Path search method, device and storage medium based on symbolic execution

Abstract

The present disclosure provides a path search method, device and storage medium based on symbolic execution, which relates to the field of computer technology, wherein the method includes: using a generation-based path traversal algorithm to perform path search on a tested program, determining an available path in an executable path based on a preset path optimization function and path selection rules; performing bundle processing on the available paths of each generation to generate a bundle; sorting the bundle and the available paths in the bundle based on the in-bundle coefficients and out-of-bundle coefficients corresponding to the available paths; outputting the available paths in the bundle and the corresponding path constraints to a solver to generate a new input. The method, device and storage medium disclosed in the present disclosure optimize the generation-based path strategy algorithm, which can increase the directionality of the test; on the basis of high test coverage, it can save computing resources and improve the efficiency of the test.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a path search method, device and storage medium based on symbolic execution. Background Art

[0002] At present, for test case generation in fuzz testing, the existing path traversal strategy is usually used to collect path constraints; the collected path constraints are directly used for solving by the constraint solving module; the shortcomings of this path constraint collection method are caused by the shortcomings of the selected path traversal strategy, and the selected path traversal strategy is a generation-based path traversal strategy, etc. The generation-based path traversal strategy has path traversal redundancy, large computing resource occupancy, and may even cause problems such as too many paths and reduced test efficiency. Summary of the invention

[0003] In view of this, a technical problem to be solved by the present disclosure is to provide a path search method, device and storage medium based on symbolic execution.

[0004] According to the first aspect of the present disclosure, a path search method based on symbolic execution is provided, including: using a generation-based path traversal algorithm to perform path search on a program under test to obtain executable paths of each generation corresponding to the program under test; determining optional paths in the executable paths based on a preset path optimization function and path selection rules; performing bundle processing on the optional paths of each generation to generate a bundle; sorting the bundle and the optional paths within the bundle based on the in-bundle coefficients and out-of-bundle coefficients corresponding to the optional paths; and outputting the optional paths within the bundle and the corresponding path constraints to a solver so that the solver generates new inputs.

[0005] Optionally, the path optimization function includes: a sensitive function, a bundling function, and a function that characterizes whether there are subsequent branches or loops; wherein, determining the optional path in the executable path based on the preset path optimization function and the path selection rule includes: calculating the weight of the executable path based on the path optimization function; and selecting an executable path in the executable path whose weight is greater than a preset threshold based on the path selection rule as the optional path.

[0006] Optionally, the path optimization function is:

[0007] f(x)=g(x)+β / αj(x)+θk(x);

[0008] Among them, g(x) refers to the sensitivity function; ɑ refers to the coefficient of the bundle where the optional path is located, α<2^i-1, i is the current generation of the optional path; j(x) is the bundling function, β refers to the hierarchical weight coefficient of the optional path in the bundle; k(x) refers to the function that characterizes whether there are subsequent branches or loops, and θ refers to the complexity of the loop.

[0009] Optionally, the out-of-bundle coefficient is the ɑ, and the in-bundle coefficient is the β; the sorting of the bundle and the optional paths within the bundle based on the in-bundle coefficient and the out-of-bundle coefficient corresponding to the optional paths includes: sorting the bundles of each generation based on β / ɑ; and sorting the optional paths within the bundle based on β.

[0010] Optionally, outputting the optional paths and corresponding path constraints in the bundle to the solver includes: obtaining the optional path with the highest weight in the bundle and the corresponding path constraints and outputting them to the solver.

[0011] Optionally, if it is determined that the highest weighted alternative path has an abnormality after solving, the order of the bundle to which the highest weighted alternative path belongs is adjusted to the front; if the highest weighted alternative path is blocked, the highest weighted alternative path is deleted from the bundle to which it belongs.

[0012] According to a second aspect of the present disclosure, a path search device based on symbolic execution is provided, comprising: a path acquisition unit, used to perform path search on a tested program using a generation-based path traversal algorithm, so as to obtain executable paths of each generation corresponding to the tested program; a path optimization unit, used to determine optional paths in the executable path based on a preset path optimization function and path selection rules; a bundling unit, used to perform bundle processing on the optional paths of each generation to generate a bundle; a sorting unit, used to sort the bundle and the optional paths within the bundle based on the in-bundle coefficients and out-of-bundle coefficients corresponding to the optional paths; and a path solving unit, used to output the optional paths within the bundle and the corresponding path constraints to a solver, so that the solver generates new inputs.

