Test case adaptive mutation method and system based on double-population crossover learning

Abstract

The application provides a test case adaptive mutation method based on double population crossover learning, comprising: compiling and inserting a program source code of a measured object; obtaining a data packet flow of a measured protocol and loading into a seed queue as a starting point of a fuzzy test process; adopting a test case adaptive mutation algorithm based on double population crossover learning, dividing seeds of each iteration into high-quality seeds and low-quality seeds according to quality degrees, respectively executing different mutation strategies, and expanding a global possible solution search surface; monitoring a system, a memory and a CPU survival state of a program, recording seeds causing abnormality of a target program or system crash, seeds generating new branch paths or seeds generating new state conversions; evaluating seed mutation strategies according to monitoring results, measuring and calculating quality degrees of seeds causing program abnormality, system crash, new branch paths or state conversions, increasing quality degree reward values of the seeds in an iteration process, and obtaining a test global optimal solution.

Description

Technical Field

[0001] This invention relates to the field of network security testing technology, specifically to a test case adaptive mutation method and system based on dual-population cross-learning. Background Technology

[0002] Fuzzing detects abnormal behavior, such as crashes, downtime, or denial-of-service, by sending modified and altered abnormal inputs to objects implementing a protocol. This allows for the timely discovery of security vulnerabilities within the protocol. The seed file is a key factor affecting the performance and reliability of protocol fuzzing. By modifying the seed structure to generate test cases and inputting them into the object under test, the coverage space of all possible execution paths is explored, improving test path coverage and thus increasing the probability of discovering protocol vulnerabilities.

[0003] The seed mutation strategy in fuzzing has been around for a long time. The traditional approach is to use open-source fuzzing tools, including AFL, AFL++, and EPF. However, these tools have poor scalability and flexibility. For example, AFL++'s mutation strategies are fixed, such as bitflip (flipping bits to 0 or 1), arithmetic (addition and subtraction based on arithmetic operations), dictionary (replacing automatically generated or user-provided token values), and havoc (performing destructive random mutations). These mutation strategies are very indiscriminate, not sensitive to the input format of the target protocol, and difficult to generate complex protocol structures. As a result, a large number of mutated test cases cannot pass the format verification of the device under test and are directly discarded. The test case failure rate is high, and the path coverage is not significantly improved.

[0004] In recent years, the focus in the field of protocol fuzzing has mainly been on improving the efficiency of fuzz test cases or increasing the coverage of fuzz test paths. For example, patent number CN116170181A discloses a network protocol fuzzing method and system based on state and message awareness. During the testing process, a global message pool is created and maintained for the target state of the protocol under test, and infix messages are extracted from the message sequence. The value score of each message is evaluated based on its given value, and messages with high value scores are selected for mutation operations. Another example is patent number CN107193731A, which uses a controlled mutation fuzzing coverage improvement method. It uses instrumentation technology to provide feedback on the test case generation process, and combines random mutation and controlled mutation methods to optimize test case generation and improve coverage. Patent number CN116305162A discloses adding a concurrent vulnerability guidance mechanism and input judgment method to AFL, and pruning infeasible paths to remove seeds with low coverage. Such patents use fuzzy testing methods oriented towards coverage improvement. After introducing coverage feedback information, they tend to select seeds with high coverage. Although they can continuously perform program exploration according to the preset mutation strategy, they lack a standard for judging the quality of individual seeds. This may cause low-coverage seeds to be missed or discarded, and thus fail to trigger new paths.

[0005] On the other hand, some studies have taken a different approach. For example, patent number CN115934544A discloses a hybrid fuzzing method and system based on multi-seed selection, calculating seed returns to explore more tested branches; patent number CN202310229160.2 discloses an industrial control protocol fuzzing optimization method based on coverage guidance, introducing the concept of coverage guidance tracking, encoding coverage boundaries, and self-reporting when new coverage is generated in test cases. These patents globally screen test cases in the seed pool, but the effectiveness monitoring, evaluation, and feedback of the global mutation strategy for the screened test cases can be further optimized. Some patents also have limitations in protocol scope (such as in the industrial control field). In summary, even low-quality seeds have a certain probability of triggering new paths. Protocol fuzzing should not only focus on the quality of seeds globally but also combine coverage feedback mechanisms such as seed strategy effectiveness evaluation.

[0006] Therefore, there is a need for an adaptive mutation method and system for test cases based on dual-population cross-learning, which can transform the problem of guiding the coverage of high-quality seeds in protocol fuzz testing into the problem of optimizing the coverage of all seed test cases, expanding from local optimization to global optimization, and improving testing efficiency without adding additional dominance parameters. Summary of the Invention

[0007] The purpose of this invention is to provide a test case adaptive mutation method and system based on dual-population crossover learning, in order to solve the technical problems existing in the background art.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] An adaptive mutation method for test cases based on dual-population crossover learning includes:

[0010] Compile and instrument the program source code of the object under test;

[0011] The data packet traffic of the protocol under test is acquired and loaded into the seed queue as the starting point of the fuzzing process;

[0012] An adaptive mutation algorithm for test cases based on dual-population crossover learning is adopted. The seeds in each iteration are divided into high-quality seeds and low-quality seeds according to their quality scores, and different mutation strategies are executed for each seed to expand the global search surface of possible solutions.

