A fuzzing method for multiple vulnerabilities

Abstract

The application discloses a kind of fuzzy testing methods for multiple vulnerabilities, comprising: S1, the target program of multiple vulnerabilities is oriented to be inserted into patch compilation;S2, after the core link of fuzzy testing is optimized by being queued based on seed group, the mutated seed is input to the target program that has been inserted into patch compilation and runs multi-objective fuzzy testing;S3, according to the state of target program and multi-objective fuzzy testing running result, corresponding processing is carried out;S4, after the end of multi-objective fuzzy testing, the abnormal seed collected is sorted and filtered, and the seed after filtering and deduplication is analyzed and positioned for potential vulnerability.The application can obtain additional vulnerability-related program behavior and state information;At the same time, multi-objective fuzzy testing can be carried out, so that the fuzzy testing tool can more efficiently carry out multi-objective fuzzy testing and find multiple potential vulnerabilities;Without affecting efficiency, the mining of multiple vulnerabilities has stronger pertinence.

Description

Technical Field

[0001] This invention relates to the technical field of network security vulnerability discovery, and in particular to a fuzzing method for multiple vulnerabilities. Background Technology

[0002] As cybersecurity gains increasing importance, people are increasingly aware of the significant security risks that vulnerabilities pose to computer software and systems. Attackers can exploit security vulnerabilities in software or systems to cause serious harm to computer systems and networks. Furthermore, according to authoritative statistics on the number of Linux kernel vulnerabilities over the past 20 years, the number of Linux kernel vulnerabilities has been on the rise overall in recent years. As the most commonly used system for servers, the security of Linux is crucial to the normal operation of tens of millions of servers.

[0003] While current fuzzing methods have achieved great success in finding software and system vulnerabilities, they often lack specificity. Although fuzzing requires significantly less computational resources and time compared to methods like symbolic execution, the cost is still substantial. Experiments often show that during gray-box fuzzing of a large open-source program, even with a single CPU thread fully loaded, it can still take tens of hours or even days to discover a single vulnerability, and we cannot be certain whether the discovered vulnerability is a known but unpatched one. If we need to find undiscovered vulnerabilities in a program and report them as new CVEs (Common Vulnerabilities & Exposures), it is very likely that the fuzzing process will take even longer, potentially days or even weeks.

[0004] Existing technology 1 provides an intelligent fuzzing method and system based on vulnerability learning. This scheme extracts features from each basic block in the control flow graph to obtain a feature vector for each basic block. In the vulnerability prediction module, the probability of each function in the binary program under test being vulnerable is predicted based on the control flow graph. In the vulnerability-guided fuzzing module, the binary program under test is tested, and the fitness score of a given input is calculated by combining the execution path of that input, the probability of a function being vulnerable in that path, and the execution result. Inputs with high fitness scores are used as seeds for genetic mutation to generate the next generation of inputs, and the binary program under test is tested iteratively until the test ends. This intelligent fuzzing system can more efficiently uncover vulnerabilities in binary programs. However, the seed fitness scoring proposed in this scheme only improves seed priority scheduling and does not improve or optimize other key aspects of fuzzing. This scheme has limitations.

[0005] Existing technology 2 proposes a guided gray-box fuzzing method and apparatus based on dominance point coverage. This scheme includes: initializing the system, which involves downloading the source code of the program under test and installing a compilation toolchain; instrumenting the source code of the program under test using the compilation toolchain to generate a binary program for testing, the instrumentation including code coverage instrumentation, dominance point coverage instrumentation, distance instrumentation, and instrumentation for statistical information, including memory access and function calls; and performing gray-box fuzzing on the binary program to generate test cases, including test cases that trigger crashes. This scheme, based on traditional instrumentation rules, adds more statistical information beneficial to triggering crashes, such as dominance point coverage, memory access, and function calls, in addition to statistical code coverage of the program execution path, thus improving the efficiency of generating crash-triggered test cases. However, this scheme does not make good use of the statistical information obtained through the improved instrumentation rules and does not make targeted improvements to the fuzzing framework. This scheme has limitations.

[0006] Prior art 3 proposes a parallel fuzzing scheduling method and apparatus based on mutation strategies. This scheme discloses a parallel fuzzing scheduling method and apparatus based on mutation strategies. The method comprises: 1) statically assigning mutation strategies used to generate test case data in the fuzzer, allocating different mutation strategies to different parallel test instances; 2) during the fuzzing process of each test instance generating test samples according to the assigned mutation strategy and performing fuzzing on the target program, collecting the number of anomalies and test coverage information generated when different mutation strategies are applied to the target program; 3) calculating the advantage weight of each mutation strategy for the target program based on the number of anomalies and test coverage information corresponding to each mutation strategy; 4) establishing a parallel scheduling model based on the advantage weight of the mutation strategies and dynamically optimizing the parallel fuzzing scheduling scheme. This scheme utilizes advantageous mutation strategies to optimize the parallel fuzzing execution effect of different target programs and has universal applicability. However, this scheme only optimizes the mutation strategies and does not propose corresponding targeted improvement measures for other key aspects of fuzzing. This scheme has limitations.

[0007] Prior art 4 proposes a fuzzing method and a computer-readable storage medium. This method provides a fuzzing method and a computer-readable storage medium, the method comprising the following steps when generating mutation input: S1: performing byte analysis on each seed in the seed queue to identify bytes related to verification checks, the byte analysis including attempting mutations on all bytes in the seed, and obtaining a score value for the byte based on the path change of the mutation input; S2: determining whether to mutate the byte based on the score value of the byte. This method uses a novel lightweight mutation strategy to increase the probability of generating legitimate mutation inputs; furthermore, it achieves greater code coverage in the same amount of time, improving fuzzing efficiency. However, since this method only optimizes mutations for code coverage, it cannot perform more targeted fuzzing on vulnerabilities.

