Intelligent fuzzy testing method, device and system

Abstract

The present invention discloses an intelligent fuzzy testing method, device and system, which relates to the field of computer technology. The method comprises: converting input variables of a target to be tested into symbolic expressions through symbolic execution; constraining the execution path of the symbolic expressions of multiple input variables; generating test cases according to the constrained execution paths; executing the test cases, and obtaining the execution status and test data of the test cases. The embodiments of the present invention can solve the problem of low detection efficiency in existing fuzzy testing.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an intelligent fuzzy testing method, device and system. Background Art

[0002] Due to the existence of design vulnerabilities and software vulnerabilities in the power system, malicious attacks on the power cyber-physical system (power CPS) from the information side are likely to break through the protection measures and cause larger-scale disturbances and failures. Therefore, it is extremely necessary to discover the vulnerabilities of the current power CPS protocols and systems for the protection of power CPS.

[0003] At present, the means of security vulnerability detection in the Internet of Things has become mature, and the various technologies in it can also be used for vulnerability detection in power CPS. Its vulnerability detection technology is mainly divided into static analysis and dynamic analysis. The object of static analysis is mainly the target source code; the object of dynamic analysis is mainly executable binary files. Among them, the dynamic binary analysis solution mainly uses fuzz testing. The principle of fuzz testing is to input a large amount of deformed data into the target program, and discover possible security vulnerabilities in the program under test by monitoring the anomalies of the program under test. It is a typical automatic or semi-automatic process.

[0004] Although traditional fuzz testing can detect program vulnerabilities, the current vulnerability mining based on fuzz testing in the power Internet of Things is a black box test, that is, monitoring the test process and return results of the protocol server and client. This process will generate a large number of invalid samples, and this method does not collect any internal execution control flow and data flow information of the program during the input processing process, resulting in low code coverage. Low code coverage and a large number of invalid samples will lead to low test efficiency. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides an intelligent fuzzy testing method, device and system to solve the problem of low detection efficiency in existing fuzzy testing.

[0006] According to the first aspect, an embodiment of the present invention provides an intelligent fuzzy testing method, which includes: converting the input variables of the target under test into symbolic expressions through symbolic execution; performing execution path constraints on the symbolic expressions of multiple input variables; generating test cases according to the constrained execution paths; executing the test cases, and obtaining the execution status and test data of the test cases.

[0007] Optionally, the converting of the input variables of the target under test into symbolic expressions through symbolic execution includes: using the S2E platform to record the internal tainted data flow and program instruction control flow of the software of the target under test to obtain the input tainted variables; and obtaining the symbolic expression of the input tainted variables on the execution path through symbolic execution.

[0008] Optionally, the performing of execution path constraints on the symbolic expressions of the multiple input variables includes: generating deformation constraint conditions according to the symbolic expressions of the multiple input variables; and solving path constraints on the input tainted variables according to the deformation constraint conditions to obtain a specified code path.

[0009] Optionally, the intelligent fuzzy testing method also includes: using a test case knowledge base to provide a test case template, and generating a test case based on the test case template, the test case knowledge base includes a distortion database and a test case template library; the distortion database is used to provide distortion data, thereby generating distortion constraints; the test case template library is used to provide a test case template, thereby generating a test case.

[0010] Optionally, the intelligent fuzzy testing method also includes: during the execution of the test case, using a vulnerability detection algorithm to detect security vulnerabilities, and the detection process includes: detecting whether the released heap memory pointer is reused during the execution of the test case; if the released heap memory pointer is reused, it is determined that a security vulnerability exists.

[0011] Optionally, before detecting whether the released heap memory pointer is reused, the method also includes: intercepting the heap management API, monitoring the allocation and release of heap memory; tracking the propagation of pointers, matching the mapping relationship between pointers and the heap memory; and clearing all pointers corresponding to the heap memory to zero when the heap memory is released.

