A mapping relationship guided cyclic code fuzz testing method

Abstract

This invention discloses a mapping-guided fuzzing method for loop code, applied in the field of software testing. The method includes: continuously mutating test cases, inputting them into a test case queue, sending them to the program under test (CUPT) with instrumented loop code structures, and outputting a coverage statistics table when the fuzzing termination condition is met; training a deep learning model and back-calculating the weighted distance sum to construct and output a mapping relationship between the byte sequences of test cases and the coverage of the loop code structure; based on the mapping relationship, assigning mutation probabilities to the corresponding byte sequences in the test cases corresponding to the loop code structure coverage and performing mutations to generate child test cases, which are then used as input to the CUPT for fuzzing until the fuzzing termination condition is met, and outputting a fuzzing report. This method mutates the byte sequences of test cases based on mapping relationships, enabling the targeted generation of test cases that improve the coverage of loop code results.

Description

Technical Field

[0001] This invention relates to the field of software testing, and in particular to a mapping-guided fuzzing method for loop code. Background Technology

[0002] As industrial software evolves and iterates, its scale expands, and the number of defects within it increases accordingly. Software defects are errors introduced during the software coding process. These defects can lead to abnormal software operation, or even cause economic losses or endanger lives.

[0003] Software testing is an effective means of reducing software defects. Based on whether the software under test is run, it can be divided into two types: static analysis and dynamic testing. Static analysis refers to analyzing the control flow, data flow, and other information in the code to determine if software defects exist. Dynamic analysis refers to running the program under test and observing its execution and results to determine if software defects exist.

[0004] Fuzz testing is a type of dynamic analysis. The main idea of ​​fuzz testing is to generate a large number of valid or partially valid inputs as test cases, send them to the program under test to execute, and monitor the execution of the software under test to collect the coverage of test objects (such as functions, basic blocks, loop code, or other code structures) and discover phenomena such as program crashes and assertion violations, thereby determining whether there are software defects.

[0005] The core of fuzzing technology lies in the quality of test cases. High-quality test cases can cover more software code, thus enabling more comprehensive analysis and testing of the software code. Among existing fuzzing technologies, coverage-guided fuzzing tools such as AFL use genetic algorithms as a test case retention strategy. They retain test cases that can cover more code and then use byte-level operations (such as bit reversal) to mutate the retained test cases, thereby generating test cases that can improve code coverage.

[0006] However, coverage-guided fuzzing tools like AFL do not fully utilize semantic information such as control flow in the program, blindly generating test inputs, which may result in a large number of invalid test cases, leading to low testing efficiency. Furthermore, this type of method struggles to target code coverage and analysis, and cannot effectively detect software defects. Target-guided fuzzing tools like AFLGo use specific basic blocks as targets, generating test cases that approximate the target basic block by retaining seeds that are close to it. However, their detection efficiency is low, and they cannot determine the correlation between basic block coverage and test cases.

[0007] Loop code is one of the basic software structures, capable of repeatedly executing statements within the loop body until a loop termination condition is met. Compared to other basic structures, defects in loop code have a greater impact, and due to issues such as the indeterminate number of iterations and the indirect influence of loop termination conditions on the execution of statements within the loop body, existing fuzzing methods struggle to adequately test loop code structures.

[0008] Therefore, how to provide a mapping-guided loop code fuzzing method that can selectively mutate test cases based on the coverage of loop code structure, thereby improving test accuracy and efficiency, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0009] In view of this, this invention proposes a mapping-guided fuzzing method for loop code. This method inputs test cases, runs the program under test with instrumented loop code, and determines whether the test cases meet the fuzzing termination condition. If they do, a coverage statistics table is output; otherwise, the test cases are mutated to generate child test cases that meet the fuzzing termination condition. Based on the output coverage statistics table, a deep learning model is trained and the weighted distance sum is calculated in reverse to construct and output a mapping relationship between the byte sequence of the test cases and the coverage of the loop code structure. Based on this mapping relationship, the corresponding byte sequence in the test cases corresponding to the loop code structure coverage is specifically mutated to generate the next generation of child test cases. The next generation of test cases is used as input to the program under test for fuzzing until the fuzzing termination condition is met, and a fuzzing report is output. This invention mutates the byte sequence of test cases based on mapping relationships, which can generate high-quality test cases more specifically. This not only increases the coverage of loop code structures by test cases and performs more thorough testing of loop code structures in the project under test, thus improving test accuracy, but also improves test efficiency by reducing the blind generation of test case inputs and avoiding a large number of invalid test cases.

