Automobile electronic control unit fuzzy test method based on partial code coverage rate feedback and computer

Abstract

The invention provides an automobile electronic control unit fuzzy testing method based on partial code coverage rate feedback and a computer, and belongs to the technical field of automobile electronic control unit code testing. The computer performs static analysis on source codes of the automobile electronic control unit, identifies inevitable execution blocks and conditional execution blocks, performs selective instrumentation on the conditional execution blocks, and inserts coverage rate recording instructions of the conditional execution blocks. And the computer source code is loaded into the automobile electronic control unit, and a test input signal is generated through the fuzzy test engine and is injected into the automobile electronic control unit. In the process of executing the program by the automobile electronic control unit, recording the coverage condition of the condition execution block to a bitmap in the memory; the computer reads the coverage rate data of the condition execution block through the debugger every time a complete execution cycle is completed; and the fuzzy test engine adjusts the input generation strategy according to the coverage rate data feedback of the condition execution block and tests again. According to the method, the automobile electronic control unit source code fuzzy test coverage condition is efficiently collected.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of code testing of automobile electronic control unit, and in particular, the present application relates to a fuzzy testing method for automobile electronic control unit based on partial code coverage feedback and a computer. BACKGROUND

[0002] Fuzz testing is a dynamic testing method that discovers software defects and security vulnerabilities by inputting a large amount of random or variant data into a target system. In the traditional IT software field, fuzz testing has achieved remarkable success and has gradually been applied to the safety testing of embedded systems, especially automobile electronic control units (ECU). Directly applying traditional fuzz testing methods to automobile ECU systems faces a series of technical challenges. Unlike general-purpose computer systems, ECU software usually runs on specific real-time operating system platforms such as AUTOSAR, with strict execution cycles and real-time requirements. Although developers usually have the source code of the ECU, the limited storage resources of the ECU make it difficult to apply traditional compilation instrumentation methods, as the size of the instrumented code significantly increases, often exceeding the storage capacity limit of the ECU. In addition, in automobile systems, in order to ensure the determinism and stability of the system, the ECU program usually uses task polling rather than interrupt processing to handle input data, resulting in program execution characteristics that there are a large number of periodically repeated code paths, and only a small part of the code will execute different branches due to different inputs.

[0003] Chinese patent 106874055A provides a method and device for automatic flashing test of automobile ECU program. The automatic flashing method generates a test sequence including all ECU program version switching operations according to the user-provided file to be flashed, then calls the interface to perform ECU program flashing according to the test sequence, and performs ECU diagnosis test before and after flashing, records the flashing and diagnosis results, and generates a flashing report.

[0004] The prior art cannot efficiently collect the fuzzy testing coverage of the source code of the automobile electronic control unit. SUMMARY

[0005] The present application aims to provide a fuzzy testing method for automobile electronic control unit based on partial code coverage feedback and a computer, in order to achieve the technical purpose of efficiently collecting the fuzzy testing coverage of the source code of the automobile electronic control unit.

[0006] In view of the above challenges, the present application provides a fuzzy testing method for automobile electronic control unit based on partial code coverage feedback, the core innovation of which is to combine the execution characteristics of the automobile electronic control unit program, and to use a combination of selective instrumentation and periodic reading by the debugger, without affecting the real-time performance of the system, to effectively collect code coverage information.

[0007] To achieve the above object, the technical scheme adopted by the present application is:

[0008] The present application provides a kind of based on partial code coverage feedback's automobile electronic control unit fuzzy test method:

[0009] Step one: computer is carried out to the source code of automobile electronic control unit static analysis, identifies certain execution block and conditional execution block;

[0010] Step two: computer is selectively inserted to the conditional execution block, inserts the coverage record instruction of conditional execution block;

[0011] Step three: computer compiles the source code of automobile electronic control unit after selectively inserting, and loads into automobile electronic control unit;

[0012] Step four: computer generates test input signal by fuzzy test engine, and is injected into automobile electronic control unit;

[0013] Step five: automobile electronic control unit is in the process of executing program, and records the coverage of conditional execution block to the bitmap in memory;

[0014] Step six: automobile electronic control unit is completed every complete execution cycle, and computer reads the coverage data of conditional execution block by debugger;

[0015] Step seven: fuzzy test engine adjusts input generation strategy according to the coverage data feedback of conditional execution block, and is injected into automobile electronic control unit and tests again.

