A heterogeneous parallel fuzzing test system and method based on coverage sharing

Abstract

Embodiments of the present application provide a heterogeneous parallel fuzzing system and method based on coverage sharing. A central dispatcher coordinates multiple heterogeneous (AFL, MOPT, Fairfuzz) fuzzers, and the coverage data of each fuzzer is uniformly shared. The sharing method is to use a coverage mapping file (bitmap) as a heterogeneous fuzzer coverage representation. Two key problems are mainly solved: one is to break through the technical limitations of a single tool through the cooperation of heterogeneous fuzzers; the other is to realize cross-tool collaborative optimization through unified coverage representation and sharing mechanism.

Description

Technical Field

[0001] This invention belongs to the field of software testing technology, specifically relating to a heterogeneous parallel fuzz testing system and method based on coverage sharing. Background Technology

[0002] Fuzzing, as a dynamic vulnerability discovery method, involves injecting large amounts of unstructured or semi-structured input data into a target program and observing its abnormal behavior to discover potential vulnerabilities. With increasing software complexity, the inefficiency of traditional random fuzzing has become increasingly apparent, necessitating the exploration of optimized new fuzzing frameworks.

[0003] Coverage-guided testing and strategy optimization have become key technological directions, aiming to improve code exploration efficiency through dynamic feedback and algorithmic improvements. The following three tools represent significant technological innovations in the field of fuzzing: AFL optimizes testing direction through genetic algorithms and path feedback; FairFuzz focuses on balancing the deep logical branches of the coverage program; and MOPT utilizes swarm intelligence algorithms to improve mutation strategies. Together, these three have driven breakthroughs in the accuracy and efficiency of fuzzing in vulnerability discovery.

[0004] AFL (American Fuzzy Lop): AFL's core technology is to discover software vulnerabilities through genetic algorithms and coverage-guided fuzzing. It monitors the program's execution path, records the code coverage triggered by inputs, and prioritizes inputs that can trigger new paths for mutation, thereby gradually exploring more code regions and increasing the probability of discovering vulnerabilities.

[0005] FairFuzz: FairFuzz's core technology focuses on testing code paths that are difficult to trigger in a program. It identifies less frequently triggered branches by analyzing the impact of input on program branches and prioritizes generating input that can trigger these branches. This approach provides fairer coverage of all parts of the program and is particularly suitable for testing complex conditional branches.

[0006] MOPT: The core technology of MOPT is to optimize the mutation strategy in fuzzing. It introduces the Particle Swarm Optimization (PSO) algorithm to dynamically adjust the probability distribution of mutation operations, thereby generating inputs that can trigger program vulnerabilities more efficiently. MOPT aims to improve the efficiency and vulnerability discovery rate of fuzzing, especially when dealing with complex programs.

[0007] Existing fuzz testing methods mainly suffer from the following drawbacks: 1) The mutation strategy and scheduling algorithm of a single fuzzer (such as AFL) have limitations and are difficult to cover all code paths.

[0008] 2) In traditional parallel fuzzing, resource competition is fierce among similar fuzzer instances, resulting in high coverage repetition.

[0009] 3) The coverage data of heterogeneous fuzzers (such as AFL, MOPT, FairFuzz) are isolated and cannot be used to collaboratively optimize test efficiency.

[0010] In view of this, the present invention is hereby proposed. Summary of the Invention

[0011] The purpose of this invention is to overcome the shortcomings of the prior art and provide a heterogeneous parallel fuzzing system and method based on coverage sharing. This system coordinates multiple heterogeneous fuzzers (AFL, MOPT, Fairfuzz) through a central scheduler, unifying and sharing the coverage data of each fuzzer. The sharing is achieved through a coverage mapping file (bitmap) representing the coverage of the heterogeneous fuzzers. This invention primarily addresses two key issues: first, overcoming the technical limitations of single tools through heterogeneous fuzzer collaboration; and second, achieving cross-tool collaborative optimization through a unified coverage representation and sharing mechanism.