[0012] According to the second aspect, an embodiment of the present invention provides an intelligent fuzzy testing device, which includes: a variable processing module, used to convert the input variables of the target under test into symbolic expressions through symbolic execution; a path constraint module, used to perform path constraints on the execution path of the target under test according to the symbolic expression; a test case generation module, used to generate test cases according to the constrained execution path; and a comprehensive processing module, used to execute the test cases and obtain the execution status and test data of the test cases.

[0013] According to a third aspect, an embodiment of the present invention provides an intelligent fuzzy testing system, the system comprising: a comprehensive management subsystem, used to establish a fuzzy testing task according to a target under test; a test case knowledge base, used to provide distortion data and test case templates; a test case generation subsystem, used to generate test cases according to the test case templates, the test case generation subsystem comprising: a variable processing module, used to convert the input variables of the target under test into symbolic expressions through symbolic execution; a path constraint module, used to perform path constraints on the execution path of the target under test according to the symbolic expression; a test case generation module, used to generate test cases according to the constrained execution path; a comprehensive processing module, used to execute the test case and obtain the execution status and test data of the test case; a fuzzy testing engine, used to parse the test case, and use the S2E selective symbolic execution platform to execute the parsed test case; a test control subsystem, used to control the execution process of the test case, and obtain the execution status and test data of the test case; an exception verification subsystem, used to analyze software exceptions in the test data and analyze the exception triggering mechanism; a basic service platform, used to create a virtual machine cluster and use physical machine resources to execute the fuzzy testing task.

[0014] According to the fourth aspect, an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the intelligent fuzzy testing method of the first aspect and any embodiment of the first aspect by executing the computer instructions.

[0015] According to the fifth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the intelligent fuzzy testing method of the first aspect and any embodiment of the first aspect.

[0016] The embodiments of the present invention have at least the following advantages:

[0017] This embodiment uses symbolic execution to convert the input variables of the target under test into symbolic expressions, then solves the constraints, specifies the execution path of the test code, and uses a path constraint-based strategy to guide the generation of test cases. This can avoid path explosion during symbolic execution, reduce the data that needs to be symbolized, and improve code coverage, thereby improving vulnerability detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flow chart of an intelligent fuzzy testing method provided by an embodiment of the present invention is shown;

[0020] Figure 2 is a flow chart of a test case generation process according to an embodiment of the present invention;

[0021] Figure 3 is a diagram of an S2E architecture according to an embodiment of the present invention;

[0022] Figure 4 is a schematic diagram of a process of abstracting a power system communication protocol into a protocol structure according to an embodiment of the present invention;

[0023] Figure 5 is a schematic diagram of the structure of an intelligent fuzzy testing device according to an embodiment of the present invention;

[0024] Figure 6 is an architecture diagram of an intelligent fuzzy testing system according to an embodiment of the present invention;

[0025] Figure 7 is an example distribution architecture diagram of the S2E plug-in provided in an embodiment of the present invention;

[0026] Figure 8 It is a physical machine architecture diagram of the basic service platform provided by an embodiment of the present invention.

[0027] Fig. 9 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0029] The so-called symbolic execution, which is to use symbolic values ​​instead of real values ​​for execution, is an important formal method and software analysis technology. Its main platform is Selective Symbolic Execution, S2E platform. By using symbolic execution technology, the value of the variable in the program is represented as a calculation expression composed of symbolic values ​​and constants, and the output of the program calculation is represented as a function of the input symbolic value. It plays an important role in software testing and program verification. Based on this, this embodiment provides an intelligent fuzz testing method, which uses symbolic execution to perform fuzz testing. The specific method includes establishing a test task according to the target software under test, selecting a test case generation template according to the data type or protocol of the target under test, generating a test case according to the test case generation template, executing the test case and performing data control on the execution process of the test case.

[0030] Among them, since the current software has a large amount of code, the corresponding execution paths and the number of states will grow exponentially during fuzz testing. In order to avoid path explosion during symbolic execution and reduce the data that needs to be symbolized, refer to Figure 1 As shown, the intelligent fuzzy testing method of this embodiment includes the following steps:

[0031] Step S1: converting the input variables of the target under test into symbolic expressions through symbolic execution;

[0032] Specifically, for example, the S2E platform can be used to record the internal tainted data flow and program instruction control flow of the software of the target under test to obtain the input tainted variables; and the symbolic expression of the input tainted variables on the execution path can be obtained through symbolic execution.

