A method, device and electronic device for mining vulnerability code samples of smart terminals

Abstract

The present application provides a method, device and electronic device for mining vulnerability code samples of smart terminals. The method includes: obtaining a code sample generated by a generator of a generative adversarial network for the current smart terminal; judging whether the code sample is a suspicious code based on the loss value corresponding to the code sample; when the code sample is determined to be suspicious code, performing a fuzz test on the code sample to obtain a corresponding fuzz test result; when the fuzz test result indicates that the code sample is a vulnerability code, using the code sample as a new vulnerability code sample. The method provided by the above scheme, by performing a fuzz test on the suspicious code generated by the generator during the construction process of the generative adversarial network, accurately judges whether the suspicious code is a vulnerability code, effectively increases the number of vulnerability code samples, and lays the foundation for improving the accuracy of the vulnerability code detection model.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, and electronic device for mining vulnerability code samples for smart terminals. Background Art

[0002] With the development of network technology, the most common attack method currently is that attackers attack the network system of smart terminals based on vulnerability codes, thereby causing damage to their network files. Therefore, it is very necessary to accurately and effectively identify vulnerability codes.

[0003] In the existing technology, since vulnerability codes differ from normal codes in structure, function and behavioral characteristics, vulnerability code detection models are often built based on neural networks to detect which codes are vulnerability codes by identifying the differences in the codes.

[0004] However, vulnerability codes are invisible, polymorphic, and multi-faceted, and the number of vulnerability code samples currently available to neural network model builders for model training is limited. Therefore, there is an urgent need for a method to mine a large number of vulnerability code samples, which is of great significance to improving the accuracy of vulnerability code detection models. Summary of the Invention

[0005] The present application provides a method, device and electronic device for mining vulnerability code samples for smart terminals to address the defects of the prior art, such as the limited number of vulnerability code samples available for model training.

[0006] The first aspect of the present application provides a method for mining vulnerability code samples for smart terminals, comprising:

[0007] Obtain the code sample generated by the generator of the generative adversarial network for the current smart terminal;

[0008] Determining whether the code sample is a suspicious code according to the loss value corresponding to the code sample;

[0009] When the code sample is determined to be suspicious code, a fuzz test is performed on the code sample to obtain a corresponding fuzz test result;

[0010] When the fuzz test result indicates that the code sample is a vulnerable code, the code sample is used as a new vulnerable code sample.

[0011] Optionally, judging whether the code sample is suspicious code according to the loss value corresponding to the code sample includes:

[0012] Inputting a preset code sample into the judge of the generative adversarial network to obtain the judgement result of the judge on the preset code sample and the corresponding loss value; wherein the judgment result is divided into normal code and vulnerability code;

[0013] Determine the suspicious code judgment range based on the average loss value corresponding to normal code and the average loss value corresponding to vulnerability code;

[0014] When the loss value corresponding to the code sample falls within the suspicious code judgment range, the code sample is determined to be a suspicious code.

[0015] Optionally, before determining whether the code sample is suspicious code based on the loss value corresponding to the code sample, the method further includes:

[0016] The code sample is input into the judge of the generative adversarial network to obtain a judgment result of the judge on the code sample and a corresponding loss value.

[0017] Optionally, performing fuzz testing on the code sample to obtain a corresponding fuzz testing result includes:

[0018] generating a plurality of fuzz test cases for the code sample;

[0019] Inputting each of the fuzzy test cases into the code sample in sequence to obtain a path coverage of each of the fuzzy test cases on the code sample and a corresponding fuzzy test sub-result;

[0020] Screening seed cases from the plurality of fuzzy test cases according to the path coverage of the code sample by each of the fuzzy test cases, and building a seed case pool;

[0021] extracting target seed use cases from the seed use case pool;

[0022] mutating the target seed use case to obtain a mutated target seed use case;

[0023] Inputting the mutated target seed use case into the code sample to obtain the path coverage of the mutated target seed use case on the code sample and the corresponding fuzz test sub-result;

[0024] If the path coverage of the mutated target seed use case for the code sample includes a new path, then adding the mutated target seed use case as a new seed use case to the seed use case pool, and returning to the step of extracting the target seed use case from the seed use case pool;

[0025] When a fuzz test termination signal is received, the fuzz test sub-results are aggregated to obtain a fuzz test result of the code sample.

