model to generate the initialization code of the kernel object, and at the same time ask the large language model whether the initialization code involves other kernel objects; wherein the initialization code covers the setting of the object counter, memory allocation and operation definition;

[0019] In the case where other kernel objects are involved in the initialization code, the step of filling the kernel object and the function with dependency into the kernel object initialization code prompt template is re-executed based on the other kernel objects to generate a set of kernel objects including a plurality of mutually dependent kernel objects; wherein the kernel objects in the kernel object set are already initialized kernel objects;

[0020] For the initialized kernel objects, except for the system call that initializes the kernel object, the signature input of the remaining related system calls and the kernel object are embedded into the kernel object test code prompt template, and the test code for the kernel object is generated using the large language model.

[0021] Furthermore, after generating the test code for the kernel object, the method further includes:

[0022] The initialization code and the test code of the kernel object are embedded into the kernel object destruction code prompt template, and the large language model is used to generate codes for destroying or releasing the initialization code and the test code.

[0023] Further, when the test case passes the verification, obtaining the fuzzy test result of the target operating system based on the test case includes:

[0024] Embed Syzlang syntax and test cases into the C language to syzProgram prompt template, and use the large language model to generate test cases that conform to Syzlang syntax;

[0025] Convert the test cases that conform to Syzlang syntax into test cases that can be executed in the Linux environment. If an error occurs during the conversion process, embed the code of the error information into the error repair template, and use the large language model to obtain the test cases that can be executed in the Linux environment.

[0026] A mutation operation is performed on the test case executable in the Linux environment, and a fuzz test of the target operating system is performed based on the mutation operation result to obtain a fuzz test result of the target operating system.

[0027] A kernel fuzz testing system based on a large language model, the system comprising:

[0028] A mapping relationship building module is used to build a mapping relationship between the system call and kernel object of the target operating system;

[0029] A test case generation module, used to generate test cases based on the mapping relationship between the system call and the kernel object and using a large language model;

[0030] The fuzzy testing module is used to obtain the fuzzy testing result of the target operating system based on the test case when the test case passes the verification.

[0031] An electronic device, characterized in that the electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the kernel fuzzy testing method based on a large language model described in any one of the above items is implemented.

[0032] A computer-readable storage medium, characterized in that computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are executed by a processor, any of the kernel fuzz testing methods based on a large language model described above is implemented.

[0033] Compared with the prior art, the present invention has at least the following beneficial effects.

[0034] 1. It saves a lot of labor costs and can generate a large number of seed sequences available for the syzkaller tool in a short time.

[0035] 2. Compared with manual writing, the system call sequence generated by the present invention has a wider coverage and conforms to the dependencies between system calls, which can effectively guide the fuzz testing work of syzkaller. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Flowchart of kernel fuzz testing method based on large language model.

[0037] Figure 2 Schematic diagram for identifying kernel objects and system calls.

[0038] Figure 3 Generates a schematic diagram for LLM-based system call sequences. DETAILED DESCRIPTION

[0039] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below through its specific embodiments in conjunction with the accompanying drawings.

[0040] In order to obtain the expected output from LLM, the user needs to interact with the model through prompt engineering, whether it is a zero-shot or a few-shot method, which can effectively guide LLM to produce the expected results of the user. When LLM is required to generate a call sequence containing system dependencies, these dependencies must first be deeply mined, and the corresponding Promote templates must be constructed based on the mined relationships. LLM is allowed to learn and understand the dependencies between system calls through prompts, and generate call sequences that meet the dependencies. This process is crucial to ensure that LLM can accurately generate call sequences that meet system dependencies, so the present invention intends to adopt the following steps to achieve this function-identifying kernel objects and system calls, test case generation based on LLM, and verification optimization of test cases.

[0041] The kernel fuzzy testing method based on a large language model of the present invention is as follows: Figure 1 As shown, the steps include steps 1 to 3.

[0042] Step 1: Build the mapping relationship between the target operating system's system calls and kernel objects.

