A dynamic adaptive strategy-based fuzzing method

Abstract

The application relates to a dynamic self-adaptive strategy-based fuzzy test optimization method, and belongs to the technical field of network security vulnerability mining. The method comprises the following steps: in the initialization stage, the breadth index of seeds is completed, two seed breadth index heuristic rules are set, and a seed breadth index function is designed; a control flow is mapped to a Markov chain, path branch probability calculation formulas, basic block probability calculation formulas and seed depth index value calculation formulas are respectively designed according to a path state transition process, and the depth index value of the seed is obtained; a dynamic self-adaptive function is designed to optimize the convergence process of the seed set, the fitness threshold and the breadth index and the depth index value of the seed are set according to the program size, the fitness in the seed mutation execution process is obtained, the fitting degree of the seed is judged according to the value of the fitness, the seed with high fitting degree is reserved for continuous mutation, and the rest is removed.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security vulnerability mining, and particularly relates to a fuzzy testing optimization method based on a dynamic adaptive strategy. BACKGROUND

[0002] Fuzzy testing technology is widely used in the field of vulnerability mining, and has advantages such as automation, high efficiency and scalability. The fuzzy testing tool AFL combined with a heuristic algorithm has become a landmark product of industrialized parallel vulnerability mining because of its intelligence and efficiency. Users provide an initial test set for the program to be tested, AFL uses a genetic algorithm to mutate the test cases, marks the test cases that can discover new execution paths as seeds, forms a seed set by continuously covering the execution paths, and iterates the seed set in the fuzzy testing period. In this process, a crash can be triggered to discover program bugs. AFL sets a favorite strategy for the selection and mutation of seeds. This strategy is similar to the idea of simulated annealing. In a single path, the seed that reaches the target area the fastest and has the smallest shape is marked as favorite, and the seed marked as favorite has a higher priority in seed selection.

[0003] Before the start of the Fuzz cycle, AFL selects seeds to start mutation, and the number of mutated test cases is defined as the energy of the seed. The energy calculation includes three elements: the code segment coverage rate of the seed path, the execution time and the period of generating new test cases. In a complete Fuzz cycle, the number of mutated test cases of the favorite seed is nearly 100 times that of the unmarked seed. In practice, it is found that AFL mostly executes favorite seeds. Since the method of determining the favorite seed is related to the shape and execution speed of the seed, and has nothing to do with whether a new execution path is generated, the favorite seed is marked too early in the fuzzy testing process, and the unmarked seed in the seed set is discarded too early, which cannot fully trigger new paths and causes the seed set to converge too early, resulting in insufficient path coverage. Currently, there are methods to optimize the selection of seed sets using simulated annealing algorithms to expand the number of favorite seed marks, using gradient descent methods to alleviate local optimization, and using greedy algorithms to improve path traversal. However, there is still a lot of room for improvement in preventing the seed set from converging too early and improving the efficiency of vulnerability mining. SUMMARY

[0004] (1) Technical problem to be solved

[0005] The technical problem to be solved by the present application is how to design a method for improving the path coverage rate of fuzzy testing.

[0006] (2) Technical solution

[0007] To solve the above technical problems, the application provides a fuzzy test optimization method based on a dynamic adaptive strategy, comprising the following steps:

[0008] Step 1. In the initialization stage, the test case capable of discovering a new execution path is marked as a seed, and the breadth index of the seed is completed.

[0009] Step 2. The program control flow is mapped to a Markov chain.

[0010] Step 3. The path weight and the depth index value of the seed are calculated based on step 2.

[0011] Step 4. The dynamic adaptive function optimization is performed based on steps 1 and 3, and the seed set convergence is realized.

[0012] Preferably, in step 1, two seed breadth index heuristic rules are set: 1. The more new path segments discovered by a single seed, the greater the probability that the seed offspring mutation discovers a new path; 2. The more code blocks crossed by the execution flow discovered by a single seed, the more complex the control flow execution, and the closer to the program exception; based on the above two seed breadth index heuristic rules, the breadth index function of the seed is set as follows:

[0013]

[0014] Wherein, i is the serial number of the seed in the current basic block optional execution path segment, 2 cycle(i) / 2 represents the number of optional new paths of the seed when traversing the path for the first time, and the breadth index value at different stages can be obtained through the breadth index function.

