Directed fuzzy testing method and system based on dynamic branch selection

Abstract

The present invention discloses a directional fuzz testing method and system based on dynamic branch selection. The method first uses a directional fuzz testing tool to obtain the target point of the program under test, and generates an executable file to obtain the execution path and input offset sequence. Secondly, the missing branch pool is updated based on the obtained seed execution path, and the branch attributes are calculated for the newly added missing branches in the updating process. Then, based on the branch attributes, the weight corresponding to each branch is obtained, and the number of branches with different branch characteristic marks in the candidate branch set is calculated by the weight. Finally, based on the candidate branch set, a fuzzy mutation method of an open source tool is used to perform fuzzy mutation according to a structure instance. The system includes a static analysis module, an information extraction module, a branch scheduling module and a fuzzy mutation module. The present invention improves the overall efficiency of directional fuzzy testing, explores more paths in the program under test, and can discover more program vulnerabilities.

Description

Technical Field

[0001] The present invention belongs to the field of automated software testing, and in particular relates to a directional fuzzy testing method and system based on dynamic branch selection. Background Art

[0002] Fuzz testing is a general software testing method that can automatically or semi-automatically generate input cases and send them to the program under test for execution, and discover possible defects or vulnerabilities in the program by observing the running status and output results of the program under test. Traditional fuzz testing methods are based on coverage guidance. By inserting stubs in each basic block of the program under test, it can provide runtime feedback information such as code coverage during execution, and use the feedback information to guide the generation process of input cases.

[0003] The directed fuzz testing method adds a target point orientation based on the coverage indicator. Before the fuzz testing process starts, the code lines or operation sequences where vulnerabilities may occur in the program under test are marked as target points, and a corresponding seed fitness calculation scheme is designed to drive the seeds to gradually approach the target points in the fuzz testing process to trigger the vulnerabilities.

[0004] The directional fuzz testing tool AFLGo marks the code lines that may trigger vulnerabilities in the tested program as target points during the program compilation phase, calculates the distance between each basic block in the program and the target point through static analysis, and calculates the final distance between the seed and the target point through the distance information during the fuzz testing process for priority calculation and energy allocation; the directional fuzz testing tool ParmeSan uses Address Sanitizer to locate memory-related errors and automatically extracts the target points in the tested program through difference comparison. CN114417348B proposes a multi-target directional fuzz testing method, which allocates seed energy through the multi-dimensional characteristics of seeds and simulated annealing algorithm; CN114756471A proposes a vulnerability type-oriented fuzz testing method based on byte-sensitive energy allocation, which counts the feature information of different types of vulnerabilities at runtime to calculate the mutation weights of different input bytes; CN115269412A proposes a directional fuzz testing method based on target front-end area search, which performs global seed selection and energy scheduling based on the runtime information of the basic block preceding the target point in the tested program.

[0005] Existing directed fuzz testing methods generally suffer from precision loss when utilizing the guidance information provided by the target point. Information calculation and strategy design are performed at the seed level, and the fine-grained guidance information at the basic block level is converted to coarse-grained information to calculate the priority of the seed, which is used to screen out high-quality seeds in the seed pool and allocate energy. The process of converting guidance information from the basic block level to the seed level will inevitably lose precision, making it impossible to effectively guide the fuzz testing process, affecting the overall testing efficiency. Summary of the invention

[0006] In view of the above problems, the present invention proposes a directional fuzzy testing method and system based on dynamic branch selection.

[0007] The directional fuzz testing method based on dynamic branch selection mainly includes four stages: static analysis stage, information extraction stage, branch scheduling stage and fuzzy mutation stage. First, the fuzz testing system statically analyzes the program under test, marks the code lines that may trigger vulnerabilities as target points, and compiles and inserts the program under test; secondly, the fuzz testing system updates the missing branch pool based on the execution path of the seed during the fuzz testing process, and calculates the depth, vulnerability distance, heat coefficient and other properties of the newly added branches; then, the fuzz testing system determines whether the branch has characteristics such as deep depth, close vulnerability, and high heat according to the size of different branch attribute values ​​and marks them. According to the number of seeds and vulnerabilities found during the test process with different branch characteristics, the feature weight is adjusted in real time and dynamic branch scheduling is performed to obtain the pre-selected branch set that needs to be explored at present; finally, the fuzz testing system performs fuzz testing on the missing branches in the pre-selected branch set and records the newly discovered seeds.

[0008] The missed branches are taken as the overall scheduling object of fuzz testing to maintain precise guidance information between basic blocks and target points at the basic block level. At the same time, multiple test-related branch attributes are designed. Dynamic branch scheduling is performed according to the real-time validity of different branch attributes before the start of each round of fuzz testing iteration to further improve the efficiency of vulnerability mining.

[0009] The directed fuzz testing method based on dynamic branch selection specifically includes the following steps:

[0010] 1. Static analysis stage

[0011] Use the directed fuzz testing tool to obtain the target points of the program under test, compile and instrument the program, and generate an executable file. It includes the following:

[0012] 1.1 Target point acquisition

[0013] The memory error detection tool AddressSanitizer (ASAN) is used to compile the program under test, and the target point is located based on the error detection mark added by ASAN in the program under test and the location information of the target point is saved.

[0014] 1.2 Program compilation and instrumentation

[0015] Directly compile the program under test to generate a bytecode file. At the same time, perform stub compilation on the program under test, use a random hash value as an independent identifier for each basic block in the program, and insert the code that provides the identification information as a stub into the basic block of the program to generate an executable file for the program under test.