[0013] Monitor the memory and CPU status of the system and program, and record the seeds that cause the target program to malfunction or the system to crash, the seeds that generate new branch paths, or the seeds that generate new state transitions.

[0014] The seed mutation strategy is evaluated based on the monitoring results. For seeds that cause program anomalies, system crashes, generate new branch paths, or state transitions, their quality score is calculated, and their quality score reward value is increased during the iteration process to obtain the test global optimal solution.

[0015] In some embodiments, compiling and instrumenting the program source code of the object under test includes:

[0016] Obtain the source code file of the program whose source code needs to be fuzz tested, and use the preset compilation tool to perform static instrumentation compilation on the target program to generate the corresponding binary executable file;

[0017] The program runs as a binary executable file, obtains the data stream after instrumentation, and allocates a certain amount of shared memory space for real-time statistics of the code coverage information of the protocol under test.

[0018] In some embodiments, acquiring the data packet traffic of the protocol under test and loading it into a seed queue as the starting point of the fuzzing process includes:

[0019] Different types of protocol data packets are defined as different protocol groups, and protocol data packets of the same type but different states are defined as different populations of the protocol. Each test case of each protocol is a test seed individual of the protocol, the set of all seed individuals is called the seed queue of the protocol, and the different fields of each test seed are called the chromosome of the seed.

[0020] The data packets of the protocol under test are obtained using a preset packet capture tool. The attribute information of each component chromosome of each protocol seed individual is parsed using a preset module package to construct the initial test seed corpus of the protocol.

[0021] In some embodiments, the adaptive mutation algorithm for test cases based on dual-population crossover learning, which divides the seeds in each iteration into high-quality seeds and low-quality seeds according to their quality score, and executes different mutation strategies for each seed to expand the global search surface for possible solutions, includes:

[0022] Before each round of testing, the population of all protocols is initialized, including: the test population of each protocol is divided into high-quality subpopulation and low-quality subpopulation according to a preset ratio, representing the high and low code path coverage respectively;

[0023] Define a quality score parameter for each test seed. All seeds start with a quality score of 0. After each iteration, seeds with high code coverage are rewarded. Seeds with high code coverage will have their quality score increase with the reward during the continuous mutation process.

[0024] In the next test iteration, all test seeds with quality scores below the quality score threshold are divided into a low-quality population. Seeds in the low-quality population are mutated based on a probability function to obtain a new population.

[0025] New populations were obtained by using cross-cooperative mutation methods on high-quality populations.

[0026] The newly obtained populations are merged to generate all seed test cases;

[0027] Repeat the above steps until the stopping iteration condition is met.

[0028] In some embodiments, the step of dividing all test seeds with quality scores below a quality score threshold into a low-quality population in the next test iteration, and mutating the seeds in the low-quality population based on a probability function to obtain a new population includes:

[0029] If the code coverage of a low-quality seed is Cov(i) in the i-th iteration, and if Cov(i+1) > Cov(i) in the (i+1)-th iteration, then the quality score of the seed is rewarded and the seed quality score Q(i) is updated to Q`(i).

[0030] When Q`(i) reaches the low-quality population quality threshold limit M(i), the (i+1)th seed individual of this protocol is added to the high-quality population with the state transition probability. The value of the low-quality population quality threshold limit M(i) is determined by the seed ratio Pr(i) entering the low-quality population in this round of iteration, and Q(i-1)->Pr(i)->M(i)->Q(i).

[0031] In some embodiments, obtaining a new population by using a cross-cooperative mutation method on a high-quality population includes:

[0032] Based on hybridization variation: Randomly select two data packets from the high-quality seed queue, randomly select a field in the data packet, use this as the dividing line, and splice the first half of the first data packet with the second half of the second data packet to obtain the first new population.

[0033] Based on the first new population, a certain field is selected for mutation using a custom probability function, and a random value is generated for that field to obtain a second new population.

[0034] In some embodiments, the monitoring system, the program's memory and CPU survival status, and the recording of seeds that cause the target program to malfunction or the system to crash, seeds that generate new branch paths, or seeds that generate new state transitions include:

[0035] The new population obtained from high-quality population mutation is used as the input test case into the program. Fuzz testing is then initiated, and the memory and CPU survival status of the system and program are monitored during the testing process.

[0036] In response to a preset situation, the abnormal result, protocol name, current seed quality, seed execution path and seed ID are recorded, and the seed is saved to a separate file. This result is a local optimization result. The preset situation includes at least one of the following: the occurrence of a seed that causes the target program to malfunction or the system to crash, the generation of a seed with a new path overlay, and the generation of a seed with a new state transition.

