Picture video format vulnerability mining method based on fuzz testing

Abstract

This invention discloses a method for mining image and video format vulnerabilities based on fuzzing. First, an input module obtains image and video input files from the user's seed library. Then, parallel fuzzing is performed on the image and video input files using master-control and slave modes to uncover image and video format vulnerabilities. Finally, a simplification module monitors the queue directory of each instance in the master-control and slave modes and simplifies the queue directory set to provide simplified input data for subsequent fuzzing. This invention effectively solves the problems of non-linear processing speed growth and corpus duplication in existing AFL fuzzing frameworks by using improved measures such as parallel processing of multiple master-control modes and simplification of the corpus set during fuzzing.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to the design of a method for discovering vulnerabilities in image and video formats based on fuzz testing. Background Technology

[0002] Currently, image and video processing functions are widely used in various software and systems. However, with the development of the internet, uncertified images and videos spread extremely quickly, often carrying security risks. Once vulnerabilities are exploited, they pose a serious threat to personal privacy, corporate data, and national security. Therefore, discovering and fixing security vulnerabilities in these formats has become an important task for security researchers. Numerous image and video formats exist, each with multiple versions, resulting in complex and diverse format specifications. For example, common image formats include JPG, PNG, GIF, and BMP, while video formats include MP4, AVI, MKV, and FLV. Each format has different file structures, encoding algorithms, and metadata information. This presents challenges for developers and leaves room for potential flaws. Image and video processing software often needs to parse and render multimedia files from untrusted sources, providing opportunities for attackers. Attackers can construct special image or video files, exploiting software vulnerabilities to execute arbitrary code or cause denial-of-service attacks. Therefore, these software systems face serious security risks. Traditional manual testing and unit testing struggle to thoroughly cover all possible input scenarios, especially for complex image and video formats. Fuzzing, as an effective automated software testing technique, has been proposed to find security vulnerabilities and execution errors in software. By generating a large number of random or specification-based test cases automatically or semi-automatically, fuzzing can more effectively discover edge cases and hidden defects. For software that processes image and video formats, using fuzzing methods to study security risks in its format processing has a natural advantage. With the continuous development of digital media and the expansion of application scenarios, research in this field will become increasingly important and urgent.

[0003] Fuzzing, as a popular vulnerability detection technique, effectively saves manpower in finding vulnerabilities and avoids the problems of static analysis ignoring the actual operating environment and code constraints. AFL (American Fuzzy Lop), developed by security researcher Michal Zalewski, is a coverage-guided fuzzing tool. It records the code coverage of input samples, thereby adjusting the input samples to improve coverage and increase the probability of discovering vulnerabilities. It is particularly suitable for fuzzing image and video format software. Currently, the AFL fuzzing framework mainly suffers from the following problems:

[0004] (1) When AFL uses a master-slave mechanism for fuzzing, there can only be one instance of the master fuzzer, while there are multiple instances of the slave fuzzers. Each fuzzer instance receives interesting cases from other instances, and these instances independently calculate coverage based on these interesting cases. Therefore, a significant drawback of this method is that the processing speed does not increase linearly.

[0005] (2) After the master fuzz tester completes one loop, the subordinate fuzz testers have run many loops. Over time, a very large corpus will be accumulated, which will lead to duplicate test cases and a high probability of duplicate processes in each subordinate fuzz tester. Summary of the Invention

[0006] The purpose of this invention is to address the problems of non-linear growth in processing speed and corpus duplication in existing AFL fuzzing frameworks, and to propose a fuzzing-based method for mining vulnerabilities in image and video formats.

[0007] The technical solution of this invention is: a method for discovering image and video format vulnerabilities based on fuzz testing, comprising the following steps:

[0008] S1. Obtain image and video input files from the user's seed library through the input module.

[0009] S2. Parallel fuzz testing is performed on the image and video input files using master control mode and slave mode to uncover image and video format vulnerabilities.

[0010] S3. Monitor the queue directory of each instance in master control mode and slave mode through the simplification module, and simplify the queue directory set to provide simplified input data for subsequent fuzz testing.

[0011] Further, step S1 includes the following sub-steps:

[0012] S11. Obtain interesting samples from the user's seed library through the input queue submodule.

[0013] S12. Read image and video input files from interesting samples through the file submodule and provide them to the main control mode as input data.

