A coverage-driven parallel fuzzing task dynamic scheduling method and system

Abstract

The application discloses a coverage-driven parallel fuzzy testing task dynamic scheduling method and system. The method comprises the following steps: adaptively adjusting the frequency of task allocation according to the real-time monitored coverage increment. Through the preset minimum and maximum period limit, the system prolongs the period when the coverage growth is lower than the threshold, reduces the resource consumption; when the coverage growth exceeds the threshold, the period is shortened, and the new code area exploration is accelerated. The threshold itself also supports dynamic adjustment, continuously monitors the coverage change and the effect of task allocation period through the feedback loop, realizes the real-time fine adjustment of the threshold, and adapts to the coverage difficulty in different stages. This dynamic adjustment strategy can effectively cope with the non-uniform coverage difficulty in the fuzzy testing process, and ensure that the testing process is efficient and continuously promoted. This design not only optimizes the resource utilization efficiency and the testing progress to adapt to the coverage difficulty change in different stages, but also significantly improves the efficiency and effect of parallel fuzzy testing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software fuzz testing, and particularly relates to a coverage-driven parallel fuzzy testing task dynamic scheduling method and system. BACKGROUND

[0002] With the rapid development of Internet technology, digitalization has become the cornerstone of modern society. In today's rapidly developing software industry, as the system size continues to expand and the update frequency continues to rise, ensuring the stability and security of software has become the core goal of the development process. This requires the efficiency of testing and vulnerability mining to be improved simultaneously to accurately mine potential vulnerabilities and ensure the safe operation of software. The importance and universality of software security are increasingly highlighted, because an unreported vulnerability can be exploited by hackers, leading to data leakage, system failure or even more serious consequences. These incidents not only cause a huge blow to user trust, but also can trigger a series of legal, financial and social problems.

[0003] In the face of large and complex software system testing challenges, it is particularly critical to explore more efficient testing methods and tools. Researchers have explored a variety of technical means to improve efficiency. Among them, fuzz testing detects potential program crashes by inputting abnormal, unexpected or random data to software systems. Due to its strong adaptability and low labor cost, fuzz testing has gradually been recognized by the industry and academia. However, for large and complex actual software systems, traditional single-machine single-core fuzz testing has been unable to meet the growing testing needs. Therefore, parallel fuzz testing as a natural extension of traditional fuzz testing has been proposed. With the development of parallel computing technology, parallel-based fuzz testing methods have begun to be favored. It improves testing efficiency by running multiple fuzz testing cases simultaneously. With the increase of computing resources, parallel fuzz testing can more easily expand the testing scale to cope with the growing complexity of software.

[0004] In the current research field of parallel fuzz testing, most of the work focuses on how to reasonably divide tasks, while the attention to dynamic task scheduling is relatively less. These studies usually assign test cases once at the beginning of parallel testing according to the characteristics of different tasks, or update tasks every fixed time. However, this method has a problem: although the existing method performs well in the definition and allocation of tasks, it cannot adapt to the dynamic changes in the fuzz testing process. As the test deepens, the difficulty of exploration gradually increases, and at the same time, the exploration situation under different programs and different environments will also change. Therefore, further research is needed on how to achieve dynamic task scheduling to improve the efficiency and adaptability of parallel fuzz testing.

[0005] In view of the problem that existing parallel fuzz testing lacks adaptive scheduling strategies for test tasks, the present application provides a coverage-driven parallel fuzz testing task dynamic scheduling method and system, which flexibly adjusts the frequency of task allocation based on real-time monitored coverage growth. By setting upper and lower limits of the period, when the coverage growth is lower than the preset threshold, the system will extend the period to reduce resource consumption; on the contrary, when the coverage growth exceeds the threshold, the system will shorten the period to speed up the exploration of new code areas. The threshold itself also has the ability to dynamically adjust, continuously tracking the effects of coverage changes and task allocation periods through a feedback mechanism, to achieve real-time fine-tuning of the threshold to adapt to the needs of different exploration stages. This dynamic adjustment strategy effectively addresses the uneven coverage difficulty problem in fuzz testing, ensuring the continuity and efficiency of the test. By optimizing resource allocation and test progress, this strategy not only adapts to the changes in coverage difficulty at different stages of the test process, but also significantly improves the overall efficiency of parallel fuzz testing. SUMMARY

