Hybrid fuzz testing method and system for command line options and medium

Abstract

The invention discloses a hybrid fuzz testing method and system for command line options and a medium, and the method comprises the steps: constructing a seed input vector for hybrid fuzz testing, on the basis of a seed input vector, fuzzy testing and symbolic execution are combined to explore a perceptual hybrid testing scheme for parameter setting, combination and conflict of different command lines to generate a seed, and the seed is added into a seed queue to execute a test on a tested program subjected to instrumentation; according to the perceptual hybrid test scheme, firstly, different program paths are preliminarily explored by using fuzzy testing, then, a symbolic execution tool is called to perceive a new execution path and a path constraint set by a command line parameter corresponding to the new execution path, and finally, a constraint solver is called to obtain a new seed capable of exploring the new execution path and add the new seed into a seed queue. The invention aims to combine a fuzzy test technology and a symbolic execution technology to efficiently generate effective command line option combinations and parameters capable of exploring paths of different programs, and the code exploration space of fuzzy test is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability mining in the field of computer security, and in particular to a hybrid fuzzy testing method, system and medium for command line options. Background Art

[0002] Fuzz testing is one of the most successful search-based software testing methods. It continuously mutates inputs to increase code coverage, thereby triggering potential software defects in the software (such as out-of-bounds access, etc.). Currently, most fuzz testing research is devoted to optimizing fuzz testing strategies, such as seed selection, energy scheduling, and seed mutation strategies. These improvements significantly improve the code coverage of fuzz testing and enhance the vulnerability discovery capabilities of fuzz testing tools. However, although the latest fuzz testing tools already have strong program exploration capabilities, there are still some unexplored codes. These unexplored codes are affected by different command line options. Command line options and command line parameters affect the execution of the program, and different command line options correspond to different program execution branches. Therefore, only by specifying specific command line options and setting specific command line parameters instead of changing the program input file can the program path affected by the command line options be covered. However, in previously exposed vulnerabilities, only a small part of the options were specified. For example, Libtiff only specified 20 different options in 103 CVEs between 2014 and 2020, accounting for 9.8% of all options, which means that many codes that rely on options may not have been explored yet. Since the number of combinations can be large, it is not practical to iterate over all combinations. Summary of the invention

[0003] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a hybrid fuzz testing method, system and medium for command line options are provided. The present invention aims to combine fuzz testing technology and symbolic execution technology to efficiently generate effective command line option combinations and parameters that can explore paths of different programs, thereby improving the code exploration space of fuzz testing.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: A hybrid fuzz testing method for command line options includes the following steps: S101, constructing a seed input vector for hybrid fuzz testing, wherein the seed input vector is formed by concatenating a file vector constructed by an input file of a tested program and a command line vector constructed by all command line parameters so that the hybrid fuzz testing can explore different program paths jointly affected by the input file and the command line parameters; S102, based on the seed input vector, combines fuzz testing with symbolic execution to explore different command line parameter settings, combinations and conflicts of perceptual hybrid testing solutions to generate seeds and add them to the seed queue to perform tests on the plugged program under test. The perceptual hybrid testing solution first uses fuzz testing to preliminarily explore different program paths, then calls the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings, and finally calls the constraint solver to obtain new seeds that can explore the new execution path and add them to the seed queue.

[0005] Optionally, the function expression of the seed input vector in step S101 is: , In the above formula, is the seed input vector, is the file vector, is the command line vector.

[0006] Optionally, the function expression of the command line vector in step S101 is: , In the above formula, is the command line vector, ~ are n command line options of the target program, and the length of each command line option is the vector length corresponding to the parameter type of the command line option.

[0007] Optionally, using fuzz testing to preliminarily explore different program paths in step S102 includes: S201, compressing the effective mutation intervals of different command line vectors according to the following formula to perform mutation and generate new test cases: , In the above formula, Represents the i-th command line option of the target program The value of Represents the value of the command line vector, represents the value interval of effective variation, the value interval of effective variation Initialized to an empty set of values, represents the interval of values ​​for random variation, represents the running time of the fuzz test, Indicates the time threshold when fuzz testing starts using the valid mutation interval; S202, determine whether the new test case covers the new path, if not, end and exit; if the new path is covered, update the effective mutation value interval according to the following formula : , , In the above formula, Represents a merge operation. It indicates that the test coverage of fuzz testing has increased, and the mutation is now a valid mutation; S203, adding the new test case as a new seed to the seed queue, and optimizing the energy distribution of each seed in the seed queue according to the effective mutation interval of different command line vectors, so that the energy of each seed is positively correlated with the length of the effective value interval of the command line vector input to the seed, and the energy of the seed is used to calculate the number of mutations of the seed based on the AFL method.