[0014] Furthermore, step S2 specifically includes:

[0015] Deterministic fuzzing was performed on the image and video input files in master control mode, while random fuzzing was performed on the image and video input files in slave mode. Vulnerabilities in image and video formats were discovered based on the results of the deterministic and random fuzzing tests.

[0016] Furthermore, the specific method for performing deterministic fuzz testing on image and video input files through the master control mode is as follows:

[0017] A1. Perform deterministic mutation on the image and video input files according to deterministic compilation logic to obtain deterministic mutated data, and at the same time determine the amount of inversion of the input data.

[0018] A2. Use integer addition and subtraction operations to perform integer addition / subtraction arithmetic operations on deterministic mutated data to obtain integer addition / subtraction arithmetic mutated data.

[0019] A3. Replace the special content in the integer addition / subtraction arithmetic operation mutation data to obtain the special content replacement mutation data.

[0020] A4. Replace or insert the automatically generated or user-provided token into the special content replacement mutation data to perform token insertion / replacement mutation, and obtain token insertion / replacement mutation data.

[0021] A5. Divide the process according to the amount of flipping of the input data, and perform the mutation operations of steps A1 to A4 on the image and video input files in parallel according to different processes to obtain the deterministic fuzzy test results.

[0022] Furthermore, the deterministic variations in step A1 include:

[0023] Deterministic mutation bitflip 1 / 1: Flips 1 bit at a time, starting from the beginning with a step size of 1 bit, flipping only the state of a single bit at a time, operating bit by bit, ensuring fine-grained mutation.

[0024] Deterministic mutation bitflip 2 / 1: Each time, flip two adjacent bits, starting from the beginning with a step size of 1 bit, and each time it acts on two adjacent bits, increasing the mutation intensity in the local area.

[0025] Deterministic mutation bitflip 4 / 1: Each time, flip 4 adjacent bits, starting from the beginning with a step size of 1 bit, and collectively flip 4 consecutive bits to further enrich the mutation patterns.

[0026] Deterministic mutation bitflip 8 / 8: flips 8 adjacent bits (one byte) at a time, proceeding byte by byte, operating independently on each byte of the file, thus achieving mutation by byte block.

[0027] Deterministic mutation bitflip 16 / 8: Flip 16 adjacent bits at a time, starting from the beginning and flipping each word in steps of 8 bits.

[0028] Deterministic mutation bitflip 32 / 8: Each time, flip 32 adjacent bits, starting from the beginning in 8-bit increments, and flip each dword sequentially.

[0029] Variations in integer addition / subtraction arithmetic operations in step A2 include:

[0030] Arith 8 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 8 bits at a time, starting from the beginning in 8-bit increments, to mutate the byte-level data of the file.

[0031] Arith 16 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 16 bits at a time, starting from the beginning in 8-bit increments, and mutates the value of each 16-bit data unit.

[0032] Arith 32 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 32 bits at a time, starting from the beginning in 8-bit increments, and mutates the value of each 32-bit data unit.

[0033] The special content substitution variations in step A3 include:

[0034] Interest 8 / 8: Replaces the value of 8 bits at a time, starting from the beginning in 8-bit increments, to achieve precise redefinition of each byte.

[0035] Special content replacement mutation Interest 16 / 8: Replaces values ​​in increments of 16 bits, starting from the beginning in steps of 8 bits.

[0036] Special content replacement mutation Interest 32 / 8: Replaces values ​​in 32-bit increments, starting from the beginning in 8-bit increments.

[0037] The token insertion / replacement mutations in step A4 include:

[0038] User tokens replacement mutation: Starting from scratch, the user-provided tokens are sequentially replaced into special content replacement mutation data.

[0039] User tokens insertion mutation: Starting from the beginning, the user-provided tokens are sequentially inserted into the special content replacement mutation data.

[0040] Automatic token replacement mutation detection: Starting from the beginning, automatically detected tokens are sequentially replaced into special content replacement mutation data.

[0041] Furthermore, step A5 includes the following sub-steps:

[0042] A51. Obtain the total bit depth L and maximum flip size Max_Flips of the input image / video file, and divide it into N processes. A52. For the i-th process, the flip size it is responsible for is within the range [start_flip, end_flip), where:

[0043] start_flip = (i * Max_Flips) / N

[0044] end_flip=[(i+1)*Max_Flips)] / N

[0045] i = 0, 1, 2, ..., N-1

[0046] A53. Using the partitioning strategy in steps A51 to A52, the mutation space of the deterministic fuzzy test is divided into N continuous and non-overlapping subspaces. The mutation operations in steps A1 to A4 are performed on the image and video input files in parallel through different subspaces to obtain the deterministic fuzzy test results.

