Kernel testing method and device

Abstract

The embodiments of the present specification provide a kernel testing method and device, wherein the kernel testing method comprises: obtaining an application program of a target application, and starting the application program in a running environment of the target application, obtaining an application process running the application program, and calling a sampling tool to sample the type and frequency of initial system calls executed by the application process, determining test weights corresponding to different initial system calls according to the sampling results, screening target system calls according to the test weights, and testing the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular to a kernel testing method. Background Art

[0002] The operating system is system software that manages computer hardware and software resources, and the kernel is the core of the operating system. It abstracts and encapsulates various underlying hardware and exposes interfaces for user programs to use. Unlike user-mode programs, the kernel runs in the kernel mode with the highest permissions. Once a security vulnerability occurs, it directly affects the entire operating system and user programs. Fuzz testing is an automated software testing technology. Its core idea is to automatically or semi-automatically generate random data input into the target program and detect program anomalies to discover possible program errors. It is one of the common vulnerability mining technologies.

[0003] The input of fuzz testing technology for operating system kernels is generally a program composed of interfaces provided by the kernel to the upper layer, that is, a system call sequence. A good system call sequence has dependencies between system calls. The behavior of system call A may affect the behavior of system call B. This is reflected in two points. First, the implementation of system calls is generally robust. It will check the parameters and kernel status before the core logic. If it is illegal, it will return directly to protect the kernel. Second, the system call will select the specific execution branch and logic according to different parameters and kernel status. Therefore, generating a valid and legal system call sequence can improve the code coverage of the test, and is more likely to discover potential defects and vulnerabilities, thereby improving the efficiency of fuzz testing. However, there is currently a lack of methods that can generate valid system call sequences. Therefore, an effective method is urgently needed to solve this problem. Summary of the invention

[0004] In view of this, an embodiment of the present specification provides a kernel testing method. One or more embodiments of the present specification also relate to a kernel testing device, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a kernel testing method is provided, including:

[0006] Obtaining an application program of a target application, and starting the application program in a running environment of the target application;

[0007] Acquire an application process running the application program, and call a sampling tool to sample the type and frequency of initial system calls executed by the application process;

[0008] Determine test weights corresponding to different initial system calls according to the sampling results, screen target system calls according to the test weights, and test the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

[0009] Optionally, determining the test weights corresponding to different initial system calls according to the sampling results includes:

[0010] The target linear regression function is called to process the type and frequency sampling values ​​of the initial system calls described in the sampling results, and the test weights corresponding to different initial system calls are generated.

[0011] Optionally, the calling target linear regression function processes the type and frequency sampling value of the initial system call in the sampling result to generate test weights corresponding to different initial system calls, including:

[0012] Calculate the initial weight corresponding to each type of initial system call according to the target linear regression function and the frequency sampling value of each initial system call in the sampling result;

[0013] Based on the initial weight and the first preset interval, a test weight corresponding to each type of initial system call is generated.

[0014] Optionally, calculating the initial weight corresponding to each type of initial system call according to the target linear regression function and the frequency sampling value of each initial system call in the sampling result includes:

[0015] The frequency sampling values ​​corresponding to each type of initial system call are input into the target linear regression function for processing to generate the initial weights corresponding to each type of initial system call.

[0016] Optionally, generating a test weight corresponding to each type of initial system call based on the initial weight and the first preset interval includes:

[0017] Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval;

[0018] The initial weight corresponding to each type of initial system call is multiplied by the first boundary value to generate a test weight corresponding to each type of initial system call.

[0019] Optionally, the kernel testing method further includes:

[0020] Sorting the frequency sampling values ​​of different initial system calls in the sampling results, and selecting the first frequency sampling value and the second frequency sampling value according to the sorting results;

[0021] Based on the first frequency sampling value and the second frequency sampling value, the frequency sampling values ​​of different initial system calls are standardized to generate corresponding standardized processing results.

[0022] Optionally, the performing standardization processing on the frequency sampling values ​​of different initial system calls based on the first frequency sampling value and the second frequency sampling value to generate corresponding standardization processing results includes:

[0023] Determine a second boundary value according to a second preset interval, and determine an interval length value of the second preset interval, wherein the second boundary value belongs to the second preset interval;

[0024] Determine a first difference between the frequency sampling value of each initial system call and the second frequency sampling value, and determine a second difference between the first frequency sampling value and the second frequency sampling value;

[0025] Determine a ratio of the first difference to the second difference, and perform a product operation on the ratio and the interval length value;

[0026] The difference between the product operation result and the second boundary value is used as the standardized processing result corresponding to each initial system call.