[0037] In some embodiments, the step of evaluating the seed mutation strategy based on monitoring results, calculating the quality score of seeds that cause program anomalies, system crashes, generate new branch paths, or state transitions, and increasing their quality score reward value during iteration to obtain the globally optimal solution includes:

[0038] In response to the fact that the program generates a total of M test cases from all seeds during the fuzzing process, and N test cases exhibit the preset situation, and each seed has k mutation operations, the probability of each mutation operation being selected is {Pb1, Pb2, ..., Pbk}, and the number of each mutation operation in the N test cases is {N1, N2, ..., Nk}, respectively. The probability of each mutation operation generating a new coverage path, program crash, or state transition is determined as: Qi = Ni / N, i∈(0,k). Then, for the i-th mutation operation, the number of test cases generated is M*Pbi, that is, the probability of the i-th mutation operation producing the preset situation is: Ci = M*Pbi / N*Qi, that is, the one with higher Ci is selected as the evaluation criterion for the effectiveness of each mutation operation.

[0039] For seeds that induce collapse or increase coverage paths, their quality score is increased during the iterative feedback process. The calculation method is Q` = Q + C1*R1(Qa_best-Q) + C2*R2(Qb_best-Q), where Q is the quality score in the current iteration; C1 and C2 are the individual and population learning factors, respectively, set to random values ​​in the interval [0,1]; Qa_best represents the quality score when the individual in the high-quality population has the highest coverage during the fuzzing process, i.e., the quality score at the current local optimum; Qb_best represents the quality score of the individual that can achieve the highest coverage among all individuals during the fuzzing process, i.e., the quality score at the current global optimum; finally, Q` is the initial value of the quality score of the next round of seeds.

[0040] Based on the aforementioned evaluation calculations, the quality score results are continuously fed back into the tests for further iteration until the complete set of valid test cases for outputting code path coverage is completed.

[0041] The test ends when the maximum number of iterations is reached, at which point the optimal solution for the set of all valid test cases is obtained based on the iteration results.

[0042] Meanwhile, this invention also discloses a test case adaptive mutation system based on dual-population crossover learning, comprising:

[0043] The program preprocessing module is used to compile and instrument the program source code of the object under test;

[0044] The seed acquisition module is used to acquire the data packet traffic of the protocol under test and load it into the seed queue, which serves as the starting point of the fuzz testing process.

[0045] The test seed mutation module is used to adopt a test case adaptive mutation algorithm based on dual-population crossover learning. It divides the seeds of each iteration into high-quality seeds and low-quality seeds according to their quality score, and executes different mutation strategies for each seed to expand the global possible solution search surface.

[0046] The program monitoring module is used to monitor the memory and CPU status of the system and program, and record the seeds that cause the target program to malfunction or the system to crash, the seeds that generate new branch paths, or the seeds that generate new state transitions.

[0047] The mutation strategy evaluation and feedback module is used to evaluate seed mutation strategies based on monitoring results. For seeds that cause program exceptions, system crashes, generate new branch paths, or state transitions, its quality score is calculated, and its quality score reward value is increased during the iteration process to obtain the globally optimal solution for testing.

[0048] Meanwhile, the present invention also discloses a test case adaptive mutation device based on dual-population crossover learning. The device includes a processor and a memory. The memory is used to store instructions. When the instructions are executed by the processor, the device causes the device to implement any of the aforementioned test case adaptive mutation methods based on dual-population crossover learning.

[0049] Meanwhile, the present invention also discloses a computer-readable storage medium that stores computer instructions. When a computer reads the computer instructions in the storage medium, the computer runs the test case adaptive mutation method based on dual-population crossover learning described above.

[0050] Beneficial effects

[0051] The significant advantages of this invention compared to existing technologies are:

[0052] This invention employs an adaptive mutation method for fuzzy test cases based on dual-population cross-learning, introducing heuristic ideas to improve code coverage and testing efficiency. Compared to existing fuzzing tools such as AFL, AFL++, and EPF, this invention effectively solves the problems of blind mutation and high test case failure rates in traditional fuzzers. Within the same testing time, this invention evaluates and scores the effectiveness of mutation strategies for global test cases, exploring more code paths and offering significant efficiency improvements and scenario adaptability compared to traditional methods. Attached Figure Description

[0053] Figure 1 This is a schematic diagram of a test case adaptive mutation system based on dual-population crossover learning in this embodiment;

[0054] Figure 2 This is a flowchart illustrating the adaptive mutation method for test cases based on dual-population crossover learning involved in this embodiment;

[0055] Figure 3 This is a deployment diagram of the test case adaptive mutation system based on dual-population crossover learning according to an embodiment of the present invention;

[0056] Figure 4 This is a schematic diagram illustrating the implementation process of the adaptive mutation method for test cases based on dual-population crossover learning, according to an embodiment of the present invention.

[0057] Figure 5 This is a schematic diagram of population variation in an embodiment of the present invention. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0059] Conversely, this application covers any substitutions, modifications, equivalent systems, and solutions made within the spirit and scope of this application as defined in the claims. Furthermore, to provide the public with a better understanding of this application, certain specific details are described in detail below. However, this application can be fully understood by those skilled in the art even without these detailed descriptions.