[0033] Among them, the record of the tainted data flow can be expressed as recording the detailed information of the program execution path of the software of the target under test (such as registers, memory, variables, instructions, etc.), and using symbolic execution and forward taint propagation technology to collect sensitive path information and sensitive data propagation information in the execution trajectory, and obtain tainted variables based on the propagation information of sensitive data.

[0034] This step improves the efficiency of vulnerability detection by performing symbolic calculations on the input variables of multiple targets under test and by recording the internal tainted data flow and program instruction control flow of the software of the target under test.

[0035] Step S2: performing execution path constraints on the symbolic expressions of multiple input variables;

[0036] The input variables converted into symbolic expressions in the multi-path step S1 are obtained, and deformed constraints are generated according to the symbolic expressions of the multi-path input variables; according to the deformed constraints, the path constraints of the input tainted variables are solved to obtain the specified code path. That is, by deforming the multiple execution paths, the test case generation task is executed according to the specified code path, that is, the strategy based on the tainted variable constraint solution is used to guide the generation of test cases, which can reduce the data that needs to be symbolized and avoid path explosion.

[0037] Step S3: Generate test cases according to the constrained execution path;

[0038] Specifically, the generation of test cases needs to be implemented according to test case templates. This embodiment uses a test case knowledge base to provide test case templates and generates test cases based on the test case templates. The test case knowledge base includes a distortion database and a test case template library; the distortion database is used to provide distortion data, thereby generating distortion constraints; the test case template library is used to provide test case templates, thereby generating test cases.

[0039] In actual applications, testers can choose to generate different templates according to the different input data formats or protocols of the tested targets, and define the state model, data model and different distortion libraries of software testing through XML script styles and configure corresponding generation strategies to automatically generate batches of test cases. Test cases for data formats include two major categories: file input and data packet input. The file input template includes common document, video and image file formats such as doc, xls, ppt, pdf, jpg, png, wmv, MP3, etc. The input template for network protocol test cases supports mainstream communication protocols such as UDP, TCP, HTTPS, FTP, SMTP / POP3 and DNS. According to the distortion methods contained in the distortion library corresponding to each test template, and the test case generation strategy corresponding to the distortion method is configured to automatically generate batches of test cases.

[0040] Optionally, test cases can also be generated according to a mutation-based test case generation strategy, a generation-based test case generation strategy, or a self-feedback-based test case generation strategy, or a combination of any two of the above mutation-based test case generation strategy, generation-based test case generation strategy, or self-feedback-based test case generation strategy, or a combination of all three. A mutation-based test case generation strategy generates new test cases by mutation based on known data samples; a generation-based test case generation strategy generates test cases by modeling based on known protocols or interface specifications; and a self-feedback-based test case generation strategy uses the instruction execution path information of the test process and uses a genetic algorithm to optimize the generation of input data so that it covers the entire program as much as possible.

[0041] Detailed test case generation process reference Figure 2 The S2E platform solves the path constraints of the symbolic execution results to obtain the specified execution path. According to the specified execution path, multiple test cases are automatically generated using the test case template, that is, the generation of test cases is guided by the strategy based on tainted variable constraint solving. Optionally, test cases can also be generated by mutation-based, generation-based, and self-feedback-based test case generation strategies, and then the test cases are input into the QEMU test environment built by the S2E platform for execution.

[0042] Step S4: Execute the test case and obtain the execution status and test data of the test case.