[0026] Optionally, the method further includes:

[0027] If the path coverage of the mutated target seed use case for the code sample does not include a new path, the mutated target seed use case is discarded.

[0028] Optionally, extracting a target seed use case from the seed use case pool includes:

[0029] Sorting the seed use cases in the seed use case pool according to the priority of each seed use case;

[0030] According to the ranking result of the seed use cases, target seed use cases are extracted from the seed use case pool.

[0031] Optionally, mutating the target seed use case to obtain a mutated target seed use case includes:

[0032] According to a preset step size, several bits of the target seed use case are flipped to obtain a mutated target seed use case.

[0033] The second aspect of the present application provides a device for mining vulnerability code samples for smart terminals, comprising:

[0034] An acquisition module is used to obtain a code sample generated by a generator of a generative adversarial network for the current smart terminal;

[0035] a judgment module, configured to judge whether the code sample is suspicious code according to a loss value corresponding to the code sample;

[0036] A fuzz testing module is used to perform a fuzz test on the code sample when it is determined that the code sample is suspicious code, and obtain a corresponding fuzz testing result;

[0037] The mining module is used to use the code sample as a new vulnerable code sample when the fuzzy test result indicates that the code sample is a vulnerable code.

[0038] Optionally, the judgment module is specifically configured to:

[0039] Inputting a preset code sample into the judge of the generative adversarial network to obtain the judgement result of the judge on the preset code sample and the corresponding loss value; wherein the judgment result is divided into normal code and vulnerability code;

[0040] Determine the suspicious code judgment range based on the average loss value corresponding to normal code and the average loss value corresponding to vulnerability code;

[0041] When the loss value corresponding to the code sample falls within the suspicious code judgment range, the code sample is determined to be a suspicious code.

[0042] Optionally, the judgment module is further configured to:

[0043] The code sample is input into the judge of the generative adversarial network to obtain a judgment result of the judge on the code sample and a corresponding loss value.

[0044] Optionally, the fuzz testing module is specifically used to:

[0045] generating a plurality of fuzz test cases for the code sample;

[0046] Inputting each of the fuzzy test cases into the code sample in sequence to obtain a path coverage of each of the fuzzy test cases on the code sample and a corresponding fuzzy test sub-result;

[0047] Screening seed cases from the plurality of fuzzy test cases according to the path coverage of the code sample by each of the fuzzy test cases, and building a seed case pool;

[0048] extracting target seed use cases from the seed use case pool;

[0049] mutating the target seed use case to obtain a mutated target seed use case;

[0050] Inputting the mutated target seed use case into the code sample to obtain the path coverage of the mutated target seed use case on the code sample and the corresponding fuzz test sub-result;

[0051] If the path coverage of the mutated target seed use case for the code sample includes a new path, then adding the mutated target seed use case as a new seed use case to the seed use case pool, and returning to the step of extracting the target seed use case from the seed use case pool;

[0052] When a fuzz test termination signal is received, the fuzz test sub-results are aggregated to obtain a fuzz test result of the code sample.

[0053] Optionally, the fuzz testing module is further used to:

[0054] If the path coverage of the mutated target seed use case for the code sample does not include a new path, the mutated target seed use case is discarded.

[0055] Optionally, the fuzz testing module is specifically used to:

[0056] Sorting the seed use cases in the seed use case pool according to the priority of each seed use case;

[0057] According to the ranking result of the seed use cases, target seed use cases are extracted from the seed use case pool.

[0058] Optionally, the fuzz testing module is specifically used to:

[0059] According to a preset step size, several bits of the target seed use case are flipped to obtain a mutated target seed use case.

[0060] A third aspect of the present application provides an electronic device, comprising: at least one processor and a memory;

[0061] The memory stores computer-executable instructions;

[0062] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method described in the first aspect and various possible designs of the first aspect.

[0063] The fourth aspect of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When a processor executes the computer-executable instructions, the method described in the first aspect and various possible designs of the first aspect are implemented.