[0060] The following will combine Figure 1-5 This application provides a detailed description of a test case adaptive mutation method and system based on dual-population crossover learning, as illustrated in the embodiments of this application. It is worth noting that the following embodiments are merely illustrative of this application and do not constitute a limitation thereof.

[0061] Example 1

[0062] like Figure 1 The diagram shown is a schematic of the test case adaptive mutation system 100 based on dual-population crossover learning in this embodiment. Figure 3 This is a deployment diagram of the test case adaptive mutation system based on dual-population crossover learning according to an embodiment of the present invention; as shown below. Figure 1 As shown, the test case adaptive mutation system 100 based on dual-population crossover learning includes:

[0063] The program preprocessing module 110 is used to compile and instrument the program source code of the object under test. For example, the program preprocessing module 110 can compile and instrument the program source code of the object under test, and typically uses afl-clang-fast to perform static instrumentation compilation of the target program.

[0064] The seed acquisition module 120 is used to acquire the data packet traffic of the protocol under test and load it into the seed queue as the starting point of the fuzzing process.

[0065] In some embodiments, the seed acquisition module 120 can acquire the data packet traffic of the protocol under test. For example, it typically uses Wireshark or tcpdump to filter and decompose the .pacp protocol and load it into the seed queue, which becomes the starting point of the fuzzing process.

[0066] The test seed mutation module 130 is used to adopt a test case adaptive mutation algorithm based on dual-population crossover learning. It divides the seeds of each iteration into high-quality seeds and low-quality seeds according to their quality scores, and executes different mutation strategies for each seed to expand the global search surface of possible solutions.

[0067] In some embodiments, the test seed mutation module 130 may employ a fuzzy test case adaptive mutation algorithm based on dual-population cross-learning to divide the seeds of each iteration into high-quality seeds and low-quality seeds according to their quality scores, and execute different mutation strategies for each seed to expand the global search surface for possible solutions.

[0068] In some embodiments, the test seed mutation module 130 can separately count the number of new program execution paths triggered by all seeds generated by each mutation strategy and the number of program exceptions triggered by that seed. The number of program execution paths is calculated using code instrumentation, and the number of program exceptions is calculated by monitoring and calculating the relevant processes of the test target using a debugger. Based on the effectiveness evaluation results of the mutation strategy, a quality score concept and formula are proposed, dividing all seed test cases into high path coverage test cases (high-quality population) and low path coverage test cases (low-quality population).

[0069] The program monitoring module 140 is used to monitor the memory and CPU status of the system and program, and record the seeds that cause the target program to malfunction or the system to crash, the seeds that generate new branch paths, or the seeds that generate new state transitions.

[0070] The mutation strategy evaluation and feedback module 150 is used to evaluate the seed mutation strategy based on the monitoring results. For seeds that cause program abnormalities, system crashes, generate new branch paths, or state transitions, its quality score is calculated, and its quality score reward value is increased during the iteration process to obtain the test global optimal solution.

[0071] In some embodiments, the mutation strategy evaluation and feedback module 150 can divide the population into high-quality subpopulations and low-quality subpopulations based on the feedback results of each iteration, according to the test case coverage. The low-quality subpopulations are added to the high-quality subpopulations with a certain mutation probability function, focusing on finding possible high-coverage solution regions and improving the mutation strategy; the high-quality subpopulations adopt a cross-cooperative learning mechanism, randomly mutating the local optimal solution and the historical global optimal solution of the seed at different positions according to the protocol rule field. Each test seed parent individual can cross-mutate to generate new test child individuals, which are then put into testing to guide the entire particle swarm to perform a global search to find the optimal solution, thereby improving the code path test coverage and the quality of the test seed.

[0072] It should be noted that the above description of the test case adaptive mutation system and its modules based on dual-population crossover learning is for convenience only and should not be construed as limiting this specification to the scope of the embodiments described. It is understood that those skilled in the art, after understanding the principles of this system, may arbitrarily combine the various modules or construct subsystems connected to other modules without departing from these principles. In some embodiments, Figure 1 The preprocessing module 110 and seed acquisition module 120 disclosed herein can be different modules within a single system, or a single module can implement the functions of two or more of the aforementioned modules. For example, the modules can share a single storage module, or each module can have its own separate storage module. Such variations are all within the scope of protection of this specification.

[0073] like Figure 2 The diagram shown is a schematic of the flow 200 of the test case adaptive mutation method based on dual-population crossover learning in this embodiment. Figure 4 This is a schematic diagram illustrating the implementation process of the adaptive mutation method for test cases based on dual-population crossover learning, according to an embodiment of the present invention.

[0074] In some embodiments, process 200 can be executed based on a test case adaptive mutation system 100 using dual-population crossover learning. For example... Figure 2 and Figure 4 As shown, process 200 includes:

[0075] Step 210: Compile and instrument the program source code of the object under test.

[0076] In some embodiments, step 210 includes the following operations:

[0077] Step 211: Obtain the source code file of the program source code that needs to be fuzzed, and use the preset compilation tool to perform static instrumentation compilation on the target program to generate the corresponding binary executable file.

