A floating-point exception detection method based on floating-point format-aware fuzzing

Abstract

The application discloses a floating-point exception detection method based on floating-point format-aware fuzzing, which comprises the following steps: S1, static analysis and instrumentation; all floating-point operations in a program and control flow graph information of the program are identified and obtained by using a static analysis technique, and corresponding detection functions are defined and instrumented; an ErrBits function is inserted for each floating-point operation, and the ErrBits function is used to measure the distance of a test input from triggering a potential floating-point exception; S2, floating-point format-aware fuzzing; the code instrumented in step S1 is subjected to fuzzing guided by floating-point exception distance minimization and branch coverage information to detect potential floating-point exceptions in the program. The application has the advantages of simple principle, simple operation, low false positive rate, good scalability and the like.

Description

Technical Field

[0001] This invention mainly relates to the field of security detection technology for software systems, specifically a floating-point anomaly detection method based on floating-point format-aware fuzzy testing. Background Technology

[0002] With the development of information technology, computer applications are becoming increasingly widespread and in-depth, and the security and reliability of software systems are receiving more and more attention. Floating-point arithmetic is prevalent in modern computer systems, and it exists in many software programs that involve a large amount of scientific and engineering calculations. Because floating-point numbers are approximations of real numbers and represent a finite proper subset of real numbers, their precision and range of representation are limited, which can lead to anomalies during floating-point arithmetic.

[0003] According to the IEEE-754 floating-point standard, floating-point exceptions in floating-point operations are classified into five types: overflow, underflow, division by zero, invalid operation, and inaccuracy. In system control software in security-critical fields such as defense, aerospace, finance, transportation, and healthcare, the occurrence of floating-point exceptions during operations can lead to program failures and potentially catastrophic consequences.

[0004] The reliability of floating-point operations significantly impacts the reliability of software systems. Therefore, detecting potential floating-point exceptions in a program before it actually runs is crucial for ensuring the reliability of the software system.

[0005] The purpose of numerical program floating-point anomaly detection methods is to detect potential floating-point anomalies before software failures occur, thereby ensuring software reliability. Existing floating-point anomaly detection methods mainly employ static analysis, which primarily includes the following two steps:

[0006] S1: Construct corresponding floating-point constraints for different types of floating-point operations in the numerical program, so that the test input that violates the constraint is the input that triggers a floating-point exception.

[0007] S2: Based on S1, the program source code with floating-point constraints was constructed, and static analysis (such as symbolic execution) was performed to analyze and obtain potential floating-point exceptions in the program.

[0008] The existing analysis methods mentioned above mainly employ static analysis, which can easily lead to false alarms when detecting floating-point anomalies in numerical programs due to excessive approximation.

[0009] The existing analysis methods described above have limited scalability. These methods typically involve first constructing floating-point constraints in the source program and then using an SMT solver to solve them. However, real-world numerical programs may contain tens of thousands of floating-point operations, and using an SMT solver to solve floating-point constraints is very expensive, thus limiting their scalability. Summary of the Invention

[0010] The technical problem to be solved by this invention is: in view of the technical problems existing in the prior art, this invention provides a floating-point anomaly detection method based on floating-point format-aware fuzzy testing that is simple in principle, easy to operate, has a low false alarm rate, and good scalability.

[0011] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0012] A floating-point anomaly detection method based on floating-point format-aware fuzz testing, comprising:

[0013] Step S1: Static analysis and instrumentation; Static analysis techniques are used to identify and obtain all floating-point operations and the program's control flow graph information, define and instrument the corresponding detection functions; ErrBits function is inserted for each floating-point operation, which is used to measure the distance of a test input from triggering a potential floating-point anomaly;

[0014] Step S2: Floating-point format-aware fuzz testing; For the code instrumented in step S1, perform fuzz testing guided by floating-point exception distance minimization and branch coverage information to detect potential floating-point exceptions in the program.

[0015] As a further improvement to the method of the present invention: the process of step S1 includes:

[0016] Step S11: Identify floating-point operations; identify all floating-point operations in the target program through static analysis;

[0017] Step S12: Perform code instrumentation; Based on the LLVM framework, instrument the exception detection function and ErrBits function into the floating-point operations in the original program, and then instrument the corresponding exception detection function according to the different types of floating-point operations.

[0018] As a further improvement to the method of the present invention: in step S1, the program is instrumented based on the program's control flow information to record the branch coverage information during runtime.

