Context-aware dependency-guided kernel fuzzing test case mutation method and system
By dynamically collecting and minimizing system call sequences and using neural network models to learn context-aware dependencies, combined with multi-armed gambling machine models and upper bound confidence algorithms, the problem of insufficient context awareness in dependency modeling in kernel fuzzing tools is solved, thereby improving test case quality and kernel vulnerability discovery efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHEJIANG UNIV BINJIANG RES INST
- Filing Date
- 2023-03-10
- Publication Date
- 2026-06-02
AI Technical Summary
Existing kernel fuzzing tools lack context awareness when modeling system call dependencies, resulting in low test case quality, difficulty in triggering deep code paths, and coarse-grained dependency modeling, which affects testing efficiency.
By dynamically collecting and minimizing system call sequences, learning context-aware dependencies through a neural network language model, and combining the multi-armed gambling machine model to divide the exploration and exploitation phases, the optimal mutation operation is selected, and the upper bound confidence algorithm is used for mutation operation scheduling, thereby improving the quality and efficiency of test cases.
It achieves more accurate system call dependency modeling, improves the quality of test cases, enhances the triggering efficiency of deep kernel code logic and vulnerability discovery efficiency, while maintaining the efficiency and scalability of fuzz testing.
Smart Images
Figure CN116541268B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of software security and operating system kernel testing technology, and in particular to a method and system for mutating kernel fuzz test cases based on context-aware bootstrapping. Background Technology
[0002] The operating system kernel manages, controls, and coordinates the computer's hardware and software resources, forming the core and foundation of modern computer systems. Kernel security is crucial to the overall stability of the system. However, due to the kernel's massive codebase and complex functional structure, developers inevitably introduce errors or vulnerabilities; and given the widespread application and critical role of operating systems, these vulnerabilities can pose serious threats and losses. Discovering hidden errors and vulnerabilities in the operating system is of great significance for improving overall system security. Automated fuzzing has become one of the most popular and effective software testing techniques, widely used in testing various mainstream software, including operating system kernels.
[0003] To improve testing efficiency, many kernel fuzzing tools, such as Syzkaller, employ kernel virtualization execution and system call sequences as input to test kernel code. Due to the stateful nature of the kernel, explicit and implicit dependencies exist between different system calls. The triggering of certain vulnerabilities or kernel code paths requires specific combinations of system calls. Therefore, understanding the dependencies between system calls and selecting appropriate system calls to establish state paths based on context significantly impacts the exploration of deep kernel code paths and overall testing efficiency. To achieve this, Syzkaller uses a static probabilistic adjacency matrix to represent point-to-point, context-independent dependencies between system calls, including 1) determining dependencies based on common types between system calls, and 2) determining dependencies based on existing seed sets. The final probability distribution is obtained by combining these two sets of data, and system calls are selected based on this probability distribution. Another fuzzing tool, HEALER, uses a dynamic relation table (0-1 adjacency matrix) to represent point-to-point, context-independent dependencies between system calls. Its core lies in 1) dynamically executing the minimized test cases, 2) determining the dependency relationship between the last two system calls in the sequence, and 3) using a relation table to guide test case mutation.
[0004] While the aforementioned fuzzing tools can automatically infer dependencies between system calls and detect potential kernel vulnerabilities, their dependency modeling methods are incomplete, suffering from insufficient context awareness, low test case quality, and difficulty in triggering deep code. Specifically, existing fuzzing tools construct dependencies based on context-independent, point-to-point methods. During the mutation phase, they struggle to utilize context-independent dependencies to select system calls suitable for the mutation context, making it difficult to maintain state paths in test cases and reducing test case quality. Furthermore, existing fuzzing tools use coarse-grained runtime dynamic feedback, failing to fully grasp the dependencies inherent in the entire sequence. Therefore, a context-aware dependency modeling method that improves test quality and efficiency is currently lacking. Summary of the Invention
[0005] To address the aforementioned technical problems, this invention provides a context-aware, dependency-guided kernel fuzz test case mutation method and system. First, during testing, the system call sequences that successfully trigger new code paths are dynamically collected. Invalid system calls in the sequences are eliminated using a minimization algorithm to obtain a minimized sequence. The collected minimized sequence set is used as a training set to train a neural network language model to learn context-aware dependencies for subsequent mutations. Next, to balance exploration diversity and testing efficiency, this invention periodically switches between exploration and exploitation phases based on a multi-armed gambling machine model. During the exploitation phase, an upper-bound confidence algorithm selects the optimal mutation operation from multiple mutation operations and executes it. Based on the language model, this invention can perform context-aware, dependency-guided mutations, with a higher probability of establishing valid state paths, thereby improving the quality of test cases and increasing the efficiency of tools in discovering kernel vulnerabilities.