[0016] In step one, computer constructs the control flow graph of source code by control flow analysis tool, identifies all basic blocks, and then determines certain execution block and conditional execution block for basic block.

[0017] The identification method of certain execution block includes: static path analysis, execution characteristic analysis and task critical path analysis.

[0018] The basic block determined as conditional execution block includes: code block in conditional branch, loop body with variable loop times, exception or error handling path, function module executed only under certain conditions.

[0019] In step two, computer inserts coverage record instruction to conditional execution block, and coverage record instruction is updated when executing a bitmap, record the conditional execution block covered in current execution cycle.

[0020] In step four, the test input signal generated by fuzzy test engine includes network message and sensor signal.

[0021] In step seven, the computer determines whether the current execution triggers a new conditional execution module based on the coverage data, and records the test input signal triggering the new conditional execution module as a valuable seed.

[0022] The computer generates new candidate test input signals by slightly perturbing the high-priority seeds in the valuable seeds based on the mutation strategy of the evolutionary algorithm.

[0023] The coverage-guided algorithm adopted by the fuzzing engine in the computer guides the mutation of the test input signals to be more inclined to those that can expand the coverage of the conditional execution blocks.

[0024] The present application provides a computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method when executing the computer program.

[0025] The technical effects of the present application are:

[0026] (1) The automobile electronic control unit fuzzing test method based on partial code coverage feedback provided by the present application effectively solves the problems of coverage collection and real-time guarantee in automobile electronic control unit fuzzing test by combining the technical means of selective instrumentation and periodic coverage reading. The method fully considers the execution characteristics and resource limitations of automobile electronic control unit programs, and provides a practical and feasible test scheme, which can efficiently find potential security vulnerabilities and functional defects while ensuring system real-time performance.

[0027] (2) The present application does not rely on the tracking function of specific hardware, and avoids the interference of frequent breakpoint operations on the system, thus having wider applicability and higher test efficiency.

[0028] (3) Through the method of the present application, developers and testers can more effectively verify the security and robustness of automobile electronic control units, discover potential risks in a timely manner, and improve the protection measures of the product.

[0029] (4) The selective instrumentation of the present application greatly reduces the size of the instrumented code, solving the problem of insufficient storage space caused by full instrumentation.

[0030] (5) The present application provides a more efficient coverage collection mechanism in combination with the specific execution characteristics of automobile electronic control units. BRIEF DESCRIPTION OF DRAWINGS

[0031] The present specification includes the following drawings, the contents of which are shown as follows:

[0032] Figure 1 The present application is a flowchart of an automobile electronic control unit fuzzing test method based on partial code coverage feedback and a computer. DETAILED DESCRIPTION

[0033] The application provides a fuzzy test method for an automobile electronic control unit based on partial code coverage feedback.

[0034] The application provides a fuzzy test method for an automobile electronic control unit based on partial code coverage feedback.

[0035] Step one: a computer performs static analysis on source code of the automobile electronic control unit to identify certain execution blocks and conditional execution blocks.

[0036] Step two: the computer selectively inserts a coverage recording instruction into the conditional execution block.

[0037] Step three: the computer compiles the source code of the automobile electronic control unit after selective insertion and loads the source code into the automobile electronic control unit.

[0038] Step four: the computer generates a test input signal through a fuzzy test engine and injects the test input signal into the automobile electronic control unit.

[0039] Step five: the automobile electronic control unit records the coverage of the conditional execution block in a bitmap in the memory during the execution of the program.

[0040] Step six: the computer reads the coverage data of the conditional execution block through a debugger after the automobile electronic control unit completes a complete execution cycle.

