Directional grey box fuzzy test method and system based on function execution time optimization

Abstract

The invention discloses a directional grey box fuzzy testing method and system based on function execution time optimization, the method is divided into a static analysis stage and a dynamic execution stage, firstly, the static analysis stage analyzes a tested program and generates a function call graph (CG) and a control flow graph (CFG), then, node parameters of the CG are initialized, a parameter-containing CG is generated, and then, the CG is subjected to dynamic execution; iteratively updating a time intensity parameter in a dynamic execution stage, wherein the parameter is used for measuring the condition difficulty degree of each node; according to the time intensity parameter, the execution time of a seed at each node needs to be extracted according to real-time feedback data provided by a fuzzifier, and a parameter value can be obtained by applying the calculation method provided by the invention; the parameter-containing CG graph after parameter updating can well adjust the execution sequence of the seed queue and optimize the scheduling process, so that the fuzzy test efficiency is higher, and finally, a vulnerability report is generated. The method is suitable for directional fuzzy test vulnerability detection similar to patch testing, the fuzzy test coverage rate is high, and vulnerability discovery is efficient.

Description

Technical Field

[0001] The present invention relates to a testing technology for protocols, namely, protocol fuzzy testing. The testing method classifies protocol response codes in the static analysis stage and pays attention to the response status of protocol execution failure. Subsequently, the protocol response status that needs to be paid attention to is continuously updated in the dynamic analysis process, and the calculation method of seed selection probability is improved by using the Boltzmann selection algorithm and the linear sorting algorithm. Background Art

[0002] Protocol fuzz testing is a testing method for network protocols, which aims to improve testing efficiency and testing methods, thereby improving the completeness and anti-attack capabilities of the protocol. In 2001, the first practical fuzz testing tool developed for protocols was born. After that, tools such as Peach, Sulley, and AFLNet appeared. After AFLNet, a series of gray-box fuzz testing tools appeared, such as StateAFL, SNPSFuzzer, SnapFuzz, etc. Compared with black-box fuzz testing, gray-box fuzz testing omits the process of protocol format inference and protocol state model construction; and guides the generation of test cases through feedback information, thereby retaining valuable seeds for further testing.

[0003] Grey-box fuzz testing tools such as AFLNet all use techniques such as code coverage feedback, seed segmentation mutation, and state feedback, and use the status code in the response as state information to guide the fuzzer to explore the state space of the protocol. However, not all protocol states are equally important, and the time for fuzz testing is limited, requiring an effective state selection algorithm, which reduces the efficiency of protocol testing. Liu et al. proposed the AFLNetLegion algorithm to evaluate protocol states, and solved the problem of AFLNet's coarse-grained state transition judgment in a gradual way. However, it does not fundamentally treat different categories of status code categories unequally, and cannot distinguish between two status codes with the same status code but different protocol state transition methods, resulting in the omission of state transition-related information. Summary of the invention

[0004] In view of the above-mentioned shortcomings, the present invention proposes a directed gray-box fuzz testing method and system based on function execution time optimization. The testing method initializes the state code set in the static analysis phase based on the state code type and dynamic state selection, and selectively selects inputs that are more likely to trigger protocol vulnerabilities in the dynamic phase, thereby improving the efficiency of protocol fuzz testing.

[0005] The present invention is mainly achieved through the following technical solutions:

[0006] Directed gray-box fuzz testing method based on function execution time optimization, including static analysis phase and dynamic execution phase

[0007] Two stages:

[0008] Static analysis phase: The path information of each part of the control flow graph needs to be saved in the parameters of each node of the function call graph. First, the compiler and code difference tool are used to analyze the program under test, generate the function call graph (CG graph) and the control flow graph (CFG graph), and find the target code line; then define and calculate the initial parameters of each node of the CG graph to generate the initial parameter-containing CG graph;

[0009] Dynamic execution phase: First, the execution time of each function is counted in real time as a parameter to quantify the complexity of each function; then, the seed queue generated by the fuzzifier and the initial parameters of each node of the CG graph obtained in the static phase are combined to calculate the seed distance of each seed and obtain a seed queue containing the seed distance; then the seed queue containing the seed distance is put into the fuzzifier to implement seed scheduling and execution; finally, a result feedback document is generated, and the parameters of the CG graph containing parameters are iteratively updated to achieve dynamic optimization of the CG graph containing parameters.

[0010] Furthermore, the static analysis phase includes the following steps:

[0011] 1-1. Perform static analysis on the program under test. First, use the compiler and code difference tool to analyze the program under test, generate CG graph and CFG graph and find the target code line set; then find the target node set through the target code line; then define the initial parameters of each node of the CG graph.

[0012] 1-2 Generate the initial parameterized CG graph. This step designs two parameters. The first parameter is used to measure the distance between the node and the target node and the path accessibility. The second parameter is used to retain the key path information of the CFG subgraph corresponding to each node to improve the calculation accuracy.

[0013] Furthermore, the dynamic execution phase includes the following steps:

[0014] 2-1. Calculate the distance between the seed in the seed queue and the target node. Input the CG graph with parameters and the seed queue generated by the fuzzer. It should be noted that if the z parameter value of each node in the CG graph has not been calculated at this stage, the value of the initial z parameter is 1. The arithmetic mean of the distance from each node on the seed path to the target node is used as the seed distance of the seed, and the seed distance set corresponding to each seed in the seed queue is output.