[0016] 1.3 Dynamic Execution Analysis

[0017] The program under test is compiled using the data flow analysis tool DataFlowSanitizer. The generated executable file can output the execution path of the seed and runtime data such as the input offset sequence of adjacent branches in the path during the seed execution process.

[0018] 2 Information extraction stage

[0019] Maintain the missed branch pool to save the missed branches found in the test, use the bytecode file to generate the control flow graph CFG of the program under test, and use the target point location information to mark the target point in the CFG.

[0020] During the fuzz testing process, all the seeds found are dynamically analyzed, and the missing branch pool is updated based on the obtained seed execution path.

[0021] For the newly added missed branches during the update process, calculate and record the branch's depth, vulnerability distance, heat coefficient and other attributes. Specifically include the following:

[0022] 2.1 Missing branch pool update

[0023] The adjacent uncovered branches in the seed execution path are regarded as missed branches, and the missed branches are used as the overall scheduling object of the fuzz test. At the beginning of the fuzz test, the initial input case provided by the user in the seed pool is dynamically analyzed, and the obtained missed branches are saved as initial data in the missed branch pool BranchPool: {missBranch1,…,missBranch z ,…,missBranch q}, z = 1, 2, …, q, q is the total number of missing branches in the missing branch pool.

[0024] The branch missBranch z = <BasicBlock a→BasicBlock b >, representing the basic block BasicBlock of the program under test a Meet missBranch z After the constraints are met, jump to BasicBlock b , and maintains a structure instance for each missing branch, which stores information such as the branch's identification, original seed, input offset sequence, branch attributes, and branch feature tags.

[0025] 2.1.1 Pruning missed branches

[0026] The missed branches that have been covered in the missed branch pool are deleted based on the seed execution path.

[0027] During the fuzz testing process, each time a seed Seed is found, it means that the fuzz testing system covers a new program branch in the program under test. The Seed is dynamically executed and analyzed to obtain the execution path of the Seed BasicBlocks: {BasicBlock1,…,BasicBlock x ,…,BasicBlock w}, x = 1..w, w is the number of basic blocks covered during the execution of Seed, and traverses all branches consisting of two consecutive basic blocks in BasicBlocks. x = <BasicBlock x →BasicBlock x+1 >, if Branch x If it exists in the BranchPool, it will be deleted, indicating that the missing branch has been covered.

[0028] 2.1.2 Add missing branches

[0029] Dynamic execution analysis collects uncovered program branches in the Seed execution path and saves them into the missed branch pool BranchPool.

[0030] Given a branch x = <BasicBlock a →BasicBlock b >, BasicBlock a Treat as Branch x During dynamic execution analysis, any basic block in BasicBlocks is used as the predecessor of BasicBlock. c The uncovered branch of the predecessor x = <BasicBlock c →BasicBlockk >Is regarded as a missed branch and saved to the missed branch pool.

[0031] Meanwhile, use the data flow analysis tool DataFlowSanitizer to parse the data flow during program execution, and collect the input offset sequence offs = {[x1, y1]…[x z , y v , y v …[x u , y u}, v = 1..u, where u is the number of offset segments, 0 ≤ x v ≤ y v < Len, and Len is the length of the program input Seed. Each segment [x v , y v means that the consecutive bytes from offset x v to y v in Seed are passed to the branch missBranch z . Regard Seed as the original seed for discovering missBranch z , and save the original seed Seed and the input offset sequence offs to the structure instance of missBranch z .

[0032] 2.2 Branch Attribute Calculation

[0033] For the new missed branch missBranch z = <BasicBlock a →BasicBlock a >, calculate the relevant branch attributes of missBranch z , including branch depth, constraint length, number of conditions, vulnerability distance, heat coefficient, and cooling coefficient. The calculation process is as follows:

[0034] 2.2.1 Branch Depth Calculation

[0035] BasicBlock m is the basic block where the entry of the main function of the program under test is located. The branch depth calculation of missBranch z is: the shortest path distance on the CFG graph from BasicBlock m to the predecessor basic block BasicBlock z of missBranch a , which is calculated on the CFG using the Dijkstra algorithm.

[0036] 2.2.2 Calculation of constraint length and condition quantity

[0037] For missBranch z The input offset sequence offs = {[x1,y1]…[x v ,y v ]…[x u ,y u ]}, u=1..m, indicating that there are u groups of continuous data in the program input passed to missBranch z It affects the value of the branch constraint, representing missBranch z It is composed of more than u check conditions connected by conditional connectors, where the offset of the vth group of continuous data is x v to y v .

[0038] Set m as missBranch z The number of conditions, missBranch z The constraint length cLen is calculated using the following formula:

[0039]

[0040] 2.2.3 Vulnerability distance calculation

[0041] At the beginning of the fuzz testing process, vulnerability distance backpropagation is performed based on the target point nodes marked on the CFG, and the vulnerability distances of all nodes in the CFG are calculated through breadth-first search and saved in the nodes.

[0042] Collect the missing branch missBranch during the fuzz testing process z When z The successor basic node BasicBlock b The vulnerability distance saved on the z The vulnerability distance.

[0043] 2.2.4 Heat coefficient calculation

[0044] Seed: The number of seeds found in the fuzzy mutation process, SeedCount, is initially 0.

[0045] When the input case generated by the Seed mutation can trigger a new branch in the program, the input case is saved in the seed pool and the SeedCount increases by 1.

[0046] When missing branch missBranch z When the original seed is Seed, missBranchz The heat coefficient of Seed is expressed as the number of seeds found by Seed, SeedCount.