[0010] To achieve the above objectives, the present invention adopts the following technical solution:

[0011] A mapping-guided fuzzing method for loop code includes:

[0012] S1: Input the project under test, instrument the loop code structure, compile and output the program under test;

[0013] S2: Input the initial test cases and mutate them. Add the mutated test cases to the test case queue and send them to the program under test for execution. Determine whether the test case queue meets the fuzz test termination condition. If it does, output the coverage statistics table. If it does not meet the condition, mutate the test cases in the test case queue to generate child test cases to meet the fuzz test termination condition.

[0014] S3: Input the coverage statistics table, train the deep learning model and back-calculate the weight distance sum, construct and output the mapping relationship between the byte sequence of the test cases and the coverage of the loop code structure;

[0015] S4: Based on the mapping relationship, mutate the corresponding byte sequence in the test cases that correspond to the loop code structure coverage to generate child test cases;

[0016] S5: Use the S4 child test cases as input to the S2 program under test, perform fuzz testing until the fuzz testing termination condition is met, and output the fuzz test report.

[0017] Optionally, S1 is as follows:

[0018] S1-1: Input the item to be tested;

[0019] S1-2: Read and iterate through the sequence of test objects of the project under test, and determine the test object. i If the code is in a loop, proceed to step S1-3; otherwise, proceed to step S1-4.

[0020] S1-3: Test object Object i Perform the drive and, after the drive is completed, proceed to steps S1-4.

[0021] S1-4: Determine if the entire sequence of test objects has been traversed. If it has been traversed, execute S1-5; otherwise, execute S1-2.

[0022] S1-5: Compile the test item after the staking into the test program;

[0023] S1-6: Output the program under test.

[0024] Optionally, S2 is as follows:

[0025] S2-1: Input the initial test cases and the program under test, and add the initial test cases to the test case queue;

[0026] S2-2: Determine whether the fuzz test termination condition is met. If the termination condition is not met, proceed to step S2-3; otherwise, proceed to step S2-13.

[0027] S2-3: Mutate the test cases in the test case queue and add the generated child test cases to the test case queue;

[0028] S2-4: Read the child test cases from the test case queue one by one, and send the child test cases to the program under test as input to the program under test, until the test case queue is empty;

[0029] S2-5: Run the program under test and collect the coverage information for each child test case;

[0030] S2-6: Traverse the child test cases. If the child test cases have not been completely traversed, execute S2-7; otherwise, execute S2-2.

[0031] S2-7: Read the i-th child test case t from the test case queue Te. i and child test cases t i Corresponding coverage;

[0032] S2-8: Determine the child generation test cases t i If a crash is triggered, proceed to step S2-10; otherwise, proceed to step S2-9.

[0033] S2-9: Determine the child generation test cases t i If more loop code structures are covered, execute S2-11; otherwise, execute S2-5.

[0034] S2-10: Translate the child test cases t i Save to local storage;

[0035] S2-11: Translate the child test cases t i Add to the test case queue;

[0036] S2-12: Save the child test cases and their corresponding coverage information to the coverage statistics table; execute S2-6;

[0037] S2-13: Output coverage statistics table.

[0038] Optionally, S3 specifically refers to:

[0039] S3-1: Input consists of the test case set Te = (t1, t2, ..., t n ) T The test case coverage set S = (s1, s2, ..., s...) n ) T Coverage statistics table;

[0040] Where n is the number of test cases, the elements in Te are the test cases, and the elements in S are the test case coverage.

