A multi-target oriented fuzz testing method and system based on USB driver

Abstract

The present invention provides a multi-target oriented fuzz testing method and system based on USB driver, belonging to the field of system security technology, including: firstly, obtaining a binary file for static analysis and dynamic fuzz testing by preprocessing kernel source code, then using static vulnerability analysis to calculate vulnerability scores for each target function, and finally guiding the total vulnerability scores of the triggered execution path during fuzz testing, so that the fuzz test is carried out in the direction most likely to contain vulnerabilities. The present invention can greatly improve the efficiency of vulnerability mining for USB drivers in the Linux kernel by proposing a prototype system MODFuzz, and safeguard the security of USB devices.

Description

Technical Field

[0001] The present invention relates to the technical field of system security, and in particular to a multi-target oriented fuzzy testing method and system based on USB drive. Background Art

[0002] The Universal Serial Bus (USB) protocol is a plug-and-play protocol that specifies the physical, electrical, and communication standards for connecting devices. It has become a commonly used communication standard for connecting devices to computers or other hardware. USB interfaces are very common and are widely found in small embedded systems, personal computers, and large cloud computing servers. Traditional USB connections require physical contact between devices, but the emergence of innovative technologies such as USBIP allows users to exchange data remotely using the USB protocol over the network.

[0003] The widespread use of USB devices makes the study of their security particularly important. The USB protocol is a master-slave architecture, and multiple USB devices can be connected to the same host at the same time. If there is a vulnerability in the USB driver in the host, then the attacker can attack the host through a maliciously constructed USB device, resulting in denial of service, memory corruption and other serious consequences. Actively discovering unknown vulnerabilities in USB drivers and repairing them in a timely manner can alleviate this potential security risk to a certain extent.

[0004] At present, fuzz testing has been proven to be an effective vulnerability mining method. From the perspective of seed selection strategy, existing fuzzers can be divided into coverage-guided fuzzers and guided fuzzers. Coverage-guided fuzz testing uses code coverage as the main indicator to measure seed quality. Guided fuzzers try to make the execution trace triggered by the seed more focused on the predetermined part of the target. Since the USB driver runs in the operating system kernel space, it is not the best choice to use coverage-guided fuzz testing on it. On the one hand, there are a large number of interrupts and timer tasks in the kernel, which makes the coverage collection of a single thread in the kernel inaccurate. The hot plug of USB devices is an asynchronous event. When USB devices trigger code execution in multiple different contexts, it often leads to large coverage results, which greatly affects the efficiency and accuracy of fuzz testing. Existing schemes have tried to alleviate this problem by saving the execution context on the stack before calling do_IRQ, but this method is not suitable for the latest kernel versions. On the other hand, some studies have pointed out that different parts of the program have different importance for vulnerability mining. The kernel is large in size (there are nearly 200,000 functions in the Linux kernel v6.4.10), but the proportion of drivers that are truly fuzzy-testing-worthy is small. Theoretically, this makes guided fuzzers more suitable for focusing fuzz testing attention on specific USB drivers. As one of the most popular guided fuzzers, distance-based guided fuzzers are proposed to exploit or reproduce vulnerabilities in pre-specified code sections. They are suitable for fuzz testing predetermined parts of a program. However, existing distance-based guided fuzzers cannot be directly used to fuzz USB drivers because they still have defects in binary distance calculation, instrumentation strategy, and automated target selection. Summary of the invention

[0005] The present invention provides a multi-target oriented fuzzy testing method and system based on USB driver, which are used to solve the defects of unreasonable computing resource configuration and low overall efficiency in the USB driver fuzzy testing technology in the prior art.

[0006] In a first aspect, the present invention provides a multi-target oriented fuzz testing method based on a USB driver, comprising:

[0007] Preprocess the target kernel source code to obtain the binary file of the kernel during dynamic runtime;

[0008] Use static vulnerability analysis to calculate the vulnerability risk of the target function corresponding to each binary file, and obtain the vulnerability analysis results of each target function;

[0009] Based on the multi-objective-oriented fuzz test, the vulnerability scores corresponding to the vulnerability analysis results of the objective functions are obtained, and the fuzz test execution path is determined according to the sum of the vulnerability scores.