[0078] For example, obtain the source code file that needs to be fuzzed, and use the clang compiler afl-clang-fast of AFL++ to statically instrument the target program and generate the corresponding binary executable file.

[0079] Step 212 involves running a binary executable file to obtain the instrumented data stream, while simultaneously allocating a certain size of shared memory space for real-time statistics of the code coverage information of the protocol under test.

[0080] For example, run the binary executable file generated in step 211 to obtain the data stream after instrumentation, and at the same time allocate a certain size of shared memory space for real-time statistics of the code coverage information of the protocol under test (generally, the size of the shared memory space is 64KB, and 64KB has 65536 branches, which can meet the requirements of most protocol entity program coverage statistics).

[0081] Step 220: Obtain the data packet traffic of the protocol under test and load it into the seed queue as the starting point of the fuzzing process.

[0082] In some embodiments, step 220 includes the following steps:

[0083] Step 221: Define different types of protocol data packets as different protocol groups, and protocol data packets of the same type but different states as different populations of the protocol. Each test case of each protocol is a test seed individual of the protocol, the set of all seed individuals is called the seed queue of the protocol, and the different fields of each test seed are called the chromosome of the seed.

[0084] For example, different types of protocol packets (such as DNS protocol, Modbus protocol) are defined as different protocol groups, and protocol packets of the same type but different states are defined as different populations of the protocol (such as distinguishing between high-quality population and low-quality population based on code coverage). Each test case of each protocol is a test seed individual of the protocol, the set of all seed individuals is called the seed queue of the protocol, and the different fields of each test seed are called the chromosome of the seed.

[0085] Step 222: Use a preset packet capture tool to obtain the data packets of the protocol under test, and use a preset module package to parse the attribute information of each component chromosome of each protocol seed individual to construct the initial test seed corpus of the protocol.

[0086] For example, use packet capture tools such as Wireshark and tcpdump to obtain data packets of the protocol under test, and use the Scapy module package to parse out the position, meaning, word length, symbols, etc. of each component chromosome of each protocol seed individual to build an initial test seed corpus for the protocol.

[0087] Step 230: Adaptive mutation algorithm for test cases based on dual-population crossover learning is adopted. The seeds of each iteration are divided into high-quality seeds and low-quality seeds according to their quality scores, and different mutation strategies are executed for each seed to expand the global search surface of possible solutions.

[0088] In some embodiments, step 230 includes the following steps:

[0089] Step 231: Before each round of testing, initialize the population of all protocols, including: the test population of each protocol is divided into high-quality subpopulation and low-quality subpopulation according to a preset ratio, representing the high and low code path coverage respectively.

[0090] For example, in each round of testing, the populations for all protocols need to be initialized. The test population for each protocol is divided into two subpopulations according to a certain ratio Pr: a high-quality subpopulation and a low-quality subpopulation, representing the level of code path coverage, respectively. Pr is determined by the quality ranking of each seed from the previous iteration and is generally set to a fixed constant.

[0091] Step 232: Define the quality score parameter for each test seed. The initial quality score of all seeds is 0. After each iteration, the quality score of seeds with high code coverage is rewarded. The quality score of seeds with high code coverage will continue to increase with the reward during the continuous mutation process.

[0092] For example, each test seed is defined with a quality score parameter, representing the level of code coverage achieved by that seed during testing. All seeds initially have a quality score of 0. After each iteration, seeds with high code coverage are rewarded with a quality score, which increases continuously as the seed undergoes further mutation.

[0093] Step 233: In the next test iteration, all test seeds with quality scores below the quality score threshold are divided into low-quality populations. Seeds in the low-quality populations are mutated based on a probability function to obtain a new population.

[0094] For example, all test seeds with a quality score below the threshold will be classified as low-quality populations in the next test iteration. Seeds in the low-quality populations will not be eliminated, but will be mutated based on a probability function.

[0095] In some embodiments, step 233 includes the following steps:

[0096] Step 2331: If the code coverage of a low-quality seed in the i-th iteration is Cov(i), and if Cov(i+1)>Cov(i) occurs in the (i+1)-th iteration, then reward the quality score of the seed and update the seed quality score Q(i) to Q`(i).

[0097] Step 2332: When Q`(i) reaches the low-quality population quality threshold limit M(i), the (i+1)th seed individual of the protocol is added to the high-quality population with the state transition probability. The value of the low-quality population quality threshold limit M(i) is determined by the seed ratio Pr(i) entering the low-quality population in this iteration, and Q(i-1)->Pr(i)->M(i)->Q(i).

[0098] Step 234: Use the cross-cooperative mutation method on the high-quality population to obtain a new population.

[0099] like Figure 5 The diagram shown illustrates population variation in an embodiment of the present invention.

[0100] In some embodiments, step 234 includes the following steps:

[0101] Step 2341, based on hybridization variation: randomly select two data packets from the high-quality seed queue, randomly select a field in the data packets, use this as a separator, and splice the first half of the first data packet with the second half of the second data packet to obtain the first new population.