[0008] Optionally, when optimizing the energy allocation of each seed in the seed queue according to the effective variation interval of different command line vectors in step S203, the calculation function expression of the energy of each seed is: , In the above formula, Indicates the i-th seed in the seed queue The energy Indicates the i-th seed in the seed queue The length of the valid value interval of the input command line vector, Represents the average length of the valid value interval of the command line vector of all seed inputs in the seed queue, Indicates the i-th seed in the seed queue The seed base energy value obtained based on the AFL method.

[0009] Optionally, when calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings in step S102, it includes calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings to obtain uncovered execution branches and a set of path constraints for the uncovered execution branches, wherein the uncovered execution branches refer to program branches that have not been covered and executed by the current fuzz testing tool, and the path constraints in the path constraint set refer to constraints from the program entry point entry along the execution path of the seed to the uncovered branch; if the uncovered execution branches and the set of path constraints for the uncovered execution branches are empty, the constraint solver is called to obtain a new seed that can explore the new execution path and add it to the seed queue; otherwise, it ends and exits.

[0010] Optionally, in step S102, calling the constraint solver to obtain a new seed capable of exploring a new execution path and adding the new seed to the seed queue includes: S301, a priority score is calculated by combining the cumulative total symbolic execution time of the seed and the number of uncovered branches found on the seed execution path. The calculation function expression of the priority score is: , In the above formula, Indicates seed The priority score of Indicates seed The set of unexplored branches in the path The size of For seeds At the time of the i-th symbolic execution, For seeds The total number of symbolic executions of ; S302, arranging all seeds in descending order according to their priority scores; S303, select the seed with the highest priority score to perform symbolic execution to explore the uncovered branches on the seed execution path, and call the constraint solver Z3 to solve the path constraints of the uncovered branches, generate seeds that can explore new branches and add them to the seed queue.

[0011] In addition, the present invention also provides a hybrid fuzzy testing system for command line options, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the hybrid fuzzy testing method for command line options.

[0012] In addition, the present invention also provides a computer-readable storage medium, in which a computer program / instruction is stored. The computer program / instruction is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor.

[0013] In addition, the present invention also provides a computer program product, including a computer program / instruction, which is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor.

[0014] Compared with the prior art, the present invention mainly has the following advantages: 1. In order to solve the problem that fuzz testing and symbolic execution cannot change the command line option combination and command line option parameter value to explore the program execution path, the present invention includes a seed input structure of the seed input vector of the fuzz testing and symbolic execution, and the seed input vector is composed of a file vector constructed by the input file of the tested program and a command line vector constructed by all command line parameters so that the hybrid fuzz test can explore different program paths jointly affected by the input file and the command line parameters, thereby dividing the seed structure into two parts: the first part is a vector composed of the file input of the program, and the second part is a vector composed of the command line option parameters. In the static analysis stage, the number, value type and value range of all command line options are obtained to form the value intervals of different command line options. Based on the number and type of command line options, a command line vector of considerable length is constructed so that it can accommodate all command line option values; based on the value interval of the command line options, the present invention further proposes an interval compression algorithm to optimize the mutation efficiency of fuzz testing and the solution efficiency of symbolic execution.

[0015] 2. Mutation optimization technology for command line vectors. The number of command line option combinations shows an explosive trend as the number of command line options increases. Therefore, it is unrealistic to iteratively execute all command line option combinations to test the effectiveness of command line option combinations. In order to efficiently explore different command line option combinations, the present invention selects to mutate only the command line vector in the seed, and controls whether to enable a certain command line option by changing the command line vector value. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Schematic diagram of the basic principle of the method of the embodiment of the present invention. DETAILED DESCRIPTION