[0015] 2-2. Normalize the seed distances in the seed set. Input the seed distance set calculated in 2-1. To avoid the seeds, since the seed distances calculated from 2-1 contain complex parameter combinations, these parameter combinations may make the distances of each seed in the set not in the same order of magnitude. Therefore, it is necessary to normalize each seed distance in the seed distance set obtained by the above calculation, control the value range to (0,1), and output the seed distance set corresponding to the normalized seed queue.

[0016] 2-3. Select the execution order of seeds during seed execution. Input the seed distance set corresponding to the seed queue after normalization in 2-2. During the fuzz test, the fuzzer preferentially selects seeds with smaller seed distances in the current seed queue for mutation and execution. This stage outputs feedback information of the current iteration round, including the number of vulnerabilities corresponding to the timestamp, the number of execution branches, coverage, and other feedback information.

[0017] 2-4. Calculate the time intensity parameter value of each CG node in the current iteration execution round. Input the feedback information and the CG graph with parameters obtained in stage 2-3, count the execution time of each branch node in the current iteration process, then calculate the time intensity parameter value of each node in the CG graph with parameters, and dynamically update the parameter value of the CG graph with parameters. Output the CG graph with parameters of the current round.

[0018] 2-5. Determine whether to terminate the dynamic execution loop. If the current number of iterations reaches the maximum number of iterations or the fuzz test time reaches the threshold, end the directed fuzz test; otherwise, go to 2-1.

[0019] Furthermore, the specific process of step 1-1 in the static analysis phase is as follows:

[0020] 1-1-1. Use the llvm tool to instrument the program under test and generate the program control flow graph CFG and function call graph CG.

[0021] 1-1-2. Obtain the target code line set and the corresponding node set in the CFG graph as the CFG-level target node set.

[0022] Use code difference tools (such as WinMerge, DiffMerge, etc.) to scan and obtain the difference code line number set DifCode = {t1, t2, ..., t n}, where t n Indicates the position of the nth target code line; then, the set DifCode corresponds to the node set DifCFG of the CFG graph = {t1 CFG ,t2 CFG ,...,t n CFG}, as the set of CFG-level target nodes.

[0023] 1-1-3. The CFG level target node set corresponds to the CG graph node set as the target node set.

[0024] Input the target code line number, use the find_nodes function in distance.py to find the graph node number corresponding to DifCode and CG graph, and save it in the target node set T = {t1 CG ,t2 CG ,...,t n CG}, where t n CG Indicates t n The position in the CG graph, T represents the position set of all target nodes corresponding to the difference code lines in the CG graph, that is, the target node set. Output the target node set T in the CG graph.

[0025] 1-1-4. Initialize the parameters of each node of the CG graph

[0026] For each node of the CG graph, the original parameter is F i , represents the number of the i-th node in the CG graph; in F i On the basis of , three parameters x, y, and z are added to construct the CG graph node weights. The node parameter combination is expressed as (F i ,x,y,z), x represents the CG graph F i The shortest path distance between the node and the target node, y represents the CG graph F i The path information of the CFG subgraph corresponding to the node, z represents the path information of the CFG subgraph corresponding to the node, and z represents the path information of the CFG subgraph corresponding to the node, ... i The difficulty of the node conditions (see 2-4 for calculation method).

[0027] Furthermore, the specific process of steps 1-2 in the static analysis phase is as follows:

[0028] 1-2-1. Calculate the shortest path distance x value between each node of the CG graph and the target node

[0029] Input the positions of each node in the CG graph and the target node set T in 1-1-3, calculate the minimum number of nodes that need to be passed from the CG graph node to the target node, and then set the x parameter of the CG graph node. The x parameter calculation formula is as follows:

[0030]

[0031] Wherein γ and ρ are adjustment parameters, and the present invention recommends taking the values ​​as (γ=0.9, ρ=0.5); d i It is node F in the CG graph. iThe shortest distance to the target node set T needs to be stored in the d field of the node; preds represents the predecessor sequence of the target node set T. It should be noted that if the node F i is the target node, then d i =0.

[0032] Output a parametric CG graph containing x parameters.

[0033] 1-2-2. Calculate the path information y value of the CFG subgraph corresponding to each node of the CG graph

[0034] Input the CFG graph, the CG graph with parameters after calculating the x parameter, and the target node set T. According to the path information of the CFG subgraph corresponding to each CG graph node, calculate the path information y value of the CFG subgraph corresponding to each node of the CG graph. The parameter y of the CG graph with parameters can well preserve the path information of the CFG graph and ensure the granularity is consistent with the CFG. Figure 1 The specific calculation method is as follows:

[0035] First, find the CFG subgraphs corresponding to each node of the CG graph, then use the Dijkstra algorithm to calculate the shortest path distance in each CFG subgraph, and finally store it in the y field of each node of the CG graph. The calculation formula is as follows:

[0036] y(F i )=min{dist[F i ,t1 CG ],dist[F i ,t2 CG ],...,dist[F i ,t n CG ]}(1.2)

[0037] Among them, dist[F i ,t j CG ] indicates that node F in the CG graph i To the target node set T j CG The shortest distance of the node is calculated for each node in the set T in turn, and then the min is taken to represent the shortest distance from node i to the target node set T, and is stored in the parameter y as the key path information of the CFG graph.