[0013] Optionally, the path optimization function includes: a sensitive function, a bundling function and a function that characterizes whether there are subsequent branches or loops; the path optimization unit is used to calculate the weight of the executable path based on the path optimization function; and based on the path selection rule, select an executable path with a weight greater than a preset threshold from the executable path as the selectable path.

[0014] Optionally, the path optimization function is:

[0015] f(x)=g(x)+β / αj(x)+θk(x);

[0016] Among them, g(x) refers to the sensitivity function; ɑ refers to the coefficient of the bundle where the optional path is located, α<2^i-1, i is the current generation of the optional path; j(x) is the bundling function, β refers to the hierarchical weight coefficient of the optional path in the bundle; k(x) refers to the function that characterizes whether there are subsequent branches or loops, and θ refers to the complexity of the loop.

[0017] Optionally, the out-of-bundle coefficient is the ɑ, and the in-bundle coefficient is the β; the sorting processing unit is used to sort the bundles of each generation based on β / ɑ; and to sort the selectable paths within the bundle based on β.

[0018] Optionally, the path solving unit is specifically used to obtain the optional path with the highest weight in the bundle and the corresponding path constraint and output them to the solver.

[0019] Optionally, the path solving unit is also used to adjust the order of the bundle to which the highest weighted alternative path belongs to to the front if it is determined that an abnormality occurs after solving the alternative path with the highest weight; if the highest weighted alternative path is blocked, delete the highest weighted alternative path from the bundle to which it belongs.

[0020] According to a third aspect of the present disclosure, a path search device based on symbolic execution is provided, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute the method as described above based on instructions stored in the memory.

[0021] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the instructions are executed by a processor as described above.

[0022] The symbolic execution-based path search method, device and storage medium disclosed in the present invention optimize the generation-based path strategy algorithm to increase the directionality of the test; on the basis of high test coverage, the weight value of the path is increased and the path constraint set is simplified to save computing resources and improve test efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0024] Figure 1 A flowchart of an embodiment of a path search method based on symbolic execution according to the present disclosure;

[0025] Figure 2 A search schematic diagram of another embodiment of a path search method based on symbolic execution according to the present disclosure;

[0026] Figure 3 It is a module diagram of an embodiment of a path search device based on symbolic execution according to the present disclosure;

[0027] Figure 4 It is a module diagram of another embodiment of a path search device based on symbolic execution according to the present disclosure. DETAILED DESCRIPTION

[0028] The present disclosure is described more fully below with reference to the accompanying drawings, in which exemplary embodiments of the present disclosure are described. The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure. The technical solutions of the present disclosure are described in many aspects below in conjunction with various figures and embodiments.

[0029] In software testing, symbolic execution can achieve high code coverage by automatically generating test cases. Symbolic execution uses symbolic methods to explore all possible execution paths of a program, generate path constraints, solve the constraints, and automatically generate test cases.

[0030] The general process of using symbolic execution is: perform binary instrumentation on the program file. During the first execution, provide the program with a random or selected initial input data, and then symbolize the input data with the help of the instrumentation code; during the execution of the program, perform symbolic execution at the same time, and the instrumentation code will record the operations of the symbolized variables under each execution path; after one execution, form a constraint expression based on the collected constraints, and use the path search algorithm to negate one of the conditions in these expressions, call the constraint solver to solve, and thus generate a new test case, which will be executed along a different path for the next time.

[0031] The path search algorithm is an integral part of the symbolic execution process. The purpose of the path search is to ensure that the execution process can traverse all possible execution paths of the program, so as to comprehensively generate test cases to detect the program. Path search methods include: breadth-first search, generational search, random search, meta-strategy and other algorithms.

[0032] Figure 1 FIG. 1 is a flow chart of an embodiment of a path search method based on symbolic execution according to the present disclosure, as shown in FIG. Figure 1 As shown:

[0033] Step 101 : Use a generation-based path traversal algorithm to perform path search on the program under test to obtain executable paths of various generations corresponding to the program under test.

[0034] In one embodiment, fuzz testing and symbolic execution are two different testing methods. Fuzz testing is to provide a large number of malformed inputs to the target program and monitor the abnormal results of the target system to discover software defects. Symbolic execution is to represent the specific input of the target program with symbolic variables, use symbolic variables to interpret the execution program, use symbolic expressions to represent the jump conditions at the branch jumps of the program, and the final output of the program is a logical or arithmetic expression composed of symbolic variables, called path constraints; by negating the constraints, solving the symbolic variables, generating new test cases, and covering new paths in the program.