[0017] The present invention proposes a hybrid fuzz testing technology for command line options to accurately perceive the correspondence between different command line options and parameter settings and program execution paths, and efficiently generate effective command line option combinations and parameters that can explore the paths of different programs. The hybrid fuzz testing technology for command line options is a technology that combines fuzz testing technology and symbolic execution technology. On the one hand, fuzz testing can quickly generate a large number of input files to explore program execution paths; on the other hand, symbolic execution can negate the constraints on the seed execution path to find unexplored branches, and call the constraint solver to solve the path constraints to generate new inputs. The technical problems to be solved by the present invention include: 1. Reconstructing the seed input structure of fuzz testing and symbolic execution. Traditional fuzz testing and symbolic execution technologies use program file input as seed input, and are committed to optimizing fuzz testing strategies, such as seed selection, energy scheduling, and seed mutation strategies, etc., to mutate different byte values ​​of the seed, thereby trying to cover different program paths. In order to explore the program paths affected by different command line options, we also use the parameters of the command line options as seed inputs for the hybrid fuzz testing system. The seed input structure is composed of the byte vector of the program input file (referred to as file vector) and the byte vector constructed by all command line option parameters (referred to as command line vector). Therefore, how to reasonably improve the efficiency of hybrid testing based on the file vector and command line vector seed input is the first problem to be solved. 2. Command line option combination test based on fuzz testing. The number of command line option combinations shows an explosive trend as the number of command line options increases. Therefore, it is unrealistic to iteratively execute all command line option combinations to test the effectiveness of command line option combinations. In order to efficiently explore different command line option combinations, we choose to only mutate the command line vector in the seed, and control whether a certain command line option is enabled by changing the command line vector value. Therefore, how to change different command line vectors in fuzz testing and feedback program execution information to guide command line vector mutation and improve fuzz test mutation efficiency is the second technical problem to be solved. 3. Combine the efficient mutation efficiency of fuzz testing with the path perception capability of symbolic execution. Since the number of command line combinations may be large, it is unrealistic to iterate all combinations. In order to avoid the blindness and randomness of fuzz testing, the symbolic executor will track the execution path of the seed input, collect the path constraints related to the command line vector, and find uncovered branches by constraint negation. Finally, the symbolic executor will call the constraint solver to solve the path constraints related to the command line vector, and obtain the command line option parameters that can cover the new path to set the exploration and utilization phases of adaptive coordinated directed fuzz testing. Therefore, how to combine the mutation efficiency of fuzz testing with the path perception ability of symbolic execution is the third technical problem to be solved.

[0018] like Figure 1As shown, this embodiment provides a hybrid fuzz testing method for command line options, comprising the following steps: S101, constructing a seed input vector for hybrid fuzz testing, wherein the seed input vector is formed by concatenating a file vector constructed by an input file of a tested program and a command line vector constructed by all command line parameters so that the hybrid fuzz testing can explore different program paths jointly affected by the input file and the command line parameters; S102, based on the seed input vector, combines fuzz testing with symbolic execution to explore different command line parameter settings, combinations and conflicts of perceptual hybrid testing solutions to generate seeds and add them to the seed queue to perform tests on the plugged program under test. The perceptual hybrid testing solution first uses fuzz testing to preliminarily explore different program paths, then calls the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings, and finally calls the constraint solver to obtain new seeds that can explore the new execution path and add them to the seed queue.

[0019] The function expression of the seed input vector in step S101 of this embodiment is: , In the above formula, is the seed input vector, is the file vector, is the command line vector.

[0020] The function expression of the command line vector in step S101 of this embodiment is: , In the above formula, is the command line vector, ~ are n command line options of the target program, and the length of each command line option is the vector length corresponding to the parameter type of the command line option.

[0021] In step S102 of this embodiment, the fuzz test is used to preliminarily explore different program paths, including: S201, compressing the effective mutation intervals of different command line vectors according to the following formula to perform mutation and generate new test cases: , In the above formula, Represents the i-th command line option of the target program The value of Represents the value of the command line vector, represents the value interval of effective variation, the value interval of effective variation Initialized to an empty set of values, represents the interval of values ​​for random variation, represents the running time of the fuzz test, Indicates the time threshold when fuzz testing starts using the valid mutation interval; S202, determine whether the new test case covers the new path, if not, end and exit; if the new path is covered, update the effective mutation value interval according to the following formula : , , In the above formula, Represents a merge operation. It indicates that the test coverage of fuzz testing has increased, and the mutation is now a valid mutation; S203, adding the new test case as a new seed to the seed queue, and optimizing the energy distribution of each seed in the seed queue according to the effective variation interval of different command line vectors, so that the energy of each seed is positively correlated with the effective value interval length of the command line vector input of the seed, and the energy of the seed is used to calculate the number of mutations of the seed based on the AFL method. The AFL-based method is an existing well-known method, see the AFL technical white paper: Michal Zalewski. American Fuzzy Lop. [Online]. Available: http: / / lcamtuf.coredump.cx / afl / technical_details.txt for details.

