A hybrid fuzz testing method, system and medium for command line options

Abstract

The present invention discloses a hybrid fuzz testing method, system and medium for command line options. The method of the present invention includes constructing a seed input vector for hybrid fuzz testing, combining fuzz testing with symbolic execution on the basis of the seed input vector to explore different command line parameter settings, combinations and conflicts, generating a perceptual hybrid testing scheme that adds seeds to a seed queue to perform testing on the instrumented program under test. The perceptual hybrid testing scheme first uses fuzz testing to preliminarily explore different program paths, then calls a symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings, and finally calls a constraint solver to obtain a new seed that can explore the new execution path and adds it to the seed queue. The present invention aims to combine fuzz testing technology and symbolic execution technology to efficiently generate effective command line option combinations and parameters that can explore the paths of different programs, thereby improving the code exploration space of fuzz testing.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability mining in the field of computer security, and in particular to a hybrid fuzzy testing method, system and medium for command line options. Background Art

[0002] Fuzz testing is one of the most successful search-based software testing methods. It continuously mutates inputs to increase code coverage, thereby triggering potential software defects (such as out-of-bounds access) in the software. Currently, most fuzz testing research focuses on optimizing fuzzing strategies, such as seed selection, energy scheduling, and seed mutation strategies. These improvements significantly improve fuzz testing code coverage and enhance the vulnerability discovery capabilities of fuzz testing tools. However, while the latest fuzz testing tools have strong program exploration capabilities, some unexplored code still exists. This unexplored code is affected by various command-line options. Command-line options and command-line parameters affect program execution, with different command-line options corresponding to different program execution branches. Therefore, only by specifying specific command-line options and setting specific command-line parameters, rather than modifying program input files, can program paths affected by command-line options be covered. However, in previously disclosed vulnerabilities, only a small fraction of options are specified. For example, Libtiff specified only 20 different options in 103 CVEs between 2014 and 2020, accounting for 9.8% of all options. This means that much option-dependent code may have remained unexplored. Since the number of combinations can be large, it is not practical to iterate over all combinations. Summary of the Invention

[0003] Technical problem to be solved by the present invention: In response to the above-mentioned problems in the prior art, a hybrid fuzz testing method, system and medium for command line options are provided. The present invention aims to combine fuzz testing technology and symbolic execution technology to efficiently generate effective command line option combinations and parameters that can explore the paths of different programs, thereby improving the code exploration space of fuzz testing.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] A hybrid fuzz testing method for command line options includes the following steps:

[0006] S101, constructing a seed input vector for hybrid fuzz testing, wherein the seed input vector is formed by concatenating a file vector constructed by the input file of the tested program and a command line vector constructed by all command line parameters so that the hybrid fuzz testing can explore different program paths affected by both the input file and the command line parameters;

[0007] S102, based on the seed input vector, combines fuzz testing with symbolic execution to explore different command line parameter settings, combinations and conflicts of the perceptual hybrid test scheme to generate seeds and add them to the seed queue to perform tests on the instrumented tested program. The perceptual hybrid test scheme first uses fuzz testing to preliminarily explore different program paths, then calls the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings, and finally calls the constraint solver to obtain new seeds that can explore the new execution path and add them to the seed queue.

[0008] Optionally, the function expression of the seed input vector in step S101 is:

[0009] ,

[0010] In the above formula, is the seed input vector, is the file vector, is the command line vector.

[0011] Optionally, the function expression of the command line vector in step S101 is:

[0012] ,

[0013] In the above formula, is the command line vector, ~ are n command line options of the target program, and the length of each command line option is the vector length corresponding to the parameter type of the command line option.

[0014] Optionally, in step S102, using fuzz testing to preliminarily explore different program paths includes:

[0015] S201, compress the effective mutation intervals of different command line vectors according to the following formula to perform mutation and generate new test cases:

[0016] ,

[0017] In the above formula, Indicates the i-th command line option of the target program The value of Represents the value of the command line vector, Indicates the value interval of effective variation, the value interval of effective variation Initialized to an empty set of values, represents the interval of values ​​for random variation, represents the running time of the fuzz test, Indicates the time threshold when fuzz testing starts using the valid mutation interval;

[0018] S202: Determine whether the new test case covers the new path. If not, end and exit. If the new path is covered, update the effective mutation value range according to the following formula: :

[0019] ,

[0020] ,

[0021] In the above formula, Indicates a merge operation. Indicates that the test coverage of the fuzz test has increased, and the mutation is now a valid mutation;

[0022] S203, adding the new test case as a new seed to the seed queue, and optimizing the energy distribution of each seed in the seed queue according to the effective mutation interval of different command line vectors, so that the energy of each seed is positively correlated with the length of the effective value interval of the command line vector input to the seed. The energy of the seed is used to calculate the number of mutations of the seed based on the AFL method.

