An efficient fuzzing method based on score matrix

Abstract

The application provides a high-efficiency fuzzy test method based on a score matrix, only normal basic blocks with a block score greater than 0 are subjected to a plug-in operation, and branches with a reaching probability of 0 are deleted through a pruning mode, which can prevent the fuzzy test of the application from generating new irrelevant test case inputs; therefore, it can be seen that the application avoids the fuzzy test tool of the application from exploring paths to irrelevant codes through the optimization mode; meanwhile, test cases in the seed pool of the application can trigger new paths reaching the target basic block or trigger vulnerabilities in the code to be tested, and the application selects a test case according to the final score and the mutation probability corresponding to each test case in the seed pool to perform mutation, and continues to test the vulnerabilities of the code to be tested according to the test case after mutation, so that the test case can reach the target basic block as much as possible through a high-score path, and the vulnerability mining efficiency of the software system to be tested is improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an efficient fuzzy testing method based on a score matrix. BACKGROUND

[0002] As an automatic testing method for discovering potential vulnerabilities and security important issues of software applications, the existing directional fuzzy testing method (such as AFLGO) focuses on exploration, that is, expanding coverage as much as possible in the early stage of fuzzing because the explored paths are limited, and the distance to the target point is possibly far at this time. When the coverage reaches a certain degree, the seeds with a short distance are used for mutation, so as to quickly cover the target point expected to be reached by the user.

[0003] When AFLGO performs directional fuzzy testing, firstly, source code is compiled to obtain a control flow graph (CFG) and a function call graph (CG) of a program to be fuzzed. This step is completed by LLVMPass in AFL.

[0004] Secondly, the distances of all basic blocks (BBs) to the basic block where the target is located are calculated according to the CFG, the CG and the given target. This step is completed by a python script.

[0005] Then, the source code is compiled again to perform instrumentation on the program. In addition to the original instrumentation logic of AFL, an instruction for adding the distance of each basic block to a specified address is added, that is, a shared memory address is specified as a distance variable, and the following instruction is inserted in the basic block: distance += current_BB_distance, that is, the distance of the current basic block is added to the distance variable.

[0006] Finally, the logic of the fuzzing part is as follows: according to the information fed back by the instrumentation, AFLGO can obtain the distance corresponding to the test case when the test case is used as input to execute the program, that is, the distance of the execution path of the test case to the target point. Then, the test case is scored according to the distance. The scoring algorithm is simulated annealing algorithm. The closer the distance, the higher the score, and the more opportunities the test case has for mutation.

[0007] Current directed fuzzing methods (such as AFLGO) as an automated testing method for discovering potential vulnerabilities and security important issues of software applications, use code coverage feedback to generate input to guide the directed fuzzer to explore most irrelevant code, by accessing these codes, the directed fuzzer has little progress in reaching the target or triggering the specified vulnerability, and this path exploration strategy will cause the fuzzer to waste a lot of effort to explore irrelevant code, which seriously limits the performance of the directed fuzzer, and causes the fuzzer to require a large amount of computing resources including CPU time and memory, which makes them unable to be applied to the security detection work of the software system to be tested on a large scale. SUMMARY

[0008] To solve the above problems, the present application provides an efficient fuzzing method based on score matrix, which realizes accurate identification of the relevant code that the directed fuzzer should explore for the software to be tested

[0009] An efficient fuzzing method based on score matrix, comprising the following steps:

[0010] S1: block the program code of the service software to be tested to obtain a plurality of basic blocks, and filter out target basic blocks from the basic blocks, and the rest are ordinary basic blocks;

[0011] S2: obtain the block distance corresponding to each basic block;

[0012] S3: obtain the block score of each ordinary basic block relative to each target basic block according to the block distance corresponding to each ordinary basic block;

[0013] S4: for each ordinary basic block, the average value of the block scores corresponding to all target basic blocks is taken as the final corresponding block score of itself;