[0022] In step S203 of this embodiment, when optimizing the energy allocation of each seed in the seed queue according to the effective variation interval of different command line vectors, the calculation function expression of the energy of each seed is: , In the above formula, Indicates the i-th seed in the seed queue The energy Indicates the i-th seed in the seed queue The length of the valid value interval of the input command line vector, Represents the average length of the valid value interval of the command line vector of all seed inputs in the seed queue, Indicates the i-th seed in the seed queue The basic energy value of the seed obtained based on the AFL method. If the effective value interval length of the seed input is longer than the average effective value interval length, the energy allocated to the seed by the fuzz test will be higher.

[0023] In step S102 of this embodiment, when calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings, it includes calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings to obtain uncovered execution branches and a set of path constraints for the uncovered execution branches, wherein the uncovered execution branches refer to program branches that have not been covered and executed by the current fuzz testing tool, and the path constraints in the path constraint set refer to constraints from the program entry point entry along the execution path of the seed to the uncovered branch; if the uncovered execution branches and the set of path constraints for the uncovered execution branches are empty, the constraint solver is called to obtain a new seed that can explore the new execution path and add it to the seed queue; otherwise, the process ends and exits.

[0024] In step S102 of this embodiment, calling the constraint solver to obtain a new seed capable of exploring a new execution path and adding the new seed to the seed queue includes: S301, a priority score is calculated by combining the cumulative total symbolic execution time of the seed and the number of uncovered branches found on the seed execution path. The calculation function expression of the priority score is: , In the above formula, Indicates seed The priority score of Indicates seed The set of unexplored branches in the path The size of For seeds At the time of the i-th symbolic execution, For seeds The total number of symbolic executions of ; S302, arranging all seeds in descending order according to their priority scores; S303, select the seed with the highest priority score to perform symbolic execution to explore the uncovered branches on the seed execution path, and call the constraint solver Z3 to solve the path constraints of the uncovered branches, generate seeds that can explore new branches and add them to the seed queue. Specifically, in step S303 of this embodiment, the symbolic execution uses the Epsilon-Greedy algorithm (an existing well-known algorithm) to execute a seed with a high priority with a high probability symbol, and executes a seed with a low priority with a low probability random symbol. In this process, the symbolic execution will continue to prune the "unsolvable" branches, thereby improving the execution and solution efficiency of the symbolic execution.

[0025] like Figure 1As shown, the method of this embodiment mainly includes the following three components: a static analysis component, which mainly implements two functions (1) for identifying all command line options of each program and the parameter types of different command line options. For example, the parameter type of the command line option "-C 1" is "int", and the parameter type of "-d" is bool value, etc. (2) analyzing the combination template of seed input, that is, how to design the seed input vector based on the file vector and the command line vector. A fuzz test component, which is used to perform fuzz testing on the target program. The fuzz test component fixes the file vector and continuously mutates the command line vector to explore the program execution path. In this component, a command line vector mutation optimization module is introduced. The command line vector mutation optimization module can optimize the command line vector mutation strategy (such as excluding the value of the conflicting command line vector, etc.) according to the mutation feedback of the command line vector (i.e., whether the new execution path is covered). A symbolic execution component, which is used to track the execution path of the seed, find uncovered branches, and solve the constraint condition set of the path of the uncovered branch to generate new seeds. These new seeds will be fed back to the fuzz test component to help the fuzz test explore new program paths. The symbolic execution component introduces a command line option perception module to perceive and record the legal combinations and legal values ​​of different command line options, so as to optimize the fuzz testing strategy and symbolic execution strategy.