[0038] Furthermore, the specific process of steps 2-4 of the dynamic execution phase is as follows:

[0039] 2-4-1. Input the feedback information and parameter-containing CG graph obtained in stage 2-3, and count the execution time of each branch node in the current round of iteration, and then dynamically update the parameter z of the parameter-containing CG graph.

[0040] 2-4-2. Calculate the time intensity parameter value z of each node in the CG graph.

[0041] In the current execution stage, seed s is at branch node F i The execution time t(F i ) can be directly queried through the fuzzer's q->exec_us variable (a variable defined by the fuzzer). i ) multiplied by the parameter α and rounded, node F i The time intensity parameter value z(F i ) is calculated as:

[0042]

[0043] The recommended value of α is 0.5, and the recommended value of θ is 10s; then use the calculated z(F i ) Update CG image F i The node parameter z dynamically updates the parameterized CG graph containing the three parameters x, y, and z.

[0044] 2-4-3. Update the parameter z of the parameterized CG graph, and output the parameterized CG graph containing the three parameters x, y, and z for the current round.

[0045] Another object of the present invention is to propose a directional gray-box fuzzy test based on function execution time optimization.

[0046] Test system, including:

[0047] Test preparation module: compile the target program based on aflnet's llvm_mode.

[0048] Generates binary executables that provide coverage information;

[0049] Protocol fuzz testing static analysis module: AFLNET uses its request sequence parser (Request

[0050] Sequence Parser) component to generate the initial corpus of message sequences and extract status codes;

[0051] Protocol fuzz testing dynamic execution module: During dynamic operation, the fuzzer will calculate the state score of each seed based on the extracted state code, and allocate different mutation and execution energies according to the state score of the seed;

[0052] Result feedback module: provides real-time feedback on the overall coverage information during the protocol fuzz testing process; provides real-time feedback on the number of times the program crashes are triggered during the targeted fuzz testing process, and saves the test cases that trigger the program crashes to facilitate the subsequent reproduction and analysis of the crashes.

[0053] The beneficial effects of the present invention are:

[0054] It does not fundamentally treat different status code categories unequally, and cannot distinguish between two status codes with the same status code but different protocol state transition methods, resulting in the omission of state transition related information

[0055] 1. Different categories of status codes can be distinguished by initializing status code classification, so that fuzz testing can spend more time exploring inputs with greater potential for vulnerabilities, making protocol fuzz testing more efficient.

[0056] 2. By synchronously updating the new state transition and the corresponding status code, it is possible to distinguish two status codes with the same status code but different protocol state transition methods. Using fine-grained distinction between different status codes and state transitions makes the selection of the target status code more accurate.

[0057] 3. The linear sorting algorithm is used to solve the shortcoming of reduced fuzzer exploration caused by excessive fitness, and the time factor is combined to make the probability calculation more accurate and more universal. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 The overall flow chart of the improved protocol fuzzy test of the present invention

[0059] Figure 2 This is the implementation process of the static analysis phase of the present invention

[0060] Figure 3 Part of the state transition path diagram of the RTSP protocol

[0061] Figure 4 The implementation process of the dynamic execution phase of the present invention

[0062] Figure 5 A diagram showing the difference between the coarse-grained state transition and the improved fine-grained state transition effects of aflnet

[0063] Figure 6 The overall experimental results are shown in Figure DETAILED DESCRIPTION

[0064] The present invention will be described systematically and completely below in conjunction with the accompanying drawings of the present invention.

[0065] Directed gray box fuzzy testing method based on function execution time optimization of the present invention ( Figure 1 The overall flow chart of the improved protocol fuzzy test of the present invention includes two stages: static analysis stage and dynamic execution stage:

[0066] Static analysis phase: The path information of each part of the control flow graph needs to be saved in the parameters of each node of the function call graph. First, the compiler and code difference tool are used to analyze the program under test, generate the function call graph (CG graph) and the control flow graph (CFG graph), and find the target code line; then define and calculate the initial parameters of each node of the CG graph to generate the initial parameter-containing CG graph;

[0067] Dynamic execution phase: First, the execution time of each function is counted in real time as a parameter to quantify the complexity of each function; then, the seed queue generated by the fuzzifier and the initial parameters of each node of the CG graph obtained in the static phase are combined to calculate the seed distance of each seed and obtain a seed queue containing the seed distance; then the seed queue containing the seed distance is put into the fuzzifier to implement seed scheduling and execution; finally, a result feedback document is generated, and the parameters of the CG graph containing parameters are iteratively updated to achieve dynamic optimization of the CG graph containing parameters.

[0068] The static analysis phase includes the following steps:

[0069] 1-1. Perform static analysis on the program under test. First, use the compiler and code difference tool to analyze the program under test, generate CG graph and CFG graph and find the target code line set; then find the target node set through the target code line; then define the initial parameters of each node of the CG graph.