[0014] S5: select the ordinary basic block with a block score greater than 0 for patching operation to obtain the program code of the patched service software to be tested;

[0015] S6: construct a basic block mapping diagram containing the block scores of each ordinary basic block and the position information of the patched ordinary basic block according to the program code of the patched service software to be tested;

[0016] S7: insert a set of code fragments at the key positions in the program code of the patched service software to be tested to obtain the test code; the key positions need to meet any vulnerability feature in the vulnerability feature library;

[0017] S8: randomly generate test cases, then input the test cases into the test code, and identify the patched ordinary basic blocks involved in the execution process of the test cases in the test code according to the basic block mapping diagram;

[0018] S9: score the current test case according to the block score corresponding to the identified instrumented normal basic block, to obtain a score A; meanwhile, score the current test case according to whether the current test case causes the change of the key variable of the code under test, to obtain a score B; and add the score A and the score B to obtain the final score of the current test case;

[0019] S10: determine whether the current time reaches the set cycle time, if not, go to step S11, and if yes, end the cycle;

[0020] S11: determine whether the current test case triggers a new path from any normal basic block to any target basic block or triggers a bug in the code under test, if yes, store the current test case in the seed pool and set a mutation probability for the current test case, and go to step S12; if not, discard the current test case and go to step S12;

[0021] S12: determine whether the seed pool is empty, if yes, randomly generate a new test case to re-execute S8-S11; if not, select a test case from the seed pool according to the final score and the mutation probability of each test case in the seed pool to perform mutation, and re-execute steps S8-S11 until the set cycle time is reached.

[0022] Further, the method for obtaining the block score of each normal basic block relative to each target basic block in step S3 is as follows:

[0023] Take each normal basic block as the current normal basic block and each target basic block as the current normal basic block in turn, and execute the following steps:

[0024] S31: obtain all possible paths between the current normal basic block and the current target basic block, and divide all possible paths into branch paths and non-branch paths according to whether the normal basic blocks contained in each possible path have branch statements; wherein, for the branch paths, each branch path performs a block score obtaining operation, and for the non-branch paths, the shortest non-branch path is selected to perform a block score obtaining operation; wherein, the block score obtaining operation is:

[0025] Obtain the subsequent basic blocks between the current normal basic block b j and the target basic block on the current path, and record the number of the subsequent basic blocks as n;

[0026] Substitute the block distances of the subsequent basic blocks into the following formula to obtain the block score of the current normal basic block b j on the current path:

[0027]

[0028] wherein t(b j ) is the block score of the current normal basic block b j The block score of the block on the current path, D(i) is the block distance corresponding to the i-th subsequent basic block of the current normal basic block b j f i (b j ) is the arrival probability of the current normal basic block b j to its i-th subsequent basic block, and ε is a set penalty term.

[0029] S32: After averaging the block scores of the current normal basic block on all branch paths, the average obtained is averaged with the block score on the non-branch path with the shortest distance, and the final average obtained is taken as the block score of the current normal basic block relative to the current target basic block.

[0030] Further, the method for obtaining the block distance corresponding to each basic block in step S2 is as follows:

[0031] Let each basic block be the current basic block and perform the following operations: obtain the arrival probability of the current basic block to each target basic block, and take the average of the reciprocals of each arrival probability as the block distance corresponding to the current basic block; wherein, if the current basic block is a target basic block, the probability of the current basic block arriving at the target basic block to which it belongs is 1.

[0032] Further, in the process of cyclically executing steps S8-S12, if any test case input to the code under test causes the code under test to crash, it indicates that the current test case triggers a vulnerability in the code under test; at the same time, after the code under test crashes, the code under test is automatically restarted to continue the cyclic execution of steps S8-S10.

[0033] Further, the method for constructing the vulnerability feature library in step S7 is as follows:

[0034] Collect vulnerability features related to the service software being tested in public data;

[0035] Read the source code of the service software being tested, and manually extract vulnerability features;

[0036] Construct the collected vulnerability features and the manually extracted vulnerability features into a vulnerability feature library.