[0006] The specific technical solution is as follows:
[0007] In a first aspect, the present invention provides a method for mutating kernel fuzz test cases based on context-aware dependency guidance, comprising the following steps:
[0008] (1) Seed test case selection stage: Randomly select test cases from the corpus;
[0009] (2) Mutation operation selection stage: The selection of mutation operations is periodically divided into two stages: exploration and utilization. When in the exploration stage, a mutation operation is randomly selected from multiple mutation operations and the performance of the selected mutation operation is recorded. When entering the utilization stage, the best mutation operation is selected from multiple mutation operations and then the best mutation operation is continuously used.
[0010] (3) Test case mutation process: The selected seed test cases are mutated according to the selected mutation operation. If the selected mutation operation is a context-aware dependency-guided mutation, the subsequences before and after the mutation point in the test case are used as context input to the language model. The language model outputs the best system call and inserts it into the mutation point.
[0011] (4) Test case execution phase: The mutated test cases are executed in the kernel, and the execution results of the test cases are analyzed. If the test cases trigger new code paths, invalid system calls in the test cases are removed one by one in a dynamic manner, and the retained test cases are stored in the corpus. If it is in the exploration phase, the performance of the mutation operation corresponding to the test cases also needs to be recorded.
[0012] (5) Periodically train the language model using the corpus;
[0013] (6) The operating system kernel fuzzing tool repeats steps (2)-(5) until the fuzzing ends.
[0014] Kernel fuzzing tools typically combine multiple system calls into a sequence based on dependencies, populate parameters, and then execute it through the kernel to trigger abnormal kernel behavior. In this invention, test cases that trigger new code coverage are minimized. The minimized sequence eliminates irrelevant system calls while preserving clear dependencies, serving as a high-quality training set to help build context-aware dependencies between system calls and improve test case quality. In this process, fuzzing must also consider both test diversity and efficiency. During fuzzing, the more test cases that establish effective state paths, the more complex the triggered kernel behavior, and the higher the likelihood and efficiency of test cases triggering new execution paths and vulnerabilities.
[0015] Furthermore, step (2) specifically includes:
[0016] In the mutation operation selection phase, two stages are divided: exploration and exploitation. The two stages are assigned different time budgets and are switched alternately. When in the exploration phase, the fuzzing tool assigns different mutation operations the same probability, randomly selects one mutation operation, and records the performance of the mutation operation during the test case execution phase.
[0017] When entering the utilization phase, the best mutation operation is selected based on the performance of different mutation operations recorded in the exploration phase.
[0018] Furthermore, step (3) includes:
[0019] (3-1) Determine the type of mutation operation. If the mutation operation is a context-aware dependency-guided mutation, for a given seed test case, randomly select a position from the test cases as the mutation point, and use the subsequence before the mutation point and the subsequence after the mutation point as the mutation context, and input them into the language model respectively.
[0020] (3-2) For the two probability distributions given by the language model, select the system calls with the highest probabilities as temporary mutation candidates, and then merge the two groups of temporary mutation candidates and normalize them to obtain the final mutation candidates and their probability distributions.
[0021] (3-3) Randomly select a system call as the target from the final mutation candidates according to the probability distribution, supplement the parameters according to the context and insert it into the mutation point to complete the seed test case mutation.