[0064] The technical solution of this application has the following advantages:

[0065] The present application provides a method, device and electronic device for mining vulnerability code samples of smart terminals. The method includes: obtaining a code sample generated by a generator of a generative adversarial network for the current smart terminal; judging whether the code sample is a suspicious code based on the loss value corresponding to the code sample; when the code sample is determined to be suspicious code, performing a fuzz test on the code sample to obtain a corresponding fuzz test result; when the fuzz test result indicates that the code sample is a vulnerability code, using the code sample as a new vulnerability code sample. The method provided by the above scheme, by performing a fuzz test on the suspicious code generated by the generator during the construction process of the generative adversarial network, accurately judges whether the suspicious code is a vulnerability code, effectively increases the number of vulnerability code samples, and lays the foundation for improving the accuracy of the vulnerability code detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0067] Figure 1 This is a schematic diagram of the structure of the intelligent terminal vulnerability code sample mining system based on the embodiments of the present application;

[0068] Figure 2A flowchart of a method for mining vulnerability code samples for smart terminals provided in an embodiment of the present application;

[0069] Figure 3 A diagram showing the structure of a judger for a generative adversarial network according to an embodiment of the present application;

[0070] Figure 4 A diagram showing the structure of a fully connected neural network at the end of the decision maker provided in an embodiment of the present application;

[0071] Figure 5 A schematic diagram of the training process of a generative adversarial network provided in an embodiment of the present application;

[0072] Figure 6 A schematic diagram of the fuzzy testing process provided in an embodiment of the present application;

[0073] Figure 7 A schematic diagram of the structure of a device for mining vulnerability code samples for smart terminals provided in an embodiment of the present application;

[0074] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0075] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present disclosure in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0076] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0077] In addition, the terms "first," "second," etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. In the description of the following embodiments, "plurality" means more than two, unless otherwise specifically defined.

[0078] With the rapid development and advancement of computer technology, smart terminals are being used in a wider range of applications, bringing greater convenience to people. However, these applications also pose numerous security risks. Current offline vulnerability mining technology for smart terminal devices is insufficient, and vulnerability mining is limited to traditional information systems. This makes it impossible to identify security vulnerabilities in smart terminals before they are put into operation.

[0079] Existing binary code vulnerability datasets have incomplete coverage, and manual binary program vulnerability mining is difficult and inefficient. Generative adversarial networks can solve the problem of too few vulnerability code datasets. However, the code samples randomly generated by the generator in the current generative adversarial network contain a large amount of suspicious code, and the judge cannot accurately screen out vulnerable code from these suspicious codes.

[0080] In response to the above problems, the embodiments of the present application provide a method, device, and electronic device for mining vulnerability code samples for smart terminals. The method, device, and electronic device obtain the code sample generated by the generator of the generative adversarial network for the current smart terminal; determine whether the code sample is suspicious code based on the loss value corresponding to the code sample; when the code sample is determined to be suspicious code, perform a fuzz test on the code sample to obtain the corresponding fuzz test result; when the fuzz test result indicates that the code sample is a vulnerability code, the code sample is used as a new vulnerability code sample. The method provided by the above scheme accurately determines whether the suspicious code is a vulnerability code by performing a fuzz test on the suspicious code generated by the generator during the construction of the generative adversarial network, thereby effectively increasing the number of vulnerability code samples and laying the foundation for improving the accuracy of the vulnerability code detection model.

[0081] The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The following describes the embodiments of the present invention in conjunction with the accompanying drawings.

[0082] First, the structure of the intelligent terminal vulnerability code sample mining system on which this application is based is described:

[0083] The method, device and electronic device for mining vulnerability code samples of smart terminals provided in the embodiments of the present application are suitable for expanding vulnerability code samples of smart terminals. Figure 1 As shown, this is a structural diagram of the smart terminal vulnerability code sample mining system based on an embodiment of the present application, which mainly includes a data acquisition device and a smart terminal vulnerability code sample mining device. Specifically, the data acquisition device is used to collect code samples generated by a generator in a preset generative adversarial network, and then send the collected code samples to the smart terminal vulnerability code sample mining device to decide whether to use the code sample as a new vulnerability code sample based on the device.

