A probabilistic-based directed hybrid fuzzing method

Abstract

The application discloses a kind of probability-based directional hybrid fuzzy testing methods, it includes: static analysis, for identifying the successor basic block of each program basic block, and the basic block distance and basic block address of each basic block are calculated;Directional fuzzy testing is used for directional fuzzy testing to target program;Symbolic execution is used to track the execution path of seed, discover unexplored branch and constraint solving to the path constraint condition set of unexplored branch, generate new seed.The application has the advantages of simple principle, easy operation, can obtain more accurate fitness index, can improve directional efficiency and the like.

Description

Technical Field

[0001] This invention mainly relates to the field of computer security technology, specifically a probability-based directional hybrid fuzz testing method, which is particularly suitable for vulnerability discovery systems in the field of computer security. Background Technology

[0002] Fuzz testing is one of the most successful search-based software testing methods. As a variant of fuzz testing, Goal-Guided Directed Gray-Box Fuzzing (DGF) has recently attracted widespread attention from researchers. Essentially, DGF is an optimization problem. The key to optimization is searching the input space to find the optimal solution to reach the target code block, with the optimization objective being to maximize the probability of the fuzz test reaching the target code block.

[0003] The earliest targeted fuzzing work, AFLGo, used basic block distance and seed distance to measure the probability of fuzzing reaching the target code block, and based on the idea that seeds with lower distance values ​​have higher energy. Later, new fitness metrics such as path similarity, path constraint distance, and sequence coverage were combined with seed distance to improve the accuracy of targeted fuzzing. However, the probability of fuzzing satisfying different branch conditions varies; for example, satisfying linear constraints is much easier than satisfying nonlinear constraints. Specifically, if the constraints on a seed execution path are easier for the fuzzing to satisfy and the seed distance is shorter, then the fuzzing is more likely to reach the target code block by mutating the seed. For example, given two seeds with the same distance, the fuzzing should prioritize the seed with the higher path probability; given two seeds with the same path probability, the fuzzing should consider the seed with the shorter distance. Therefore, some practitioners have proposed a probability-based distance fitness metric to eliminate the bias caused by branch probabilities and guide fuzzing towards execution paths with higher path probabilities and shorter distances.

[0004] In directed fuzzing, although Directed Geometric Exploration (DGF) considers the relationship between exploration and development, most existing DGF work still fails to dynamically transition between the exploration and development phases. For example, AFLGo uses a static approach to partition the exploration and development phases, pre-setting a time threshold before the test begins, causing the fuzzing to "slowly" transition from the exploration phase to the development phase. In reality, due to the diversity of programs and the randomness of fuzzing, artificially setting thresholds can introduce significant randomness into the experimental results, potentially leading to poor outcomes. For instance, insufficient exploration time results in too few usable execution paths; excessive exploration time leads to the inability to fully utilize discovered execution paths. Therefore, some practitioners have proposed a directed multi-armed fuzzing model to coordinate the exploration and development phases, achieving a dynamically optimal partitioning solution.

[0005] Directed hybrid fuzzing combines directed fuzzing with symbolic execution. On one hand, fuzzing can quickly generate a large number of input files to explore program execution paths; on the other hand, symbolic execution can invert constraints on seed execution paths to discover unexplored branches and call constraint solvers to solve path constraints, generating new inputs. However, in reality, different branches should have different priorities when symbolically executed. For example, solving unsolvable and unreachable branches yields no benefit, only wasting computational resources; branches closer to the target code block should have higher priority than those farther away.

[0006] Currently, all existing technologies have the following shortcomings:

[0007] 1. Based on AFLGo, most existing directional fuzzing techniques use the arithmetic mean of some or all basic block distances as the fitness index to guide directional fuzzing. However, since the probability of path constraints being satisfied is not the same, the probability of reaching different basic blocks also varies. For example, compared to easily satisfied constraints (such as linear constraints), fuzzing is more difficult to reach the target code block through difficult-to-satisfy branch conditions (such as nonlinear constraints).