[0043] After the test case is generated, the content of the test case needs to be parsed, and the relevant test parameters need to be set. Then the parsed test case is sent to the Qemu test environment built by S2E for execution. The S2E architecture is as follows: Figure 3As shown in the figure, the S2E platform uses the QEMU virtual machine, the symbolic execution engine KLEE, and the LLVM symbolic chain to access symbolic data, connects data through the S2E selection interface and the S2E analysis interface, and uses the plug-in to specify the target code and analyze the target code. Specifically, the target application under test runs in the QEMU virtual machine, drives the operating system kernel by calling library functions, and performs dynamic binary translation of the tested program through the dynamic binary translator, and executes the translated TCG intermediate language, including specific mode and symbolic mode. When executing the specific mode, the TCG intermediate language is converted into the host machine code, and the specific mode data is executed by the host CPU; when executing the symbolic mode, the TCG intermediate language is converted into LLVM bytecode, and the KLEE symbolic execution engine is used to execute the symbolic data; at the same time, by redirecting the read and write operations in the QEMU and KLEE execution engines to the shared virtual machine memory state, virtual CPU state, and virtual device state, the state sharing is realized, so that S2E can perform data conversion between specific execution and symbolic execution, and provide different state backups for different execution paths.

[0044] Taking the mining of power system communication protocol vulnerabilities as an example, the fuzzy test object is: the communication protocol parsing module in the power industrial control system and the terminal. The purpose is to test whether there are vulnerabilities in the implementation of the power system communication protocol by the tested object. The mining process is as follows:

[0045] Abstract the power system communication protocol into a protocol structure, such as Figure 4 As shown, the process of describing protocol structure recognition mainly includes: using type matching to extract the same type of message sequences from different network traffic data files (PCAP) in the local historical network traffic, and treating them as a message group; multiple sequence alignment message combination, and separation of invariant domains and variable domains to preliminarily divide the message domain; message area recognition, further obtaining the ANSII string domain, thereby generating a more accurate message format and test data, and using fuzzy testing tools and more accurate message formats and test data to perform fuzz testing on the target under test. Specifically, the tester selects the corresponding data template based on the above-abstracted protocol structure description, and defines the state model, data model and different distortion libraries of the software test through XML-style script style and configures different generation strategies to automatically generate batches of test cases, and execute the above test cases.

[0046] In addition, during the execution of the test case, this embodiment provides a detection algorithm for common vulnerability types such as memory release reuse vulnerability, integer overflow vulnerability, buffer overflow vulnerability, etc. The specific process of using the vulnerability detection algorithm to detect security vulnerabilities includes:

[0047] During the execution of the test case, it is detected whether the released heap memory pointer is reused. If the released heap memory pointer is reused, it is determined that a security vulnerability exists, thereby detecting possible security vulnerabilities.

[0048] Taking the memory release reuse vulnerability as an example, the detection method includes: intercepting the heap management API, monitoring the allocation and release of heap memory; tracking the propagation of pointers, matching the mapping relationship between pointers and the heap memory; clearing all pointers corresponding to the heap memory when the heap memory is released. If the released heap memory pointer, i.e., the floating pointer, is reused during the execution of the test case, it indicates that the current test case can trigger a security vulnerability.

[0049] This embodiment uses symbolic execution to convert the input variables of the target under test into symbolic expressions, then solves the constraints, specifies the execution path of the test code, and uses a path constraint-based strategy to guide the generation of test cases. This can avoid path explosion during symbolic execution, reduce the data that needs to be symbolized, and improve code coverage.

[0050] Furthermore, this embodiment provides an intelligent fuzzy testing device, referring to Figure 5 , the device comprises:

[0051] The variable processing module 01 is used to convert the input variables of the target under test into symbolic expressions through symbolic execution; this module executes the method described in step S1 in the above embodiment, which will not be repeated here.

[0052] The path constraint module 02 is used to constrain the execution path of the target under test according to the symbolic expression; this module executes the method described in step S2 of the above embodiment, which will not be repeated here.

[0053] The test case generation module 03 is used to generate a test case according to the constrained execution path; this module executes the method described in step S3 of the above embodiment, which will not be described in detail here.

[0054] The comprehensive processing module 04 is used to execute the test case and obtain the execution status and test data of the test case. This module executes the method described in step S4 of the above embodiment, which will not be repeated here.

[0055] It should be noted that the comprehensive processing module includes the Qemu test environment built using S2E in the intelligent fuzzy testing system of the following embodiment to execute test cases, and a test management and control subsystem for obtaining the execution status and test data of the test cases.