[0035] The algorithm idea of ​​the generation-based path traversal algorithm is: for the path constraints generated by the current input, the constraints are inverted in turn to generate the next generation of path constraint sets, and the above operations are repeated to traverse all executable paths in the program under test. The generation-based path traversal algorithm can generate multiple new path constraints each time, and generate new inputs through the constraint solver. The existing generation-based path traversal algorithm can be used to search for paths in the program under test.

[0036] Step 102: determining selectable paths in executable paths based on a preset path optimization function and path selection rules.

[0037] Step 103, performing bundle processing on the selectable paths of each generation to generate a bundle.

[0038] Step 104 , sorting the bundles and the optional paths in the bundles based on the in-bundle coefficients and out-of-bundle coefficients corresponding to the optional paths.

[0039] Step 105 , outputting the selectable paths in the bundle and the corresponding path constraints to the solver, so that the solver generates new inputs.

[0040] The constraint expressions formed by the path constraints obtained during the path exploration process can be inverted, and the path condition constraint expressions formed during the symbolic execution process can be solved. New test cases can be generated based on the solution results. The path constraints are composed of different conditional expressions. Existing solvers can be used to generate new inputs based on the input selectable paths and the corresponding path constraints.

[0041] In one embodiment, the path optimization function includes a sensitive function, a bundling function, and a function that characterizes whether there are subsequent branches or loops. The weight of the executable path is calculated based on the path optimization function, and the executable path with a weight greater than a preset threshold is selected from the executable path based on the path selection rule as the selectable path. For example, the path optimization function is:

[0042] f(x)=g(x)+β / αj(x)+θk(x);

[0043] Among them, g(x) refers to the sensitivity function; ɑ refers to the coefficient of the bundle where the optional path is located, α<2^i-1, i is the current generation of the optional path; j(x) is the bundling function, β refers to the hierarchical weight coefficient of the optional path in the bundle; k(x) refers to the function that characterizes whether there are subsequent branches or loops, θ refers to the complexity of the loop, and x represents the path or branch.

[0044] In one embodiment, the coefficient outside the bundle is ɑ, and the coefficient inside the bundle is β. There are many methods for sorting, for example, sorting the bundles of each generation based on β / ɑ; sorting the selectable paths within the bundle based on β.

[0045] There are many ways to output the optional paths and corresponding path constraints in the bundle to the solver. For example, the optional path with the highest weight in the bundle and the corresponding path constraint are obtained and output to the solver. If it is determined that the optional path with the highest weight is abnormal after solving, the order of the bundle to which the optional path with the highest weight belongs is adjusted to the front; if the optional path with the highest weight is not accessible, the optional path with the highest weight is deleted from the bundle to which it belongs.

[0046] The path search method based on symbolic execution in the above embodiment optimizes the generation-based path strategy algorithm, and adds parameters in the process of negating the collection constraint set in each generation to increase the directionality; on the basis of high coverage, the weight value of the path is increased and the path constraint set is simplified to save computing resources, reduce the probability of path explosion, and improve testing efficiency.

[0047] In one embodiment, based on the generation-based path traversal strategy in symbolic execution, a path optimization function is added to optimize the path and calculate the corresponding parameters to select the optimization method and whether to exclude:

[0048] The final path is obtained by calculating the sensitivity function of the path optimization function, the number of bundles, the hierarchical weight coefficients inside and outside the bundle, whether there are subsequent branches or loops, and the cyclic complexity, and then sorted according to the coefficient β / α of the bundle. The final path can be obtained according to the formula: f(x)=g(x)+β / αj(x)+θk(x), α<2^i-1 (i is the current generation).

[0049] Based on the above execution results, the paths in the bundle are sorted according to the hierarchical weight coefficient β, and the paths with high weights are extracted for solver solution. If there is abnormal feedback, the bundle is adjusted to the first place in the sequence and waits for the next generation of path traversal.

[0050] like Figure 2 As shown in the figure, the parameter data in the path optimization function: the sensitive function g(x) can be a specified function vulnerability set, such as a system built-in library function, etc.; the bundle number ɑ is the bundle of α paths at the current level, α<2^i-1 (i is the current generation); the hierarchical weight coefficient β can be used to calculate the weight coefficient of the path in the bundle according to the hierarchical analysis method (APH); whether there are subsequent branches or loops k(x): if there are subsequent branches or loops, k(x) is 1, otherwise it is 0; the cyclomatic complexity θ: the complexity coefficient of the subsequent loop can be calculated according to the APH. The specific calculation method of g(x) and k(x) needs to be formulated for specific scenarios. g(x) and k(x) can be a variety of existing functions. For example, g(x) is a specified function vulnerability set, such as a system built-in library function. The test unit needs to rate the vulnerability according to its own risk preference and then formulate this function. k(x) also needs to be specified according to the risk preference.