[0027] Optionally, determining the test weights corresponding to different initial system calls according to the sampling results includes:

[0028] Input the frequency sampling value corresponding to each initial system call into the target linear regression function for processing, and generate the initial weight corresponding to the standardized processing result of each initial system call;

[0029] Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval;

[0030] The initial weight corresponding to the standardized processing result of each initial system call is multiplied by the first boundary value to generate a test weight corresponding to the standardized processing result of each initial system call.

[0031] Optionally, the kernel testing method further includes:

[0032] Determine the naming format of the system call name corresponding to the fuzz testing tool;

[0033] Different types of initial system calls in the sampling results are converted according to the naming format, and the conversion results of different types of initial system calls and their corresponding test weights are associated and stored.

[0034] Optionally, screening the target system call according to the test weight, and testing the operating system kernel of the target application based on the target system call includes:

[0035] Querying the initial system call of the target application and the test weight corresponding to the initial system call, screening the initial system call according to the test weight, and obtaining the target system call;

[0036] A test case is generated based on the target system call, and the operating system kernel of the target application is tested based on the test case.

[0037] According to a second aspect of an embodiment of this specification, a kernel testing device is provided, including:

[0038] an acquisition module, configured to acquire an application program of a target application and start the application program in a running environment of the target application;

[0039] A sampling module is configured to obtain an application process running the application program, and call a sampling tool to sample the type and frequency of initial system calls executed by the application process;

[0040] The test module is configured to determine the test weights corresponding to different initial system calls according to the sampling results, screen the target system calls according to the test weights, and test the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

[0041] According to a third aspect of an embodiment of this specification, a computing device is provided, including:

[0042] Memory and processor;

[0043] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions:

[0044] Obtaining an application program of a target application, and starting the application program in a running environment of the target application;

[0045] Acquire an application process running the application program, and call a sampling tool to sample the type and frequency of initial system calls executed by the application process;

[0046] Determine test weights corresponding to different initial system calls according to the sampling results, screen target system calls according to the test weights, and test the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

[0047] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of any one of the kernel testing methods are implemented.

[0048] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned kernel testing method.

[0049] An embodiment of the present specification obtains an application program of a target application, starts the application program in a running environment of the target application, obtains an application process running the application program, and calls a sampling tool to sample the type and frequency of initial system calls executed by the application process, determines test weights corresponding to different initial system calls according to the sampling results, screens target system calls according to the test weights, and tests the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

[0050] The embodiments of the present specification sample the initial system calls executed during the running of the target application program, and determine the test weights of different types of initial system calls based on the types and execution frequencies of the initial system calls contained in the sampling results, thereby screening the target system calls for fuzz testing the operating system kernel of the target application based on the test weights. Screening the target system calls for kernel fuzz testing in this way is beneficial to ensuring the accuracy of the test results and improving the test efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a flow chart of a kernel testing method provided by an embodiment of this specification;

[0052] Figure 2 is a curve diagram of a sigmoid function provided by an embodiment of this specification;

[0053] Figure 3 is a process flow chart of a kernel testing method provided by an embodiment of this specification;

[0054] Figure 4 It is a structural schematic diagram of a kernel testing device provided by an embodiment of this specification;

[0055] Figure 5 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0056] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0057] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0058] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0059] First, the terms involved in one or more embodiments of this specification are explained.

[0060] Kernel fuzz testing: A method for detecting defects in the kernel code of an operating system. This method triggers abnormal states of the operating system by randomly generating, mutating, and executing system call sequences, thereby detecting defects in the kernel code of the operating system.

[0061] Seed: A test case generated by a fuzzing tool through mutation, generation, and other operations. A seed consists of a sequence of system calls. The type and order of system calls, as well as the specific parameters of each system call input will directly affect the composition of the seed.

[0062] System call: The interactive interface between kernel state and user state provided by the operating system. In the kernel fuzz testing scenario, system call is the basic unit of seed.

[0063] System call enablement: A method for determining whether a system call participates in fuzz testing. This method can be used to determine whether a system call participates in fuzz testing.

[0064] System call weight: A way to determine the system call's participation in fuzz testing. This method determines the possibility of a system call as a basic unit to form a seed and participate in fuzz testing. The weight reflects the degree of participation of each system call in kernel fuzz testing and has a direct impact on the test effect of fuzz testing.

[0065] In this specification, a kernel testing method is provided. This specification also relates to a kernel testing device, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0066] Figure 1 A flowchart of a kernel testing method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0067] Step 102: Obtain an application program of a target application, and start the application program in the operating environment of the target application.

[0068] Specifically, the target application is one of multiple applications that can provide different services to users; the application program of the target application is a computer program that is run in the operating environment of the operating system in order to complete one or several specific tasks in the target application.