[0008] Existing technology 5 proposes a seed processing method, fuzzing method, system, and storage medium for fuzzing. This application is in software testing technology. The seed processing method includes obtaining the static weight of each program block; statistically analyzing the number of times each program block is run during fuzzing, and obtaining the dynamic weight of each program block based on the statistically analyzed number of runs in each fuzzing test; scoring seeds in a seed library based on the static and dynamic weights; selecting seeds for mutation, where test cases are obtained, and a higher seed score has a higher probability of being selected; and statistically analyzing code coverage, updating the seed library with test cases based on the code coverage of the test cases. This scheme only scores seeds based on the number of runs of each program block, which does not allow seeds more likely to discover vulnerabilities to receive higher mutation priority.

[0009] With the increasing variety and quantity of software programs and applications, finding potential security vulnerabilities in these programs to prevent users' computers or servers from being attacked and exploited by hackers has always been a major challenge in the field of cybersecurity. As many programs become more feature-rich and their code more complex, vulnerability discovery becomes increasingly difficult. Fuzzing is one of the most popular vulnerability discovery techniques today, and its efficiency has always been its greatest strength. However, current mainstream fuzzing tools still have some limitations, unable to simultaneously achieve both high efficiency and targeting of multiple vulnerabilities. Summary of the Invention

[0010] The purpose of this invention is to solve the technical problem that current fuzzing techniques cannot simultaneously achieve both high efficiency in vulnerability discovery and targeting of multiple vulnerabilities, and to provide a fuzzing method for multiple vulnerabilities.

[0011] To achieve the above objectives, the present invention adopts the following technical solution:

[0012] A fuzzing method for multiple vulnerabilities includes the following steps:

[0013] S1. Instrument the target program that is designed to exploit multiple vulnerabilities.

[0014] S2. After performing multi-objective optimization on the core aspects of fuzzing based on seed group queuing, the mutated seeds are input into the instrumented and compiled target program and multi-objective fuzzing is run.

[0015] S3. Perform corresponding processing based on the status of the target program and the results of the multi-target fuzzy test.

[0016] S4. After the multi-target fuzz test is completed, the collected abnormal seeds are sorted and filtered, and the potential vulnerabilities of the filtered and deduplicated seeds are analyzed and located.

[0017] In some embodiments of the present invention, in step S1, the instrumentation compilation is performed by selecting an open-source target program that needs to be vulnerabilities discovered through fuzzing, and using the LLVM static instrumentation compilation tool to instrument the target program with multiple vulnerabilities as the guide to obtain relevant program status and program behavior information.

[0018] In some embodiments of the present invention, the various vulnerabilities include four types of vulnerabilities: memory conflict-related vulnerabilities (MV), array out-of-bounds vulnerabilities (OOB), memory consumption-related vulnerabilities (MC), and algorithm complexity-related vulnerabilities (AC).

[0019] In some embodiments of the present invention, for memory conflict-related vulnerabilities (MV), dangerous areas are found by detecting and counting instructions that operate on memory; for array out-of-bounds vulnerabilities (OOB), dangerous areas are found by detecting sets to obtain offsets and sizes, and quantifying the probability of out-of-bounds using the offset / size ratio; for memory consumption-related vulnerabilities (MC), dangerous areas are found by detecting instructions that allocate and release memory to obtain the total size of allocated memory; and for algorithm complexity-related vulnerabilities (AC), dangerous areas are found by calculating the number of basic blocks checked in the input.

[0020] In some embodiments of the present invention, step S2, which involves optimizing the core aspects of fuzzy testing based on seed group queuing, includes the following steps:

[0021] S2-1. Select an appropriate number of higher priority seed groups based on seed priority scheduling of multi-objective multi-level queues;

[0022] S2-2. Multi-objective seed energy scheduling based on information entropy allocates energy to seed groups;

[0023] S2-3. Perform seed mutation based on seed mutations inferred from the keyword section.

[0024] In some embodiments of the present invention, in step S2-1, the six metrics for selection include seed execution speed, the number of edges traversed by the seed, the number of basic blocks executed, the number of memory access operations, array out-of-bounds cases, and memory consumption. If requiring all six metrics to be optimal simultaneously is too strict, the seed execution speed metric will be removed, and only the remaining five metrics will be compared until a suitable number of higher priority seed groups can be selected.

[0025] In some embodiments of the present invention, in step S2-2, the energy allocation to the seed group is achieved by optimizing the power scheduling among different seeds in a seed group. The power scheduling determines the energy of each seed in each seed group by adaptively calculating the ratio of each seed in the seed group.

[0026] In some embodiments of the present invention, the energy of each seed in each seed group is defined as follows: in, The energy E of the i-th seed in each seed group g g It is the energy of seed group g. The ratio of each seed in the seed group; the ratio of each seed in the seed group The definition of is:

[0027]

[0028] Where g i It is the i-th seed in seed group g. It is the ratio of the i-th seed in seed group g; This represents the sum of the various types of information within each seed in the seed group, calculated using the information entropy method. This represents the total information content of the 5 seeds in the seed group.

[0029] In some embodiments of the present invention, in steps S2-3, the seed mutation based on keyword byte inference is performed by observing the results of changing bytes to establish the relationship between input bytes and vulnerability metrics; when selecting bytes for mutation, those confirmed related bytes are mutated with a higher probability; for each sub-seed other than the original seed, byte inference will only mutate bytes related to the target vulnerability for seed mutation.

[0030] In some embodiments of the present invention, step S3, specifically the corresponding processing based on the state of the target program and the results of the multi-target fuzz test, involves: in a target program that is running a multi-target fuzz test, if a new code coverage is found, a new seed group is added to the seed group queue; if a new bug metric is found, the corresponding seed is replaced from the seed group; if there is no sub-seed corresponding to the corresponding type of vulnerability in the seed group, the input will be directly added without replacement.