[0037] Further, the set code segment inserted in step S7 is a code that can detect whether the key variable at the key position changes as expected; wherein, the key variable is a variable related to the vulnerability and capable of triggering the vulnerability, and the key position is the basic block where the key variable is located.

[0038] Further, the weight of score A in step S9 is higher than the weight of score B.

[0039] Advantages:

[0040] 1. The application provides a high-efficiency fuzzy test method based on a score matrix, only normal basic blocks with block scores greater than 0 are subjected to a patching operation, and branches with a reaching probability of 0 are deleted in a way of pruning, which can prevent the fuzzy test of the application from generating new irrelevant test case inputs, so it can be seen that the application avoids the fuzzy test tool of the application from exploring the path of irrelevant code through the optimization method, and meanwhile, the test cases in the seed pool of the application can trigger new paths reaching the target basic block or trigger the vulnerabilities in the code to be tested, so the application selects a test case according to the final score and mutation probability corresponding to each test case in the seed pool to perform mutation, and continues to test the vulnerabilities in the code to be tested according to the test case after mutation, so that the test case can reach the target basic block as much as possible along the high-score path, and the vulnerability mining efficiency of the code to be tested is improved.

[0041] 2. The application provides a high-efficiency fuzzy test method based on a score matrix, for non-branch paths, the shortest non-branch path is selected to perform a block score acquisition operation, which can better reflect the progress of reaching the target basic block and obtain a basic block reaching probability matrix.

[0042] 3. The application provides a high-efficiency fuzzy test method based on a score matrix, it is considered that the higher the score of a basic block, the higher the possibility of mining vulnerabilities on the basic block, therefore, the score operation designed by the application is not sensitive to large numbers, a heavier penalty term is set for a subsequent basic block that cannot reach the target basic block, which can effectively guide the application to mine more basic blocks matching the target basic block, instead of a basic block with a higher probability of a subsequent basic block, so that it is easier to mine vulnerabilities on the target basic block. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 A flowchart of a high-efficiency fuzzy test method based on a score matrix provided by the application is shown in the figure.

[0044] Figure 2 A score matrix fuzzy tester architecture diagram provided by the application is shown in the figure.

[0045] Figure 3 A distance calculation code example diagram provided by the application is shown in the figure. DETAILED DESCRIPTION

[0046] In order to enable personnel in the art to better understand the application scheme, the technical solutions in the application examples will be described clearly and completely below in combination with the drawings in the application examples.

[0047] As Figure 1As shown, an efficient fuzzy testing method based on a score matrix comprises the following steps:

[0048] S1: block the program code of the service software to be tested to obtain a plurality of basic blocks, and meanwhile, filter out target basic blocks from the basic blocks, and the rest are ordinary basic blocks;

[0049] It should be noted that the blocking method of the program code and the filtering standard of the target basic blocks can refer to the existing directed fuzzy testing method, and the present application will not be repeated here.

[0050] S2: obtain the block distance corresponding to each basic block, specifically comprising the following steps:

[0051] Let each basic block be the current basic block to perform the following operations: obtain the arrival probability of the current basic block to each target basic block, and take the average value of the inverses of each arrival probability as the block distance corresponding to the current basic block; wherein, if the current basic block is a target basic block, the probability of the current basic block arriving at the target basic block to which it belongs is 1;

[0052] For example, assuming that the program code of the service software to be tested is divided into 10 basic blocks, and assuming that numbers 1 to 7 are ordinary basic blocks, and numbers 8 to 10 are target basic blocks, then the block distance corresponding to the first basic block is the average value of the inverses of the arrival probabilities of the first basic block to the eighth target basic block, the ninth target basic block and the tenth target basic block; at the same time, the eighth basic block itself belongs to a target basic block, so the arrival probability of the eighth basic block to the eighth target basic block is 1, and the block distance corresponding to the eighth basic block is the average value of the inverses of the arrival probabilities of the eighth basic block to the eighth target basic block, the ninth target basic block and the tenth target basic block.