[0056] This embodiment uses symbolic execution to convert the input variables of the target under test into symbolic expressions, then solves the constraints, specifies the execution path of the test code, and uses a path constraint-based strategy to guide the generation of test cases. This can avoid path explosion during symbolic execution, reduce the data that needs to be symbolized, and improve code coverage.

[0057] Furthermore, this embodiment provides an intelligent fuzzy testing system, referring to Figure 6 The system includes: comprehensive management subsystem 05, test case knowledge base 06, test case generation subsystem 07, fuzzy testing engine 08, test management and control subsystem 09, abnormal verification subsystem 10 and basic service platform 11.

[0058] Specifically, the comprehensive management subsystem 05 is used to establish a fuzzy test task according to the target to be tested. The comprehensive management subsystem 05 includes a test management module 12, a configuration management module 13, an operation management module 14, a user management module 15, a knowledge base management module 16 and a log management module 17.

[0059] The test management module 12 is used to manage fuzzy test tasks, establish test tasks, and allocate memory, storage or CPU system resources to test tasks;

[0060] Configuration management module 13, used to configure the test case generation subsystem, specify the test case generation strategy of the fuzz test according to the characteristics of the target under test, and configure the fuzz test engine to complete the test work;

[0061] The operation management module 14 is used to schedule fuzz test tasks, perform operation management such as pausing, suspending, snapshotting, and restarting the virtual machine of the running fuzz test, and receive and collect the internal operation status of the equipment of the test control subsystem, and collect and display the fine-grained operation information status;

[0062] User management module 15, used to manage, register, and deregister administrator and common user accounts;

[0063] The knowledge base management module 16 is used to manage the storage of test data and templates, and store distortion data and test case modules;

[0064] The log management module 17 is used to record and process the system operation information during the task execution process and display it to the user.

[0065] Specifically, the test case knowledge base 06 is used to provide distortion data and test case templates, reduce the redundancy of test cases as much as possible, improve code coverage, and thus improve the efficiency of fuzz testing. The knowledge base mainly includes a distortion database and a test case template library. The distortion database mainly includes a set of distortion data for common types of tainted variables such as string type, integer data type, Boolean type, floating point type, directory index, etc. The test case template library contains file templates for mainstream documents, pictures, and videos, mainly in doc, ppt, xls, jpg, png, wmv and other formats, and supports data packet format templates for mainstream communication protocols, mainly UDP, TCP, HTTPS, FTP, SMTP / POP3, DNS and other common TCP / IP protocols, and can support custom templates for communication protocols with unknown formats to carry out testing, support fine-grained definitions at the Bit and Byte levels, and support the use of common field types and similar checksum calculations in custom templates, and the calculation method can be customized.

[0066] Specifically, the test case generation subsystem 07 is used to generate test cases according to the test case template, and the test case generation subsystem includes the above-mentioned variable processing module 01, path constraint module 02 and test case generation module 03. Testers can choose to generate different templates according to the different input data formats or protocols of the test object, and define the state model, data model and different distortion libraries of the software test through XML-style script styles and configure different generation strategies to automatically generate batches of test cases. Selective symbolic execution is used to record the internal tainted data flow propagation and program instruction control flow of the tested software, so as to guide the generation of test cases and perform intelligent fuzzy testing.

[0067] Specifically, the fuzzy testing engine 08 is used to accept the test cases generated by the test case generation subsystem, parse the test cases, and execute the parsed test cases using the S2E selective symbolic execution platform; the fuzzy testing engine mainly includes a test case acceptance module 18, a description and parsing module 19, a test case sending module 20 and a test data acquisition module 21.

[0068] The test case receiving module 18 is used to receive relevant test cases;

[0069] Description parsing module 19 is used to parse the test case content and set relevant test parameters;

[0070] The test case sending module 20 is used to send the parsed test case to the Qemu test environment built by S2E for execution;

[0071] The test data collection module 21 is used to provide, in the form of a plug-in, a recording function of the execution path, state, related memory access, and code block execution data when an abnormal state occurs.