[0047] 2.2.5 Cooling coefficient calculation

[0048] The cooling coefficient of the seed Seed is CDCount, the initial value is 0.

[0049] If Seed does not find any seeds or vulnerabilities in a round of fuzzy mutation, the value of CDCount is increased by 1, otherwise CDCount is cleared to 0.

[0050] When missing branch missBranch z When the original seed is Seed, missBranch z The cooling coefficient is expressed as the cooling coefficient CDCount of Seed.

[0051] 3 Branch Scheduling Phase

[0052] Based on the branch attributes obtained in the information extraction stage, the branches in the missing branch pool are marked as having different branch characteristics, and the number of seeds and vulnerabilities found by each branch characteristic during the test is recorded as its benefit, and then the weight corresponding to each branch is obtained. The higher the benefit of the branch characteristic, the larger the weight value. In the next round of iteration, more branches with this characteristic will be assigned for fuzz testing. The number of branches marked with different branch characteristics in the candidate branch set is calculated by the weight.

[0053] The weights of different branch characteristics are iteratively updated based on the particle swarm optimization algorithm. Specifically, it includes the following contents:

[0054] 3.1 Branch Feature Tags

[0055] After calculating the branch depth, constraint length, number of conditions, vulnerability distance, heat coefficient and cooling coefficient of different missed branches, the minimum value minV[t] and maximum value maxV[t] of these attribute values, t = 1..6, and the threshold of branch feature marking is calculated by the following formula:

[0056] minThreshold[t]=minV[t]+α×(maxV[t]-minV[t])

[0057] maxThreshold[t]=minV[t]+(1-α)×(maxV[t]-minV[t])

[0058] Where minThreshold[t] is the lower threshold of the t-th branch attribute, maxThreshold[t] is the upper threshold of the t-th branch attribute, and α is the threshold adjustment parameter. The upper and lower thresholds of the branch attribute are used to mark the missed branches as having different branch characteristics.

[0059] 3.2 Weight Information Calculation

[0060] By recording the paths and number of vulnerabilities found in different feature branches, the real-time effectiveness of branch features in the fuzz testing process is evaluated, and the weights of the nine branch features in the system are adjusted accordingly.

[0061] pw[i][j], i=1..9, j≥0, represents the pre-selected weight value of the i-th branch feature Pr[i] in the j-th iteration, with an initial value of 20.

[0062] f global [i], i = 1..9, the initial value is 0, when the missing branch with the i-th branch characteristic Pr[i] finds a new seed in the fuzzy mutation process, fS global [i] Increase.

[0063] f round [i], i = 1..9, the initial value is 0. When the missing branch with the i-th branch feature Pr[i] finds a new vulnerability in the fuzzy mutation process, fC round [i] Increase.

[0064] The candidate branch set selectedBranches has a size of N=50, and uses nbr[i], i=1..9 to record how many branches in selectedBranches are marked with Pr[i]. The initial value of nbr[i] is 5.

[0065] The pre-selected weight pw[i][j] of the i-th branch feature Pr[i] is regarded as the i-th particle in the particle swarm optimization algorithm, and the swarm optimal solution P of the i-th particle is global [i] Calculated using the following formula:

[0066]

[0067] where fS total is the number of seeds in the seed pool.

[0068] Maintain the individual optimal solution P of the i-th particle local [i], i = 1..9, the initial value is 20, and the fitness value P corresponding to the individual optimal solution fit[i], i = 1..9, the initial value is 0. When the jth round of fuzzy test iteration is completed, the fitness value of Pr[i] is calculated by the following fitness function formula f(i):

[0069]

[0070] Where α and β are the weights of the number of seeds and the number of vulnerabilities in the fitness function calculation. fit [i], P local [i] is updated to the pre-selected weight pw[i][j] of the j-th branch feature Pr[i] in the k-th iteration, and P is updated fit [i] is f(i).

[0071] Calculate the optimal solution P of the group global [i] and the individual optimal solution P local [i], the pre-selected weight value pw[i][j] of each branch feature is updated by the following formula:

[0072] vw[i][j]=r×vw[i][j-1]+s×P local [i]+o×P global [i]

[0073] pw[i][j]=pw[i][j-1]+vw[i][j]

[0074] Where vw[i][j] represents the weight update amount of Pr[i] in the jth iteration, i=1..9, j≥0, the initial value of vw[i][j] is 0, and r, s, and o are the update weights of the relevant variables.

[0075] 3.3 Dynamic Branch Scheduling

[0076] After completing a round of fuzz testing iterations, the pre-selection weights pw[i][j] of all branch features are updated. In the next round of fuzz testing iterations, based on the updated pw[i][j], the number nbr[i] of branches with different branch feature tags in the candidate branch set selectedBranches is calculated using the following formula:

[0077]

[0078] Among them, N represents the size of the candidate branch set selectedBranches. Branches corresponding to the number nbr[i] are selected from the omitted branch pool and saved in selectedBranches. In this round of fuzzy testing iterations, fuzzy mutation is performed on the branches in seletcedBranches.

[0079] 4 Fuzzy mutation stage

[0080] Traverse each missing branch missBranch in selectedBranches z , from missBranch z Get the original seed Seed and input offset sequence offs from the structure instance, and use the fuzzy mutation method of the ParmeSan open source tool to perform fuzzy mutation on the byte sequence with offset offs in Seed.

[0081] Execute all input test cases generated during the fuzzy mutation process, determine whether they can cover new program branches in the program under test, and extract information from the seeds that can cover the new branches.