[0069] In actual applications, the operating environment of the target application includes but is not limited to a physical machine, a virtual machine or a container.

[0070] Before performing fuzz testing on the operating system kernel of the target application, the embodiments of the present specification can run the application program of the target application and sample the type and frequency of initial system calls used during the running of the application program, so as to determine the target system call for fuzz testing based on the sampling results, thereby achieving the purpose of improving the efficiency of fuzz testing.

[0071] Step 104: obtain the application process that runs the application program, and call a sampling tool to sample the type and frequency of initial system calls executed by the application process.

[0072] Specifically, a process refers to a program that is already running in a computer. It is the basic unit for resource allocation and scheduling in the system and the foundation of the operating system structure. A process is the basic execution entity of a program; a process is an instance of a running application. Several processes may be related to the same program, and each process can run independently in a synchronous or asynchronous manner.

[0073] An application is an ordered collection of instructions and data, which itself does not have any running meaning. An application process is the execution process of an application on a processor.

[0074] In specific applications, the functions of an application can be implemented by a process. In a system that supports multi-threading, the functions of an application can also be implemented concurrently by multiple threads. During the running process, a process or thread can execute a system call (syscall), that is, call a syscall, as needed.

[0075] In the embodiments provided later in this specification, the kernel testing method provided in the embodiments of this specification will be implemented in a Linux system as an example. Since processes and threads are unified in Linux and there is no distinction between threads and processes, threads are generally considered to be lightweight processes that share data space. Therefore, in the description of the following embodiments, no clear distinction is made and the process expression is mainly used.

[0076] Since the main function of the operating system is to manage hardware resources and provide a good environment for application developers to make applications more compatible, in order to achieve this goal, the kernel provides a series of multi-kernel functions with predetermined functions, which are presented to users through a set of interfaces called system calls. The system call transmits the application's request to the kernel, calls the corresponding kernel function to complete the required processing, and returns the processing result to the application.

[0077] Therefore, when running an application, the type and number of times the initial system call used by the application can be determined by sampling using a sampling tool, so as to determine the test weights corresponding to different initial system calls for kernel fuzz testing based on the sampling results.

[0078] In actual applications, sampling tools include but are not limited to perf and syscount tools.

[0079] Step 106, determining the test weights corresponding to different initial system calls according to the sampling results, screening the target system calls according to the test weights, and testing the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

[0080] Specifically, as mentioned above, after sampling the type and frequency (number of times used) of the initial system calls used during the running of the application to obtain the sampling results, the test weights corresponding to different initial system calls for kernel fuzz testing can be determined based on the sampling results; the test weight can be proportional to the number of times used, and the more times it is used, the greater the corresponding test weight.

[0081] After determining the test weights corresponding to different initial system calls, the target system calls for kernel fuzz testing can be screened according to the test weights. Since the test cases need to cover as many system calls covered by the target application's application as possible when performing kernel fuzz testing, by determining the test weights corresponding to different initial system calls and screening, the initial system calls with larger test weights are used as target system calls to generate test cases based on the target system calls, so that there is a greater probability of generating test cases that are consistent with the application behavior of the target application, which is conducive to improving the efficiency of kernel fuzz testing and the accuracy of test results.

[0082] In specific implementation, the test weights corresponding to different initial system calls are determined according to the sampling results, that is, the target linear regression function is called to process the type and frequency sampling values ​​of the initial system calls described in the sampling results to generate test weights corresponding to different initial system calls.

[0083] Furthermore, the target linear regression function is called to process the type and frequency sampling value of the initial system call in the sampling result to generate test weights corresponding to different initial system calls, which can be specifically implemented in the following way:

[0084] Calculate the initial weight corresponding to each type of initial system call according to the target linear regression function and the frequency sampling value of each initial system call in the sampling result;

[0085] Based on the initial weight and the first preset interval, a test weight corresponding to each type of initial system call is generated.

[0086] Furthermore, according to the target linear regression function and the frequency sampling value of each initial system call in the sampling result, the initial weight corresponding to each type of initial system call is calculated, including:

[0087] The frequency sampling values ​​corresponding to each type of initial system call are input into the target linear regression function for processing to generate the initial weights corresponding to each type of initial system call.

[0088] Specifically, the target linear regression function can be a sigmoid function, which calls the sigmoid function to process the type and frequency sampling value of the initial system call in the sampling result. Specifically, the initial weight corresponding to each type of system call can be calculated based on the sigmoid function and the frequency sampling value of each type of initial system call in the sampling result, and the initial weight can be mapped to the first preset interval to generate a test weight corresponding to each type of initial system call.

