Agent-driven semantic clustering directed fuzzing method and apparatus

Abstract

The embodiment of the application discloses an agent-driven semantic clustering directed fuzzing method and device, and relates to the technical field of software security testing.The method specifically comprises the following steps: firstly, a target point is acquired and is merged according to functions; secondly, the control flow graph of each function is analyzed before testing, key predicates are extracted, and a constraint signature is generated for the target point; the constraint signature is divided into semantic clusters based on a logical relationship, and combined constraint signatures of the semantic clusters are formed in combination with calling contexts; then, in the testing runtime, the semantic clusters are taken as units, seeds and energy are dispatched according to the combined constraint signatures of the semantic clusters, the state is updated according to feedback, and it is determined whether the semantic clusters are stagnant; when the semantic clusters are stagnant, the input is directed to be adjusted to generate a new seed and to be executed based on the combined constraint signatures of the semantic clusters and the path of the current seed; finally, the state of the semantic clusters and the historical strategy are updated according to the execution result of the new seed, and the above-mentioned dispatching and generating process is iteratively executed, so that efficient and accurate vulnerability testing is realized.

Description

Technical Field

[0001] This invention relates to the field of software security testing technology, and more specifically, to an agent-driven semantic clustering directional fuzzy testing method and device. Background Technology

[0002] With the development of software security testing technology, efficiently verifying potential vulnerabilities identified in massive static analysis reports has become a real need. Directed Grey-box Fuzzing (DGF) technology has emerged to address this need. Its core objective is to concentrate testing energy on a specified target code region within the program, thereby quickly verifying the triggerability of specific suspicious code or vulnerabilities. Currently, the application scenarios of this technology have expanded from single-target reproduction to large-scale target-guided greybox fuzzing (LTGF), dealing with thousands or even tens of thousands of potential vulnerability points marked by tools such as sanitizer instrumentation.

[0003] To address the challenges of large-scale target scenarios, researchers have proposed various improvement schemes. Existing solutions mainly revolve around multi-target priority scheduling, such as managing a large number of targets through iterative priority mechanisms or introducing probabilistic models to model and guide target reachability. These methods aim to sort and allocate resources for massive numbers of targets to improve the overall efficiency of testing.

[0004] However, existing multi-objective oriented fuzzy testing schemes have significant drawbacks. First, the granularity of object grouping is too coarse, often based on functions, ignoring the logical mutual exclusion relationships between object points under different conditional branches within the same function, leading to oscillations in testing between contradictory constraints. Second, mutation strategies lack semantic guidance, and relying on random mutation operators is insufficient to effectively satisfy complex predicate verification, resulting in a significant waste of testing energy. Finally, the intelligent overhead is difficult to control; simply batch-calling large language models or static analysis engines for all objects generates unacceptable computational and time costs, hindering the large-scale application of the technology in practical engineering. Summary of the Invention

[0005] This invention provides an agent-driven semantic clustering directional fuzzy testing method and device to improve at least one of the above-mentioned technical problems.

[0006] In a first aspect, the present invention provides an agent-driven semantic clustering directional fuzzy testing method, which includes S1 to S5.

[0007] S1. Obtain the set of target points in the program to be tested, and merge the set of target points according to their respective functions to obtain a set containing the target functions.

[0008] S2. Before fuzz testing starts: Based on the control flow graph of each objective function in the set containing objective functions, extract the key predicates that affect the reachability of the objective point, generate constraint signatures for each objective point, and divide semantic clusters according to the consistency, mutual exclusion and inclusion relationship between the constraint signatures, and then combine the pre-constraints of the call point to obtain the combined constraint signatures of each semantic cluster.

[0009] S3. During the fuzz test: Based on the combined constraint signature of each semantic cluster, the seeds are matched, filtered and mutation energy is allocated. The directional fuzz test is executed with the semantic cluster as the scheduling unit. The running status of each semantic cluster is updated according to the execution feedback and it is determined whether the target semantic cluster has entered a stagnant state.

[0010] S4. When it is determined that the target semantic cluster has entered a stagnant state: based on the combined constraint signature of the target semantic cluster, the execution path of the current seed and the unmet constraints, the input is adjusted in a directional manner to generate a candidate seed, and the candidate seed is executed.

[0011] S5. Based on the execution results of the candidate seeds, update the state of the corresponding semantic cluster, historical failure samples, and effective modification strategies to continue the iterative execution of S3 and S4.

[0012] As a further aspect of the present invention, S1 specifically involves: obtaining potential vulnerability points marked by static analysis reports or Sanitizer instrumentation as target points in the target point set, and merging the target points according to the function identifier to which each target point belongs, to obtain multiple subsets containing target functions and target point subsets corresponding to each target function.

[0013] As a further aspect of the present invention, S2 includes S201 to S212.

[0014] S201. Read each control flow graph containing the objective function, and based on the distribution of the objective points in the control flow graph, identify candidate conditional predicates that can divert different objective points to different control regions.

[0015] S202. When different branches of the same conditional predicate contain target points, the conditional predicate is identified as a candidate key predicate.

[0016] S203. When all the relevant target points of the same conditional predicate are located within the same branch control region, the conditional predicate is removed from the candidate key predicates.

[0017] S204. Perform input relevance identification on the candidate key predicates, and retain only the candidate key predicates that have data dependencies on external inputs as key predicates.

[0018] S205. For each target point, extract the branch values ​​of the target point on each key predicate, and combine the branch values ​​according to the correspondence between the key predicate identifier and the value to obtain the constraint signature of the target point.

[0019] S206. When multiple target points have the same branch value on a shared key predicate, the multiple target points are assigned to the same semantic cluster.

[0020] S207. When multiple target points have opposite branch values ​​on any shared key predicate, the multiple target points are divided into different semantic clusters.

[0021] S208. When the constraint signature of the first target point contains all the constraints in the constraint signature of the second target point, the first target point and the second target point are assigned to the same semantic cluster, and the constraint signature with more complete constraints is used as the representative constraint signature of the semantic cluster.

[0022] S209, For functions containing objective functions target point set Construct a constraint conflict graph Among them, if a key predicate exists... , so that reaching the first Target points Need to meet And reached the Target points Need to meet Or conversely, at the target point With the target point Add conflict-constrained edges between them and assign edge weights. Define the target point With the target point The minimum number of mutually exclusive key predicates.

