Knowledge extraction and envelope coverage-oriented software vulnerability test method and related equipment

Abstract

The invention discloses a knowledge extraction and envelope coverage-oriented software vulnerability test method and related equipment, and the method comprises the steps: obtaining vulnerability key information of target software, and obtaining sensitive function features through defect dependence analysis and construction based on the vulnerability key information; performing semantic analysis on the analysis report and the code abstract associated with the sensitive function characteristics, screening to obtain a target sensitive function, performing path envelope reverse tracking on the target sensitive function, and constructing to obtain a target path envelope; and obtaining coverage information enveloped by the target path, and carrying out fuzzy testing on the basis of the coverage information in combination with the iteratively optimized variation sample. According to the method, through intelligent closed loop of analysis-positioning-testing-feedback-optimization, static analysis provides accurate guidance for dynamic testing, and the static analysis strategy is inversely optimized by the result of the dynamic testing, so that the maximum improvement of the testing efficiency and the vulnerability discovery accuracy is realized in limited testing resources, and the testing efficiency and the vulnerability discovery accuracy are improved. The method can be widely applied to the technical field of software security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software security, and in particular to a software vulnerability testing method for knowledge extraction and envelope coverage and related equipment. BACKGROUND

[0002] Open source software has become a core component of modern digital infrastructure, and its transparency and collaboration have accelerated technological innovation while introducing unprecedented security risks. The concealment, complexity of propagation chain, and lag in repair of open source vulnerabilities have become a major challenge in the field of national network security. Researching efficient and accurate open source software vulnerability testing technology not only concerns the security protection of critical information infrastructure, but also is a strategic requirement for building a self-controllable software supply chain.

[0003] Software vulnerability mining technology is the focus of open source software security research, mainly divided into static analysis and dynamic analysis technology. Static analysis technology does not need to execute the program, and identifies potential vulnerability patterns through rule matching, data flow and control flow analysis on the source code. The core challenge is that due to the lack of context information of the actual running of the program, it is difficult to accurately judge the real vulnerability state under complex control flow or data flow, resulting in a high false positive rate; at the same time, for vulnerability patterns involving deep logic semantics (such as complex conditional judgment, polymorphic behavior), the accuracy of their understanding and analysis also faces great difficulties. Dynamic analysis technology verifies the existence of vulnerabilities by actually executing the program and capturing function calls, variable states, memory operations and other context information in runtime. The core challenge is that due to the combinatorial explosion characteristics of program execution paths and the finiteness of test resources (time, computing power), it is difficult to achieve high code / state coverage in a limited test period, especially difficult to effectively touch deep or conditionally demanding code branches. SUMMARY

[0004] The main purpose of the embodiments of the present application is to propose a software vulnerability testing method and device for knowledge extraction and envelope coverage, electronic equipment, storage medium and program product, aiming at solving at least one problem of the prior art.

[0005] To achieve the above-mentioned purpose, one aspect of an embodiment of the present application proposes a software vulnerability testing method for knowledge extraction and envelope coverage, the method comprising: obtaining vulnerability key information of a target software, and constructing sensitive function features based on the vulnerability key information through defect dependency analysis; The semantic analysis is performed on the analysis report and the code summary of the sensitive function feature association, the target sensitive function is screened, the path envelope reverse tracking is performed on the target sensitive function, and the target path envelope is constructed. The coverage information of the target path envelope is acquired, and the fuzz testing is performed based on the coverage information and the mutation sample of iterative optimization.

[0006] In some embodiments, the vulnerability key information of the target software is acquired, including the following steps: The vulnerability information of the target software is acquired; wherein the sources of the vulnerability information include a vulnerability database, a vulnerability report, a patch description, a technical blog and a security announcement; The data cleaning and standardization processing are performed on the vulnerability information, and the vulnerability description is obtained; The function code fragment related to the vulnerability triggering is extracted based on the function call information of the code space of the target software; The vulnerability description and the function code fragment are associated and combined into the vulnerability key information.

[0007] In some embodiments, the sensitive function feature is constructed based on the vulnerability key information through defect dependency analysis, including the following steps: The triggering and influencing situations between different vulnerabilities in the target software are analyzed based on the vulnerability key information corresponding to each vulnerability, and then the defect dependency relationship is constructed; The potential vulnerability mode and feature of the target software are sorted based on the defect dependency relationship and the key code fragment corresponding to the vulnerability triggering, and then the sensitive function feature model is established to determine the sensitive function feature.

[0008] In some embodiments, the semantic analysis is performed on the analysis report and the code summary of the sensitive function feature association, the target sensitive function is screened, including the following steps: Based on the sensitive function feature, the static analysis tool is used to perform error detection on the target software, and an analysis report is generated; The analysis report is split into a single warning, the format of each type of error information corresponding to each warning is uniformly coded, and then the warning level is sorted, and the preliminary sensitive function is extracted based on the sorting result of the warning level; The code summary of the preliminary sensitive function is generated by using the program dependency analysis technology; The uniformly coded result and the code summary are input as prompt word instructions, the semantic analysis is performed by using a large language model, and the target sensitive function is screened.

[0009] In some embodiments, the path envelope reverse tracking is performed on the target sensitive function, and the target path envelope is constructed, including the following steps: Based on the function characteristics corresponding to the target sensitive function, program control dependencies and data dependencies are identified using a static value flow analysis method, and a program inter-control flow graph oriented by the target sensitive function is constructed. Based on the program inter-control flow graph, the target sensitive function is marked as a pollution sink point, and the pollution source is traced back based on the pollution sink point to construct a target path envelope.

[0010] In some embodiments, obtaining the coverage information of the target path envelope includes the following steps: Based on the source code of the target software, the envelope basic block corresponding to the target path envelope in the target software is marked; Based on the envelope basic block, the target software is instrumented to obtain the coverage information.

[0011] In some embodiments, based on the coverage information, the mutation sample is iteratively optimized and the fuzz testing is performed, including the following steps: Obtain an initial sample set, and use the initial sample set as an input sample; Using the coverage information and the input sample, the fuzz testing is performed to obtain a vulnerability result and a high-quality sample; Based on the high-quality sample, its corresponding coverage function sequence and the function call structure of the target software, a prompt word is generated using a prompt word engineering; Based on the prompt word, a chain of thinking and a few sample learning technique are used to guide a large language model to generate a mutation sample; The mutation sample is used as an input sample, and the step of performing fuzz testing using the coverage information and the input sample is returned until the path envelope coverage rate of the fuzz testing reaches a preset requirement.