[0012] To achieve the above objectives, the present invention provides the following technical solution: According to a first aspect of the present invention, a heterogeneous parallel fuzz testing system based on coverage sharing is proposed, comprising: A central scheduler is used to dynamically allocate test tasks and manage test cases generated by multiple heterogeneous fuzzers. The central scheduler is connected to each heterogeneous fuzzer and is used to receive coverage mapping files and seed files sent by the heterogeneous fuzzers and distribute them to other heterogeneous fuzzers. The coverage sharing module, coupled with the central scheduler, is used to maintain global coverage information and support the real-time reading and writing of the global coverage information by the multiple heterogeneous fuzzers. The heterogeneous fuzzer layer contains at least two or more heterogeneous fuzzers. The heterogeneous fuzzers interact with the central scheduler through the coverage sharing module to guide their respective mutation directions based on the shared coverage information.

[0013] According to a second aspect of the present invention, a heterogeneous parallel fuzzing method based on coverage sharing is proposed, employing the aforementioned heterogeneous parallel fuzzing system based on coverage sharing, comprising the following steps: Step S1: Multiple heterogeneous fuzzers generate test cases based on their respective advantageous strategies; Step S2: Execute the test cases generated in step S1. All heterogeneous fuzzers submit the newly generated coverage information to the central scheduler for sharing in real time. Step S3: When any heterogeneous fuzzer discovers a new path, the fuzzer compresses the current bitmap using a coverage compression algorithm, and encapsulates the compressed bitmap data and the corresponding test seed into a data packet and sends it to the central scheduler. Step S4: The central scheduler receives the data packet and determines whether it is a new path by comparing the difference between the current compressed bitmap array and the historical bitmap array; if so, the new path information is updated to the scheduler database; if not, the data packet is discarded. Step S5: Before each test execution, each heterogeneous fuzzer requests the central scheduler to check if a new path has been discovered; Step S6: If a new path is discovered, the heterogeneous fuzzer downloads the corresponding compressed bitmap array and test seed from the central scheduler and restores the original bitmap. Step S7: Compare the restored bitmap with the bitmap of the current blurr itself. If it is determined that a new path has been triggered under the current blurr, add the corresponding test seed to the seed queue of the blurr.

[0014] In one possible embodiment, in step S1, the dominant strategy includes AFL's genetic algorithm, MOPT's mutation parameter optimization, and FairFuzz's low-frequency path exploration.

[0015] In one possible embodiment, in step S3, the heterogeneous fuzzer compresses the current bitmap into a one-dimensional array with each element occupying 4 bytes using a coverage compression algorithm, and then sends the binary string of the array to the upload coverage API interface of the central scheduler using the POST method of the HTTP protocol, while simultaneously uploading the associated seed file to the upload seed API interface of the central scheduler.

[0016] In one possible embodiment, in step S4, the scheduler database is used to store seed and coverage information corresponding to new paths confirmed by the central scheduler.

[0017] In one possible embodiment, in step S6, the specific method for restoring the original bitmap is as follows: initialize an all-zero bitmap, traverse the compressed bitmap array, and increment the value at the corresponding index position of the bitmap by one.

[0018] In one possible embodiment, step S7 further includes triggering other blurrs to adjust their mutation strategies for the uncovered areas; In step S7, triggering other heterogeneous fuzzers to adjust their respective mutation strategies based on the uncovered regions in the global coverage information specifically includes: the heterogeneous fuzzers identify uncovered code regions from the global coverage information obtained from the central scheduler, add the seeds corresponding to the uncovered region information to the seed queue, perform a test using the seed, and then evaluate the test to instruct the heterogeneous fuzzers to increase the exploration of the uncovered regions or adjust their mutation strategies.

[0019] According to a third aspect of the invention, a computer-readable storage medium is provided on which a computer program is stored, which, when executed by a processor, implements the method described above.

[0020] According to a fourth aspect of the present invention, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.