[0082] Another object of the present invention is to provide a directed fuzzy testing system based on dynamic branch selection, comprising a static analysis module, an information extraction module, a branch scheduling module and a fuzzy mutation module.

[0083] Static analysis module: Through the compilation tool, obtain the overall control flow graph of the program under test, the target point set file Targets.json and the executable file file.track.

[0084] Information extraction module: It executes the new seed information through the executable file file.track, performs dynamic execution analysis, updates the missing branch pool, and calculates the relevant branch properties of the newly added missing branches based on the overall control flow graph of the tested program and the target point set file Targets.json.

[0085] Branch scheduling module: Based on the branch attribute distribution of the overall missed branches, all missed branches are marked with branch characteristics, and the pre-selected weights of branch characteristics are adjusted according to the particle swarm algorithm. A specific number of missed branches are selected from the missed branch pool and added to the candidate branch set.

[0086] Fuzzy mutation module: Perform fuzzy mutation on the missing branches in the candidate branch set according to the executable file file.track, reduce the search space of the random mutation strategy, and extract information from the new seeds that can cover the new program branches.

[0087] The main advantages of the present invention are:

[0088] 1. The present invention adopts a directed fuzz testing method based on dynamic branch selection, takes the missing branches as the overall scheduling object of the fuzz test, maintains the precise guidance information provided by the target point in the compilation phase at the basic block level and makes effective use of it, thereby improving the testing efficiency.

[0089] 2. The present invention utilizes a particle swarm optimization algorithm to perform dynamic branch scheduling, extracts multiple test-related branch characteristics for missed branches, and adaptively adjusts the test weights of branch characteristics according to the real-time test benefits of different branch characteristics during the fuzzy testing process, and performs branch scheduling based on the weight, thereby improving the overall efficiency of directed fuzz testing.

[0090] 3. By using the present invention, the efficiency of vulnerability mining can be significantly improved. Under the same test environment, compared with the existing directional fuzzy testing system, more paths in the tested program can be explored and more program vulnerabilities can be discovered. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] Figure 1 The overall system flow of the directional fuzzy testing method based on dynamic branch selection of the present invention;

[0092] Figure 2 It is the static analysis process of the directional fuzzy testing method based on dynamic branch selection of the present invention;

[0093] Figure 3 This is a branch example of the directional fuzzy testing method based on dynamic branch selection of the present invention;

[0094] Figure 4 It is the fuzzy variation process of the directional fuzzy testing method based on dynamic branch selection of the present invention;

[0095] Figure 5 This is the system architecture of the directed fuzzy testing method based on dynamic branch selection of the present invention. DETAILED DESCRIPTION

[0096] The technical solutions of the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings of the present invention.

[0097] like Figure 1 As shown, the directed fuzzy testing method based on dynamic branch selection mainly includes four stages: static analysis stage, information extraction stage, branch scheduling stage and fuzzy mutation stage.

[0098] 1 Static Analysis Phase

[0099] 1.1 Target point acquisition

[0100] Static analysis process Figure 2 As shown, the gclang / gclang++ compiler tool in the gllvm code library is used to compile the program under test to generate a binary executable file, and get-bc is used to disassemble the binary executable file to generate a bytecode file file.bc.

[0101] Under the default parameter settings, file.bc is directly compiled into file.normal, and after adding the AddressSanitizer error detection parameter "-fsanitize=address", file.bc is compiled into file.asan. By performing a difference analysis on the two files file.normal and file.asan, the target point location information Targets.json that may trigger memory defects in the tested program is obtained.

[0102] 1.2 Program compilation and instrumentation

[0103] Compile file.bc with the "-emit-llvm" parameter to generate the LLVM IR file file.ll of the program under test, and use the LLVM component to extract the complete control flow graph of the program under test from file.ll. Compile file.bc with angora-clang / angora-clang++ to perform stubs, use random hash values ​​as independent identifiers for each basic block in the program, and insert the code that provides the identification information as a stub into the basic block of the program to generate an executable file of the program under test.

[0104] 1.3 Dynamic Execution Analysis

[0105] Use DataFlowSanitizer to compile file.bc and generate an executable file file.track, which is used for dynamic execution analysis during the fuzz testing process. It can provide the fuzz testing system with runtime information such as the seed execution path and input offset sequence.

[0106] 2 Information extraction stage

[0107] 2.1 Pruning missed branches

[0108] The missed branches that have been covered in the missed branch pool are deleted based on the seed execution path.

[0109] During the fuzz testing process, each time a seed Seed is found, it means that the fuzz testing system covers a new program branch in the program under test. The Seed is dynamically executed and analyzed to obtain the execution path of the Seed BasicBlocks: {BasicBlock1,…,BasicBlock x ,…,BasicBlick w}, x = 1..w, w is the number of basic blocks covered during the execution of Seed, and traverses all branches consisting of two consecutive basic blocks in BasicBlocks. x = <BasicBlock x →BasicBlock x+1>, if Branch x exists in BranchPool, delete it, indicating that the missing branch has been covered.

[0110] 2.2 New Missing Branches

[0111] Given a branch Branch x = <BasicBlock a →BasicBlock b >, consider BasicBlock a as the predecessor of Branch x . During the dynamic execution analysis, an uncovered branch Branch c with BasicBlock x = <BasicBlock c →BasicBlock k > as its predecessor is considered a missing branch and saved to the missing branch pool.