[0012] To achieve the above purpose, another aspect of the embodiment of the present application proposes a software vulnerability testing device for knowledge extraction and envelope coverage, the device comprising: A data acquisition module is configured to acquire vulnerability key information of a target software, and based on the vulnerability key information, sensitive function characteristics are constructed through defect dependency analysis; A path envelope module is configured to perform semantic analysis on an analysis report and a code summary associated with the sensitive function characteristics, filter a target sensitive function, perform path envelope reverse tracking on the target sensitive function, and construct a target path envelope; A fuzz testing module is configured to obtain coverage information of the target path envelope, and perform fuzz testing based on the coverage information and an iteratively optimized mutation sample.

[0013] To achieve the above purpose, another aspect of the embodiment of the present application proposes an electronic device, which comprises a memory and a processor, the memory stores a computer program, and the processor implements the preceding method when executing the computer program.

[0014] To achieve the above object, another aspect of the embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the foregoing method.

[0015] To achieve the above object, another aspect of the embodiment of the present application provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the foregoing method.

[0016] The embodiment of the present application at least has the following beneficial effects: the present application provides a software vulnerability testing method, device, electronic equipment, storage medium and program product facing knowledge extraction and envelope coverage, the scheme obtains the vulnerability key information of the target software, and the sensitive function characteristics are constructed based on the vulnerability key information through defect dependency analysis; the analysis report and the code summary associated with the sensitive function characteristics are subjected to semantic analysis, and the target sensitive function is screened; the target path envelope is constructed by performing path envelope reverse tracking on the target sensitive function; the coverage information of the target path envelope is obtained, and the fuzzy testing is performed based on the coverage information combined with the iterative optimization of the mutation sample. The embodiment of the present application screens the target sensitive function through “defect dependency analysis” and “semantic analysis”, and constructs the path envelope, so that the test resources are concentrated in the code region where the real vulnerability is most likely to exist, the large number of irrelevant alarms generated by static analysis is effectively filtered, and the problem of high false alarm rate of traditional static analysis is fundamentally reduced. In addition, the key code region that needs to be covered is defined through “path envelope reverse tracking” in the embodiment of the present application, and the iterative optimization of the mutation sample is used for directional fuzzy testing, so that the test process preferentially explores these high-risk paths, and the defects of low coverage and difficulty in triggering deep branches caused by blindness of traditional fuzzy testing are overcome. Specifically, the method of the embodiment of the present application is not simply connected in series with static and dynamic analysis, but forms an intelligent closed loop of “analysis-positioning-testing-feedback-optimization”. The static analysis provides accurate guidance for dynamic testing, and the result of dynamic testing optimizes the strategy of static analysis, so that the test efficiency and the accuracy of vulnerability discovery are maximized in the limited test resources. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is an implementation environment schematic diagram of the software vulnerability testing method facing knowledge extraction and envelope coverage provided by the embodiment of the present application; Figure 2 is a flow schematic diagram of the software vulnerability testing method facing knowledge extraction and envelope coverage provided by the embodiment of the present application; Figure 3 is a whole flow schematic diagram of the software vulnerability testing method facing knowledge extraction and envelope coverage provided by the embodiment of the present application; Figure 4is a schematic diagram of the architecture principle of the sensitive function feature meticulous review method provided by the embodiment of the present application; Figure 5 is a schematic diagram of the architecture principle of the envelope construction method based on sensitive functions provided by the embodiment of the present application; Figure 6 is a schematic diagram of the architecture principle of the advanced fuzz testing method based on path envelope coverage provided by the embodiment of the present application; Figure 7 is a structural schematic diagram of the software vulnerability testing device for knowledge extraction and envelope coverage provided by the embodiment of the present application; Figure 8 is a structural schematic diagram of an electronic device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the objects, technical solutions and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application. When the following description relates to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementation described in the following exemplary embodiments does not represent all the implementations consistent with the embodiments of the present application, but is only an example of devices and methods consistent with some aspects of the embodiments of the present application as described in the appended claims.

[0019] It can be understood that the terms "first", "second", and the like used in the present application can be used herein to describe various concepts, but unless specifically stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determining".

[0020] The terms "at least one", "multiple", "each", "any" and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0022] In the related art, due to the lack of context information of actual running of a program, it is difficult to accurately determine the real vulnerability state under a complex control flow or data flow, resulting in a high false positive rate; meanwhile, for a vulnerability mode involving deep logic semantics (such as complex condition judgment, polymorphic behavior), the accuracy of understanding and analysis thereof also faces great difficulties. Dynamic analysis technology verifies the vulnerability existence by actually executing a program to capture context information such as function call, variable state, and memory operation at runtime. In addition, due to the combinatorial explosion characteristics of program execution paths and the finiteness of test resources (time, computing power), it is difficult to achieve high code / state coverage in a limited test period, especially to effectively touch deep or conditionally demanding code branches.

[0023] Therefore, in the embodiments of the present application, a software vulnerability testing method and related equipment are provided. The method comprises the following steps: obtaining vulnerability key information of target software; constructing sensitive function features based on the vulnerability key information through defect dependency analysis; performing semantic analysis on analysis reports and code abstracts associated with the sensitive function features to filter target sensitive functions; performing path envelope reverse tracking on the target sensitive functions to construct target path envelopes; obtaining coverage information of the target path envelopes; and performing fuzzy testing based on the coverage information and iterative optimization of mutation samples. The embodiments of the present application filter the target sensitive functions through defect dependency analysis and semantic analysis, and construct path envelopes, thereby concentrating test resources on code regions most likely to have real vulnerabilities, effectively filtering a large number of irrelevant alarms generated by static analysis, and fundamentally reducing the high false positive rate of traditional static analysis. In addition, the embodiments of the present application clearly define key code regions that need to be covered through path envelope reverse tracking, and perform directional fuzzy testing using iterative optimization of mutation samples, thereby guiding the test process to preferentially explore these high-risk paths, overcoming the low coverage and difficulty in triggering deep branches caused by blindness of traditional fuzzy testing. Specifically, the method of the embodiments of the present application is not simply a series connection of static and dynamic analysis, but forms an intelligent closed loop of analysis-positioning-testing-feedback-optimization. Static analysis provides accurate guidance for dynamic testing, and the results of dynamic testing in turn optimize the strategy of static analysis, thereby maximizing the improvement of test efficiency and vulnerability discovery accuracy within limited test resources.