[0021] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects: The benefits and advantages of this invention lie in its design of a central scheduler to coordinate multiple heterogeneous fuzzers, unifying and sharing the coverage data of each fuzzer, and designing a heterogeneous parallel fuzz testing system and method. Through heterogeneous and parallel strategies, coverage sharing is achieved, significantly improving coverage and fuzz testing efficiency compared to a single fuzz testing tool. The system and method designed in this invention have the following benefits and advantages: Improved coverage: Heterogeneous fuzzers complement each other to cover blind spots, and a shared pool reduces redundant testing.

[0022] Vulnerability discovery efficiency: Through dynamic scheduling, resources are tilted towards high-potential fuzzers.

[0023] The beneficial effects of this invention are as follows: Heterogeneous collaboration: Through the central scheduler and coverage sharing module, fuzzers with different architectures and advantages, such as AFL, MOPT, and FairFuzz, are organically combined to form a high-efficiency parallel testing system. Each fuzzer can use the path information discovered by other fuzzers to guide its own mutation, achieving a synergistic effect of "1+1>2".

[0024] Global coverage guidance: Real-time sharing of global coverage is achieved, enabling a single fuzzer to perceive the coverage status of the entire testing process, thereby adjusting the mutation strategy in a targeted manner, avoiding repeated exploration, concentrating computing power to cover uncovered areas, and significantly improving path exploration efficiency and code coverage.

[0025] Efficient data interaction: By adopting a coverage compression algorithm and a path judgment mechanism based on difference, the amount of data transmission between the central scheduler and each fuzzer is reduced, communication overhead is lowered, and the stability and scalability of the system under high concurrency are ensured. Attached Figure Description The accompanying drawings are incorporated in and form part of this specification, and together with the description serve to explain the principles of the invention.

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a system composition diagram of the present invention; Figure 2 This is a flowchart of the process of the present invention; Figure 3. Schematic diagram of coverage sharing factor compression. Detailed Implementation

[0028] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples consistent with some aspects of the invention as detailed in the appended claims.

[0029] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0030] Example 1 like Figure 1 As shown, a heterogeneous parallel fuzz testing system based on coverage sharing includes: A central scheduler is used to dynamically allocate test tasks and manage test cases generated by multiple heterogeneous fuzzers. The central scheduler is connected to each heterogeneous fuzzer and is used to receive coverage mapping files and seed files sent by the heterogeneous fuzzers and distribute them to other heterogeneous fuzzers. The coverage sharing module, coupled with the central scheduler, is used to maintain global coverage information and support the real-time reading and writing of the global coverage information by the multiple heterogeneous fuzzers. The heterogeneous fuzzer layer contains multiple heterogeneous fuzzers. These heterogeneous fuzzers interact with the central scheduler through the coverage sharing module to guide their respective mutation directions based on the shared coverage information.

[0031] Example 2 like Figure 2 As shown, a heterogeneous parallel fuzz testing method based on coverage sharing includes the following steps: 1. Heterogeneous Fuzzy Controller Collaboration Mechanism Different fuzzers generate test cases based on their respective advantages (such as AFL's genetic algorithm, MOPT's mutation parameter optimization, and FairFuzz's low-frequency path exploration). After executing the test cases, the fuzzer generates coverage information. The fuzzer will determine whether a new path has been found. If a new path is found, the coverage information will be compressed, and then the coverage information and seed file will be uploaded.

[0032] All fuzzers submit new coverage and seed files to the central scheduler in real time. Before a fuzzer executes the next round of testing, it downloads the coverage and seed files from the central scheduler and determines the coverage of the test case. If a new path is discovered, the test case will be used to execute a test. Then, the test case will be evaluated to trigger other fuzzers to adjust their mutation strategies for uncovered areas.

[0033] 2. Mutation Strategy Fusion By submitting new coverage and seed files from different fuzzers to a central scheduler for sharing, the coverage areas affecting test cases of other fuzzers are guided. This shared coverage and seed files from different fuzzers combine the dynamic mutation operator based on particle swarm optimization (PSO) in the MOPT framework with FairFuzz's low-frequency path exploration and AFL's coverage guidance mechanism to construct a hybrid mutation strategy. Integrating advanced seeds from multiple heterogeneous fuzzers into their respective seed queue scheduling, this fusion strategy significantly improves the mutation efficiency of fuzz testing, enabling faster breakthroughs of path constraints and triggering of deep vulnerabilities, while maintaining AFL's path coverage advantage.