[0041] Step seven: the fuzzy test engine adjusts the input generation strategy according to the coverage data of the conditional execution block and injects the input into the automobile electronic control unit for retesting.

[0042] In step one, the computer constructs a control flow graph of the source code through a control flow analysis tool, identifies all basic blocks, and then judges the basic blocks as certain execution blocks and conditional execution blocks.

[0043] The identification method of the certain execution block includes static path analysis, execution characteristic analysis and task critical path analysis.

[0044] The basic blocks judged as the conditional execution blocks include code blocks in conditional branches, loop bodies with variable loop times, exception or error processing paths and function modules that are executed only under certain conditions.

[0045] In step two, the computer inserts the coverage recording instruction into the conditional execution block, and the coverage recording instruction updates a bitmap when executed to record the conditional execution blocks that have been covered in the current execution cycle.

[0046] In step four, the test input signal generated by the fuzzy test engine includes a network message and a sensor signal.

[0047] In step seven, the computer determines whether the current execution triggers a new conditional execution module based on the coverage data, and records the test input signal triggering the new conditional execution module as a valuable seed.

[0048] The computer generates new candidate test input signals by slightly perturbing the high-priority seeds in the valuable seeds based on the mutation strategy of the evolutionary algorithm.

[0049] The coverage-guided algorithm used by the fuzzing engine in the computer guides the mutation of the test input signals to be more inclined to those that can expand the coverage of the conditional execution blocks.

[0050] The present application provides a computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0051] The computer performs static analysis on the source code of an automotive electronic control unit (ECU) to identify deterministic execution blocks and conditional execution blocks. The computer constructs a control flow graph (CFG) of the source code using the control flow analysis tool provided in the compiler, identifies all basic blocks, and classifies the basic blocks into deterministic execution blocks and conditional execution blocks. The deterministic execution blocks are code blocks that are always executed in each execution cycle, such as task initialization and periodic state updates. The conditional execution blocks are code blocks that may or may not be executed depending on input data or system state, such as various conditional branch processing logic.

[0052] The identification of deterministic execution blocks is achieved by the following methods:

[0053] (1) Static path analysis: starting from the task entry point, mark the code paths that are unconditionally executed.

[0054] (2) Execution characteristic analysis: based on historical execution records, identify code blocks that are always triggered in multiple executions.

[0055] (3) Task critical path analysis: identify the core function paths that must be executed by the task.

[0056] The basic blocks identified as conditional execution blocks include: code blocks within conditional branches (branches in if-else structures), loop bodies with variable loop times (such as input data-based loops), exception or error handling paths, and function modules that are executed only under certain conditions. Among them, the execution under certain conditions refers to logical judgment of data, environment, and user behavior factors.

[0057] Step two: the computer selectively inserts the coverage recording instructions into the conditional execution blocks. The computer inserts the coverage recording instructions into the conditional execution blocks, which, when executed, update a bitmap that records the conditional execution blocks that have been covered in the current execution cycle. The bitmap is placed in the RAM of the automotive electronic control unit, occupying a small amount of space and having fast access speed, and has little effect on system performance. The coverage recording instructions usually use simple bit operations to set the identification bit corresponding to the conditional execution block in the bitmap of the coverage recording instruction. For example:

[0058] coverage_bitmap[block_id / 8]|=(1<<(block_id%8))

[0059] To further reduce the instrumentation overhead, this module combines the coverage recording of adjacent conditional execution blocks, and can also insert coverage recording instructions at the key branch points of the conditional execution blocks. The present application identifies the blocks that must be executed in each execution cycle in the source code of the automotive electronic control unit through static program analysis technology, and the blocks that must be executed do not need to be instrumented for monitoring. Only the conditional execution blocks that may be conditionally executed due to different inputs are instrumented with coverage recording instructions. This selective instrumentation strategy significantly reduces the total amount of instrumented code, making the size of the instrumented source code controllable and able to adapt to the limitations of the storage resources of the automotive electronic control unit.