[0031] The present invention has the following beneficial effects:

[0032] This invention can obtain additional vulnerability-related program behavior and state information by instrumenting the target program during compilation; at the same time, it can perform multi-target fuzzing by optimizing the algorithm for the core fuzzing process based on seed groups, thereby enabling the fuzzing tool to perform multi-target fuzzing more efficiently and find various types of potential vulnerabilities; and it has a stronger targeting for the discovery of various vulnerabilities without affecting efficiency.

[0033] Other beneficial effects of the embodiments of the present invention will be further described below. Attached Figure Description

[0034] Figure 1 This is a flowchart of the steps of the fuzzing method for various vulnerabilities in an embodiment of the present invention;

[0035] Figure 2 This is a flowchart illustrating the main framework of the fuzzing method for various vulnerabilities in this embodiment of the invention.

[0036] Figure 3 This is a flowchart of the steps in Embodiment 1 of the fuzzing method for multiple vulnerabilities in this invention. Detailed Implementation

[0037] The present invention will be further described below with reference to the accompanying drawings and preferred embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0038] It should be noted that the directional terms such as left, right, up, down, top, and bottom used in this embodiment are only relative concepts or are based on the normal use of the product, and should not be considered as restrictive.

[0039] Current mainstream fuzzing tools still have some limitations, failing to simultaneously achieve high efficiency and specificity for various types of vulnerabilities. Therefore, a significant portion of current research on fuzzing focuses on finding more vulnerabilities while being more efficient and computationally efficient. From this perspective, the goal of the following embodiments of this invention is to improve the efficiency of fuzzing (a black-box (or gray-box) testing technique) and its ability to find corresponding bugs (vulnerabilities) by designing a more targeted fuzzing framework.

[0040] The following embodiments of the present invention improve the instrumentation of the target program before fuzzing by using the LLVM (Low Level Virtual Machine, a framework system for building compilers) tool. This reduces runtime overhead while obtaining more information. Furthermore, addressing the shortcomings of current fuzzing tools in terms of targeting various types of vulnerabilities and their low efficiency, the invention focuses on the three core aspects of fuzzing: seed scheduling, energy allocation, and mutation. Without affecting the efficiency of fuzzing, it provides stronger targeting for the discovery of various vulnerabilities.

[0041] Therefore, the following embodiments of the present invention address the problems of current fuzzing techniques lacking static instrumentation methods for multiple vulnerability types and lacking targeted algorithms for various types of vulnerabilities, and propose a new fuzzing method based on multiple vulnerabilities.

[0042] The following embodiments of the present invention propose a fuzzing method for various vulnerabilities, such as... Figure 1 As shown, the process includes the following steps: S1, instrumenting and compiling the target program based on multiple vulnerabilities; S2, after multi-target optimization of the core fuzzing process based on seed group queuing, inputting the mutated seeds into the instrumented and compiled target program and running multi-target fuzzing; S3, processing the target program's state and the results of the multi-target fuzzing; S4, after the multi-target fuzzing is completed, organizing and filtering the collected abnormal seeds, and performing potential vulnerability analysis and location on the filtered and deduplicated seeds.

[0043] In a preferred embodiment, step S2, which optimizes the core link of fuzzy testing based on seed group queuing, includes the following steps: S2-1, selecting an appropriate number of higher priority seed groups based on seed priority scheduling of multi-objective multi-level queues; S2-2, allocating energy to seed groups based on multi-objective seed energy scheduling of information entropy; S2-3, performing seed mutation based on seed mutation inferred from keyword byte.

[0044] In a preferred embodiment, in steps S2-3, the seed mutation based on keyword byte inference is performed by observing the results of changing bytes to establish the relationship between input bytes and vulnerability metrics; when selecting bytes for mutation, those confirmed related bytes are mutated with a higher probability; for each sub-seed other than the original seed, byte inference will only mutate bytes related to the target vulnerability for seed mutation.

[0045] In a preferred embodiment, step S3, specifically the corresponding processing based on the state of the target program and the results of the multi-target fuzz test, involves: in a target program that is running a multi-target fuzz test, if a new code coverage is found, a new seed group is added to the seed group queue; if a new bug metric is found, the corresponding seed is replaced from the seed group; if there is no sub-seed corresponding to the corresponding type of vulnerability in the seed group, the input will be directly added without replacement.

[0046] This invention mainly consists of two aspects. The first aspect is the proposal of a novel static instrumentation compilation technique for fuzzing tools, capable of acquiring more program state and behavior information. Based on some built-in LLVM calling interfaces, static instrumentation of the target program and the acquisition of related program state and behavior information are achieved. Through this additional information, the fuzzing tool can perform more targeted fuzzing on vulnerabilities. Simultaneously, by storing the instrumented program information using shared memory, the overhead during target program execution is significantly reduced, providing a fundamental guarantee for the efficiency of the fuzzing tool. The second aspect is the proposal of a multi-target fuzzing framework based on a novel seed queue format for seed groups, oriented towards various major types of vulnerabilities. By improving and optimizing the algorithms for the three core aspects of fuzzing—seed selection, energy scheduling, and seed mutation—and designing multiple fuzzing metrics, the concept of information entropy is used to allocate appropriate energy to the seeds for mutation, thereby enabling the fuzzing tool to perform multi-target fuzzing more efficiently and find various types of potential vulnerabilities.