[0072] Specifically, the test control subsystem 09 is used to control the execution process of the test case, and collect and monitor the execution status of the test equipment to achieve fine-grained test control. The test control subsystem 09 includes a software status monitoring module 22, a software status recording module 23 and an exception capture module 24.

[0073] The software status monitoring module 22 is configured to monitor the running status of software modules such as loading and unloading by setting S2E operating system event monitor plug-ins such as WindowsMonitor, LinuxMonitor, OSMonitorInterface, RawMonitor, ModuleExecutionDetector, and StateManager.

[0074] Software status recording module 23: uses S2E analyzer plug-ins such as TranslationBlockTracer and InstructionCounter to record various path information, code block addresses, CPU register information and other data during software execution.

[0075] Exception capture module 24: Use ModuleTracer and Interceptor plug-ins to obtain debug information during the test process; use ExecutionTracer plug-in and customized Annotation plug-in to capture exceptions.

[0076] refer to Figure 7 , use multiple selector plug-ins to execute the test program, and use multiple S2E analyzer plug-ins, general analyzers and Windows-specific analyzers to record various path information, code block addresses, CPU register information and other data during software execution, and use multiple operating system event monitor plug-ins to monitor the software status.

[0077] Specifically, the exception verification subsystem 10 is used to analyze software anomalies in test data, analyze the anomaly triggering mechanism, and verify the availability of the anomalies triggered in the fuzz test. The exception verification subsystem can provide a supporting environment and tools to improve the ability and efficiency of exception analysis. The exception verification subsystem 10 includes an exception environment loading module 25, a static analysis module 26, a dynamic analysis module 27, and an exception debugging auxiliary tool 28.

[0078] The above-mentioned exception loading module is implemented through the Qemu virtual machine and is divided into two processes, which can cover operating system exceptions and software exceptions. First, the operating system is loaded through the Qemu virtual machine and restored to the system image before the exception. Then, the tested software is loaded in the operating system, and the test case data that generates the exception is sent to the tested software to reproduce the software exception. It can capture the instruction position of the exception trigger point, including the current program instruction context, call stack, register information, etc.

[0079] The static analysis module is composed of static analysis tools such as Execution Profiler, Coverage Generator, TracePrinter, etc. provided by S2E. It realizes the ability to analyze and process information such as the trace acquisition capability of the instruction sequence executed during the test, page faults, TLB losses, cache descriptions, etc., and provides analysis reports on the coverage of related code blocks and generates abnormal test cases.

[0080] The dynamic analysis module includes S2E's ModuleTracer and Interceptor plug-ins, which provide the ability to obtain debug code information during the test process, including obtaining key branches of the execution path, instrumenting analysis code, etc., which can assist in exception debugging.

[0081] The exception debugging auxiliary tool set consists of general debuggers such as OllyDbg, Windbg, Immunity Debugger, GDB, etc., which can analyze software exceptions or system exceptions in mainstream operating systems such as Windows and Linux. It also includes mainstream disassembly tools such as IDA to support the key locations where static reverse software exceptions occur.

[0082] The basic service platform 11 is used to create a virtual machine cluster and use physical machine resources to perform the fuzz testing task. The basic service platform provided in this embodiment uses server clusters and server virtualization technologies. The cluster technology connects many servers to improve computing power, and the virtualization technology creates a diverse and independent server environment on a single machine. The nodes in the cluster are no longer real physical machine nodes but virtual machine nodes. This cluster constructed by virtual machines is called a virtual cluster. Since there is no precise coupling with physical devices, or the virtual cluster is transparent to the physical nodes, it can be configured more quickly and flexibly, and physical resources can be more efficiently and fully utilized, thereby reducing the cost of management and use. In this way, limited computing and storage resources can be more effectively utilized for intensive fuzz testing. At the same time, by using a cluster virtualization resource pool, the same host can act as a client and a server at the same time, which can make the system's hardware resources very convenient to elastically expand.