[0084] The present invention provides a method for mining vulnerability code samples for smart terminals, which is used to expand vulnerability code samples for smart terminals. The execution subject of the present invention is an electronic device, such as a server, desktop computer, laptop computer, tablet computer, or other electronic device that can be used to expand vulnerability code samples.

[0085] like Figure 2 FIG. 1 is a flow chart of a method for mining vulnerability code samples for smart terminals provided by an embodiment of the present application, the method comprising:

[0086] Step 201: Obtain a code sample generated by a generator of a generative adversarial network for the current smart terminal.

[0087] Among them, the code sample generated by the embodiment of the present application can be a binary code sample.

[0088] Specifically, a generative adversarial network suitable for the current smart terminal can be pre-trained. After the training of the generative adversarial network is completed, a code sample is generated for the current smart terminal based on the generator in the generative adversarial network. The generator can specifically generate code samples based on random noise information.

[0089] Step 202: Determine whether the code sample is suspicious code based on the loss value corresponding to the code sample.

[0090] It should be noted that suspicious code is code whose type cannot be accurately determined by the judge of the generative adversarial network.

[0091] Specifically, in one embodiment, the code sample can be input into the judge of the generative adversarial network to obtain the judge's judgment result on the code sample and the corresponding loss value.

[0092] Specifically, the loss value of the judgment result of the judge on the code sample can be calculated based on the following loss function:

[0093]

[0094] Among them, E(·) represents the expected value of the distribution function, P data (x) represents the distribution of preset code samples, P z (z) represents the noise distribution defined in low dimension, G(z) represents the code sample generated by the generator, D(x) represents the judgment result of the judge on the code sample, V(D,G) represents the difference between the preset code sample and the code sample generated by the generator, The meaning is to fix the generator G and make the judge maximize the ability to distinguish whether the current input code sample comes from the preset code sample or the code sample generated by the generator. Consider the latter part as a whole, let against Here, the generator G is obtained under the condition of a fixed judge D. This G is required to minimize the difference between the preset code sample and the code sample generated by the generator. Through the above-mentioned min and max game process, it will ideally converge to the true distribution.

[0095] Step 203: When the code sample is determined to be suspicious code, a fuzz test is performed on the code sample to obtain a corresponding fuzz test result.

[0096] It should be noted that before performing fuzz testing on the code sample, the code sample needs to be converted into an executable file.

[0097] Specifically, a fuzzy testing model for performing fuzz testing on code samples can be pre-deployed. When a code sample is determined to be suspicious code, the code sample can be input into the fuzzy testing model to perform corresponding fuzz testing on the code sample based on the fuzzy testing model and output the corresponding fuzzy testing results.

[0098] Step 204: When the fuzzy test result indicates that the code sample is a vulnerable code, the code sample is used as a new vulnerable code sample.

[0099] It should be noted that the principle of fuzz testing is to input unexpected inputs into a code sample and determine whether the code sample is a vulnerable code based on the output results fed back by the code sample.

[0100] Specifically, when the fuzz testing result indicates that the code sample is a vulnerable code, the code sample may be determined as a vulnerable code sample and added as a new vulnerable code sample to the vulnerable code sample set to expand the vulnerable code sample set.

[0101] For the generative adversarial network provided in the embodiment of the present application, such as Figure 3 As shown in FIG, the structure diagram of the judger of the generative adversarial network provided in the embodiment of the present application is as follows: Figure 4 As shown, it is a fully connected neural network structure diagram of the end of the judge provided in the embodiment of the present application. The judge includes a CNN module and a fully connected layer module, specifically including 5 convolution layers and 4 fully connected layers; wherein, the structures of convolution layers 1, 2, and 4 are the same, and the convolution kernel size is 5, the convolution step is 1, and the feature map filling width is 1; the structures of convolution layers 3 and 5 are the same, and the convolution kernel size is 4, the convolution step is 2, and the feature map filling width is 1. In addition to outputting the true and false discrimination of the sample, the output layer of the judge also outputs a posterior estimate of the sample label, which in the embodiment of the present application is a classification of whether the binary code sample is a vulnerability code. The new code sample corresponding to the result output by the judge is sent back to the generator to continue training to optimize the generative adversarial network model.