[0047] 1. Program instrumentation

[0048] To acquire and retain more information about program behavior and state within the same execution path, LLVM is used to detect the target program, obtaining feedback on code coverage and vulnerability-related metrics. Vulnerabilities are complex and difficult to predict, but some vulnerabilities exhibit characteristics similar to program crashes or timeouts when certain conditions are met; that is, vulnerabilities possess certain characteristics. Below are four types of vulnerabilities selected in this embodiment of the invention and their vulnerability characteristics:

[0049] (1) Memory Violation (MV) vulnerabilities are among the most common and serious vulnerabilities. Memory Violation vulnerabilities occur when pointers access memory incorrectly. Therefore, if fuzzing focuses on memory access operations, i.e., allocating more energy to code regions with more memory access, it is likely to uncover more vulnerabilities involving illegal memory access.

[0050] (2) Out-of-Bounds (OOB) vulnerabilities are a specific type of memory violation that involves reading or writing bytes outside their bounds. Intuitively, accessing memory closer to the boundary is more likely to trigger an OOB-related vulnerability than accessing memory farther from the boundary. Therefore, fuzzing can allocate more energy to accessing seeds closer to the boundary.

[0051] (3) Memory Consumption Vulnerability (MC). Memory consumption is a spatial complexity issue that occurs when program execution consumes excessive memory. Because this vulnerability consumes too much memory, attackers can launch denial-of-service (DoS) attacks. To detect this vulnerability, embodiments of this invention consider that inputs consuming more memory are more likely to trigger the excessive memory consumption vulnerability than inputs consuming less memory.

[0052] In the target program instrumentation compilation technique of this invention embodiment, the information obtained on the memory consumption of the target program is not accurate enough. A more accurate method for obtaining memory consumption can be proposed from this aspect, so as to more efficiently discover memory consumption-related vulnerabilities in the program.

[0053] (4) Algorithm Complexity Vulnerabilities (AC). If an input triggers an algorithm complexity vulnerability, it will cause the target program to spend a significant amount of time completing its execution. Therefore, attackers can also exploit this to launch DoS attacks. Intuitively, inputs that result in a large number of executed instructions are more likely to trigger this type of vulnerability in the target program.

[0054] After identifying the four common types of vulnerabilities targeted by this invention, the next step is to locate the dangerous areas associated with these four types of vulnerabilities in the program code. For memory conflict-related vulnerabilities, this invention detects and counts instructions that operate on memory. Specifically, this invention tests function calls that operate on memory, such as the malloc, free, and memcpy functions. Furthermore, this invention utilizes two methods from LLVM: MayReadFromMemory() (to determine if an instruction reads memory) and MayWriteToMemory (to determine if an instruction writes to memory) to detect instructions that may operate on memory. For array out-of-bounds vulnerabilities, this invention detects collections (such as arrays and structures) to obtain the offset (i.e., the current position of memory access) and size (i.e., the total size of the collection). This invention uses the offset / size ratio to quantify the likelihood of an out-of-bounds access. For memory consumption-related vulnerabilities, this invention detects instructions that allocate and free memory to obtain the total size of allocated memory. For algorithm complexity-related vulnerabilities, this invention calculates the number of basic blocks for input checking.

[0055] The types of vulnerabilities addressed in the embodiments of this invention can be further expanded.

[0056] After obtaining relevant program status and behavior information through instrumentation, this information needs to be used to improve fuzz testing efficiency. This is the content of the main framework of the second part of the invention embodiment.

[0057] 2. Main framework

[0058] Most coverage-guided fuzzing tools (CGF) maintain a seed queue, which is retained when generated input discovers new code coverage. Unlike these CGFs, this embodiment maintains a seed group queue, where seeds are either designed to discover a certain type of vulnerability or to find new code coverage.

[0059] A seed group is a set of five seeds with the same code execution path. In a single seed group, in addition to the original seed (based on code coverage, the same as other CGFs), there are four seeds corresponding to the four vulnerability types mentioned above. These seeds have the same execution path as the original seeds, but they have better values ​​in the corresponding vulnerability characteristic indicators. This is why these four types of seeds related to specific vulnerability types are kept.

[0060] During fuzzing, if new code coverage is found in an input, that input becomes the original seed in a new seed group, and that seed group is added to the seed group queue. If the seed group corresponding to the input's code execution path contains one or more seeds that are inferior to the input in a certain type of vulnerability metric (i.e., a new bug metric is found), then the input will replace the corresponding seed in the seed group. If the seed group does not contain any sub-seeds corresponding to the corresponding type of vulnerability, then the input will be directly added to it without replacement.

[0061] In this way, the number of seed groups will be kept at an appropriate size, so that adding seeds will not reduce the efficiency of fuzz testing. Figure 2 This document describes the workflow of the main framework of this invention, which primarily includes three components: seed group priority scheduling, energy scheduling, and keyword inference. These three components will be described in detail in the following three subsections. Furthermore, the executor is responsible for inputting the mutated seed into the target program and processing it accordingly based on the target program's state and execution results. Vulnerability verification and analysis refers to the process of organizing and filtering the collected abnormal seeds after the fuzzing test is completed, and finally performing potential vulnerability analysis and location on the filtered and deduplicated seeds.

[0062] 2.1 Seed Group Priority Scheduling

[0063] The first major component is a seed selection strategy based on multi-level queue scheduling, which corresponds to the seed selection stage in the core of fuzzing. In this embodiment, the seed selection problem is viewed as a multi-objective optimization problem. To more efficiently select seeds with superior overall performance and quality, this embodiment selects six metrics based on several key factors affecting seed efficiency and the seed's performance in vulnerability-related metrics. These metrics are: seed execution speed, the number of edges traversed by the seed, the number of executed basic blocks, the number of memory access operations, array out-of-bounds errors, and memory consumption. Among all the metrics, seed execution speed and the number of edges traversed by the seed are generally used to improve code coverage, because fuzzing generally favors seeds with faster execution speeds and the ability to traverse more edges.