[0089] Among them, according to the sigmoid function and the frequency sampling value of each type of initial system call in the sampling result, the initial weight corresponding to each type of system call is calculated. Specifically, the frequency sampling value corresponding to each type of initial system call in the sampling result can be input into the expression of the sigmoid function for calculation to generate the initial weight corresponding to each type of initial system call.

[0090] In practical applications, the expression of the sigmoid function is shown in formula (1).

[0091]

[0092] Among them, z can be used to characterize each initial system call, σ(z) can be used to characterize the initial weight, and x can be used to characterize the frequency sampling value of each initial system call. By inputting the frequency sampling value corresponding to any type of initial system call in the sampling result into formula (1), the frequency sampling value of the initial system call of this type can be normalized to obtain the initial weight corresponding to the initial system call of this type.

[0093] Further, after generating the initial weight corresponding to each type of initial system call, the test weight corresponding to each type of initial system call can be generated based on the initial weight and the first preset interval, which can be specifically achieved in the following way:

[0094] Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval;

[0095] The initial weight corresponding to each type of initial system call is multiplied by the first boundary value to generate a test weight corresponding to each type of initial system call.

[0096] Specifically, the first preset interval can be [1,1000], so the first boundary value can be 1000; after generating the initial weight corresponding to each type of initial system call, the initial weight corresponding to each type of initial system call can be mapped to the first preset interval through formula (2) to generate the test weight corresponding to each type of initial system call.

[0097] w z =σ(z)*1000 Formula (2)

[0098] Among them, w z It can be used to characterize the test weight corresponding to each initial system call. After processing the initial weight corresponding to each type of initial system call using formula (2), the initial weight can be mapped to the interval [1,1000] to obtain the test weight corresponding to each type of initial system call.

[0099] In actual applications, the first preset interval can be determined according to actual needs and is not limited here. After determining the first preset interval, the right boundary value of the first preset interval can be used as the first boundary value, and the initial weight corresponding to each type of initial system call can be multiplied by the first boundary value to generate the test weight corresponding to each type of initial system call.

[0100] In specific implementation, after determining the test weight corresponding to each type of initial system call according to the sigmoid function and the first preset interval, the initial system calls of different types can be standardized according to the frequency sampling values ​​corresponding to each type of initial system call, so as to use the curve corresponding to the sigmoid function to characterize the test weights of different types of initial system calls based on the standardized processing results, which can be specifically implemented in the following way:

[0101] Sorting the frequency sampling values ​​of different initial system calls in the sampling results, and selecting the first frequency sampling value and the second frequency sampling value according to the sorting results;

[0102] Based on the first frequency sampling value and the second frequency sampling value, the frequency sampling values ​​of different initial system calls are standardized to generate corresponding standardized processing results.

[0103] Further, based on the first frequency sampling value and the second frequency sampling value, the frequency sampling values ​​of different initial system calls are standardized to generate corresponding standardized processing results, including:

[0104] Determine a second boundary value according to a second preset interval, and determine an interval length value of the second preset interval, wherein the second boundary value belongs to the second preset interval;

[0105] Determine a first difference between the frequency sampling value of each initial system call and the second frequency sampling value, and determine a second difference between the first frequency sampling value and the second frequency sampling value;

[0106] Determine a ratio of the first difference to the second difference, and perform a product operation on the ratio and the interval length value;

[0107] The difference between the product operation result and the second boundary value is used as the standardized processing result corresponding to each initial system call.

[0108] Specifically, in order to represent the test weights of different types of initial system calls through the curve corresponding to the same sigmoid function, the ordinate of the sigmoid function is used to characterize the value of the test weight, and the abscissa is used to characterize different initial system calls. Therefore, each initial system call is standardized according to the frequency sampling value of different initial system calls, so that the standardized result corresponds to the abscissa of the sigmoid function, and the position of the abscissa corresponding to different standardized results can characterize a type of initial system call.

[0109] In practical applications, after obtaining the sampling results, the frequency sampling values ​​of different initial system calls in the sampling results can be sorted, and the first frequency sampling value and the second frequency sampling value can be selected according to the sorting results; wherein, if the frequency sampling values ​​are sorted in descending order, the first frequency sampling value can be the frequency sampling value ranked first in the sorting results, and the second frequency sampling value can be the frequency sampling value ranked last in the sorting results; after determining the first frequency sampling value and the second frequency sampling value, the frequency sampling values ​​of different initial system calls can be standardized.

[0110] In addition, the second preset interval can be [-10, 10]. After determining the second preset interval, the second boundary value determined according to the second preset interval can be the right boundary value of the second preset interval, that is, 10, and the determined interval length value of the second preset interval is 20. After determining the second boundary value and the interval length value, the standardized processing result corresponding to each initial system call can be obtained according to formula (3).