[0023] S210. Equivalent to a constraint conflict graph for legal semantic partitioning. Color the legal graph and use chromatic numbers. This serves as a lower bound on the minimum number of semantic clusters required to complete the conflict-free objective decomposition.

[0024] in, For the first Target points. This represents the set of conflicting edges. This represents the edge weight function. Representing a constraint conflict diagram color number.

[0025] S211. Extract the pre-constraints of the call point formed by the upper-level branch conditions controlled by the call statement of the function containing the target semantic cluster. Append the pre-constraints of the call point to the representative constraint signature of the target semantic cluster to obtain the combined constraint signature of the target semantic cluster.

[0026] S212. Use a greedy coloring algorithm to process the constraint conflict graph. The solution is performed, and the semantic cluster to which each target point belongs is determined based on the solution results. The priority weight of each semantic cluster is initialized based on the edge weight in the constraint conflict graph, which serves as the initial input of the semantic cluster scheduling module.

[0027] As a further aspect of the present invention, S3 includes S31 to S36.

[0028] S31. Obtain the branch conditions traversed by the seed in the current execution path. Here, "seed" refers to the test input sample in fuzzing. Match the branch conditions with the constraint signatures of each semantic cluster to obtain the constraint matching results of each seed relative to each semantic cluster. Based on the constraint matching results, prioritize the seed that satisfies more pre-constraints on the target semantic cluster and assign higher mutation energy to the selected seed.

[0029] S32. First, match the branch condition with the pre-constraints of the call point of the target semantic cluster to determine whether the seed satisfies the external call condition for entering the target function. If the seed satisfies the external call condition, then match the branch condition with the representative constraint signature of the target semantic cluster to determine the degree to which the seed satisfies the internal constraints of the target semantic cluster.

[0030] S33. When a newly executed seed successfully expands the path coverage of the target semantic cluster, the target semantic cluster is restored to the normal exploration state. If multiple rounds of seed execution fail to expand the path coverage of the target semantic cluster, the scheduling priority of the target semantic cluster is reduced, and computing resources are reallocated to other semantic clusters.

[0031] S34. Based on the execution feedback of the same semantic cluster in multiple consecutive scheduling rounds, construct the execution path branch frequency distribution of the semantic cluster in the current round, and calculate the exploration entropy score of the semantic cluster. When the exploration entropy score is lower than the adaptive threshold of the semantic cluster, and the constraint satisfaction progress of the semantic cluster is lower than the preset threshold, the semantic cluster is determined to enter a stagnant state.

[0032] .

[0033] in, Semantic clusters In the The exploration entropy score of the wheel. Indicates the first A semantic cluster. Indicates the current round number. This represents Shannon entropy. Indicates the first Frequency distribution of execution path branches in a round. This indicates backtracking relative to the current round. Frequency distribution of execution path branches corresponding to each round. This indicates the size of the sliding window.

[0034] S35. Treat each semantic cluster as an optional arm, and treat each round of semantic cluster selection as an arm selection operation. After selecting a target semantic cluster and completing the mutation energy allocation, calculate the reward value of the target semantic cluster based on the number of newly added path coverages, the number of newly satisfied key predicates, and the number of successfully triggered targets in this round of scheduling:

[0035] .

[0036] in, Indicates the first Semantic clusters in round-robin scheduling The reward value. Indicates the scheduling round. This is a coefficient representing the number of newly added path coverages. The coefficient for the number of new key predicates. The coefficient for the number of times the target is successfully triggered.

[0037] S36. Update the scheduling priority of the target semantic cluster based on the reward value, and determine the semantic cluster to be scheduled in the next round using the UCB1-Tuned formula. Before the first execution of the UCB1-Tuned formula, set an initial prior reward based on the priority weight of each semantic cluster and the severity of the vulnerability type of the target point corresponding to each semantic cluster.

[0038] As a further embodiment of the present invention, S4 includes S41 to S44.

[0039] S41. Obtain the execution path corresponding to the current seed and extract the branch conditions that have been satisfied by the execution path. Compare the satisfied branch conditions with the combined constraint signature of the target semantic cluster item by item to determine the key predicate constraints that have not yet been satisfied, and obtain the set of unsatisfied constraints. Based on the set of unsatisfied constraints, determine the key branch conditions that prevent the current seed from reaching the target semantic cluster.

[0040] S42. Based on the data dependency relationship between the set of unsatisfied constraints and the input, locate the key fields or byte ranges in the input corresponding to each unsatisfied constraint, and perform targeted value modification on the key fields when the unsatisfied constraint corresponds to a numerical relationship or pattern matching relationship. When the unsatisfied constraint corresponds to a length relationship or structural relationship, perform consistency correction on the overall structure of the input.

[0041] S43. When the combined constraint signature of the target semantic cluster contains a pre-constraint on the call point, the input is adjusted first based on the pre-constraint on the call point so that the execution path corresponding to the current seed enters the target function. After entering the target function, the key fields or byte ranges in the input are further adjusted based on the representative constraint signature of the target semantic cluster to satisfy the internal constraints of the target function.

[0042] S44. Perform vulnerability type-aware generation based on the Sanitizer instrumentation type of the triggering target semantic cluster. When the Sanitizer instrumentation type corresponds to UAF or Double-Free, unmet constraints are identified as temporal constraints, and candidate seeds are generated based on the "allocation-release-use" operation sequence. When the Sanitizer instrumentation type corresponds to buffer overflow, unmet constraints are identified as boundary constraints, and critical values ​​of key fields are calculated based on arithmetic solutions and boundary value enumeration to generate candidate seeds. When the Sanitizer instrumentation type corresponds to integer overflow, unmet constraints are identified as bit-width boundary constraints, and bit-width boundary value perturbations are applied to the operand fields of related operations to generate candidate seeds.

[0043] Among them, the operand field is set to or This represents the maximum representable value of the target integer type. Represents the smallest representable value of the target integer type.

[0044] As a further aspect of the present invention, S5 includes: updating the state of the corresponding semantic cluster, historical failure samples, and effective modification strategies based on the execution results of the candidate seed. When the candidate seed expands the path coverage corresponding to the target semantic cluster, the input modification method corresponding to the candidate seed is recorded as an effective modification strategy. When the candidate seed does not expand the path coverage corresponding to the target semantic cluster, the candidate seed and its unmet constraints are written into the historical failure samples.