[0053] That is, the present application starts from the control flow chart of the target service software to be tested, and extracts the probability of each basic block of the target service software to be tested to reach the target basic block according to the position of the target basic block selected in advance by the traditional method. The present application marks each basic block, and the marking principle is based on whether the arrival probability of the basic block has been calculated or not, and the marks are initial, calculate and finish respectively. For the selected basic block b, the present application calculates the "probability" Pb of the basic block b to reach the target basic block T, wherein the probability Pb is used to estimate the probability of reaching the target basic block T from the basic block b. Then, the present application calculates the inverse of the probability of the basic block b to reach the target basic block as the block distance Db(b, T) corresponding to the basic block. At the same time, if the basic block b is located at the target basic block, the present application considers that its arrival probability is set to 100%. Otherwise, it recursively calculates the arrival probability of the successor block. Specifically, the arrival probability of the basic block b is the average value of the arrival probabilities of all the successor blocks of the basic block b.

[0054] S3: obtaining the block score of each ordinary basic block relative to each target basic block according to the block distance corresponding to each ordinary basic block, specifically comprising the following steps:

[0055] sequentially taking each ordinary basic block as a current ordinary basic block and each target basic block as a current ordinary basic block to perform the following steps:

[0056] S31: obtaining all possible paths between the current ordinary basic block and the current target basic block, and dividing all possible paths into branch paths and non-branch paths according to whether the ordinary basic blocks contained in each possible path have branch statements; wherein, for the branch paths, each branch path performs a block score obtaining operation, and for the non-branch paths, the block score obtaining operation is performed on the non-branch path with the shortest distance; wherein, the block score obtaining operation is:

[0057] obtaining the subsequent basic blocks between the current ordinary basic block b j and the target basic block on the current path, and recording the number of the subsequent basic blocks as n;

[0058] substituting the block distance corresponding to each subsequent basic block into the following formula to obtain the block score of the current ordinary basic block b j on the current path:

[0059]

[0060] wherein, t(b j ) is the block score of the current ordinary basic block b j on the current path, D(i) is the block distance corresponding to the i th subsequent basic block of the current ordinary basic block b j , f i (b j ) is the reaching probability of the current ordinary basic block b j to the i th subsequent basic block, and ε is a set penalty term.

[0061] It should be noted that the present application considers that the possibility of the vulnerability mined on the basic block with a higher block score is higher, therefore, the score operation designed by the present application is not sensitive to large numbers, and the penalty for the situation that a certain subsequent basic block cannot reach the target basic block is heavier, which can effectively guide the present application to mine more target basic blocks with a higher probability of matching, instead of a certain subsequent basic block with a higher probability, so that it is easier to mine the vulnerability on the target basic block.

[0062] S32: obtaining the average of the block scores of the current ordinary basic block on all branch paths, then obtaining the average of the block score on the non-branch path with the shortest distance, and finally taking the obtained average as the block score of the current ordinary basic block relative to the current target basic block.

[0063] It can be seen that the present application needs to be specially processed for conditional statements and loop statements. For each if statement which is a basic block itself, the present application assumes that the execution probability of each branch is equal. For example, if an if statement has three branches, each of which is a basic block, the execution probability of each branch is 1 / 3. For loop and recursive statements which are usually contained in a program, the present application cannot accurately deduce the specific running iteration times of the loop and recursive statements in the static distance analysis. Therefore, the present application only executes the loop body and the recursive function once, that is, the present application assumes that a loop statement runs 10 times in actual running, but only calculates the execution of the statement once when calculating the probability, so as to reduce the complexity of the model.