[0024] It can be understood that the software vulnerability testing method for knowledge extraction and envelope coverage provided by the present application can be applied to any computer device with data processing and calculation capability, and the computer device can be various terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, CDN (Content Delivery Network), and big data and artificial intelligence platform. Alternatively, the terminal is a smart phone, a tablet computer, a notebook computer, a desktop computer, and the like, but is not limited thereto.

[0025] As shown in Figure 1 , it is an implementation environment schematic diagram provided by the embodiment of the present application. Referring to Figure 1 , the implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected through wireless or wired network to complete data transmission and exchange.

[0026] The server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, CDN (Content Delivery Network), and big data and artificial intelligence platform.

[0027] In addition, the server 101 can also be a node server in a blockchain network. The blockchain is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.

[0028] The terminal 102 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, and the like, but is not limited thereto. The terminal 102 and the server 101 can be directly or indirectly connected through wired or wireless communication, and the embodiment of the present application does not limit this.

[0029] Exemplarily, based on Figure 1In the illustrated implementation environment, the embodiment of the present application provides a software vulnerability testing method facing knowledge extraction and envelope coverage. The following takes the application of the software vulnerability testing method facing knowledge extraction and envelope coverage in the server 101 as an example for description. It can be understood that the software vulnerability testing method facing knowledge extraction and envelope coverage can also be applied in the terminal 102.

[0030] Referring to Figure 2 , Figure 2 is an optional flowchart of the software vulnerability testing method facing knowledge extraction and envelope coverage provided by the embodiment of the present application. The execution subject of the software vulnerability testing method facing knowledge extraction and envelope coverage can be any one of the computer devices (including servers or terminals) described above. Figure 2 The method in the embodiment can include but is not limited to steps S100 to S300.

[0031] In step S100, the vulnerability key information of the target software is acquired, and the sensitive function features are constructed through defect dependency analysis based on the vulnerability key information. It should be noted that in some embodiments, the acquisition of the vulnerability key information of the target software can include the following steps: acquiring the vulnerability information of the target software; wherein the sources of the vulnerability information include vulnerability databases, vulnerability reports, patch descriptions, technical blogs and security announcements; performing data cleaning and standardization processing on the vulnerability information to obtain vulnerability descriptions; extracting the function code fragments related to vulnerability triggering based on the function call information of the code space of the target software; and combining the vulnerability descriptions and the function code fragments into vulnerability key information.

[0032] Exemplarily, in some specific embodiments, for the target software, all historical vulnerability information can be crawled from information sources such as NVD (National Vulnerability Database), GitHub Issue tracker and its official security announcements, etc. Then, the crawled text is cleaned (such as removing irrelevant characters, unifying date formats, etc.) using scripts, and structured “vulnerability descriptions” (such as “CVE-2023-XXXX: libfoo 1.2.3 has a heap buffer overflow vulnerability in the parse_xml function when parsing a specific format of XML file”) are extracted. At the same time, all functions and their call relationships in the libfoo code are extracted through source code analysis tools (such as CTAGS, SCITools Understand), and the code fragment of the parse_xml function is located. Finally, the “vulnerability description” is associated with the “parse_xml function code fragment” to form a complete “vulnerability key information”.

[0033] Specifically, the embodiment of the present application defines the composition and acquisition method of the "vulnerability key information". By integrating multiple source heterogeneous vulnerability information (vulnerability database, report, patch, etc.) and associating with the actual "function code segment", a high-quality, structured knowledge base is formed. This ensures the comprehensiveness and accuracy of the subsequent "defect dependency analysis" and "sensitive function feature" construction, provides a reliable data foundation for the entire technical solution, and avoids the initial direction error caused by information loss or inaccuracy.

[0034] It should be noted that in some embodiments, the sensitive function feature is constructed based on the vulnerability key information through defect dependency analysis, which can include the following steps: based on the analysis of each vulnerability corresponding to the vulnerability key information, the triggering and influencing situation between different vulnerabilities in the target software is obtained, and then the defect dependency relationship is constructed; based on the defect dependency relationship and the key code segment triggered by the corresponding vulnerability, the potential vulnerability mode and feature of the target software are sorted out, and then the sensitive function feature model is established to determine the sensitive function feature.

[0035] Illustratively, in some specific embodiments, for example, it is found through analysis that multiple vulnerabilities in the target software are related to the parse_xml function processing untrusted input data. Further analysis shows that the occurrence of vulnerability C (integer overflow) will calculate the wrong memory allocation size, and then cause vulnerability D (heap overflow) to be triggered, which constructs a "defect dependency relationship". Based on this, the "potential vulnerability mode" that "the software has a universal defect in checking the length of input data" can be summarized, and the "sensitive function feature model" is established: functions that are used to process external input data and involve memory allocation operations should be listed as highly sensitive functions.

[0036] Specifically, the embodiment of the present application defines how to extract reusable knowledge models ("sensitive function features") from vulnerability information. By analyzing the "defect dependency relationship" (such as whether the triggering of vulnerability A will create conditions for vulnerability B), the chain reaction and root cause between vulnerabilities can be understood, and more general "potential vulnerability mode and feature" can be extracted. This makes the system not only able to discover variants of known vulnerabilities, but also has a certain unknown vulnerability mining capability, enhancing the universality and forward-looking of the scheme.

[0037] In step S200, the analysis report and code summary associated with the sensitive function feature are subjected to semantic analysis, and the target sensitive function is screened out. The target sensitive function is subjected to path envelope reverse tracking, and the target path envelope is constructed. It should be noted that in some embodiments, the semantic analysis of the analysis report and the code summary associated with the sensitive function features screens the target sensitive function, which can include the following steps: based on the sensitive function features, using a static analysis tool to detect errors in the target software, and generating an analysis report; split the analysis report into a single warning, uniformly encode the format of each type of error information corresponding to each warning, and then sort the warning levels, and extract the preliminary sensitive function based on the result of the warning level sorting; using program dependency analysis technology to generate a code summary of the preliminary sensitive function; the uniformly encoded result and the code summary are used as prompt word instructions, and a large language model is used for semantic analysis to screen the target sensitive function.