[0070] 1-2 Generate the initial parameterized CG graph. This step designs two parameters. The first parameter is used to measure the distance between the node and the target node and the path accessibility. The second parameter is used to retain the key path information of the CFG subgraph corresponding to each node to improve the calculation accuracy.

[0071] The dynamic execution phase includes the following steps:

[0072] 2-1. Calculate the distance between the seed in the seed queue and the target node. Input the CG graph with parameters and the seed queue generated by the fuzzer. It should be noted that if the z parameter value of each node in the CG graph has not been calculated at this stage, the value of the initial z parameter is 1. The arithmetic mean of the distance from each node on the seed path to the target node is used as the seed distance of the seed, and the seed distance set corresponding to each seed in the seed queue is output.

[0073] 2-2. Normalize the seed distances in the seed set. Input the seed distance set calculated in 2-1. To avoid the seeds, since the seed distances calculated from 2-1 contain complex parameter combinations, these parameter combinations may make the distances of each seed in the set not in the same order of magnitude. Therefore, it is necessary to normalize each seed distance in the seed distance set obtained by the above calculation, control the value range to (0,1), and output the seed distance set corresponding to the normalized seed queue.

[0074] 2-3. Select the execution order of seeds during seed execution. Input the seed distance set corresponding to the seed queue after normalization in 2-2. During the fuzz test, the fuzzer preferentially selects seeds with smaller seed distances in the current seed queue for mutation and execution. This stage outputs feedback information of the current iteration round, including the number of vulnerabilities corresponding to the timestamp, the number of execution branches, coverage, and other feedback information.

[0075] 2-4. Calculate the time intensity parameter value of each CG node in the current iteration execution round. Input the feedback information and the CG graph with parameters obtained in stage 2-3, count the execution time of each branch node in the current iteration process, then calculate the time intensity parameter value of each node in the CG graph with parameters, and dynamically update the parameter value of the CG graph with parameters. Output the CG graph with parameters of the current round.

[0076] 2-5. Determine whether to terminate the dynamic execution loop. If the current number of iterations reaches the maximum number of iterations or the fuzz test time reaches the threshold, end the directed fuzz test; otherwise, go to 2-1.

[0077] Among them, the specific process of step 1-1 in the static analysis phase is as follows:

[0078] 1-1-1. Use the llvm tool to instrument the program under test and generate the program control flow graph CFG and function call graph CG.

[0079] 1-1-2. Obtain the target code line set and the corresponding node set in the CFG graph as the CFG-level target node set.

[0080] Use code difference tools (such as WinMerge, DiffMerge, etc.) to scan and obtain the difference code line number set DifCode = {t1, t2, ..., t n}, where t n Indicates the position of the nth target code line; then, the set DifCode corresponds to the node set DifCFG of the CFG graph = {t1 CFG ,t2 CFG ,...,t n CFG}, as the set of CFG-level target nodes.

[0081] 1-1-3. The CFG level target node set corresponds to the CG graph node set as the target node set.

[0082] Input the target code line number, use the find_nodes function in distance.py to find the graph node number corresponding to DifCode and CG graph, and save it in the target node set T = {t1 CG,t2 CG ,...,t n CG}, where t n CG Indicates t n The position in the CG graph, T represents the position set of all target nodes corresponding to the difference code lines in the CG graph, that is, the target node set. Output the target node set T in the CG graph.

[0083] 1-1-4. Initialize the parameters of each node of the CG graph

[0084] For each node of the CG graph, the original parameter is F i , represents the number of the i-th node in the CG graph; in F i On the basis of , three parameters x, y, and z are added to construct the CG graph node weights. The node parameter combination is expressed as (F i ,x,y,z), x represents the CG graph F i The shortest path distance between the node and the target node, y represents the CG graph F i The path information of the CFG subgraph corresponding to the node, z represents the path information of the CFG subgraph corresponding to the node, and z represents the path information of the CFG subgraph corresponding to the node, ... i The difficulty of the node conditions (see 2-4 for calculation method).

[0085] Furthermore, the specific process of steps 1-2 in the static analysis phase is as follows:

[0086] 1-2-1. Calculate the shortest path distance x value between each node of the CG graph and the target node

[0087] Input the positions of each node in the CG graph and the target node set T in 1-1-3, calculate the minimum number of nodes that need to be passed from the CG graph node to the target node, and then set the x parameter of the CG graph node. The x parameter calculation formula is as follows:

[0088]

[0089] Wherein γ and ρ are adjustment parameters, and the present invention recommends taking the values ​​as (γ=0.9, ρ=0.5); d i It is node F in the CG graph. i The shortest distance to the target node set T needs to be stored in the d field of the node; preds represents the predecessor sequence of the target node set T. It should be noted that if the node F i is the target node, then d i =0.

[0090] Output a parametric CG graph containing x parameters.

