A rich-branch node-based targeted fuzz testing optimization method and system

Abstract

The application discloses a kind of based on the optimization method and system of directional fuzzy test of rich branch node, the method includes: the compiling insertion of being tested program, extract program call graph CG and control flow graph CFG information;According to the energy allocation strategy of directional fuzzy test, seed of input pool is endowed with energy, strategy selects the seed energy and selects appropriate seed after variation, and the test case is used as the input of the compiling insertion of being tested program, and the coverage information is collected in the running process of being tested program, and the distance from the test case to sensitive position is calculated by CG and CFG;The energy of input seed is changed by the newly added transition diffusion strategy, so as to increase the comprehensiveness of directional fuzzy test.The application can improve coverage while directional fuzzy test, and the comprehensiveness of fuzzy test is considered.

Description

Technical Field

[0001] This invention belongs to the field of fuzz testing technology, and in particular relates to a directional fuzz testing optimization method and system based on rich branch nodes. Background Technology

[0002] Fuzzing is one of the most efficient ways to automate the testing of applications and discover software defects and vulnerabilities. In recent years, the code space of applications has become increasingly large. For example, the current version of the CHROME browser has more than 100 million lines of code[2]. Behind the huge code space lies a huge security risk. However, the huge code space has exceeded the capabilities of manual code analysis. Therefore, fuzzing has become the mainstream method for discovering security vulnerabilities in applications. In order to quickly test the security of specific locations in a program or reproduce vulnerabilities, symbolic execution, taint analysis and coverage-based fuzzing techniques have been applied to fuzzing to give it directional capabilities. However, the application of these techniques has increased the complexity of fuzzing and sacrificed the comprehensiveness of fuzzing. It is necessary to optimize them. Directed fuzzing is a special fuzzing technique. In order to control the significant impact of releasing POCs, most current vulnerability reports only report the vulnerability location (i.e., the crash point). In order to reproduce vulnerabilities or test the security of patches, security workers urgently need a security testing tool that can quickly reach the vulnerability report location or patch location. Based on the maturity and efficiency of fuzzing, giving fuzzing directional capabilities has become one of the research directions of security researchers. Early targeted fuzzing relied on symbolic execution, which uses a set of abstract symbols to represent corresponding constraints. Test cases generated using these constraints can be executed relatively consistently along a selected path. However, as the program runs, the increasing number of branches leads to a sharp rise in the complexity of the constraints—this is the path explosion effect. Symbolic execution cannot achieve targeted fuzzing for long paths. AFLGo, building upon AFL, extracts the call graph (CG) and control flow graph (CFG), calculates the distance from the seed to the target, and optimizes the energy scheduling algorithm using simulated annealing, thus implementing coverage-based targeted gray-box fuzzing. However, AFLGo's energy allocation algorithm is not favorable for long-distance seeds and seeds deviating from the target, failing to ensure comprehensive fuzzing results. Summary of the Invention

[0003] This invention addresses the problem that the energy allocation scheme based on the simulated annealing algorithm does not consider the diffusion of test cases after they reach the target, thus causing AFLGo's directional fuzzing technology to fail to achieve comprehensive fuzzing. It proposes an optimized method and system for directional fuzzing based on rich-branch-nodes (RDGFuzz). Based on AFLGo, the energy allocation algorithm is optimized and improved, and an improved directional greybox fuzzing is implemented. Experiments demonstrate that this invention can improve coverage while simultaneously achieving comprehensive fuzzing.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] This invention proposes a directional fuzzy testing optimization method based on rich branch nodes, comprising:

[0006] Step 1: Compile and instrument the program under test, and extract the program call graph (CG) and control flow graph (CFG) information;

[0007] Step 2: Assign energy to the seeds in the input pool according to the energy allocation strategy of the directional fuzzing test. Select an appropriate seed based on the seed energy, mutate it, and use the test case as the input of the compiled and instrumented program under test. During the operation of the program under test, collect coverage information and calculate the distance from the test case to the sensitive location through CG and CFG. If the program crashes during operation, store the test case in the crash seed database. Otherwise, if new coverage is generated, store the test case in the input pool and perform the next fuzzing test. If no new coverage is generated, directly perform the next fuzzing test.