[0034] 3. Coverage sharing implementation Design a central scheduler to provide corresponding interfaces for each fuzzing tool, including interfaces for uploading coverage, uploading torrents, and downloading coverage and torrents. It should be able to receive coverage bitmaps and torrent files sent by fuzzing tools and provide them to other fuzzing tools.

[0035] A network module is designed for each fuzzer. When it discovers a new path, it sends its coverage map (bitmap) and seed file to the scheduler. The current coverage map is compressed into a one-dimensional array with each element occupying 4 bytes using a coverage compression algorithm. The binary string of this array is then sent to the central scheduler's upload coverage interface via the HTTP POST method, and the associated seed file is uploaded to the central scheduler's upload seed interface at the same time. The module can also receive the coverage map (bitmap) and seed file from the scheduler. It calls the central scheduler's download coverage interface and download seed interface via the HTTP GET method, restores the received coverage to its own coverage map (bitmap), determines whether a new path has been discovered, and then adds the obtained seed file to the execution queue.

[0036] Example of heterogeneous fuzzer integration: AFL instance: Responsible for basic path exploration, generating high-quality seeds through a genetic algorithm.

[0037] MOPT Example: Using a mutation strategy based on particle swarm optimization to achieve targeted breakthroughs in complex conditional branches.

[0038] FairFuzz example: Prioritize testing low-frequency execution paths to avoid over-covering hotspot areas.

[0039] 4. Coverage sharing compression The default bitmap is a 64KB array, with each byte recording the hit count of the corresponding edge. This method extracts the positions of all non-zero values ​​in the original bitmap and forms a smaller data structure, significantly reducing storage space and improving coverage sharing efficiency.

[0040] The compression process is shown in Figure 3, and a compression example is shown below: Original trace_bit: Index: 01234567… Value: 03050020… The compressed array is: Traversing trace_bit, we find that the non-zero indices are 1, 3, and 6.

[0041] Generate a compressed array: 1,3,6 (stored as a u32 array, currently occupying 12 bytes).

[0042] The process of decompressing a bitmap compressed array using a fuzzer is as follows: First, an all-zero bitmap is initialized. Then, by traversing the compressed bitmap array, the values ​​at corresponding indices of the bitmaps are set to 1, thus restoring the original bitmap's hit state. The specific decompression process is shown below: 1) Retrieve the array from the server: 1,3,6 (Continuing with the compressed example, decompress the array). 2) Initialize all-zero trace_bit: Index: 000… Value: 000… 3) Traverse the compressed array and set the corresponding index to 1: trace_bit[1] = 1 trace_bit[3] = 1 trace_bit[6] = 1 4) The final restored trace_bit: Index: 01234567… Value: 01010010… 5. Coverage sharing process The coverage sharing process is as follows: 1) Coverage extraction and compression When a fuzzer discovers a new path, it compresses the bitmap using a coverage compression algorithm. Simultaneously, it encapsulates the current test seed and coverage data into a data packet, which is then sent to the scheduler via the central scheduler's upload coverage and upload seed interfaces.

[0043] 2) Coverage sharing The scheduler receives the uploaded coverage compressed bitmap array and seed. It determines whether a new path has been found by comparing the difference between the current compressed bitmap array and the previous bitmap array. If a new path is found, it is updated in the scheduler database. If no new path is found, it is discarded. This process maintains the scheduler's coverage advancement.

[0044] 3) Coverage Consolidation Before each test execution, each fuzzer sends a request to the scheduler to download the corresponding bitmap compressed array and seed. The fuzzer initializes an all-zero bitmap, and by traversing the compressed bitmap array, increments the value at the corresponding index of the bitmap to reconstruct the hit state of the original bitmap. By comparing the reconstructed bitmap with the current fuzzer's bitmap (trace_bit), it determines whether a new path has been triggered under that fuzzer. If so, the seed is added to the fuzzer's seed queue.

[0045] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention.