[0102] For example, arbitrarily select two data packets from the high-quality seed queue. Knowing all the fields of the protocol in step 2.2, randomly select one field as the separator T. Concatenate the first half of the first data packet with the second half of the second data packet, generating a new offspring from the two parent packets. That is, offspring Z = T × parent X + T` × parent Y, where T + T` = all protocol fields. Protocol features are usually located in the first half of the protocol and generally contain key information such as the sender, receiver, and type of the data packet. The data packet type can be used to identify the protocol group. Therefore, after crossover and mutation, the offspring inherits from the parent that provided the first half of the protocol's characteristics.

[0103] Step 2342: Based on the first new population, select a field for mutation using a custom probability function, generate a random value for that field, and obtain the second new population.

[0104] For example, based on hybridization mutation, a field can be selected for mutation using the randval() function with a custom probability, generating a value for that field that is both random and suitable for it.

[0105] Step 235: Merge the newly obtained population to generate all seed test cases.

[0106] For example, the new mutant seeds generated in steps 232-234 are merged to generate all seed test cases.

[0107] Step 236: Repeat the above steps until the stopping iteration condition is met.

[0108] For example, until the number of cycles or the seed quality is not lower than a preset threshold.

[0109] Step 240: Monitor the memory and CPU status of the system and program, and record the seeds that cause the target program to malfunction or the system to crash, the seeds that generate new branch paths, or the seeds that generate new state transitions.

[0110] In some embodiments, step 240 includes the following steps:

[0111] Step 241: Input the new population obtained from high-quality population mutation into the test case program, start fuzz testing, and monitor the memory and CPU survival status of the system and program during the test.

[0112] Step 242: In response to the occurrence of a preset situation, record the abnormal result, protocol name, current seed quality, seed execution path and seed ID, and save the seed to a separate file. This result is a local optimization result. The preset situation includes at least one of the following: the occurrence of a seed that causes the target program to malfunction or the system to crash, the occurrence of a seed that generates a new path overlay, and the occurrence of a seed that generates a new state transition.

[0113] Step 250: Evaluate the seed mutation strategy based on the monitoring results. For seeds that cause program anomalies, system crashes, generate new branch paths, or state transitions, calculate their quality score and increase their quality score reward value during the iteration process to obtain the test global optimal solution.

[0114] In some embodiments, step 250 includes the following steps:

[0115] Step 251: In response to the fact that the program generated a total of M test cases from all seeds during the fuzzing process, and N test cases showed the preset situation, each seed is set to have k mutation operations, and the probability of each mutation operation being selected is {Pb1, Pb2, ..., Pbk}. The number of each mutation operation in the N test cases is {N1, N2, ..., Nk} respectively. The probability of each mutation operation generating a new coverage path, program crash, or state transition is determined as: Qi = Ni / N, i∈(0,k). Then, for the i-th mutation operation, the number of test cases generated is M*Pbi, that is, the probability of the i-th mutation operation producing the preset situation is: Ci = M*Pbi / N*Qi. That is, the one with higher Ci is selected as the evaluation criterion for the effectiveness of each mutation operation.

[0116] Step 252: For seeds that induce collapse or increase coverage paths, their quality score is increased during the iterative feedback process. The calculation method is Q` = Q + C1*R1(Qa_best-Q) + C2*R2(Qb_best-Q), where Q is the quality score in the current iteration; C1 and C2 are the individual and population learning factors, respectively, set to random values ​​in the interval [0,1]; Qa_best represents the quality score when the individual in the high-quality population has the highest coverage during the fuzzing process, i.e., the quality score at the current local optimum; Qb_best represents the quality score of the individual that can achieve the highest coverage among all individuals during the fuzzing process, i.e., the quality score at the current global optimum; finally, Q` is the initial value of the quality score of the next round of seeds. According to the above formula, the quality score of each seed can be continuously iterated during the testing process.

[0117] Step 253: Based on the aforementioned evaluation calculation, the quality score results are continuously fed back into the test for further iteration until the complete set of valid test cases for outputting code path coverage is completed.

[0118] Step 254: In response to reaching the maximum number of iterations, the test ends. At this point, the optimal solution for the global set of all valid test cases is obtained based on the iteration results.

[0119] Meanwhile, the present invention also discloses a test case adaptive mutation device based on dual-population crossover learning. The device includes a processor and a memory. The memory is used to store instructions. When the instructions are executed by the processor, the device causes the device to implement the test case adaptive mutation system based on dual-population crossover learning described above.

[0120] Meanwhile, the present invention also discloses a computer-readable storage medium that stores computer instructions. When a computer reads the computer instructions in the storage medium, the computer runs the test case adaptive mutation system based on dual-population crossover learning described above.