[0045] Secondly, the present invention provides an agent-driven semantic clustering directional fuzzy testing device, comprising a processor, a memory, and a computer program stored in the memory. The computer program can be executed by the processor to implement an agent-driven semantic clustering directional fuzzy testing method as described in any paragraph of the first aspect.

[0046] By adopting the above technical solution, the present invention can achieve the following technical effects: This invention significantly improves the efficiency and targeting of vulnerability detection by dividing target points into semantic clusters according to the logical relationship of constraint signatures and using semantic clusters as scheduling units for targeted fuzz testing. The adaptive scheduling strategy based on multi-armed gambling machine theory can intelligently allocate mutation energy, avoiding resource waste in traditional methods. Simultaneously, the theoretical regret bound ensures that scheduling overhead does not increase linearly with test rounds. Combined with a constraint signature-based targeted seed generation mechanism, differentiated generation strategies are adopted for different vulnerability types such as UAF, buffer overflow, and integer overflow, greatly increasing the trigger probability of complex vulnerabilities, especially significantly enhancing the detection capability for time-related and boundary condition vulnerabilities.

[0047] This invention further introduces a memory module mechanism, which continuously accumulates historical failure samples and effective modification strategies to continuously optimize seed generation quality across iterations, effectively solving the path exploration stagnation problem in traditional fuzz testing. Through the synergistic effect of combined constraint signatures and call point pre-constraints, the system can still make reasonable priority judgments in the cold start phase without historical data, avoiding blind exploration and improving overall testing efficiency by orders of magnitude, making it particularly suitable for security vulnerability mining scenarios in large and complex software systems. Attached Figure Description

[0048] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the specific embodiments of the present invention will be briefly introduced below. It should be understood that the following drawings only show some specific embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0049] Figure 1 This is a schematic diagram of the overall architecture of an agent-driven directional fuzzy testing system.

[0050] Figure 2 This is a schematic diagram of target semantic clustering based on constraint consistency.

[0051] Figure 3 This is a schematic diagram of a scheduling mechanism based on semantic clusters and constraint matching.

[0052] Figure 4 This is a schematic diagram of a directional seed generation module based on constraint signatures. Detailed Implementation

[0053] The technical solutions of the present invention will now be clearly and completely described with reference to the accompanying drawings in the embodiments of the present invention.

[0054] Example 1, please refer to Figures 1 to 4The first embodiment of the present invention provides an agent-driven semantic clustering directional fuzzy testing method, which includes S1 to S5.

[0055] S1. Obtain the set of target points in the program under test, and merge the set of target points according to their respective functions to obtain a set containing target functions. Preferably, S1 specifically involves: obtaining potential vulnerability points marked by static analysis reports or Sanitizer instrumentation as target points in the target point set, and merging the target points according to the function identifiers to which each target point belongs to, to obtain multiple sets containing target functions, and a subset of target points corresponding to each set containing target functions.

[0056] Specifically, the semantic analysis agent first merges all target points according to their respective functions to obtain a set containing the target functions.

[0057] S2. Before fuzz testing starts: Based on the control flow graph of each objective function in the set containing objective functions, extract the key predicates that affect the reachability of the objective point, generate constraint signatures for each objective point, and divide semantic clusters according to the consistency, mutual exclusion and inclusion relationship between the constraint signatures, and then combine the pre-constraints of the call point to obtain the combined constraint signatures of each semantic cluster.

[0058] S3. During the fuzz test: Based on the combined constraint signature of each semantic cluster, the seeds are matched, filtered and mutation energy is allocated. The directional fuzz test is executed with the semantic cluster as the scheduling unit. The running status of each semantic cluster is updated according to the execution feedback and it is determined whether the target semantic cluster has entered a stagnant state.

[0059] S4. When it is determined that the target semantic cluster has entered a stagnant state: based on the combined constraint signature of the target semantic cluster, the execution path of the current seed and the unmet constraints, the input is adjusted in a directional manner to generate a candidate seed, and the candidate seed is executed.

[0060] S5. Based on the execution results of the candidate seeds, update the state of the corresponding semantic cluster, historical failure samples, and effective modification strategies to continue the iterative execution of S3 and S4.

[0061] The present invention provides an agent-driven semantic clustering directional fuzzy testing method, which constructs a fuzzy testing system in which multiple dedicated agents work collaboratively. Through skill invocation and shared memory mechanisms, it realizes a controllable and scalable directional fuzzy testing process for large-scale multi-objective scenarios.

[0062] like Figure 1As shown, the overall system of this invention adopts a modular structure design, mainly including a semantic clustering module, a semantic cluster scheduling module, and a targeted seed generation module. Data flow and capability reuse between modules are achieved through a shared memory module and a unified skill invocation interface. The system is uniformly coordinated by a scheduling agent, with each functional module having its specific tasks executed by a semantic analysis agent, a scheduling agent, and a generation agent, respectively.

[0063] Based on the above embodiments, in an optional embodiment of the present invention, S2 includes S201 to S212.

[0064] S201. Read each control flow graph containing the objective function, and based on the distribution of the objective points in the control flow graph, identify candidate conditional predicates that can divert different objective points to different control regions.

[0065] S202. When different branches of the same conditional predicate contain target points, the conditional predicate is identified as a candidate key predicate.

[0066] S203. When all the relevant target points of the same conditional predicate are located within the same branch control region, the conditional predicate is removed from the candidate key predicates.

[0067] S204. Perform input relevance identification on the candidate key predicates, and retain only the candidate key predicates that have data dependencies on external inputs as key predicates.

[0068] Specifically, the constraint-consistency-based semantic clustering module is executed before the fuzz test begins. Using the objective function as the analysis unit, it performs constraint modeling on the set of objective points within the function and divides them into semantic clusters. For example... Figure 2 As shown. Subsequently, for each objective function, the agent reads the control flow graph corresponding to the function and, in conjunction with the distribution of the objective point in the control flow graph, extracts the key control conditions (i.e., candidate condition predicates) that can affect the reachability of the objective point.

[0069] This process does not require reconstructing the complete path from the function entry point to each target point. Instead, it identifies which conditional branches will divert target points to different regions by controlling dependency extraction capabilities. If different branches of a conditional predicate contain target points, the predicate is considered to have a distinguishing effect on target partitioning and is marked as a candidate key predicate. If all target points are located within the same branch control region of the predicate, the predicate is considered to have no partitioning value and is ignored in subsequent processing. The semantic analysis agent performs input relevance identification on the candidate key predicates, retaining only constraints that have data dependencies on external inputs and can be used in subsequent input construction.