[0060] Step three: the computer compiles the source code of the automotive electronic control unit that has been selectively instrumented, and loads it into the automotive electronic control unit.

[0061] Step four: the computer generates test input signals through a fuzz testing engine and injects them into the automotive electronic control unit. The test input signals generated by the fuzz testing engine include network messages and sensor signals. The network messages are CAN or LIN bus messages, which are generated based on the information provided by the vehicle communication matrix definition (such as the DBC file), combined with the standard message ID, data length and signal meaning corresponding to each byte received by the automotive electronic control unit. Two generation methods can be used: one is based on the protocol format, which ensures that the generated message conforms to the basic frame structure and verification rules, and then randomly fills or specifically varies the data content. The other is based on system design information, which generates test messages that are closer to the boundary conditions by using the value range specified in the functional specification for certain messages and signals.

[0062] The test input signal generated by the simulation sensor signal generation test input signal is specifically that the automobile electronic control unit obtains data from the sensor through ADC (analog-to-digital converter) input, digital IO or vehicle network, directly simulates the input of the sensor channel by means of a hardware-in-the-loop test platform (HIL) or an automobile electronic control unit simulation environment, and the specific mode includes: controlling the hardware-in-the-loop test platform to output an analog voltage / current signal to the sensor interface of the automobile electronic control unit, or directly writing the sensor reading register through the automobile electronic control unit calibration interface (such as the XCP protocol).

[0063] The test input signal generated by the fuzzy test engine can read real vehicle data from a pre-collected seed input library for mutation, or can generate data completely randomly. The acquisition of the initial seed depends on the test requirements, and can be a nominal value in a DBC file, vehicle operation data measured by experiments, or a record from a functional test case.

[0064] Step five: In the process of executing the program of the automobile electronic control unit, the coverage of the conditional execution block is recorded to a bitmap in the memory;

[0065] Step six: After the automobile electronic control unit completes a complete execution cycle, the computer reads the coverage data of the conditional execution block through the debugger. Since the automobile electronic control unit adopts task polling instead of interruption to process sensor data and bus data and execute corresponding decision logic, in order to avoid the influence of frequent coverage data transmission on the real-time performance of the automobile electronic control unit, the present application adopts a periodic reading mechanism, and does not immediately report the coverage in each basic block execution, but reads the coverage data of the conditional execution block through the automobile electronic control unit debugging interface (such as JTAG or DAP) once after the automobile electronic control unit completes a complete execution cycle. This batch reading mode minimizes the interference of coverage collection on the execution of the automobile electronic control unit, and ensures that the real-time performance of the key task is not affected.

[0066] Step seven: The fuzzy test engine adjusts the input generation strategy according to the coverage data of the conditional execution block, and injects it into the automobile electronic control unit for retesting. The computer converts the read coverage data into a standard format, compares it with the previous coverage record, and determines whether the new conditional execution module is triggered in this execution. If a new conditional execution module is found, the current test input signal of the automobile electronic control unit is recorded as a valuable seed for subsequent mutation. Subsequently, based on the mutation strategy of the evolutionary algorithm, a new candidate input is generated by slightly disturbing the high-priority seed (test input signal with high coverage gain). Typical mutation operations include: bit flipping, byte insertion / deletion, numerical increase / decrease, recombination of multiple input fragments, etc., to slightly modify the input format to keep it roughly valid, but to try to explore the critical condition.

[0067] The coverage-guided algorithm adopted by the fuzzing engine in the computer guides the mutation of the test input signal to be more inclined to the direction that can expand the coverage of the conditional execution block. The computer converts the read coverage data into a standard format, compares it with the previous coverage data, and judges whether the coverage is rising. If the change of a certain input field has caused the coverage to rise, the algorithm will subsequently attempt to modify this field more frequently; otherwise, the frequency of disturbance to the invalid field will be reduced. This closed-loop evolution process greatly improves the test efficiency and can explore the difficult-to-trigger paths in the source code in a targeted manner. The application realizes the coverage change trend analysis function, identifies the code regions sensitive to specific input fields by monitoring the coverage changes of multiple consecutive executions, and provides more accurate direction guidance for subsequent input generation.