[0046] It should be understood that the present invention is not limited to the content already described above, and various modifications and changes can be made without departing from its scope. The scope of the present invention is limited only by the appended claims.

Claims

1. A heterogeneous parallel fuzz testing system based on coverage sharing, characterized in that, include: The central scheduler is used to dynamically allocate test tasks and manage test cases generated by multiple heterogeneous fuzzers. The central scheduler is connected to each heterogeneous fuzzer and is used to receive the coverage mapping file and seed file sent by the heterogeneous fuzzer and distribute them to other heterogeneous fuzzers. The coverage sharing module, coupled with the central scheduler, is used to maintain global coverage information and supports real-time reading and writing of the global coverage information by multiple heterogeneous fuzzers. The heterogeneous fuzzer layer contains multiple heterogeneous fuzzers. These heterogeneous fuzzers interact with the central scheduler through the coverage sharing module to guide their respective mutation directions based on the shared coverage information.

2. A heterogeneous parallel fuzzing method based on coverage sharing, employing the heterogeneous parallel fuzzing system based on coverage sharing as described in claim 1, characterized in that, Includes the following steps: Step S1: Multiple heterogeneous fuzzers generate test cases based on their respective advantageous strategies; Step S2: Execute the test cases generated in step S1. All heterogeneous fuzzers submit the newly generated coverage information to the central scheduler for sharing in real time. Step S3: When any heterogeneous fuzzer discovers a new path, the fuzzer compresses the current bitmap using a coverage compression algorithm, and encapsulates the compressed bitmap data and the corresponding test seed into a data packet and sends it to the central scheduler. Step S4: The central scheduler receives the data packet and determines whether it is a new path by comparing the difference between the current compressed bitmap array and the historical bitmap array; if so, the new path information is updated to the scheduler database; if not, the data packet is discarded. Step S5: Before each test execution, each heterogeneous fuzzer requests the central scheduler to check if a new path has been discovered; Step S6: If a new path is discovered, the heterogeneous fuzzer downloads the corresponding compressed bitmap array and test seed from the central scheduler and restores the original bitmap. Step S7: Compare the restored bitmap with the bitmap of the current blurr itself. If it is determined that a new path has been triggered under the current blurr, add the corresponding test seed to the seed queue of the blurr.

3. The heterogeneous parallel fuzz testing method based on coverage sharing according to claim 2, wherein in step S1, the advantageous strategies include AFL's genetic algorithm, MOPT's mutation parameter optimization, and FairFuzz's low-frequency path exploration.

4. In the heterogeneous parallel fuzzing method based on coverage sharing according to claim 2, in step S3, the heterogeneous fuzzer compresses the current bitmap into a one-dimensional array with each element occupying 4 bytes using a coverage compression algorithm, and then sends the binary string of the array to the upload coverage API interface of the central scheduler using the POST method of the HTTP protocol, while simultaneously uploading the associated seed file to the upload seed API interface of the central scheduler.

5. In the heterogeneous parallel fuzz testing method based on coverage sharing according to claim 2, in step S4, the scheduler database is used to store the seed and coverage information corresponding to the new path confirmed by the central scheduler.

6. In the heterogeneous parallel fuzzing test method based on coverage sharing according to claim 2, in step S6, the specific method for restoring the original bitmap is as follows: initialize an all-zero bitmap, traverse the compressed bitmap array, and increment the value at the corresponding index position of the bitmap by one.

7. The heterogeneous parallel fuzzing test method based on coverage sharing according to claim 2, wherein step S7 further includes triggering other fuzzers to adjust their mutation strategies for uncovered areas; In step S7, triggering other heterogeneous fuzzers to adjust their respective mutation strategies based on the uncovered areas in the global coverage information specifically includes: The heterogeneous fuzzer identifies uncovered code regions from the global coverage information obtained from the central scheduler, adds the seed corresponding to the uncovered region information to the seed queue, performs a test using the seed, and then evaluates the test to instruct the heterogeneous fuzzer to increase the exploration of the uncovered regions or adjust the mutation strategy.

8. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in any one of claims 2-7.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in any one of claims 2-7.

Images