Fuzzy test automatic vulnerability positioning method

Abstract

The invention relates to the technical field of system security testing, in particular to an automatic vulnerability positioning method for fuzzy testing, which comprises a contract source code, the contract source code is in data connection with a fuzzy tester, the fuzzy tester is in data connection with a JSON file, the JSON file is in data connection with an AST abstract semantic tree, the AST abstract semantic tree is in signal connection with an abstract analysis module, and the abstract analysis module is in data connection with the fuzzy tester. The abstract analysis module is in data connection with an attack-susceptible branch module, the attack-susceptible branch module is in signal connection with a branch resource allocation module, and the branch resource allocation module is in signal connection with a fuzzy execution module. The fuzzy tester can explore most branches in the smart contract, including difficult branches which are difficult to reach through a conventional test means, and potential security vulnerabilities in the smart contract can be identified by using fuzzy testing.

Description

Technical Field

[0001] The present invention relates to the technical field of system security testing, and in particular to a fuzzy testing automated vulnerability location method. Background Art

[0002] Blockchain is hailed as the most disruptive innovative technology in the Fourth Industrial Revolution and an important breakthrough for the country's independent innovation in core technologies. The rise of blockchain technology has promoted the widespread application of smart contracts, and decentralized applications have therefore been able to develop rapidly. However, the frequent occurrence of smart contract security vulnerabilities has not only caused serious economic losses, but also brought huge security risks to the trusted transaction environment of the entire blockchain ecosystem. In recent years, more and more researchers in academia and industry have begun to devote themselves to security vulnerability detection in order to accurately detect security vulnerabilities in smart contracts.

[0003] The current mainstream vulnerability detection methods can be divided into two categories: one method revolves around static analysis technology, which relies on logical rules defined by experts to detect vulnerabilities, but these rules are fixed and easily bypassed by attackers, resulting in problems such as the inconsistency between static analysis results and actual operation conditions; the other method uses fuzz testing technology, which has strong interpretability and can effectively point out the location of contract vulnerabilities, thereby further guiding developers to patch the vulnerabilities. However, the current fuzz testing technology still has problems such as chaotic function call sequences, strong randomness of test cases, and random allocation of test resources, which seriously affects the efficiency of fuzz testing and the accuracy of vulnerability detection and location. To this end, our fuzz testing automated vulnerability location method solves the above problems. Summary of the invention

[0004] The purpose of the present invention is to provide a fuzzy testing automated vulnerability location method to solve the problems raised in the above background technology.

[0005] The technical solution of the present invention is: a fuzzy testing automated vulnerability positioning method, including a contract source code, the contract source code data is connected to a fuzz tester, the fuzz tester data is connected to a JSON file, the JSON file data is connected to an AST abstract semantic tree, the AST abstract semantic tree signal is connected to an abstract analysis module, the abstract analysis module data is connected to a vulnerable branch module, the vulnerable branch module signal is connected to a branch resource allocation module, the branch resource allocation module signal is connected to a fuzzy execution module, the fuzzy execution module signal is connected to a fuzzy testing module, the fuzzy testing module signal is connected to a data diversion module, and the data diversion module data is connected to a vulnerability detection module.

[0006] Preferably, the fuzzy testing module is signal-connected to the abstract analysis module, and the fuzzy execution module is data-connected to the vulnerable branch module.

[0007] Preferably, the data diversion module includes a data flow analyzer, a branch distance analyzer and an abstract interpretation analyzer, the data diversion analyzer is signal-connected to the branch distance analyzer, and the data diversion analyzer is data-connected to the abstract interpretation analyzer.

[0008] Preferably, the vulnerability detection module is connected to the contract code data.

[0009] Preferably, the data diversion module is data-connected to the branch resource allocation module.