[0111]

[0112] Among them, s z It is used to characterize the standardized processing result of each initial system call, and x is used to characterize the frequency sampling value of each initial system call. max Characterizes the first frequency sampling value, x min Characterizes the second frequency sampling value; xx min That is, the first difference between the frequency sampling value of each initial system call and the second frequency sampling value, x max -x min That is, the second difference between the first frequency sampling value and the second frequency sampling value; the ratio of the first difference to the second difference is multiplied with the interval length value, and the product operation result is subtracted from the right boundary value to generate the standardized processing result of each initial system call.

[0113] In practical applications, the second preset interval can be determined according to actual needs and is not limited here.

[0114] In addition, after generating the standardized processing result of each initial system call, if you need to use the curve of the sigmoid function to characterize the test weights of different types of initial system calls, you also need to standardize or normalize the initial weight of each initial system call, which can be achieved in the following ways:

[0115] Input the frequency sampling value corresponding to each initial system call into the target linear regression function for processing, and generate the initial weight corresponding to the standardized processing result of each initial system call;

[0116] Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval;

[0117] The initial weight corresponding to the standardized processing result of each initial system call is multiplied by the first boundary value to generate a test weight corresponding to the standardized processing result of each initial system call.

[0118] Specifically, the aforementioned mapping of the frequency sampling values ​​of each type of initial system call to the second preset interval is equivalent to standardizing the frequency sampling values ​​of each type of initial system call so as to correspond the processing results to the horizontal axis of the sigmoid function; and in addition to standardizing the frequency sampling values, the initial weights of the initial system calls also need to be standardized or normalized.

[0119] Among them, according to the sigmoid function and the frequency sampling value of each type of initial system call in the sampling result, the initial weight corresponding to the standardized processing result of each type of initial system call is calculated. Specifically, the frequency sampling value corresponding to each type of initial system call in the sampling result can be input into the expression of the sigmoid function for calculation, so as to generate the initial weight corresponding to the standardized processing result of each type of initial system call.

[0120] In practical applications, the expression of the sigmoid function is shown in formula (4).

[0121]

[0122] Among them, s z The standardized processing result used to characterize each initial system call, σ(s z ) can be used to characterize the initial weight corresponding to the standardized processing result of each type of initial system call, and x can be used to characterize the frequency sampling value of each initial system call. By inputting the frequency sampling value corresponding to any type of initial system call in the sampling result into formula (4), the frequency sampling value of the initial system call of this type can be normalized to obtain the initial weight corresponding to the standardized processing result of the initial system call of this type.

[0123] In addition, the first preset interval can be [1,1000], so the first boundary value can be 1000; after generating the initial weight corresponding to the standardized processing result of each type of initial system call, the initial weight corresponding to the standardized processing result of each type of initial system call can be mapped to the first preset interval through formula (5) to generate the test weight corresponding to the standardized processing result of each type of initial system call.

[0124]

[0125] in, It can be used to characterize the test weight corresponding to the standardized processing result of each initial system call. After processing the initial weight corresponding to the standardized processing result of each type of initial system call using formula (5), the initial weight can be mapped to the interval [1,1000] to obtain the test weight corresponding to the standardized processing result of each type of initial system call.

[0126] After obtaining the test weight corresponding to the standardized processing result of each type of initial system call and the standardized processing result of each initial system call, the standardized processing result of each type of initial system call and the test weight corresponding to the standardized processing result of each initial system call can be mapped to the curve of the sigmoid function. The curve diagram of the sigmoid function provided in the embodiment of this specification is as follows: Figure 2 As shown in the figure, each point in the figure represents a type of initial system call, the horizontal axis of the standardized processing result of each initial system call is in the range of [-10,10], and the vertical axis (test weight) of each initial system call is in the range of [0,1000] ( Figure 2 The horizontal axis represents the number of standardized system call executions, and the vertical axis represents the system call weight). The curve value corresponding to the horizontal axis of the standardized processing result of any type of initial system call in the curve of the sigmoid function is the test weight of the initial system call of this type.

[0127] In addition, after sampling and obtaining the frequency sampling values ​​of each type of initial system call, the naming format of the system call name corresponding to the fuzz testing tool can also be determined;

[0128] Different types of initial system calls in the sampling results are converted according to the naming format, and the conversion results of different types of initial system calls and their corresponding test weights are associated and stored.