[0112] Meanwhile, use the data flow analysis tool DataFlowSanitizer to parse the data flow during program execution, collect the input offset sequence offs = {[x1, y1]…[x z , y v , y v …[x m , y m}, v = 1..m, where m is the number of offset segments, 0 ≤ x v ≤ y v < Len, and Len is the length of the program input Seed. Each segment [x v , y v indicates that the consecutive bytes from offset x v to y v in Seed are passed to the branch missBranch z . Consider Seed as the original seed for discovering missBranch z , and save the original seed Seed and the input offset sequence offs to the structure instance of missBranch z . For example, Figure 3 the input offset sequence offs = {[0], [3]} of branch β in indicates that the bytes at offsets 0 and 3 in the program input affect the condition value of this branch. Finally, save the seed Seed as the original seed of branch β together with the input offset sequence to the structure instance of branch β for further fuzz testing.

[0113] The pseudo code of the update process of the missing branch pool is as follows:

[0114]

[0115]

[0116] 2.3 Branch attribute calculation

[0117] For the new missing branch missBranch z = <BasicBlock a →BasicBlock b >, calculate missBranch z The relevant branch properties include branch depth, constraint length, number of conditions, vulnerability distance, heat coefficient and cooling coefficient. The calculation process is as follows:

[0118] 2.3.1 Branch Depth Calculation

[0119] BasicBlock m The basic block where the main function entry of the program under test is located, missBranch z The branch depth of BasicBlock is calculated as: m To missBranch z Predecessor BasicBlock a The shortest path distance on the CFG graph is calculated using the Dijkstra algorithm on the CFG.

[0120] 2.3.2 Calculation of constraint length and condition quantity

[0121] For missBranch z The input offset sequence offs = {[x1,y1]…[x v ,y v ]…[x u ,y u ]}, u=1..m, indicating that there are u groups of continuous data in the program input passed to missBranch z It affects the value of the branch constraint, representing missBranch z It consists of more than u check conditions connected by conditional connectors, where the offset of the vth group of continuous data is x v to y v .

[0122] Set m as missBranch z The number of conditions, missBranch zThe constraint length cLen is calculated using the following formula:

[0123]

[0124] 2.3.3 Vulnerability distance calculation

[0125] At the beginning of the fuzz testing process, vulnerability distance backpropagation is performed based on the target point nodes marked on the CFG, and the vulnerability distances of all nodes in the CFG are calculated through breadth-first search and saved in the nodes.

[0126] Collect the missing branch missBranch during the fuzz testing process z When z The successor basic node BasicBlock b The vulnerability distance saved on the z The vulnerability distance.

[0127] 2.3.4 Heat coefficient calculation

[0128] Seed: The number of seeds found in the fuzzy mutation process, SeedCount, initially 0;

[0129] When the input case generated by the Seed mutation can trigger a new branch in the program, the input case is saved in the seed pool and the SeedCount increases.

[0130] When missing branch missBranch z When the original seed is Seed, missBranch z The heat coefficient of Seed is expressed as the number of seeds found by Seed, SeedCount.

[0131] 2.3.5 Cooling coefficient calculation

[0132] The cooling coefficient of the seed Seed is CDCount, the initial value is 0.

[0133] If Seed does not find any seeds or vulnerabilities in a round of fuzzy mutation, the value of CDCount is increased by 1, otherwise CDCount is cleared to 0.

[0134] When missing branch missBranch z When the original seed is Seed, missBranch z The cooling coefficient is expressed as the cooling coefficient CDCount of Seed.

[0135] 3 Branch Scheduling Phase

[0136] 3.1 Branch Feature Tags

[0137] After calculating the branch depth, constraint length, number of conditions, vulnerability distance, heat coefficient and cooling coefficient of different missed branches, the minimum value minV[t] and maximum value maxV[t] of these attribute values, t = 1..6, and the threshold of branch feature marking is calculated by the following formula:

[0138] minThreshold[t]=minV[t]+α×(maxV[t]-minV[t])

[0139] maxThreshold[t]=minV[t]+(1-α)×(maxV[t]-minV[t])

[0140] Where minThreshold[t] is the lower threshold of the t-th branch attribute, maxThreshold[t] is the upper threshold of the t-th branch attribute, α is the threshold adjustment parameter, and α=0.2 is usually taken based on empirical values. The missing branches are marked as having different branch characteristics in the manner described in Table 1:

[0141] Table 1 Branch characteristics

[0142] Branch characteristic Pr[i] Correspondence between branch characteristics and attribute thresholds Depth Pr[1] The branch depth value is greater than the upper depth threshold maxThreshold[1] Shallow depth Pr[2] The branch depth value is less than the depth lower threshold minThreshold[1] Constraint length Pr[3] The constraint length value is greater than the constraint length upper threshold maxThreshold[2] Constrained short Pr[4] The constraint length value is less than the constraint length lower threshold minThreshold[2] Conditional Multi-Pr[5] The condition quantity value is greater than the condition quantity upper threshold maxThreshold[3] Conditions less Pr[6] The condition quantity value is less than the condition quantity lower threshold minThreshold[3] Vulnerability close to Pr[7] The vulnerability distance value is less than the vulnerability distance lower threshold minThreshold[4] High heat Pr[8] The heat coefficient value is greater than the heat coefficient upper threshold maxThreshold[5] Cooling low Pr[9] The cooling coefficient value is less than the cooling coefficient lower threshold minThreshold[6]

[0143] 3.2 Weight Information Calculation

[0144] By recording the paths and number of vulnerabilities found in different feature branches, the real-time effectiveness of branch features in the fuzz testing process is evaluated, and the weights of the nine branch features in the system are adjusted accordingly.