[0038] Exemplarily, in some specific embodiments, a static analysis tool (such as Clang Static Analyzer) is used to scan the target software to generate an analysis report containing 200 warnings. These warnings are split into independent entries, and their types, locations, severity, etc. are uniformly encoded into JSON format. From them, 20 high-level warnings related to memory operations are selected to obtain the corresponding “preliminary sensitive function” name (such as handle_data). Subsequently, the code summary of the handle_data function (including its parameters, key variables, core loops and conditional judgment statements) is generated by program slicing technology. Then, the following prompt word input LLM (such as GPT-4 or CodeLlama) is constructed, for example: “You are a security expert. Please analyze the following static analysis warnings and code summaries. Warning information (JSON format): {...}. Related function code summary:... Is there a real high-risk vulnerability in this function? Please give a ‘yes’ or ‘no’ conclusion and a brief reason.” Finally, according to the analysis result of the LLM, 5 target sensitive functions judged as high-risk are selected from the 20 preliminary functions.

[0039] Specifically, the embodiments of the present application innovatively introduce a large language model (LLM) for intelligent semantic analysis to solve the problem that traditional static analysis tools are difficult to judge complex warnings. By inputting the uniform warning encoding and code summary as prompt words into the LLM, using the powerful code understanding and logical reasoning ability of the LLM, the accuracy of screening and distinguishing static analysis warnings is greatly improved, which can effectively distinguish the “target sensitive function” that really needs to be tested from the code pattern that may be harmless (i.e. false positives), which is a key step to overcome the core challenge of static analysis.

[0040] It should be noted that in some embodiments, the target path envelope is constructed by performing path envelope reverse tracking on the target sensitive function, which can include the following steps: based on the function characteristics corresponding to the target sensitive function, program control dependencies and data dependencies are identified using a static value flow analysis method, and then a program inter-control flow graph guided by the target sensitive function is constructed; based on the program inter-control flow graph, the target sensitive function is marked as a point of pollution convergence, and a pollution source is reverse tracked based on the point of pollution convergence to construct the target path envelope.

[0041] For example, in some specific embodiments, it is determined that the memcpy call in the parse_xml function is a target sensitive function (a point of pollution convergence). A static value flow analysis tool (such as Phasar) is used to analyze the source code of the target software to construct an inter-procedural control flow graph (ICFG) thereof. Then, starting from the memcpy point, it is analyzed in reverse which data (pollution) will be transmitted to this point, and which control conditions (if, switch, etc.) affect these data. All basic blocks (Basic Blocks) and edges (Edges) passed through in this process jointly constitute a “target path envelope”, which represents a set of potential pollution paths from the input point to the vulnerability point.

[0042] Specifically, the embodiments of the present application define how to expand the screened sensitive function points into testable code paths (“target path envelope”). Through the “path envelope reverse tracking” technology, all code paths and input sources that can affect the vulnerability trigger point (point of pollution convergence) are marked in reverse from the vulnerability trigger point. This provides an extremely accurate “map” for subsequent fuzz testing, so that the mutation and generation of test cases are no longer blind, but targeted exploration towards these key paths, directly addressing the core problem of low dynamic test coverage.

[0043] In step S300, the coverage information of the target path envelope is obtained, and the fuzz testing is performed based on the coverage information and the mutation sample optimized iteratively. It should be noted that in some embodiments, the coverage information of the target path envelope can be obtained by the following steps: based on the source code of the target software, the envelope basic blocks corresponding to the target path envelope in the target software are marked; and the target software is instrumented based on the envelope basic blocks to obtain the coverage information.

[0044] Exemplarily, in some specific embodiments, when compiling the source code of the target software, a patching tool (such as the patching module of AFL++) can be used. The tool reads the previously marked "envelope basic block" list (a file containing the addresses of these basic blocks), and then only inserts additional code into these specific basic blocks during the compilation process. The function of these inserted codes is very simple: when the program runs, if it executes a certain marked basic block, a bit in a shared memory mapping is marked. In this way, the fuzzer can efficiently know which parts of the "target path envelope" are covered by the current test input, that is, obtain the "coverage information", by checking the bitmap.

[0045] Specifically, the embodiment of the present application provides a specific means for runtime monitoring of the "target path envelope". By inserting detection code (patching) only at the key "envelope basic blocks", rather than full program patching, the performance overhead of fuzz testing is greatly reduced. This makes the test process execute more iterations more quickly, improving the test efficiency. At the same time, it accurately collects "coverage information", providing key data for evaluating test progress and guiding subsequent test direction.

[0046] It should be noted that in some embodiments, the fuzz testing based on the coverage information and the variation sample optimized by iteration can include the following steps: obtaining an initial sample set, taking the initial sample set as an input sample; performing fuzz testing using the coverage information and the input sample to obtain a vulnerability result and a high-quality sample; generating a prompt word based on the high-quality sample, the corresponding coverage function sequence and the function call structure of the target software; generating a variation sample based on the prompt word using chain thinking and few-shot learning technology to guide a large language model; taking the variation sample as an input sample, returning to the step of performing fuzz testing using the coverage information and the input sample until the path envelope coverage rate of the fuzz testing reaches a preset requirement.

[0047] Exemplarily, in some specific embodiments, the fuzz testing finds that an input sample input_A can cover 30% of the basic blocks in the target path envelope. The sample triggers the function call sequence read_input→parse_header→parse_xml. This is a "high-quality sample". Based on this, a prompt word is constructed for the LLM: "You are a test case generator. The target program receives a custom data format. The data structure of the input sample is as follows: [description of structure]. It is known that the sample successfully calls the function sequence: read_input -> parse_header -> parse_xml. The current sample in hexadecimal is: {input_A_hex}. Please analyze and generate a new variant sample with the following requirements: 1. Maintain the overall structure validity; 2. Try to modify the length field in parse_header to a larger value to trigger deeper processing logic in the parse_xml function. Please output the modified hexadecimal data directly." The LLM generates a new, structurally valid sample input_A_variant according to the requirements. The fuzzer adds this sample to the test queue, and the next iteration uses this sample for testing, making it more likely to explore previously unexplored paths.

[0048] Specifically, the embodiments of the present application again introduce a large language model (LLM) as an intelligent generator of test cases. Using the "high-quality sample" and "covered function sequence" information from fuzzing feedback, through carefully designed prompt engineering, the LLM is guided to understand the code logic and test state, thereby generating "variant samples" that can explore deeper branches. This method combines the creativity of LLMs with real-time feedback from programs, breaking through the randomness limitations of traditional mutation strategies (such as bit flipping), and automatically generating syntax and semantically valid inputs to efficiently trigger deep code branches that require complex conditions to enter, ultimately improving path envelope coverage.