[0015] Preferably, the program comprises a plurality of basic blocks, each basic block represents a specific execution state of the program, and there is a direct influence relationship between adjacent basic blocks, that is, the past state does not affect the prediction of the future state, and the occurrence of the future state is only related to the present, satisfying the Markov property. In step 2, the program control flow is abstracted into a Markov chain, the path is a state transition process, AFL performs dynamic insertion at the program branch node to obtain execution path information, and a complete program control flow graph is formed; the path branch probability calculation method is defined as follows:

[0016]

[0017] X represents that X test cases pass through the path branch AB from basic block A to basic block B, Y represents that Y test cases do not pass through the path branch AB from to B, after one fuzzy test cycle, m test cases pass through basic block A and run down, and the test cases passing through the path branch AD are n.

[0018] Preferably, the weight value of each path of a single seed represents the depth index value of the seed, and the calculation formula of the probability of the basic block according to the path branch probability is as follows:

[0019]

[0020] B is a basic block, JB is a path segment from basic block J to B, J(B) is a set of basic blocks directly connected to a given basic block S, the basic blocks in J(B) can directly reach the basic block S through a state transition, P(R) represents the probability of selecting basic block R, P(B is the proportion of seeds passing through basic block B after a one-time fuzzy test loop, P(JB) represents the probability of passing through the path from J to B, which is calculated by the calculation method in step 2; in step 3, the weight value of each basic block is calculated according to the calculation formula, thereby obtaining the weight value of the path, and the total number of basic blocks passed by a single seed is BLK(s), and the depth index value of the single seed is calculated:

[0021] index_value_deep=∑ B∈BLK(s) ￡B.

[0022] Preferably, in step 4, for a single seed, the threshold values of the depth index and the breadth index of the seed are found, and the index value is calculated in different threshold intervals. According to the depth index value calculation method, the fitness of the seed is finally calculated.

[0023] Preferably, the calculation method of the fitness of the seed is improved on the basis of the genetic algorithm of AFL itself.

[0024] Preferably, the calculation formula of the fitness of the seed is:

[0025]

[0026] Wherein, is a set fitness threshold, according to the size of the program control flow graph, μ represents the number of path segments that can be selected by the seed. In the dynamic fuzzy test process, the seed is continuously mutated to generate new test cases, forming a new seed set. According to the fitness calculation method of the seed, the seeds that do not meet the requirements are continuously removed from the seed set, and the fuzzy test optimization is realized.

[0027] Preferably, τ is determined according to the size of the program control flow graph. The maximum execution path level of the seed set in the program control flow graph is the largest, and the value of τ is the largest. After one round of fuzzy test, the seed set is updated, the seeds with a fitness higher than the preset threshold are retained and continue to be mutated, and the remaining seeds are removed. In the whole fuzzy test period, the seed set is continuously updated and optimized to ensure that more path branches can be reached.

[0028] Preferably, in the process of constantly updating the optimized seed set, the glowworm algorithm is used to continue optimizing the seed set, and the path explosion problem is alleviated.

[0029] Preferably, the better the fitness function fits the seed set in the optimization process, the higher the glowworm brightness marked, the seed set gradually shrinks in the seed decision range, the seeds deviating from the preset index are discarded, and the global optimum is gradually achieved as a whole, and a higher path coverage is achieved.

[0030] (III) Beneficial effects

[0031] The application provides a fuzzy test optimization method based on a dynamic adaptive strategy, which improves the fuzzy test path coverage based on the dynamic adaptive strategy. The method comprises the following steps: in an initialization stage, completing seed breadth index, setting two seed breadth index heuristic rules, and designing a seed breadth index function; mapping a control flow to a Markov chain, respectively designing a path branch probability calculation formula, a basic block probability calculation formula and a seed depth index value calculation formula according to a path state transition process, and obtaining a seed depth index value; designing a dynamic adaptive function to optimize a seed set convergence process, setting a fitness threshold and the breadth index and the depth index value of the seed according to the program size, obtaining the fitness in a seed mutation execution process, judging the fitting degree of the seed according to the value of the fitness, retaining the seed with high fitting degree for further mutation, and eliminating the rest; further, the glowworm algorithm is used to prevent the path explosion problem to optimize the seed set convergence process, and the process is repeatedly iterated to expand the path coverage of the target program and improve the crash output of vulnerability mining. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 is a dynamic adaptive fuzzy test optimization method flowchart in the embodiment of the application;

[0033] Figure 2 is a path fitness calculation schematic diagram in the embodiment of the application. DETAILED DESCRIPTION

[0034] In order to make the purpose, content and advantages of the application more clear, the specific embodiments of the application are further described in detail below with reference to the drawings and embodiments.

[0035] The application is applicable to binary executable programs compiled by structured programming languages such as C language, and in view of the problems in the prior art, the application provides a fuzzy test method based on a dynamic adaptive strategy, mainly optimizes path selection in the seed mutation process, alleviates the problem of early convergence of the seed set, and mainly alleviates the problem of early convergence of AFL seed mutation and seed set updating, and achieves the purpose of improving the efficiency of fuzzy test.