[0070] S205. For each target point, extract the branch values ​​of the target point on each key predicate, and combine the branch values ​​according to the correspondence between the key predicate identifier and the value to obtain the constraint signature of the target point.

[0071] Specifically, after obtaining the key predicate, the semantic analysis agent generates a constraint signature for the target point. This constraint signature is not a complete path, but rather a combination of branch values ​​for the target point on the key predicate. For example, if a target point is reachable only through the true branch of function A, its signature can be written as "A=true". If a target point needs to satisfy both "A=true" and "B=false", its signature can be written as "A=true, B=false".

[0072] S206. When multiple target points have the same branch value on a shared key predicate, the multiple target points are assigned to the same semantic cluster.

[0073] S207. When multiple target points have opposite branch values ​​on any shared key predicate, the multiple target points are divided into different semantic clusters.

[0074] S208. When the constraint signature of the first target point contains all the constraints in the constraint signature of the second target point, the first target point and the second target point are assigned to the same semantic cluster, and the constraint signature with more complete constraints is used as the representative constraint signature of the semantic cluster.

[0075] Specifically, for multiple target points within the same function, if their values ​​on a shared key predicate are consistent, they are considered to satisfy the same or compatible preconditions and can be grouped into the same semantic cluster. If a key predicate has opposite values, it indicates that their path conditions are mutually exclusive and they should be classified into different semantic clusters. If the signature of one target point contains all the constraints of another target point, they are considered to have a precondition inclusion relationship and can be grouped into the same semantic cluster, with the signature with the more complete constraints serving as the representative constraint of that cluster.

[0076] S209, For functions containing objective functions target point set Construct a constraint conflict graph Among them, if a key predicate exists... , so that reaching the first Target points Need to meet And reached the Target points Need to meet Or conversely, at the target point With the target point Add conflict-constrained edges between them and assign edge weights. Define the target point With the target point The minimum number of mutually exclusive key predicates.

[0077] Specifically, based on the clustering process described above, this module further introduces a Constraint Conflict Graph (CCG) to formally model the semantic clustering results, providing a provable guarantee of optimality. This applies to clustering with an objective function. Set of target points within Construct a constraint conflict graph If a certain key predicate exists Make it possible to reach Require And arrive Require (or vice versa), then in and Add conflict-constrained edges between them. Edge weights. The constraint conflict depth is defined as the minimum number of mutually exclusive key predicates between two objectives. The constraint conflict graph is a weighted undirected graph. The edge weights... Indicates the target point With the target point The depth of the conflict between them.

[0078] S210. Equivalent to a constraint conflict graph for legal semantic partitioning. Color the legal graph and use chromatic numbers. This serves as a lower bound on the minimum number of semantic clusters required to complete the conflict-free objective decomposition.

[0079] Specifically, based on this graph, a valid semantic partition is equivalent to a valid graph coloring of a CCG—there are no conflicting edges between vertices of the same color. The chromatic number of a CCG... A provable lower bound is given on the minimum number of semantic clusters required to complete the conflict-free objective decomposition, thus providing a strict semantic optimality guarantee for the clustering steps of this invention: in, For the first Target points. This represents the set of conflicting edges. This represents the edge weight function. Representing a constraint conflict diagram color number.

[0080] S211. Extract the pre-constraints of the call point formed by the upper-level branch conditions controlled by the call statement of the function containing the target semantic cluster. Append the pre-constraints of the call point to the representative constraint signature of the target semantic cluster to obtain the combined constraint signature of the target semantic cluster.

[0081] Specifically, in addition to internal function constraints, the reachability of the target point may also be affected by the conditions of the branch where the calling point is located. Therefore, this module further introduces calling context constraint modeling.

[0082] When a function call statement is controlled by a conditional branch, the semantic analysis agent extracts the pre-constraints corresponding to the call point and appends them to the constraint signature of the semantic cluster inside the called function, thus forming a combined constraint representation (i.e., a combined constraint signature).

[0083] For example, if the target function is called Given a condition C, function A is called when C = true, and function B is called when C = false. Then, any semantic cluster within function A has an external context constraint "C = true", and any semantic cluster within function B has an external context constraint "C = false". If the original signature of a semantic cluster within function A is P = true, then its combined signature can be represented as C = true, P = true. Here, true indicates that the condition is true, and false indicates that the condition is false.

[0084] In this way, the impact of upstream conditions at the call point on the reachability of the target within the called function can be expressed without performing a full cross-procedural path recovery.

[0085] S212. Use a greedy coloring algorithm to process the constraint conflict graph. The solution is performed, and the semantic cluster to which each target point belongs is determined based on the solution results. The priority weight of each semantic cluster is initialized based on the edge weight in the constraint conflict graph, which serves as the initial input of the semantic cluster scheduling module.

[0086] Specifically, within the same semantic cluster, the values ​​of the target point on all key predicates do not exhibit any logical contradictions, and the total number of groups reaches the theoretical minimum without introducing constraint conflicts. This module employs a greedy coloring algorithm to efficiently solve the sparse CCG, and the resulting coloring is directly used as the basis for semantic cluster partitioning. Simultaneously, the conflict depth of each edge is passed to the scheduling module to initialize the priority weights of each semantic cluster.

[0087] Based on the above embodiments, in an optional embodiment of the present invention, S3 includes S31 to S36.

[0088] S31. Obtain the branch conditions traversed by the seed in the current execution path. Here, "seed" refers to the test input sample in fuzzing. Match the branch conditions with the constraint signatures of each semantic cluster to obtain the constraint matching results of each seed relative to each semantic cluster. Based on the constraint matching results, prioritize the seed that satisfies more pre-constraints on the target semantic cluster and assign higher mutation energy to the selected seed.

[0089] like Figure 3As shown, the semantic cluster scheduling module, which is activated on demand, works continuously during the fuzz test. It is responsible for differentiating the scheduling of different targets based on the semantic clustering results, and dynamically switching between low-cost conventional exploration and high-cost targeted generation, thereby improving test efficiency and controlling overall computational overhead in large-scale multi-target scenarios.