[0008] 2. Targeted fuzzing typically involves two phases. In the exploration phase, fuzzing discovers as many execution paths as possible; in the exploitation phase, it uses seeds with smaller distances to guide the test to the target code block. Previous targeted fuzzing efforts, such as AFLGo, mostly used a fixed division between the exploration and exploitation phases. For example, the time budget for both phases was pre-configured in the test commands and heavily relied on human subjective experience. However, because each program under test and each fuzzing process is different, this fixed division method cannot adapt to different testing processes. Even when the number of exploitable paths discovered in the exploration phase is far from sufficient, this fixed division method cannot allow fuzzing to transition back from the exploitation phase to the exploration phase, leading to unsatisfactory test results.

[0009] 3. Current advanced targeted hybrid fuzzing techniques prioritize symbolic execution, which may uncover more vulnerabilities (e.g., SAVIOR) or seeds with shorter seed distances (e.g., Hydiff). Therefore, the symbolic execution component can prioritize solving path constraints for branches with shorter distances, generating new seeds. However, existing targeted hybrid fuzzers have two problems. First, the symbolic execution component may waste resources solving unreachable and unsolvable branches. Second, when the symbolic execution component solves some branches, the fuzzing may cover these branches before symbolic execution. In both cases, the symbolic execution component not only fails to help the fuzzing explore new paths to reach the target code block, but also wastes considerable computational resources. Summary of the Invention

[0010] The technical problem to be solved by this invention is: in view of the technical problems existing in the prior art, this invention provides a probability-based orientation hybrid fuzzy testing method that is simple in principle, easy to operate, can obtain more accurate fitness indexes, and can improve orientation efficiency.

[0011] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0012] A probability-based directional mixed fuzz testing method, comprising:

[0013] Static analysis is used to identify the successor basic blocks of each program basic block and to calculate the basic block distance and basic block address of each basic block;

[0014] Targeted fuzz testing is used to perform targeted fuzz testing on a target program.

[0015] Symbolic execution is used to trace the execution path of the seed, discover unexplored branches, and solve the constraint set of the path of the unexplored branches to generate a new seed.

[0016] As a further improvement to the method of the present invention: during static analysis, each basic block has a unique basic block address, which is obtained by hashing the string consisting of the line number and code content of the last line of each basic block; at the same time, the basic block distance and address are instrumented into the target program.

[0017] As a further improvement to the method of the present invention: during directional fuzzy testing, a probability-based distance calculation module and a DMAB module are introduced; the probability-based distance calculation module is used to calculate the path probability of each basic block on the seed execution path, and combines the path probability with the basic block distance to become a new fitness index; based on the probability distance, using the fitness index, the DMAB module is used to realize the dynamic switching between the exploration and development phases and the adaptive adjustment of the seed energy allocation plan.

[0018] As a further improvement to the method of the present invention: after starting the DMAB module, the corresponding seed energy allocation strategy is selected according to the initial, exploration and development test phase of the module; at the same time, the mutation and execution number of the seed are determined according to the allocated energy.

[0019] As a further improvement to the method of this invention: check whether a new path is found during the testing process; if so, retain the seed and add it to the seed queue, calculate the seed priority based on the seed's distance and expected branch probability, and pass the seed to the symbolic execution component; initiate an optimized symbolic execution complementarity strategy, and use the Epsilon-Greedy algorithm to determine the symbolic execution order of the seeds based on the seed priority; during symbolic execution, prune unsolvable and unreachable branches, and update the branch's solution time threshold and seed priority based on the number of times the branch is solved; check whether a new interesting seed is generated during symbolic execution; if so, feed the new seed back to the directed fuzzing component.

[0020] As a further improvement to the method of the present invention: depending on the testing stage of the fuzzing, different energy allocation strategies are selected to allocate energy to the seed; based on the allocated energy, the mutation and execution number of the seed are determined; the priority of the seed that can cover the new path is calculated and passed to symbolic execution; symbolic execution prioritizes the higher priority seed according to the seed priority, prunes unsolvable and unreachable branches, and solves the path constraint set of unexplored branches to generate a new seed, which will be fed back to the fuzzing component to enable it to reach the target code block.