[0036] As Figure 1 shown, the present example provides a dynamic adaptive strategy-based fuzzing method, which includes the following steps:

[0037] Step 1. In the initialization phase, mark the test case that can discover new execution paths as a seed, and complete the breadth index of the seed.

[0038] According to the data discovered by the LAVA test set, the more code fragments in the program control flow, the more program unknown errors occur, that is, the program control flow is proportional to the number of program bugs, and two seed breadth index heuristic rules are set here: 1. The more new path fragments discovered by a single seed, the greater the probability of discovering new paths by the seed's descendants; 2. The more code blocks spanned by the execution flow discovered by a single seed, the more complex the control flow execution, and the closer to the program exception. Based on the above two rules, the breadth index function of the seed is set as follows:

[0039]

[0040] Where i is the serial number of the seed in the current basic block optional execution path fragment (i.e. path branch), in order to alleviate the path explosion, here 2 cycle(i) / 2 represents the number of optional new paths of the seed in the first path traversal, and in Figure 2 , the number of optional new paths of the seed entering the initial main function in the first path traversal is 3, and the of the first breadth index is

[0041] Step 2. Map the program control flow to a Markov chain.

[0042] The program contains multiple basic blocks, each basic block represents a specific execution state of the program, and there is a direct influence relationship between adjacent basic blocks, that is: the past state does not affect the prediction of the future state, and the occurrence of the future state is only related to the present, which satisfies the Markov property. The following defined program control flow is abstracted into a Markov chain, the path is a state transition process, and AFL performs dynamic instrumentation at the program branch node to obtain execution path information, and a complete program control flow graph can be formed. The following defines the path branch probability calculation method:

[0043]

[0044] X represents that X test cases pass through the path branch AB from basic block A to basic block B, and Y represents that Y test cases do not pass through the path branch AB from to B, as shown in Figure 2 After one fuzzing cycle, m test cases run down from basic block A, and n test cases pass through the path branch AD, then

[0045] Step 3. Calculate the path weight and the depth index value of the seed based on step 2.

[0046] The weight value of a single seed on each path represents the depth index value of the seed, and the probability of the basic block can be calculated according to the path branch probability:

[0047]

[0048] B is a basic block, JB is a path segment from basic block J to B, J(B) is a set of basic blocks directly connected to a given basic block S, the basic blocks in J(B) can directly reach basic block S through a state transition, P(R) represents the probability of selecting basic block R, P(B is the proportion of seeds passing through basic block B after a single fuzzy test loop, P(JB) represents the probability of passing through the path from J to B, which can be calculated according to the calculation method in step 2. The weight value of each basic block can be calculated by this method, and the weight value of the path is obtained. Let the total number of basic blocks passed by a single seed be BLK(s), and the depth index value of a single seed can be calculated:

[0049]

[0050] The depth index value of a single seed is calculated by the above method. Figure 2 The path fitness calculation graph in the embodiment of the application is shown, the initialization program is input, the seed enters the function main program entry, and the marked numbers on the connection line are the probabilities of the seed passing through this path. The (0.3, 3.3) of basic block A respectively represent the probability of passing through this basic block and the weight, because there is only one path segment from main to A, the calculation method is:

[0051]

[0052] Step 4. Perform dynamic adaptive function optimization based on steps 1 and 3 to realize the convergence of the seed set.

[0053] According to the program execution characteristics, the seed mainly calculates the breadth index value in the early stage, and mainly calculates the depth index value in the later stage. For a single seed, we need to find the threshold value of the depth index and the breadth index of the seed. In different threshold intervals, index value calculation is performed respectively. According to the above index value calculation method, the fitness of the seed is finally calculated. The calculation method of the fitness of the seed is improved based on the genetic algorithm of AFL itself:

[0054]

[0055] is a set fitness threshold, which can be dynamically adjusted according to the size of the control flow graph of the program, μ represents the number of optional path segments of the seed, index_fit represents the fitness of the seed, in the dynamic fuzzing test process, the seed is continuously mutated to generate new test cases, forming a new seed set, according to the seed fitness calculation method, the seeds are continuously removed from the seed set, and the optimization of the fuzzing test is realized. Figure 2 For example, there is a bug on the path main->A->E->J->M->return, when the seed executes to the basic block M, a crash will be triggered, through the calculation method of step 3, the weight values of this path can be obtained respectively, which are A(0.3, 3.33), E(0.15, 13.04), J(0.15, 9.60), M(0.06, 20.67), and the sum can calculate the value of index_deep_value(seed), and then the index_fit can be calculated. According to the size of the program control flow graph, the maximum execution path level of the seed set in the control flow graph is, The maximum value of the value is the maximum value. After one round of fuzzing test, the seed set is updated, the seeds with fitness higher than the preset threshold are retained, and the remaining seeds are removed, and the whole fuzzing test period, the seed set is continuously updated and optimized, and more path branches can be reached.