[0041] S3-2: Transform the test case set Te and the test case coverage set S into training data that can be recognized by the deep learning model;

[0042] t i For the i-th test case, set the test case set Te = (t1, t2, ..., t... n ) T Test case t in i Perform binary conversion and select the first k bytes as test case t. i The binary byte sequence, t i =(x i,1 ,x i,2 ,…,x i,k ); obtain test case t i The characteristic matrix M feature :

[0043]

[0044] Where k is determined by the user and is the number of bytes selected to convert the test cases into binary bytes;

[0045] s i Then it is test case t i The coverage of each loop code structure is used as input to the program under test. i =(y i,1 ,y i,2 ,…,y i,m ), where m is the number of loop code structures in the tested project; based on s i Test case t can be obtained. i The label matrix M, which serves as the input to the program under test, shows the coverage of each loop code structure. label ;

[0046]

[0047]

[0048] Among them, y i,j For test case t i The j-th loop code structure Object is used as input. j Coverage status;

[0049] S3-3: Based on the feature matrix M feature and label matrix M labelThe deep learning model is trained; the training data of the model consists of n pairs of tuples, where the i-th pair of tuples is the i-th row of the feature matrix and the label matrix, which are used as the feature vector and the label vector, respectively, where 1≤i≤n; the deep learning model adopts a fully connected neural network model.

[0050] S3-4: Perform reverse computation on the trained deep neural network model N. The input layer X of N consists of k neurons, X = (x1, x2, ..., x...). k ), where k is the number of features, and is the length of the selected test case byte sequence; the output layer Y of N consists of m neurons, Y = (y1, y2, ..., y m ), where m is the number of tags and is the number of loop code structures;

[0051] For each neuron y in the output layer j And each neuron x in the input layer i y can be calculated using formula (4). j With each x i The weighted distance between them;

[0052]

[0053] U in formula (4) i,j For output layer neuron y j With input layer neuron x i The weighted distance between them; p is x i With y j The number of neuron connection paths between them, for a fully connected neural network, p can be calculated by formula (5);

[0054]

[0055] Where d represents the number of hidden layers in the deep neural network N; SizeOfLayer(index) represents the number of neurons in the index-th hidden layer. Multiplying the number of neurons in each hidden layer gives the number of neurons x from the input layer. i to the output layer neuron y j The number of connection paths between them;

[0056] In formula (4) For input layer neuron x i With output layer neuron y j The weight coordinates are formed by the l-th neuron path between the input and output layers. Each coordinate represents a weight in the neuron path. The weight values ​​are sequentially used as values ​​on the coordinate axes from the input layer to the output layer to construct the weight coordinates. The specific form of the weight coordinates is... It can be calculated using formula (6);

[0057]

[0058] Where, x i and y j Let ξ be any neurons in the input and output layers. l (s) represents the s-th neuron in the l-th neuron connection path, i.e., x i o 1:h o 2:u o d:k and y j d is the number of hidden layers in the deep neural network model. For neurons o k:h With the next layer of neurons o k+1:u The weight values ​​between the input and output layers are arranged in order from the input layer to the output layer to obtain a set of representations for x. i to y j Weight coordinates of the neuron paths; weight coordinates The s-th coordinate value in the data is used This indicates that 0 ≤ s ≤ d;

[0059] In formula (4) Represents weight coordinates and weight coordinates The distance between them is calculated using the Euclidean distance in formula (7);

[0060]

[0061] S3-5: The mapping relationship M between the weight distance obtained based on formula (4) and the byte sequence of the constructed test cases and the coverage of the loop code structure;

[0062]

[0063] Among them, U i,j Represents the output layer neuron y j With input layer neuron x i The sum of weighted distances between them, k is the number of neurons in the input layer, which is also the length of the selected test case byte sequence, and m represents the number of neurons in the output layer, which is also the number of loop code structures;

[0064] S3-6: Output mapping relationship M.

[0065] Optionally, S4 specifically refers to:

[0066] S4-1: Input coverage statistics table;

[0067] S4-2: Calculate the fitness of the seed test cases based on the fitness function;

[0068] S4-3: The mapping relationship M between the byte sequence of the input test cases and the coverage of the loop code structure;

[0069] S4-4: Combining the weighted distance sum in the mapping relationship M, assign the mutation probability of the byte sequence of the test case and select the mutation position;

[0070] S4-5: Generate offspring test cases based on the mutation location of the test cases;

[0071] S4-6: Output the child generation test cases.