[0047] Furthermore, the specific method for performing random fuzz testing on image and video input files using a subordinate pattern is as follows:

[0048] B1. An instance that runs multiple processes, using random mutation logic to perform parallel random fuzz testing on image and video input files.

[0049] B2. Continuously generate random test cases and input them into the target program for execution.

[0050] B3. By iteratively generating and executing test cases, continuously improve the quality of test cases and try to explore more program execution paths to obtain random fuzz test results.

[0051] Furthermore, the random mutation logic in step B1 includes:

[0052] Randomly select one bit from the data stream and flip it. Randomly select a byte and set it to a random and interesting value.

[0053] Randomly select a word, and randomly select its endianness and set it to a random and interesting value.

[0054] Randomly select a dword, and randomly select its endianness, then set it to a random and interesting value.

[0055] Select a random byte and subtract a random number from it.

[0056] Select a random byte and add a random number to it.

[0057] Randomly select a word, and randomly select its endianness (both big and little), then subtract a random number from it.

[0058] Randomly select a word, and randomly select its endianness (both big and little), then add a random number to it.

[0059] Randomly select a dword, and randomly select its endianness (big-endian or little-endian), then subtract a random number from it.

[0060] Randomly select a dword, and randomly select its endianness (big-endian or little-endian), then add a random number to it.

[0061] Select a random byte and set it as a random number.

[0062] Randomly delete a segment of bytes.

[0063] A random position is selected, and a piece of content of random length is inserted. There is a 75% probability that the content is inserted at a random position in the original text, and a 25% probability that a randomly selected number is inserted.

[0064] A random position is selected and replaced with a piece of content of random length. There is a 75% probability that the content will be replaced with the content at a random position in the original text, and a 25% probability that it will be replaced with a randomly selected number.

[0065] Randomly select a location and replace it with a randomly selected token.

[0066] Randomly select a position and insert it with a randomly selected token.

[0067] Furthermore, step S3 includes the following sub-steps:

[0068] S31. By simplifying the queue submodule to track and manage the queue directory of each instance in the master control mode and slave mode, the queues in the master control mode and slave mode are aggregated to obtain the global queue directory.

[0069] S32. The global queue directory is simplified through the pruning submodule to obtain the simplified corpus outputDir, which provides simplified input data for subsequent fuzzy testing.

[0070] Furthermore, step S32 includes the following sub-steps:

[0071] S321. Read the files in the global queue directory into the input file inputFiles.

[0072] S322. Add each input file (inputFile) to the traces and save the traces.

[0073] S323. Find the best files related to the traces being tracked.

[0074] S324. Sort the tracking targets according to their frequency to obtain sorted tracking targets.

[0075] S325. Traverse each trace in the sortedTraces list and obtain the best file associated with each uncovered trace.

[0076] S326. Copy each best file (bestFile) that is not in the simplified corpus outputDir to the simplified corpus outputDir.

[0077] S327. Output the simplified corpus outputDir to provide simplified input data for subsequent fuzzy testing.

[0078] The beneficial effects of this invention are:

[0079] (1) This invention addresses the problem of master-slave mechanism processing in the traditional AFL framework by proposing an improved measure of using multiple master control mode processes for parallel processing and rationally dividing deterministic fuzz testing. This effectively solves the problem that the processing speed in the traditional AFL framework does not increase linearly, and can discover format vulnerabilities in images and videos more efficiently.

[0080] (2) This invention addresses the problem of corpus duplication in the master-slave mechanism of the traditional AFL framework by proposing an improvement measure to simplify the corpus set during fuzzing testing, which has achieved significant results in improving the efficiency and coverage of fuzzing testing. Attached Figure Description

[0081] Figure 1 The diagram shows a flowchart of the image and video format vulnerability mining method based on fuzz testing provided in an embodiment of the present invention. Detailed Implementation

[0082] Exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the embodiments shown and described in the drawings are merely exemplary and are intended to illustrate the principles and spirit of the invention, and are not intended to limit the scope of the invention.

[0083] This invention provides a method for discovering image and video format vulnerabilities based on fuzz testing, such as... Figure 1 As shown, it includes the following steps S1 to S3:

[0084] S1. Obtain image and video input files from the user's seed library through the input module.