[0010] According to a multi-target oriented fuzz testing method based on USB driver provided by the present invention, the target kernel source code to be tested is preprocessed to obtain a binary file when the kernel is dynamically running, including:

[0011] Add IVSHMEM driver implementation code to the target kernel source code to be tested;

[0012] Based on the lightweight binary instrumentation algorithm, the _RET_IP_ macro is used to obtain the upper-level function call address that calls the instrumentation function;

[0013] Determine the name of the running function during dynamic runtime by using the range of the upper-level function call address;

[0014] The binary file of the kernel dynamic runtime is obtained by converting the running function name.

[0015] According to a multi-target oriented fuzz testing method based on USB driver provided by the present invention, static vulnerability analysis is used to calculate the vulnerability risk of the target function corresponding to each binary file, and the vulnerability analysis results of each target function are obtained, including:

[0016] Calculate a first edge transfer probability ETP distance between the target function set and each function in the vulnerability original trigger function set, and a second ETP distance between the target function set and each function in the universal serial bus USB driver related function set;

[0017] The first ETP distance and the second ETP distance are weightedly summed to obtain the vulnerability analysis result of the objective function;

[0018] Calculating the dangerous references of global variables of the target function set, and locating all read-type references to dangerous global variables;

[0019] Run symbolic execution from the start address of the function where the dangerous global variable is referenced until the first call instruction after the dangerous global variable address is encountered;

[0020] Check whether there is a pointer to the dangerous global variable space in the parameter register and stack space in the environment before this call;

[0021] If it is determined that a pointer pointing to a dangerous global variable space appears, a global variable dangerous reference analysis result is obtained based on the pointer calculation.

[0022] According to a multi-target oriented fuzz testing method based on USB driver provided by the present invention, the ETP distance includes:

[0023] Calculate the path composed of all basic blocks between two sites;

[0024] For each component path, calculate the Markov transition probability at each step;

[0025] The Markov transition probabilities of all paths are summed to obtain the ETP distance.

[0026] According to a multi-target oriented fuzz testing method based on USB driver provided by the present invention, a target function set is screened by matching keywords in source code and analyzing the real USB device processing function call chain mode;

[0027] By collecting and manually sorting the common vulnerabilities and exposed CVE historical lists, a set of original vulnerability trigger functions is constructed;

[0028] By capturing the actual execution path of the kernel when processing USB devices, a set of USB driver-related functions can be obtained.

[0029] According to a multi-target oriented fuzz testing method based on USB driver provided by the present invention, after preprocessing the target kernel source code to be tested and obtaining the binary file of the kernel during dynamic runtime, the method further includes:

[0030] The open source framework angr is used to construct and prune the inter-procedural control flow graph ICFG of the compiled binary file vmlinux to obtain a streamlined binary file.

[0031] According to a multi-objective-oriented fuzz testing method based on a USB driver provided by the present invention, vulnerability scores corresponding to the vulnerability analysis results of each objective function are obtained based on the multi-objective-oriented fuzz testing, and a fuzz testing execution path is determined according to the sum of the vulnerability scores, including:

[0032] Through multiple objective functions and multiple objective function corresponding vulnerability score key-value pairs, the seed mutation strategy and seed mutation direction of fuzz testing are determined;

[0033] To the seed corresponding to the maximum vulnerability score sum of the triggering execution path, mutation opportunities and computing resources are allocated, so that the seed executes the fuzz test execution path.

[0034] In a second aspect, the present invention further provides a multi-target oriented fuzz testing system based on USB driver, comprising:

[0035] A preprocessing module is used to preprocess the target kernel source code to obtain a binary file when the kernel is dynamically running;

[0036] An analysis module is used to calculate the vulnerability risk of the target function corresponding to each binary file by using static vulnerability analysis to obtain the vulnerability analysis results of each target function;

[0037] The test module is used to obtain the vulnerability scores corresponding to the vulnerability analysis results of each objective function based on the multi-objective-oriented fuzz test, and determine the fuzz test execution path according to the sum of the vulnerability scores.

[0038] In a third aspect, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements any of the USB-driven multi-target-oriented fuzz testing methods described above.

[0039] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the USB-driven multi-target-oriented fuzz testing methods described above.