[0008] Step 3: After the program under test finishes running, extract rich branch nodes based on the coverage of the test cases. If the test cases reach sensitive locations, activate the transfer diffusion strategy. The transfer diffusion strategy updates the seed energy in the input pool based on the information of the rich branch nodes, allowing more seeds to spread to the surrounding areas of the rich branch nodes while conducting directional fuzz testing, thereby improving the coverage.

[0009] Furthermore, the energy allocation strategy for the directional fuzz test adopts the energy allocation strategy of AFLGo.

[0010] Furthermore, in step 3, rich branch nodes are extracted in the following manner:

[0011]

[0012] Where parameter I f I nW represents the basic influence of the function and the basic influence of the node, respectively. final Indicates the final weight of the node;

[0013] Select the top 10% of nodes by final weight as rich branch nodes, and construct a list of rich branch nodes from highest to lowest final weight.

[0014] Furthermore, the basic influence of the function or the basic influence of the node are calculated as follows:

[0015]

[0016] Where parameter I C s n W n These represent the type influence of a function or node, the total number of edges in a function or node, and the edge weight of a function or node, respectively; I basic Indicates the basic influence of a function or node;

[0017] Calculate the type influence of a function or node as follows:

[0018]

[0019]

[0020] Among them I in I on These represent the influence of converging functions or nodes, and the influence of diverging functions or nodes, respectively; s in s out These represent the total number of referenced edges of a function or node, and the total number of referenced edges of a function or node, respectively.

[0021] Calculate the edge weights of functions or nodes as follows:

[0022]

[0023]

[0024]

[0025]

[0026] Among them W inis W onos W inos W onis These represent the edge weights of converging functions or nodes, referencing edges of diverging functions or nodes, and referencing edges of converging functions or nodes, respectively; the parameter x is the number of times the edge is covered.

[0027] Furthermore, the transfer and diffusion strategy includes:

[0028] The test cases are counted through the rich branch nodes, and a bias α is calculated based on the final weight of each rich branch node. α is used to adjust the energy allocated to the seed by the AFLGo energy allocation strategy.

[0029] α is calculated using the following formula

[0030]

[0031] Another aspect of this invention proposes a directional fuzzy testing optimization system based on rich branch nodes, comprising:

[0032] The preprocessing module is used to compile and instrument the program under test, and extract the program call graph (CG) and control flow graph (CFG) information.

[0033] The directional fuzzing module is used to assign energy to the seeds in the input pool according to the directional fuzzing energy allocation strategy. After selecting an appropriate seed based on the seed energy and mutating it, the test case is used as the input of the compiled and instrumented program under test. During the execution of the program under test, coverage information is collected, and the distance from the test case to the sensitive location is calculated through CG and CFG. If a crash occurs during program execution, the test case is stored in the crash seed database. Otherwise, if new coverage is generated, the test case is stored in the input pool and the next fuzzing test is performed. If no new coverage is generated, the next fuzzing test is performed directly.

[0034] The transfer and diffusion testing module is used to extract rich branch nodes based on the coverage of test cases after the program under test has finished running. If a test case reaches a sensitive position, the transfer and diffusion strategy is activated. The transfer and diffusion strategy updates the seed energy in the input pool based on the information of the rich branch nodes, allowing more seeds to spread to the surrounding areas of the rich branch nodes while the targeted fuzz test is being performed, thereby improving the coverage.

[0035] Furthermore, the energy allocation strategy for the directional fuzz test adopts the energy allocation strategy of AFLGo.

[0036] Furthermore, in the transfer and diffusion test module, rich branch nodes are extracted in the following manner:

[0037]

[0038] Where parameter I f I n W represents the basic influence of the function and the basic influence of the node, respectively. final Indicates the final weight of the node;

[0039] Select the top 10% of nodes by final weight as rich branch nodes, and construct a list of rich branch nodes from highest to lowest final weight.

[0040] Furthermore, the basic influence of the function or the basic influence of the node are calculated as follows:

[0041]

[0042] Where parameter I C s n W n These represent the type influence of a function or node, the total number of edges in a function or node, and the edge weight of a function or node, respectively; I basic Indicates the basic influence of a function or node;

[0043] Calculate the type influence of a function or node as follows:

[0044]

[0045]

[0046] Among them I in I on These represent the influence of converging functions or nodes, and the influence of diverging functions or nodes, respectively; s in s out These represent the total number of referenced edges of a function or node, and the total number of referenced edges of a function or node, respectively.