[0021] As a further improvement to the method of this invention: Prioritize symbolic execution of the optimal seed: Calculate a seed score for each seed based on the probability-based distance between branches on the seed execution path, branch probabilities, and constraint solution time thresholds; based on the seed score, OSEC uses the Epsilon-Greedy algorithm to pre-execute the seed with the highest priority score with high probability. The priority score for each seed is:

[0022]

[0023] As a seed is symbolically executed multiple times, its priority score will continuously decrease.

[0024] As a further improvement to the method of the present invention: the probability-based distance calculation module has a probability-based adaptive distance metric, including:

[0025] Branch probability measurement based on branch hit count: Based on the number of hits of different branches under the same constraint, the changing branch probability of different branches during the fuzzing process is dynamically measured as follows:

[0026]

[0027] A path probability measurement method based on Markov chains: fuzzing's exploration of program execution paths is considered a Markov chain; based on the branch probabilities of the branches covered by the execution path, the path probability of a basic block m on the path is:

[0028] P(pat h m )=Π{P(br i )|br i ∈path m}

[0029] Probability-based distance calculation: When the path probability of basic block m is obtained... m Distance d from the basic block b (m, T) b The probability-based basic block distance is calculated as follows:

[0030]

[0031] Seed distance measurement: Execution paths for different seeds contain different basic blocks. The seed distance is calculated based on the probability-based distance between all basic blocks along the seed execution path.

[0032]

[0033] This constitutes a probability-based adaptive distance metric.

[0034] As a further improvement to the method of the present invention: the DMAB module divides the testing phase into an initial phase, an exploration phase, and a development phase according to the goals of fuzzing exploration and development; in the initial phase, fuzzing explores the program's path space in AFL mode to discover more possible paths to the target code block; in the development phase, the DMAB module uses shorter seeds to reach the target code block; in the exploration phase, the DMAB module is used to discover more possible program execution paths to the target basic block.

[0035] As a further improvement to the method of the present invention: the seed energy allocation method in the DMAB module for different testing stages of fuzz testing is as follows: the method of DMAB allocating energy to seeds varies with the objective of the testing stage in different testing stages; in the initial stage, the seed energy allocation method of DMAB is the same as that of AFL; in the development stage, DMAB allocates more energy to seeds with shorter seed distances and allocates less energy to seeds with longer seed distances; in the exploration stage, DMAB evaluates the probability of different seeds covering new branches and allocates more energy to seeds with a higher probability of covering new branches.

[0036] Compared with the prior art, the advantages of the present invention are as follows:

[0037] 1. The probability-based directional hybrid fuzzing method of the present invention is simple in principle and easy to operate, and can obtain a more accurate fitness index, thereby improving the directional efficiency. The present invention uses a probability-based distance as a new fitness index, which combines the basic block distance with the path probability, and prioritizes the selection of seeds that are easier to reach the test target, guiding the directional fuzzing test to reach the target code block more quickly.

[0038] 2. The probability-based directional hybrid fuzzy testing method of the present invention is for the directional multi-armed slot machine (DMAB) model with seed energy allocation. This model treats directional fuzzy testing as a MAB-like problem and introduces reachable unexplored branches to design energy allocation strategies for different fuzzy testing stages. It adaptively coordinates the exploration and development stages of directional fuzzy testing to obtain the optimal solution for dynamic partitioning.

[0039] 3. The probability-based directed hybrid fuzzing method of this invention proposes an optimized complementary symbolic execution scheme. This scheme combines directed fuzzing and symbolic execution in a complementary manner, enabling symbolic execution to concentrate resources on solving path constraints leading to the target code. This invention combines directed fuzzing and symbolic execution with an optimized complementary scheme, enhancing the auxiliary role of symbolic execution within a limited testing time. Attached Figure Description

[0040] Figure 1 This is a schematic diagram illustrating the principle of the method of the present invention. Detailed Implementation

[0041] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] like Figure 1 As shown, the probability-based directional hybrid fuzzy testing method of the present invention includes:

[0043] Static analysis is used to identify the successor basic blocks of each program basic block and to calculate the basic block distance and basic block address of each basic block;

[0044] Targeted fuzz testing is used to perform targeted fuzz testing on a target program.