[0023] Optionally, when optimizing the energy distribution of each seed in the seed queue according to the effective variation interval of different command line vectors in step S203, the calculation function expression of the energy of each seed is:

[0024] ,

[0025] In the above formula, Indicates the i-th seed in the seed queue energy, Indicates the i-th seed in the seed queue The length of the valid value interval of the input command line vector, Represents the average length of the valid value interval of the command line vector of all seed inputs in the seed queue, Indicates the i-th seed in the seed queue The seed basic energy value obtained based on the AFL method.

[0026] Optionally, when calling the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings in step S102, it includes calling the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings to obtain uncovered execution branches and a set of path constraints for the uncovered execution branches, wherein the uncovered execution branches refer to program branches that have not been covered and executed by the current fuzz testing tool, and the path constraints in the path constraint set refer to constraints from the program entry point entry along the execution path of the seed to the uncovered branch; if the uncovered execution branches and the set of path constraints for the uncovered execution branches are empty, the constraint solver is called to obtain a new seed that can explore the new execution path and add it to the seed queue; otherwise, it ends and exits.

[0027] Optionally, in step S102, calling the constraint solver to obtain a new seed capable of exploring a new execution path and adding the new seed to the seed queue includes:

[0028] S301, a priority score is calculated based on the cumulative total symbolic execution time of the seed and the number of uncovered branches found on the seed execution path. The calculation function expression of the priority score is:

[0029] ,

[0030] In the above formula, Indicates seed Priority score, Indicates seed The set of unexplored branches in the path The size of For seeds At the time of the i-th symbolic execution, For seeds The total number of symbolic executions;

[0031] S302, sorting all seeds in descending order according to their priority scores;

[0032] S303, select the seed with the highest priority score to perform symbolic execution to explore the uncovered branches on the seed execution path, and call the constraint solver Z3 to solve the path constraints of the uncovered branches, generate seeds that can explore new branches and add them to the seed queue.

[0033] In addition, the present invention also provides a hybrid fuzz testing system for command line options, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the hybrid fuzz testing method for command line options.

[0034] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program / instruction. The computer program / instruction is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor.

[0035] In addition, the present invention also provides a computer program product, including a computer program / instruction, which is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor.

[0036] Compared with the prior art, the present invention mainly has the following advantages:

[0037] 1. To address the problem that fuzz testing and symbolic execution cannot change command line option combinations and command line option parameter values ​​to explore program execution paths, the present invention involves reconstructing the seed input structure of the seed input vector for fuzz testing and symbolic execution. The seed input vector is composed of a file vector constructed from the input file of the tested program and a command line vector constructed from all command line parameters. This allows hybrid fuzz testing to explore different program paths influenced by both the input file and command line parameters. The seed structure is divided into two parts: the first part is a vector composed of the program's file input, and the second part is a vector composed of the command line option parameters. During the static analysis phase, the number, value type, and value range of all command line options are obtained to form the value ranges of different command line options. Based on the number and type of command line options, a command line vector of sufficient length is constructed to accommodate all command line option values. Based on the value range of the command line options, the present invention further proposes an interval compression algorithm to optimize the mutation efficiency of fuzz testing and the solution efficiency of symbolic execution.

[0038] 2. Mutation optimization technology for command line vectors. The number of command line option combinations is exploding as the number of command line options increases. Therefore, iteratively executing all command line option combinations to test their effectiveness is unrealistic. To efficiently explore different command line option combinations, the present invention mutates only the command line vectors in the seed and controls whether a particular command line option is enabled by changing the command line vector value. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 Schematic diagram of the basic principle of the method of the embodiment of the present invention. DETAILED DESCRIPTION