[0145] pw[i][j], i=1..9, j≥0, represents the pre-selected weight value of the i-th branch feature Pr[i] in the j-th iteration, with an initial value of 20.

[0146] f global [i], i = 1..9, the initial value is 0, when the missing branch with the i-th branch characteristic Pr[i] finds a new seed in the fuzzy mutation process, fS global [i] Increase.

[0147] f round [i], i = 1..9, the initial value is 0. When the missing branch with the i-th branch feature Pr[i] finds a new vulnerability in the fuzzy mutation process, fC round [i] Increase.

[0148] The candidate branch set selectedBranches has a size of N=50, and uses nbr[i], i=1..9 to record how many branches in selectedBranches are marked with Pr[i]. The initial value of nbr[i] is 5.

[0149] The pre-selected weight pw[i][j] of the i-th branch feature Pr[i] is regarded as the i-th particle in the particle swarm optimization algorithm, and the swarm optimal solution P of the i-th particle is global [i] Calculated using the following formula:

[0150]

[0151] where fS total is the number of seeds in the seed pool. Maintain the individual optimal solution P of the i-th particle local [i], i = 1...9, the initial value is 20, and the fitness value P corresponding to the individual optimal solution fit [i], i = 1...9, the initial value is 0. When the jth round of fuzzy test iteration is completed, the fitness value of Pr[i] is calculated by the following fitness function formula f(i):

[0152]

[0153] Where α and β are the weights of the number of seeds and the number of vulnerabilities in the fitness function calculation. According to experience, α=1 and β=15 are usually taken. fit [i], P local [i] is updated to the pre-selected weight pw[i][j] of the j-th branch feature pr[i] in the k-th iteration, and P is updated fit [i] is f(i).

[0154] Calculate the optimal solution P of the group global [i] and the individual optimal solution P local [i], the pre-selected weight value pw[i][j] of each branch feature is updated by the following formula:

[0155] vw[i][j]=r×vw[i][j-1]+s×P local [i]+o×P global [i]

[0156] pw[i][j]=pw[i][j-1]+vw[i][j]

[0157] vw[i][j] represents the weight update amount of Pr[i] in the jth iteration, i=1..9, j≥0, the initial value of vw[i][j] is 0, r, s, o are the update weights of the relevant variables, usually r=0.9, s=0.1, o=0.05.

[0158] 3.3 Dynamic Branch Scheduling

[0159] After completing a round of fuzz testing iterations, the pre-selection weights pw[i][j] of all branch features are updated. In the next round of fuzz testing iterations, based on the updated pw[i][j], the number nbr[i] of branches with different branch feature tags in the candidate branch set selectedBranches is calculated using the following formula:

[0160]

[0161] Among them, N represents the size of the candidate branch set selectedBranches. Branches corresponding to the number of nbe[i] are selected from the omitted branch pool and saved in selectedBranches. In this round of fuzzy testing iteration, fuzzy mutation is performed on the branches in selectedBranches.

[0162] 4 Fuzzy mutation stage

[0163] 4.1 Fuzzy mutation

[0164] Traverse each missing branch missBranch in selectedBranches z , from missBranch z Get the original seed Seed and input offset sequence offs from the structure instance, and use the fuzzy mutation method of the ParmeSan open source tool to fuzzily mutate the byte sequence with offset offs in Seed. Execute all input test cases generated during the fuzzy mutation process, and determine whether they can cover the new program branches in the program under test, and extract information from the seeds that can cover the new branches. The fuzzy mutation process is as follows: Figure 4 shown.

[0165] 4.2 Added coverage judgment

[0166] Use the input test case obtained by executing the mutation of the program under test to determine whether the input test case covers the new program branch in the program under test, and decide whether to save it as a seed in the seed pool for further mutation. If a new seed is found, extract information from the new seed.

[0167] In summary, the directed fuzz testing method based on dynamic branch selection proposed in the present invention adds a missed branch pool to the fuzz testing process, uses the missed branches to save the precise guidance information provided by the target point in the compilation phase, and designs multiple test-related branch characteristics. In the fuzz testing process, adaptive branch scheduling is performed based on the real-time effectiveness of different branch characteristics to improve the overall efficiency of directed fuzz testing.

[0168] In order to verify the effectiveness of the present invention, in the experiment, the experimental group used a method based on dynamic branch selection optimization (DyFuzz), and the control group used three open source fuzz testing tools: AFL, MOPT and AFLGo. The test set used five practical command line programs from Github. Each test lasted 12 hours. In order to reduce the impact of randomness in fuzz testing, all experiments were repeated three times and the results were averaged. The final experimental data are shown in Tables 2 and 3:

[0169] Table 2. Number of paths found

[0170]

[0171] Table 3. Number of vulnerabilities found

[0172]

[0173] As shown in the table, after using the method of the present invention, compared with the three open source fuzz testing tools AFL, MOPT and AFLGo, the two key indicators of path discovery and vulnerability discovery have been greatly improved. Therefore, the method of the present invention can effectively improve the efficiency of the directional fuzz testing system in detecting vulnerabilities.

[0174] Another object of the present invention is to provide a directional fuzzy testing system based on dynamic branch selection, such as Figure 5 As shown, it includes a static analysis module, an information extraction module, a branch scheduling module and a fuzzy mutation module.