[0022] Furthermore, step (4) includes:
[0023] (4-1) Execute the mutated test cases in the kernel, analyze the execution of the test cases, and if the test cases trigger new code paths in the kernel, exclude irrelevant system calls by removing system calls one by one and re-executing them to obtain the minimized test cases;
[0024] (4-2) If it is in the exploration phase, record that the mutation operation corresponding to the test case triggered a new code path;
[0025] (4-3) Save the minimized test cases to the corpus as the training set for the language model.
[0026] Furthermore, step (5) includes:
[0027] (5-1) In the initial stage, analyze the available system call functions and establish the corresponding system function mapping dictionary;
[0028] (5-2) The language model adopts a deep neural network, which includes a word embedding layer, a bidirectional gated recurrent unit, and a fully connected layer network structure. First, the test cases are mapped to the input of the word embedding layer. The word embeddings of the test cases are used as the input of the bidirectional gated recurrent unit to encode their dependencies. Finally, after passing through the fully connected layer, the probability distribution of the next system call is output.
[0029] (5-3) The language model is periodically trained on the corpus to learn the context-aware dependencies between system calls and the dependencies are continuously updated according to the progress of fuzz testing.
[0030] Secondly, the present invention provides a context-aware, boot-dependent kernel fuzzing system, comprising:
[0031] The mutation operation scheduling module periodically divides mutation operations into two phases: exploration and exploitation. During the exploration phase, a mutation operation is randomly selected from multiple mutation operations, and its performance after execution is recorded. When the exploitation phase begins, the best mutation operation is selected from multiple mutation operations, and then the best mutation operation is continuously used.
[0032] The test case mutation module is used to mutate selected seed test cases according to the selected mutation operation. If the selected mutation operation is a context-aware dependency-guided mutation, the subsequences before and after the mutation point in the test case are used as context input to the language model, and the language model outputs the best system call and inserts it into the mutation point.
[0033] The fuzzing execution module inputs the mutated test cases into the kernel and monitors kernel code coverage.
[0034] The data collection module determines whether test cases need to be minimized based on code coverage. If new code coverage is triggered, it minimizes the test cases to obtain a set of related system call sequences and saves them to the corpus.
[0035] The language model training module is used to periodically perform the language model training process based on the corpus, learn the dependencies between system calls, and apply them to seed mutation.
[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0037] 1) This invention dynamically collects a minimized set of system call sequences as a high-quality training set, and uses a neural network model to realize context-aware system call dependency modeling, thereby achieving more accurate and efficient modeling of system call relationships.
[0038] 2) This invention applies context-aware system call dependencies and guides fuzzy testing tools to select system calls that are more suitable for the context through a neural network language model. This increases the probability of test cases establishing effective state paths, improves the quality of test cases, and enables the triggering of deep kernel code logic, thereby optimizing coverage and vulnerability discovery efficiency.
[0039] 3) This invention uses a multi-armed gambling machine model to schedule mutation operations, and by dividing the exploration and exploitation phases, it takes into account both the diversity of exploration during the testing process and the efficiency of historical knowledge guidance.
[0040] 4) The invention requires very little additional time overhead, which can ensure the high efficiency of fuzzing tools in discovering kernel vulnerabilities; it is highly extensible and can be easily added to existing fuzzing tools as a module. Attached Figure Description
[0041] Figure 1 This is a schematic diagram of the overall architecture of a kernel fuzzing system based on language model context-aware dependency guidance.
[0042] Figure 2 A schematic diagram of the workflow for training a language model;
[0043] Figure 3 A schematic diagram illustrating the workflow of context-aware dependency-guided sequence mutation. Detailed Implementation
[0044] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not limit it in any way.