[0040] This paper proposes a hybrid fuzz testing technique for command-line options to accurately detect the correspondence between different command-line options and parameter settings and program execution paths, and efficiently generate effective command-line option combinations and parameters that can explore different program paths. This hybrid fuzz testing technique for command-line options combines fuzz testing and symbolic execution. Fuzz testing can rapidly generate a large number of input files to explore program execution paths. Symbolic execution can negate constraints on seed execution paths to discover unexplored branches and invoke a constraint solver to solve these path constraints and generate new inputs. The technical problems addressed by this invention include: 1. Reconstructing the seed input structure for fuzz testing and symbolic execution. Traditional fuzz testing and symbolic execution techniques use program file input as seed input and focus on optimizing fuzz testing strategies, such as seed selection, energy scheduling, and seed mutation strategies, to mutate different byte values ​​of the seed to attempt to cover different program paths. To explore program paths affected by different command-line options, we also use command-line option parameters as seed input for the hybrid fuzz testing system. The seed input structure consists of a concatenation of the byte vector of the program input file (referred to as the file vector) and the byte vector constructed from all command-line option parameters (referred to as the command-line vector). Therefore, the first challenge is to improve the efficiency of hybrid testing based on the file vector and command-line vector seed inputs. Second, fuzz-based command-line option combination testing. The number of command-line option combinations explodes with the number of command-line options. Therefore, iteratively executing all command-line option combinations to test their effectiveness is unrealistic. To efficiently explore different command-line option combinations, we choose to mutate only the command-line vector in the seed and control whether a particular command-line option is enabled by changing the command-line vector value. Therefore, the second technical challenge is to determine how to mutate different command-line vectors in fuzz testing and provide feedback on program execution information to guide command-line vector mutation and improve fuzzing mutation efficiency. Third, combining the efficient mutation efficiency of fuzz testing with the path-aware capabilities of symbolic execution. Since the number of command-line combinations can be large, it is unrealistic to iterate over all combinations. To avoid the blindness and randomness of fuzz testing, a symbolic executor traces the execution path of the seed input, collects path constraints related to the command-line vector, and discovers uncovered branches by constraint negation. Finally, the symbolic executor calls the constraint solver to solve the path constraints associated with the command line vector, obtaining command line option parameters that can cover the new path and setting the exploration and exploitation phases of adaptively coordinated directed fuzzing. Therefore, how to combine the mutation efficiency of fuzzing with the path-awareness of symbolic execution is the third technical problem to be solved.

[0041] like Figure 1As shown, this embodiment provides a hybrid fuzz testing method for command line options, including the following steps:

[0042] S101, constructing a seed input vector for hybrid fuzz testing, wherein the seed input vector is formed by concatenating a file vector constructed by the input file of the tested program and a command line vector constructed by all command line parameters so that the hybrid fuzz testing can explore different program paths affected by both the input file and the command line parameters;

[0043] S102, based on the seed input vector, combines fuzz testing with symbolic execution to explore different command line parameter settings, combinations and conflicts of the perceptual hybrid test scheme to generate seeds and add them to the seed queue to perform tests on the instrumented tested program. The perceptual hybrid test scheme first uses fuzz testing to preliminarily explore different program paths, then calls the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings, and finally calls the constraint solver to obtain new seeds that can explore the new execution path and add them to the seed queue.

[0044] The function expression of the seed input vector in step S101 of this embodiment is:

[0045] ,

[0046] In the above formula, is the seed input vector, is the file vector, is the command line vector.

[0047] The function expression of the command line vector in step S101 of this embodiment is:

[0048] ,

[0049] In the above formula, is the command line vector, ~ are n command line options of the target program, and the length of each command line option is the vector length corresponding to the parameter type of the command line option.

[0050] In step S102 of this embodiment, fuzz testing is used to preliminarily explore different program paths, including:

[0051] S201, compress the effective mutation intervals of different command line vectors according to the following formula to perform mutation and generate new test cases:

[0052] ,

[0053] In the above formula, Indicates the i-th command line option of the target program The value of Represents the value of the command line vector, Indicates the value interval of effective variation, the value interval of effective variation Initialized to an empty set of values, represents the interval of values ​​for random variation, represents the running time of the fuzz test, Indicates the time threshold when fuzz testing starts using the valid mutation interval;

[0054] S202: Determine whether the new test case covers the new path. If not, exit. If not, update the effective mutation value interval according to the following formula. :

[0055] ,

[0056] ,

[0057] In the above formula, Indicates a merge operation. Indicates that the test coverage of the fuzz test has increased, and the mutation is now a valid mutation;

[0058] S203 adds the new test case as a new seed to the seed queue. The energy distribution of each seed in the seed queue is optimized based on the effective mutation range of different command line vectors, ensuring that the energy of each seed is positively correlated with the length of the effective value range of the seed's input command line vector. The seed energy is used to calculate the number of seed mutations using the AFL method. The AFL-based method is a well-known method. For details, see the AFL technical white paper: Michal Zalewski. American Fuzzy Lop. [Online]. Available: http: / / lcamtuf.coredump.cx / afl / technical_details.txt.