[0085] In this embodiment of the invention, the input module includes an input queue submodule and a file submodule. Through the collaborative work of the input queue module and the file module, input data can be dynamically managed and provided to subsequent processes.

[0086] Step S1 includes the following sub-steps S11 to S12:

[0087] S11. Obtain interesting samples from the user's seed library through the input queue submodule.

[0088] S12. Read image and video input files from interesting samples through the file submodule and provide them to the main control mode as input data.

[0089] In this embodiment of the invention, the seed library is a set of pre-prepared input files, which can be legitimate inputs, sample inputs, or inputs containing known vulnerabilities. The seed files in the seed library serve as the initial input for the subsequent fuzzer, used to generate mutations and test cases. The fuzzer starts by reading files from the user's seed library. After starting, the fuzzer can read interesting samples from the input queue submodule and pass the files to the fuzzing logic for fuzzing.

[0090] S2. Parallel fuzz testing is performed on the image and video input files through master and slave modes to uncover image and video format vulnerabilities.

[0091] In this embodiment of the invention, deterministic fuzz testing is performed on the image and video input files through the master control mode, while random fuzz testing is performed on the image and video input files through the slave mode. Image and video format vulnerabilities are discovered based on the results of deterministic fuzz testing and random fuzz testing.

[0092] In this embodiment of the invention, the specific method for performing deterministic fuzzy testing on image and video input files through the master control mode is as follows:

[0093] A1. Perform deterministic mutation on the image and video input files according to deterministic compilation logic to obtain deterministic mutated data, and at the same time determine the amount of inversion of the input data.

[0094] In this embodiment of the invention, deterministic variations include:

[0095] Deterministic mutation bitflip 1 / 1: Flips 1 bit at a time, starting from the beginning with a step size of 1 bit, flipping only the state of a single bit at a time, operating bit by bit, ensuring fine-grained mutation.

[0096] Deterministic mutation bitflip 2 / 1: Each time, flip two adjacent bits, starting from the beginning with a step size of 1 bit, and each time it acts on two adjacent bits, increasing the mutation intensity in the local area.

[0097] Deterministic mutation bitflip 4 / 1: Each time, flip 4 adjacent bits, starting from the beginning with a step size of 1 bit, and collectively flip 4 consecutive bits to further enrich the mutation patterns.

[0098] Deterministic mutation bitflip 8 / 8: flips 8 adjacent bits (one byte) at a time, proceeding byte by byte, operating independently on each byte of the file, thus achieving mutation by byte block.

[0099] Deterministic mutation bitflip 16 / 8: Flip 16 adjacent bits at a time, starting from the beginning and flipping each word in steps of 8 bits.

[0100] Deterministic mutation bitflip 32 / 8: Each time, flip 32 adjacent bits, starting from the beginning in 8-bit increments, and flip each dword sequentially.

[0101] A2. Use integer addition and subtraction operations to perform integer addition / subtraction arithmetic mutation on deterministic mutated data to obtain integer addition / subtraction arithmetic mutated data.

[0102] In this embodiment of the invention, the variations in integer addition / subtraction arithmetic operations include:

[0103] Arith 8 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 8 bits at a time, starting from the beginning in 8-bit increments, to mutate the byte-level data of the file.

[0104] Arith 16 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 16 bits at a time, starting from the beginning in 8-bit increments, and mutates the value of each 16-bit data unit.

[0105] Arith 32 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 32 bits at a time, starting from the beginning in 8-bit increments, and mutates the value of each 32-bit data unit.

[0106] A3. Replace the special content with integer addition / subtraction arithmetic operation mutation data and perform special content replacement (Interest) mutation to obtain special content replacement mutation data.

[0107] In this embodiment of the invention, the special content replacement variation includes:

[0108] Interest 8 / 8: Replaces the value of 8 bits at a time, starting from the beginning in 8-bit increments, to achieve precise redefinition of each byte.

[0109] Special content replacement mutation Interest 16 / 8: Replaces values ​​in increments of 16 bits, starting from the beginning in steps of 8 bits.

[0110] Special content replacement mutation Interest 32 / 8: Replaces values ​​in 32-bit increments, starting from the beginning in 8-bit increments.

[0111] A4. Replace or insert the automatically generated or user-provided token into the special content replacement mutation data to perform token insertion / replacement (Dictionary) mutation, and obtain token insertion / replacement mutation data.