[0010] Preferably, the method comprises the following steps:

[0011] Step S1: Given a smart contract source code as input, the fuzz tester will first compile the contract source code and generate a JSON file containing bytecode and binary application interface information as follows:

[0012] {bytecode:{...};abi:{..};..}

[0013] Step S2: The fuzz tester will extract the AST abstract semantic tree of the smart contract from the JSON file, and perform data flow dependency analysis on the global variables in the contract. After analyzing the reading and writing of global variables in each function, the order priority of the function guess and the function getReward is calculated, and a suitable function call sequence guess→getReward is generated. The mutation strategy is selected according to the distance feedback, and a large number of different inputs are generated for the function call sequence guess→getReward. After each round of execution, the branch distance function results of the current test case and the seed test case are compared, and the seed is updated according to the principle of reducing the distance. The quality of the seed is continuously improved, and the test cases generated by the fuzz tester can explore most of the branches in the program, and the difficult branch mag.walue=50fmney will be satisfied;

[0014] Step S3: When the fuzz test reaches the time limit or finds all branches in the contract, it will start to analyze the covered paths and find the target branches that need to be tested. The target branches include rare branches with multiple layers of nesting and vulnerable branches with vulnerability characteristics in the contract source code. The vulnerable branches are obtained by semantic analysis and abstract interpretation analysis of the smart contract source code. Through the analysis of the contract source code, it is found that block-number and now are related to the block number dependency vulnerability and the timestamp dependency vulnerability. The related mlmhxe keywords are related to the reentrancy vulnerability. The fuzz tester will continue to test according to the allocated resources;

[0015] Step S4: The seeds corresponding to the high resource branch will be selected for mutation first. The test cases that can reach PrizePool = SafeAdd (prizePool, msg.value) at the same time will be executed first. When the program executes to userBalnace [masg.sender] = SafeAdd (userBalance [msg.sender]), msg.value * 2

[0016] When the timestamp instruction TIMESTAMP and the adjacent encryption instruction SHA3 are recorded, the msg.sender.call.value(userBa[msg.sender]) condition is met. The execution will trigger the call.value function to perform the transfer operation. The operation will interact with the pre-deployed attack contract. The attack contract will launch a reentrancy attack and repeatedly call the getReward function. The fuzz tester will record the CALL instructions executed in the process. When analyzing the execution log, the fuzz tester will find that the timestamp instruction is executed together with the encryption instruction, which meets the timestamp dependency vulnerability rule.

[0017] Step S5: There are timestamp dependency vulnerabilities and reentrancy vulnerabilities in the fuzz tester. When the resources allocated to each branch are exhausted, the fuzz test ends and the corresponding vulnerability detection report is output;

[0018] Step S6: Analyze the contract using the data flow analysis strategy to generate the guess→newGame function call sequence as follows:

[0019] (1) The fuzz tester will use the seed iteration optimization strategy to make the generated function guess input continuously approach the branch condition until it enters functiongetRewardpayableexternal;

[0020] (2) The fuzz tester uses the resource allocation strategy to make as many test cases as possible test if (userBalance[msg.sg.sender]<PrizePool&useBalance[msg.sg.sender]>0);

[0021] (3) When the fuzz tester executes msg.sender.call.value(userBalance[msg.sender]), it triggers the rules related to the balance vulnerability in the vulnerability analysis strategy and records when the EVM executes the BALANCE instruction;

[0022] (4) According to the balance dependency vulnerability rule in the vulnerability analysis strategy, the fuzz tester will analyze whether the EVM executes a conditional jump or comparison instruction after executing the BALANCE instruction;

[0023] (5) When the conditions of (3) and (4) are met, the fuzz tester discovers the vulnerability and locates it.

[0024] The present invention provides an automated vulnerability location method for fuzzy testing by improvement, which has the following improvements and advantages compared with the prior art:

[0025] First, by generating a large number of test cases and function call sequences, the fuzz tester of the present invention can explore most branches in smart contracts, including those "difficult branches" that are difficult to reach through conventional testing methods. By using fuzz testing, potential security vulnerabilities in smart contracts can be identified, such as timestamp dependency vulnerabilities, reentrancy vulnerabilities, and Ethereum balance dependency vulnerabilities. If these vulnerabilities are not discovered and repaired, they may lead to the theft of contract funds or abnormal contract behavior. After discovering the vulnerability, the fuzz tester can record the instructions and conditions that trigger the vulnerability, helping developers to accurately locate and repair the vulnerability. Through continuous fuzz testing and optimization, the security and Robustness, reducing the risk of attacks. Fuzz testing is an automated testing method that can save a lot of manual testing time and improve testing efficiency. It can also automatically adjust the test strategy according to the test results to better cover the logical branches in the contract. Fuzz testing can be performed before the smart contract is deployed to the production environment. Potential security issues can be discovered and fixed in advance to avoid attacks and losses after the contract goes online. Fuzz testing can be used as a continuous monitoring tool to perform security tests on smart contracts regularly or in real time to ensure that they always maintain a high level of security. Fuzz testing is not limited to discovering specific types of vulnerabilities, but can also be used to detect many different types of vulnerabilities.