[0091] 1-2-2. Calculate the path information y value of the CFG subgraph corresponding to each node of the CG graph

[0092] Input the CFG graph, the CG graph with parameters after calculating the x parameter, and the target node set T. According to the path information of the CFG subgraph corresponding to each CG graph node, calculate the path information y value of the CFG subgraph corresponding to each node of the CG graph. The parameter y of the CG graph with parameters can well preserve the path information of the CFG graph and ensure the granularity is consistent with the CFG. Figure 1 The specific calculation method is as follows:

[0093] First, find the CFG subgraphs corresponding to each node of the CG graph, then use the Dijkstra algorithm to calculate the shortest path distance in each CFG subgraph, and finally store it in the y field of each node of the CG graph. The calculation formula is as follows:

[0094] y(F i )=min{dist[F i ,t1 CG ],dist[F i ,t2 CG ],...,dist[F i ,t n CG ]}(1.2)

[0095] Among them, dist[F i ,t j CG ] indicates that node F in the CG graph i To the target node set T j CG The shortest distance of the node is calculated for each node in the set T in turn, and then the min is taken to represent the shortest distance from node i to the target node set T, and is stored in the parameter y as the key path information of the CFG graph.

[0096] The specific process of steps 2-4 in the dynamic execution phase is as follows:

[0097] 2-4-1. Input the feedback information and parameter-containing CG graph obtained in stage 2-3, and count the execution time of each branch node in the current round of iteration, and then dynamically update the parameter z of the parameter-containing CG graph.

[0098] 2-4-2. Calculate the time intensity parameter value z of each node in the CG graph.

[0099] In the current execution stage, seed s is at branch node F i The execution time t(F i ) can be directly queried through the fuzzer's q->exec_us variable (a variable defined by the fuzzer).i ) multiplied by the parameter α and rounded, node F i The time intensity parameter value z(F i ) is calculated as:

[0100]

[0101] The recommended value of α is 0.5, and the recommended value of θ is 10s; then use the calculated z(F i ) Update CG image F i The node parameter z dynamically updates the parameterized CG graph containing the three parameters x, y, and z.

[0102] 2-4-3. Update the parameter z of the parameterized CG graph, and output the parameterized CG graph containing the three parameters x, y, and z for the current round.

[0103] Another object of the present invention is to propose a directional gray-box fuzzy test based on function execution time optimization.

[0104] Test system, including:

[0105] Test preparation module: compile the target program based on aflnet's llvm_mode.

[0106] Generates binary executables that provide coverage information;

[0107] Protocol fuzz testing static analysis module: AFLNET uses its request sequence parser (Request

[0108] Sequence Parser) component to generate the initial corpus of message sequences and extract status codes;

[0109] Protocol fuzz testing dynamic execution module: When running dynamically, the fuzzer will extract

[0110] The status code of each seed is calculated, and different variables are assigned according to the status score of the seed.

[0111] Different and executive energy;

[0112] Result feedback module: It provides real-time feedback on the overall coverage information during the protocol fuzz testing process.

[0113] Feedback: Provide real-time feedback on the number of times the program crashes during the directional fuzz testing process, and

[0114] The test cases that cause program crashes are saved to facilitate the reproduction and analysis of the crashes later.

[0115] Static analysis phase: Figure 2As shown, first, analyze the possible protocol status codes and protocols

[0116] State transition, generate the initial protocol status code and the initial protocol state transition diagram, and define the initial protocol status code as a Class A protocol status code.

[0117] Dynamic execution phase: Figure 4 As shown, first, the initial state transition diagram and Class A protocol status code generated in the static analysis phase are used to initialize the Class B protocol status code. The Class A status code is as follows Figure 3 As shown in the blue nodes, the B status codes are as follows Figure 3 As shown in the red node; then, according to the seed queue generated by the fuzzer, the seed state score is calculated; then the seeds with high scores are selected for mutation and execution; finally, during the execution process, if a new state transition is generated, the Class B protocol state code and the protocol state transition diagram are updated synchronously. Class A protocol state codes are used to store state codes representing successful protocol execution and state codes that cannot generate new state transitions; Class B protocol state codes represent state codes that can generate new state transitions. Note that state codes may be repeated, so it is necessary to synchronously update state transitions to distinguish between two state codes with the same state code but different protocol state transition methods, such as Figure 5 As shown in the figure, after the improvement, it is possible to distinguish the different meanings of two identical status codes in a fine-grained manner. Figure 5 In the example, USER indicates the behavior of user login, and the status code of USER behavior ranges from 0->331; PASS indicates the behavior of successful login verification, NLST indicates the behavior of obtaining a file list from the server, MKD indicates the behavior of creating a new folder, and STRO indicates the behavior of uploading a folder; each behavior corresponds to a corresponding status code conversion.

[0118] The static analysis phase of the directed fuzzy test described in the present invention specifically includes the following steps:

[0119] 1. Static analysis phase

[0120] 1-1. Initialize protocol state transition

[0121] 1-1-1. Initialization protocol status code

[0122] Input the file or operation that allows the protocol to execute normally, use the Request Sequence Parser component to generate the initial corpus of message sequences, extract the status code from the response message, record the status code of the response when the protocol executes normally, and put it into set G.

[0123] Output the status code set G that is responded to when the protocol is executed normally.

[0124] 1-1-2. Initialization protocol state transition diagram

[0125] Input the files or operations that allow the protocol to execute normally, record the state transitions when the protocol executes normally, and put them into the protocol state transition diagrams I0 and I.

[0126] The state transition diagram I0 when the output protocol is executed normally and the protocol state transition diagram I to be updated during the dynamic execution process.