[0049] To explain the principles of the technical solutions of the present application, the overall process of the present application will be described below in conjunction with some specific embodiments. It is easy to understand that the following is an explanation of the technical principles of the present application and cannot be regarded as a limitation of the present application.

[0050] First of all, it needs to be pointed out that the importance of focusing on open source software vulnerabilities is confirmed in many major security incidents. For example, the Log4j vulnerability (CVE-2021-44228) exposed the disastrous consequences of the cascading risk of open source components. According to statistics, there are more than 35863 open source software Java components dependent on Log4j, and attackers can directly threaten the security of critical data by exploiting this vulnerability to invade the system. In addition, the Orbit Chain cross-chain bridge was attacked due to a permission management vulnerability, resulting in a loss of 8000 million dollars, highlighting the cost of the lack of contract code testing in large-scale blockchain security incidents. In addition, the Jenkins Git Parameter plugin vulnerability (CVE-2025-53652) was upgraded from a "moderate threat" to a remote code execution (RCE) high-risk vulnerability, resulting in more than 15000 unauthorized servers facing the risk of complete loss of control.

[0051] Vulnerability testing on open source software, actively discovering open source software vulnerabilities and repairing, is one of the important ways to ensure the security of open source software. In recent years, researchers have made great progress in vulnerability testing of open source software. According to whether the standard of open source software needs to run, the front research can be divided into static analysis technology and dynamic analysis technology.

[0052] Static analysis technology is a kind of software tool used to analyze the quality, structure and potential defects of code without executing the program. Its advantages are that it can help developers find potential errors, coding specification problems and performance bottlenecks when writing code, thereby improving code quality and development efficiency; its disadvantage is that it cannot obtain real-time running information of the program, so it will produce a large number of false positives. In order to reduce the false positive rate of static analysis, the current research on static analysis technology for open source software mainly includes static analysis tool integration and warning classification.

[0053] In the research context of static analysis tool integration, some technologies propose a meta-tool architecture with unified defect mode specification and priority strategy as the core: through the Dispatcher-Merger framework, the results of FindBugs, PMD and Jlint are merged in XML unified format, and the results are sorted according to the defect category and multi-tool cross-validation, which significantly improves the review efficiency; some technologies build an ISA prototype system, which uses a six-tuple unified intermediate representation to weight data fusion and threshold filtering of Rats, Its4, Flawfinder and other static tools output; some technologies build a 16-dimensional feature model based on Java / C++ code, and fuse and sort the warnings of FindBugs / PMD and Cppcheck / Understand at file granularity; experimental results verify the effectiveness of data fusion and statistical sorting in reducing review cost; some technologies based on Juliet test set and real open source / closed source code, systematically evaluate the ability difference of current mainstream static analysis tools, and propose to use naive Bayes, decision tree and other machine learning algorithms to perform "true / false" binary classification on the simple fusion results of multiple tools, while maintaining the recall rate basically unchanged, improving the accuracy of static analysis.

[0054] In the research progress of static analysis tool warning classification, some techniques first proposed and verified 14 core false positive patterns and their 27 variants by systematically analyzing Juliet C / C++ test suite, covering typical scenarios such as conditional memory leak, file close virtual method, etc. The research adopts the method of code reduction, hierarchical cataloging combined with vendor feedback, and proves that these patterns have high consistency among open source and commercial tools, providing a reusable structured basis for warning classification. Some techniques extract 21 function-level complexity and coupling metrics based on the SCATE framework, combined with SMOTE and CFS feature selection, systematically compare four types of models including SVM, KNN, Random Forests and RIPPER on 7508 test data covering 7 CWEs. The experimental results show that Random Forests significantly outperforms other algorithms with 83%–98% F-measure, and confirms that complexity and coupling indicators have a decisive impact on false positives / false negatives.

[0055] Dynamic analysis techniques detect and evaluate code for vulnerabilities by executing programs at runtime. It uses various techniques to capture data during program execution, including function calls, variable values, memory usage, etc., which can be used to identify and fix errors in programs, optimize program performance, and improve code quality. The disadvantage is that it is difficult to balance runtime consumption and coverage. To solve this problem, current research on dynamic analysis techniques for open source software mainly focuses on directed fuzz testing.

[0056] Directed Grey-box Fuzzing (DGF) of open source software has made significant progress in method innovation and tool implementation. Some technologies propose LeoFuzz for multi-target scenarios, which coordinates adaptive exploration-exploitation phases and multi-target energy scheduling, solves the trade-off between local and global optimization for traditional DGF, and reproduces 31 CVEs and discovers 23 new vulnerabilities in seven real programs. Some technologies introduce history execution sample driven dynamic invariant reasoning, propose the Halo framework, and increase the reachable input ratio from 5% to 43%, achieving a 15.3x speedup in vulnerability reproduction on the Magma benchmark. Some technologies build a virtual environment (VEE) based on deep neural networks, combine reinforcement learning model (RLF) and multi-element particle swarm optimization (MPSO), and propose DeepGo, which can speed up 3.23x on average compared to AFLGo and other tools on 100 target points. Some technologies use large language models (LLM) to generate targeted initial seeds, propose ISC4DGF, reduce the number of attempts required to trigger target vulnerabilities by 616x, improve overall speed by 35.63x, and significantly reduce search space. Some technologies propose Lyso, which first implements multi-target and multi-step static analysis result verification, and through key step disassembly and overlap-depth-distance measurement, it speeds up by an average of 12.17x on eight comparison tools and discovers 18 new vulnerabilities in four real programs.

[0057] However, existing open source software vulnerability mining technologies generally have low efficiency, insufficient coverage, and limited automation, especially in the aspects of relying on expert experience to construct test cases, difficulty in accurately and efficiently covering key vulnerability paths, and lack of intelligence in sample mutation strategies. Therefore, as shown in the background art, the present application provides a software vulnerability testing method for knowledge extraction and envelope coverage, which can be implemented through the following process: Figure 3 S1: The detailed review method of sensitive function features mainly includes two modules of vulnerability information extraction and sensitive function feature construction. First, the vulnerability information extraction technology based on text and code analysis is implemented to extract the key information of the vulnerability as the basis for constructing the sensitive function feature model. Then, the sensitive function feature construction technology based on defect association is implemented to capture and analyze the defect association and extract the vulnerability pattern to construct a comprehensive and accurate sensitive function feature model. As shown in the background art, the following can be implemented: Figure 4 ​​S11: Multi-source vulnerability information extraction technology: vulnerability information extraction technology based on text and code analysis, which obtains vulnerability information from sources such as vulnerability databases (such as CVE, NVD), vulnerability reports, patch descriptions, technical blogs, and security announcements. The collected vulnerability information is cleaned and standardized to obtain a standardized vulnerability description, including vulnerability type, target software, and impact range. The function call information of the code space of the target software is analyzed to extract the function code fragments related to vulnerability triggering, which are combined with the standardized vulnerability description to form vulnerability key information, providing support for constructing sensitive function features.