[0040] The multi-target oriented fuzz testing method and system based on USB driver provided by the present invention can greatly improve the vulnerability mining efficiency of USB driver in Linux kernel and safeguard the security of USB devices by proposing the prototype system MODFuzz and applying kernel source code preprocessing, static vulnerability analysis and multi-target oriented fuzz testing respectively. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is a flow chart of a multi-target oriented fuzzy testing method based on USB driver provided by the present invention;

[0043] Figure 2 It is the overall architecture diagram of the prototype system MODFuzz provided by the present invention;

[0044] Figure 3 This is a schematic diagram of the USB driver framework provided by the present invention;

[0045] Figure 4 It is a schematic diagram of ICFG pruning provided by the present invention;

[0046] Figure 5 It is a comparison chart of the simulation execution efficiency of MODFuzz provided by the present invention and similar tools;

[0047] Figure 6 This is a comparison chart of vulnerability mining efficiency between MODFuzz provided by the present invention and similar tools;

[0048] Figure 7 It is a structural schematic diagram of a multi-objective oriented fuzzy testing system based on USB driver provided by the present invention;

[0049] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Figure 1 FIG. 1 is a flow chart of a multi-target oriented fuzzy testing method based on a USB driver provided by an embodiment of the present invention. Figure 1 As shown, including:

[0052] Step 100: preprocess the target kernel source code to obtain a binary file of the kernel during dynamic runtime;

[0053] Step 200: Using static vulnerability analysis to calculate the vulnerability risk of the target function corresponding to each binary file, and obtaining the vulnerability analysis results of each target function;

[0054] Step 300: Based on the multi-objective-oriented fuzz test, the vulnerability scores corresponding to the vulnerability analysis results of the target functions are obtained, and the fuzz test execution path is determined according to the sum of the vulnerability scores.

[0055] Specifically, Figure 2 The overall architecture diagram of the prototype system MODFuzz is shown. The present invention is mainly divided into three parts: kernel source code preprocessing, static vulnerability analysis and multi-target oriented fuzz testing.

[0056] The embodiment of the present invention obtains a binary file for static analysis and dynamic fuzz testing by preprocessing the kernel source code, then uses static vulnerability analysis to calculate the vulnerability score of each target function, and finally uses the sum of the vulnerability scores of the triggered execution paths as a guide during fuzz testing, so that the fuzz test is carried out in the direction most likely to contain vulnerabilities.

[0057] like Figure 3The USB driver framework schematic diagram shown is divided into three layers, from the bottom hardware to the middle kernel space, and then to the upper user space. In the hardware part, the USB host controller controls each USB device. The USB host controller in the kernel space drives the USB Core to the USB device driver to control the user-mode program in the user space. Here, the system structure corresponding to the prototype system MODFuzz proposed in the embodiment of the present invention.

[0058] The present invention proposes a prototype system MODFuzz, which respectively applies kernel source code preprocessing, static vulnerability analysis and multi-target oriented fuzz testing, which can greatly improve the efficiency of vulnerability mining for USB drivers in the Linux kernel and safeguard the security of USB devices.

[0059] On the basis of the above embodiment, the target kernel source code to be tested is preprocessed to obtain a binary file when the kernel is dynamically running, including:

[0060] Add IVSHMEM driver implementation code to the target kernel source code to be tested;

[0061] Based on the lightweight binary instrumentation algorithm, the _RET_IP_ macro is used to obtain the upper-level function call address that calls the instrumentation function;

[0062] Determine the name of the running function during dynamic runtime by using the range of the upper-level function call address;

[0063] The binary file of the kernel dynamic runtime is obtained by converting the running function name.

[0064] Specifically, during kernel source code preprocessing, an embodiment of the present invention adds IVSHMEM driver implementation code for implementing shared memory to the source code of the target kernel to be tested, and simultaneously implements a novel lightweight binary instrumentation algorithm; the instrumentation algorithm is improved based on the instrumentation tool kcov that comes with the Linux kernel, and the function __sanitizer_cov_trace_pc is an instrumentation function inserted into the end of each binary basic block when kcov is activated. The present invention deletes the parts with higher overhead such as collecting code coverage, processing bitmap mapping and hash operations, and instead uses a compiler macro _RET_IP_ in __sanitizer_cov_trace_pc to obtain the calling address of the upper function that calls the instrumentation function, that is, the address of the instrumented function. Since the name of each function to be plugged and the corresponding address range can be directly obtained by reading the information of the symbol table, the address obtained by the plugged function can be compared with each address range in the symbol table, so as to determine the name of the function to be run during dynamic operation; after completing the modification of kcov, the kcov compilation option of the Linux kernel is turned on, and the Linux kernel is compiled to obtain a binary executable kernel file supporting the novel plugging algorithm of the present invention. Under this plugging strategy, the kernel can capture the information of the function names passed by a series of execution paths with extremely low overhead during dynamic operation, providing feedback for subsequent fuzzy testing.