[0026] Second: The present invention starts with the contract source code, and finally completes the vulnerability detection through a series of automated modules and tools, thereby improving the efficiency of security testing and reducing the possibility of human error. Through the AST abstract semantic tree and abstract analysis module, the contract source code can be deeply semantically analyzed to discover possible security vulnerabilities. This semantic-based analysis method is more comprehensive and accurate than the traditional text-based analysis. The vulnerable branch module can identify the vulnerable branches in the contract source code, and then allocate more resources for fuzz testing. This ensures that key security issues receive more attention and processing. The fuzzy execution module and the fuzzy testing module can perform efficient fuzz testing on the contract source code according to the allocated resources, simulating various possible inputs and scenarios to discover potential security vulnerabilities. The data diversion module can divert data to different vulnerability detection modules according to the test results to achieve targeted vulnerability detection. This can not only improve the accuracy of vulnerability detection, but also speed up the process of vulnerability repair. The entire system adopts a modular design, and each module communicates through data connection and signal connection, which makes the system very scalable. New functional modules can be added or existing modules can be replaced as needed. Due to the use of semantic-based analysis methods and fuzz testing technology, the system can adapt to different types of contract source codes and different security requirements. Regardless of the complexity of the contract source code, the system can effectively perform security testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will be further explained below in conjunction with the accompanying drawings and embodiments:

[0028] Figure 1 It is a flow chart of the fuzzy testing automated vulnerability location method of the present invention;

[0029] Figure 2 It is a schematic diagram of the execution sequence of the generation function of the present invention;

[0030] Figure 3 It is a schematic diagram of the fuzzy test process guided by distance feedback of the present invention. DETAILED DESCRIPTION

[0031] The present invention is described in detail below, and the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] The present invention provides an automated vulnerability location method for fuzzy testing by improvement. The technical solution of the present invention is:

[0033] like Figure 1 - Figure 3 As shown, a fuzzy testing automated vulnerability location method includes a contract source code, a contract source code data connection with a fuzz tester, a fuzz tester data connection with a JSON file, a JSON file data connection with an AST abstract semantic tree, an AST abstract semantic tree signal connection with an abstract analysis module, an abstract analysis module data connection with a vulnerable branch module, a vulnerable branch module signal connection with a branch resource allocation module, a branch resource allocation module signal connection with a fuzzy execution module, a fuzzy execution module signal connection with a fuzzy testing module, a fuzzy testing module signal connection with a data diversion module, and a data diversion module data connection with a vulnerability detection module.

[0034] Furthermore, the fuzzy testing module is signal-connected with the abstract analysis module, the fuzzy execution module is data-connected with the vulnerable branch module, the fuzzy testing module is signal-connected with the abstract analysis module, and the fuzzy execution module is data-connected with the vulnerable branch module, which has important application value in software security testing and vulnerability discovery, improves the automation and efficiency of testing, enhances the accuracy of testing, promotes the collaborative work of testing and analysis, conducts precise testing on vulnerable branches, quickly discovers potential vulnerabilities, and improves the flexibility and scalability of testing.

[0035] Furthermore, the data diversion module includes a data flow analyzer, a branch distance analyzer and an abstract interpretation analyzer. The data diversion analyzer is signal-connected to the branch distance analyzer, and the data diversion analyzer is data-connected to the abstract interpretation analyzer. The data diversion module integrates the data flow analyzer, the branch distance analyzer and the abstract interpretation analyzer, and realizes their collaborative work through a specific connection method, thereby bringing many benefits, such as improving data processing efficiency, optimizing resource allocation, enhancing system flexibility and scalability, improving decision-making accuracy, and reducing system complexity and maintenance costs.

[0036] Furthermore, the vulnerability detection module is connected to the contract code data. Through the direct connection with the contract code data, the vulnerability detection module can analyze the code in real time and efficiently to discover potential security vulnerabilities. Compared with the traditional code review method, this method can greatly reduce the detection time and improve the detection efficiency. At the same time, because it is connected to the original code data, the detection results are more accurate and reliable.

[0037] Furthermore, the data diversion module is data-connected with the branch resource allocation module. Through accurate data diversion and resource allocation, the system can ensure that each data flow branch can obtain sufficient processing resources while avoiding waste of resources.