[0045] Symbolic execution is used to trace the execution path of the seed, discover unexplored branches, and solve the constraint set of the path of the unexplored branches to generate a new seed.

[0046] In a specific application example, during static analysis, each basic block has a unique basic block address, which is obtained by hashing a string consisting of the line number and the code content of the last line of each basic block. Simultaneously, the basic block distance and address are instrumented into the target program.

[0047] In a specific application example, a probability-based distance calculation module and a DMAB module are introduced during directional fuzz testing. The probability-based distance calculation module calculates the path probability of each basic block on the seed execution path and combines this path probability with the basic block distance to form a new fitness metric: probability-based distance. Using this fitness metric, the DMAB module can dynamically switch between the exploration and development phases and adaptively adjust the seed energy allocation plan.

[0048] In specific application examples, during symbolic execution, the new seed will be fed back into the targeted fuzzing process to help it reach the target code block more quickly.

[0049] Furthermore, as a preferred embodiment, the present invention introduces an optimized symbolic execution complementarity scheme during symbolic execution, which can prune unreachable and unsolvable branches;

[0050] Furthermore, as a preferred embodiment, the present invention designs a seed priority calculation method, in which the priority symbol is used to select the optimal seed.

[0051] Combination Figure 1 This is a flowchart illustrating a specific application example of the present invention. The detailed process of this invention in a specific application includes:

[0052] Step S1: Identify the successor basic block of the basic block, calculate the address and distance of the basic block, and instrument the target program;

[0053] Step S2: Enable targeted fuzz testing and symbolic execution, and select a seed from the seed queue for testing;

[0054] Step S3: Activate the probability-based distance calculation module to calculate the probability-based distance for each basic block. Based on the probability-based distance for each basic block, calculate the distance for each seed.

[0055] Step S4: Start the DMAB model and select the corresponding seed energy allocation strategy based on the model's initial, exploration, and development testing phase. Simultaneously, determine the seed mutation and execution count based on the allocated energy.

[0056] Step S5: Check if a new path has been found during the testing process; if so, keep the seed in the seed queue, calculate the seed priority based on the seed's distance and expected branch probability, and pass the seed to the symbolic execution component.

[0057] Step S6: Initiate the optimized symbolic execution complementary scheme module, using Epsilon-Greed according to seed priority. y The algorithm determines the symbolic execution order of the seed. During symbolic execution, unsolvable and unreachable branches are pruned, and the solution time threshold and seed priority of each branch are updated based on the number of times the branch has been solved.

[0058] Step S7: Check if any new interesting seeds are generated during symbol execution; if so, feed the new seeds back to the directed fuzzing component and proceed to step S1 to continue testing.

[0059] Step S8: HyperGo terminates the program execution based on the user's pause action or the preset runtime.

[0060] In a specific application example, this invention employs a probability-based distance fitness metric based on Markov chains. To address the bias caused by different branches having the same weight when calculating basic block distances, this invention models the process of a seed execution path covering branches as a Markov process. Based on this model, the probability (path probability) of a fuzzy test reaching a basic block through a given execution path is equal to the product of the branch probabilities of all branches covered by that path. This invention combines path probabilities with basic block distances to form a new probability-based distance fitness metric to eliminate the bias caused by different branch probabilities. Simultaneously, based on the new seed distance, higher energy is allocated to seeds with smaller seed distances during the development phase.