[0047] Calculate the edge weights of functions or nodes as follows:

[0048]

[0049]

[0050]

[0051]

[0052] Among them W inis W onos W inos W onis These represent the edge weights of converging functions or nodes, referencing edges of diverging functions or nodes, and referencing edges of converging functions or nodes, respectively; the parameter x is the number of times the edge is covered.

[0053] Furthermore, the transfer and diffusion strategy includes:

[0054] The test cases are counted through the rich branch nodes, and a bias α is calculated based on the final weight of each rich branch node. α is used to adjust the energy allocated to the seed by the AFLGo energy allocation strategy.

[0055] α is calculated using the following formula

[0056]

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] This invention optimizes and improves the energy allocation algorithm of AFLGo and implements an improved directional fuzzy test. Experiments show that this invention can improve coverage while performing directional fuzzy testing, thus ensuring the comprehensiveness of fuzzy testing. Attached Figure Description

[0059] Figure 1 This is a flowchart of a directional fuzzy testing optimization method based on rich branch nodes, according to an embodiment of the present invention.

[0060] Figure 2 This is a graph showing the changes in the weights of incoming edges of converging functions / nodes and the weights of outgoing edges of diverging functions / nodes according to an embodiment of the present invention.

[0061] Figure 3 This is a graph showing the changes in the outgoing edge weights of convergent functions / nodes and the incoming edge weights of divergent functions / nodes according to an embodiment of the present invention.

[0062] Figure 4 RDGFuzz was used to detect different crash times in an embodiment of the present invention;

[0063] Figure 5 This is a real-time change in the coverage of RDGFuzz and AFLGo in an embodiment of the present invention;

[0064] Figure 6 This is a schematic diagram of a directional fuzzy testing optimization system architecture based on rich branch nodes, according to an embodiment of the present invention. Detailed Implementation

[0065] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0066] A directional fuzzing optimization method based on rich branch nodes (RDGFuzz) is proposed. RDGFuzz mainly consists of three parts: preprocessing, directional fuzzing, and transition diffusion testing. Figure 1 The main workflow of RDGFuzz is shown, including:

[0067] The main task of the preprocessing section is to compile and instrument the program under test, and extract the program call graph (CG) and control flow graph (CFG) information. Compilation and instrumentation are prerequisites for obtaining coverage information during program execution. CG and CFG are used to calculate the distance from the seed to sensitive locations, providing support for the energy allocation scheme of directional fuzzing testing.

[0068] The main task of the directional fuzzing section is to assign energy to the seeds in the input pool according to the directional fuzzing energy allocation strategy. The selection strategy then chooses a suitable seed based on the seed energy, mutates it, and uses this seed as input to the compiled and instrumented program under test. During the program's execution, coverage information is collected, and the distance from the test case to sensitive locations is calculated using CG and CFG. If a crash occurs during program execution, the test case is stored in the crash seed database. Otherwise, if new coverage is generated, the test case is stored in the input pool and the next fuzzing test is performed. If no new coverage is generated, RDGFuzz directly proceeds to the next fuzzing test.

[0069] The main task of the transfer-diffusion testing section is to increase the comprehensiveness of directional fuzzing by changing the energy of the input seeds through a newly added transfer-diffusion strategy. After the program under test finishes running, rich branch nodes are extracted based on the coverage of the test cases. If a test case reaches a sensitive location, the transfer-diffusion strategy is activated. The transfer-diffusion strategy updates the seed energy in the input pool based on the information of the rich branch nodes, allowing more seeds to diffuse to the surrounding areas of the rich branch nodes during directional fuzzing, thereby improving coverage.

[0070] (1) Energy allocation strategy for directional fuzzy testing

[0071] The energy allocation strategy for directional fuzzy testing adopts the energy allocation strategy of AFLGo. In AFLGo, the function-level distance and the basic block-level distance are calculated by formulas (1) and (2), respectively.

[0072]

[0073]

[0074] The distance from the seed to the target is called the seed distance. The seed distance calculated by formula (3) is normalized using formulas (4), (5), and (6).

[0075]

[0076]

[0077] min D = min s′∈S [d b (s′,T b (5)

[0078] max D = max s′∈S [d b (s′,T b (6)

[0079] The normalized seed distance is an important basis for the simulated annealing algorithm to allocate energy. Combined with the energy allocation strategy of AFL, the corresponding energy is finally allocated to the seed by formula (7).