[0059] In step S203 of this embodiment, when optimizing the energy distribution of each seed in the seed queue according to the effective variation interval of different command line vectors, the calculation function expression of the energy of each seed is:

[0060] ,

[0061] In the above formula, Indicates the i-th seed in the seed queue energy, Indicates the i-th seed in the seed queue The length of the valid value interval of the input command line vector, Represents the average length of the valid value interval of the command line vector of all seed inputs in the seed queue, Indicates the i-th seed in the seed queue The basic energy value of the seed obtained by the AFL method. If the valid value interval length of the seed input is longer than the average valid value interval length, the energy allocated to the seed by the fuzz test will be higher.

[0062] In step S102 of this embodiment, when calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings, it includes calling the symbolic execution tool to perceive the path constraints of the new execution path and the corresponding command line parameter settings to obtain uncovered execution branches and a set of path constraints for the uncovered execution branches. The uncovered execution branches refer to program branches that have not been covered and executed by the current fuzz testing tool, and the path constraints in the path constraint set refer to constraints from the program entry point entry along the execution path of the seed to the uncovered branch; if the uncovered execution branches and the set of path constraints for the uncovered execution branches are empty, the constraint solver is called to obtain a new seed that can explore the new execution path and add it to the seed queue; otherwise, it ends and exits.

[0063] In step S102 of this embodiment, calling the constraint solver to obtain a new seed capable of exploring a new execution path and adding the new seed to the seed queue includes:

[0064] S301, a priority score is calculated based on the cumulative total symbolic execution time of the seed and the number of uncovered branches found on the seed execution path. The calculation function expression of the priority score is:

[0065] ,

[0066] In the above formula, Indicates seed Priority score, Indicates seed The set of unexplored branches in the path The size of For seeds At the time of the i-th symbolic execution, For seeds The total number of symbolic executions;

[0067] S302, sorting all seeds in descending order according to their priority scores;

[0068] In step S303, the seed with the highest priority score is selected for symbolic execution to explore uncovered branches on the seed execution path. The constraint solver Z3 is then invoked to solve the path constraints for the uncovered branches. A seed capable of exploring new branches is generated and added to the seed queue. Specifically, in step S303 of this embodiment, the symbolic execution uses the Epsilon-Greedy algorithm (a well-known algorithm) to symbolically execute the high-priority seed with high probability and a low-priority seed with low probability. During this process, symbolic execution continuously prunes "unsolvable" branches, thereby improving the execution and solution efficiency of symbolic execution.

[0069] like Figure 1 As shown, the method of this embodiment mainly includes the following three components: a static analysis component, which mainly implements two functions (1) to identify all command line options of each program and the parameter types of different command line options. For example, the parameter type of the command line option "-C 1" is "int", and the parameter type of "-d" is bool value, etc. (2) to analyze the combination template of seed input, that is, how to design the seed input vector based on the file vector and the command line vector. A fuzz test component, which is used to perform fuzz testing on the target program. The fuzz test component fixes the file vector and continuously mutates the command line vector to explore the program execution path. In this component, a command line vector mutation optimization module is introduced. The command line vector mutation optimization module can optimize the command line vector mutation strategy (such as excluding conflicting command line vector values, etc.) based on the mutation feedback of the command line vector (i.e., whether the new execution path is covered). A symbolic execution component, which is used to track the execution path of the seed, find uncovered branches, and solve the constraint condition set of the path of the uncovered branch to generate new seeds. These new seeds will be fed back to the fuzz test component to help the fuzz test explore new program paths. The symbolic execution component introduces a command line option perception module to perceive and record the legal combinations and legal values ​​of different command line options, so as to optimize the fuzz testing strategy and symbolic execution strategy.