[0072] As can be seen from the above technical solution, compared with the prior art, this method, by inputting test cases, runs the program under test with instrumented loop code structure, determines whether the test cases meet the fuzzing termination condition, and if so, outputs a coverage statistics table; if not, it mutates the test cases to generate child test cases to meet the fuzzing termination condition; based on the output coverage statistics table, it trains a deep learning model and calculates the weight distance sum in reverse, constructs and outputs the mapping relationship between the byte sequence of the test cases and the coverage of the loop code structure; based on the mapping relationship, it performs targeted mutation on the corresponding byte sequence in the test cases corresponding to the loop code structure coverage to generate the next generation of test cases; it uses the next generation of test cases as input to the program under test for fuzzing until the fuzzing termination condition is met, and outputs a fuzzing report. This invention, by mutating the byte sequence of test cases based on the mapping relationship, can more specifically generate high-quality test cases, not only increasing the coverage of loop code structure by test cases and more fully testing the loop code structure in the project under test, thus improving test accuracy, but also improving test efficiency by reducing the blind generation of test case inputs and avoiding a large number of invalid test cases. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0074] Figure 1 This is a schematic diagram of the process of the present invention.

[0075] Figure 2 This is a schematic diagram of the S1 process of the present invention.

[0076] Figure 3 This is a schematic diagram of the S2 process of the present invention.

[0077] Figure 4 This is a schematic diagram of the S3 process of the present invention.

[0078] Figure 5 This is a schematic diagram of the S4 process of the present invention.

[0079] Figure 6 This is a schematic diagram of the fully connected neural network structure in S3 of the present invention. Detailed Implementation

[0080] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0081] This invention discloses a mapping-guided fuzzing method for loop codes, comprising:

[0082] S1: Input the project under test, instrument the loop code structure, compile and output the program under test, such as... Figure 2 As shown, specifically:

[0083] S1-1: Input the project to be tested, such as the source code file of the project to be tested that can be compiled.

[0084] S1-2: Read and iterate through the sequence of test objects in the project under test. The sequence of test objects consists of code structures such as functions, basic blocks, and loop code. Determine the test object (Object). i If it is a loop structure, proceed to step S1-3; otherwise, proceed to step S1-4.

[0085] S1-3: Test object Object i Instrumentation involves inserting specific instructions into the test object. These instructions collect execution information of the program under test while maintaining the integrity of its original logic. After instrumentation, steps S1-4 are executed to determine whether the entire test object has been traversed.

[0086] S1-4: Determine if the entire sequence of test objects has been traversed. If it has, execute S1-5; otherwise, execute S1-2.

[0087] S1-5: Compile the test item after instrumentation into the test program.

[0088] S1-6: Output the program under test.

[0089] S2: Input the initial test cases and the program under test. Add the initial test cases to the test case queue. Determine if the test case queue meets the fuzzing termination condition. If it does, output the coverage statistics table; otherwise, mutate the test cases in the test case queue to generate child test cases, which are then sent to the program under test to run, thus satisfying the fuzzing termination condition. Figure 3 As shown, specifically:

[0090] S2-1: Input the initial test cases and the program under test, and add the initial test cases to the test case queue. The test cases are input by the user, and the program under test is obtained from S1-5.

[0091] S2-2: Determine whether the fuzz test termination condition is met (such as the test reaching the predetermined time or the test reaching the predetermined index, etc.). If the termination condition is not met, proceed to step S2-3; otherwise, proceed to step S2-13.

[0092] S2-3: Mutate the test cases in the test case queue to generate child test cases.

[0093] S2-4: Send the child test cases to the program under test as input to the program under test.

[0094] S2-5: Run the program under test and collect the coverage information for each child test case. Coverage refers to the execution status of the instrumented loop code structure in the program under test, i.e., whether the child test cases cover the instrumented loop code.

[0095] S2-6: Traverse the child test cases. If the child test cases have not been completely traversed, execute S2-7; otherwise, execute S2-2.

[0096] S2-7: Read the i-th child test case t from the child test case queue Te. i and child test cases t i The corresponding coverage. Here, coverage refers to the child test cases t. i The case where each loop code is covered.

[0097] S2-8: Determine the child generation test cases t i If a crash is triggered, proceed to step S2-10; otherwise, proceed to step S2-9.

[0098] S2-9: Determine the child generation test cases t i If more loop code structures are covered, execute S2-11; otherwise, execute S2-5.

[0099] S2-10: Translate the child test cases t iSave locally. This includes the child test cases t. i These are test cases that trigger defects in the program under test.