[0058] S12: Sensitive function feature construction technology: based on defect association, the vulnerability key information obtained in the previous step is used to analyze whether there is a vulnerability impact triggering another vulnerability in the target software, thereby constructing a defect dependency relationship. By recording and analyzing the defect dependency relationship, combined with the key code fragments of vulnerability triggering, potential vulnerability patterns and features in the software are obtained, and a sensitive function feature model is established.

[0059] S2: The envelope construction method based on sensitive functions mainly involves two parts: sensitive function detection technology assisted by large language models and path envelope reverse tracking strategy guided by sensitive functions. First, static analysis tools are used to perform static analysis on open source software and produce reports, and program dependency analysis techniques are used to obtain a simplified code summary related to each vulnerability warning trigger. Then, the code summary and static analysis are fused as input to the large language model, and the semantic analysis capabilities of the large language model are used to filter out sensitive function warnings that can actually trigger vulnerabilities. Finally, using taint analysis techniques, a path envelope of sensitive functions is constructed based on the route from the sensitive function design to the program execution entry point. As shown in Figure 5 , the following can be implemented: S21: Large language model assisted sensitive function detection technology: static analysis tools are used to detect errors in specific software and produce analysis reports, which are split into individual warnings. According to the format of error type, description, error location, and other related data, uniform coding is performed, and warning level sorting is implemented to achieve preliminary extraction of sensitive functions. Program dependency analysis techniques are used to generate the most simplified code summary about sensitive functions. Combined with the uniformly coded static analysis report and the simplified code summary as prompt word instructions, the large language model is guided to provide reasonable explanations and accurate conclusions for the report, achieving accurate extraction of sensitive functions for programs.

[0060] S22: Sensitive function oriented path envelope reverse tracking strategy: develop a static value flow analysis method, combine the function name, function line, and file directory location of the sensitive function, and statically identify program control dependence and data dependence to achieve sensitive function oriented program control flow chart construction; study the pollution analysis technology, mark the sensitive function as a pollution sink, and based on the pollution sink, track the pollution source in reverse to achieve the construction of the path envelope from the sensitive function to the program execution entry.

[0061] S3: Advanced fuzzing method based on path envelope coverage mainly includes two modules of path envelope coverage information acquisition and sample mutation based on large language model. The path envelope coverage information acquisition module identifies and inserts a stub for a specific basic block, provides the fuzzing engine with the coverage information of the sample on the sensitive function path envelope, guides the seed selection link of the fuzzing process, and guides the fuzzing engine to generate a sample that can hit and trigger the sensitive function exception; the coverage guided fuzzing test often falls into a bottleneck period after a long time of running, in order to generate a sample that can break through the bottleneck period and cover a new path envelope, the sample mutation module based on the large language model accepts the sample that can hit the sensitive function output by the fuzzing engine, combines the function sequence actually executed by the sample and the function call graph of the whole program under test (i.e. the target software), and uses the large language model to generate a mutated sample as a new sample for the fuzzing engine. As shown in Figure 6 , the following can be implemented: S31: Path envelope coverage information acquisition: develop envelope basic block identification technology, analyze the source code of the program under test based on the extracted path envelope, and achieve the labeling of the envelope basic block in the program under test. Develop envelope basic block coverage rate acquisition technology, insert a stub into the program under test based on the labeled envelope basic block, and achieve the acquisition of the envelope basic block coverage information of the sample in the fuzzing process. Design a method for identifying key basic blocks on the path envelope, analyze the path envelope by combining the dominance tree and other technologies, and achieve the labeling of the key basic blocks in the envelope basic block. Research sample execution path acquisition technology, calculate the specific path of the sample coverage envelope based on the key basic block, and achieve fine-grained acquisition of the sample envelope coverage information.

[0062] S32: Sample mutation based on large language model: develop high-quality sample extraction technology, select samples that are more likely to generate new path envelope coverage through large language model mutation based on the sample set generated by the fuzzing engine that can hit the sensitive function, and provide input for the mutation link. Research the implementation method of the prompt word engineering, design the prompt word to make the large language model understand the function call structure (i.e. the function call graph) of the program under test and the function sequence covered by the high-quality sample, use chain thinking and few-shot learning technologies, guide the large language model to generate a sample that covers a new path envelope, and help the fuzzing engine improve the path envelope coverage rate.

[0063] In summary, the present application aims to provide precise knowledge guidance for vulnerability mining by systematically summarizing sensitive function features and constructing typical security sensitive point (such as stack overflow, integer overflow, UAF, formatted string, etc.) models; by utilizing program dependency analysis technology combined with vulnerability trigger vectors, a method for constructing source-sink point path envelope is designed to focus on key potential vulnerability paths; finally, a path envelope coverage method based on deep learning is proposed to realize intelligent sample mutation strategy, thereby effectively improving the precision and overall efficiency of vulnerability mining. Specifically, the technical logic features realized by the technical solutions of the present application at least include: 1. Multi-source vulnerability intelligence driven sensitive function modeling: based on multi-source vulnerability data such as CVE / patch / code snippets, a vulnerability semantic-code feature mapping model is constructed through defect association analysis to realize automatic and accurate identification of sensitive functions. Compared with the existing technology relying on manual rule definition, the present method significantly improves the model generalization ability and knowledge coverage integrity.

[0064] 2. Large model enabled static warning verification and path envelope construction: structural prompt words are generated by fusing static analysis reports, code summaries and sensitive function models, and LLM semantic understanding is used to verify the authenticity of sensitive functions; after verification, the functions are taken as sink points, and high-confidence path envelopes are generated by reverse tracking to the program entry through taint analysis. The existing technology relies on manual review of false positives and uses inefficient forward analysis, and the present scheme realizes intelligent verification and targeted path compression.