[0102] The purpose of the generator is to generate realistic code samples as much as possible, and the purpose of the judge is to determine whether the output of the generator is a new code sample. Training stops when the judge's predicted probability of the code sample generated by the generator is close to 0.5, that is, when the judge cannot distinguish between true and false.

[0103] Among them, Figure 5 As shown, it is a schematic diagram of the training process of the generative adversarial network provided by the embodiment of the present application, wherein the preset code samples include a vulnerability code dataset and a normal code dataset. The generative adversarial network is trained separately and iteratively, so the objective function is also optimized for the judge and the generator respectively. First, the judge is optimized, and the expression is as follows:

[0104]

[0105] After completing the optimization of the discriminator, the generator is optimized. Specifically, the judgment result D(G(z)) can be made close to 1, that is, the total value is minimized.

[0106] Optimize the judgement, the expression is as follows:

[0107]

[0108] Based on the above embodiments, in order to accurately screen suspicious code, as an implementable approach, in one embodiment, determining whether a code sample is suspicious code based on the loss value corresponding to the code sample includes:

[0109] In step 2021, the preset code sample is input into the judge of the generative adversarial network to obtain the judgement result of the judge on the preset code sample and the corresponding loss value.

[0110] Among them, the judgment results are divided into normal code and vulnerability code.

[0111] Step 2022: Determine the suspicious code judgment range based on the average loss value corresponding to the normal code and the average loss value corresponding to the vulnerability code.

[0112] Step 2023: When the loss value corresponding to the code sample falls within the suspicious code judgment range, the code sample is determined to be a suspicious code.

[0113] Specifically, a certain number of preset code samples of known types can be input into the generative adversarial network's judger, which then performs type judgment on these preset code samples based on the judger, obtaining the current judger's judgment results and corresponding loss values for each preset code sample. The suspicious code judgment range (a, b) is then determined by calculating the average loss value a for the preset code samples whose judgment results are normal code, and the average loss value b for the preset code samples whose judgment results are vulnerability code. Furthermore, if the loss value corresponding to the judger's recognition result for the current code sample falls within the suspicious code judgment range (a, b), the code sample is determined to be suspicious code.

[0114] Based on the above embodiment, as an implementable approach, in one embodiment, fuzz testing is performed on the code sample to obtain corresponding fuzz testing results, including:

[0115] Step 2031, generating multiple fuzzy test cases for the code sample;

[0116] Step 2032: input each fuzzy test case into the code sample in sequence to obtain the path coverage of each fuzzy test case on the code sample and the corresponding fuzzy test sub-result;

[0117] Step 2033: Screen seed cases from multiple fuzzy test cases based on the path coverage of the code sample by each fuzzy test case, and build a seed case pool;

[0118] Step 2034: extracting a target seed use case from the seed use case pool;

[0119] Step 2035: mutate the target seed use case to obtain a mutated target seed use case;

[0120] Step 2036: Input the mutated target seed use case into the code sample to obtain the path coverage of the mutated target seed use case on the code sample and the corresponding fuzz test sub-result;

[0121] Step 2037: If the path coverage of the mutated target seed use case for the code sample includes a new path, then the mutated target seed use case is added to the seed use case pool as a new seed use case, and the process returns to the step of extracting the target seed use case from the seed use case pool.

[0122] Step 2038: When a fuzz test termination signal is received, the fuzz test sub-results are aggregated to obtain the fuzz test result of the code sample.

[0123] Accordingly, in one embodiment, if the path coverage of the mutated target seed use case for the code sample does not include the new path, the mutated target seed use case is discarded, where Figure 6The figure shows a schematic diagram of the fuzzy testing process provided in an embodiment of the present application.

[0124] It's important to note that the fuzz testing process consists of two parts. The first involves executing and tracing code samples. This involves performing lightweight analysis of the code samples after the test case is entered to determine the path coverage of the code sample during execution. The second part involves generating test samples. This involves selecting target seed cases from a pool of seed cases during each test and then generating malformed inputs for the code sample to execute based on different mutation strategies.