[0112] In this embodiment of the invention, the token insertion / replacement mutation includes:

[0113] User tokens replacement mutation (User Extras Over): Starting from scratch, the user-provided tokens are sequentially replaced into special content replacement mutation data.

[0114] User tokens insertion mutation: Starting from the beginning, insert the user-provided tokens sequentially into the special content replacement mutation data.

[0115] Auto Extras Over: Starting from scratch, automatically detected tokens are sequentially replaced into the special content replacement mutation data.

[0116] A5. Divide the process according to the amount of flipping of the input data, and perform the mutation operations of steps A1 to A4 on the image and video input files in parallel according to different processes to obtain the deterministic fuzzy test results.

[0117] Step A5 includes the following sub-steps A51 to A53:

[0118] A51. Obtain the total bit depth L and maximum flip size Max_Flips of the input image / video file, and divide it into N processes. A52. For the i-th process, the flip size it is responsible for is within the range [start_flip, end_flip), where:

[0119] start_flip = (i * Max_Flips) / N

[0120] end_flip=[(i+1)*Max_Flips)] / N

[0121] i = 0, 1, 2, ..., N-1

[0122] A53. Using the partitioning strategy in steps A51 to A52, the mutation space of the deterministic fuzzy test is divided into N continuous and non-overlapping subspaces. The mutation operations in steps A1 to A4 are performed on the image and video input files in parallel through different subspaces to obtain the deterministic fuzzy test results.

[0123] In this embodiment of the invention, the flipped quantum space that each main control process is responsible for can be represented as:

[0124] FlipRange(i,N)=[(i*Max_Flips) / N,((i+1)*Max_Flips) / N)

[0125] In this embodiment of the invention, the specific method for performing random fuzz testing on image and video input files using a subordinate mode is as follows:

[0126] B1. An instance that runs multiple processes, using random mutation logic to perform parallel random fuzz testing on image and video input files.

[0127] In this embodiment of the invention, each process has one instance.

[0128] In this embodiment of the invention, the random mutation logic includes:

[0129] Randomly select one bit from the data stream and flip it. Then, randomly select a byte and set it to a random, interesting value.

[0130] Randomly select a word, and randomly select its endianness and set it to a random and interesting value.

[0131] Randomly select a dword, and randomly select its endianness, then set it to a random and interesting value.

[0132] Select a random byte and subtract a random number from it.

[0133] Select a random byte and add a random number to it.

[0134] Randomly select a word, and randomly select its endianness (both big and little), then subtract a random number from it.

[0135] Randomly select a word, and randomly select its endianness (both big and little), then add a random number to it.

[0136] Randomly select a dword, and randomly select its endianness (big-endian or little-endian), then subtract a random number from it.

[0137] Randomly select a dword, and randomly select its endianness (big-endian or little-endian), then add a random number to it.

[0138] Select a random byte and set it as a random number.

[0139] Randomly delete a segment of bytes.

[0140] A random position is selected, and a piece of content of random length is inserted. There is a 75% probability that the content is inserted at a random position in the original text, and a 25% probability that a randomly selected number is inserted.

[0141] A random position is selected and replaced with a piece of content of random length. There is a 75% probability that the content will be replaced with the content at a random position in the original text, and a 25% probability that it will be replaced with a randomly selected number.

[0142] Randomly select a location and replace it with a randomly selected token.

[0143] Randomly select a position and insert it with a randomly selected token.

[0144] B2. Continuously generate random test cases and input them into the target program for execution.

[0145] B3. By iteratively generating and executing test cases, continuously improve the quality of test cases and try to explore more program execution paths to obtain random fuzz test results.

[0146] In this embodiment of the invention, by using a subordinate mode, the fuzz tester can perform multiple test tasks in parallel, thus accelerating the fuzz testing process. Subordinate instances use various random mutation strategies to generate new test cases, and periodically synchronize the test case queue from the master control instance or other subordinate instances. This ensures that all instances can share and utilize discoveries from other instances, and each subordinate node can independently generate and execute test cases.

[0147] S3. Monitor the queue directory of each instance in master control mode and slave mode through the simplification module, and simplify the queue directory set to provide simplified input data for subsequent fuzz testing.

[0148] In the traditional AFL master-slave fuzzing framework, after the master fuzzer completes one loop, the slave fuzzer has already run many loops. At this point, there will be a very large corpus, and the probability of duplication among the slave processes is high. Therefore, a simplification module has been added in this embodiment of the invention.