[0043] The dependencies in the system call sequence are crucial for whether the test case can be successfully accepted by the operating system kernel. Some dependencies are obvious, such as when the return value of a system call is directly used as the input of another system call, this dependency can be identified by comparing the return value type and input parameter type of the two. However, when the system call involves a complex data structure containing void* type parameters, this direct dependency identification method is no longer applicable. At this time, the present invention needs to obtain these implicit dependencies by tracking the operations of the relevant kernel objects in detail.

[0044] In addition, the execution of many kernel functions depends on the specific field values ​​of specific kernel objects. Taking different types of cdrom as an example, the kernel defines a special read operation function for each type, such as cdrom_read_(). These functions will check whether the specific subdomain of the kernel object (such as cd→_method) is assigned a specific value of the corresponding type before execution. And the setting of this value is usually completed in the registration function register_cdrom() driven by the cdrom. Therefore, in order to successfully execute the read operation of cdrom, the present invention not only needs to clarify the direct dependency between system calls, but also must deeply understand the dependency of the operation code on the specific value of the kernel object, and must use the system call sequence in the correct context. In order to achieve this requirement, the present invention first needs to identify the kernel object operated by each system call in the target kernel, collect kernel objects and related system calls, including kernel object sets and system call sets, and when the system call sequence is generated according to the kernel objects later, the dependency between calls can be provided according to the extracted information.

[0045] Kernel objects usually have two significant features: first, they are usually defined as global variables; second, they have special fields to record common information of kernel objects, such as reference count fields, object type names, and definitions of object operations, etc. In order to identify these kernel objects, the present invention adopts a method of comprehensively scanning the kernel source code to find objects that meet the above two significant features, and records all system call sets that operate these objects.

[0046] like Figure 2 As shown, the present invention first selects the target operating system kernel, saves the compilation command record during the kernel compilation process, screens the record, and extracts the .c and .h files as subsequent target files. Use code compilation tools such as LLVM to convert all kernel codes into AST, and judge the code structure, extract all the source code of the structure and function definition by traversal, and store the function and structure objects in different tables of the database. Scan each system call in is the complete set of system calls in the target kernel. When scanning all system call sequences, the parts that meet the above two significant features are marked as kernel objects, recorded as It is the collection of all kernel objects in the kernel. During the traversal process, if a function calls or returns a certain structure object, the present invention considers that this function has a dependency relationship with this structure.

[0047] For example, the code that handles the open system call in the Linux kernel ultimately calls the do_sys_openat2 function in the VFS layer. The following is a simplified code. It can be seen that a file object f is created and bound to the fd handle, so it can be concluded that there is an association between the file object and the open system call.

[0048]

[0049] Considering that kernel object transfer is often performed through pointers, and simple system call parameter scanning may not be able to capture such relationships, therefore, after identifying the kernel object, the present invention further performs static pointer analysis on the kernel code, and searches in the function body whether one or several kernel objects have been modified, called, etc., so as to find kernel objects that are indirectly operated on by system calls through pointers. If in the function body, the present invention finds that it has operated on a global variable or structure variable, it is considered that this function has a dependency relationship with the structure, and the system call-kernel object mapping relationship is updated according to the newly found information.

[0050] Step 2: Generate test cases based on the mapping relationship between system calls and kernel objects and using the large language model.

[0051] After constructing this detailed system call-kernel object mapping relationship, the present invention uses LLM to generate a system call sequence, i.e., a test case. The present invention first constructs a set of prompt templates, and then uses different templates according to different links, and fills the kernel knowledge that needs to be provided to LLM into the template, guides LLM to deeply understand the task requirements, and adopts a step-by-step guidance method of different links to ensure that the call sequence it generates meets expectations and requirements. Figure 3 Generates a schematic diagram for LLM-based system call sequences.