[0056] In the process of continuously updating and optimizing the seed set, the glowworm algorithm is used to continue to optimize the seed set, and the path explosion problem is alleviated.

[0057] With the expansion of the breadth and depth of the seed set, the control flow graph changes dynamically in the program instrumentation running, and the path explosion problem is inevitable in the expansion of the seed path, which leads to a geometric increase in the amount of calculation. Here, we use the idea of glowworm algorithm to avoid the seed set falling into local optimum. In the optimization process of the seed set, the better the fitness function fits, the higher the brightness of the glowworm is marked, and the seed set gradually shrinks in the seed decision range (seed variation traversal path process), and the seeds with high deviation are discarded, so that the global optimum is gradually realized as a whole, the path coverage rate is higher, and the fuzzing test efficiency is improved.

[0058] The above only describes the preferred embodiments of the present application, and it should be noted that for those skilled in the art, without departing from the technical principles of the present application, a number of improvements and modifications can be made, and these improvements and modifications should be regarded as the protection scope of the present application.

Claims

1. A dynamic adaptive strategy based fuzzing method, characterized in that, The method is used for network security vulnerability mining, and comprises the following steps: Step 1. In the initialization stage, the test case capable of discovering a new execution path is marked as a seed, and the breadth index of the seed is completed; Step 2. The program control flow is mapped to a Markov chain; Step 3. The path weight and the depth index value of the seed are calculated based on step 2; Step 4. The dynamic adaptive function is optimized based on steps 1 and 3, and the seed set converges; In step 1, the more code fragments in the program control flow, the more program unknown errors, that is, the program control flow is proportional to the number of program bugs, and two seed breadth index heuristic rules are set; In step 2, the program control flow is mapped to a Markov chain, the path is a state transition process, the fuzzy testing tool AFL performs dynamic insertion at the program branch node to obtain the execution path information, and a complete program control flow graph is formed; In step 3, the weight value of each basic block is calculated, and the weight value of the path is obtained, the total number of basic blocks passed by a single seed execution path is BLK(s), and the depth index value of a single seed is calculated as shown in formula (1): In step 4, according to the program execution characteristics, the breadth index value of the seed is calculated in the early stage, and the depth index value is calculated in the later stage, for a single seed, the threshold value of the depth index and the breadth index of the seed is found, in different threshold value intervals, the index value is calculated, according to the depth index value calculation method, the fitness of the seed is finally calculated; The calculation formula of the fitness index_fit of the seed is shown in formula (2): wherein, is a set fitness threshold, according to the program control flow graph size, μ represents the number of path segments that the seed can select; index_value_wide is the breadth index value of the seed; In the dynamic fuzzy testing process, the seed is continuously mutated to generate new test cases, a new seed set is formed, according to the fitness calculation method of the seed, the seeds not meeting the requirements are continuously removed from the seed set, and the fuzzy testing is optimized.

2. The method of claim 1, wherein, The two seed breadth index heuristic rules include:

1. The more new path fragments discovered by a single seed, the greater the probability of new path discovery by the seed offspring mutation; 2. The more code blocks spanned by a single seed in the execution flow, the more complex the control flow execution, and the closer to the program exception; based on the above two seed breadth index heuristic rules, the calculation formula of the breadth index value of the seed is shown in formula (3): where i is the index of the seed in the current basic block optional execution path segment, 2 cycle(i) / 2 represents the number of optional new paths for the seed when the first path traversal.

3. The method of claim 2, wherein, The calculation formula of the path branch probability is shown in formula (4): X represents that X test cases pass the path branch AB from basic block A to basic block B, and Y represents that Y test cases do not pass the path branch AB from A to B.

4. The method of claim 3, wherein, The weight value of a single seed on each path represents the depth index value of the seed, and the calculation formula of the probability of the basic block according to the path branch probability is shown in formula (5): B is a basic block, JB is a path segment from basic block J to B, J(B) is a basic block set directly connected to the given basic block B, the basic blocks in J(B) can directly reach the basic block B through a state transition, P(R) represents the probability of selecting the basic block R, P(B) is the proportion of the seed passing through the basic block B after one fuzzy testing cycle, and P(JB) represents the probability of passing through the path from J to B.

5. The method of claim 1, wherein, In the process of updating the seed set constantly, the firefly algorithm is used to continue optimizing the seed set, and the path explosion problem is alleviated.

Images