[0149] During fuzz testing, AFL automatically places interesting targets into a queue. Therefore, the simplification module in this embodiment first designs a simplification queue module to collect the queue directory, and then designs a pruning module to prune this queue directory.

[0150] Step S3 includes the following sub-steps S31 to S32:

[0151] S31. By simplifying the queue submodule to track and manage the queue directory of each instance in the master control mode and slave mode, the queues in the master control mode and slave mode are aggregated to obtain the global queue directory.

[0152] In this embodiment of the invention, the streamlined queue submodule dynamically adjusts the queue based on the seed file's rating and priority to ensure that high-quality seed files can be processed and reused first, while the global queue queues seed files based on their code coverage.

[0153] S32. The global queue directory is simplified through the pruning submodule to obtain the simplified corpus outputDir, which provides simplified input data for subsequent fuzzy testing.

[0154] In this embodiment of the invention, the pruning submodule is an important supplement to the streamlined queue submodule. As master fuzzing and slave fuzzing proceed, a very large corpus accumulates, some of which are similar or redundant. The task of the pruning submodule is to analyze the test cases in the queue directory set and use deduplication or clustering algorithms to detect and remove similar or redundant test cases, thereby reducing the number of test cases. Since master fuzzing and slave fuzzing are iterative processes, the goal of the pruning submodule is to provide a more compact and streamlined set of test cases, i.e., a streamlined corpus outputDir, to facilitate more efficient input mutation and testing by the subsequent input module.

[0155] Step S32 includes the following sub-steps S321 to S327:

[0156] S321. Read the files in the global queue directory into the input file inputFiles.

[0157] S322. Add each input file (inputFile) to the traces and save the traces.

[0158] S323. Find the best files related to the traces being tracked.

[0159] S324. Sort the tracking targets according to their frequency to obtain sorted tracking targets.

[0160] S325. Traverse each trace in the sortedTraces list and obtain the best file associated with each uncovered trace.

[0161] S326. Copy each best file (bestFile) that is not in the simplified corpus outputDir to the simplified corpus outputDir.

[0162] S327. Output the simplified corpus outputDir to provide simplified input data for subsequent fuzzy testing.

[0163] The technical effects of the present invention will be explained in detail below with reference to specific experimental examples.

[0164] All experiments in this example were tested in the same experimental environment. The server was configured with an Intel(R) Xeon(R) Gold 6148 CPU @ 2.40GHz, 8GB of memory, and the operating system was Ubuntu 20.04; all programs ran on GLIBC 2.31-0ubuntu9.9.

[0165] This experiment selected six mainstream open-source software / libraries for image and video formats to reproduce known vulnerabilities, as shown in Table 1, including Libexif, LibTIFF, Mp4v2, Libpng, ImageMagick, and Bento4. In addition, this experiment also selected Mp4v2 and Bento4, two other mainstream software programs, to explore unknown vulnerabilities.

[0166] Table 1. Experimental data on known vulnerabilities

[0167]

[0168] This experimental example provides an in-depth analysis of the standard specifications for image and video formats to understand their structure and key identifiers. Based on these specifications, this example selects a rich set of images and designs fuzzy test cases for both images and videos, including operations such as shifting image dimensions and heights and changing key identifiers.

[0169] Through reproduction experiments on known vulnerabilities, the vulnerability discovery method proposed in this invention demonstrates a significant efficiency advantage. In the best-case scenario, the method improves vulnerability reproduction efficiency by 28.85% compared to traditional AFL; even in the worst-case scenario, the efficiency improvement is still 19.45%. Overall, the vulnerability reproduction efficiency of the method proposed in this invention is approximately 22.91% higher than that of traditional AFL. This experimental result highlights the superior performance of the two key improvements proposed in this invention: firstly, the use of multiple master control processes to rationally divide the deterministic mutation phase; and secondly, the simplification of the corpus set during fuzzing. This indicates that the vulnerability discovery method proposed in this invention has higher fuzzing efficiency. The vulnerability reproduction experimental results are shown in Table 2.

[0170] Table 2 shows the improved efficiency in reproducing known vulnerabilities.