[0061] Probabilistic distance-adaptive metrics include:

[0062] Branch probability measurement based on branch hit count: Based on the number of hits of different branches under the same constraint, the changing branch probability of different branches during the fuzzing process is dynamically measured as follows:

[0063]

[0064] A path probability measurement method based on Markov chains: fuzzing's exploration of program execution paths can be viewed as a Markov chain. Based on the branch probabilities of the branches covered by the execution path, a basic block on the path... m The path probability is:

[0065] P(pat h m )=Π{P(br i |br i ∈pat h m}

[0066] Probability-based distance calculation: When the path probability of basic block m is obtained...m Distance d from the basic block b (m, T) b The probability-based basic block distance can be calculated as follows:

[0067]

[0068] Seed distance measurement: Execution paths of different seeds contain different basic blocks. Based on the probability-based distances between all basic blocks along the seed execution path, the seed distance can be calculated as follows:

[0069]

[0070] In a specific application example, this invention employs a Directed Multi-Armed Slot Machine (DMAB) model for coordinating the exploration and development phases. To coordinate and dynamically switch between exploration and development in directed fuzzy testing, this invention models the seed as the arms of a slot machine and divides the fuzzy testing phase into initial, exploration, and development phases. In different testing phases, DMAB designs different seed energy allocation methods based on the testing objectives of each phase to control seed mutation and execution count. Simultaneously, DMAB designs time thresholds for transitioning between testing phases based on the expected time for discovering new paths and the testing time, dynamically switching between different testing phases to obtain a dynamically optimal solution. Through this model, DMAB allocates appropriate energy to the seed in different testing phases to achieve the optimal solution and avoids energy waste.

[0071] The testing phase division method for fuzzing is as follows: Based on the goals of fuzzing exploration and development, the testing phase is divided into an initial phase, an exploration phase, and a development phase. In the initial phase, fuzzing uses the AFL (Automatic Flow Framework) model to explore the program's path space to discover more possible paths to the target code block. In the development phase, DMAB (Digital Path Bypass) aims to utilize the shortest possible seed to reach the target code block. In the exploration phase, DMAB aims to discover more possible program execution paths to the target basic block.

[0072] Seed energy allocation method in different testing phases of fuzzing: In different testing phases, DMAB allocates energy to seeds in a different way depending on the objective of the testing phase.

[0073] In the initial stage, the seed energy allocation method for DMAB is the same as that for AFL.

[0074] During the development phase, DMAB allocates more energy to seeds with shorter seed distances and less energy to seeds with longer seed distances. The energy allocated to a seed is:

[0075]

[0076] During the exploration phase, DMAB assesses the probability of different seeds covering new branches and allocates more energy to seeds with a higher probability of covering new branches. The energy allocated to a seed is:

[0077]

[0078] The test phase transition method for fuzzing: DMAB determines whether to transition the test phase based on whether the fuzzing test can cover the new path within a specified adaptive time threshold. The formula for determining the phase transition behavior is:

[0079]

[0080] The phase transition behavior is related to the adaptive time threshold, which in turn is related to the expected time for a single path to be covered and the fuzz test runtime.

[0081] In a specific application example, this invention employs an optimized symbolic execution complementarity (OSEC) scheme for directed hybrid fuzz testing. This scheme determines the symbolic execution order of seeds based on seed priority, and uses the Epsilon-Greedy algorithm to execute higher-priority seeds with a high probability, and to execute lower-priority seeds randomly with a low probability. Furthermore, during symbolic execution, OSEC prunes unsolvable and unreachable branches, and updates the solution time threshold and seed priority of each branch based on the number of times it has been solved, thereby improving the execution and solution efficiency of symbolic execution.

[0082] The specific implementation steps of this invention include:

[0083] 1) Calculate the probability-based distance for each basic block, and then calculate the seed distance for each seed based on the probability-based distance;

[0084] 2) Based on the testing phase of the fuzzy test, select different energy allocation strategies to allocate energy to the seed;

[0085] 3) Based on the allocated energy, determine the mutation of the seed and the number of times it will be executed;

[0086] 4) Calculate the priority of the seed that can cover the new path and pass it to the symbolic execution component;

[0087] 5) The symbolic execution component prioritizes the highest priority seed based on the seed priority, prunes unsolvable and unreachable branches, and solves the path constraint set of unexplored branches to generate a new seed. The new seed will be fed back to the fuzzing component to help the fuzzing component reach the target code block faster.