[0019] As a further improvement to the method of the present invention: the process of step S2 includes:

[0020] Step S21: The input is the program after instrumentation in step S1 and the initial test input, and the output is BuggyS, which is the set of test cases that trigger floating-point exceptions in the target program;

[0021] Step S22: When the fuzz test running time does not exceed the predefined threshold time limit, firstly, select an input s from the seed queue, mutate it, and generate a mutated input s'; then, run the mutated input s' and monitor its execution status, collecting distance floating-point exception information and program branch coverage information;

[0022] Step S23: If the mutated input s' is closer to triggering a floating-point exception, that is, the ErrBits value of the current execution relative to the potential exception location in the floating-point exception information CurSet_ErrBits is smaller than the ErrBits value of the latest execution relative to the corresponding potential exception location in the floating-point exception information Set_ErrBits, then the mapping table Set_ErrBits is updated using the information from CurSet_ErrBits. At the same time, the mutated input s' is regarded as an interesting seed and added to the seed queue for further mutation to generate more potentially interesting test inputs; or, if the mutated input s' covers a program location that was not previously covered during its execution, the input s' will also be regarded as an interesting seed and added to the seed queue.

[0023] Step S24: If the execution of this input causes the target program to crash, then the input will be added to the collection of test cases that trigger floating-point exceptions, BuggyS; finally, when the running time of the floating-point format-aware fuzz test reaches the predefined time limit threshold, the running process ends and the test case set that triggers floating-point exceptions, BuggyS, is output.

[0024] As a further improvement to the method of the present invention: in step S21, at the beginning stage, BuggyS and CurSet_ErrBits are initialized to empty sets, and the fuzz test seed pool is initialized to a queue consisting of initial test inputs; CurSet_ErrBits represents the mapping from all abnormal positions to the corresponding ErrBits in the current test input run.

[0025] As a further improvement to the method of the present invention: In step S22, during execution, the execution engine maintains two variables, CurSet_ErrBits and Set_ErrBits. Set_ErrBits is a global mapping that retains the minimum ErrBits information at each exception location. After the current execution ends, the execution engine obtains the floating-point exception distance information CurSet_ErrBits for this execution and the latest Set_ErrBits information.

[0026] As a further improvement to the method of the present invention: In step S23, for the exponent and mantissa, a bit-flipping mutation strategy is included: Under the bit-flipping strategy, for the exponent bit, a random bit is flipped at a random position, and a randomly selected consecutive n bits are flipped; where n is 2, 3, 4 and 8; the flipping operation of the mantissa bit is the same as that of the exponent bit, but a new value of 16 is added to n.

[0027] As a further improvement to the method of the present invention: In step S23, for the exponent and mantissa, the arithmetic operation strategy includes: for the exponent, add an integer from 1 to 32; the opposite mutation operation is to subtract this integer from it; the arithmetic operation for the mantissa is the same as for the exponent, but this integer is 2. m -1, where m is from 1 to 33.

[0028] As a further improvement to the method of the present invention: In step S23, for the exponent and mantissa, a large-destruction strategy is included: Under the destruction mechanism, mutation operators are set, including e-bitflip, m-bitflip, e-addition, m-addition, e-decrease, m-decrease, and random-bit; e-bitflip represents flipping one bit at a random position of the exponent; m-bitflip represents flipping one bit at a random position of the mantissa; e-addition represents adding an integer to the exponent, which is randomly generated in the range of 1 to 32; m-addition represents adding an integer to the mantissa, which is 2. p -1, where p is randomly generated in the range of 1 to 33; the e-decrease represents subtracting an integer from the exponent, where the integer is randomly generated in the range of 1 to 32; the m-decrease represents subtracting an integer from the mantissa, where the integer is 2. p -1, where p is randomly generated in the range of 1 to 33; the random-bit refers to setting a random value to a random selection of consecutive n bits, where n is 4 for the exponent bits and 8, 16 and 32 for the mantissa bits.

[0029] As a further improvement to the method of this invention: the ErrBits function is used to measure the distance between the floating-point operation result O and the outlier value E. The ErrBits function is defined as follows:

[0030]

[0031] This function represents the number of floating-point numbers between the result of a floating-point operation O and the outlier E, logarithm to base 2.