[0127] 1-2. Initialize the status code of class A and B protocols

[0128] 1-2-1. Initialize Class A protocol status code

[0129] Enter the status code set G in 1-1-1, which is defined as Class A protocol status code. Class A protocol status code is used to store status codes representing successful protocol execution and status codes that cannot generate new state transitions;

[0130] Output the defined Class A protocol status code.

[0131] 1-2-2. Initialize Class B protocol status code

[0132] Initialize an empty Class B protocol status code. Class B protocol status code indicates a status code that can generate a new state transition.

[0133] Output the defined Class B protocol status code.

[0134] Table 1: Symbol definitions involved in the static analysis phase

[0135]

[0136] Among them, the dynamic execution stage of the directional fuzzy test described in the present invention needs to calculate and update the z parameter value of the CG graph node containing the parameter, which specifically includes the following steps:

[0137] 2. Dynamic execution phase

[0138] 2-1. Select the target status code

[0139] Enter the Type B protocol status code.

[0140] The status code in the B-type protocol status code is the target status code that needs to be traversed during the iteration process. Calculate the number of seeds that can reach each status code in the B-type protocol status code.

[0141] Output the i-th status code in the B-type protocol status code as the target status code d i , and synchronously output the number of seeds count that can reach the target status code i .

[0142] 2-2. Calculate status score

[0143] Input counti , Class A protocol status code, and the seed queue Que generated by the fuzzer.

[0144] During the execution, the B-type protocol status code is the target status code. If it is the first iteration, the B-type protocol status code is empty. The fuzzer generates a seed queue Que = {s1, s2, ..., s n}, where s n represents the state transition path of the nth seed. Each seed s i The state score can be directly queried in AFLNet through the variable state->score.

[0145] Output the state score set corresponding to each seed in the seed queue

[0146] Score={score1,score2,...,score n}.

[0147] 2-3. Calculate the initial seed selection probability

[0148] The present invention uses the Boltzmann selection algorithm to improve the calculation method of the seed selection probability value.

[0149] Seed i The initial selection probability of is defined as follows:

[0150]

[0151] Among them, b can control the probability of seed selection according to time, and the change of b over time is as follows:

[0152]

[0153] The first t1 hour (t1 is recommended to be 10 minutes ) , b=0, the probability of all states is set to the same value, and all target states are treated equally. t1-t2 hours (t2 is recommended to be 1h), b<0. After t1 hours, b>0. When b>0, the probability of individuals with high fitness values ​​being selected is increased; when b<0, the probability is reduced; when b=0, the selection probability of all individuals is 1 / N. The definition of Z is as follows:

[0154]

[0155] That is, Z represents the total probability of these n seeds being selected. Note that Z is not necessarily equal to 1.

[0156] Output the seed initial selection probability set Select_p corresponding to the seed queue.

[0157] 2-4. Optimize seed selection probability value

[0158] Input 2-3 seed selection probability set Select_p. During the protocol fuzz testing process, formula (1) may cause individual probability values ​​to be too high, causing the fuzzer to mutate and execute a certain seed all the time, reducing the fuzzer's exploration of other potential seeds.

[0159] Therefore, this step considers using a linear sorting algorithm to calculate the final seed selection probability value using the ranking in the set Select_p. The calculation method is as follows:

[0160]

[0161] Where P(i) represents the seed d i The seed selection probability value, N represents the number of seeds in the set Select_p, n - and n + Can be a real number between 0 and 2, n - and n + The closer the probability value is, the closer the probability value is, n - and n + The greater the difference, the greater the probability value discrimination. - and n + If both values ​​are 1, it means that there will be no difference in the seed probability value, and n - and n + The following conditions need to be met:

[0162] n + +n - =2 (5)

[0163] The value of n is recommended in this invention. + =1.5,n - =0.5.

[0164] 2-5. Updated protocol state transition diagram and Class B protocol status code

[0165] Input 2-3 seed selection probability set Select_p. During the fuzz testing process, the fuzzer will give priority to selecting seeds with higher seed probabilities in the current seed queue for mutation and execution.

[0166] During the execution process, if a new state transition occurs, the protocol state transition diagram I and class B status code are updated synchronously.

[0167] Output the updated protocol state transition diagram I and class B status code.

[0168] 2-6. Determine whether to terminate the dynamic execution loop

[0169] If the number of iterations its reaches the maximum number of iterations its_max or the fuzzy test time reaches η, the protocol fuzzy test ends; otherwise, go to 2-1. The recommended value of η is 24h.

[0170] Table 2: Symbol definitions involved in the dynamic execution phase

[0171]

[0172] The pseudo code of the algorithm for calculating the probability of seed selection is as follows:

[0173]

[0174]

[0175] Algorithm explanation: This algorithm can obtain the seed selection probability set P corresponding to the seed queue. First, initialize the variables Z and i (see line 1). Then calculate the initial seed probability value (see lines 2-21). To calculate the seed probability, you need to use variable b to control the size of the seed selection probability value according to time, corresponding to formula (2), see lines 3-9. Then calculate the initial seed selection probability value according to formula (1) (see lines 15-21). Finally, calculate the final seed selection probability value according to formula (4) (see lines 22-26).