[0026] The working process of the three components of the method of this embodiment is as follows: 1) The static analysis component identifies all command line options of each program and the parameter types of different command line options, analyzes the combination template of seed input, that is, how to design seed input vectors based on file vectors and command line vectors, and inserts the target program. 2) The fuzz test component and the symbolic execution component are started at the same time, and seeds are selected from the seed queue for testing; 3) The mutation optimization module of the command line vector is started, and the mutation strategy of the command line vector is optimized according to the mutation results of the command line vector, and the command line option combination and value that improve the coverage rate are given priority, and the conflicting command line vector values ​​are excluded; 4) Check whether a new path is found during the test process. If so, the seed is reserved and put into the seed queue, and the seed is passed to the symbolic execution component; 5) The command line option perception module in the symbolic execution component is started, and the symbolic execution order of the seed is determined according to the corresponding relationship between the command line vector that has been mutated and executed and the execution path, and the unsolvable and unreachable branches are pruned. 6) The symbolic execution component tracks the execution path of the seed, collects the path constraints on the execution path, and negates each constraint condition to find uncovered branches. 7) If the uncovered branch is not pruned by the command line option perception module, the symbolic execution component calls the constraint solver to solve the path constraint set of the branch, generates a seed input that can cover the branch, and obtains a valid command line vector input. 8) The program execution is terminated by the user's pause operation or the preset running time. The key points of the method of this embodiment include: (1) Reconstructing the seed input structure of fuzz testing and symbolic execution: In order to solve the problem that fuzz testing and symbolic execution cannot change the command line option combination and command line option parameter value to explore the program execution path, this embodiment modifies the structure of the seed in the hybrid fuzz test. This embodiment divides the seed structure into two parts: the first part is a vector composed of the file input of the program, and the second part is a vector composed of the command line option parameters. In the static analysis stage, this embodiment obtains the number, value type and value range of all command line options to form the value interval of different command line options. Based on the number and type of command line options, this embodiment constructs a command line vector of considerable length so that it can accommodate all command line option values; based on the value interval of the command line option, this embodiment proposes an interval compression algorithm to optimize the mutation efficiency of fuzz testing and the solution efficiency of symbolic execution. (2) Mutation optimization technology for command line vectors. The number of command line option combinations shows an explosive trend as the number of command line options increases. Therefore, it is unrealistic to iteratively execute all command line option combinations to test the effectiveness of command line option combinations. In order to efficiently explore different command line option combinations, this embodiment chooses to mutate only the command line vector in the seed, and controls whether a certain command line option is enabled by changing the command line vector value. (3) Command line option perception and branch priority technology solutions for symbolic execution.The scheme calculates the seed priority based on the number of times different seed inputs have been symbolically executed and the cumulative time threshold, and determines the symbolic execution order of the seeds. Then, the symbolic execution uses the Epsilon-Greedy algorithm to symbolically execute a seed with a high priority with a high probability, and a seed with a low priority with a low probability random symbol. In addition, during this process, the symbolic execution will continue to prune the "unsolvable" branches to improve the execution and solution efficiency of the symbolic execution.

[0027] In summary, this embodiment discloses a hybrid fuzz testing method for program command line parameter settings, including reconstructing the seed input structure (seed input vector structure) of fuzz testing and symbolic execution, which is composed of the byte vector of the program input file and the byte vector constructed by all command line parameters, so that the hybrid fuzz testing can explore different program paths jointly affected by the program input file and the command line parameters; designing a perceptual hybrid testing scheme that explores different command line parameter settings, combinations and conflicts. The perceptual hybrid testing scheme combines fuzz testing with symbolic execution in a complementary way. It first uses fuzz testing to preliminarily explore different program paths; then, the scheme calls the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings; finally, the scheme calls the constraint solver to obtain the command line parameter vector value that can explore the new execution path. The perceptual hybrid testing scheme avoids the blindness of randomly combining different command line options and randomly setting different command line parameters, and effectively improves the testing efficiency of command line parameters.

[0028] In addition, this embodiment also provides a hybrid fuzzy testing system for command line options, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the hybrid fuzzy testing method for command line options.

[0029] In addition, this embodiment also provides a computer-readable storage medium, in which a computer program / instruction is stored. The computer program / instruction is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor.