[0064] Ideally, these six metrics would help select the best seed groups. However, based on experimental observations, in some cases, requiring all six metrics to be optimal simultaneously is too stringent and cannot be satisfied at the same time, potentially leading to a lack of suitable seed groups being selected. Therefore, in this embodiment of the invention, the requirement for the number of metrics is gradually reduced based on the number of seeds selected. For example, if requiring all six metrics to be optimal simultaneously is too stringent, the seed execution speed metric will be removed, and only the remaining five metrics will be compared until a suitable number of higher-priority seed groups can be selected.

[0065] After selecting the seed groups that are more likely to discover vulnerabilities and have a higher priority, energy needs to be allocated to the seed groups. This is the content of the second major component below.

[0066] 2.2 Energy Dispatch

[0067] The second major component is a multi-objective energy allocation strategy based on information entropy, corresponding to the seed energy scheduling stage in the core of fuzzing. This invention aims to optimize power scheduling among different seeds within a seed group. Power scheduling determines the energy of each seed in a seed group by adaptively calculating the percentage allocated to each seed. This invention utilizes the concept of information entropy to introduce five major population categories (i.e., five categories of information, each containing multiple species) for energy allocation. One major category is code coverage, and the other four categories are the four types of vulnerabilities described above. Since the program information related to vulnerabilities differs in different execution paths, in this invention, within each vulnerability-related major category, the vulnerability-related metrics of different seeds executing different execution paths are considered different species; that is, each vulnerability-related metric in an execution path is a species within the vulnerability-related major category.

[0068] According to the above definition, each seed energy comes from all five major categories. Specifically, each seed contains characteristics such as code coverage, memory conflict-related vulnerabilities, array out-of-bounds vulnerabilities, memory consumption-related vulnerabilities, and algorithm complexity-related vulnerabilities. Since this embodiment of the invention includes five seeds in a seed group, each seed has a corresponding entropy. To adaptively allocate energy to the seeds in the seed group, the ratio of each seed is calculated as follows:

[0069]

[0070] Where g i It is the i-th seed in seed group g. It is the ratio of the i-th seed in seed group g; This represents the sum of the various types of information within each seed in the seed group, calculated using the information entropy method. This represents the sum of information content from the five seeds in the seed group. With the ratio... The energy of the i-th seed in each seed group g can be easily calculated. Where E g This is the energy of seed group g. The total energy E of each seed group... g The computational strategy is the same as that of AFL++ (one of the most advanced fuzzing tools currently available).

[0071] After calculating the ratio of each seed in the seed group, energy is allocated to each seed according to its ratio in the seed group. For example... Figure 2 In the seed energy scheduling stage, the energy allocation ratios in the seed group are 0.1, 0.3, 0.2, 0.1 and 0.3, respectively. The energy of each seed is the corresponding ratio coefficient multiplied by the total energy of the seed group.

[0072] In this embodiment of the invention, the energy scheduling algorithm for the seed group suffers from reduced information discovery efficiency in the later stages of fuzz testing, leading to a decline in algorithm performance. This algorithm can be improved into a more adaptive one to enhance the efficiency of information discovery in the later stages of fuzz testing.

[0073] 2.3 Keyword Section Inference

[0074] The third major component is an efficient seed mutation strategy based on keyword sections, which corresponds to the seed mutation stage in the core of fuzz testing.

[0075] When a seed is allocated energy, the next step is to select the byte to mutate within that seed. Since seeds in a seed group execute the same execution path, their mutations are highly likely to overlap, meaning that mutations in different seeds can be completely identical. To address this issue, embodiments of the invention use a key byte inference strategy to mutate seed bytes, i.e., key bytes, associated with four vulnerability type metrics. As discussed earlier, larger vulnerability metrics are more likely to expose vulnerabilities. Therefore, focusing on fuzzy test bytes that can lead to larger metric values ​​is effective.

[0076] Byte inference is based on the observation that only a subset of bytes in the seed are relevant to the vulnerability metric, while the majority of bytes in the input are irrelevant; these relevant bytes are the key bytes. Observation shows that mutating all bytes in a seed would be a waste of time. This embodiment of the invention establishes the relationship between input bytes and the vulnerability metric by observing the results of changing bytes. When selecting bytes for mutation, this embodiment mutates those confirmed to be relevant with a higher probability. This embodiment includes five seeds in a seed set, where each seed is intended to optimize a different target. For each seed other than the original seed (i.e., a sub-seed), byte inference will only mutate bytes relevant to the target vulnerability.

[0077] This invention addresses the problem of insufficient vulnerability targeting in current fuzzing techniques by proposing a novel fuzzing technique targeting multiple vulnerabilities. Firstly, it improves the instrumentation of the target program before fuzzing using LLVM tools, while minimizing runtime overhead. Traditional coverage-based gray-box fuzzing techniques primarily focus on obtaining code coverage (e.g., edge coverage) during instrumentation, neglecting much other program state and behavior information obtainable at runtime, such as the program's usage of system calls in the operating system. By improving the original instrumentation, this invention can obtain more information to help design a better fuzzing framework, including seed scheduling strategies, energy allocation strategies, mutation strategies, and so on.

[0078] Secondly, to further optimize the current fuzzing tools, which are not sufficiently targeted and efficient for various types of vulnerabilities, we attempt to address the issue by focusing on the three core aspects of fuzzing: seed scheduling, energy allocation, and mutation. This approach aims to achieve stronger targeting for vulnerability discovery without compromising fuzzing efficiency. As shown in Table 1, B, A, and Am represent three different fuzzing tools. B is the fuzzing tool based on an improvement of AFL++ (one of the most advanced fuzzing tools currently available), A is the default mode of AFL++, and Am is the AFL++ mode using MOPT (a highly effective fuzzing mutation operator selection scheme). The comparative experimental results after fuzzing the three tools for 24 hours and repeating the experiment 10 times are shown in Table 1. As can be seen from the figure, the fuzzing tool proposed in this embodiment (B in Table 1) finds more unique crashes and vulnerabilities than the other two most advanced gray-box fuzzing tools. Therefore, the fuzzing improvement scheme proposed in this embodiment can be considered effective.