[0051] like Figure 2As shown in the figure, starting from the 0th generation, the optimization function parameters of the 0th generation are calculated and the available paths are output. The available paths are bundled into bundles, where the path bundling is the path bundling grouping. The bundled bundles are sorted according to the external coefficient β / α; the paths within the bundle are sorted according to the internal coefficient β, and the path with the highest weight is extracted and output to the solver. After solving, if an exception occurs, the entire bundle is adjusted and sorted to the first place in the sequence, waiting for the next generation of path constraint calculation; if the path is blocked, the path is removed from the bundle and the weight of the bundle is reduced.

[0052] In one embodiment, Figure 3 As shown, the present disclosure provides a path search device 30 based on symbolic execution, including: a path acquisition unit 31, a path optimization unit 32, a bundling unit 33, a sorting processing unit 34 and a path solving unit 35. The path acquisition unit 31 uses a generation-based path traversal algorithm to perform path search on the tested program to obtain executable paths of each generation corresponding to the tested program. The path optimization unit 32 determines an optional path in the executable path based on a preset path optimization function and a path selection rule.

[0053] The bundle splitting unit 33 performs bundle splitting processing on the optional paths of each generation to generate a bundle. The sorting processing unit 34 sorts the bundle and the optional paths in the bundle based on the in-bundle coefficients and out-of-bundle coefficients corresponding to the optional paths. The path solving unit 35 outputs the optional paths in the bundle and the corresponding path constraints to the solver so that the solver generates new inputs.

[0054] In one embodiment, the path optimization function includes a sensitive function, a bundling function, and a function that characterizes whether there are subsequent branches or loops; the path optimization unit 32 calculates the weight of the executable path based on the path optimization function, and selects an executable path with a weight greater than a preset threshold from the executable path based on the path selection rule as an optional path.

[0055] The sorting processing unit 34 sorts the bundles of each generation based on β / ɑ, and sorts the optional paths within the bundle based on β. The path solving unit 35 is used to obtain the optional path with the highest weight within the bundle and the corresponding path constraint and output it to the solver. If it is determined that the optional path with the highest weight is abnormal after solving, the path solving unit 35 can adjust the order of the bundle to which the optional path with the highest weight belongs to the front; if the optional path with the highest weight is blocked, the path solving unit 35 deletes the optional path with the highest weight from the bundle to which it belongs.

[0056] Figure 4 FIG. 2 is a schematic diagram of a module of another embodiment of a path search device based on symbolic execution according to the present disclosure. Figure 4 As shown, the apparatus may include a memory 41, a processor 42, a communication interface 43 and a bus 44. The memory 41 is used to store instructions, the processor 42 is coupled to the memory 41, and the processor 42 is configured to execute the above-mentioned path search method based on symbolic execution based on the instructions stored in the memory 41.

[0057] The memory 41 may be a high-speed RAM memory, a non-volatile memory, etc., or a memory array. The memory 41 may also be divided into blocks, and the blocks may be combined into virtual volumes according to certain rules. The processor 42 may be a central processing unit CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the path search method based on symbolic execution of the present disclosure.

[0058] In one embodiment, the present disclosure provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the path search method based on symbolic execution in any of the above embodiments.

[0059] The symbolic execution-based path search method, device and storage medium in the above-mentioned embodiments optimize the generation-based path strategy algorithm to increase the directionality of the test; on the basis of high test coverage, the weight value of the path is increased and the path constraint set is simplified to save computing resources and improve test efficiency.

[0060] The method and system of the present disclosure may be implemented in many ways. For example, the method and system of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0061] The description of the present disclosure is given for the purpose of illustration and description, and is not intended to be exhaustive or to limit the present disclosure to the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present disclosure, and to enable those of ordinary skill in the art to understand the present disclosure and thereby design various embodiments with various modifications suitable for specific uses.