[0083] The physical machine architecture diagram of the access basic service platform is as follows Figure 8As shown, each physical machine uses the common libvirtAPI interface to create, edit, boot or stop virtual machines; view and control the console of each QEMU virtual machine; view the performance and usage of each virtual machine; view the real-time performance and usage information of each running virtual machine and the host; use the functions of KVM, Xen, and QEMU locally or remotely. Figure 8 Libvirtd is an open source API, background program and management tool for managing virtualization platforms. It can be used to manage KVM, Xen, VMware ESX, QEMU and other virtualization technologies.

[0084] In addition, this embodiment develops a web service management interface, so that the virtual machines on the virtual machine cluster can be remotely managed using a browser. Regardless of whether the virtual machine is in a shutdown or running state, it can be conveniently powered on, shut down, and restarted through a web browser, and the remote desktop can be operated through the browser, and batch management can be extremely convenient.

[0085] This system adopts cloud computing and virtualization cluster technology to achieve rapid testing of target software and system environment, dynamic state recovery, and remote resource management, thereby building a multi-engine-based multi-granularity intelligent fuzz testing virtualization cluster that can fully meet the fuzz testing of IP-type attack equipment.

[0086] This embodiment also provides an electronic device, the electronic device includes a memory processor, the memory and the processor are connected to each other in communication, the memory stores computer instructions, and the processor executes the computer instructions to perform an intelligent fuzzy testing method. The processor and the memory can be connected via a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0087] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0088] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the intelligent fuzzy testing method in the embodiment of the present invention. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, an intelligent fuzzy testing method in the above method embodiment is implemented.

[0089] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0090] Corresponding to the above embodiment, this embodiment also provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to make the computer execute the intelligent fuzzy testing method. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.

[0091] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. An intelligent fuzzy testing method, characterized in that: The method comprises: The input variables of the target under test are converted into symbolic expressions through symbolic execution; Performing execution path constraints on the symbolic expressions of multiple input variables; Generate test cases based on the constrained execution path; Execute the test case and obtain the execution status and test data of the test case; The step of constraining the execution path of the symbolic expression of the multiple input variables includes: Generating deformed constraints according to the symbolic expressions of the multiple input variables; According to the deformed constraint condition, path constraints are solved for the input tainted variable to obtain a specified code path; The step of converting the input variables of the target under test into symbolic expressions through symbolic execution includes: The S2E platform is used to record the internal tainted data flow and program instruction control flow of the software of the target under test, and the input tainted variables are obtained; the recording of the tainted data flow is expressed as the detailed information of the program execution path of the software of the target under test, and the sensitive path information and the propagation information of sensitive data in the execution trajectory are collected using symbolic execution and forward taint propagation technology, and the input tainted variables are obtained according to the propagation information of sensitive data; Obtain the symbolic expression of the input tainted variable on the execution path through symbolic execution; The intelligent fuzzy testing method also includes: Providing a test case template using a test case knowledge base, and generating a test case based on the test case template, wherein the test case knowledge base includes a distortion database and a test case template library; The distortion database is used to provide distortion data, thereby generating distortion constraint conditions; The test case template library is used to provide test case templates to generate test cases; different templates are selected according to the different input data formats or protocols of the target under test, and the state model, data model and different distortion libraries of the software test are defined through the script style in XML format and the corresponding generation strategy is configured to automatically generate batches of test cases.

2. The intelligent fuzzy testing method according to claim 1, characterized in that: The intelligent fuzzy testing method also includes: During the execution of the test case, a vulnerability detection algorithm is used to detect security vulnerabilities. The detection process includes: Check whether the released heap memory pointer is reused during the execution of the test case; If the released heap memory pointer is reused, it is determined that a security vulnerability exists.

3. The intelligent fuzzy testing method according to claim 2 is characterized in that: Before detecting whether the released heap memory pointer is reused, the method further includes: Intercept heap management API to monitor the allocation and release of heap memory; Tracking the propagation of pointers and matching the mapping relationship between pointers and the heap memory; When the heap memory is released, all pointers corresponding to the heap memory are cleared to zero.