[0090] The semantic cluster scheduling module uses semantic clusters as the basic scheduling unit, is executed by a scheduling agent, and uses the semantic cluster information stored in the memory module and the running feedback as the basis for decision-making. During the scheduling process, the scheduling agent first matches and filters seeds based on the representative constraint signatures of the semantic clusters. Here, a seed refers to the test input sample in the fuzzing test. If the constraint signature of a certain semantic cluster is a combination of key predicate values, then the seed that already satisfies some of its pre-constraints in the current execution path is selected first, and more mutation energy is allocated to it, so that the fuzzing test continues to advance along the direction of that constraint.

[0091] S32. First, match the branch condition with the pre-constraints of the call point of the target semantic cluster to determine whether the seed satisfies the external call condition for entering the target function. If the seed satisfies the external call condition, then match the branch condition with the representative constraint signature of the target semantic cluster to determine the degree to which the seed satisfies the internal constraints of the target semantic cluster.

[0092] Specifically, for semantic clusters with call context constraints, the scheduling agent considers the combination and matching of external context constraints and internal function constraints when selecting seeds and allocating energy. For example, when the combined signature of a semantic cluster contains both call point conditions and internal function conditions, seeds that already satisfy the call context constraints are preferentially selected, thereby avoiding invalid exploration on paths that do not meet the prerequisite call conditions.

[0093] S33. When a newly executed seed successfully expands the path coverage of the target semantic cluster, the target semantic cluster is restored to the normal exploration state. If multiple rounds of seed execution fail to expand the path coverage of the target semantic cluster, the scheduling priority of the target semantic cluster is reduced, and computing resources are reallocated to other semantic clusters.

[0094] Specifically, after the agent generation module generates a new seed and reports the execution result, the scheduling agent updates the state of the corresponding semantic cluster in the memory module based on the new coverage information. When the new seed successfully expands the path coverage, the semantic cluster is restored to the normal exploration state. If no progress is made after multiple rounds of generation, its scheduling priority can be reduced according to a preset strategy, thereby reallocating computing resources to other semantic clusters.

[0095] S34. Based on the execution feedback of the same semantic cluster in multiple consecutive scheduling rounds, construct the execution path branch frequency distribution of the semantic cluster in the current round, and calculate the exploration entropy score of the semantic cluster. When the exploration entropy score is lower than the adaptive threshold of the semantic cluster, and the constraint satisfaction progress of the semantic cluster is lower than the preset threshold, the semantic cluster is determined to enter a stagnant state.

[0096] .

[0097] in, Semantic clusters In the The exploration entropy score of the wheel. Indicates the first A semantic cluster. Indicates the current round number. This represents Shannon entropy. Indicates the first Frequency distribution of execution path branches in a round. This indicates backtracking relative to the current round. Frequency distribution of execution path branches corresponding to each round. This indicates the size of the sliding window.

[0098] Specifically, to further improve the accuracy and theoretical interpretability of stagnation detection, this module introduces the Exploration Entropy Score (EES) based on information theory to replace the traditional threshold judgment of N consecutive rounds of uncovered growth. Here, N is a preset threshold constant representing the number of consecutive rounds required to determine stagnation.

[0099] semantic clusters ,definition .when Below the adaptive threshold And the constraints satisfy the progress amount At the same time below the threshold When this occurs, the semantic cluster is determined to have entered a stagnant state. Among these, The number of key predicates in the semantic cluster decreases as the number of key predicates increases, allowing the system to retain sufficient exploration margin in complex constrained regions.

[0100] S35. Treat each semantic cluster as an optional arm, and treat each round of semantic cluster selection as an arm selection operation. After selecting a target semantic cluster and completing the mutation energy allocation, calculate the reward value of the target semantic cluster based on the number of new path coverages, the number of new satisfied key predicates, and the number of successfully triggered targets in this round of scheduling.

[0101] .

[0102] in, Indicates the first Semantic clusters in round-robin scheduling The reward value. Indicates the scheduling round. This is a coefficient representing the number of newly added path coverages. The coefficient for the number of new key predicates. The coefficient for the number of times the target is successfully triggered.

[0103] Specifically, in scenarios involving concurrent scheduling of multiple semantic clusters, this module employs a Multi-Armed Bandit (MAB) scheduling strategy instead of a static priority formula, providing an adaptive decision-making mechanism with a theoretical regret bound guarantee for semantic cluster scheduling. Each semantic cluster is treated as an optional "arm," and each round of scheduling corresponds to the selection of an arm. The selected semantic cluster... After allocating the mutated energy, a reward is obtained.

[0104] S36. Update the scheduling priority of the target semantic cluster based on the reward value, and determine the semantic cluster to be scheduled in the next round using the UCB1-Tuned formula. Before the first execution of the UCB1-Tuned formula, set an initial prior reward based on the priority weight of each semantic cluster and the severity of the vulnerability type of the target point corresponding to each semantic cluster.

[0105] Specifically, the scheduling strategy adopts the UCB1-Tuned formula, which can be proven to be effective in... The upper limit of the cumulative regrets in the overall scheduling is This theoretically ensures that scheduling overhead does not increase linearly with the number of rounds. The total number of scheduling rounds (total number of test rounds) is a variable or an upper bound.

[0106] To avoid blind exploration during the cold start phase, the initial prior rewards for each arm are initialized by the CCG conflict depth and vulnerability type severity, enabling the system to make reasonable priority judgments based on static analysis information even without historical data.

[0107] Based on the above embodiments, in an optional embodiment of the present invention, S4 includes S41 to S44.

[0108] S41. Obtain the execution path corresponding to the current seed and extract the branch conditions that have been satisfied by the execution path. Compare the satisfied branch conditions with the combined constraint signature of the target semantic cluster item by item to determine the key predicate constraints that have not yet been satisfied, and obtain the set of unsatisfied constraints. Based on the set of unsatisfied constraints, determine the key branch conditions that prevent the current seed from reaching the target semantic cluster.

[0109] like Figure 4As shown, the constraint signature-based directional seed generation module is triggered to execute after the scheduling module determines that a certain semantic cluster has entered a stagnant state. It is responsible for generating candidate seed inputs that can break through the current path bottleneck based on the constraint signature of the semantic cluster and the call context constraints.

[0110] Unlike existing fuzzy testing methods based on large language models that directly generate programs or inputs in a general way, this module uses semantic clusters as the basic unit and constraint signatures as the core basis to perform targeted corrections on the input, thereby transforming the random mutation process into a construction process oriented towards constraint satisfaction.