[0070] The three components of this embodiment's method operate as follows: 1) The static analysis component identifies all command-line options for each program and the parameter types of different command-line options, analyzes the seed input combination template, and analyzes how to design seed input vectors based on file vectors and command-line vectors. The component then instrumentes the target program. 2) The fuzz testing component and symbolic execution component are simultaneously enabled, selecting seeds from the seed queue for testing. 3) The command-line vector mutation optimization module is enabled. Based on the command-line vector mutation results, the command-line vector mutation strategy is optimized, prioritizing command-line option combinations and values ​​that improve coverage and eliminating conflicting command-line vector values. 4) The testing process checks whether new paths have been discovered. If so, the seed is retained in the seed queue and passed to the symbolic execution component. 5) The command-line option awareness module in the symbolic execution component is enabled. Based on the correspondence between the mutated command-line vectors and the execution path, the symbolic execution component determines the symbolic execution order of the seeds, pruning unsolvable and unreachable branches. 6) The symbolic execution component traces the execution path of the seed, collects path constraints along the execution path, and negates each constraint to identify uncovered branches. 7) If the uncovered branch is not pruned by the command line option perception module, the symbolic execution component calls the constraint solver to solve the path constraint set of the branch, generates a seed input that can cover the branch, and obtains a valid command line vector input. 8) The program execution is terminated by the user's pause operation or the preset running time. The key points of the method of this embodiment include: (1) Reconstructing the seed input structure of fuzz testing and symbolic execution: In order to solve the problem that fuzz testing and symbolic execution cannot change the command line option combination and command line option parameter value to explore the program execution path, this embodiment modifies the structure of the seed in the hybrid fuzz test. This embodiment divides the seed structure into two parts: the first part is a vector composed of the program's file input, and the second part is a vector composed of the command line option parameters. In the static analysis stage, this embodiment obtains the number, value type and value range of all command line options to form the value range of different command line options. Based on the number and type of command line options, this embodiment constructs a command line vector of considerable length so that it can accommodate all command line option values; based on the value range of the command line options, this embodiment proposes an interval compression algorithm to optimize the mutation efficiency of fuzz testing and the solution efficiency of symbolic execution. (2) Mutation optimization technology for command line vectors. The number of command line option combinations tends to explode as the number of command line options increases. Therefore, it is unrealistic to iteratively execute all command line option combinations to test their effectiveness. In order to efficiently explore different command line option combinations, this embodiment chooses to mutate only the command line vectors in the seed and control whether a certain command line option is enabled by changing the command line vector value. (3) Command line option awareness and branch priority technology solutions for symbolic execution.This scheme calculates seed priorities based on the number of symbolic executions of different seed inputs and a cumulative time threshold, determining the symbolic execution order of the seeds. Symbolic execution then uses the Epsilon-Greedy algorithm to symbolically execute high-priority seeds with high probability and low-priority seeds with low probability. Furthermore, during this process, symbolic execution continuously prunes "unsolvable" branches to improve both execution and solution efficiency.

[0071] In summary, this embodiment discloses a hybrid fuzz testing method for program command line parameter settings, including reconstructing the seed input structure (the structure of the seed input vector) for fuzz testing and symbolic execution. The seed input structure is composed of a byte vector of the program input file and a byte vector constructed from all command line parameters, enabling hybrid fuzz testing to explore different program paths affected by both the program input file and the command line parameters; and designing a perceptual hybrid testing scheme that explores different command line parameter settings, combinations, and conflicts. This perceptual hybrid testing scheme combines fuzz testing with symbolic execution in a complementary manner. It first uses fuzz testing to preliminarily explore different program paths; then, the scheme calls a symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings; finally, the scheme calls a constraint solver to obtain the command line parameter vector value that can explore the new execution path. This perceptual hybrid testing scheme avoids the blindness of randomly combining different command line options and randomly setting different command line parameters, effectively improving the testing efficiency of command line parameters.

[0072] In addition, this embodiment also provides a hybrid fuzz testing system for command line options, including a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to execute the hybrid fuzz testing method for command line options.

[0073] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program / instruction. The computer program / instruction is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor.

[0074] In addition, this embodiment also provides a computer program product, including a computer program / instruction, which is programmed or configured to execute the hybrid fuzz testing method for command line options through a processor.