[0052] Step 2.1: Write a Prompt template for interacting with LLM, which mainly includes task requirements, input format, output format, input content, output content and some examples. Let LLM generate output for the information given by the present invention according to the provided requirements and examples, that is, according to the kernel object source code and system call source code, generate the initialization code, test case and destruction code involving the kernel object to ensure the integrity of the test process. Among them, the Prompt template includes: kernel object initialization code prompt template, kernel object test code prompt template, kernel object destruction code prompt template, C language to syzProgram prompt template and error repair template.

[0053] The content of the kernel object initialization code prompt template includes: role setting and task description, generation steps, kernel object information to be generated, and related functions. Among them, the role setting and task description can be: 1) Please generate C language code for structure initialization based on the given structure and function information; 2) At the same time, please indicate whether other structure objects are involved in the initialization process, and if so, please return the name of the structure object. The generation steps may include: 1) Understanding the role and usage scenario of the structure; 2) Finding the function for initialization from the provided functions; 3) Generate initialization code based on the usage scenario and appropriate function; 4) Determine whether other structure objects are involved from the generated initialization code, and return the name of the structure object.

[0054] The content of the kernel object test code prompt template includes: role setting and task description, initialization code, and related functions. Among them, the role setting and task description can be: please generate C language code for functional testing based on the given initialization code and related function information.

[0055] The content of the kernel object destruction code prompt template includes: role setting and task description, initialization code, test code, and related functions. Among them, the role setting and task description can be: please generate C language code for destroying the target structure object based on the initialization code, test code and related functions.

[0056] The content of the C language to syzProgram prompt template includes: role setting and task description, syzlang language syntax rules, Syz Program syntax rules, syz program examples, generation steps, and test code. Among them, the role setting and task description can be: please generate a syzprogram for the Syzkaller tool to perform kernel fuzz testing based on the information. The generated code should comply with the syntax rules of the syz program, and ensure that the system call functions used are available in the syzkaller tool. The generation steps may include: 1) extracting the system call functions involved in the execution process based on the provided C language code; 2) converting the involved system call functions into the syz program format.

[0057] The error repair template includes: role setting and task description, Syz Program syntax rules, the optional syscall column of the current system in the syzkller tool, the syz program content with errors, and error messages. The role setting and task description can be: 1) The syz program generated by you previously had some problems during the actual test process, and I need you to help me fix these problems so that the generated syz program can run normally; 2) I will provide you with the name of the syscall available in syzkaller, the name of the corresponding system call in Linux, and its input parameters and return values; 3) Repair according to the information provided. If you cannot find a function suitable for the current program repair in the provided list, please be sure to answer "The current function list is not available."

[0058] Step 2.2: The present invention selects a kernel object Based on the system call-kernel object mapping relationship, functions with dependencies are obtained. Kernel objects and functions fill in the kernel object initialization code prompt template to guide LLM to generate its initialization code P ko This initialization code usually covers the setting of object counters, memory allocation, operation definition, and adding kernel objects to the kernel object list to facilitate kernel recycling and other operations.

[0059] Step 2.3: When generating test code, since the life cycle of an object may involve the use of other objects, an iterative approach is used to allow LLM to determine whether other kernel objects not included in the generated code are involved based on the system call sequence currently being generated. If so, it is generated iteratively to generate other system call sequences with dependencies. This ensures that the generated call sequence contains all required prerequisites or other dependent content, ensuring the integrity of the content.

[0060] Specifically, this embodiment is based on the initialization code P ko , locate the source code of the function. Then ask LLM in turn whether these source codes involve other kernel objects. If there are other objects, iteratively execute step 2.2 to continuously discover and initialize new kernel objects. Finally, the present invention may obtain a set of kernel objects containing multiple interdependent kernel objects. If LLM prompts that more kernel objects are needed during the analysis process, the corresponding function source code is found according to the feedback of LLM, and is input into LLM again for analysis.

[0061] Step 2.4: For initialized kernel objects, except for the initialization system call, input the signatures of the remaining related system calls into the kernel object test code prompt template to guide LLM to generate test code for the kernel object. If there are multiple kernel objects, LLM is required to generate test code that can include the dependencies between these objects.