[0111] First, the path understanding process identifies unmet key constraints based on the matching relationship between the execution path of the current seed and the constraint signature of the semantic cluster. For each key predicate of the semantic cluster, it determines whether the execution path of the current seed has satisfied the corresponding branch condition, thereby determining the gap between the current path and the target semantic cluster and locating the key branch conditions that prevent the path from continuing.

[0112] S42. Based on the data dependency relationship between the set of unsatisfied constraints and the input, locate the key fields or byte ranges in the input corresponding to each unsatisfied constraint, and perform targeted value modification on the key fields when the unsatisfied constraint corresponds to a numerical relationship or pattern matching relationship. When the unsatisfied constraint corresponds to a length relationship or structural relationship, perform consistency correction on the overall structure of the input.

[0113] Specifically, the seed generation process adjusts the input based on unmet key constraints. For input-related constraints, this module, in conjunction with data dependencies, locates the key fields or byte ranges in the input corresponding to the constraint and modifies them according to the constraint requirements.

[0114] For example, when a constraint requires a field to satisfy a specific numerical relationship or match a specific pattern, the seed generation process adjusts that field to a value that meets the condition. When the constraint involves length or structural relationships, the overall input structure is modified for consistency.

[0115] S43. When the combined constraint signature of the target semantic cluster contains a pre-constraint on the call point, the input is adjusted first based on the pre-constraint on the call point so that the execution path corresponding to the current seed enters the target function. After entering the target function, the key fields or byte ranges in the input are further adjusted based on the representative constraint signature of the target semantic cluster to satisfy the internal constraints of the target function.

[0116] Specifically, for semantic clusters that include call context constraints, the seed generation process considers the combination of external call conditions and internal function constraints. When the constraint signature of a semantic cluster contains a call point condition, the input is adjusted first to satisfy the call condition, thereby ensuring that the execution path can enter the target function, and then the internal function constraints are satisfied.

[0117] S44. Perform vulnerability type-aware generation based on the Sanitizer instrumentation type of the triggering target semantic cluster. When the Sanitizer instrumentation type corresponds to UAF or Double-Free, unmet constraints are identified as temporal constraints, and candidate seeds are generated based on the "allocation-release-use" operation sequence. When the Sanitizer instrumentation type corresponds to buffer overflow, unmet constraints are identified as boundary constraints, and critical values ​​of key fields are calculated based on arithmetic solutions and boundary value enumeration to generate candidate seeds. When the Sanitizer instrumentation type corresponds to integer overflow, unmet constraints are identified as bit-width boundary constraints, and bit-width boundary value perturbations are applied to the operand fields of related operations to generate candidate seeds.

[0118] Among them, the operand field is set to or This represents the maximum representable value of the target integer type. Represents the smallest representable value of the target integer type.

[0119] Specifically, to further improve the targeting of seed generation, this module introduces the Vulnerability Signature Taxonomy (VST). The constraint structure is classified according to the type of Sanitizer instrumentation that triggers the semantic cluster, and differentiated constraint parsing and input generation strategies are adopted for different categories.

[0120] For UAF and Double-Free targets, the constraints are temporal in nature. The key is that the driving execution path goes through a specific sequence of operations of "allocation-release-use". Therefore, the agent is called first to generate inputs that satisfy the temporal constraints.

[0121] For targets that exceed the buffer limit, the critical values ​​of the target field are calculated directly through arithmetic solving and boundary value enumeration, without needing to call the large language model.

[0122] For integer overflow targets, apply bit-width boundary values ​​(such as MAX_INT±1, MIN_INT±1) to the operand fields of the relevant operations to perform targeted perturbations. This represents the unit increment or decrement of the disturbance based on the maximum or minimum representable value.

[0123] By incorporating vulnerability type information into the representation layer of constraint signatures, this module achieves an upgrade from general constraint-driven generation to type-aware targeted generation, avoiding the waste of resources caused by applying the same strategy to vulnerabilities of different natures.

[0124] Based on the above embodiments, in an optional embodiment of the present invention, S5 includes: updating the state of the corresponding semantic cluster, historical failure samples, and effective modification strategies based on the execution results of the candidate seed. When the candidate seed expands the path coverage corresponding to the target semantic cluster, the input modification method corresponding to the candidate seed is recorded as an effective modification strategy. When the candidate seed does not expand the path coverage corresponding to the target semantic cluster, the candidate seed and its unmet constraints are written into the historical failure samples.

[0125] Specifically, this module reuses historical failure samples and effective modification strategies from the memory module to continuously optimize the generation quality across iterations.

[0126] The agent-driven semantic clustering directional fuzzy testing method of the present invention has the following significant advancements.

[0127] Eliminating interference from mutually exclusive constraints and improving the accuracy of target decomposition: By using fine-grained semantic clustering within functions based on constraint consistency, target points that were originally mixed in the same function are divided according to pre-existing constraints, so that logically mutually exclusive targets are separated into different semantic clusters. Therefore, the fuzzing process no longer repeatedly tries between contradictory conditions, but instead continuously explores around the direction of consistent constraints, thereby improving the accuracy of target decomposition and the efficiency of path approximation.

[0128] To achieve constraint-driven targeted generation and improve the reachability of complex conditions: By introducing the constraint signatures of semantic clusters and the constraints of the calling context into the seed generation process, input generation is transformed from traditional random mutation to constraint-based targeted construction. For key predicate conditions, only relevant input fields are locally modified, thereby increasing the probability that the generated input satisfies the target path conditions, reducing invalid attempts at complex validation conditions, and improving the reachability of deep paths.

[0129] State-aware on-demand scheduling reduces overall computational overhead: By introducing semantic cluster-level state modeling and a shared memory mechanism, the exploration progress of each semantic cluster is continuously tracked, and the targeted generation process is activated only when path exploration stalls are detected. Compared to methods that uniformly perform deep analysis on all targets, this invention significantly reduces the triggering frequency of high-cost analysis and generation operations, effectively controlling computational resource consumption while ensuring test results, and improving the system's scalability in large-scale multi-target scenarios.