[0171]

[0172] In this experiment, seven zero-day vulnerabilities were discovered during the discovery of unknown vulnerabilities. These seven zero-day vulnerabilities have been reported to CommonVulnerabilities & Exposures and assigned CVE numbers. The results of these discovered vulnerabilities are detailed in Table 3. These results demonstrate that the vulnerability discovery method proposed in this invention has achieved significant results in the discovery of unknown vulnerabilities.

[0173] Table 3 shows the zero-day vulnerabilities discovered.

[0174]

[0175] Analysis of the experimental results shows that the vulnerability discovery method proposed in this invention significantly improves the number of vulnerabilities discovered and code coverage compared to the original AFL. Under the same testing cycle, the method of this invention can discover more potential vulnerabilities and achieve higher code coverage. This demonstrates that the method of this invention has significant advantages in the effectiveness and efficiency of fuzz testing.

[0176] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A method for discovering image and video format vulnerabilities based on fuzz testing, characterized in that, Includes the following steps: S1. Obtain image and video input files from the user's seed library through the input module; S2. Parallel fuzz testing is performed on image and video input files using master control mode and slave mode to uncover image and video format vulnerabilities. S3. Monitor the queue directory of each instance in master control mode and slave mode through the simplified module, and simplify the queue directory set to provide simplified input data for subsequent fuzz testing. Step S2 specifically involves: Deterministic fuzz testing is performed on the image and video input files in master control mode, while random fuzz testing is performed on the image and video input files in slave mode. Image and video format vulnerabilities are discovered based on the results of deterministic and random fuzz testing. Step S3 includes the following sub-steps: S31. By simplifying the queue submodule, the queue directory of each instance in the master control mode and slave mode is tracked and managed, and the queues in the master control mode and slave mode are collected to obtain the global queue directory. S32. The global queue directory is simplified through the pruning submodule to obtain the simplified corpus outputDir, which provides simplified input data for subsequent fuzzy testing. Step S32 includes the following sub-steps: S321. Read the files in the global queue directory into the input file inputFiles; S322. Add each input file (inputFile) to the traces and save the traces. S323. Find the best files related to the traces being tracked; S324. Sort the tracking targets according to their frequency to obtain sorted tracking targets; S325. Traverse each trace in the sortedTraces list and obtain the best file associated with each uncovered trace. S326. Copy each best file (bestFile) that is not in the simplified corpus outputDir to the simplified corpus outputDir; S327. Output the simplified corpus outputDir to provide simplified input data for subsequent fuzzy testing.

2. The image and video format vulnerability mining method based on fuzz testing according to claim 1, characterized in that, Step S1 includes the following sub-steps: S11. Obtain interesting samples from the user's seed library through the input queue submodule; S12. Read image and video input files from interesting samples through the file submodule and provide them to the main control mode as input data.

3. The image and video format vulnerability mining method based on fuzz testing according to claim 1, characterized in that, The specific method for performing deterministic fuzzy testing on image and video input files through the master control mode is as follows: A1. Perform deterministic mutation on the image and video input files according to deterministic compilation logic to obtain deterministic mutated data, and at the same time determine the amount of flipping of the input data; A2. Use integer addition and subtraction operations to perform integer addition / subtraction arithmetic operations on deterministic mutated data to obtain integer addition / subtraction arithmetic mutated data; A3. Replace the special content with the integer addition / subtraction arithmetic operation mutation data to obtain the special content replacement mutation data; A4. Replace or insert the automatically generated or user-provided token into the special content replacement mutation data to perform token insertion / replacement mutation, and obtain token insertion / replacement mutation data; A5. Divide the process according to the amount of flipping of the input data, and perform the mutation operations described in steps A1 to A4 on the image and video input files in parallel according to different processes to obtain the deterministic fuzzy test results.