[0175] Static analysis module: Use the gclang / gclang++ compiler tool in the gllvm code library to perform instrumentation compilation on C-class code, generate a binary executable file of the program under test, and disassemble the executable file through get-bc to generate a bytecode file file.bc. Use the "-emit-llvm" parameter to generate the LLVM IR intermediate code of file.bc, which is used to extract the overall control flow graph of the program under test; directly compile file.bc to generate file.normal, use the "-fsanitize=address" parameter to compile and generate file.asan with a memory error detection flag, and obtain the target point set file Targets.json by performing a difference analysis on file.normal and file.asan; use DataFlowSantizer to compile file.bc to generate an executable file file.track with dynamic execution analysis.

[0176] Information extraction module: The information of the new seed is executed through the executable file file.track, and the seed is dynamically analyzed. The missing branch pool is updated using the seed execution path obtained by the analysis. At the same time, the relevant branch properties of the newly added missing branches are calculated based on the program control flow graph maintained by the fuzz testing system and the target point set file Targets.json.

[0177] Branch scheduling module: Based on the branch attribute distribution of the overall missed branches, all missed branches are marked with branch characteristics, and the pre-selection weights of branch characteristics are adjusted according to the benefit information obtained from different branch characteristics in the test history. Finally, a specific number of missed branches are selected from the missed branch pool based on the pre-selection weights of different branch characteristics and added to the candidate branch set.

[0178] Fuzzy mutation module: Fuzzy mutation is performed on the missing branches in the candidate branch set according to the executable file file.track. The original seed and input offset sequence of each missing branch are obtained from the structure instance, and the mutation strategy is applied to the bits near the offset sequence in the original seed for fuzzy mutation, reducing the search space of the random mutation strategy. All input cases generated by the mutation of the program under test are used to extract information from the new seeds that can cover the new program branches.

[0179] The embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. All equivalent changes and modifications made within the scope of the invention application of the present invention belong to the scope of protection of the present invention.

[0180] The component combination features not described in detail in the specification belong to the content that is easily thought of by the known technology or easily determined and undisputed when implementing the present invention. The above scheme is only a description of the preferred implementation of the present application, but the protection scope of the present application is not limited to this. Any person familiar with the technology can easily implement it within the scope of the description of the present application without changing the changes or substitutions involved in the basic principles of the claims, which should be included in the protection scope of the present application, that is, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A directional fuzzy testing method based on dynamic branch selection, characterized in that: The steps include: S1. Use the directional fuzz testing tool to obtain the target point of the program under test, compile and insert the program and generate an executable file, and then obtain the execution path and input offset sequence; S2. Maintain a missing branch pool to save the missing branches found in the test, use the bytecode file to generate a control flow graph CFG of the program under test, and use the location information of the target point to mark the target point in the CFG; During the fuzz testing process, the discovered seeds are dynamically analyzed and the missing branch pool is updated based on the obtained seed execution path; Calculate and record the branch attributes for the newly added missing branches during the update process; Based on branch attributes, S3 marks the branches in the missing branch pool as having different branch characteristics, and records the number of seeds and vulnerabilities found during the test for each branch characteristic, thereby obtaining the weight corresponding to each branch. The number of branches marked with different branch characteristics in the candidate branch set selectedBranches is calculated based on the weight nbr[i]; S4 performs fuzzy mutation based on the candidate branch set selectedBranches and the fuzzy mutation method of the ParmeSan open source tool according to the structure instance.

2. According to the directional fuzzy testing method based on dynamic branch selection in claim 1, it is characterized in that the specific process of updating the missing branch pool in S2 is as follows: 2.1.1 The adjacent uncovered branches in the seed execution path are regarded as missed branches, and the missed branches are used as the overall scheduling object of the fuzz test; at the beginning of the fuzz test, the initial input case provided by the user in the seed pool is dynamically analyzed, and the obtained missed branches are saved as initial data in the missed branch pool BranchPool: {missBranch1, ..., missBranch z , ..., missBranch q }, z = 1, 2, ..., q, q is the total number of missed branches in the missed branch pool; The branch missBranch z = < BasicBlock a →BasicBlock b >, represents the basic block BasicBlock of the program under test a Meet missBranch z After the constraints are met, jump to BasicBlock b , and maintain a structure instance for each missing branch; The structure instance stores the identification, original seed, input offset sequence, branch attributes and branch characteristic tag information of the branch; 2.1.2 During the fuzz testing process, each time a seed Seed is found, it means that the fuzz testing system covers a new program branch in the program under test. The Seed is dynamically executed and analyzed to obtain the execution path BasicBlocks of the Seed: {BasicBlock1, ..., BasicBlock x , ..., BasicBlock w }, x = 1...w, w is the number of basic blocks covered during the execution of Seed, and traverses all branches consisting of two consecutive basic blocks in BasicBlocks. x = < BasicBlock x →BasicBlock x+1 >, if Branch x If it exists in the BranchPool, it will be deleted, indicating that the missing branch has been covered; 2.1.3 Dynamic execution analysis collects uncovered program branches in the Seed execution path and saves them into the missed branch pool BranchPool; Given a branch x = < BasicBlock a →BasicBlock b >, BasicBlock a Treat as Branch x Predecessor of; During dynamic execution analysis, any basic block BasicBlock in BasicBlocks c The uncovered branch of the predecessor x = < BasicBlock c →BasicBlock k > is considered as a missed branch and saved in the missed branch pool.

3. The directional fuzzy testing method based on dynamic branch selection according to claim 2 is characterized in that: In step 2.1.3, it also includes: using the data flow analysis tool DataFlowSanitizer to parse the data flow during program execution, collecting the data from Seed to the missing branch missBranch z And the input offset sequence offs={[x1,y1]...[x v ,y v ]...[x u ,y u ]}, v = 1...u, u is the number of offset fragments, 0 ≤ x v ≤y v <Len, Len is the length of the program input Seed, where each segment [x v ,y v ] indicates that the offset in Seed is x v to y v The consecutive bytes are passed to the branch missBranch z Middle; Seed is regarded as finding missBranch z The original seed, save the original seed Seed and input offset sequence offs to missBranch z In the structure instance of .