[0130] Theoretically Guaranteed Adaptive Scheduling Reduces Cumulative Regret: Multi-Armed Bandit (MAB) Scheduling Strategy The upper limit of the cumulative regrets in the total round of testing is Theoretically, this ensures that the system will not waste more than an order of magnitude of testing budget on low-value semantic clusters. The adaptive threshold mechanism for stagnation determination in Exploration Entropy Score (EES) dynamically adjusts the trigger sensitivity based on constraint complexity, reducing false triggers while preserving sufficient exploration of difficult target regions. Compared to fixed-round determination, it has higher determination accuracy in complex constraint scenarios.

[0131] Vulnerability type-aware generation improves the triggering efficiency of high-risk targets: Vulnerability Signature Taxonomy (VST) explicitly encodes the constraint structure differences of five major memory security vulnerabilities into the generation process. For time-constrained targets such as UAF and Double-Free, sequence-aware generation is used, and for numerical out-of-bounds targets, arithmetic solution is used instead of large language model calls. While reducing unnecessary agent call overhead, the generation strategy is matched with the fundamental triggering conditions of the target vulnerability, further improving the discovery efficiency of high-risk vulnerabilities.

[0132] The agent-driven semantic clustering directional fuzzy testing method of the present invention is applicable to the security assessment of large-scale software written in memory-unsafe languages ​​such as C, C++, and Rust.

[0133] The agent-driven semantic clustering directional fuzzy testing method of the present invention is applicable to the following typical application scenarios.

[0134] Vulnerability Discovery in Complex Protocol Parsers: Network protocol parsers typically contain strict format validation and multi-layered nested state machine logic, making it difficult for traditional fuzzing to generate valid protocol inputs. This method, through an intelligent agent understanding the protocol specifications and generating compliant inputs, can penetrate the format validation layer to reach deep processing logic, effectively discovering memory safety vulnerabilities hidden behind the normal parsing process.

[0135] Security testing of operating system kernel drivers: The input interface of kernel drivers often involves multiple gating conditions such as device control code matching and permission checks. This method separates the processing logic corresponding to different control codes into independent targets through semantic clustering, and combines it with an intelligent agent to generate inputs that meet the gating conditions, thereby improving the efficiency of kernel-level vulnerability discovery.

[0136] Large-scale vulnerability verification for supply chain software: In software supply chain security scenarios, known vulnerabilities in upstream components can affect a large number of downstream projects. This method, through efficient multi-target targeting capabilities, can trigger verification on each batch of labeled suspicious vulnerability points, assisting security teams in quickly assessing the scope of vulnerability impact.

[0137] Example 2: This invention provides an agent-driven semantic clustering directional fuzzy testing device, which includes a processor, a memory, and a computer program stored in the memory. The computer program can be executed by the processor to implement an agent-driven semantic clustering directional fuzzy testing method as described in any paragraph of Example 1.

[0138] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An agent-driven semantic clustering directional fuzzy testing method, characterized in that, include: S1. Obtain the set of target points in the program to be tested, and merge the set of target points according to their respective functions to obtain a set containing the target functions; S2. Before fuzz testing starts: Based on the control flow graph of each objective function in the set containing objective functions, extract the key predicates that affect the reachability of the objective point, generate constraint signatures for each objective point, and divide semantic clusters according to the consistency, mutual exclusion and inclusion relationship between the constraint signatures, and then combine the pre-constraints of the call point to obtain the combined constraint signatures of each semantic cluster. S3. During the fuzz test: Based on the combined constraint signature of each semantic cluster, the seeds are matched, filtered and mutation energy is allocated. The directional fuzz test is executed with the semantic cluster as the scheduling unit. The running status of each semantic cluster is updated according to the execution feedback and it is determined whether the target semantic cluster has entered a stagnant state. S4. When it is determined that the target semantic cluster has entered a stagnant state: based on the combined constraint signature of the target semantic cluster, the execution path of the current seed and the unmet constraints, the input is adjusted to generate a candidate seed, and the candidate seed is executed. S5. Based on the execution results of the candidate seeds, update the state of the corresponding semantic cluster, historical failure samples, and effective modification strategies to continue the iterative execution of S3 and S4.

2. The agent-driven semantic clustering directional fuzzy testing method according to claim 1, characterized in that, S2 include: S201. Read each control flow graph containing the objective function, and based on the distribution of the objective points in the control flow graph, identify candidate conditional predicates that can divert different objective points to different control regions. S202. When different branches of the same conditional predicate contain target points, the conditional predicate is identified as a candidate key predicate. S203. When all the relevant target points of the same conditional predicate are located within the same branch control region, the conditional predicate shall be removed from the candidate key predicates. S204. Perform input relevance identification on the candidate key predicates, and retain only the candidate key predicates that have data dependencies on external inputs as key predicates; S205. For each target point, extract the branch values ​​of the target point on each key predicate, and combine the branch values ​​according to the correspondence between the key predicate identifier and the value to obtain the constraint signature of the target point. S206. When multiple target points have the same branch value on a shared key predicate, the multiple target points are assigned to the same semantic cluster. S207. When multiple target points have opposite branch values ​​on any shared key predicate, the multiple target points are divided into different semantic clusters; S208. When the constraint signature of the first target point contains all the constraints in the constraint signature of the second target point, the first target point and the second target point are assigned to the same semantic cluster, and the constraint signature with more complete constraints is used as the representative constraint signature of the semantic cluster.

3. The agent-driven semantic clustering oriented fuzzy testing method according to claim 2, characterized in that, S2 also includes: S209, For functions containing objective functions target point set Construct a constraint conflict graph Among them, if a key predicate exists... , so that reaching the first Target points Need to meet And reached the Target points Need to meet Or conversely, at the target point With the target point Add conflict-constrained edges between them and assign edge weights. Define the target point With the target point The minimum number of mutually exclusive key predicates; S210. Equivalent to a constraint conflict graph for legal semantic partitioning. Color the valid graph and use chromatic numbers. This serves as a lower bound on the minimum number of semantic clusters required to complete the conflict-free objective decomposition. in, For the first One target point; Represents the set of conflicting edges; Represents the edge weight function; Representing a constraint conflict diagram color number.

4. The agent-driven semantic clustering oriented fuzzy testing method according to claim 3, characterized in that, S2 also includes: S211. Extract the pre-constraints of the call point formed by the upper-level branch conditions controlled by the call statement of the function where the target semantic cluster is located; attach the pre-constraints of the call point to the representative constraint signature of the target semantic cluster to obtain the combined constraint signature of the target semantic cluster. S212. Use a greedy coloring algorithm to process the constraint conflict graph. The solution is performed, and the semantic cluster to which each target point belongs is determined based on the solution results. The priority weight of each semantic cluster is initialized based on the edge weight in the constraint conflict graph, which serves as the initial input of the semantic cluster scheduling module.