[0032] Compared with the prior art, the advantages of the present invention are as follows:

[0033] 1. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing of this invention is simple in principle, easy to operate, and widely applicable. It does not require solving complex floating-point constraints and has a low false alarm rate. Existing analysis methods mainly use static analysis, which can easily lead to false alarms when detecting floating-point anomalies in numerical programs due to over-approximation. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing proposed in this invention uses a combination of dynamic and static methods. First, static analysis and instrumentation are performed on the numerical program. The instrumented program ensures that it is functionally consistent with the source program. Then, fuzz testing is performed on the instrumented program. If the test input triggers a floating-point anomaly, it is added to the floating-point anomaly test case set. As can be seen, this method has a low false alarm rate.

[0034] 2. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing proposed in this invention has good scalability. Existing technologies using static analysis methods for floating-point anomaly detection typically involve first constructing floating-point constraints in the source program and then solving them using an SMT solver. However, real-world numerical programs may contain tens of thousands of floating-point operations, and solving floating-point constraints using an SMT solver is very expensive, resulting in limited scalability. The dynamic analysis method based on floating-point format-aware fuzzy testing proposed in this invention does not require solving complex floating-point constraints, thus exhibiting better scalability. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating the method of the present invention.

[0036] Figure 2 This is a schematic diagram of the anomaly-related detection function in a specific application example of the present invention.

[0037] Figure 3 This is a schematic diagram of the slicing procedure from the gsl_sf_exprel_2 function in a specific application example of the present invention. Detailed Implementation

[0038] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0039] like Figure 1 As shown, the present invention provides a floating-point anomaly detection method based on floating-point format-aware fuzzy testing, the steps of which include:

[0040] Step S1: Static analysis and pile driving;

[0041] For the target numerical program, the present invention first needs to use static analysis techniques to identify and obtain all floating-point operations and the program's control flow graph information.

[0042] Furthermore, for different types of floating-point operations, this invention defines and instrumentes corresponding detection functions so that floating-point exceptions can be explicitly exposed when they are triggered.

[0043] Based on the program's control flow information, this invention instrumentes the program to record branch coverage information during runtime.

[0044] Furthermore, the present invention also inserts an ErrBits function for each floating-point operation, which is used to measure the distance of a test input from triggering a potential floating-point exception.

[0045] Step S2: Floating-point format-aware fuzz testing;

[0046] For the code instrumented in step S1, fuzz testing is performed using floating-point exception distance minimization and branch coverage information as guidance to detect potential floating-point exceptions in the program.

[0047] The floating-point anomaly detection method based on floating-point format-aware fuzzy testing proposed in this invention is actually a complete process of automatically mining potential floating-point anomalies in numerical programs.

[0048] In a specific application example, the specific steps of step S1 are as follows:

[0049] Step S11: Identify floating-point operations;

[0050] By identifying all floating-point operations in the target program through static analysis, the purpose of this invention is to explicitly alert the user when a floating-point exception is triggered. To this end, corresponding exception detection functions are designed according to different types of floating-point operations, such as... Figure 2 As shown.

[0051] Step S12: Perform code instrumentation;

[0052] Based on the LLVM framework, this invention instrumentes the anomaly detection function and the ErrBits function into the floating-point operations of the original program.

[0053] Insert corresponding exception detection functions based on different types of floating-point operations.

[0054] Based on the program's control flow information, the program is instrumented to record runtime branch coverage information.

[0055] Furthermore, as a preferred embodiment, the present invention also inserts an ErrBits function for each floating-point operation, which is used to measure the distance of a test input from triggering a potential floating-point exception.

[0056] In a specific application example, the specific steps of step S2 are as follows:

[0057] Step S21: The input to the algorithm corresponding to this step is the program after instrumentation in step S1 and the initial test input. The output is BuggyS, which is the set of test cases that trigger floating-point exceptions in the target program.

[0058] At the beginning of the algorithm, BuggyS and CurSet_ErrBits are initialized to empty sets, and the fuzz test seed pool is initialized to a queue consisting of the initial test inputs. Here, CurSet_ErrBits represents the mapping from all aberration positions to their corresponding ErrBits during the current test input run.

[0059] Step S22: When the fuzz test runtime does not exceed a predefined threshold, firstly, select an input s from the seed queue, mutate it, and generate a mutated input s'. Then, run the mutated input s' and monitor its execution status, collecting distance floating-point anomaly information and program branch coverage information. During execution, the execution engine maintains two variables: CurSet_ErrBits and Set_ErrBits. Set_ErrBits is a global mapping that retains the minimum ErrBits information at each anomaly location. After the current execution ends, the execution engine obtains the floating-point anomaly distance information CurSet_ErrBits and the latest Set_ErrBits information for this execution.