[0080]

[0081] Where p(s,T) b ) is the energy allocated by the simulated annealing algorithm, with a value range of (0, 1). Therefore, the final The range of values ​​is within between.

[0082] For the meaning of each parameter in formulas (1) to (7), please refer to the paper "Directed Greybox Fuzzing".

[0083] (2) Rich branch nodes

[0084] By analyzing the program's CG and CFG, we can see that some functions (nodes) have rich reference and referenced paths. We call functions (nodes) with more referenced paths (incoming edges) than referenced paths (outgoing edges) convergent functions (nodes), and vice versa.

[0085] To achieve higher coverage, fuzz testing generally favors edges that are tested less frequently, as these edges are more likely to generate new coverage and discover new vulnerabilities. For converging functions (nodes), the coverage generated comes more from functions (nodes) that reference them; therefore, the fewer times their referenced edges are covered, the greater their weight. For diverging functions (nodes), the coverage generated comes more from the functions (nodes) they reference; therefore, the fewer times their referenced edges are covered, the greater their weight.

[0086] To ensure fuzz testing coverage, it's also necessary to guarantee a certain level of test case correctness to ensure efficiency. Converging reference edges and diverging referenced edges primarily determine whether a test case can pass or reach its designated location. Therefore, the more times a test case is covered, the higher its seed accuracy and the greater its weight.

[0087] We use W inis W onos W inos W onisLet represent the weights of referenced edges in a converging function (node), the weights of referenced edges in a diverging function (node), the weights of referenced edges in a converging function (node), and the weights of referenced edges in a diverging function (node), respectively. We define the weight expression of any edge of a function (node) using formulas (8), (9), (10), and (11), where the parameter x is the number of times the edge is covered.

[0088]

[0089]

[0090]

[0091]

[0092] like Figure 2 As shown, the weights of incoming edges of converging functions (nodes) and outgoing edges of diverging functions (nodes) decrease as the number of times they are covered increases. At the beginning of the fuzz test, all incoming edges of converging functions (nodes) and outgoing edges of diverging functions (nodes) are 1. As the fuzz test progresses, the weights of frequently covered edges gradually approach 0. The decrease in edge weights will cause the targeted fuzz test to select the path with the greater weight to execute, thereby improving the coverage of the targeted fuzz test. Figure 3 The graph shows the changes in the weights of outgoing edges of converging functions (nodes) and incoming edges of diverging functions (nodes). Initially, the weights of all outgoing edges of converging functions (nodes) and incoming edges of diverging functions (nodes) are 0. As fuzzing progresses, the weights of frequently covered edges gradually approach 1. The increase in edge weights makes the directional fuzzing test tend to select the path that can run correctly, thus increasing the accuracy of the test cases in the directional fuzzing test.

[0093] For different converging and diverging functions (nodes), this invention determines the type influence degree based on the number of referenced edges and the number of referenced edges of the function (node). This invention uses I... in I on Let represent the influence of converging functions (nodes) and diverging functions (nodes) respectively. This invention uses formulas (12) and (13) to define the influence of different types of functions (nodes), where s in s out These represent the total number of referenced edges and the total number of referenced edges of the function (node), respectively.

[0094]

[0095]

[0096] Based on the influence of different function (node) types, this invention defines the basic influence degree I of a function (node) using formula (14).basic , where parameter I C s n W n These represent the type influence of a function (node), the total number of edges of a function (node), and the edge weight of a function (node), respectively.

[0097]

[0098] Since the node is located inside the function, the final weight of the node is related to the function it is in. This invention uses formula (15) to define the final weight W of the node. final , where parameter I f I n These represent the basic influence of the function and the basic influence of the node, respectively.

[0099]

[0100] This invention selects the top 10% of nodes by final weight as rich branch nodes and constructs a rich branch node list from highest to lowest according to the final weight.

[0101] (3) Rich Branch Node Extraction Algorithm

[0102] Algorithm 1 demonstrates the specific algorithm for rich branch node extraction. The algorithm takes the CG and CFG of the tested program as input. After one test case run, it analyzes the coverage information and obtains information such as the covered functions and nodes (lines 1-3). Next, the algorithm combines the CG and CFG to determine the type of newly added functions and nodes (lines 4-7). After determining the type information of the functions and nodes, it calculates the weights of various functions and nodes. Finally, after calculating the final weights of all nodes, the algorithm returns a list of rich branch nodes based on the top 10% of the weights (lines 8-9).