[0125] Specifically, after each round of fuzz testing, if the currently used mutated target seed case covers the new path, the mutated target seed case is saved in the seed case pool, otherwise it is discarded. Finally, a round of fuzz testing ends and the next round of testing is prepared. This process is continuously looped. If a fuzz test causes the sample code to crash abnormally or an error occurs, the test case that currently triggers the crash is recorded in the corresponding fuzz test sub-result, and then the loop continues until the fuzz test termination signal is received. At this time, all the previously obtained fuzz test sub-results are summarized to obtain the fuzz test result of the code sample.

[0126] Specifically, in one embodiment, in order to determine whether a new path is covered, the path information of the path coverage range corresponding to the current test case can be saved in a hash table. This not only saves the path passing information, but also records the number of times the path is passed. The key in the hash table represents a path, and the value records the number of times the path is covered. When the target program is executed, AFL begins to analyze this hash table to determine the execution status of the sample code. When analyzing whether there is a new path, the corresponding position can also be obtained to store the number of times the path is covered. When the path coverage result of the code sample execution is obtained again, it is only necessary to compare the path records. If the number of times the hash node corresponding to a block of paths increases, that is, it is no longer zero, it means that this execution covers a new path. At this time, the path record retained by AFL itself is modified, and the input of this execution is saved as a new seed case and added to the seed case pool.

[0127] Specifically, in one embodiment, in order to ensure that high-quality target seed use cases can be extracted to improve the efficiency of fuzz testing, the seed use cases in the seed use case pool can be sorted according to the priorities of various sub-use cases; based on the sorting results of the seed use cases, the target seed use cases are extracted from the seed use case pool.

[0128] Specifically, the priorities of various sub-use cases can be set according to the sizes of the path coverage corresponding to the various sub-use cases, and the target seed case extracted for the first time can be the seed case with the largest path coverage.

[0129] Specifically, in one embodiment, several bits of the target seed use case may be flipped according to a preset step size to obtain a mutated target seed use case.

[0130] It should be noted that in order to test the detected path as comprehensively as possible, when a target seed case is selected, not only one mutation can be performed, but multiple mutations will be performed for the target seed case to test the target seed case as comprehensively as possible.

[0131] Specifically, a random mutation method can be used to mutate the value of each bit / byte of the target seed use case, such as using a bit flipping method to continuously flip several bits according to a preset step size, or flipping bits of a fixed width at a random or specific position.

[0132] Similarly, you can overwrite some bytes in the target seed case with preset values, or insert them into specific bytes of the target seed case. The preset values can be randomly generated or user-specified. You can also concatenate two or more target seed cases with significant differences to obtain a mutated target seed case.

[0133] The method for mining vulnerability code samples for smart terminals provided in the embodiment of the present application obtains the code sample generated by the generator of the generative adversarial network for the current smart terminal; determines whether the code sample is suspicious code based on the loss value corresponding to the code sample; when the code sample is determined to be suspicious code, fuzz testing is performed on the code sample to obtain the corresponding fuzz test result; when the fuzz test result indicates that the code sample is a vulnerability code, the code sample is used as a new vulnerability code sample. The method provided by the above scheme, by fuzz testing the suspicious code generated by the generator during the construction process of the generative adversarial network, accurately determines whether the suspicious code is a vulnerability code, effectively increases the number of vulnerability code samples, and lays the foundation for improving the accuracy of the vulnerability code detection model.

[0134] An embodiment of the present application provides a device for mining vulnerability code samples of smart terminals, which is used to execute the method for mining vulnerability code samples of smart terminals provided in the above embodiment.

[0135] like Figure 7 FIG. 7 is a schematic diagram of a device for mining vulnerability code samples of smart terminals according to an embodiment of the present invention. The device 70 comprises an acquisition module 701 , a judgment module 702 , a fuzzy testing module 703 and a mining module 704 .