[0079] Table 1. Experimental results comparing the embodiments of the present invention with the prior art.

[0080]

[0081] The specific features of the embodiments of the present invention are as follows:

[0082] 1. Program instrumentation and compilation targeting various types of vulnerabilities.

[0083] Pre-fuzzing instrumentation and mutation of the target program is a necessary stage in most gray-box fuzzing tests. Its purpose is to obtain information about the execution path of the seed program and code coverage during program execution. The program instrumentation compilation technique proposed in this invention, based on existing code coverage information, further obtains additional program behavior and state information using LLVM tools. This provides assistance for designing algorithms related to seed priority scheduling and energy allocation in subsequent fuzzing, thereby laying the foundation for improving fuzzing efficiency.

[0084] 2. Seed priority scheduling technique based on multi-level queues

[0085] While some existing studies have considered using program behavior information obtained through additional program instrumentation to help improve the efficiency of fuzzing, these existing solutions have not utilized this additional information for efficient priority scheduling of seeds. In this invention, by combining the core aspect of seed scheduling in fuzzing with multi-objective optimization and multi-level queue scheduling, a more vulnerability-targeted seed priority scheduling algorithm is designed. This algorithm enables seeds to consider both code coverage and vulnerability-related metrics, and assigns higher priority to selected seeds, thereby improving the vulnerability discovery efficiency of fuzzing.

[0086] 3. Multi-objective energy scheduling algorithm based on information entropy

[0087] While existing research has yielded numerous improvements to seed energy scheduling algorithms, these solutions generally lack specificity for vulnerabilities, resulting in inefficient seed energy scheduling. In this invention, the seed energy scheduling stage of fuzzing is integrated with the concept of information entropy. This allows for targeted scoring of different seeds' ability to discover new information, including vulnerabilities, and a more vulnerability-specific energy scheduling algorithm is designed, thereby improving the overall efficiency and targeting of vulnerability discovery within the fuzzing framework.

[0088] Example 1, the process is as follows Figure 3 As shown, the three steps within the dashed box are the core steps of the fuzz testing process.

[0089] First, select an open-source target program that needs to be fuzzed for vulnerability discovery, and use the LLVM static instrumentation compilation tool proposed in this embodiment to perform instrumentation compilation to obtain the target program for fuzzing.

[0090] LLVM is used to detect the target program, obtaining feedback on code coverage and vulnerability-related metrics. Vulnerabilities are complex and difficult to predict, but some vulnerabilities exhibit characteristics similar to program crashes or timeouts when certain conditions are met; that is, vulnerabilities possess certain characteristics. Below are four types of vulnerabilities selected in this embodiment and their vulnerability characteristics:

[0091] (1) Memory Violation (MV) vulnerabilities are among the most common and serious vulnerabilities. Memory Violation vulnerabilities occur when pointers access memory incorrectly. Therefore, if fuzzing focuses on memory access operations, i.e., allocating more energy to code regions with more memory access, it is likely to uncover more vulnerabilities involving illegal memory access.

[0092] (2) Out-of-Bounds (OOB) vulnerabilities are a specific type of memory violation that involves reading or writing bytes outside their bounds. Intuitively, accessing memory closer to the boundary is more likely to trigger an OOB-related vulnerability than accessing memory farther from the boundary. Therefore, fuzzing can allocate more energy to accessing seeds closer to the boundary.

[0093] (3) Memory Consumption Vulnerability (MC). Memory consumption is a spatial complexity issue that occurs when program execution consumes excessive memory. Because this vulnerability consumes too much memory, attackers can launch denial-of-service (DoS) attacks. To detect this vulnerability, this embodiment assumes that inputs consuming more memory are more likely to trigger the excessive memory consumption vulnerability than inputs consuming less memory.

[0094] (4) Algorithm Complexity Vulnerabilities (AC). If an input triggers an algorithm complexity vulnerability, it will cause the target program to spend a significant amount of time completing its execution. Therefore, attackers can also exploit this to launch DoS attacks. Intuitively, inputs that result in a large number of executed instructions are more likely to trigger this type of vulnerability in the target program.

[0095] Having identified the four common types of vulnerabilities addressed in this embodiment, the next step is to locate the dangerous areas associated with these vulnerabilities in the program code. For memory conflict-related vulnerabilities, this embodiment detects and counts instructions that operate on memory. Specifically, this embodiment tests function calls that operate on memory, such as the malloc, free, and memcpy functions. Furthermore, this embodiment utilizes two methods from LLVM—MayReadFromMemory (to determine if an instruction reads memory) and MayWriteToMemory (to determine if an instruction writes to memory)—to detect instructions that may operate on memory. For array out-of-bounds vulnerabilities, this embodiment detects collections (such as arrays and structures) to obtain the offset (i.e., the current position of memory access) and size (i.e., the total size of the collection). This embodiment uses the offset / size ratio to quantify the likelihood of an out-of-bounds access. For memory consumption-related vulnerabilities, this embodiment detects instructions that allocate and free memory to obtain the total size of allocated memory. For algorithm complexity-related vulnerabilities, this embodiment calculates the number of basic blocks for input checking.

[0096] After designing the algorithm logic of the LLVM instrumentation compiler, you can generate packaged compilers (afl-clang-fast and afl-clang-fast++) using scripts within AFLplusplus. By selecting the appropriate compiler based on the target programming language and instrumenting the target program, you can obtain relevant program state and behavior information.

[0097] After obtaining the target program, the fuzzing framework of this invention needs to be implemented based on AFLplusplus. Most coverage-guided fuzzing tools (CGF) maintain a seed queue, which is retained when the generated input discovers new code coverage. Unlike these CGFs, this embodiment maintains a seed group queue, where the seeds in the seed group aim to either discover a certain type of vulnerability or discover new code coverage.