[0121] In summary, the technical solution of this invention can employ a seed mutation strategy evaluation algorithm in the seed mutation strategy evaluation module and an adaptive mutation algorithm for fuzzy test cases based on dual-population cross-learning in the seed mutation strategy optimization module. This solves the problems of lacking dynamic adaptive construction of effective mutation strategies, high test case failure rate, and low code coverage in protocol fuzzing scenarios. It transforms the problem of prioritizing high-quality seed coverage in protocol fuzzing into an optimization problem of the coverage of all seed test cases, expanding from local optimization to global optimization, and improving testing efficiency without adding additional dominance parameters.

[0122] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A test case adaptive mutation method based on dual-population crossover learning, characterized in that, include: Compile and instrument the program source code of the object under test; The data packet traffic of the protocol under test is acquired and loaded into the seed queue as the starting point of the fuzzing process; An adaptive mutation algorithm for test cases based on dual-population crossover learning is adopted. The seeds in each iteration are divided into high-quality seeds and low-quality seeds according to their quality score, and different mutation strategies are executed for each seed to expand the global search surface of possible solutions. Monitor the memory and CPU status of the system and program, and record the seeds that cause the target program to malfunction or the system to crash, the seeds that generate new branch paths, or the seeds that generate new state transitions. The seed mutation strategy is evaluated based on the monitoring results. For seeds that cause program abnormalities, system crashes, generate new branch paths, or state transitions, their quality score is calculated, and their quality score reward value is increased during the iteration process to obtain the test global optimal solution. The specific steps to obtain the global optimal solution for the test include: In response to the fact that the program generates a total of M test cases for all seeds during the fuzzing process, and N test cases have a preset situation, each seed is set to have k mutation operations, and the probability of each mutation operation being selected is {Pb1, Pb2, ..., Pbk}, and the number of each mutation operation in the N test cases is {N1, N2, ..., Nk}, respectively. The probability of each mutation operation generating a new coverage path, program crash, or state transition is determined as: Qi = Ni / N, i∈(0,k). Then, for the i-th mutation operation, the number of test cases it generates is M*Pbi, that is, the probability of the i-th mutation operation generating the preset situation is: Ci = M*Pbi / N*Qi, that is, the one with higher Ci is selected as the evaluation criterion for the effectiveness of each mutation operation. For seeds that induce collapse or increase coverage paths, their quality score is increased during the iterative feedback process. The calculation method is Q`=Q+C1*R1(Qa_best-Q)+C2*R2(Qb_best-Q), where Q is the quality score in the current iteration; C1 and C2 are the individual and population learning factors, respectively, set to random values ​​in the interval [0,1]; Qa_best represents the quality score when the individual in the high-quality population has the highest coverage during the fuzzing process, i.e., the quality score at the current local optimum; Qb_best represents the quality score of the individual that can achieve the highest coverage among all individuals during the fuzzing process, i.e., the quality score at the current global optimum; finally, Q` is the initial value of the quality score of the next round of seeds. Based on the aforementioned evaluation calculations, the quality score results are continuously fed back into the tests for further iteration until the complete set of valid test cases for outputting code path coverage is completed. The test ends when the maximum number of iterations is reached, at which point the optimal solution for the set of all valid test cases is obtained based on the iteration results.

2. The method according to claim 1, characterized in that, The compilation and instrumentation of the program source code of the object under test includes: Obtain the source code file of the program whose source code needs to be fuzz tested, and use the preset compilation tool to perform static instrumentation compilation on the target program to generate the corresponding binary executable file; The program runs as a binary executable file, obtains the data stream after instrumentation, and allocates a certain amount of shared memory space for real-time statistics of the code coverage information of the protocol under test.

3. The method according to claim 2, characterized in that, The process of acquiring the data packet traffic of the protocol under test and loading it into the seed queue, serving as the starting point of the fuzzing process, includes: Different types of protocol data packets are defined as different protocol groups, and protocol data packets of the same type but different states are defined as different populations of the protocol. Each test case of each protocol is a test seed individual of the protocol, the set of all seed individuals is called the seed queue of the protocol, and the different fields of each test seed are called the chromosome of the seed. The data packets of the protocol under test are obtained using a preset packet capture tool. The attribute information of each component chromosome of each protocol seed individual is parsed using a preset module package to construct the initial test seed corpus of the protocol.

4. The method according to claim 3, characterized in that, The test case adaptive mutation algorithm based on dual-population crossover learning divides the seeds in each iteration into high-quality seeds and low-quality seeds according to their quality score, and executes different mutation strategies for each, expanding the global search surface for possible solutions, including: Before each round of testing, the population of all protocols is initialized, including: the test population of each protocol is divided into high-quality subpopulation and low-quality subpopulation according to a preset ratio, representing the high and low code path coverage respectively; Define a quality score parameter for each test seed. All seeds start with a quality score of 0. After each iteration, seeds with high code coverage are rewarded. Seeds with high code coverage will have their quality score increase with the reward during the continuous mutation process. In the next test iteration, all test seeds with quality scores below the quality score threshold are divided into a low-quality population. Seeds in the low-quality population are mutated based on a probability function to obtain a new population. New populations were obtained by using cross-cooperative mutation methods on high-quality populations. The newly obtained populations are merged to generate all seed test cases; Repeat the above steps until the stopping iteration condition is met.