[0129] Specifically, during the fuzz testing process, there are certain differences in the name formats between the system call configuration items of the test tool and the initial system calls extracted by the sampling tool, so format conversion needs to be performed. The embodiments of this specification can convert the initial system call names in the sampling results into system call names that comply with the configuration specifications of the fuzz testing tool by text conversion. Specifically, the names of various types of initial system calls in the sampling results can be formatted according to the template corresponding to the system call name of the fuzz testing tool.

[0130] After the conversion is completed, the conversion results of different types of initial system calls and their corresponding test weights can be associated and stored. Specifically, the system call names that conform to the fuzz test configuration format and their test weights can be entered into the fuzz test json configuration file in a dictionary format. The expression is: {system call name: system call weight}.

[0131] Based on this, the target system call is screened according to the test weight, and the operating system kernel of the target application is tested based on the target system call, which can be specifically implemented in the following manner:

[0132] Querying the initial system call of the target application and the test weight corresponding to the initial system call, screening the initial system call according to the test weight, and obtaining the target system call;

[0133] A test case is generated based on the target system call, and the operating system kernel of the target application is tested based on the test case.

[0134] Specifically, when performing kernel fuzz testing, it is necessary to use system calls to build test cases, and the test cases need to cover the location where the application program of the target application is executed (the location of the code) as accurately as possible. Therefore, in order to ensure the coverage rate, it is necessary to select target system calls with larger weights to build test cases. When screening target system calls, the initial system call of the target application and the test weight corresponding to the initial system call can be queried in the fuzz test json configuration file, and screening can be performed according to the query results to obtain one, two or more target system calls with larger weights, and then generate test cases based on the target system calls to test the operating system kernel of the target application.

[0135] An embodiment of the present specification obtains an application program of a target application, starts the application program in a running environment of the target application, obtains an application process running the application program, and calls a sampling tool to sample the type and frequency of initial system calls executed by the application process, determines test weights corresponding to different initial system calls according to the sampling results, screens target system calls according to the test weights, and tests the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

[0136] The embodiments of this specification automatically select target system calls for fuzz testing by sampling the initial system calls used in the application execution process, thereby improving the automation level of fuzz test system call selection; the current enabling mode is replaced by a weighted method, thereby improving the flexibility of fuzz test system call selection and achieving a more fine-grained system call selection, making fuzz testing more in line with the actual application's operating environment; in addition, since the weights are automatically generated based on the frequency of application execution system calls, the complexity of manual configuration caused by converting from an enabling mode to a weighted mode is also avoided.

[0137] The embodiments of the present specification sample the initial system calls executed during the running of the target application program, and determine the test weights of different types of initial system calls based on the types and execution frequencies of the initial system calls contained in the sampling results, thereby screening the target system calls for fuzz testing the operating system kernel of the target application based on the test weights. Screening the target system calls for kernel fuzz testing in this way is beneficial to ensuring the accuracy of the test results and improving the test efficiency.

[0138] The following combination Figure 3 Taking the application of the kernel testing method provided in this specification to perform kernel fuzzy testing on the operating system of application A as an example, the kernel testing method is further described. Figure 3 A processing flow chart of a kernel testing method provided by an embodiment of the present specification is shown, which specifically includes the following steps.

[0139] Step 302: Obtain an application program of application A, and start the application program in the running environment of application A.

[0140] Step 304: obtain the application process that runs the application program, and call a sampling tool to sample the initial system call executed by the application process.

[0141] Step 306: Determine frequency sampling values ​​of different types of initial system calls according to the sampling results.

[0142] Step 308: Determine the test weights corresponding to different types of initial system calls according to the frequency sampling values.

[0143] Step 310, initial system call format conversion.

[0144] Specifically, the naming format of the system call name corresponding to the fuzz testing tool is determined, and the initial system calls of different types in the sampling results are converted according to the naming format.

[0145] Step 312, initial system call weight configuration.

[0146] The conversion results of different types of initial system calls and their corresponding test weights are stored in association.

[0147] Step 314, fuzzy testing.

[0148] Specifically, query the initial system call of application A and the test weight corresponding to the initial system call, filter the initial system call according to the test weight, obtain the target system call, generate a test case based on the target system call, and test the A operating system kernel of the application based on the test case.

[0149] The embodiments of the present specification sample the initial system calls executed during the running of application A, and determine the test weights of different types of initial system calls based on the types and execution frequencies of the initial system calls contained in the sampling results, thereby screening the target system calls for fuzz testing the operating system kernel of application A based on the test weights. Screening the target system calls for kernel fuzz testing in this way is beneficial to ensuring the accuracy of the test results and improving the test efficiency.