[0176] Experimental results:

[0177] Experiment 1:

[0178] The experimental results of improving AFLNet based on state classification and intelligent seed selection algorithm are as follows Figure 6 As shown. This article uses three protocols to test and compare the improved fuzzer and AFLNet fuzzer. From the perspective of vulnerability discovery efficiency, the improved fuzzer is more efficient, with a maximum improvement of nearly three times and an average improvement of about 1.5 times. Based on the coverage improvement, there are two protocols that can improve the coverage of aflnet, namely the DNS protocol and the DTLS protocol, and the coverage can be improved by about 0.07%. In general, the improved fuzzer has higher efficiency in protocol fuzz testing.

[0179] Result analysis:

[0180] 1. Analyze the effectiveness of initialization status code classification on improving fuzz testing efficiency:

[0181] Events of successful execution of protocol-related operations are often maintained more frequently, are more stable, and have a lower probability of crashing; while for states of failed execution of protocol-related operations, they are maintained less frequently. The status code of failed execution is taken as the target status code for key exploration and classified as Class B protocol status code. Focusing on the conversion of Class B protocol status code in the subsequent execution process can better improve the efficiency of protocol fuzz testing.

[0182] 2. Analyze the effectiveness of fine-grained differentiation of status codes by synchronously updating new state transitions and corresponding status codes.

[0183] like Figure 5 As shown, AFLNet is a coarse-grained classification state code. For the same state code, it cannot distinguish the state transition process well and ignores the state transition details. The present invention synchronously updates the new state transition and the corresponding state code, which can well retain the state transition details and distinguish the state code in a fine-grained manner.

[0184] 3. Analyze how the linear sorting algorithm improves the fuzzer’s exploratory capabilities.

[0185] The linear sorting algorithm is only affected by the numerical ranking of the scores and will not be affected by the maximum and minimum values. Therefore, it can prevent the fuzzifier from mutating and executing only a seed with a very large score, thereby improving the fuzzer's exploration and versatility.

[0186] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A directed gray-box fuzz testing method based on function execution time optimization, characterized in that: It includes two stages: static analysis stage and dynamic execution stage: Static analysis phase: The path information of each part of the control flow graph needs to be saved in the parameters of each node of the function call graph. First, the compiler and code difference tool are used to analyze the program under test, generate the function call graph (CG graph) and the control flow graph (CFG graph), and find the target code line; then define and calculate the initial parameters of each node of the CG graph to generate the initial parameter-containing CG graph; Dynamic execution phase: First, the execution time of each function is counted in real time as a parameter to quantify the complexity of each function; then, the seed queue generated by the fuzzifier and the initial parameters of each node of the CG graph obtained in the static phase are combined to calculate the seed distance of each seed and obtain a seed queue containing the seed distance; then the seed queue containing the seed distance is put into the fuzzifier to implement seed scheduling and execution; finally, a result feedback document is generated, and the parameters of the CG graph containing parameters are iteratively updated to achieve dynamic optimization of the CG graph containing parameters.

2. The directed gray box fuzz testing method based on function execution time optimization as claimed in claim 1, characterized in that: The static analysis phase includes the following steps: 1-1. Perform static analysis on the program under test: First, use the compiler and code difference tool to analyze the program under test, generate CG graph and CFG graph and find the target code line set; then find the target node set through the target code line; then define the initial parameters of each node of the CG graph; 1-2. Generate the initial parameterized CG graph: This step designs two parameters. The first parameter is used to measure the distance between the node and the target node and the path accessibility. The second parameter is used to retain the key path information of the CFG subgraph corresponding to each node to improve the calculation accuracy.

3. The directed gray box fuzz testing method based on function execution time optimization as claimed in claim 1, characterized in that: The dynamic execution phase includes the following steps: 2-1. Calculate the distance between the seeds in the seed queue and the target node: input the CG graph with parameters and the seed queue generated by the fuzzer. If the z parameter value of each node in the CG graph has not been calculated at this stage, initialize the value of the z parameter to 1, and take the arithmetic mean of the distance from each node on the seed path to the target node as the seed distance of the seed, and output the seed distance set corresponding to each seed in the seed queue; 2-2. Normalize the seed distances in the seed set: Input the seed distance set calculated in 2-1, normalize each seed distance in the seed distance set, control the value range to (0,1), and output the seed distance set corresponding to the normalized seed queue; 2-3. Select the execution order of seeds during seed execution: Input the seed distance set corresponding to the seed queue after 2-2 normalization. During the fuzz test, the fuzzer will give priority to the seeds with smaller seed distances in the current seed queue for mutation and execution. In this stage, the feedback information of the current iteration round is output, including the number of vulnerabilities corresponding to the timestamp, the number of execution branches, and the coverage feedback information. 2-4. Calculate the time intensity parameter value of each CG node in the current iteration execution round: input the feedback information and the parameter CG graph obtained in stage 2-3, count the execution time of each branch node in the current round of iteration, then calculate the time intensity parameter value of each node in the parameter CG graph, dynamically update the parameter value of the parameter CG graph, and output the parameter CG graph of the current round; 2-5. Determine whether to terminate the dynamic execution loop: If the current number of iterations reaches the maximum number of iterations or the fuzz test time reaches the threshold, end the directed fuzz test; otherwise, go to 2-1.