[0100] S2-11: Translate the child test cases t i Add it to the test case queue.

[0101] S2-12: Save the child test cases and their corresponding coverage to the coverage statistics table; execute S2-6.

[0102] S2-13: Output coverage statistics table.

[0103] S3: Input the coverage statistics table, train the deep learning model and back-calculate the weight distance sum, construct and output the mapping relationship between the byte sequence of test cases and the coverage of loop code structure, such as... Figure 4 As shown, specifically:

[0104] S3-1: Input consists of the test case set Te = (t1, t2, ..., t n ) T The test case coverage set S = (s1, s2, ..., s...) n ) T Coverage statistics table.

[0105] Where n is the number of test cases, Te represents the test cases, and S represents the test case coverage.

[0106] S3-2: Transform the test case set Te and the test case coverage set S into training data that can be recognized by the deep learning model.

[0107] t i For the i-th test case, set the test case set Te = (t1, t2, ..., t... n ) T Test case t in i Binary conversion is performed. Since the length of the binary byte sequences for each test case is different, while the feature vector length required for training the deep learning model needs to be consistent, the first k binary bytes are selected as the test case t. i The binary byte sequence, t i =(x i,1 ,x i,2 ,…,x i,k ); where k is determined by the user. The larger k is, the more accurately the model can learn the correlation between the byte sequence of test cases and the coverage, but the longer the model training time. When t iWhen the length of the binary byte sequence is less than k, zeros are padded to the end of the original binary byte sequence to make the length reach k. After converting all test cases in the test case set Te into binary byte sequences, test case t can be obtained. i The characteristic matrix M feature .

[0108]

[0109] s i Then it is test case t i The coverage of each loop code structure is used as input to the program under test. i =(y i,1 ,y i,2 ,…,y i,m ), where m is the number of loop code structures being instrumented; based on s i Test case t can be obtained. i The label matrix M, which serves as the input to the program under test, shows the coverage of each loop code structure. label .

[0110]

[0111]

[0112] Among them, y i,j For test case t i The j-th loop code structure Object is used as input. j Coverage status.

[0113] S3-3: Based on the feature matrix M feature and label matrix M label Training a deep learning model; the training data for the model consists of n pairs of tuples, where the i-th pair of tuples represents the i-th row of the feature matrix and the label matrix, respectively serving as the feature vector and the label vector, where 1 ≤ i ≤ n; the deep learning model employs a fully connected neural network model, such as... Figure 6 As shown, the structure of a fully connected neural network can be specified by the user.

[0114] S3-4: Perform reverse computation on the trained deep neural network model N. Reverse computation refers to starting from the output layer neurons in the fully connected neural network and traversing backwards through all neurons connected to the output layer neurons until the input layer is reached. Record the weights between every two neurons, construct weight coordinates, and calculate the distance between the weights. The sum of these distances is used as the difference between the weights of the input layer and the output layer. The larger the difference value obtained from the reverse computation, the greater the impact of the value of that input layer neuron on the input layer's result compared to other input layer neurons.

[0115] The specific calculation process of reverse computation is as follows: For a trained deep neural network N, the input layer X of N consists of k neurons, X = (x1, x2, ..., x...). k ), where k is the number of features, and is the length of the selected test case byte sequence; the output layer Y of N consists of m neurons, Y = (y1, y2, ..., y m ), where m is the number of tags and is the number of loop code structures.

[0116] For each neuron y in the output layer j And each neuron x in the input layer i y can be calculated using formula (4). j With each x i The weighted distance between them.

[0117]

[0118] U in formula (4) i,j For output layer neuron y j With input layer neuron x i The weighted distance between them; p is x i With y j The number of neuron connection paths between them, for a fully connected neural network, p can be calculated by formula (5).

[0119]

[0120] Where d represents the number of hidden layers in the deep neural network N, such as d=1 in a single-hidden-layer neural network model. SizeOfLayer(index) represents the number of neurons in the index-th hidden layer. Multiplying the number of neurons in each hidden layer gives the number of neurons x from the input layer. i to the output layer neuron y j The number of connection paths between them, such as Figure 6 The single hidden layer neural network model structure shown has an input layer neuron x. i to the output layer neuron y j There are 3 neuron connection paths, namely ξ1=(x1,o 1:1 ,y1),ξ2=(x1,o 1:2 ,y1),ξ3=(x1,o 1:3 ,y1), where o k:m Let ξ be the m-th neuron in the k-th hidden layer. h Let ξ be the connection path of the h-th neuron. For ease of subsequent description, let ξ be the neuron path. h The s-th neuron in the ξ h(s) represents, where 1≤s≤(d+2).