[0103] Algorithm 1 Rich Branch Node Extraction Algorithm

[0104] Input: CG and CFG of the program under test

[0105] Output: List of rich branch nodes

[0106] 1. BEGIN: exec(testcase) / / Run the test case

[0107] 2. `funclist ← analysisFunc(cov)` / / Analyzes coverage information and adds the functions covered in this run to `funclist`.

[0108] 3. nodelist ← analysisNode(cov, funclist) / / Analyze coverage information and add the nodes covered in this run.

[0109] nodelist

[0110] 4. for func in funclist:

[0111] 5. jugFuncType(func, CG) / / Use CG to determine the function type

[0112] 6. jugNodeType(func, CFG) / / Use CFG to determine the node type

[0113] 7. end for

[0114] 8. countWeight(funclist) / / Calculates the weights of functions and nodes.

[0115] 9. `RBNodelist = desort(nodelist, weight, 0.1)` / / Rich branch nodes are the top 10% of nodes by weight in the node list. 10. `return RBNodelist`

[0116] 11. function jugFuncType(func, CG) / / Function definition for determining function type 12. {

[0117] 13. if func.type! = null:

[0118] 14.exit

[0119] 15.else:16.func.type←(countInside(func,CG)>countOutside(func,CG))? intype:outtype / / Use CG to judge

[0120] Is the function of type convergent or divergent?

[0121] 17.end if

[0122] 18.}

[0123] 19. function jugNodeType(func, CFG) / / Function definition for determining node type

[0124] 20.{

[0125] 21. for node in func:

[0126] 22. if node.type ! = null:

[0127] 23.exit

[0128] 24.else:25.node.type←(countInside(func,CFG)>countOutside(func,CFG))? intype:outtype / / use

[0129] CFG determines whether a node is a convergent or divergent node.

[0130] 26.end if

[0131] 27. end for

[0132] 28.}

[0133] 29. function countWeight(funclist) / / Calculate weights

[0134] 30.{

[0135] 31. for func in funclist:

[0136] 32.for node in func:33.node.tInflu←node.type==intype? count(node.inSide)^2 / (count(node.inSide)^2+

[0137] count(node.outSide)^2):count(node.outSide)^2 / (count(node.inSide)^2+

[0138] count(node.outSide)^2) / / Calculate the influence of node type.

[0139] 34. For side in node: / / Calculate the edge weight of the node

[0140] 35. if side.type == intype: / / Calculate the weight of the incoming edges of the node

[0141] 36.side.weight←node.type==intype?

[0142] 2*e^(-0.01*count(side.cov)) / (1+e^(-0.01*count(side.cov))):(1-e^(0.01*count(side.cov))) / (1+e

[0143] ^(0.01*count(side.cov)))

[0144] 37.else: / / Calculate the weights of outgoing edges from nodes

[0145] 38.side.weight←node.type==intype?

[0146] (1-e^(0.01*count(side.cov))) / (1+e^(0.01*count(side.cov))):

[0147] 2*e^(-0.01*count(side.cov)) / (1+e^(-0.01*count(side.cov)))

[0148] 39.end if

[0149] 40.end for

[0150] 41. end for

[0151] 42.func.tInflu←func.type==intype? count(func.inSide)^2 / (count(func.inSide)^2+

[0152] count(func.outSide)^2):count(func.outSide)^2 / (count(func.inSide)^2+

[0153] count(func.outSide)^2) / / Calculates the type influence of the function.