[0045] To implement a kernel fuzzing test case mutation method based on language model-based context-aware dependency guidance, this invention dynamically collects a minimized set of system call sequences as a training set. It then utilizes a neural network language model to learn the dependencies inherent in the training set, achieving context-aware dependency modeling. This model is applied to context-aware dependency-guided mutation to help select system calls appropriate for the current context and establish effective state paths. Simultaneously, this invention divides the fuzzing process into exploration and exploitation phases, dynamically scheduling mutation operations to balance test diversity and efficiency. In the exploitation phase, an upper-bound confidence algorithm selects the optimal mutation operation. Ultimately, this method improves test case generation quality through language model-based context-aware dependency and mutation operation scheduling, enabling triggering of deep kernel code logic and increasing the efficiency of fuzzing in uncovering kernel vulnerabilities.
[0046] The basic idea is as follows: First, a seed sequence from the corpus is randomly selected, and a mutation operation is chosen according to different scheduling strategies based on the current stage. Next, the seed sequence is mutated according to the selected mutation operation. If the selected mutation operation is a context-aware dependency-guided mutation operation, the context of the seed sequence is extracted and input into the language model. Based on the model's predicted distribution, appropriate system calls are selected and inserted into the mutation points. Then, fuzzing analyzes the results of the kernel executing test cases. If a new code path is triggered, the test cases are minimized and saved as part of the training set, and the next round of testing begins. The fuzzing tool periodically trains the model on the training set, updating the dependencies between system calls.
[0047] like Figure 1 As shown, the kernel fuzzing system based on language model context-aware dependency guidance includes a mutation operation scheduling module, a test case mutation module, a test case execution module, a data collection module, and a language model training module, wherein:
[0048] The test case mutation module uses context-aware dependencies learned by the language model to select system calls that fit the mutation point context, fill in the parameters, and insert them into the seed.
[0049] The mutation operation scheduling module records the performance of different mutation operations during the exploration phase and uses the best-performing mutation operation during the utilization phase.
[0050] The fuzzing execution module inputs the mutated test cases into the kernel and monitors kernel code coverage.
[0051] The data collection module determines whether to minimize test cases based on code coverage. If new code coverage is triggered, it minimizes the test cases to obtain a set of related system call sequences and saves them to the training set.
[0052] The language model training module periodically executes the language model training process based on the collected set of system call sequences, learns the dependencies between system calls and applies them to seed mutation, thereby improving the quality of test cases and testing more in-depth code.
[0053] The kernel fuzz test case mutation method based on the context-aware dependency guidance of the above system mainly includes the following steps:
[0054] (1) Randomly select a system call sequence from the corpus as a seed.
[0055] (2) The mutation operation scheduling module is divided into two phases: exploration and exploitation. These two phases alternate, and different scheduling strategies are used to select mutation operations based on the current phase, including:
[0056] (2-1) During the exploration phase, all mutation operations are assigned the same weight, and a mutation operation is randomly selected to ensure the diversity of test cases; the mutation operations are mainly divided into three types: context-aware dependency-guided mutation, static relation dependency-guided mutation, and random mutation; the number of times each mutation operation is used is recorded, and the number of times each mutation operation triggers new code coverage is recorded during the execution phase;
[0057] (2-2) When in the exploitation phase, the best mutation operation is selected by using the upper bound confidence algorithm based on the number of times each mutation operation is used and the number of times new code coverage is triggered, and the operation is used continuously to improve testing efficiency.
[0058] (3) Based on the selected mutation operation, the test case mutation module mutation seed sequence is determined. When the mutation operation is a context-aware dependency-guided mutation, mutation is performed by combining the context and the language model, such as... Figure 3 As shown, it includes:
[0059] (3-1) Randomly select a position in the sequence as the mutation point, extract the subsequences before and after the mutation point as the mutation context, and input the preceding text in ascending order and the following text in descending order into the language model to obtain the probability distribution predicted by the model;
[0060] For example, for the sequence {c0,c1,c2,…,c m}, randomly select c i As the mutation point, mutation point c i The preceding subsequence {c0,c1,c2,…,c i-1} and the subsequent subsequence {c i+1 ,c i+2 ,c i+3 ,…,c m} are used as variation contexts, with the preceding text in ascending order and the following text in descending order input into the language model to adapt to the bidirectional gated loop unit.