[0064] That is, it is assumed that a path between a basic block and a target basic block contains a loop basic block, and the code on the loop basic block contains a loop statement. The loop basic block is calculated only once in the path. For example, the path is a first normal basic block, a second normal basic block, a third normal basic block, and an eighth target basic block. If the third normal basic block is a loop basic block with a loop count of 3, the subsequent basic blocks of the first normal basic block in the path are the second normal basic block and the third normal basic block, but not the second normal basic block, the third normal basic block, the third normal basic block, and the third normal basic block.

[0065] Further, in the service software mining process to be tested, the present application uses code location for guidance. It is assumed that there are n successor basic blocks from a selected basic block b to a target basic block. A set of successor basic blocks related to the target basic block is given as A probability score matrix is constructed by calculating the size of the probability of reaching the target basic block in the successor basic block. b represents a basic block, and C(b) represents the reaching probability in the basic block b. Therefore, we have:

[0066]

[0067] Where F i (b) represents the reaching probability of the i-th successor basic block of the basic block b.

[0068] Table 1: Reaching probability matrix of successor basic blocks

[0069]

[0070] Meanwhile, in the calculation of the distance metric of the present application for each subsequent basic block distance (i.e. D(i)), the distance metric of the present application is the shortest block distance of all the basic blocks covered in the run, rather than the method commonly used by other fuzzers of calculating the average block distance of the covered basic blocks as the input distance. The reason behind this design choice of the present application is that the shortest distance can better reflect the progress of reaching the target code and obtain the basic block reach probability matrix. Let Distance(i) be used to represent the shortest distance of the subsequent basic block i contained in the basic block to reach the target basic block, and an example target basic block shortest distance matrix D(j) is shown in Table 2.

[0071] Table 2 Target basic block shortest distance matrix

[0072]

[0073]

[0074] S4: For each normal basic block, the average of the block scores corresponding to all target basic blocks is taken as the final corresponding block score of itself;

[0075] S5: Select the normal basic blocks with block scores greater than 0 for the insertion operation to obtain the program code of the patched service software to be tested;

[0076] It should be noted that the conventional method is to perform the insertion operation on all normal basic blocks, and the present application only performs the insertion operation on the normal basic blocks with block scores greater than 0, which is equivalent to deleting the branches with a reach probability of 0 through pruning, which can prevent the fuzzing test of the present application from generating new irrelevant inputs. Therefore, it can be seen that the present application avoids the fuzzing test tool of the present application from exploring the path of irrelevant code through this optimization method.

[0077] The insertion operation belongs to the technical means commonly used in the art, and the present application will not be described here.

[0078] S6: Construct a basic block mapping containing the block scores of each normal basic block and the position information of the normal basic blocks that are inserted according to the program code of the patched service software to be tested;

[0079] Therefore, for steps S1-S6, the present application calculates the probability of each basic block reaching the target basic block, further obtains the block distance matrix, finally performs the operation of taking the inverse of the obtained block distance matrix to obtain the basic block score matrix, and according to the score result, the basic blocks are inserted to obtain the basic block mapping for guiding the focus of the mining process of the target code of the vulnerability mining.

[0080] The basic block calibration map is constructed to provide a target basic block to the directional mining process and guide the focus of mining. Meanwhile, through the guidance based on the target basic block, the present application can start from the code structure of the to-be-tested service software, evaluate the score of the basic block, and insert a probe code to focus on the target basic block for mining. Through the target test case generated by the input of the to-be-tested service software and the higher scoring matrix of the directional score, more efficient targeted mining of the target code of the to-be-tested system can be realized.

[0081] S7: inserting a set code segment at a key position in the program code of the to-be-tested service software after the probing, to obtain to-be-tested code; the key position needs to meet any vulnerability feature in the vulnerability feature library;

[0082] Further, the construction method of the vulnerability feature library is:

[0083] Collecting vulnerability features related to the to-be-tested service software in public data;

[0084] Reading the source code of the to-be-tested service software, and manually extracting vulnerability features;

[0085] Constructing the collected vulnerability features and the manually extracted vulnerability features into a vulnerability feature library;

[0086] Meanwhile, the set code segment inserted in step S7 is a code capable of detecting whether the key variable at the key position changes as expected; wherein the key variable is a variable related to a vulnerability and capable of triggering the vulnerability, and the key position is a basic block where the key variable is located.