[0065] 3. Fine-grained envelope coverage guided intelligent sample generation: fine-grained coverage feedback is achieved by inserting a plug-in for key blocks in the path envelope; when the coverage rate is bottlenecked, the program structure and sample semantics are analyzed through LLM, and targeted test cases are generated based on chain thinking. Traditional fuzz testing uses random mutation and basic block coverage feedback, and the present technology breaks through the bottleneck of deep path coverage and improves the accuracy of vulnerability triggering.

[0066] The present application mainly solves the problem of vulnerability testing of open source software, and the technical problems solved by the technical logic of the embodiments of the present application at least include: (1) In view of the problem that the vulnerability characteristics of open source software are not obvious, the present application proposes a detailed review method for sensitive function features. By extracting key information of vulnerabilities from vulnerability text descriptions and codes related to triggering vulnerabilities, combined with defect association analysis technology, sensitive function models corresponding to stack overflow, integer overflow, UAF and formatted string vulnerabilities are constructed to clearly depict the vulnerability characteristics of open source software.

[0067] (2) In view of the high false alarm problem of the traditional static analysis technology of open source software, the application proposes an envelope construction method based on sensitive functions. The static analysis tool is used to scan the software for vulnerability rules and output a defect report, the confidence of the defect report is described by combining a large language model, the position of the sensitive function in the defect report is determined, and the path envelope guided by the sensitive function is constructed by using the taint analysis technology. Through the above analysis of the existence of the sensitive function and its path envelope, the false alarm rate of the static analysis tool for software vulnerabilities is reduced.

[0068] (3) In view of the problem of insufficient coverage of the traditional dynamic technology of open source software, the application proposes a high-level fuzzy test method based on path envelope coverage, develops a guided fuzzy test technology for obtaining fine-grained path envelope coverage information, and combines a sample variation method based on a large language model to improve the accuracy and efficiency of vulnerability mining.

[0069] Compared with the prior art, the difference of the technical logic realized by the embodiment of the application is: 1. Multi-source vulnerability intelligence driven sensitive function modeling: the existing technology has single knowledge source and lacks semantic association, resulting in poor model generalization; the application realizes automatic knowledge precipitation of vulnerability patterns through multi-source intelligence structuring and defect association.

[0070] 2. Large model enabled static warning verification and path envelope construction: the existing forward analysis faces the problem of path explosion, and the false alarm depends on manual processing; the application verifies the credibility of the sink (i.e. the position of the sensitive function) through a large model, and accurately compresses the path space by combining reverse taint tracking.

[0071] 3. Fine-grained envelope coverage guided intelligent sample generation: the existing coverage feedback has coarse granularity and blind variation, and it is difficult to trigger deep vulnerabilities; the application locates the key path by envelope-level fine-grained instrumentation, and realizes intelligent directional generation of samples by using the code understanding ability of LLM.

[0072] Compared with the prior art, the application at least includes the following beneficial effects: (1) Compared with the prior art, in the aspect of static analysis technology, the traditional static analysis tool relies on rule matching, which is easy to produce high false alarm due to code complexity or rule limitation. The application improves the accuracy of the static tool analysis report by establishing a double-track mechanism of "sensitive function modeling and large model semantic verification report".

[0073] (2) Compared with the prior art, in the aspect of dynamic analysis technology, the existing fuzzy test relies on random variation or simple coverage feedback, which is difficult to cover deep vulnerability paths. The application realizes the targeted coverage of vulnerability paths by "taint reverse envelope definition + large model guided test sample generation", thereby improving the coverage of the dynamic test tool.

[0074] As Figure 7 shown, the embodiment of the present application also provides a software vulnerability testing device 900 for knowledge extraction and envelope coverage, which can implement the above method, and the device can include: The data acquisition module 910 is configured to acquire vulnerability key information of the target software, and construct sensitive function features based on the vulnerability key information through defect dependency analysis; The path envelope module 920 is configured to perform semantic analysis on the analysis report and the code summary associated with the sensitive function features, filter to obtain a target sensitive function, perform path envelope reverse tracking on the target sensitive function, and construct a target path envelope; The fuzz testing module 930 is configured to acquire coverage information of the target path envelope, and perform fuzz testing based on the coverage information in combination with an iterative optimization mutation sample.

[0075] It can be understood that the content in the above method embodiments is applicable to the device embodiments, the device embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0076] The embodiment of the present application also provides an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the above method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0077] It can be understood that the content in the above method embodiments is applicable to the device embodiments, the device embodiments specifically implement the functions of the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0078] As Figure 8 shown, Figure 8 a hardware structure of an electronic device 1000 of another embodiment is illustrated, and the electronic device 1000 includes: The processor 1001 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application specific integrated circuit (aSIC), or one or more integrated circuits, etc., and is configured to execute a related program to implement the technical solutions provided by the embodiment of the present application. The memory 1002 can be implemented in the form of Read Only Memory (ROM), static storage device, dynamic storage device or Random access Memory (RAM), etc. The memory 1002 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 1002 and are called and executed by the processor 1001 to perform the method of the embodiments of the present application; The input / output interface 1003 is used to realize information input and output; The communication interface 1004 is used to realize the communication interaction between the device and other devices, which can realize communication through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.); The bus 1005 transmits information between various components (such as the processor 1001, the memory 1002, the input / output interface 1003 and the communication interface 1004) of the device; The processor 1001, the memory 1002, the input / output interface 1003 and the communication interface 1004 are connected to each other through the bus 1005 to realize the communication connection between them in the device.

[0079] The electronic device embodiments described above are only schematic, and the units described as separate components can or can not be physically separated, that is, they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment.

[0080] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the above method.

[0081] It can be understood that the contents of the above method embodiments are applicable to the present storage medium embodiment, the functions realized by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0082] The embodiment of the present application also provides a computer program product, which includes a computer program, and the computer program is executed by a processor to realize the above method.

[0083] It can be understood that the contents of the above method embodiments are applicable to the present program product embodiment, the functions realized by the present program product embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those of the above method embodiments.