[0150] Corresponding to the above method embodiment, this specification also provides a kernel testing device embodiment, Figure 4 FIG. 1 is a schematic diagram showing the structure of a core testing device provided by an embodiment of the present specification. Figure 4 As shown, the device comprises:

[0151] The acquisition module 402 is configured to acquire an application program of a target application and start the application program in a running environment of the target application;

[0152] The sampling module 404 is configured to obtain the application process running the application program, and call a sampling tool to sample the type and frequency of the initial system call executed by the application process;

[0153] The test module 406 is configured to determine the test weights corresponding to different initial system calls according to the sampling results, screen the target system calls according to the test weights, and test the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

[0154] Optionally, the test module 406 is further configured to call a target linear regression function to process the type and frequency sampling values ​​of the initial system calls in the sampling results, and generate test weights corresponding to different initial system calls.

[0155] Optionally, the testing module 406 includes:

[0156] A calculation submodule is configured to calculate an initial weight corresponding to each type of initial system call according to a target linear regression function and a frequency sampling value of each initial system call in a sampling result;

[0157] The generating submodule is configured to generate a test weight corresponding to each type of initial system call based on the initial weight and the first preset interval.

[0158] Optionally, the calculation submodule is further configured to:

[0159] The frequency sampling values ​​corresponding to each type of initial system call are input into the target linear regression function for processing to generate the initial weights corresponding to each type of initial system call.

[0160] Optionally, the generating submodule is further configured to:

[0161] Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval;

[0162] The initial weight corresponding to each type of initial system call is multiplied by the first boundary value to generate a test weight corresponding to each type of initial system call.

[0163] Optionally, the kernel testing device further includes:

[0164] A sorting module is configured to sort the frequency sampling values ​​of different initial system calls in the sampling results, and select the first frequency sampling value and the second frequency sampling value according to the sorting result;

[0165] The standardization processing module is configured to perform standardization processing on the frequency sampling values ​​of different initial system calls based on the first frequency sampling value and the second frequency sampling value, and generate corresponding standardization processing results.

[0166] Optionally, the standardization processing module is further configured to:

[0167] Determine a second boundary value according to a second preset interval, and determine an interval length value of the second preset interval, wherein the second boundary value belongs to the second preset interval;

[0168] Determine a first difference between the frequency sampling value of each initial system call and the second frequency sampling value, and determine a second difference between the first frequency sampling value and the second frequency sampling value;

[0169] Determine a ratio of the first difference to the second difference, and perform a product operation on the ratio and the interval length value;

[0170] The difference between the product operation result and the second boundary value is used as the standardized processing result corresponding to each initial system call.

[0171] Optionally, the testing module 406 is further configured to:

[0172] Input the frequency sampling value corresponding to each initial system call into the target linear regression function for processing, and generate the initial weight corresponding to the standardized processing result of each initial system call;

[0173] Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval;

[0174] The initial weight corresponding to the standardized processing result of each initial system call is multiplied by the first boundary value to generate a test weight corresponding to the standardized processing result of each initial system call.

[0175] Optionally, the kernel testing device further includes:

[0176] A determination module is configured to determine a naming format of a system call name corresponding to the fuzz testing tool;

[0177] The conversion module is configured to convert different types of initial system calls in the sampling results according to the naming format, and associate and store the conversion results of different types of initial system calls and their corresponding test weights.

[0178] Optionally, the testing module 406 is further configured to:

[0179] Querying the initial system call of the target application and the test weight corresponding to the initial system call, screening the initial system call according to the test weight, and obtaining the target system call;

[0180] A test case is generated based on the target system call, and the operating system kernel of the target application is tested based on the test case.

[0181] The above is a schematic scheme of a kernel test device of this embodiment. It should be noted that the technical scheme of the kernel test device and the technical scheme of the kernel test method described above are of the same concept, and the details not described in detail in the technical scheme of the kernel test device can be found in the description of the technical scheme of the kernel test method described above.

[0182] Figure 5 The structure block diagram of a computing device 500 provided according to an embodiment of the present specification is shown. The components of the computing device 500 include but are not limited to a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and the database 550 is used to store data.

[0183] The computing device 500 also includes an access device 540 that enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0184] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 5 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0185] The computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 500 may also be a mobile or stationary server.

[0186] The processor 520 is used to execute the following computer executable instructions, which implement the steps of the above-mentioned kernel testing method when executed by the processor.

[0187] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the kernel testing method described above are of the same concept, and the details not described in detail in the technical scheme of the computing device can be found in the description of the technical scheme of the kernel testing method described above.

[0188] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which implement the steps of the above-mentioned kernel testing method when executed by a processor.

[0189] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the kernel test method described above are of the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the kernel test method described above.

[0190] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned kernel testing method.

[0191] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the kernel testing method described above are of the same concept, and the details not described in detail in the technical solution of the computer program can be found in the description of the technical solution of the kernel testing method described above.