[0087] For example, the position pointed to by the pointer to the cache array exceeds 50% of the length of the cache array; the number of NS reference acquisitions is greater than 30% of the "maximum recursive query" threshold; it should be noted that the change of the key variable in this example does not necessarily cause the to-be-tested software to crash or other vulnerabilities, but according to the analysis of the vulnerability feature library, it is believed that the test case that causes the expected change of the key variable has a greater possibility of detecting the vulnerability of the to-be-tested service software, and is given a higher mutation probability and execution times.

[0088] S8: randomly generating a test case, then inputting the test case into the to-be-tested code, and identifying the inserted normal basic block involved in the execution process of the test case in the to-be-tested code according to the basic block calibration map;

[0089] S9: score the current test case according to the block score corresponding to the identified instrumented normal basic block, to obtain a score A; meanwhile, score the current test case according to whether the current test case causes the change of the key variable of the code under test, to obtain a score B; and add the score A and the score B to obtain the final score of the current test case; wherein the weight of the score A is higher than the weight of the score B;

[0090] S10: determine whether the current time reaches the set cycle time, if not, go to step S11, and if yes, end the cycle;

[0091] For example, if the program code of the service software under test needs to be mined for 10 hours, the set cycle time is 10 hours.

[0092] S11: determine whether the current test case triggers a new path from any normal basic block to any target basic block or triggers a bug in the code under test, if yes, store the current test case in the seed pool and set a mutation probability for the current test case, and go to step S12; if not, discard the current test case and go to step S12.

[0093] S12: determine whether the seed pool is empty, if yes, randomly generate a new test case to re-execute S8-S11; if not, select a test case from the seed pool according to the final score and the mutation probability of each test case to perform mutation, and re-execute steps S8-S11 until the set cycle time is reached; wherein the higher the final score of the test case, the greater the mutation probability, and the greater the probability of being selected for mutation.

[0094] It should be noted that during the cycle execution of steps S8-S12, if any test case input into the code under test causes the code under test to crash, it indicates that the current test case triggers a bug in the code under test; at the same time, after the code under test crashes, the code under test is automatically restarted to continue the cycle execution of steps S8-S10.

[0095] As can be seen, after determining the normal basic blocks that can better reach the target basic blocks, the problem to be solved by the present application is how the selected basic blocks reach the target basic blocks, so as to prompt the accuracy and efficiency of the bug mining.

[0096] The present invention first identifies target code as relevant code in relation to control or data. In other words, code that determines the control flow or data flow conditions that trigger a vulnerability is relevant code. The present invention defines two classes of relevant code: path code and data code. Path code is in the last intersection block of reachable and unreachable paths. Data code affects the values of key variables used in the target; these variables can be assigned the values of some constants or variables (direct dependencies), which can be further derived from other variables in other code blocks (indirect dependencies). At the same time, code in the target basic block is included as relevant code and is considered data code.

[0097] Path code provides important feedback that enables the fuzzer of the present invention to distinguish inputs that progress towards the target. Specifically, by traversing the paths that can reach the path code when it is reached, the fuzzer of the present invention can generate new inputs from better test case inputs and get closer to the target basic block. It can also generate irrelevant inputs, however, whose execution only discovers irrelevant code. But because the code is not detected and neither provides coverage nor distance feedback. Thus, the present invention prunes branches with a probability of 0 of being reached, which prevents the fuzzer of the present invention from generating new irrelevant inputs. The present invention avoids the fuzzer of the present invention exploring paths towards irrelevant code through this optimization.