[0061] It should be noted that the context sequence is input to the same language model, while the preceding and following sequences are each output by the language model module independently, which determines the probability distribution of the next system call.
[0062] (3-2) For the two probability distributions given by the model, the top few system calls with the highest probability are selected as temporary mutation candidates. Then, the two groups of temporary mutation candidates are merged and normalized to obtain the final mutation candidates and their probability distributions. In this embodiment, the top 10 system calls with the highest probability distributions are selected as temporary mutation candidates and combined to obtain the final mutation candidates.
[0063] (3-3) Randomly select a system call as the target from the final mutation candidates according to the probability distribution, supplement the parameters according to the context, and insert it into the mutation point to complete the seed mutation.
[0064] (4) The test case execution module delivers the mutated test cases to the kernel for execution and records the execution results, such as recording the corresponding coverage information.
[0065] (5) The data collection module analyzes the execution results of test cases to construct a training set, including:
[0066] (5-1) Analyze the execution of test cases. If a test case triggers a new kernel code path, remove system calls sequentially from back to front, re-execute the reduced sequence of methods to exclude irrelevant system calls, and obtain the minimized test cases;
[0067] (5-2) If it is in the exploration phase, record that the mutation operation corresponding to the test case triggered a new code path;
[0068] (5-3) The minimized system call sequence contains relatively clear dependencies between system calls and is saved in the training set;
[0069] (6) Periodically use the language model training module to model the dependencies between system calls on the training set, update the language model parameters, and use the model for context-aware dependency-guided mutations to improve the quality of test case generation and increase the probability of test cases exploring deep code paths.
[0070] like Figure 2 As shown, the workflow for language model training is as follows:
[0071] (6-1) In the initial stage, analyze the available system call functions and establish the corresponding system function mapping dictionary;
[0072] (6-2) The language model employs a deep neural network, including network structures such as word embedding layers, bidirectional gated recurrent units, and fully connected layers. First, the system call sequence {c0, c1, c2, ..., c...} in the training set is obtained through the word embedding layer. m The word embeddings of the system call sequence are used as inputs to bidirectional gated recurrent units to encode their dependencies. Finally, after passing through a fully connected layer, the output c is obtained. m+1 The probability distribution.
[0073] (6-3) The language model is periodically trained on the training set to learn context-aware dependencies between system calls, and the dependencies are continuously updated according to the progress of fuzz testing;
[0074] (7) Repeat steps (2)-(6) until the fuzzy detection ends.
[0075] For the system implementation, since it basically corresponds to the method implementation described above, the relevant parts can be referred to in the description of the method implementation, for example:
[0076] The mutation operation scheduling module may further include:
[0077] The phase division module is used to divide the mutation operation selection process into two phases: exploration and exploitation. The two phases are assigned different time budgets and are switched alternately.
[0078] The exploration phase execution module is used to assign equal probability to different mutation operations by the fuzzing tool during the exploration phase, randomly select a mutation operation, and record its performance after the mutation operation is executed.
[0079] The phase execution module is used to select the best mutation operation based on the performance of different mutation operations recorded in the exploration phase.
[0080] The test case variation module may further include:
[0081] The mutation operation type determination module is used to determine the type of mutation operation. If the mutation operation is a context-aware dependency-guided mutation, for a given seed test case, a position is randomly selected from the test cases as the mutation point, and the subsequence before the mutation point and the subsequence after the mutation point are used as the mutation context and input into the language model respectively; otherwise, the mutation operation is directly executed at the mutation point.
[0082] The language model module is used to output two probability distributions based on the input context sequence, select the system calls with the highest probabilities as temporary mutation candidates, and then merge the two sets of temporary mutation candidates and perform normalization to obtain the final mutation candidates and their probability distributions.
[0083] The mutation insertion module is used to randomly select a system call as the target from the final mutation candidates according to a probability distribution, supplement the parameters according to the context, and insert it into the mutation point to complete the mutation of the seed test case.