4. The image and video format vulnerability mining method based on fuzz testing according to claim 3, characterized in that, The deterministic variations in step A1 include: Deterministic mutation bitflip 1 / 1: Flips 1 bit at a time, starting from the beginning with a step size of 1 bit, flipping only the state of a single bit at a time, operating bit by bit, ensuring fine-grained mutation; Deterministic mutation bitflip 2 / 1: Each time, flip two adjacent bits, starting from the beginning with a step size of 1 bit, and each time it acts on two adjacent bits, increasing the mutation intensity in the local region; Deterministic mutation bitflip 4 / 1: Each time, flip 4 adjacent bits, starting from the beginning with a step size of 1 bit, and collectively flip 4 consecutive bits to further enrich the mutation pattern; Deterministic mutation bitflip 8 / 8: flips 8 adjacent bits (one byte) at a time, proceeding byte by byte, operating independently on each byte of the file, thus achieving mutation by byte block; Deterministic mutation bitflip 16 / 8: Flip 16 adjacent bits at a time, starting from the beginning and flipping each word in increments of 8 bits; Deterministic mutation bitflip 32 / 8: Each time, flip 32 adjacent bits, starting from the beginning in 8-bit increments, and flip each dword sequentially; The variations in integer addition / subtraction arithmetic operations in step A2 include: Arith 8 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 8 bits at a time, starting from the beginning in 8-bit increments, and performs numerical mutations on the byte-level data of the file. Arith 16 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 16 bits at a time, starting from the beginning in 8-bit increments, and mutates the value of each 16-bit data unit. Arith 32 / 8, an integer addition / subtraction arithmetic operation mutation, performs addition and subtraction operations on 32 bits at a time, starting from the beginning in 8-bit increments, and mutates the value of each 32-bit data unit. The special content substitution variations in step A3 include: Special content replacement mutation Interest 8 / 8: Replaces the value of 8 bits at a time, starting from the beginning in 8-bit increments, to achieve precise redefinition of each byte; Special content replacement mutation Interest 16 / 8: Replaces values ​​in increments of 16 bits, starting from the beginning in steps of 8 bits. Special content replacement mutation Interest 32 / 8: Replaces values ​​in 32-bit increments, starting from the beginning in 8-bit increments; The token insertion / replacement mutations in step A4 include: User tokens replacement mutation: Starting from the beginning, the user-provided tokens are sequentially replaced into the special content replacement mutation data; User tokens insertion mutation: Starting from the beginning, the user-provided tokens are sequentially inserted into the special content replacement mutation data; Automatic token replacement mutation detection: Starting from the beginning, automatically detected tokens are sequentially replaced into special content replacement mutation data.

5. The image and video format vulnerability mining method based on fuzz testing according to claim 3, characterized in that, Step A5 includes the following sub-steps: A51. Obtain the total number of bits L and the maximum number of flips Max_Flips of the image / video input file, and divide it into N processes; A52. For the i-th process, the range of flips it is responsible for is [start_flip, end_flip), where: start_flip = (i * Max_Flips) / N end_flip = [(i + 1) * Max_Flips)] / N i=0,1,2,...,N-1 A53. Using the partitioning strategy described in steps A51 to A52, the mutation space of the deterministic fuzzy test is divided into N continuous and non-overlapping subspaces. The mutation operations described in steps A1 to A4 are performed on the image and video input files in parallel through different subspaces to obtain the deterministic fuzzy test results.

6. The image and video format vulnerability mining method based on fuzz testing according to claim 1, characterized in that, The specific method for performing random fuzz testing on image and video input files using a subordinate mode is as follows: B1. An instance that runs multiple processes, using random mutation logic to perform parallel random fuzz testing on image and video input files; B2. Continuously generate random test cases and input them into the target program for execution; B3. By iteratively generating and executing test cases, continuously improve the quality of test cases and try to explore more program execution paths to obtain random fuzz test results.

7. The image and video format vulnerability mining method based on fuzz testing according to claim 6, characterized in that, The random mutation logic in step B1 includes: Randomly select one bit from the data stream and flip it; randomly select a byte and set it to a random and interesting value. Randomly select a word, and randomly select its endianness and set it to a random and interesting value; Randomly select a dword, and randomly select its endianness and set it to a random and interesting value; Randomly select a byte and subtract a random number from it; Randomly select a byte and add a random number to it; Randomly select a word, and randomly select its endianness (both big and little), then subtract a random number from it; Randomly select a word, and randomly select its endianness and add a random number to it; Randomly select a dword, and randomly select its endianness (big-endian or little-endian), then subtract a random number from it; Randomly select a dword, and randomly select its endianness and little-endianness, then add a random number to it; Randomly select a byte and set it as a random number; Randomly delete a segment of bytes; A random position is selected, and a piece of content of random length is inserted, with a 75% probability of inserting content from a random position in the original text and a 25% probability of inserting a randomly selected number. A random position is selected and replaced with a piece of content of random length, with a 75% probability of replacing it with content at a random position in the original text and a 25% probability of replacing it with a randomly selected number. Randomly select a location and replace it with a randomly selected token; Randomly select a position and insert it with a randomly selected token.

Images