Claims

1. A path search method based on symbolic execution, comprising: Using a generation-based path traversal algorithm to perform path search on the tested program to obtain executable paths of each generation corresponding to the tested program; Determine an optional path in the executable path based on a preset path optimization function and a path selection rule; The optional paths of each generation are separated into bundles to generate bundles; sorting the bundle and the optional paths within the bundle based on the in-bundle coefficients and out-of-bundle coefficients corresponding to the optional paths; Outputting the selectable paths within the bundle and the corresponding path constraints to the solver so that the solver generates new inputs; The path optimization function includes: a sensitive function, a bundling function, and a function that characterizes whether there are subsequent branches or loops; the determination of the selectable paths in the executable path based on the preset path optimization function and path selection rules includes: The weight of the executable path is calculated based on the path optimization function; and the executable path with a weight greater than a preset threshold is selected from the executable path based on the path selection rule as the selectable path.

2. The method of claim 1, wherein: The path optimization function is: f(x)=g(x)+β / αj(x)+θk(x); Among them, g(x) refers to the sensitivity function; ɑ refers to the coefficient of the bundle where the optional path is located, α<2^i-1, i is the current generation of the optional path; j(x) is the bundling function, β refers to the hierarchical weight coefficient of the optional path in the bundle; k(x) refers to the function that characterizes whether there are subsequent branches or loops, θ refers to the complexity of the loop, and x represents the path or branch.

3. The method of claim 2, wherein: The out-of-beam coefficient is the α, and the in-beam coefficient is the β; and the sorting of the bundle and the optional paths in the bundle based on the in-beam coefficient and the out-of-beam coefficient corresponding to the optional paths comprises: Sort the bundles of each generation based on β / ɑ; The alternative paths within the bundle are ranked based on β.

4. The method of claim 2, wherein the outputting the selectable paths and corresponding path constraints in the bundle to the solver comprises: The optional path with the highest weight in the bundle and the corresponding path constraint are obtained and output to the solver.

5. The method of claim 4, further comprising: If it is determined that the optional path with the highest weight is abnormal after solving, the order of the bundle to which the optional path with the highest weight belongs is adjusted to the front; If the alternative path with the highest weight is not accessible, the alternative path with the highest weight is deleted from the bundle to which it belongs.

6. A path search device based on symbolic execution, comprising: A path acquisition unit, used to perform a path search on the tested program using a generation-based path traversal algorithm to obtain executable paths of various generations corresponding to the tested program; A path optimization unit, configured to determine an optional path in the executable path based on a preset path optimization function and a path selection rule; A bundle splitting unit, used for performing bundle splitting processing on the optional paths of each generation to generate a bundle; A sorting processing unit, configured to sort the bundle and the optional paths within the bundle based on the in-bundle coefficients and out-of-bundle coefficients corresponding to the optional paths; A path solving unit, configured to output the selectable paths in the bundle and the corresponding path constraints to a solver, so that the solver generates a new input; Among them, the path optimization function includes: a sensitive function, a bundling function and a function that characterizes whether there are subsequent branches or loops; the path optimization unit is used to calculate the weight of the executable path based on the path optimization function; based on the path selection rule, an executable path with a weight greater than a preset threshold is selected from the executable path as the selectable path.

7. The device according to claim 6, wherein: The path optimization function is: f(x)=g(x)+β / αj(x)+θk(x); Among them, g(x) refers to the sensitivity function; ɑ refers to the coefficient of the bundle where the optional path is located, α<2^i-1, i is the current generation of the optional path; j(x) is the bundling function, β refers to the hierarchical weight coefficient of the optional path in the bundle; k(x) refers to the function that characterizes whether there are subsequent branches or loops, θ refers to the complexity of the loop, and x represents the path or branch.

8. The device according to claim 7, wherein: The out-of-beam coefficient is the α, and the in-beam coefficient is the β; The sorting processing unit is used to sort the bundles of each generation based on β / ɑ; and to sort the selectable paths within the bundles based on β.

9. The device of claim 8, wherein: The path solving unit is specifically used to obtain the optional path with the highest weight in the bundle and the corresponding path constraint and output them to the solver.

10. The device of claim 9, wherein: The path solving unit is further configured to adjust the order of the bundle to which the optional path with the highest weight belongs to to the front if it is determined that the optional path with the highest weight is abnormal after solving; If the alternative path with the highest weight is not accessible, the alternative path with the highest weight is deleted from the bundle to which it belongs.

11. A path search device based on symbolic execution, comprising: Memory; and a processor coupled to the memory, wherein the processor is configured to execute the method according to any one of claims 1 to 5 based on instructions stored in the memory. 12 . A computer-readable storage medium storing computer instructions, wherein the instructions are executed by a processor to execute the method according to claim 1 .

Images