4. The directional fuzzy testing method based on dynamic branch selection according to claim 3 is characterized in that: The specific process of calculating branch attributes described in S2 is as follows: 2.2.1BasicBlock m The basic block where the main function entry of the program under test is located, missBranch z The branch depth of BasicBlock is calculated as: m To missBranch z Predecessor BasicBlock a The shortest path distance on the CFG graph is calculated using the Dijkstra algorithm on the CFG; 2.2.2 For missBranch z The input offset sequence offs = {[x1, y1] ... [x v ,y v ]...[x u ,y u ]}, u=1...m, indicating that there are u groups of continuous data in the program input passed to missBranch z It affects the value of the branch constraint, representing missBranch z It is composed of more than u conditional connectors connected by verification conditions, where the offset of the vth group of continuous data is x v to y v ; Set m as missBranch z The number of conditions, missBranch z The constraint length cLen is calculated using the following formula: 2.2.3 At the beginning of the fuzz testing process, the vulnerability distance is back-propagated based on the target point node marked on the CFG, and the vulnerability distance of all nodes in the CFG is calculated through breadth-first search and saved in the node; Collect the missing branch missBranch during the fuzz testing process z When z The successor basic node BasicBlock b The vulnerability distance saved on the z The vulnerability distance; 2.2.4 Seed: The number of seeds found in the fuzzy mutation process, SeedCount, initially 0; When the input case generated by the Seed mutation can trigger a new branch in the program, the input case is saved in the seed pool, and the SeedCount increases by 1; When missing branch missBranch z When the original seed is Seed, missBranch z The heat coefficient of is expressed as the number of seeds found by Seed, SeedCount; 2.2.5 Seed’s cooling coefficient CDCount, the initial value is 0; if Seed does not find a seed or vulnerability in a round of fuzzy mutation, the value of CDCount is increased by 1, otherwise CDCount is cleared to 0; When missing branch missBranch z When the original seed is Seed, missBranch z The cooling coefficient is expressed as the cooling coefficient CDCount of Seed.

5. The directional fuzzy testing method based on dynamic branch selection according to claim 4 is characterized in that: The specific process of S3 is as follows: 3.1 After calculating the six branch attributes of branch depth, constraint length, number of conditions, vulnerability distance, heat coefficient and cooling coefficient of different missed branches, the minimum value minV[t] and maximum value maxV[t] of these attribute values, t = 1..6, the threshold of branch feature marking is calculated by the following formula: minThreshold[t]=minV[t]+α×(maxV[t]-minV[t]) maxThreshold[t]=minV[t]+(1-α)×(maxV[t]-minV[t]) Where minThreshold[t] is the lower threshold of the t-th branch attribute, maxThreshold[t] is the upper threshold of the t-th branch attribute, and α is the threshold adjustment parameter. The upper and lower thresholds of the branch attribute are used to mark the missing branches as having different branch characteristics: 3.2 By recording the paths and number of vulnerabilities found by branches with different characteristics, the particle swarm algorithm calculates the group optimal solution P global [i] and the individual optimal solution P local [i], the pre-selected weight value pw[i][j] of each branch feature is updated by the following formula: vw[i][j]=r×vw[i][j-1]+s×Pl ocal [i]+o×P global [and] pw[i][j]=pw[i][j-1]+vw[i][j] Where vw[i][j] represents the weight update of the i-th branch feature Pr[i] in the j-th iteration, i = 1..9, j ≥ 0, r, s, o is the update weight of the relevant variables; 3.3 In the next round of fuzz testing iteration, based on the updated pw[i][j], the number nbr[i] of branches with different branch feature tags in the candidate branch set selectedBranches is calculated using the following formula: Among them, N represents the size of the candidate branch set selectedBranches. Branches corresponding to the number nbr[i] are selected from the omitted branch pool and saved in selectedBranches. In this round of fuzzy testing iterations, fuzzy mutation is performed on the branches in selectedBranches.

6. The directional fuzzy testing method based on dynamic branch selection according to claim 1 or 5, characterized in that: S4 also includes: executing all input test cases generated in the fuzzy mutation process, and judging whether they can cover new program branches in the tested program, and extracting information from seeds that cover the new branches.

7. A directional fuzzy testing system based on dynamic branch selection, used to implement any of the methods described in claims 1 to 6, characterized in that: It includes static analysis module, information extraction module, branch scheduling module and fuzzy mutation module; The static analysis module: obtains the control flow graph of the entire program under test, the target point set file Targets.json and the executable file file.track through the compilation tool; The information extraction module: executes the new seed information through the executable file file.track, performs dynamic execution analysis, updates the missing branch pool, and calculates the relevant branch attributes of the newly added missing branches according to the overall control flow graph of the tested program and the target point set file Targets.json; The branch scheduling module: based on the branch attribute distribution of the overall missed branches, marks all missed branches with branch characteristics, adjusts the pre-selected weights of branch characteristics according to the particle swarm algorithm, and selects missed branches from the missed branch pool to add to the candidate branch set; The fuzzy mutation module performs fuzzy mutation on the missing branches in the candidate branch set according to the executable file file.track, reduces the search space of the random mutation strategy, and extracts information from the new seeds that can cover the new program branches.

Images