[0065] Based on the above embodiment, static vulnerability analysis is used to calculate the vulnerability risk of the target function corresponding to each binary file, and the vulnerability analysis results of each target function are obtained, including:

[0066] Calculate a first edge transfer probability ETP distance between the target function set and each function in the vulnerability original trigger function set, and a second ETP distance between the target function set and each function in the universal serial bus USB driver related function set;

[0067] The first ETP distance and the second ETP distance are weightedly summed to obtain the vulnerability analysis result of the objective function;

[0068] Calculating the dangerous references of global variables of the target function set, and locating all read-type references to dangerous global variables;

[0069] Run symbolic execution from the start address of the function where the dangerous global variable is referenced until the first call instruction after the dangerous global variable address is encountered;

[0070] Check whether there is a pointer to the dangerous global variable space in the parameter register and stack space in the environment before this call;

[0071] If it is determined that a pointer pointing to a dangerous global variable space appears, a global variable dangerous reference analysis result is obtained based on the pointer calculation.

[0072] Specifically, in the static vulnerability analysis part, the embodiment of the present invention mainly performs vulnerability risk assessment on a single target function through two parts: function vulnerability analysis and global variable dangerous reference analysis.

[0073] First, the edge transition probability is defined. The ETP calculation method is as follows: calculate the path composed of all basic blocks between two sites, for each path, calculate the Markov transition probability of each step, and finally sum up the probabilities of all paths as the calculation result of the ETP distance.

[0074] Then comes the selection of the target function set. The target function refers to the function set that needs to calculate the vulnerability score during the static vulnerability analysis process. By matching keywords in the source code and analyzing the real USB device processing function call chain, the function set that deserves to be focused on in the USB driver fuzz testing is screened out as the target function set. For the kernel function set outside the target set, the vulnerability score is not calculated and its vulnerability score is regarded as 0.

[0075] Then there is the construction of the original vulnerability triggering function set and the USB driver related function set. The original vulnerability triggering set refers to the basic functions called by the line in the source code that causes the vulnerability to be triggered, such as memcpy, strcpy, etc. These functions will inevitably be called in the same type of vulnerability. The solution of the embodiment of the present invention is to build the original vulnerability triggering function set by collecting and manually arranging in the CVE history list. The USB driver related function set refers to the core function function that needs to be called in the process of the kernel processing the USB device. The embodiment of the present invention obtains the USB driver related function set by capturing the real execution path of the kernel when processing the USB device.

[0076] Here, we need to use the construction and pruning of the interprocedural control-flow graph (ICFG). We use the open source framework angr to build the ICFG for the compiled binary file vmlinux. In the constructed ICFG, due to the characteristics of function calls and returns, a large number of edges that do not actually exist will appear in the ICFG, such as Figure 4The figure shows a schematic diagram of ICFG pruning. For the function call from Func A to Func B, since the call to B will eventually return to the next instruction of the call instruction in A (mark this instruction as insn_back_A), angr adds a directed edge from B to insn_back_A. But if another Func C also calls B, then from the perspective of ICFG, even if there is no theoretical path between C and A, a false path from C to insn_back_A in A will be generated.<e3,e4> The existence of such misleading edges (e.g., e2 and e4) also greatly affects the accuracy of static analysis, so this type of edges is removed when reconstructing ICFG to avoid similar situations.

[0077] Then calculate the ETP distance between the target function to be analyzed and each function in the original trigger function set of the vulnerability, as well as the ETP distance of each function in the function set related to the USB driver, and perform weighted summation on the calculated distances to obtain the vulnerability analysis result of the target function.

[0078] Finally, the dangerous references of global variables of the target function are calculated, all read-type references to dangerous global variables are located, and symbolic execution is performed from the starting address of the function where the dangerous global variable reference is located until the first call instruction after the address of the dangerous referenced global variable is encountered; then, the parameter registers in the environment before this call and the space on the stack are checked to see whether there are pointers to the dangerous global variable space, and the results of the global variable dangerous reference analysis are calculated based on these pointers.

[0079] On the basis of the above embodiment, the vulnerability scores corresponding to the vulnerability analysis results of the objective functions are obtained based on the multi-objective oriented fuzz test, and the fuzz test execution path is determined according to the sum of the vulnerability scores, including:

[0080] Through multiple objective functions and multiple objective function corresponding vulnerability score key-value pairs, the seed mutation strategy and seed mutation direction of fuzz testing are determined;

[0081] To the seed corresponding to the maximum vulnerability score sum of the triggering execution path, mutation opportunities and computing resources are allocated, so that the seed executes the fuzz test execution path.