[0154] 43. end for

[0155] 44. for func in funclist:

[0156] 45.func.basicInflu←func.tInflu*count(func.side)*sum(func.side.weight)

[0157] 46. ​​for node in func:

[0158] 47.node.basicInflu←node.tInflu*count(node.side)*sum(node.side.weight)

[0159] 48.node.weight←func.basicInflu*e^(node.basicInflu)

[0160] 49.end for

[0161] 50.end for

[0162] 51.}

[0163] 52.END

[0164] (4) Transfer and diffusion strategy

[0165] After the test case achieves its objective, we analyze it using the collected coverage information. In AFLGo, the shorter the path of the test case, the higher the energy it can obtain. Long-path seeds will suffer from a starvation effect due to insufficient energy allocation, thus reducing the coverage of fuzz testing. However, blindly allocating energy to long-path seeds not only fails to guarantee the expected increase in coverage but also reduces the orientation capability of fuzz testing. We count the rich branch nodes traversed by the test case and calculate a bias α based on the final weight of each rich branch node. α is used to adjust the energy allocated to the seed by the AFLGo energy allocation strategy. α is calculated using formula (16), and the final seed energy is... This is expressed as formula (17).

[0166]

[0167]

[0168] To ensure that rich branch nodes can fully utilize their functions, a certain amount of time needs to be allocated to new rich branch nodes to carry out sufficient coverage. In order to balance the time of targeted fuzz testing and transfer diffusion, and to increase code coverage while ensuring directional capabilities, this invention updates the list of rich branch nodes every 20 minutes.

[0169] To verify the actual effect of the optimization method proposed in this invention, RDGFuzz was run in the configuration shown in Table 1.

[0170] Table 1 Experimental Environment

[0171]

[0172] (a) Overall performance assessment

[0173] The overall performance evaluation primarily aims to assess RDGFuzz's actual capabilities in terms of coverage, vulnerability discovery, and operational efficiency. Based on the configuration in Table 1, this invention runs the RDGFuzz fuzzing tool for 72 hours. Because RDGFuzz only runs the transfer diffusion algorithm after reaching the target, we arbitrarily marked 256 points as targets for each program. Within 72 hours, RDGFuzz discovered 13 unique crashes. Figure 4 The results show the time points at which RDGFuzz detected different crashes. During the run, libxml2 generated 5 unique crashes, while lrzip and mjs each generated 4 unique crashes.

[0174] Regarding coverage, this invention tested mjs using RDGFuzz and AFLGo for a total of 24 hours. Figure 5 The real-time coverage changes of RDGFuzz and AFLGo were shown. After the run, RDGFuzz had a coverage of 48.2% on mjs, which was 30.98% higher than AFLGo's 36.8%.

[0175] (b) Assessment of directional fuzzy testing capabilities

[0176] Targeted fuzzing capability is a core feature of AFLGo and RDGFuzz. This capability is evaluated through crash reproduction. This invention reproduces CVE-2021-33453 on lrzip, a User-Avoidance (UAF) vulnerability in lrzip-0.641, located at line 1538 of stream.c, within the ucompthread function. The fuzzing test was limited to 24 hours, using 2639 randomly selected zip files (less than 100KB each) from the internet as seed files. The test stopped upon triggering the vulnerability. In addition to the vulnerability location, 31 other arbitrary target points were marked as testing aids. Table 2 shows a comparison of the performance of RDGFuzz and AFLGo across five tests.

[0177] As shown in Table 2, RDGFuzz successfully triggered the CVE-2021-33453 vulnerability 4 times, while AFLGo successfully triggered it 5 times. The large fluctuations in the number of targets reached are due to the randomness of fuzz testing; the order in which targets are reached is completely unpredictable. Regarding average coverage per target, RDGFuzz averaged 1.27% / target, while AFLGo averaged 0.81% / target, representing a 56.79% performance improvement. However, in terms of time taken to reach each target, RDGFuzz averaged 55.03 minutes per target, while AFLGo averaged 42.41 minutes per target, representing a 29.76% performance decrease. The experiments show that RDGFuzz possesses comparable targeting capabilities to AFLGo, but because RDGFuzz's energy allocation strategy allocates more energy to nodes with rich branches, it reduces the speed of reaching targets while increasing coverage.

[0178] Table 2 Comparison of Orientation Abilities between RDGFuzz and AFLGo

[0179]

[0180] Based on the above embodiments, such as Figure 6 As shown, this invention also proposes a directional fuzzy testing optimization system based on rich branch nodes, comprising:

[0181] The preprocessing module is used to compile and instrument the program under test, and extract the program call graph (CG) and control flow graph (CFG) information.