[0084] The language model training module may further include:
[0085] The mapping dictionary module is used to analyze the available system call functions in the initial stage and build the corresponding system function mapping dictionary;
[0086] The periodic training module is used to periodically train the language model on the corpus, learn context-aware dependencies between system calls, and continuously update the dependencies based on the progress of fuzz testing.
[0087] The language model employs a deep neural network, comprising a word embedding layer, a bidirectional gated recurrent unit, and a fully connected layer network structure. First, test cases are mapped to the input of the word embedding layer. The word embeddings of the test cases are then used as the input of the bidirectional gated recurrent unit to encode their dependencies. Finally, after passing through the fully connected layer, the probability distribution of the next system call is output.
[0088] The implementation methods of the remaining modules will not be elaborated here. The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0089] The system embodiments of the present invention can be applied to any device with data processing capabilities, such as a computer or other similar device. The system embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution.
[0090] The embodiments described above provide a detailed explanation of the technical solutions and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A context-aware, dependency-driven kernel fuzz test case mutation method, characterized in that, Includes the following steps: (1) Seed test case selection stage: Randomly select test cases from the corpus; (2) Mutation operation selection stage: The selection of mutation operations is periodically divided into two stages: exploration and utilization. When in the exploration stage, a mutation operation is randomly selected from multiple mutation operations and the performance of the selected mutation operation after execution is recorded. When entering the exploitation phase, the best mutation operation is selected from multiple mutation operations, and then the best mutation operation is used continuously. (3) Test case mutation process: The selected seed test cases are mutated according to the selected mutation operation. If the selected mutation operation is a context-aware dependency-guided mutation, the subsequences before and after the mutation point in the test case are used as context input to the language model. The language model outputs the best system call and inserts it into the mutation point. (4) Test case execution phase: The mutated test cases are executed in the kernel, and the execution results of the test cases are analyzed. If the test cases trigger new code paths, invalid system calls in the test cases are removed one by one in a dynamic manner, and the retained test cases are stored in the corpus. If it is in the exploration phase, the performance of the mutation operation corresponding to the test cases also needs to be recorded. (5) Periodically train the language model using the corpus; (6) The operating system kernel fuzzing tool repeats steps (2)-(5) until the fuzzing ends.
2. The context-aware dependency-guided kernel fuzz test case mutation method according to claim 1, characterized in that, Step (2) specifically refers to: In the mutation operation selection phase, two stages are divided: exploration and exploitation. The two stages are assigned different time budgets and are switched alternately. When in the exploration phase, the fuzzing tool assigns different mutation operations the same probability, randomly selects one mutation operation, and records the performance of the mutation operation during the test case execution phase. When entering the utilization phase, the best mutation operation is selected based on the performance of different mutation operations recorded in the exploration phase.
3. The context-aware dependency-guided kernel fuzz test case mutation method according to claim 1, characterized in that, Step (3) includes: (3-1) Determine the type of mutation operation. If the mutation operation is a context-aware dependency-guided mutation, for a given seed test case, randomly select a position from the test cases as the mutation point, and use the subsequence before the mutation point and the subsequence after the mutation point as the mutation context, and input them into the language model respectively. (3-2) For the two probability distributions given by the language model, select the system calls with the highest probabilities as temporary mutation candidates, and then merge the two groups of temporary mutation candidates and normalize them to obtain the final mutation candidates and their probability distributions. (3-3) Randomly select a system call as the target from the final mutation candidates according to the probability distribution, supplement the parameters according to the context and insert it into the mutation point to complete the seed test case mutation.
4. The context-aware dependency-guided kernel fuzz test case mutation method according to claim 1, characterized in that, Step (4) includes: (4-1) Execute the mutated test cases in the kernel, analyze the execution of the test cases, and if the test cases trigger new code paths in the kernel, exclude irrelevant system calls by removing system calls one by one and re-executing them to obtain the minimized test cases; (4-2) If it is in the exploration phase, record that the mutation operation corresponding to the test case triggered a new code path; (4-3) Save the minimized test cases to the corpus as the training set for the language model.