5. The method according to claim 4, characterized in that, The process of classifying all test seeds with quality scores below the quality score threshold into a low-quality population in the next test iteration, and then mutating the seeds in the low-quality population based on a probability function to obtain a new population includes: If the code coverage of a low-quality seed is Cov(i) in the i-th iteration, and if Cov(i+1)>Cov(i) occurs in the (i+1)-th iteration, then the quality score of the seed is rewarded and the seed quality score Q(i) is updated to Q`(i). When Q`(i) reaches the low-quality population quality threshold limit M(i), the (i+1)th seed individual of this protocol is added to the high-quality population with the state transition probability. The value of the low-quality population quality threshold limit M(i) is determined by the seed ratio Pr(i) entering the low-quality population in this round of iteration, and Q(i-1)->Pr(i)->M(i)->Q(i).

6. The method according to claim 4, characterized in that, The method of obtaining a new population by cross-cooperative mutation of a high-quality population includes: Based on hybridization variation: Randomly select two data packets from the high-quality seed queue, randomly select a field in the data packet, use this as the dividing line, and splice the first half of the first data packet with the second half of the second data packet to obtain the first new population. Based on the first new population, a certain field is selected for mutation using a custom probability function, and a random value is generated for that field to obtain a second new population.

7. The method according to claim 4, characterized in that, The monitoring system records the memory and CPU status of the program, including seeds that cause the target program to malfunction or the system to crash, seeds that generate new branch paths, or seeds that generate new state transitions. The new population obtained from high-quality population mutation is used as the input test case into the program. Fuzz testing is then initiated, and the memory and CPU survival status of the system and program are monitored during the testing process. In response to a preset situation, the abnormal result, protocol name, current seed quality, seed execution path and seed ID are recorded, and the seed is saved to a separate file. This result is a local optimization result. The preset situation includes at least one of the following: the occurrence of a seed that causes the target program to malfunction or the system to crash, the generation of a seed with a new path overlay, and the generation of a seed with a new state transition.

8. A test case adaptive mutation system based on dual-population crossover learning, characterized in that, include: The program preprocessing module is used to compile and instrument the program source code of the object under test; The seed acquisition module is used to acquire the data packet traffic of the protocol under test and load it into the seed queue, which serves as the starting point of the fuzz testing process. The test seed mutation module is used to adopt a test case adaptive mutation algorithm based on dual-population crossover learning. It divides the seeds of each iteration into high-quality seeds and low-quality seeds according to their quality score, and executes different mutation strategies for each seed to expand the global possible solution search surface. The program monitoring module is used to monitor the memory and CPU status of the system and program, and record the seeds that cause the target program to malfunction or the system to crash, the seeds that generate new branch paths, or the seeds that generate new state transitions. The mutation strategy evaluation and feedback module is used to evaluate the seed mutation strategy based on the monitoring results. For seeds that cause program abnormalities, system crashes, generate new branch paths, or state transitions, its quality score is calculated, and its quality score reward value is increased during the iteration process to obtain the test global optimal solution. The specific steps to obtain the global optimal solution for the test include: In response to the fact that the program generates a total of M test cases for all seeds during the fuzzing process, and N test cases have a preset situation, each seed is set to have k mutation operations, and the probability of each mutation operation being selected is {Pb1, Pb2, ..., Pbk}, and the number of each mutation operation in the N test cases is {N1, N2, ..., Nk}, respectively. The probability of each mutation operation generating a new coverage path, program crash, or state transition is determined as: Qi = Ni / N, i∈(0,k). Then, for the i-th mutation operation, the number of test cases it generates is M*Pbi, that is, the probability of the i-th mutation operation generating the preset situation is: Ci = M*Pbi / N*Qi, that is, the one with higher Ci is selected as the evaluation criterion for the effectiveness of each mutation operation. For seeds that induce collapse or increase coverage paths, their quality score is increased during the iterative feedback process. The calculation method is Q`=Q+C1*R1(Qa_best-Q)+C2*R2(Qb_best-Q), where Q is the quality score in the current iteration; C1 and C2 are the individual and population learning factors, respectively, set to random values ​​in the interval [0,1]; Qa_best represents the quality score when the individual in the high-quality population has the highest coverage during the fuzzing process, i.e., the quality score at the current local optimum; Qb_best represents the quality score of the individual that can achieve the highest coverage among all individuals during the fuzzing process, i.e., the quality score at the current global optimum; finally, Q` is the initial value of the quality score of the next round of seeds. Based on the aforementioned evaluation calculations, the quality score results are continuously fed back into the tests for further iteration until the complete set of valid test cases for outputting code path coverage is completed. The test ends when the maximum number of iterations is reached, at which point the optimal solution for the set of all valid test cases is obtained based on the iteration results.

9. A computer-readable storage medium, characterized in that, The storage medium stores computer instructions. When the computer reads the computer instructions, the computer executes the test case adaptive mutation method based on dual-population crossover learning as described in any one of claims 1-7.

Images