[0075] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions described in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0076] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A hybrid fuzz testing method for command line options, characterized in that: The steps include: S101, constructing a seed input vector for hybrid fuzz testing, wherein the seed input vector is formed by concatenating a file vector constructed by the input file of the tested program and a command line vector constructed by all command line parameters so that the hybrid fuzz testing can explore different program paths affected by both the input file and the command line parameters; S102: Based on the seed input vector, a perceptual hybrid testing scheme combining fuzz testing and symbolic execution is used to explore different command line parameter settings, combinations, and conflicts. The generated seeds are added to a seed queue and tested on the instrumented program under test. The perceptual hybrid testing scheme first uses fuzz testing to preliminarily explore different program paths, then calls a symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings. Finally, a constraint solver is called to obtain a new seed capable of exploring the new execution path and add it to the seed queue. The initial exploration of different program paths using fuzz testing includes: S201, compress the effective mutation intervals of different command line vectors according to the following formula to perform mutation and generate new test cases: ， In the above formula, Indicates the i-th command line option of the target program The value of Represents the value of the command line vector, Indicates the value interval of effective variation, the value interval of effective variation Initialized to an empty set of values, represents the interval of values ​​for random variation, represents the running time of the fuzz test, Indicates the time threshold when fuzz testing starts using the valid mutation interval; S202: Determine whether the new test case covers the new path. If not, end and exit. If the new path is covered, update the effective mutation value range according to the following formula: : ， ， In the above formula, Indicates a merge operation. Indicates that the test coverage of the fuzz test has increased, and the mutation is now a valid mutation; S203, adding the new test case as a new seed to the seed queue, and optimizing the energy distribution of each seed in the seed queue according to the effective mutation interval of different command line vectors, so that the energy of each seed is positively correlated with the length of the effective value interval of the command line vector input to the seed. The energy of the seed is used to calculate the number of mutations of the seed based on the AFL method.

2. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: The function expression of the seed input vector in step S101 is: ， In the above formula, is the seed input vector, is the file vector, is the command line vector.

3. The hybrid fuzz testing method for command line options according to claim 2, characterized in that: The function expression of the command line vector in step S101 is: ， In the above formula, is the command line vector, ~ are n command line options of the target program, and the length of each command line option is the vector length corresponding to the parameter type of the command line option.

4. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: When optimizing the energy distribution of each seed in the seed queue according to the effective variation interval of different command line vectors in step S203, the calculation function expression of the energy of each seed is: ， In the above formula, Indicates the i-th seed in the seed queue energy, Indicates the i-th seed in the seed queue The length of the valid value interval of the input command line vector, Represents the average length of the valid value interval of the command line vector of all seed inputs in the seed queue, Indicates the i-th seed in the seed queue The seed basic energy value obtained based on the AFL method.

5. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: When calling the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings in step S102, it includes calling the symbolic execution tool to perceive the path constraints of the new execution path and its corresponding command line parameter settings to obtain uncovered execution branches and a set of path constraints for the uncovered execution branches. The uncovered execution branches refer to program branches that have not been covered and executed by the current fuzz testing tool, and the path constraints in the path constraint set refer to constraints from the program's entry point entry along the execution path of the seed to the uncovered execution branch; if the uncovered execution branches and the set of path constraints for the uncovered execution branches are empty, the constraint solver is called to obtain a new seed that can explore the new execution path and add it to the seed queue; otherwise, it ends and exits.

6. The hybrid fuzz testing method for command line options according to claim 1, characterized in that: In step S102, calling the constraint solver to obtain a new seed capable of exploring a new execution path and adding it to the seed queue includes: S301, a priority score is calculated based on the cumulative total symbolic execution time of the seed and the number of uncovered branches found on the seed execution path. The calculation function expression of the priority score is: ， In the above formula, Indicates seed Priority score, Indicates seed The set of unexplored branches in the path The size of For seeds At the time of the i-th symbolic execution, For seeds The total number of symbolic executions; S302, sorting all seeds in descending order according to their priority scores; S303, select the seed with the highest priority score to perform symbolic execution to explore the uncovered branches on the seed execution path, and call the constraint solver Z3 to solve the path constraints of the uncovered branches, generate seeds that can explore new branches and add them to the seed queue.

7. A hybrid fuzz testing system for command line options, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the hybrid fuzz testing method for command line options as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program / instruction stored therein, characterized in that: The computer program / instruction is programmed or configured to execute, through a processor, the hybrid fuzz testing method for command line options as recited in any one of claims 1 to 6.

9. A computer program product comprising a computer program / instructions, characterized in that The computer program / instruction is programmed or configured to execute, through a processor, the hybrid fuzz testing method for command line options as recited in any one of claims 1 to 6.

Images