[0060] Step S23: If the mutated input s' is closer to triggering a floating-point exception, i.e., the ErrBits value of the current execution relative to the potential exception location in the floating-point exception information CurSet_ErrBits is smaller than the latest ErrBits value of the corresponding potential exception location in the floating-point exception information Set_ErrBits (closer to triggering a floating-point exception), then the mapping table Set_ErrBits is updated using the information from CurSet_ErrBits. Simultaneously, the mutated input s' is considered an interesting seed and added to the seed queue for further mutation to generate more potentially interesting test inputs. Alternatively, if the mutated input s' covers a previously uncovered program location during execution, this input s' will also be considered an interesting seed and added to the seed queue.

[0061] Similar to traditional cover-based gray-box fuzzers (such as AFL), this invention utilizes branch cover information to guide the fuzzer in exploring more program paths. Notably, the main difference between this process and traditional cover-based gray-box fuzzers lies in the fact that this invention proposes a novel mutation strategy and utilizes ErrBits information to guide the preservation of interesting inputs. Addressing the specific characteristics of floating-point formats, the strategy of this invention mutates the sign bit, exponent bit, and mantissa bit of the floating-point number separately. Since the sign bit is 1 bit, this invention flips it with a 50% probability, switching between 0 and 1.

[0062] Step S24: If the execution of this input causes the target program to crash (triggering a floating-point exception), then the input will be added to the collection of floating-point exception test case set BuggyS. Finally, when the runtime of the floating-point format-aware fuzz test reaches the predefined time limit threshold, the execution process can be terminated and the floating-point exception test case set BuggyS can be output.

[0063] In a specific application example, in step S23, for the exponent and mantissa, the present invention designs three mutation strategies: bit flipping, arithmetic operation, and big destruction:

[0064] (1) Under the bit-flipping strategy, for the exponent bit, the present invention flips a random bit at a random position and flips a randomly selected consecutive n bits. Where n is 2, 3, 4 and 8; the flipping operation of the mantissa bit is the same as that of the exponent bit, but a new value is added to n, which is 16.

[0065] (2) Under the arithmetic operation strategy, for the exponent, this invention adds an integer from 1 to 32. The opposite mutation operation is to subtract this integer. The arithmetic operation for the mantissa is the same as for the exponent, but this integer is 2. m -1, where m is from 1 to 33.

[0066] (3) Under the large destruction strategy, the destruction mechanism is the same as that of the traditional gray box fuzzer. The main difference is its mutation operator.

[0067] For floating-point numbers, this invention designs several mutation operators, including e-bitflip, m-bitflip, e-addition, m-addition, e-decrease, m-decrease, and random-bit. e-bitflip represents flipping the exponent by one bit at a random position; m-bitflip represents flipping the mantissa by one bit at a random position; e-addition represents adding an integer to the exponent, which is randomly generated within the range of 1 to 32; m-addition represents adding an integer to the mantissa, which is 2. p-1, where p is randomly generated in the range of 1 to 33; e-decrease means subtracting an integer from the exponent, where the integer is randomly generated in the range of 1 to 32; m-decrease means subtracting an integer from the mantissa, where the integer is 2. p -1, where p is randomly generated in the range of 1 to 33; random-bit refers to setting a random value to a consecutive n bits of random selection, where n is 4 for the exponent bits and 8, 16 and 32 for the mantissa bits.

[0068] In a specific application example, this invention uses the ERRBits function to measure the distance between the floating-point operation result 0 and the outlier value E (e.g., E is 0 when performing a division operation). This invention defines the ErrBits function as follows:

[0069]

[0070] This function represents the number of floating-point numbers (logarithm to base 2) between the floating-point result O and the outlier E. A key insight of this invention is that if the result of the ErrBits function used for floating-point operations in the current program execution is lower than before, then the test input should be preserved as interesting input for further mutation. That is, these inputs are expected to expose floating-point outliers in the next round of mutation.