[0098] Furthermore, the present invention does not detect irrelevant code that can indirectly affect the control flow at the path divergent code. The present invention trades off detecting such code for a smaller exploration space. The present invention notes that the reachability of the target is mainly affected by path divergent code, not other code. Specifically, a program will continue to execute on a reachable path (after reaching a path divergent block) until it reaches the next path divergent block. When the fuzzer attempts to reach path divergent code blocks, it will access indirectly control dependent code blocks (i.e., those that affect conditional variables) on the reachable path, whether or not the present invention detects them. Detecting other code on the reachable path does not provide additional useful feedback but increases runtime overhead.

[0099] Data dependent code can not help reach the target code, but can improve the efficiency of the use phase of the fuzzer of the present invention. Since some vulnerabilities can only be triggered when key variables in the target are at specific values, exploring data dependent code can help the fuzzer of the present invention in the use phase.

[0100] For example, for a vulnerability of a to-be-tested service software, the vulnerability is caused by function overflow when querying. That is, by entering the receive_query function from check_dns_listeners, after the dnsmasq receives the second PTR request of the client, the answer_request function is called first, and then the forward_query function is called to respond to the client. At this time, the query crashes when entering the answer_request function. When the crash occurs, the value of anscount is 0x51, that is, after 81 times of loop, the cache_find_by_addr function is called again to cause illegal memory reference to crash. Specifically, the data packet generated after the cache referenced by the function is processed will be expanded and looped, so when the cache_find_by_addr function internally accesses the address of the crec structure, due to 81 times of loop record, the cache data packet has stack overflow, causing the crec address to overflow the Z character, so as to finally cause illegal address reference. Therefore, when we explore the related code, the code segment in which the crec structure address changes is regarded as data related code by the application, and by strictly monitoring the changes of the key data in the related code, we can know whether the current digging will dig out a vulnerability.

[0101] In summary, the traditional directed fuzzing scheme such as AFLGO calculates the score of the seed according to the annealing algorithm combined with time and shortest distance when fuzzing, and allocates the time for seed mutation according to the score. While the distance score matrix of the application considers the shortest distance, and the score operation designed at the same time is not sensitive to large numbers, and the penalty for the target basic block that cannot be reached by a certain subsequent basic block is heavy, which reduces the range of reachable basic blocks and avoids wasting computing power of the fuzzing program on invalid basic blocks.

[0102] Secondly, for all reachable basic blocks, the application deletes the branches with a reach probability of 0 through path selection technology, and further refines the fuzzing range of the seed through pruning operation.

[0103] Finally, compared with the traditional directed fuzzing scheme which only considers the path, the application considers that triggering a vulnerability not only requires the seed to execute to the target basic block, but also requires key values to trigger the vulnerability. The application further designs data code to further refine the seed by selecting more seeds with partial key data. That is, compared with the traditional directed fuzzing technology, the application improves the vulnerability mining cost-effectiveness of the to-be-tested system.

[0104] Of course, the present application can have other various embodiments, and those skilled in the art can certainly make various corresponding changes and modifications according to the present application without departing from the spirit and essence of the present application, but these corresponding changes and modifications shall all belong to the protection scope of the claims attached to the present application.