5. The agent-driven semantic clustering oriented fuzzy testing method according to claim 1, characterized in that, S3 include: S31. Obtain the branch conditions traversed by the seed in the current execution path; where the seed refers to the test input sample in the fuzz test; match the branch conditions with the constraint signatures of each semantic cluster to obtain the constraint matching results of each seed relative to each semantic cluster; based on the constraint matching results, preferentially select the seed that satisfies more pre-constraints on the target semantic cluster, and allocate higher mutation energy to the selected seed. S32. First, match the branch condition with the pre-constraints of the call point of the target semantic cluster to determine whether the seed satisfies the external call condition for entering the target function; if the seed satisfies the external call condition, then match the branch condition with the representative constraint signature of the target semantic cluster to determine the degree to which the seed satisfies the internal constraints of the target semantic cluster. S33. When a newly executed seed successfully expands the path coverage of the target semantic cluster, the target semantic cluster is restored to the normal exploration state; when multiple rounds of seed execution still fail to expand the path coverage of the target semantic cluster, the scheduling priority of the target semantic cluster is reduced, and computing resources are reallocated to other semantic clusters.

6. The agent-driven semantic clustering oriented fuzzy testing method according to claim 5, characterized in that, S3 also includes: S34. Based on the execution feedback of the same semantic cluster in multiple consecutive rounds of scheduling, construct the execution path branch frequency distribution of the semantic cluster in the current round, and calculate the exploration entropy score of the semantic cluster; when the exploration entropy score is lower than the adaptive threshold of the semantic cluster, and the constraint satisfaction progress of the semantic cluster is lower than the preset threshold, it is determined that the semantic cluster has entered a stagnant state. ； in, Semantic clusters In the The exploration entropy score of the wheel; Indicates the first A semantic cluster; Indicates the current round number; Represents Shannon entropy; Indicates the first Frequency distribution of execution path branches in a round; This indicates backtracking relative to the current round. Frequency distribution of execution path branches corresponding to the round; Indicates the size of the sliding window; S35. Treat each semantic cluster as an optional arm, and treat each round of semantic cluster selection as an arm selection operation; after selecting a target semantic cluster and completing the mutation energy allocation, calculate the reward value of the target semantic cluster based on the number of newly added path coverages, the number of newly satisfied key predicates, and the number of successfully triggered targets in this round of scheduling: ； in, Indicates the first Semantic clusters in round-robin scheduling The reward value; Indicates the scheduling round; This is a coefficient representing the number of newly added path coverages. The coefficient for the number of new key predicates; A coefficient representing the number of times the target can be successfully triggered; S36. Update the scheduling priority of the target semantic cluster based on the reward value, and determine the semantic cluster to be scheduled in the next round using the UCB1-Tuned formula; before the first execution of the UCB1-Tuned formula, set the initial prior reward based on the priority weight of each semantic cluster and the vulnerability type severity of the target point corresponding to each semantic cluster.

7. The agent-driven semantic clustering oriented fuzzy testing method according to claim 1, characterized in that, S4 include: S41. Obtain the execution path corresponding to the current seed and extract the branch conditions that have been satisfied by the execution path; compare the satisfied branch conditions with the combined constraint signature of the target semantic cluster item by item to determine the key predicate constraints that have not yet been satisfied, and obtain the set of unsatisfied constraints; based on the set of unsatisfied constraints, determine the key branch conditions that prevent the current seed from reaching the target semantic cluster. S42. Based on the data dependency relationship between the set of unsatisfied constraints and the input, locate the key fields or byte ranges in the input that correspond to each unsatisfied constraint, and perform targeted value modification on the key fields when the unsatisfied constraint corresponds to a numerical relationship or a pattern matching relationship; and perform consistency correction on the overall structure of the input when the unsatisfied constraint corresponds to a length relationship or a structural relationship. S43. When the combined constraint signature of the target semantic cluster contains a pre-constraint of the call point, the input is adjusted first based on the pre-constraint of the call point so that the execution path corresponding to the current seed enters the target function. After entering the target function, the key fields or byte ranges in the input are further adjusted based on the representative constraint signature of the target semantic cluster to meet the internal constraints of the target function. S44. Perform vulnerability type awareness generation based on the Sanitizer instrumentation type of the trigger target semantic cluster; when the Sanitizer instrumentation type corresponds to UAF or Double-Free, identify unmet constraints as temporal constraints and generate candidate seeds based on the "allocation-release-use" operation sequence; when the Sanitizer instrumentation type corresponds to buffer overflow, identify unmet constraints as boundary constraints and calculate the critical values ​​of key fields based on arithmetic solutions and boundary value enumeration to generate candidate seeds; when the Sanitizer instrumentation type corresponds to integer overflow, identify unmet constraints as bit-width boundary constraints and apply bit-width boundary value perturbation to the operand segments of related operations to generate candidate seeds. Among them, the operand field is set to or ; This represents the maximum representable value of the target integer type. The smallest representable value of the target integer type.

8. The agent-driven semantic clustering oriented fuzzy testing method according to any one of claims 1 to 7, characterized in that, S5 includes: updating the state, historical failure samples, and effective modification strategies of the corresponding semantic cluster based on the execution results of the candidate seed; when the candidate seed expands the path coverage corresponding to the target semantic cluster, recording the input modification method corresponding to the candidate seed as an effective modification strategy; when the candidate seed does not expand the path coverage corresponding to the target semantic cluster, writing the candidate seed and its unmet constraints into the historical failure samples.

9. The agent-driven semantic clustering oriented fuzzy testing method according to any one of claims 1 to 7, characterized in that, S1 specifically involves: obtaining potential vulnerability points marked by static analysis reports or Sanitizer instrumentation as target points in the target point set, and merging the target points according to the function identifier to which each target point belongs, to obtain multiple subsets containing target functions and the target point subsets corresponding to each target function.

10. An agent-driven semantic clustering directional fuzzy testing device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory; the computer program can be executed by the processor to implement the agent-driven semantic clustering directional fuzzy testing method as described in any one of claims 1 to 9.

Images