[0071] In a specific application example, let's take the gsl_sf_exprel_2 function from the GNU Scientific Library (GSL) as an example (some simple changes have been made for ease of explanation, such as...). Figure 3 (As shown). Figure 3 The sliced ​​code shows that the actual branch of the else if statement in line 7 contains some floating-point operations. Among these floating-point operations, there are 2 subtraction operations (line 8), 4 multiplication operations (lines 8 and 9), 1 division operation, and 1 exp() function call operation (line 8), for a total of 8 floating-point operations involving the input x. In the sliced ​​code, GSL_LOG_DBL_MIN is approximately -7.083964e+02, and GSL_LOG_DBL_MAX is approximately 7.097827e+02.

[0072] For this sliced ​​program, the present invention first performs instrumentation. The present invention instrumentes the `_Check_double()` function (lines 8 and 9) after floating-point operations (see notes in Table 1), the `_Check_div()` function (line 8) after floating-point division operations, and the `_Check_exp()` function after the `exp()` function call. Furthermore, in this sliced ​​code, the present invention instrumentes the `ErrBits` function after each floating-point operation. After instrumentation is complete, the present invention obtains the instrumented program.

[0073] After the instrumentation steps described above are completed, this invention uses floating-point format-aware fuzzing to detect potential floating-point anomalies in the program. The entire process is shown below. The algorithm's input consists of the instrumented program and the initial test input, and the output is BuggyS, which is the set of test cases that trigger floating-point anomalies in the target program. At the beginning of the algorithm, BuggyS and CurSet_ErrBits need to be initialized to empty sets, and the fuzzing seed pool is initialized to a queue consisting of the initial test inputs. Here, CurSet_ErrBits represents the mapping from all anomaly locations to their corresponding ErrBits during the current test input execution.

[0074] In order to explain Figure 3 The slicing code example in this invention assumes that the initial value of x is 0.5. Figure 3 Line 7 in the code executes the true branch of the last else if statement. Based on the mutation strategy for floating-point formats proposed in this invention, this invention can easily generate a new valid test input. Assume the initial test input It is 2.56e+02, then enter The actual branch of the last else if statement will still be hit, meaning no new branch is overridden. At this point, the overridden graybox blurr will be discarded. This would miss the opportunity to generate new inputs that could potentially expose anomalies.

[0075] On the other hand, this invention, guided by ErrBits information, considers the test input... It's closer to a division overflow exception (the result of the first multiplication operation in the expression on line 8 is closer to an overflow exception), and it's kept as an interesting input for further mutation to generate test inputs that might trigger floating-point exceptions. If Further mutations will generate a new valid input (e.g., = 5.120004e+02), which is closer to triggering an overflow exception. After some mutations, this invention can generate an exception trigger input ( = 7.094447e+02), this input triggers an overflow exception in the first multiplication operation of the expression on line 8. Traditional overlay-based gray-box fuzzers cannot detect this overflow exception because it is difficult for these fuzzers to generate valid test floating-point inputs.

[0076] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should be considered within the scope of protection of the present invention. For example, there are multiple ways to measure the distance between the test input and the floating-point exception in step S1. The key point is to effectively measure the distance between the two. Other methods that can effectively measure the distance information between the two are all effective variations of ErrBits as the measurement method, and the key point is effective measurement. As another example, for the floating-point mutation strategy for the floating-point format in step S2, other mutation methods that target the special characteristics of the floating-point format are all effective variations of the floating-point mutation strategy of the present invention, and the key point is that the mutation strategy can generate valid floating-point numbers. For the fuzz test based on floating-point anomaly distance awareness in S2, other fuzz test methods that add floating-point anomaly distance awareness are all effective variations of the fuzz test based on floating-point format awareness in this invention. The key point is to obtain the input set that triggers floating-point anomalies by using floating-point anomaly distance as a guide and branch coverage information as a guide for fuzz test.