[0192] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0193] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0194] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0195] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0196] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A kernel testing method, comprising: Obtaining an application program of a target application, and starting the application program in a running environment of the target application; Acquire an application process running the application program, and call a sampling tool to sample the type and frequency of initial system calls executed by the application process; Determine test weights corresponding to different initial system calls according to the sampling results, screen target system calls according to the test weights, and test the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

2. The kernel testing method according to claim 1, wherein determining the test weights corresponding to different initial system calls according to the sampling results comprises: The target linear regression function is called to process the type and frequency sampling values ​​of the initial system calls described in the sampling results, and the test weights corresponding to different initial system calls are generated.

3. The kernel testing method according to claim 2, wherein the calling target linear regression function processes the type and frequency sampling value of the initial system call in the sampling result to generate test weights corresponding to different initial system calls, including: Calculate the initial weight corresponding to each type of initial system call according to the target linear regression function and the frequency sampling value of each initial system call in the sampling result; Based on the initial weight and the first preset interval, a test weight corresponding to each type of initial system call is generated.

4. The kernel testing method according to claim 3, wherein the initial weight corresponding to each type of initial system call is calculated according to the target linear regression function and the frequency sampling value of each initial system call in the sampling result, comprising: The frequency sampling values ​​corresponding to each type of initial system call are input into the target linear regression function for processing to generate the initial weights corresponding to each type of initial system call.

5. The kernel testing method according to claim 4, wherein generating a test weight corresponding to each type of initial system call based on the initial weight and the first preset interval comprises: Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval; The initial weight corresponding to each type of initial system call is multiplied by the first boundary value to generate a test weight corresponding to each type of initial system call.

6. The kernel testing method according to claim 1, further comprising: Sorting the frequency sampling values ​​of different initial system calls in the sampling results, and selecting the first frequency sampling value and the second frequency sampling value according to the sorting results; Based on the first frequency sampling value and the second frequency sampling value, the frequency sampling values ​​of different initial system calls are standardized to generate corresponding standardized processing results.

7. The kernel testing method according to claim 6, wherein the step of normalizing the frequency sampling values ​​of different initial system calls based on the first frequency sampling value and the second frequency sampling value to generate corresponding normalization results comprises: Determine a second boundary value according to a second preset interval, and determine an interval length value of the second preset interval, wherein the second boundary value belongs to the second preset interval; Determine a first difference between the frequency sampling value of each initial system call and the second frequency sampling value, and determine a second difference between the first frequency sampling value and the second frequency sampling value; Determine a ratio of the first difference to the second difference, and perform a product operation on the ratio and the interval length value; The difference between the product operation result and the second boundary value is used as the standardized processing result corresponding to each initial system call.

8. The kernel testing method according to claim 6, wherein determining the test weights corresponding to different initial system calls according to the sampling results comprises: Input the frequency sampling value corresponding to each initial system call into the target linear regression function for processing, and generate the initial weight corresponding to the standardized processing result of each initial system call; Determine a first boundary value according to a first preset interval, wherein the first boundary value belongs to the first preset interval; The initial weight corresponding to the standardized processing result of each initial system call is multiplied by the first boundary value to generate a test weight corresponding to the standardized processing result of each initial system call.

9. The kernel testing method according to claim 1, further comprising: Determine the naming format of the system call name corresponding to the fuzz testing tool; Different types of initial system calls in the sampling results are converted according to the naming format, and the conversion results of different types of initial system calls and their corresponding test weights are associated and stored.

10. The kernel testing method according to claim 9, wherein the step of screening the target system call according to the test weight and testing the operating system kernel of the target application based on the target system call comprises: Querying the initial system call of the target application and the test weight corresponding to the initial system call, screening the initial system call according to the test weight, and obtaining the target system call; A test case is generated based on the target system call, and the operating system kernel of the target application is tested based on the test case.

11. A kernel testing device, comprising: an acquisition module, configured to acquire an application program of a target application and start the application program in a running environment of the target application; A sampling module is configured to obtain an application process running the application program, and call a sampling tool to sample the type and frequency of initial system calls executed by the application process; The test module is configured to determine the test weights corresponding to different initial system calls according to the sampling results, screen the target system calls according to the test weights, and test the operating system kernel of the target application based on the target system calls, wherein the target system call is at least one of the initial system calls.

12. A computing device comprising: Memory and processor; The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the kernel testing method described in any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the kernel testing method according to any one of claims 1 to 10.

14. A computer program product, comprising a computer program / instruction, which implements the steps of the kernel testing method according to any one of claims 1 to 10 when executed by a processor.

Images