[0038] Further, the following steps are included:

[0039] Step S1: Given a smart contract source code as input, the fuzz tester will first compile the contract source code and generate a JSON file containing bytecode and binary application interface information as follows:

[0040] {bytecode:{...};abi:{...};..}

[0041] Step S2: The fuzz tester will extract the AST abstract semantic tree of the smart contract from the JSON file, and perform data flow dependency analysis on the global variables in the contract. After analyzing the reading and writing of global variables in each function, the order priority of the function guess and the function getReward is calculated, and a suitable function call sequence guess→getReward is generated. The mutation strategy is selected according to the distance feedback, and a large number of different inputs are generated for the function call sequence guess→getReward. After each round of execution, the branch distance function results of the current test case and the seed test case are compared, and the seed is updated according to the principle of reducing the distance. The quality of the seed is continuously improved, and the test cases generated by the fuzz tester can explore most of the branches in the program, and the difficult branch mag.walue=50fmney will be satisfied;

[0042] Step S3: When the fuzz test reaches the time limit or finds all branches in the contract, it will start to analyze the covered paths and find the target branches that need to be tested. The target branches include rare branches with multiple layers of nesting and vulnerable branches with vulnerability characteristics in the contract source code. The vulnerable branches are obtained by semantic analysis and abstract interpretation analysis of the smart contract source code. Through the analysis of the contract source code, it is found that block-number and now are related to the block number dependency vulnerability and the timestamp dependency vulnerability. The related mlmhxe keywords are related to the reentrancy vulnerability. The fuzz tester will continue to test according to the allocated resources;

[0043] Step S4: The seeds corresponding to the high resource branch will be selected for mutation first. The test cases that can reach PrizePool = SafeAdd (prizePool, msg.value) at the same time will be executed first. When the program executes to userBalnace [masg.sender] = SafeAdd (userBalance [msg.sender]), msg.value * 2

[0044] When the timestamp instruction TIMESTAMP and the adjacent encryption instruction SHA3 are recorded, the msg.sender.call.value(userBa[msg.sender]) condition is met. The execution will trigger the call.value function to perform the transfer operation. The operation will interact with the pre-deployed attack contract. The attack contract will launch a reentrancy attack and repeatedly call the getReward function. The fuzz tester will record the CALL instructions executed in the process. When analyzing the execution log, the fuzz tester will find that the timestamp instruction is executed together with the encryption instruction, which meets the timestamp dependency vulnerability rule.

[0045] Step S5: There are timestamp dependency vulnerabilities and reentrancy vulnerabilities in the fuzz tester. When the resources allocated to each branch are exhausted, the fuzz test ends and the corresponding vulnerability detection report is output;

[0046] Step S6: Analyze the contract using the data flow analysis strategy to generate the guess→newGame function call sequence as follows:

[0047] (1) The fuzz tester will use the seed iteration optimization strategy to make the generated function guess input continuously approach the branch condition until it enters functiongetRewardpayableexternal;

[0048] (2) The fuzz tester uses the resource allocation strategy to make as many test cases as possible test if (userBalance[msg.sg.sender]<PrizePool&useBalance[msg.sg.sender]>0);

[0049] (3) When the fuzz tester executes msg.sender.call.value(userBalance[msg.sender]), it triggers the rules related to the balance vulnerability in the vulnerability analysis strategy and records when the EVM executes the BALANCE instruction;

[0050] (4) According to the balance dependency vulnerability rule in the vulnerability analysis strategy, the fuzz tester will analyze whether the EVM executes a conditional jump or comparison instruction after executing the BALANCE instruction;

[0051] (5) When the conditions of (3) and (4) are met, the fuzz tester discovers the vulnerability and locates it.

[0052] The above description enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A fuzzy testing automated vulnerability location method, including contract source code, characterized in that: The contract source code data is connected to a fuzz tester, the fuzz tester data is connected to a JSON file, the JSON file data is connected to an AST abstract semantic tree, the AST abstract semantic tree signal is connected to an abstract analysis module, the abstract analysis module data is connected to a vulnerable branch module, the vulnerable branch module signal is connected to an allocation branch resource module, the allocation branch resource module signal is connected to a fuzzy execution module, the fuzzy execution module signal is connected to a fuzzy testing module, the fuzzy testing module signal is connected to a data diversion module, and the data diversion module data is connected to a vulnerability detection module.