[0082] Specifically, the embodiment of the present invention is aimed at multi-objective-oriented fuzz testing, and the calculation of the vulnerability score of a single target function can be divided into the two dimensions of function vulnerability analysis and global variable dangerous reference analysis mentioned above; the seed mutation strategy and direction of the fuzz test are guided by key-value pairs of multiple target functions and their corresponding vulnerability scores. When the fuzzer selects and evaluates the quality of input seeds, the sum of the vulnerability scores of all target functions on the execution path triggered by the current seed is first calculated, and multiple different exponential functions are used to take the total vulnerability score as input. The calculated output is used as parameters such as the number of iterations and execution time of the seed mutation stage. The seed mutation stage includes bit flipping, arithmetic shifting, and file splicing; thereby giving seeds with a larger total vulnerability score of the triggered execution path more mutation opportunities and computing resources, so that the fuzz test as a whole develops in the direction of triggering paths that are more likely to contain vulnerabilities.

[0083] like Figure 5 As shown, the simulation execution efficiency comparison results of the prototype system MODFuzz used in the embodiment of the present invention and similar tools are shown. It can be seen that the execution efficiency of MODFuzz is significantly higher than that of other similar tools.

[0084] like Figure 6 As shown, it is the comparison result of vulnerability mining efficiency between the prototype system MODFuzz and similar tools in the embodiment of the present invention. Similarly, the mining efficiency of MODFuzz is higher than that of other similar tools.

[0085] The multi-target-oriented fuzz testing system based on USB driver provided by the present invention is described below. The multi-target-oriented fuzz testing system based on USB driver described below and the multi-target-oriented fuzz testing method based on USB driver described above can be referenced to each other.

[0086] Figure 7 is a schematic diagram of the structure of a multi-objective oriented fuzzy testing system based on USB driver provided by an embodiment of the present invention, such as Figure 7 As shown, it includes: a preprocessing module 71, an analysis module 72 and a testing module 73, wherein:

[0087] The preprocessing module 71 is used to preprocess the target kernel source code to be tested to obtain a binary file when the kernel is dynamically running; the analysis module 72 is used to use static vulnerability analysis to calculate the vulnerability risk of the target function corresponding to each binary file to obtain the vulnerability analysis results of each target function; the testing module 73 is used to obtain the vulnerability score corresponding to the vulnerability analysis results of each target function based on multi-objective-oriented fuzz testing, and determine the fuzz test execution path according to the sum of the vulnerability scores.

[0088] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute a multi-target oriented fuzz testing method based on a USB driver, the method comprising: pre-processing the target kernel source code to be tested to obtain a binary file when the kernel is dynamically running; using static vulnerability analysis to calculate the vulnerability risk of the target function corresponding to each binary file to obtain the vulnerability analysis results of each target function; obtaining the vulnerability scores corresponding to the vulnerability analysis results of each target function based on the multi-target oriented fuzz testing, and determining the fuzz test execution path according to the sum of the vulnerability scores.

[0089] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0090] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the multi-target oriented fuzz testing method based on USB driver provided by the above-mentioned methods. The method includes: preprocessing the target kernel source code to be tested to obtain a binary file when the kernel is dynamically running; using static vulnerability analysis to calculate the vulnerability risk of the target function corresponding to each binary file to obtain the vulnerability analysis results of each target function; based on the multi-target oriented fuzz testing, obtaining the vulnerability score corresponding to the vulnerability analysis result of each target function, and determining the fuzzy test execution path according to the sum of the vulnerability scores.