[0182] The directional fuzzing module is used to assign energy to the seeds in the input pool according to the directional fuzzing energy allocation strategy. After selecting an appropriate seed based on the seed energy and mutating it, the test case is used as the input of the compiled and instrumented program under test. During the execution of the program under test, coverage information is collected, and the distance from the test case to the sensitive location is calculated through CG and CFG. If a crash occurs during program execution, the test case is stored in the crash seed database. Otherwise, if new coverage is generated, the test case is stored in the input pool and the next fuzzing test is performed. If no new coverage is generated, the next fuzzing test is performed directly.

[0183] The transfer and diffusion testing module is used to extract rich branch nodes based on the coverage of test cases after the program under test has finished running. If a test case reaches a sensitive position, the transfer and diffusion strategy is activated. The transfer and diffusion strategy updates the seed energy in the input pool based on the information of the rich branch nodes, allowing more seeds to spread to the surrounding areas of the rich branch nodes while the targeted fuzz test is being performed, thereby improving the coverage.

[0184] Furthermore, the energy allocation strategy for the directional fuzz test adopts the energy allocation strategy of AFLGo.

[0185] Furthermore, in the transfer and diffusion test module, rich branch nodes are extracted in the following manner:

[0186]

[0187] Where parameter I f I n W represents the basic influence of the function and the basic influence of the node, respectively. final Indicates the final weight of the node;

[0188] Select the top 10% of nodes by final weight as rich branch nodes, and construct a list of rich branch nodes from highest to lowest final weight.

[0189] Furthermore, the basic influence of the function or the basic influence of the node are calculated as follows:

[0190]

[0191] Where parameter I C s n W n These represent the type influence of a function or node, the total number of edges in a function or node, and the edge weight of a function or node, respectively; I basic Indicates the basic influence of a function or node;

[0192] Calculate the type influence of a function or node as follows:

[0193]

[0194]

[0195] Among them I in I on These represent the influence of converging functions or nodes, and the influence of diverging functions or nodes, respectively; s in s out These represent the total number of referenced edges of a function or node, and the total number of referenced edges of a function or node, respectively.

[0196] Calculate the edge weights of functions or nodes as follows:

[0197]

[0198]

[0199]

[0200]

[0201] Among them W inis W onos W inos W onis These represent the edge weights of converging functions or nodes, referencing edges of diverging functions or nodes, and referencing edges of converging functions or nodes, respectively; the parameter x is the number of times the edge is covered.

[0202] Furthermore, the transfer and diffusion strategy includes:

[0203] The test cases are counted through the rich branch nodes, and a bias α is calculated based on the final weight of each rich branch node. α is used to adjust the energy allocated to the seed by the AFLGo energy allocation strategy.

[0204] α is calculated using the following formula

[0205]

[0206] In summary, this invention optimizes and improves the energy allocation algorithm based on AFLGo, and implements an improved directional fuzzy test. Experiments show that this invention can improve coverage while performing directional fuzzy testing, thus ensuring the comprehensiveness of fuzzy testing.

[0207] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A directional fuzzy testing optimization method based on rich branch nodes, characterized in that, include: Step 1: Compile and instrument the program under test, and extract the program call graph (CG) and control flow graph (CFG) information; Step 2: Assign energy to the seeds in the input pool according to the energy allocation strategy of directional fuzzing. Select an appropriate seed for mutation based on the seed energy. Use the mutated test cases as input to the compiled and instrumented program under test. During the program under test, collect coverage information and calculate the distance from the test case to the sensitive location using CG and CFG. If the program crashes during execution, store the test case in the crash seed database. Otherwise, if new coverage is generated, store the test case in the input pool and perform the next fuzzing test. If no new coverage is generated, directly perform the next fuzzing test. Step 3: After the program under test finishes running, extract rich branch nodes based on the coverage of the test cases. If the test cases reach sensitive locations, activate the transfer diffusion strategy. The transfer diffusion strategy updates the seed energy in the input pool based on the information of the rich branch nodes, allowing more seeds to spread to the surrounding areas of the rich branch nodes while conducting directional fuzz testing, thereby improving the coverage.

2. The directional fuzzy testing optimization method based on rich branch nodes according to claim 1, characterized in that, The energy allocation strategy for the directional fuzzy test adopts the energy allocation strategy of AFLGo.

3. The directional fuzzy testing optimization method based on rich branch nodes according to claim 2, characterized in that, In step 3, rich branch nodes are extracted in the following manner: Where parameters , These represent the basic influence of the function and the basic influence of the node, respectively. Indicates the final weight of the node; Select the top 10% of nodes by final weight as rich branch nodes, and construct a list of rich branch nodes from highest to lowest final weight.