4. An intelligent fuzzy testing device, characterized in that: The device comprises: A variable processing module is used to convert the input variables of the target under test into symbolic expressions through symbolic execution; A path constraint module, used to perform path constraints on the execution path of the target under test according to the symbolic expression; performing path constraints on the execution path of the target under test according to the symbolic expression, including: generating deformed constraint conditions according to the symbolic expression of multiple input variables; solving path constraints on input tainted variables according to the deformed constraint conditions to obtain a specified code path; A test case generation module is used to generate test cases according to the constrained execution path; A comprehensive processing module, used to execute the test case and obtain the execution status and test data of the test case; The step of converting the input variables of the target under test into symbolic expressions through symbolic execution includes: The S2E platform is used to record the internal tainted data flow and program instruction control flow of the software of the target under test, and the input tainted variables are obtained; the recording of the tainted data flow is expressed as the detailed information of the program execution path of the software of the target under test, and the sensitive path information and the propagation information of sensitive data in the execution trajectory are collected using symbolic execution and forward taint propagation technology, and the input tainted variables are obtained according to the propagation information of sensitive data; Obtain the symbolic expression of the input tainted variable on the execution path through symbolic execution; The intelligent fuzzy testing device is also used for: Providing a test case template using a test case knowledge base, and generating a test case based on the test case template, wherein the test case knowledge base includes a distortion database and a test case template library; The distortion database is used to provide distortion data, thereby generating distortion constraint conditions; The test case template library is used to provide test case templates to generate test cases; different templates are selected according to the different input data formats or protocols of the target under test, and the state model, data model and different distortion libraries of the software test are defined through the script style in XML format and the corresponding generation strategy is configured to automatically generate batches of test cases.

5. An intelligent fuzzy testing system, characterized in that: The system comprises: Comprehensive management subsystem, used to establish fuzz testing tasks according to the target to be tested; Test case knowledge base, used to provide distortion data and test case templates; A test case generation subsystem is used to generate a test case according to the test case template, and the test case generation subsystem includes: A variable processing module is used to convert the input variables of the target under test into symbolic expressions through symbolic execution; A path constraint module is used to perform path constraints on the execution path of the target under test according to the symbolic expression; performing path constraints on the execution path of the target under test includes: generating deformed constraint conditions according to the symbolic expression of multiple input variables; solving path constraints on input tainted variables according to the deformed constraint conditions to obtain a specified code path; A test case generation module is used to generate test cases according to the constrained execution path; A comprehensive processing module, used to execute the test case and obtain the execution status and test data of the test case; A fuzz testing engine that parses test cases and executes the parsed test cases using the S2E selective symbolic execution platform; The test control subsystem is used to control the execution process of the test case and obtain the execution status and test data of the test case; The exception verification subsystem is used to analyze software anomalies in test data and analyze the anomaly triggering mechanism; A basic service platform, used to create a virtual machine cluster and use physical machine resources to perform the fuzz testing task; The step of converting the input variables of the target under test into symbolic expressions through symbolic execution includes: The S2E platform is used to record the internal tainted data flow and program instruction control flow of the software of the target under test, and the input tainted variables are obtained; the recording of the tainted data flow is expressed as the detailed information of the program execution path of the software of the target under test, and the sensitive path information and the propagation information of sensitive data in the execution trajectory are collected using symbolic execution and forward taint propagation technology, and the input tainted variables are obtained according to the propagation information of sensitive data; Obtain the symbolic expression of the input tainted variable on the execution path through symbolic execution; The intelligent fuzzy testing system is also used for: Providing a test case template using a test case knowledge base, and generating a test case based on the test case template, wherein the test case knowledge base includes a distortion database and a test case template library; The distortion database is used to provide distortion data, thereby generating distortion constraint conditions; The test case template library is used to provide test case templates to generate test cases; different templates are selected according to the different input data formats or protocols of the target under test, and the state model, data model and different distortion libraries of the software test are defined through the script style in XML format and the corresponding generation strategy is configured to automatically generate batches of test cases.

6. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the intelligent fuzzy testing method described in any one of claims 1 to 3 by executing the computer instructions.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the intelligent fuzzy testing method described in any one of claims 1-3.

Images