[0136] Among them, the acquisition module is used to obtain the code sample generated by the generator of the generative adversarial network for the current smart terminal; the judgment module is used to judge whether the code sample is suspicious code based on the loss value corresponding to the code sample; the fuzzy testing module is used to perform fuzz testing on the code sample when it is determined that the code sample is suspicious code to obtain the corresponding fuzzy testing result; the mining module is used to use the code sample as a new vulnerable code sample when the fuzzy testing result indicates that the code sample is a vulnerable code.

[0137] Specifically, in one embodiment, the judgment module is specifically configured to:

[0138] Input the preset code sample into the judge of the generative adversarial network to obtain the judgement result of the judge on the preset code sample and the corresponding loss value; wherein the judgment result is divided into normal code and vulnerable code;

[0139] Determine the suspicious code judgment range based on the average loss value corresponding to normal code and the average loss value corresponding to vulnerability code;

[0140] When the loss value corresponding to the code sample falls within the suspicious code judgment range, the code sample is determined to be a suspicious code.

[0141] Specifically, in one embodiment, the judgment module is further configured to:

[0142] The code sample is input into the judge of the generative adversarial network to obtain the judgement result of the code sample and the corresponding loss value.

[0143] Specifically, in one embodiment, the fuzz testing module is specifically used to:

[0144] Generate multiple fuzz test cases for code samples;

[0145] Input each fuzzy test case into the code sample in turn to obtain the path coverage of each fuzzy test case on the code sample and the corresponding fuzzy test sub-result;

[0146] Based on the path coverage of each fuzz test case on the code sample, seed cases are screened from multiple fuzz test cases and a seed case pool is constructed.

[0147] Extract target seed use cases from the seed use case pool;

[0148] Mutate the target seed use case to obtain a mutated target seed use case;

[0149] Input the mutated target seed use case into the code sample to obtain the path coverage of the mutated target seed use case on the code sample and the corresponding fuzz test sub-result;

[0150] If the path coverage of the mutated target seed use case for the code sample includes a new path, then the mutated target seed use case is added to the seed use case pool as a new seed use case, and the process returns to the step of extracting the target seed use case from the seed use case pool;

[0151] When a fuzz test termination signal is received, the fuzz test sub-results are aggregated to obtain the fuzz test result of the code sample.

[0152] Specifically, in one embodiment, the fuzz testing module is further configured to:

[0153] If the path coverage of the mutated target seed use case for the code sample does not include the new path, the mutated target seed use case is discarded.

[0154] Specifically, in one embodiment, the fuzz testing module is specifically used to:

[0155] Sort the seed use cases in the seed use case pool according to the priorities of various sub-use cases;

[0156] According to the ranking results of the seed use cases, the target seed use cases are extracted from the seed use case pool.

[0157] Specifically, in one embodiment, the fuzz testing module is specifically used to:

[0158] According to the preset step size, several bits of the target seed use case are flipped to obtain the mutated target seed use case.

[0159] Regarding the intelligent terminal vulnerability code sample mining device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method and will not be elaborated here.

[0160] The smart terminal vulnerability code sample mining device provided in the embodiment of the present application is used to execute the smart terminal vulnerability code sample mining method provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0161] An embodiment of the present application provides an electronic device for executing the smart terminal vulnerability code sample mining method provided in the above embodiment.

[0162] like Figure 8 FIG. 8 is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. The electronic device 80 includes at least one processor 81 and a memory 82 .

[0163] The memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the smart terminal vulnerability code sample mining method provided in the above embodiment.

[0164] An electronic device provided in an embodiment of the present application is used to execute the smart terminal vulnerability code sample mining method provided in the above embodiment. Its implementation method and principle are the same and will not be repeated here.

[0165] An embodiment of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When a processor executes the computer-executable instructions, the smart terminal vulnerability code sample mining method provided in any of the above embodiments is implemented.

[0166] The storage medium containing computer-executable instructions in the embodiment of the present application can be used to store computer-executable instructions of the smart terminal vulnerability code sample mining method provided in the aforementioned embodiment. Its implementation method and principle are the same and will not be repeated here.

[0167] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0168] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0169] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0170] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program code.