[0091] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-target oriented fuzz testing method based on USB driver, characterized in that: include: Preprocess the target kernel source code to obtain the binary file of the kernel during dynamic runtime; Use static vulnerability analysis to calculate the vulnerability risk of the target function corresponding to each binary file, and obtain the vulnerability analysis results of each target function; Obtaining vulnerability scores corresponding to the vulnerability analysis results of each objective function based on a multi-objective-oriented fuzz test, and determining a fuzz test execution path according to the sum of the vulnerability scores; Static vulnerability analysis is used to calculate the vulnerability risk of the target function corresponding to each binary file, and the vulnerability analysis results of each target function are obtained, including: Calculate a first edge transfer probability ETP distance between the target function set and each function in the vulnerability original trigger function set, and a second ETP distance between the target function set and each function in the universal serial bus USB driver related function set; The first ETP distance and the second ETP distance are weightedly summed to obtain the vulnerability analysis result of the objective function; Calculating the dangerous references of global variables of the target function set, and locating all read-type references to dangerous global variables; Run symbolic execution from the start address of the function where the dangerous global variable is referenced until the first call instruction after the dangerous global variable address is encountered; Check whether there is a pointer to the dangerous global variable space in the parameter register and stack space in the environment before this call; If it is determined that a pointer pointing to a dangerous global variable space appears, a global variable dangerous reference analysis result is obtained based on the pointer calculation; Obtaining vulnerability scores corresponding to the vulnerability analysis results of each objective function based on the multi-objective oriented fuzz test, and determining the fuzz test execution path according to the sum of the vulnerability scores, including: Through multiple objective functions and multiple objective function corresponding vulnerability score key-value pairs, the seed mutation strategy and seed mutation direction of fuzz testing are determined; To the seed corresponding to the maximum vulnerability score sum of the triggering execution path, mutation opportunities and computing resources are allocated, so that the seed executes the fuzz test execution path.

2. The multi-target oriented fuzz testing method based on USB driver according to claim 1 is characterized in that: Preprocess the target kernel source code to obtain the binary file of the kernel dynamic runtime, including: Add IVSHMEM driver implementation code to the target kernel source code to be tested; Based on the lightweight binary instrumentation algorithm, the _RET_IP_ macro is used to obtain the upper-level function call address that calls the instrumentation function; Determine the name of the running function during dynamic runtime by using the range of the upper-level function call address; The binary file of the kernel dynamic runtime is obtained by converting the running function name.

3. The multi-target oriented fuzz testing method based on USB driver according to claim 1 is characterized in that: The ETP distance includes: Calculate the path composed of all basic blocks between two sites; For each component path, calculate the Markov transition probability at each step; The Markov transition probabilities of all paths are summed to obtain the ETP distance.

4. The multi-target oriented fuzz testing method based on USB driver according to claim 1 is characterized in that: By matching keywords in the source code and analyzing the actual USB device processing function call chain, the target function set is screened out; By collecting and manually sorting the common vulnerabilities and exposed CVE historical lists, a set of original vulnerability trigger functions is constructed; By capturing the actual execution path of the kernel when processing USB devices, a set of USB driver-related functions can be obtained.

5. The multi-target oriented fuzz testing method based on USB driver according to claim 2 is characterized in that: After preprocessing the target kernel source code to obtain the binary file of the kernel dynamic runtime, it also includes: The open source framework angr is used to construct and prune the inter-procedural control flow graph ICFG of the compiled binary file vmlinux to obtain a streamlined binary file.

6. A multi-target oriented fuzz testing system based on USB driver, characterized in that: include: A preprocessing module is used to preprocess the target kernel source code to obtain a binary file when the kernel is dynamically running; An analysis module is used to calculate the vulnerability risk of the target function corresponding to each binary file by using static vulnerability analysis to obtain the vulnerability analysis results of each target function; A testing module, used for obtaining vulnerability scores corresponding to the vulnerability analysis results of each objective function based on a multi-objective-oriented fuzz test, and determining a fuzz test execution path according to the sum of the vulnerability scores; The analysis module is specifically used for: Calculate a first edge transfer probability ETP distance between the target function set and each function in the vulnerability original trigger function set, and a second ETP distance between the target function set and each function in the universal serial bus USB driver related function set; The first ETP distance and the second ETP distance are weightedly summed to obtain the vulnerability analysis result of the objective function; Calculating the dangerous references of global variables of the target function set, and locating all read-type references to dangerous global variables; Run symbolic execution from the start address of the function where the dangerous global variable is referenced until the first call instruction after the dangerous global variable address is encountered; Check whether there is a pointer to the dangerous global variable space in the parameter register and stack space in the environment before this call; If it is determined that a pointer pointing to a dangerous global variable space appears, a global variable dangerous reference analysis result is obtained based on the pointer calculation; The test module is specifically used for: Through multiple objective functions and multiple objective function corresponding vulnerability score key-value pairs, the seed mutation strategy and seed mutation direction of fuzz testing are determined; To the seed corresponding to the maximum vulnerability score sum of the triggering execution path, mutation opportunities and computing resources are allocated, so that the seed executes the fuzz test execution path.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the multi-target-oriented fuzz testing method based on USB driver as described in any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the multi-target oriented fuzz testing method based on USB drive as described in any one of claims 1 to 5 is implemented.

Images