[0098] A seed group is a set of five seeds with the same code execution path. In a single seed group, in addition to the original seed (based on code coverage, the same as other CGFs), there are four seeds corresponding to the four vulnerability types mentioned above. These seeds have the same execution path as the original seeds, but they have better values ​​in the corresponding vulnerability characteristic indicators. This is why these four types of seeds related to specific vulnerability types are kept.

[0099] During fuzzing, if new code coverage is found in an input, that input becomes the original seed in a new seed group, and that seed group is added to the seed group queue. If the seed group corresponding to the input's code execution path contains one or more seeds that are inferior to the input in a certain type of vulnerability metric (i.e., a new bug metric is found), then the input will replace the corresponding seed in the seed group. If the seed group does not contain any sub-seeds corresponding to the corresponding type of vulnerability, then the input will be directly added to it without replacement.

[0100] In this way, the number of seed groups will be kept at an appropriate size, so that adding seeds will not reduce the efficiency of fuzz testing. Figure 2 This document describes the workflow of the main framework of this embodiment, which mainly includes three components: seed group priority scheduling, energy scheduling, and keyword inference. Furthermore, the executor is responsible for inputting the mutated seed into the target program and processing it accordingly based on the target program's state and execution results. Vulnerability verification and analysis refers to the process of organizing and filtering the collected abnormal seeds after the fuzzing test is completed, and finally performing potential vulnerability analysis and location on the filtered and deduplicated seeds.

[0101] The first major component is a seed selection strategy based on multi-level queue scheduling, which corresponds to the seed selection stage in the core of fuzzing. In this embodiment, the seed selection problem is viewed as a multi-objective optimization problem. To more efficiently select seeds with better overall performance and quality, this embodiment selects six metrics based on several key factors affecting seed efficiency and the seed's performance in vulnerability-related metrics. These are: seed execution speed, the number of edges traversed by the seed, the number of basic blocks executed, the number of memory access operations, array out-of-bounds errors, and memory consumption. Among all the metrics, seed execution speed and the number of edges traversed by the seed are generally used to improve code coverage, because fuzzing generally favors seeds with faster execution speeds and the ability to traverse more edges.

[0102] Ideally, these six metrics would help select the best seed groups. However, based on experimental observations, in some cases, requiring all six metrics to be optimal simultaneously is too stringent and cannot be satisfied at the same time, potentially leading to a lack of suitable seed groups being selected. Therefore, in this embodiment, the requirement for the number of metrics will be gradually reduced based on the number of seeds selected. For example, if requiring all six metrics to be optimal simultaneously is too stringent, the seed execution speed metric will be removed, and only the remaining five metrics will be compared until a suitable number of higher-priority seed groups can be selected.

[0103] After selecting the seed groups that are more likely to discover vulnerabilities and have higher priority, energy needs to be allocated to these seed groups. This is the content of the second major component. The second major component is a multi-objective energy allocation strategy based on information entropy, which corresponds to the seed energy scheduling stage in the core of fuzzing. This embodiment aims to optimize the power scheduling among different seeds in a seed group. Power scheduling determines the energy of each seed in a seed group by adaptively calculating the percentage allocated to each seed. This embodiment uses the concept of information entropy to introduce five major populations (i.e., five major categories of information, each with multiple species) for energy allocation. One major category is code coverage, and the other four categories are the four types of vulnerabilities introduced above. Since the program information related to vulnerabilities is different in different execution paths, in this embodiment, the vulnerability-related metrics in different seeds executing different execution paths are regarded as different species within each vulnerability-related major category. That is, each vulnerability-related metric in the execution path is a species of the vulnerability-related major category.

[0104] According to the above definition, each seed energy comes from all five major categories. Specifically, each seed contains characteristics such as code coverage, memory conflict-related vulnerabilities, array out-of-bounds vulnerabilities, memory consumption-related vulnerabilities, and algorithm complexity-related vulnerabilities. Since this embodiment includes five seeds in a seed group, each seed has a corresponding entropy. To adaptively allocate energy to the seeds in the seed group, the ratio of each seed is calculated as follows:

[0105]

[0106] Where g i It is the i-th seed in seed group g. It is the ratio of the i-th seed in seed group g. This represents the information content of each seed calculated using the information entropy method. With the ratio... The energy of the i-th seed in each seed group g can be easily calculated. Where E g This is the energy of seed group g. The total energy E of each seed group... g The computational strategy is the same as that of AFL++ (one of the most advanced fuzzing tools currently available).

[0107] After calculating the ratio of each seed in the seed group, energy is allocated to each seed according to its ratio in the seed group. For example... Figure 2 In the seed energy scheduling stage, the energy allocation ratios in the seed group are 0.1, 0.3, 0.2, 0.1 and 0.3, respectively. The energy of each seed is the corresponding ratio coefficient multiplied by the total energy of the seed group.

[0108] The third major component is an efficient seed mutation strategy based on keyword sections, which corresponds to the seed mutation stage in the core of fuzz testing.

[0109] When a seed is allocated energy, the next step is to select the byte to mutate within that seed. Since seeds in a seed group execute the same execution path, their mutations are highly likely to overlap, meaning that mutations from different seeds can be completely identical. To address this issue, this embodiment uses a key byte inference strategy to mutate seed bytes, or key bytes, associated with four vulnerability type metrics. As discussed earlier, larger vulnerability metrics are more likely to expose vulnerabilities. Therefore, focusing on fuzzy test bytes that can lead to larger metrics is effective.