[0068] The technical effects of the application are described in detail below.

[0069] The automobile electronic control unit fuzzing method based on partial code coverage feedback provided by the application effectively solves the problems of coverage collection and real-time guarantee in automobile electronic control unit fuzzing by combining the technical means of selective instrumentation and periodic coverage reading. The method fully considers the execution characteristics and resource limitations of automobile electronic control unit programs and provides a practical and feasible test scheme that can efficiently discover potential security vulnerabilities and functional defects while ensuring system real-time performance.

[0070] The application does not rely on the tracking function of specific hardware and avoids the interference of frequent breakpoint operations on the system, thus having wider applicability and higher test efficiency.

[0071] Through the method of the application, developers and testers can more effectively verify the security and robustness of automobile electronic control units, discover potential risks in a timely manner, and improve the protection measures of the product.

[0072] The selective instrumentation of the application greatly reduces the size of the instrumented code and solves the problem of insufficient storage space caused by full instrumentation.

[0073] The application provides a more efficient coverage collection mechanism in combination with the specific execution characteristics of automobile electronic control units.

[0074] The application has been described above in conjunction with the accompanying drawings. Obviously, the specific implementation of the application is not limited by the above manner. As long as various non-essential improvements are made using the method concept and technical solution of the application, or the above-mentioned concept and technical solution of the application is directly applied to other occasions without improvement, they are all within the protection scope of the application.

Claims

1. A fuzz testing method for an automotive electronic control unit based on partial code coverage feedback, characterized by: Step 1: The computer performs static analysis on the source code of the vehicle's electronic control unit to identify the necessary execution blocks and conditional execution blocks; Step 2: The computer selectively inserts the conditional execution block and inserts the coverage recording instruction of the conditional execution block; Step 3: The computer compiles the source code of the selectively plugged ECU and loads it into the ECU; Step 4: The computer generates a test input signal through the fuzz testing engine and injects it into the vehicle's electronic control unit; Step 5: During the execution of the program, the automotive electronic control unit records the coverage of the conditional execution block into a bitmap in the memory; Step 6: Every time the ECU completes a complete execution cycle, the computer reads the coverage data of the conditional execution block through the debugger; Step 7: The fuzz testing engine adjusts the input generation strategy based on the coverage data feedback of the conditional execution block and injects it into the vehicle's electronic control unit for retesting.

2. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 1, characterized in that: In step 1, the computer uses a control flow analysis tool to construct a control flow graph of the source code, identify all basic blocks, and then determine whether the basic blocks are necessarily executed blocks or conditionally executed blocks.

3. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 2, characterized in that: Methods for identifying inevitable execution blocks include: static path analysis, execution characteristic analysis and mission critical path analysis.

4. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 2, characterized in that: Basic blocks judged as conditional execution blocks include: code blocks within conditional branches, loop bodies with variable loop times, exception or error handling paths, and functional modules that are executed only under specific conditions.

5. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 1, characterized in that: In step 2, the computer inserts coverage recording instructions into the conditional execution blocks. When the coverage recording instructions are executed, a bitmap is updated to record the conditional execution blocks that have been covered in the current execution cycle.

6. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 1, characterized in that: In step 4, the test input signals generated by the fuzzy testing engine include network messages and sensor signals.

7. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 1, characterized in that: In step seven, the computer determines whether the current execution triggers a new conditional execution module through coverage data, and records the test input signal corresponding to the triggering of the new conditional execution module as a valuable seed.

8. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 1 or 7, characterized in that: Based on the mutation strategy of the evolutionary algorithm, the computer slightly perturbs high-priority seeds among valuable seeds to generate new candidate test input signals.

9. The automotive electronic control unit fuzz testing method based on partial code coverage feedback according to claim 1 or 7, characterized in that: The coverage guidance algorithm used by the fuzz testing engine in the computer guides the mutation of the test input signal to be more inclined to those directions that can expand the coverage of the conditional execution block.

10. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images