4. The directed gray box fuzz testing method based on function execution time optimization as claimed in claim 2, characterized in that: The specific process of step 1-1 in the static analysis phase is as follows: 1-1-1. Use the llvm tool to instrument the program under test and generate the program control flow graph CFG and function call graph CG; 1-1-2. Get the target code line set and the corresponding node set in the CFG graph as the CFG-level target node set: Use code difference tools including WinMerge and DiffMerge to scan and obtain the difference code line number set DifCode = {t1, t2, ..., t n }, where t n Indicates the location of the nth target code line; then, the set DifCode corresponds to the node set of the CFG graph As a set of CFG-level target nodes; 1-1-3. Correspond the CFG level target node set to the CG graph node set as the target node set: Enter the target code line number, use the find_nodes function in distance.py to find the graph node number corresponding to DifCode and CG graph, and save it in the target node set Among them Indicates t n The position in the CG graph, T represents the position set of all target nodes corresponding to the difference code lines in the CG graph, that is, the target node set; output the target node set T in the CG graph; 1-1-4. Initialize the parameters of each node of the CG graph: For each node of the CG graph, the original parameter is F i , represents the number of the i-th node in the CG graph; in F i On the basis of , three parameters x, y, and z are added to construct the CG graph node weights. The node parameter combination is expressed as (F i ,x,y,z), x represents the CG graph F i The shortest path distance between the node and the target node, y represents the CG graph F i The path information of the CFG subgraph corresponding to the node, z represents the path information of the CFG subgraph corresponding to the node, and z represents the path information of the CFG subgraph corresponding to the node, ... i The difficulty of the node condition.

5. The directed gray box fuzz testing method based on function execution time optimization as claimed in claim 2, characterized in that: The specific process of steps 1-2 in the static analysis phase is as follows: 1-2-1. Calculate the shortest path distance x value between each node of the CG graph and the target node: Input the positions of each node in the CG graph and the target node set T in 1-1-3, calculate the minimum number of nodes that need to be passed from the CG graph node to the target node, and then set the x parameter of the CG graph node. The x parameter calculation formula is as follows: Where γ and ρ are adjustment parameters, and their values ​​are (γ=0.9, ρ=0.5); d i It is node F in the CG graph. i The shortest distance to the target node set T needs to be stored in the d field of the node; preds represents the predecessor sequence of the target node set T. If the node F i is the target node, then d i =0; 1-2-2. Calculate the path information y value of the CFG subgraph corresponding to each node of the CG graph: Input the CFG graph, the CG graph with parameters after calculating the x parameter, and the target node set T. According to the path information of the CFG subgraph corresponding to each CG graph node, calculate the path information y value of the CFG subgraph corresponding to each node of the CG graph. The parameter y of the CG graph with parameters can well preserve the path information of the CFG graph and ensure that the granularity is consistent with the CFG graph. The specific calculation method is as follows: First, find the CFG subgraphs corresponding to each node of the CG graph, then use the Dijkstra algorithm to calculate the shortest path distance in each CFG subgraph, and finally store it in the y field of each node of the CG graph. The calculation formula is as follows: in, Represents node F in the CG graph i To the target node set T The shortest distance of the node, after finding the shortest distance of each node in the set T, takes the min, which is used to represent the shortest distance from node i to the target node set T, and is stored in the parameter y as the key path information of the CFG graph; the output contains (F i ,x,y) parameters.

6. The directed gray box fuzz testing method based on function execution time optimization as claimed in claim 3, characterized in that: The specific process of steps 2-4 of the dynamic execution phase is as follows: 2-4-1. Input the feedback information and the parameter CG graph obtained in stage 2-3, and count the execution time of each branch node in the current round of iteration, and then dynamically update the parameter z of the parameter CG graph; 2-4-2. Calculate the time intensity parameter value z of each node of the CG graph with parameters: In the current execution stage, seed s is at branch node F i The execution time t( F i ) can be directly queried through the fuzzer's q->exec_us variable, and the statistical value t(F i ) multiplied by the parameter α and rounded, node F i The time intensity parameter value z(F i ) is calculated as: The recommended value of α is 0.5, and the recommended value of θ is 10s; then use the calculated z(F i ) Update CG image F i The node parameter z dynamically updates the parameterized CG graph containing three parameters x, y, and z; 2-4-3. Update the parameter z of the parameterized CG graph, and output the parameterized CG graph containing the three parameters x, y, and z for the current round.

7. A system for implementing the directed gray-box fuzz testing method based on function execution time optimization as described in any one of claims 1 to 6, characterized in that: include: Test preparation module: compile the target program based on aflnet's llvm_mode and generate a binary executable file that provides coverage information; Protocol fuzz testing static analysis module: AFLNET uses its request sequence parser component to generate an initial corpus of message sequences and extract status codes; Protocol fuzz testing dynamic execution module: During dynamic operation, the fuzzer will calculate the state score of each seed based on the extracted state code, and allocate different mutation and execution energies according to the state score of the seed; Result feedback module: provides real-time feedback on the overall coverage information during the protocol fuzz testing process; The number of times a program crash is triggered during the directed fuzz testing process is fed back in real time, and the test cases that trigger the program crash are saved to facilitate the subsequent reproduction and analysis of the crash.

Images