[0121] In formula (4) For input layer neuron x i With output layer neuron y j The weight coordinates are formed by the l-th neuron path between the input and output layers. Each coordinate represents a weight in the neuron path. The weight values ​​are sequentially used as values ​​on the coordinate axes from the input layer to the output layer to construct the weight coordinates. The specific form of the weight coordinates is... It can be calculated using formula (6).

[0122]

[0123] Where, x i and y j Let ξ be any neurons in the input and output layers. l (s) represents the s-th neuron in the l-th neuron connection path, i.e., x i o 1:h o 2:u o d:k and y j d is the number of hidden layers in the deep neural network model. For neurons o k:h With the next layer of neurons o k+1:u The weight values ​​between the input and output layers are arranged in order from the input layer to the output layer to obtain a set of representations for x. i to y j Weight coordinates of the neuron paths; weight coordinates The s-th coordinate value in the data is used This indicates that 0 ≤ s ≤ d.

[0124] In formula (4) Represents weight coordinates and weight coordinates The distance between them is calculated using the Euclidean distance in formula (7).

[0125]

[0126] S3-5: The mapping relationship M between the weight distance obtained from formula (4) and the byte sequence of the test cases and the coverage of the loop code structure.

[0127]

[0128] Among them, U i,j Represents the output layer neuron y j With input layer neuron x iThe sum of weighted distances between them, k is the number of neurons in the input layer, which is also the length of the selected test case byte sequence, and m represents the number of neurons in the output layer, which is also the number of loop code structures.

[0129] S3-6: Output mapping relationship M.

[0130] S4: Based on the mapping relationship M, mutate the corresponding byte sequences in the test cases that correspond to the loop code structure coverage to generate child test cases, specifically:

[0131] S4-1: Input coverage statistics table.

[0132] S4-2: Calculate the fitness of seed test cases based on the fitness function. The fitness function is a function that adjusts test resources according to the quality of the seed test cases; a higher fitness seed generates more offspring, and a lower fitness seed generates fewer offspring. Fitness functions from traditional fuzzing tools can be used, such as coverage-guided fitness functions like AFL and target-guided fitness functions like AFLGo.

[0133] S4-3: The mapping relationship M between the byte sequence of the input test cases and the coverage of the loop code structure, wherein the mapping relationship M is obtained from S3-6.

[0134] S4-4: Combining the weighted distance sum in mapping relation M, assign the mutation probability of the byte sequence of the test cases and select the mutation position. The weighted distance sum U in mapping relation M ji The larger the value, the greater the value of the input layer neuron x. i For the output layer y j The greater the impact, i.e., the more the byte at the i-th position of the test case sequence affects the loop code structure Object. j The greater the coverage, the greater the impact. Therefore, during the mutation phase, a larger mutation probability should be assigned to the byte mutation at the i-th position of the test case byte sequence. After assigning the mutation probability, a value between zero and the sum of the mutation probabilities is randomly selected as the mutation probability threshold. Each byte sequence position is traversed, and the weighted distance corresponding to that byte sequence position is accumulated as the accumulated probability. If the accumulated probability is greater than the mutation probability threshold, then that byte sequence position is selected as the mutation position.

[0135] S4-5: Generate offspring test cases by mutating test cases based on the mutation location.

[0136] S4-6: Output the child generation test cases.

[0137] S5: Use the child test cases as input to the program under test (S2) for fuzz testing until the fuzz testing termination condition is met (such as the test reaching a predetermined time or the test reaching a predetermined indicator), and output a fuzz test report. The fuzz test report includes the generated test cases, program coverage, and software defect triggering conditions, which users can view, analyze, or reproduce the defects.