2. The fuzzy testing automated vulnerability location method according to claim 1, characterized in that: The fuzzy test module is signal-connected to the abstract analysis module, and the fuzzy execution module is data-connected to the vulnerable branch module.

3. The fuzzy testing automated vulnerability location method according to claim 1, characterized in that: The data diversion module includes a data flow analyzer, a branch distance analyzer and an abstract interpretation analyzer. The data diversion analyzer is connected to the branch distance analyzer by signal, and the data diversion analyzer is connected to the abstract interpretation analyzer by data.

4. The fuzzy testing automated vulnerability location method according to claim 1, characterized in that: The vulnerability detection module is connected to the contract code data.

5. The fuzzy testing automated vulnerability location method according to claim 1, characterized in that: The data diversion module is data-connected with the branch resource allocation module.

6. The fuzzy testing automated vulnerability location method according to claim 1, characterized in that: The following steps are involved: Step S1: Given a smart contract source code as input, the fuzz tester will first compile the contract source code and generate a JSON file containing bytecode and binary application interface information as follows: {bytecode: {...}; abi: {...};...} Step S2: The fuzz tester will extract the AST abstract semantic tree of the smart contract from the JSON file, and perform data flow dependency analysis on the global variables in the contract. After analyzing the reading and writing of global variables in each function, the order priority of the function guess and the function getReward is calculated, and a suitable function call sequence guess→getReward is generated. The mutation strategy is selected according to the distance feedback, and a large number of different inputs are generated for the function call sequence guess→getReward. After each round of execution, the branch distance function results of the current test case and the seed test case are compared, and the seed is updated according to the principle of reducing the distance. The quality of the seed is continuously improved, and the test cases generated by the fuzz tester can explore most of the branches in the program, and the difficult branch mag.walue=50fmney will be satisfied; Step S3: When the fuzz test reaches the time limit or finds all branches in the contract, it will start to analyze the covered paths and find the target branches that need to be tested. The target branches include rare branches with multiple layers of nesting and vulnerable branches with vulnerability characteristics in the contract source code. The vulnerable branches are obtained by semantic analysis and abstract interpretation analysis of the smart contract source code. Through the analysis of the contract source code, it is found that block-number and now are related to the block number dependency vulnerability and the timestamp dependency vulnerability. The related mlmhxe keywords are related to the reentrancy vulnerability. The fuzz tester will continue to test according to the allocated resources; Step S4: The seeds corresponding to the high resource branch will be selected for mutation first. The test cases that can reach PrizePool=SafeAdd(prizePool,msg.value) at the same time will be executed first. When the program executes to userBalnace[masg.sender]=SafeAdd(userBalance[msg.sender]), msg.value*2, the timestamp instruction TIMESTAMP and the adjacent encryption instruction SHA3 will be recorded, so that the msg.sender.call.value(userBa[msg.sender]) condition is met. The execution will trigger the call.value function to perform the transfer operation. The operation will interact with the pre-deployed attack contract. The attack contract will launch a reentry attack and repeatedly call the getReward function. The fuzz tester will record the CALL instructions executed in the process. When analyzing the execution log, the fuzz tester will find that the timestamp instruction is executed together with the encryption instruction, which meets the timestamp dependency vulnerability rule. Step S5: There are timestamp dependency vulnerabilities and reentrancy vulnerabilities in the fuzz tester. When the resources allocated to each branch are exhausted, the fuzz test ends and the corresponding vulnerability detection report is output; Step S6: Analyze the contract using the data flow analysis strategy to generate the guess→newGame function call sequence as follows: (1) The fuzz tester will use the seed iteration optimization strategy to make the generated function guess input continuously approach the branch condition until it enters functiongetRewardpayableexternal; (2) The fuzz tester uses the resource allocation strategy to make as many test cases as possible test if (userBalance[msg.sg.sender]<PrizePool&useBalance[msg.sg.sender]>0); (3) When the fuzz tester executes msg.sender.call.value(userBalance[msg.sender]), it triggers the rules related to the balance vulnerability in the vulnerability analysis strategy and records when the EVM executes the BALANCE instruction; (4) According to the balance dependency vulnerability rule in the vulnerability analysis strategy, the fuzz tester will analyze whether the EVM executes a conditional jump or comparison instruction after executing the BALANCE instruction; (5) When the conditions of (3) and (4) are met, the fuzz tester discovers the vulnerability and locates it.

Images