[0088] In specific application examples, unreachable and unsolvable branches are pruned: OSEC can determine whether a branch is reachable based on its target basic block, and it can also determine whether a branch is solvable based on whether the constraint solving time threshold exceeds the maximum expected time threshold. After determining whether a branch is reachable and solvable, the symbolic execution component will prune unreachable and unsolvable branches.

[0089] In a specific application example, OSEC prioritizes the execution of the optimal seed: It calculates a seed score for each seed based on probability-based distances between branches on the seed execution path, branch probabilities, and constraint solution time thresholds. Based on these seed scores, OSEC uses the Epsilon-Greedy algorithm to execute the seed with the highest priority score with the highest probability of prioritization. The priority score for each seed is as follows:

[0090]

[0091] As a seed is symbolically executed multiple times, its priority score will continuously decrease.

[0092] Those skilled in the art will understand that the above embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create an implementation for the process. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0093] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A probability-based directional hybrid fuzzy testing method, characterized in that, include: Static analysis is used to identify the successor basic blocks of each program basic block and to calculate the basic block distance and basic block address of each basic block; Targeted fuzz testing is used to perform targeted fuzz testing on a target program. Symbolic execution is used to trace the execution path of the seed, discover unexplored branches, and solve the constraint set of the path of the unexplored branches to generate a new seed; In directional fuzz testing, a probability-based distance calculation module and a DMAB module are introduced. The probability-based distance calculation module calculates the path probability of each basic block on the seed execution path and combines the path probability with the basic block distance to form a new fitness index. Based on the probability-based distance and the fitness index, the DMAB module is used to realize the dynamic switching between the exploration and development phases and the adaptive adjustment of the seed energy allocation plan. After the DMAB module is started, the corresponding seed energy allocation strategy is selected according to the initial, exploration and development testing phase of the module. At the same time, the mutation and execution number of the seed are determined according to the allocated energy. Check if any new paths are discovered during the testing process; if so, preserve the seed and add it to the seed queue. Calculate the seed priority based on the seed's distance and expected branch probability, and pass the seed to the symbolic execution component. Initiate an optimized symbolic execution complementarity strategy, and use the Epsilon-Greedy algorithm to determine the symbolic execution order of the seeds based on their priority. During symbolic execution, prune unsolvable and unreachable branches, and update the branch's solution time threshold and seed priority based on the number of times the branch has been solved. Check if any new seeds are generated during symbolic execution; if so, feed the new seeds back to the directed fuzzing component. Depending on the testing phase of the fuzz test, different energy allocation strategies are selected to allocate energy to the seed; based on the allocated energy, the mutation and number of executions of the seed are determined. The priority of the seed that can cover the new path is calculated and passed to symbolic execution. Symbolic execution prioritizes the higher-priority seeds according to the seed priority, prunes unsolvable and unreachable branches, and solves the path constraint set of unexplored branches to generate new seeds. The new seeds will be fed back to the fuzzing component to enable it to reach the target code block. The seed energy allocation method in the DMAB module for different testing stages of fuzzing is as follows: the method of allocating energy to seeds in different testing stages of DMAB changes with the goal of the testing stage. In the initial stage, the seed energy allocation method for DMAB is the same as that for AFL; During the development phase, DMAB allocates more energy to seeds with shorter seed distances and less energy to seeds with longer seed distances. During the exploration phase, DMAB assesses the probability of different seeds covering new branches and allocates more energy to seeds with a higher probability of covering new branches.

2. The probability-based directional hybrid fuzzy testing method according to claim 1, characterized in that, During static analysis, each basic block has a unique basic block address, which is obtained by hashing the string consisting of the line number and code content of the last line of each basic block; at the same time, the basic block distance and address are instrumented into the target program.

3. The probability-based directional hybrid fuzzy testing method according to claim 1, characterized in that, The DMAB module divides the testing phase into an initial phase, an exploration phase, and a development phase based on the goals of fuzzing exploration and development. In the initial phase, fuzzing explores the program's path space in AFL mode to discover more possible paths to the target code block. During the development phase, the DMAB module uses shorter seeds to reach the target code block; during the exploration phase, the DMAB module is used to discover more possible program execution paths to reach the target basic block.

Images