[0171] Those skilled in the art will clearly understand that for the sake of convenience and brevity, the division of the above-mentioned functional modules is only used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0172] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for mining vulnerability code samples of smart terminals, characterized in that: include: Obtain the code sample generated by the generator of the generative adversarial network for the current smart terminal; Determining whether the code sample is a suspicious code according to the loss value corresponding to the code sample; When the code sample is determined to be suspicious code, a fuzz test is performed on the code sample to obtain a corresponding fuzz test result; When the fuzz test result indicates that the code sample is a vulnerable code, using the code sample as a new vulnerable code sample; The determining, based on the loss value corresponding to the code sample, whether the code sample is a suspicious code includes: Inputting a preset code sample into the judge of the generative adversarial network to obtain the judgement result of the judge on the preset code sample and the corresponding loss value; wherein the judgment result is divided into normal code and vulnerability code; Determine the suspicious code judgment range based on the average loss value corresponding to normal code and the average loss value corresponding to vulnerability code; When the loss value corresponding to the code sample falls within the suspicious code judgment range, determining that the code sample is a suspicious code; Before determining whether the code sample is suspicious code based on the loss value corresponding to the code sample, the method further includes: The code sample is input into the judge of the generative adversarial network to obtain a judgment result of the judge on the code sample and a corresponding loss value.

2. The method according to claim 1, characterized in that The fuzz testing is performed on the code sample to obtain corresponding fuzz testing results, including: generating a plurality of fuzz test cases for the code sample; Inputting each of the fuzzy test cases into the code sample in sequence to obtain a path coverage of each of the fuzzy test cases on the code sample and a corresponding fuzzy test sub-result; Screening seed cases from the plurality of fuzzy test cases according to the path coverage of the code sample by each of the fuzzy test cases, and building a seed case pool; extracting target seed use cases from the seed use case pool; mutating the target seed use case to obtain a mutated target seed use case; Inputting the mutated target seed use case into the code sample to obtain the path coverage of the mutated target seed use case on the code sample and the corresponding fuzz test sub-result; If the path coverage of the mutated target seed use case for the code sample includes a new path, then adding the mutated target seed use case as a new seed use case to the seed use case pool, and returning to the step of extracting the target seed use case from the seed use case pool; When a fuzz test termination signal is received, the fuzz test sub-results are aggregated to obtain a fuzz test result of the code sample.

3. The method according to claim 2, characterized in that The method further comprises: If the path coverage of the mutated target seed use case for the code sample does not include a new path, the mutated target seed use case is discarded.

4. The method according to claim 2, characterized in that Extracting the target seed use case from the seed use case pool includes: Sorting the seed use cases in the seed use case pool according to the priority of each seed use case; According to the ranking result of the seed use cases, target seed use cases are extracted from the seed use case pool.

5. The method according to claim 2, characterized in that The mutating the target seed use case to obtain a mutated target seed use case includes: According to a preset step size, several bits of the target seed use case are flipped to obtain a mutated target seed use case.

6. A device for mining vulnerability code samples of smart terminals, characterized in that: include: An acquisition module is used to obtain a code sample generated by a generator of a generative adversarial network for the current smart terminal; a judgment module, configured to judge whether the code sample is suspicious code according to a loss value corresponding to the code sample; A fuzz testing module is used to perform a fuzz test on the code sample when it is determined that the code sample is suspicious code, and obtain a corresponding fuzz testing result; A mining module, configured to use the code sample as a new vulnerable code sample when the fuzz testing result indicates that the code sample is a vulnerable code; The judgment module is specifically used to: Inputting a preset code sample into the judge of the generative adversarial network to obtain the judgement result of the judge on the preset code sample and the corresponding loss value; wherein the judgment result is divided into normal code and vulnerability code; Determine the suspicious code judgment range based on the average loss value corresponding to normal code and the average loss value corresponding to vulnerability code; When the loss value corresponding to the code sample falls within the suspicious code judgment range, determining that the code sample is a suspicious code; The judgment module is further configured to: Before determining whether the code sample is suspicious code based on the loss value corresponding to the code sample, the code sample is input into the judge of the generative adversarial network to obtain the judgement result of the judge on the code sample and the corresponding loss value.

7. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and when a processor executes the computer-executable instructions, the method according to any one of claims 1 to 5 is implemented.

Images