Claims

1. A floating-point anomaly detection method based on floating-point format-aware fuzzy testing, characterized in that, include: Step S1: Static analysis and pile driving; Static analysis techniques are used to identify and obtain all floating-point operations and the program's control flow graph information, and corresponding detection functions are defined and instrumented. An ErrBits function is inserted for each floating-point operation, which is used to measure the distance of a test input from triggering a potential floating-point anomaly. Step S2: Floating-point format-aware fuzz testing; For the code instrumented in step S1, perform fuzz testing guided by floating-point anomaly distance minimization and branch coverage information to detect potential floating-point anomalies in the program. The process of step S2 includes: Step S21: The input is the program after instrumentation in step S1 and the initial test input, and the output is BuggyS, which is the set of test cases that trigger floating-point exceptions in the target program; Step S22: When the fuzz test running time does not exceed the predefined threshold time limit, firstly, select an input s from the seed queue, mutate it, and generate a mutated input s'; then, run the mutated input s' and monitor its execution status, collecting distance floating-point exception information and program branch coverage information; Step S23: If the mutated input s' is closer to triggering a floating-point exception, that is, the ErrBits value of the current execution relative to the potential exception location in the floating-point exception information CurSet_ErrBits is smaller than the ErrBits value of the latest execution relative to the corresponding potential exception location in the floating-point exception information Set_ErrBits, then the mapping table Set_ErrBits is updated using the information from CurSet_ErrBits. At the same time, the mutated input s' is regarded as an interesting seed and added to the seed queue for further mutation to generate more interesting test inputs; or, if the mutated input s' covers a program location that was not previously covered during its execution, the input s' will also be regarded as an interesting seed and added to the seed queue. Step S24: If the execution of this input causes the target program to crash, then the input will be added to the collection of test cases that trigger floating-point exceptions, BuggyS; finally, when the running time of the floating-point format-aware fuzz test reaches the predefined time limit threshold, the running process ends and the test case set that triggers floating-point exceptions, BuggyS, is output.

2. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 1, characterized in that, The process of step S1 includes: Step S11: Identify floating-point operations; identify all floating-point operations in the target program through static analysis; Step S12: Perform code instrumentation; Based on the LLVM framework, instrument the exception detection function and ErrBits function into the floating-point operations in the original program, and then instrument the corresponding exception detection function according to the different types of floating-point operations.

3. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 2, characterized in that, In step S1, the program is instrumented based on the program's control flow information to record the branch coverage information during runtime.

4. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 1, characterized in that, In step S21, at the beginning stage, BuggyS and CurSet_ErrBits are initialized to empty sets, and the fuzz test seed pool is initialized to a queue consisting of initial test inputs; CurSet_ErrBits represents the mapping from all abnormal positions to the corresponding ErrBits during the current test input run.

5. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 1, characterized in that, In step S22, during execution, the execution engine will maintain two variables, CurSet_ErrBits and Set_ErrBits. Set_ErrBits is a global mapping that retains the minimum ErrBits information at each exception location. After the current execution ends, the execution engine will obtain the floating-point exception distance information CurSet_ErrBits and the latest Set_ErrBits information for this execution.

6. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 1, characterized in that, In step S23, for the exponent and mantissa, a bit-flipping mutation strategy is included: under the bit-flipping strategy, for the exponent bit, a random bit is flipped at a random position, and a random selection of consecutive n bits is flipped; where n is 2, 3, 4 and 8; the flipping operation of the mantissa bit is the same as that of the exponent bit, but a new value of 16 is added to n.

7. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 1, characterized in that, In step S23, the arithmetic operation strategy for the exponent and mantissa includes: for the exponent, add an integer from 1 to 32; the opposite mutation operation is to subtract this integer from it; the arithmetic operation for the mantissa is the same as for the exponent, but this integer is 2. m -1, where m is from 1 to 33.

8. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 1, characterized in that, In step S23, for the exponent and mantissa, a large-destruction strategy is included: under the destruction mechanism, mutation operators are set, including e-bitflip, m-bitflip, e-addition, m-addition, e-decrease, m-decrease, and random-bit; e-bitflip represents flipping one bit at a random position of the exponent; m-bitflip represents flipping one bit at a random position of the mantissa; e-addition represents adding an integer to the exponent, which is randomly generated in the range of 1 to 32; m-addition represents adding an integer to the mantissa, which is 2. p -1, where p is randomly generated in the range of 1 to 33; the e-decrease represents subtracting an integer from the exponent, where the integer is randomly generated in the range of 1 to 32; m-decrease means subtracting an integer from the mantissa, where the integer is 2. p -1, where p is randomly generated in the range of 1 to 33; the random-bit refers to setting a random value to a random selection of consecutive n bits, where n is 4 for the exponent bits and 8, 16 and 32 for the mantissa bits.

9. The floating-point anomaly detection method based on floating-point format-aware fuzzy testing according to claim 1, 2, or 3, characterized in that, The ErrBits function is used to measure the distance between the result of a floating-point operation (O) and the outlier (E). The ErrBits function is defined as follows: This function represents the number of floating-point numbers between the result of a floating-point operation O and the outlier E, logarithm to base 2.

Images