[0138] This invention discloses a mapping-guided fuzzing method for loop code. The method inputs test cases, runs the test program with instrumented loop code structures, and determines whether the test case queue meets the fuzzing termination condition. If it does, a coverage statistics table is output; otherwise, the test cases in the queue are mutated to generate child test cases that satisfy the fuzzing termination condition. Based on the output coverage statistics table, a deep learning model is trained and the weighted distance sum is calculated in reverse to construct and output a mapping relationship between the byte sequence of the test cases and the coverage of the loop code structure. Based on this mapping relationship, the corresponding byte sequences in the test cases corresponding to the loop code structure coverage are specifically mutated to generate child test cases. These child test cases are used as input to the test program for fuzzing until the fuzzing termination condition is met, and a fuzzing report is output. This invention, by mutating the byte sequence of test cases based on the mapping relationship, can more effectively generate high-quality test cases. This not only increases the coverage of loop code structures by test cases and improves testing accuracy, but also reduces the blind generation of test case inputs, avoiding a large number of invalid test cases and improving testing efficiency.

[0139] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0140] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A mapping-guided fuzzing method for loop codes, characterized in that, include: S1: Input the project under test, instrument the loop code structure, compile and output the program under test; S2: Input the initial test cases and mutate them. Add the mutated test cases to the test case queue and send them to the program under test for execution. Determine whether the test case queue meets the fuzz test termination condition. If it does, output the coverage statistics table. If the conditions are not met, the test cases in the test case queue are mutated to generate child test cases to satisfy the fuzz test termination condition. S3: Input the coverage statistics table, train the deep learning model and calculate the weight distance sum in reverse, construct and output the mapping relationship between the byte sequence of the test cases and the coverage of the loop code structure; S4: Based on the mapping relationship, mutate the corresponding byte sequence in the test case corresponding to the coverage of the loop code structure to generate a child test case; S5: Use the child test cases described in S4 as input to the program under test in S2, perform fuzz testing until the fuzz testing termination condition is met, and output a fuzz test report. S2 specifically refers to: S2-1: Input the initial test case and the program under test, and add the initial test case to the test case queue; S2-2: Determine whether the fuzz test termination condition is met. If the termination condition is not met, proceed to step S2-3; otherwise, proceed to step S2-13. S2-3: Mutate the test cases in the test case queue and add the generated child test cases to the test case queue; S2-4: Read the child test cases from the test case queue in sequence, and send the child test cases to the program under test as input to the program under test, until the test case queue is empty; S2-5: Run the program under test and collect the coverage information for each of the child test cases; S2-6: Traverse the child test cases. If the child test cases have not been completely traversed, execute S2-7; otherwise, execute S2-2. S2-7: Read the test case queue The first in i child generation test cases and the child generation test cases Corresponding coverage; S2-8: Determine the sub-generation test cases. Whether a crash is triggered. If a crash is triggered, proceed to step S2-10; otherwise, proceed to step S2-9. S2-9: Determine the sub-generation test cases. If more loop code structures are covered, execute S2-11; otherwise, execute S2-5. S2-10: The child generation test cases... Save to local storage; S2-11: The child generation test cases Add to the test case queue; S2-12: Save the child test cases and their corresponding coverage information to the coverage statistics table; execute S2-6; S2-13: Output Coverage Statistics Table; S4 specifically refers to: S4-1: Input the coverage statistics table; S4-2: Calculate the fitness of the seed test cases based on the fitness function; S4-3: Input the mapping relationship between the byte sequence of the test cases and the loop code structure coverage. ; S4-4: Combining the aforementioned mapping relationship The weighted distance is used to assign the mutation probability of the byte sequence of the test case and select the mutation position; S4-5: Mutate the test case according to the mutation position to generate the offspring test case; S4-6: Output the child generation test cases.

2. The fuzz testing method for loop codes guided by mapping relationship according to claim 1, characterized in that, S1 specifically refers to: S1-1: Input the item to be tested; S1-2: Read and traverse the sequence of test objects for the project under test, and determine the test object. Is it a loop code structure? If so, proceed to steps S1-3. Otherwise, proceed to steps S1-4; S1-3: For the test object Perform the drive and, after the drive is completed, proceed to steps S1-4. S1-4: Determine if the entire sequence of test objects has been traversed. If it has been traversed, execute S1-5; otherwise, execute S1-2. S1-5: Compile the test item after the staking into the test program; S1-6: Output the program under test.

Images