[0062] Step 2.5: After the test code generation is completed, the initialization code and the test code are input into the kernel object destruction code prompt template to guide LLM to generate code for destroying (releasing) these kernel objects to simulate the entire life cycle of the kernel object. In this process, there is no need to explicitly ask LLM to consider dependencies, because random order of destruction operations may trigger UAF (Use-After-Free) type vulnerabilities. The complete test process of each kernel object includes three stages: initialization, testing, and destruction.

[0063] Step 2.6: Repeat the above steps for each kernel object to test. During the test process, you can customize the repeated generation of test code for the kernel object to generate multiple different test sets for the kernel object. All these test code sets will constitute the seed input set of this project.

[0064] For example, the present invention selects the file kernel object for testing. First, the file and its related functions need to be put into the Prompt template together, as shown in the following content:

[0065]

[0066] LLM returns the initialization code of the kernel object and gives a list of functions used in initialization. Based on the returned list, by integrating the function and kernel object association information obtained in the first step, the kernel objects involved in these functions can be queried in the database. If they include kernel objects other than file, you need to add other kernel object information in the prompt to let LLM generate the initialization function of the newly involved kernel object.

[0067]

[0068]

[0069] The above is an example of the result returned by the model, which gives the method for initializing the file structure. As can be seen from the above, it involves structure objects that were not included before, such as "assuming that the dentry and vfsmount of the file have been obtained", so the present invention needs to let LLM supplement this part that is not involved and initialize file_path. Therefore, the present invention needs to add the content of the file_path structure to the prompt and let LLM generate its related code. Repeat this process until there are no new structures involved, and then let LLM generate the test code and destructors corresponding to these structures.

[0070] Step 3: When the test case passes verification, obtain the fuzz testing result of the target operating system based on the test case.

[0071] The system call sequence generated by LLM may contain some problems in terms of standardization or correctness, and the content needs to be further tested and corrected.

[0072] By interacting with LLM to obtain the generated results, the present invention will further process the results in terms of format. Since the Syzkaller tool can only test test cases described in Syzlang language, it is necessary to embed Syzlang syntax as prompt information and test case set into the C language to syzProgram prompt template, so that LLM can generate a test case set that conforms to Syzlang syntax.

[0073] The following is a description of the file operation process under Syzlang syntax, but general test cases will include more other operations. Because the test code generated in step 2 includes many other steps, the generated Szylang code content will also be more.

[0074] r0=openat(0xffffffffffffff9c,&AUTO='. / file1\x00',0x42,0x1ff)

[0075] write(r0,&AUTO="01010101",0x4)

[0076] read(r0,&AUTO="" / 4,0x4)

[0077] close(r0)

[0078] The present invention puts the final result into the initial seed library of Syzkaller, which is loaded and used by the Syzkaller tool. Syzkaller will select a certain amount of initial seed files according to certain rules, such as the available and unavailable system call sets set in the user config file, and convert the file content into a Prog structure for subsequent testing. Syzkaller will convert the test cases written in the Syzlang language into test cases that can be executed in the Linux environment. If an error occurs during the conversion process, the error information and the code where the error occurs will be extracted and filled into the error repair template, and the LLM will correct the content according to the error information, and the repaired content will be put back into the Syzkaller seed library to try to execute again. As in the example below, the write function does not pass in the correct parameter r0, but passes in a string of characters, which will cause an error when the program is running. The wrong parameter information including this code can be written into the prompt template for repair, allowing LLM to generate the repaired content and repeat this step.

[0079] r0=openat(0xffffffffffffff9c,&AUTO='. / file1\x00',0x42,0x1ff)

[0080] write("abc",&AUTO="01010101",0x4)

[0081] read(r0,&AUTO="" / 4,0x4)

[0082] close(r0)

[0083] Syzkaller will randomly select a test case from the seed library and perform a mutation operation. Through the seed library provided by the present invention, the fuzz testing tool can select a wider variety of different test cases and can cover the dependencies between system calls, thereby expanding the scope of fuzz testing and improving the logical depth of kernel code execution in the test.