4. The directional fuzzy testing optimization method based on rich branch nodes according to claim 3, characterized in that, Calculate the basic influence of the function or the basic influence of the node in the following way: Where parameters , , These represent the type influence of a function or node, the total number of edges of a function or node, and the edge weight of a function or node, respectively. Indicates the basic influence of a function or node; Calculate the type influence of a function or node as follows: in , These represent the influence of converging functions or nodes, and the influence of diverging functions or nodes, respectively. , These represent the total number of referenced edges of a function or node, and the total number of referenced edges of a function or node, respectively. Calculate the edge weights of functions or nodes as follows: in , , , These represent the weights of edges referenced by nodes in a converging function or node, the weights of edges referenced by nodes in a diverging function or node, and the weights of edges referenced by nodes in a diverging function or node; parameters This represents the number of times the edge has been covered.

5. The directional fuzzy testing optimization method based on rich branch nodes according to claim 3, characterized in that, The transfer and diffusion strategy includes: The test cases are analyzed by traversing rich branch nodes, and a bias is calculated based on the final weight of each rich branch node. , Used to adjust the energy allocated to the seed by the AFLGo energy allocation strategy; Calculated using the following formula 。 6. A directional fuzzy testing optimization system based on rich branch nodes, characterized in that, include: The preprocessing module is used to compile and instrument the program under test, and extract the program call graph (CG) and control flow graph (CFG) information. The directional fuzzing module is used to assign energy to the seeds in the input pool according to the directional fuzzing energy allocation strategy, select appropriate seeds for mutation based on the seed energy, and use the mutated test cases as input to the compiled and instrumented program under test. During the execution of the program under test, coverage information is collected, and the distance from the test case to the sensitive location is calculated through CG and CFG. If a crash occurs during program execution, the test case is stored in the crash seed database. Otherwise, if new coverage is generated, the test case is stored in the input pool and the next fuzzing test is performed. If no new coverage is generated, the next fuzzing test is performed directly. The transfer and diffusion testing module is used to extract rich branch nodes based on the coverage of test cases after the program under test has finished running. If a test case reaches a sensitive position, the transfer and diffusion strategy is activated. The transfer and diffusion strategy updates the seed energy in the input pool based on the information of the rich branch nodes, allowing more seeds to spread to the surrounding areas of the rich branch nodes while the targeted fuzz test is being performed, thereby improving the coverage.

7. The directional fuzzy testing optimization system based on rich branch nodes according to claim 6, characterized in that, The energy allocation strategy for the directional fuzzy test adopts the energy allocation strategy of AFLGo.

8. The directional fuzzy testing optimization system based on rich branch nodes according to claim 7, characterized in that, In the transfer and diffusion test module, rich branch nodes are extracted in the following manner: Where parameters , These represent the basic influence of the function and the basic influence of the node, respectively. Indicates the final weight of the node; Select the top 10% of nodes by final weight as rich branch nodes, and construct a list of rich branch nodes from highest to lowest final weight.

9. The directional fuzzy testing optimization system based on rich branch nodes according to claim 8, characterized in that, Calculate the basic influence of the function or the basic influence of the node in the following way: Where parameters , , These represent the type influence of a function or node, the total number of edges of a function or node, and the edge weight of a function or node, respectively. Indicates the basic influence of a function or node; Calculate the type influence of a function or node as follows: in , These represent the influence of converging functions or nodes, and the influence of diverging functions or nodes, respectively. , These represent the total number of referenced edges of a function or node, and the total number of referenced edges of a function or node, respectively. Calculate the edge weights of functions or nodes as follows: in , , , These represent the weights of edges referenced by nodes in a converging function or node, the weights of edges referenced by nodes in a diverging function or node, and the weights of edges referenced by nodes in a diverging function or node; parameters This represents the number of times the edge has been covered.

10. The directional fuzzy testing optimization system based on rich branch nodes according to claim 8, characterized in that, The transfer and diffusion strategy includes: The test cases are analyzed by traversing rich branch nodes, and a bias is calculated based on the final weight of each rich branch node. , Used to adjust the energy allocated to the seed by the AFLGo energy allocation strategy; Calculated using the following formula 。

Images