[0030] In addition, this embodiment also provides a computer program product, including a computer program / instruction, which is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor. Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0031] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A hybrid fuzz testing method for command line options, characterized in that: The steps include: S101, constructing a seed input vector for hybrid fuzz testing, wherein the seed input vector is formed by concatenating a file vector constructed by an input file of a tested program and a command line vector constructed by all command line parameters so that the hybrid fuzz testing can explore different program paths jointly affected by the input file and the command line parameters; S102, based on the seed input vector, combines fuzz testing with symbolic execution to explore different command line parameter settings, combinations and conflicts of perceptual hybrid testing solutions to generate seeds and add them to the seed queue to perform tests on the plugged program under test. The perceptual hybrid testing solution first uses fuzz testing to preliminarily explore different program paths, then calls the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings, and finally calls the constraint solver to obtain new seeds that can explore the new execution path and add them to the seed queue.

2. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: The function expression of the seed input vector in step S101 is: ， In the above formula, is the seed input vector, is the file vector, is the command line vector.

3. The hybrid fuzz testing method for command line options according to claim 2, characterized in that: The function expression of the command line vector in step S101 is: ， In the above formula, is the command line vector, ~ are n command line options of the target program, and the length of each command line option is the vector length corresponding to the parameter type of the command line option.

4. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: In step S102, fuzz testing is used to initially explore different program paths, including: S201, compressing the effective mutation intervals of different command line vectors according to the following formula to perform mutation and generate new test cases: ， In the above formula, Represents the i-th command line option of the target program The value of Represents the value of the command line vector, represents the value interval of effective variation, the value interval of effective variation Initialized to an empty set of values, represents the interval of values ​​for random variation, represents the running time of the fuzz test, Indicates the time threshold when fuzz testing starts using the valid mutation interval; S202, determine whether the new test case covers the new path, if not, end and exit; if the new path is covered, update the effective mutation value interval according to the following formula : ， ， In the above formula, Represents a merge operation. It indicates that the test coverage of fuzz testing has increased, and the mutation is now a valid mutation; S203, adding the new test case as a new seed to the seed queue, and optimizing the energy distribution of each seed in the seed queue according to the effective mutation interval of different command line vectors, so that the energy of each seed is positively correlated with the length of the effective value interval of the command line vector input to the seed, and the energy of the seed is used to calculate the number of mutations of the seed based on the AFL method.

5. The hybrid fuzz testing method for command line options according to claim 4, characterized in that: When optimizing the energy allocation of each seed in the seed queue according to the effective variation interval of different command line vectors in step S203, the calculation function expression of the energy of each seed is: ， In the above formula, Indicates the i-th seed in the seed queue The energy Indicates the i-th seed in the seed queue The length of the valid value interval of the input command line vector, Represents the average length of the valid value interval of the command line vector of all seed inputs in the seed queue, Indicates the i-th seed in the seed queue The seed base energy value obtained based on the AFL method.

6. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: When calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings in step S102, it includes calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings to obtain uncovered execution branches and a set of path constraints for the uncovered execution branches, wherein the uncovered execution branches refer to program branches that have not been covered and executed by the current fuzz testing tool, and the path constraints in the path constraint set refer to constraints from the program entry point entry along the execution path of the seed to the uncovered branch; if the uncovered execution branches and the set of path constraints for the uncovered execution branches are empty, the constraint solver is called to obtain new seeds that can explore the new execution path and add them to the seed queue; otherwise, the process ends and exits.

7. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: In step S102, calling the constraint solver to obtain a new seed capable of exploring a new execution path and adding the new seed to the seed queue includes: S301, a priority score is calculated by combining the cumulative total symbolic execution time of the seed and the number of uncovered branches found on the seed execution path. The calculation function expression of the priority score is: ， In the above formula, Indicates seed The priority score of Indicates seed The set of unexplored branches in the path The size of For seeds At the time of the ith symbolic execution, For seeds The total number of symbolic executions of ; S302, arranging all seeds in descending order according to their priority scores; S303, select the seed with the highest priority score to perform symbolic execution to explore the uncovered branches on the seed execution path, and call the constraint solver Z3 to solve the path constraints of the uncovered branches, generate seeds that can explore new branches and add them to the seed queue.

8. A hybrid fuzz testing system for command line options, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the hybrid fuzz testing method for command line options as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored therein, characterized in that: The computer program / instruction is programmed or configured to execute the hybrid fuzz testing method for command line options as described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program / instructions, characterized in that The computer program / instruction is programmed or configured to execute the hybrid fuzz testing method for command line options described in any one of claims 1 to 7 through a processor.

Images