5. The context-aware dependency-guided kernel fuzz test case mutation method according to claim 1, characterized in that, Step (5) includes: (5-1) In the initial stage, analyze the available system call functions and establish the corresponding system function mapping dictionary; (5-2) The language model adopts a deep neural network, which includes a word embedding layer, a bidirectional gated recurrent unit, and a fully connected layer network structure. First, the test cases are mapped to the input of the word embedding layer. The word embeddings of the test cases are used as the input of the bidirectional gated recurrent unit to encode their dependencies. Finally, after passing through the fully connected layer, the probability distribution of the next system call is output. (5-3) The language model is periodically trained on the corpus to learn the context-aware dependencies between system calls and the dependencies are continuously updated according to the progress of fuzz testing.
6. A context-aware, boot-dependent kernel fuzzing system, characterized in that, include: The mutation operation scheduling module is used to periodically divide mutation operations into two phases: exploration and exploitation. During the exploration phase, a mutation operation is randomly selected from multiple mutation operations, and the performance of the selected mutation operation after execution is recorded. When entering the exploitation phase, the best mutation operation is selected from multiple mutation operations, and then the best mutation operation is used continuously. The test case mutation module is used to mutate selected seed test cases according to the selected mutation operation. If the selected mutation operation is a context-aware dependency-guided mutation, the subsequences before and after the mutation point in the test case are used as context input to the language model, and the language model outputs the best system call and inserts it into the mutation point. The fuzzing execution module inputs the mutated test cases into the kernel and monitors kernel code coverage. The data collection module determines whether test cases need to be minimized based on code coverage. If new code coverage is triggered, it minimizes the test cases to obtain a set of related system call sequences and saves them to the corpus. The language model training module is used to periodically perform the language model training process based on the corpus, learn the dependencies between system calls, and apply them to seed mutation.
7. A context-aware, boot-dependent kernel fuzzing system according to claim 6, characterized in that, The mutation operation scheduling module includes: The phase division module is used to divide the mutation operation selection process into two phases: exploration and exploitation. The two phases are assigned different time budgets and are switched alternately. The exploration phase execution module is used to assign equal probability to different mutation operations by the fuzzing tool during the exploration phase, randomly select a mutation operation, and record its performance after the mutation operation is executed. The phase execution module is used to select the best mutation operation based on the performance of different mutation operations recorded in the exploration phase.
8. A context-aware, boot-dependent kernel fuzzing system according to claim 6, characterized in that, The test case mutation module includes: The mutation operation type determination module is used to determine the type of mutation operation. If the mutation operation is a context-aware dependency-guided mutation, for a given seed test case, a position is randomly selected from the test cases as the mutation point, and the subsequence before the mutation point and the subsequence after the mutation point are used as the mutation context and input into the language model respectively; otherwise, the mutation operation is directly executed at the mutation point. The language model module is used to output two probability distributions based on the input context sequence, select the system calls with the highest probabilities as temporary mutation candidates, and then merge the two sets of temporary mutation candidates and perform normalization to obtain the final mutation candidates and their probability distributions. The mutation insertion module is used to randomly select a system call as the target from the final mutation candidates according to a probability distribution, supplement the parameters according to the context, and insert it into the mutation point to complete the mutation of the seed test case.
9. A context-aware, boot-dependent kernel fuzzing system according to claim 6, characterized in that, The language model training module includes: The mapping dictionary module is used to analyze the available system call functions in the initial stage and build the corresponding system function mapping dictionary; The periodic training module is used to periodically train the language model on the corpus, learn context-aware dependencies between system calls, and continuously update the dependencies based on the progress of fuzz testing.
10. A context-aware, boot-dependent kernel fuzzing system according to claim 6, characterized in that, The language model employs a deep neural network, comprising a word embedding layer, a bidirectional gated recurrent unit, and a fully connected layer network structure. First, test cases are mapped to the input of the word embedding layer. The word embeddings of the test cases are then used as the input of the bidirectional gated recurrent unit to encode their dependencies. Finally, after passing through the fully connected layer, the probability distribution of the next system call is output.