[0110] Byte inference is based on the observation that only a subset of bytes in the seed are relevant to the vulnerability metric, while the majority of bytes in the input are irrelevant; these relevant bytes are the key bytes. Observation shows that mutating all bytes in a seed would be a waste of time. This embodiment establishes the relationship between input bytes and the vulnerability metric by observing the results of changing bytes. When selecting bytes for mutation, this embodiment mutates those confirmed to be relevant with a higher probability. This embodiment includes five seeds in a seed group, each intended to optimize a different target. For each seed other than the original seed (i.e., a sub-seed), byte inference will only mutate bytes relevant to the target vulnerability.

[0111] After designing the three main components in this embodiment, the fuzzing program can be generated using the Makefile (automatic compilation script) in AFLplusplus. Then, using the corresponding fuzzing parameters (as shown in Table 1), the instrumented target program can be fuzzed.

[0112] The embodiments of the present invention have the following beneficial effects on the vulnerability mining industry in the software and network security fields: (1) It can obtain various vulnerability-related program behavior and status information of the target program to help users develop a fuzzing framework for the product; (2) It helps to discover various types of common vulnerabilities in open source programs and help developers fix potential security problems in the code in a timely manner.

[0113] Compared with the prior art, the embodiments of the present invention have the following significant differences and technological advantages: (1) It can obtain additional vulnerability-related program behavior and status information by instrumenting the target program; (2) It can perform multi-target fuzz testing by optimizing the algorithm for the core link of fuzz testing based on seed groups.

[0114] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, several equivalent substitutions or obvious modifications can be made without departing from the concept of the present invention, and all such modifications, achieving the same performance or purpose, should be considered within the scope of protection of the present invention.

Claims

1. A method of fuzz testing against multiple vulnerabilities, the method comprising: Includes the following steps: S1. Instrument the target program that is designed to exploit multiple vulnerabilities. S2. After performing multi-objective optimization on the core aspects of fuzzing based on seed group queuing, the mutated seeds are input into the instrumented and compiled target program and multi-objective fuzzing is run. S3. Perform corresponding processing based on the status of the target program and the results of the multi-target fuzzy test. S4. After the multi-target fuzz test is completed, the collected abnormal seeds are sorted and filtered, and the potential vulnerabilities of the filtered and deduplicated seeds are analyzed and located. In step S2, the optimization of the core fuzzy testing process based on seed group queuing includes the following steps: S2-1. Select an appropriate number of higher priority seed groups based on seed priority scheduling of multi-objective multi-level queues; S2-2, Multi-objective seed energy scheduling based on information entropy allocates energy to seed groups; the energy of each seed in each seed group is defined as follows: ,in, For each seed group The Middle i The energy of a seed It is a seed group energy, The ratio of each seed in the seed group; the ratio of each seed in the seed group The definition of is: wherein is a seed group the first i seed, is a ratio of the first seed in the seed group i ; represents a total sum of information amounts of a plurality of types of information in each seed in the seed group calculated by a method of information entropy, represents a total sum of information amounts of 5 seeds in the seed group; S2-3. Perform seed mutation based on seed mutations inferred from the keyword section.

2. The method for fuzz testing against multiple vulnerabilities of claim 1, wherein, In step S1, the instrumentation compilation involves selecting an open-source target program that needs to be vulnerabilities discovered through fuzzing, and using the LLVM static instrumentation compilation tool to instrument the target program with multiple vulnerabilities as the guide to obtain relevant program state and program behavior information.

3. The method of fuzz testing for multiple vulnerabilities according to claim 1 or 2, wherein, The various vulnerabilities include four types: memory conflict vulnerabilities (MV), array out-of-bounds vulnerabilities (OOB), memory consumption vulnerabilities (MC), and algorithm complexity vulnerabilities (AC).

4. The method of claim 3, wherein, For memory conflict-related vulnerabilities (MV), the danger zone is found by detecting and counting instructions that operate on memory; for array out-of-bounds vulnerabilities (OOB), the danger zone is found by detecting sets to obtain offsets and sizes, and quantifying the probability of out-of-bounds using the offset / size ratio; for memory consumption-related vulnerabilities (MC), the danger zone is found by detecting instructions that allocate and release memory to obtain the total size of allocated memory. For algorithm complexity-related vulnerabilities, the Acquisition Detection (AC) identifies the dangerous areas associated with the vulnerability by calculating the number of basic blocks checked in the input.

5. The method for fuzz testing against multiple vulnerabilities of claim 1, wherein, In step S2-1, the six metrics used for selection include seed execution speed, the number of edges traversed by the seed, the number of basic blocks executed, the number of memory access operations, array out-of-bounds cases, and memory consumption. If requiring all six metrics to be optimal simultaneously is too strict, the seed execution speed metric will be removed, and only the remaining five metrics will be compared until a suitable number of higher-priority seed groups can be selected.

6. The method for fuzz testing against multiple vulnerabilities of claim 1, wherein, In step S2-2, the energy allocation for the seed group is achieved by optimizing the power scheduling among different seeds in a seed group. The power scheduling determines the energy of each seed in each seed group by adaptively calculating the ratio of each seed in the seed group.

7. The fuzzing method for multiple vulnerabilities as described in claim 1, characterized in that, In steps S2-3, the seed mutation based on keyword byte inference establishes the relationship between input bytes and vulnerability metrics by observing the results of byte changes; when selecting bytes for mutation, those confirmed related bytes are mutated with a higher probability; for each sub-seed other than the original seed, byte inference will only mutate bytes related to the target vulnerability for seed mutation.

8. The method for fuzz testing against multiple vulnerabilities of claim 1, wherein, In step S3, the specific processing based on the state of the target program and the results of the multi-target fuzz test is as follows: In a target program that is running a multi-target fuzz test, if a new code coverage is found, a new seed group is added to the seed group queue; if a new bug metric is found, the corresponding seed is replaced from the seed group; if there is no sub-seed corresponding to the corresponding type of vulnerability in the seed group, the input will be added directly without replacement.

Images