[0084] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the present disclosure. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof.

Claims

1. A kernel fuzz testing method based on a large language model, characterized in that: The method comprises: Construct the mapping relationship between the target operating system's system calls and kernel objects; Based on the mapping relationship between the system call and the kernel object, a test case is generated by using a large language model; When the test case passes verification, a fuzzy test result of the target operating system is obtained based on the test case.

2. The method according to claim 1, characterized in that: The mapping relationship between the system call and the kernel object of the target operating system is constructed, including: Obtaining a compilation command record in the process of compiling a target operating system kernel, and extracting a .c file and a .h file in the compilation command record as a target file; Convert the code in the target file into an abstract syntax tree, and determine the code structure based on the abstract syntax tree, and obtain function and structure objects by extracting source code defined by functions and structures; Scan the system call sequence, mark the structure objects that meet the characteristics of kernel objects as kernel objects, and generate a mapping relationship between system calls and kernel objects based on the structure objects called or returned by the function; Static pointer analysis is performed on the source code of the kernel object, and the mapping relationship between the system call and the kernel object is updated by obtaining the kernel object indirectly operated by the system call through the pointer.

3. The method according to claim 1, characterized in that Based on the mapping relationship between the system call and the kernel object, a test case is generated using a large language model, including: Selecting a kernel object, and acquiring a function having a dependency relationship based on a mapping relationship between the system call and the kernel object; Fill the kernel object and the functions with dependencies into the kernel object initialization code prompt template, and use the large language model to generate the initialization code of the kernel object, and at the same time ask the large language model whether the initialization code involves other kernel objects; wherein the initialization code covers the setting of the object counter, memory allocation and operation definition; In the case where other kernel objects are involved in the initialization code, the step of filling the kernel object and the function with dependency into the kernel object initialization code prompt template is re-executed based on the other kernel objects to generate a set of kernel objects including a plurality of mutually dependent kernel objects; wherein the kernel objects in the kernel object set are already initialized kernel objects; For the initialized kernel objects, except for the system call that initializes the kernel object, the signature input of the remaining related system calls and the kernel object are embedded into the kernel object test code prompt template, and the test code for the kernel object is generated using the large language model.

4. The method according to claim 3, characterized in that After generating the test code for the kernel object, the method further includes: The initialization code and the test code of the kernel object are embedded into the kernel object destruction code prompt template, and the large language model is used to generate codes for destroying or releasing the initialization code and the test code.

5. The method according to claim 1, characterized in that When the test case passes the verification, obtaining a fuzzy test result of the target operating system based on the test case includes: Embed Syzlang syntax and test cases into the C language to syzProgram prompt template, and use the large language model to generate test cases that conform to Syzlang syntax; Convert the test cases that conform to Syzlang syntax into test cases that can be executed in the Linux environment. If an error occurs during the conversion process, embed the code of the error information into the error repair template, and use the large language model to obtain the test cases that can be executed in the Linux environment. A mutation operation is performed on the test case executable in the Linux environment, and a fuzz test of the target operating system is performed based on the mutation operation result to obtain a fuzz test result of the target operating system.

6. A kernel fuzz testing system based on a large language model, characterized in that: The system comprises: A mapping relationship building module is used to build a mapping relationship between the system call and kernel object of the target operating system; A test case generation module, used to generate test cases based on the mapping relationship between the system call and the kernel object and using a large language model; The fuzzy testing module is used to obtain the fuzzy testing result of the target operating system based on the test case when the test case passes the verification.

7. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the kernel fuzz testing method based on a large language model as described in any one of claims 1-5 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by the processor, the kernel fuzz testing method based on the large language model as described in any one of claims 1 to 5 is implemented.

Images