Claims

1. An efficient fuzzing method based on score matrix, characterized in that, Comprise the following steps: S1: The program code of the service software to be tested is blocked to obtain a plurality of basic blocks, and target basic blocks are screened out from each basic block, and the rest are ordinary basic blocks; S2: Obtain the block distance corresponding to each basic block, specifically: Let each basic block be the current basic block, and perform the following operations: obtain the arrival probability of the current basic block to each target basic block, and take the average of the inverses of each arrival probability as the block distance corresponding to the current basic block; wherein, if the current basic block is a target basic block, the probability of the current basic block reaching the target basic block to which it belongs is 1; S3: Obtain the block score of each ordinary basic block relative to each target basic block according to the block distance corresponding to each ordinary basic block; S4: For each ordinary basic block, take the average of the block scores corresponding to all target basic blocks as the final block score corresponding to itself; S5: Select the ordinary basic block with a block score greater than 0 for the insertion operation to obtain the program code of the service software to be tested after insertion; S6: Construct a basic block calibration map containing the block scores of each ordinary basic block and the position information of the inserted ordinary basic block according to the program code of the service software to be tested after insertion; S7: Insert a set of code fragments at the key positions in the program code of the service software to be tested after insertion to obtain the test code; the key positions need to satisfy any vulnerability feature in the vulnerability feature library; S8: Randomly generate a test case, then input the test case into the test code, and identify the inserted ordinary basic block involved in the execution process of the test case in the test code according to the basic block calibration map; S9: Score the current test case according to the block score corresponding to the identified inserted ordinary basic block to obtain score A; at the same time, score the current test case according to whether the current test case causes the key variable of the test code to change to obtain score B; weight and sum score A and score B to obtain the final score of the current test case; S10: Determine whether the current time reaches the set cycle time, if not, go to step S11, if yes, end the cycle; S11: Determine whether the current test case triggers a new path of any ordinary basic block reaching any target basic block or triggers a vulnerability in the test code, if yes, store the current test case in the seed pool and set a mutation probability for the current test case, go to step S12; if not, discard the current test case and go to step S12; S12: Determine whether the seed pool is empty, if yes, randomly generate a new test case to execute S8-S11 again; if not, select a test case according to the final score and mutation probability corresponding to each test case in the seed pool to perform mutation, and execute steps S8-S11 again after mutation until the set cycle time is reached.

2. A high efficiency fuzz testing method based on score matrix as claimed in claim 1 wherein, The method for obtaining the block score of each ordinary basic block relative to each target basic block in step S3 is as follows: In turn, take each ordinary basic block as the current ordinary basic block and each target basic block as the current target basic block to perform the following steps: S31: acquire all possible paths between the current normal basic block and the current target basic block, and divide all possible paths into branch paths and non-branch paths according to whether the normal basic blocks contained in each possible path have branch statements; wherein, for branch paths, each branch path performs a block score acquisition operation, and for non-branch paths, the shortest non-branch path is selected to perform a block score acquisition operation; wherein, the block score acquisition operation is: acquiring a subsequent basic block between the current normal basic block b j and the target basic block on the current path, and recording the number of the subsequent basic blocks as n; The block distance corresponding to each subsequent basic block is substituted into the following formula to obtain the current normal basic block b j Block score on the current path: where t(b j ) is the current common basic block b j The block score of the block on the current path, D(i) is the block distance corresponding to the i-th subsequent basic block of the current common basic block b j f i (b j ) is the arrival probability of the current common basic block b j to its i-th subsequent basic block, and ε is a set penalty term. S32: average the block scores of the current normal basic block on all branch paths, then average the obtained mean value with the block score on the shortest non-branch path, and take the final obtained mean value as the block score of the current normal basic block relative to the current target basic block.

3. A high efficiency fuzz testing method based on score matrix as claimed in claim 1 wherein, In the process of executing steps S8-S12 in a loop, if the test code crashes after any test case input, it indicates that the current test case triggers a vulnerability in the test code; at the same time, after the test code crashes, the test code is automatically restarted to continue executing steps S8-S10 in a loop.

4. The high efficiency fuzzing method based on score matrix as claimed in claim 1, wherein, The construction method of the vulnerability feature library in step S7 is: Collecting vulnerability features related to the tested service software in public data; Reading the source code of the tested service software and manually extracting vulnerability features; Constructing the collected vulnerability features and the manually extracted vulnerability features into a vulnerability feature library.

5. The high efficiency fuzzing method based on score matrix as claimed in claim 1, wherein, The set code segment inserted in step S7 is a code that can detect whether the key variable at the key position changes as expected; wherein, the key variable is a variable related to the vulnerability and capable of triggering the vulnerability, and the key position is the basic block where the key variable is located.

6. The high efficiency fuzzing method based on score matrix as claimed in claim 1, wherein, The weight of score A is higher than that of score B in step S9.

Images