[0084] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include high-speed random access memory and can also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include memory that is remotely disposed relative to the processor, which can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0085] The software vulnerability testing method and device provided by the embodiment of the present application are provided for knowledge extraction and envelope coverage, and the method comprises the following steps: obtaining vulnerability key information of target software, constructing sensitive function features based on the vulnerability key information through defect dependency analysis; performing semantic analysis on analysis reports and code summaries associated with the sensitive function features, and screening target sensitive functions; performing path envelope reverse tracking on the target sensitive functions, and constructing target path envelopes; obtaining coverage information of the target path envelopes, and performing fuzzy testing based on the coverage information combined with iterative optimization of mutation samples. The embodiment of the present application screens the target sensitive functions through "defect dependency analysis" and "semantic analysis", and constructs the path envelope, so that the test resources are concentrated in the code region where the real vulnerability is most likely to exist, the large number of irrelevant alarms generated by static analysis is effectively filtered, and the problem of high false alarm rate of traditional static analysis is fundamentally reduced. In addition, the embodiment of the present application clearly defines the key code region that needs to be covered through "path envelope reverse tracking", and performs directional fuzzy testing by using "iterative optimization of mutation samples", so as to guide the test process to preferentially explore these high-risk paths, and overcome the defects of low coverage and difficulty in triggering deep branches caused by blindness in traditional fuzzy testing. Specifically, the method of the embodiment of the present application is not simply connected in series with static and dynamic analysis, but forms an intelligent closed loop of "analysis-positioning-testing-feedback-optimization". The static analysis provides accurate guidance for dynamic testing, and the result of dynamic testing optimizes the strategy of static analysis, so that the test efficiency and the accuracy of vulnerability discovery are maximized in the limited test resources.

[0086] The embodiments described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0087] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation to the embodiments of the present application, and can include more or fewer steps than the figures, or combine certain steps, or different steps.

[0088] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, that is, can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments.

[0089] Those skilled in the art can understand that all or some steps in the above disclosed method, the function modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0090] The terms "first", "second", "third", "fourth" and the like in the description of the present application and the above-mentioned figures (if any) are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0091] It should be understood that in the present application, "at least one" means one or more, and "multiple" means two or more. "And / or", used to describe the association between the associated objects, means that there can be three relationships, for example, "A and / or B" can mean that there are three cases of only A, only B and A and B at the same time, where A and B can be singular or plural. The character " / " generally represents that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0092] In several embodiments provided by the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic. The units as divided can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0093] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0094] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0095] If the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application, the essential part or the contribution to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0096] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, but this does not limit the scope of the embodiments of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and spirit of the embodiments of the present application shall be within the scope of the embodiments of the present application.

Claims

1. A software vulnerability testing method oriented towards knowledge extraction and envelope coverage, characterized in that, The method comprises the following steps: Obtain the vulnerability key information of the target software, and construct sensitive function features based on the vulnerability key information through defect dependency analysis; Perform semantic analysis on the analysis report and code summary associated with the sensitive function features, filter out target sensitive functions, and perform path envelope reverse tracking on the target sensitive functions to construct target path envelopes; Obtain the coverage information of the target path envelope, and perform fuzzy testing based on the coverage information combined with iteratively optimized mutation samples.

2. The method of claim 1, wherein, The vulnerability key information of the target software is obtained, comprising the following steps: Obtain the vulnerability information of the target software; wherein the sources of the vulnerability information include vulnerability databases, vulnerability reports, patch descriptions, technical blogs and security bulletins; Perform data cleaning and standardization processing on the vulnerability information to obtain vulnerability descriptions; Extract function code fragments related to vulnerability triggering based on the function call information of the code space of the target software; Combine the vulnerability descriptions and the function code fragments to obtain the vulnerability key information.

3. The method of claim 1, wherein, The sensitive function features are constructed based on the vulnerability key information through defect dependency analysis, comprising the following steps: Based on the vulnerability key information, the triggering and influencing conditions between different vulnerabilities in the target software are analyzed to construct a defect dependency relationship; Based on the defect dependency relationship and the key code fragments corresponding to the vulnerability triggering, potential vulnerability patterns and features of the target software are obtained, and a sensitive function feature model is established to determine the sensitive function features.

4. The method of claim 1, wherein, The semantic analysis is performed on the analysis report and code summary associated with the sensitive function features, and the target sensitive functions are filtered out, comprising the following steps: Based on the sensitive function features, use a static analysis tool to detect errors in the target software, and generate the analysis report; Split the analysis report into single warnings, uniformly encode the format of each type of error information corresponding to each warning, and then sort the warning levels, and extract preliminary sensitive functions based on the sorting results of the warning levels; Use program dependency analysis technology to generate a code summary of the preliminary sensitive functions; Input the uniformly encoded results and the code summary as prompt word instructions, and use a large language model to perform semantic analysis to filter out the target sensitive functions.

5. The method of claim 1, wherein, The target sensitive functions are reverse tracked based on the path envelope to construct target path envelopes, comprising the following steps: Based on the function features corresponding to the target sensitive functions, use a static value flow analysis method to identify program control dependencies and data dependencies, and then construct a program inter-control flow graph guided by the target sensitive functions; Based on the program inter-control flow graph, mark the target sensitive functions as a point of pollution convergence, and reverse track the pollution source based on the point of pollution convergence to construct the target path envelope.

6. The method of claim 1, wherein, The coverage information of the target path envelope is obtained, comprising the following steps: Based on the source code of the target software, mark the envelope basic blocks corresponding to the target path envelope in the target software; Patching the target software based on the envelope basic block to obtain the coverage information.

7. The method of claim 1, wherein, The fuzz testing based on the coverage information and the iteratively optimized mutation samples includes the following steps: Obtaining an initial sample set, taking the initial sample set as an input sample; Performing fuzz testing by using the coverage information and the input sample to obtain a vulnerability result and a high-quality sample; Based on the high-quality sample, its corresponding coverage function sequence and the function call structure of the target software, using a prompt word engineering to generate a prompt word; Based on the prompt word, using chain thinking and few-shot learning technology to guide a large language model to generate a mutation sample; Taking the mutation sample as the input sample, returning to perform the step of performing fuzz testing by using the coverage information and the input sample until the path envelope coverage rate of the fuzz testing reaches a preset requirement.

8. A software vulnerability testing apparatus oriented towards knowledge extraction and envelope coverage, characterized by, The device includes: A data acquisition module configured to acquire vulnerability key information of a target software, and to construct sensitive function features based on the vulnerability key information through defect dependency analysis; A path envelope module configured to perform semantic analysis on analysis reports and code summaries associated with the sensitive function features, to screen target sensitive functions, to perform path envelope reverse tracking on the target sensitive functions, and to construct target path envelopes; A fuzz testing module configured to acquire coverage information of the target path envelopes, and to perform fuzz testing based on the coverage information and iteratively optimized mutation samples.

9. An electronic device, comprising: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method of any one of claims 1 to 7 when executing the computer program.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1 to 7.

Images