[0006] The present application provides a coverage-driven parallel fuzz testing task dynamic scheduling method and system, and the specific technical solutions are as follows:

[0007] In the first aspect of the present application, a coverage-driven parallel fuzz testing task dynamic scheduling method is provided, comprising the following steps:

[0008] 1) Determine the initial value, minimum period and maximum period of the task allocation period, and the initial value is twice the minimum period;

[0009] 2) Based on the initial value and minimum period of the task allocation period, set the initial value of the threshold of the coverage increment;

[0010] 3) Task allocation is performed on the software program to be tested, and the corresponding duration of parallel fuzz testing is performed on the allocated tasks according to the size of the current task allocation period. After the test is completed, the current code coverage is recorded and the coverage increment is calculated;

[0011] 4) Compare the coverage increment with the threshold, and adjust the size of the task allocation period in real time according to the comparison result;

[0012] 5) Adjust the size of the threshold in real time according to the coverage increment;

[0013] 6) Repeat steps 3) to 5) until the preset total test duration is reached.

[0014] As a preferred scheme of the present application, before step 2), a fuzz testing running environment for the software program to be tested needs to be constructed, including multiple test engines.

[0015] As a preferred scheme of the present application, the step 2) is specifically:

[0016] 2.1) Assign the software program to be tested to multiple test engines, and the multiple test engines perform parallel fuzz testing on the assigned program until the test duration reaches the minimum period, and record the first code coverage rate;

[0017] 2.2) The test engine continues to perform parallel fuzz testing until it reaches the initial value of the task allocation period, ends the test, records the second code coverage rate, calculates the coverage increment based on the first code coverage rate and the second code coverage rate as the initial value of the threshold.

[0018] As a preferred scheme of the present application, the step 4) is specifically:

[0019] Compare the current coverage rate with the threshold value. If the current coverage increment is lower than or equal to the threshold value, the task allocation period is extended to twice the original period, but not more than the maximum period. If the current coverage increment is higher than the threshold value, the task allocation period is shortened to half the original period, but not less than the minimum period.

[0020] As a preferred scheme of the present application, the step 5) is specifically:

[0021] If the current coverage increment is lower than or equal to the threshold value, the threshold value is lowered. If the current coverage increment is higher than the threshold value, the threshold value is increased.

[0022] In the second aspect of the present application, a coverage-driven parallel fuzz testing task dynamic scheduling system is provided for implementing the coverage-driven parallel fuzz testing task dynamic scheduling method described above.

[0023] Compared with the prior art, the present application has the following beneficial effects:

[0024] 1) The present application dynamically adjusts the task allocation period according to the coverage increment, which can more effectively utilize resources. When the coverage rate grows slowly, the parallel fuzz testing system will reduce resource investment to avoid waste on inefficient paths. When the coverage rate grows rapidly, the system will increase resources to speed up testing, ensuring that resources are always used on the most promising test paths;

[0025] 2) The present application can adapt to changes in the testing process more quickly by dynamically adjusting the threshold and the task allocation period, significantly improving the efficiency of the test, especially in the face of non-uniform coverage difficulty, which can ensure that the testing process is both efficient and continuously advancing;

[0026] 3) The present application can monitor coverage changes in real time and adaptively adjust the testing strategy according to these changes. This high degree of adaptability makes it particularly suitable for large-scale software projects that require rapid iteration and high coverage guarantee, and it can quickly respond to the task requirements of parallel fuzz testing dynamic adjustment. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 The schematic diagram of the architecture of the coverage-driven parallel fuzzing task dynamic scheduling system;

[0028] Figure 2 The schematic diagram of the workflow of the dynamic period adjustment module;

[0029] Figure 3 The schematic diagram of the workflow of the threshold fine-tuning module. DETAILED DESCRIPTION

[0030] The present application will be further described and illustrated in conjunction with the specific embodiments. The embodiments are only exemplary and do not define the scope of the disclosure. The technical features of various embodiments of the present application can be combined accordingly without conflict.

[0031] As shown in Figure 1 The coverage-driven parallel fuzzing task dynamic scheduling system of the present application is composed of five parts, namely, a real-time monitoring and analysis module, a dynamic period adjustment module, a threshold fine-tuning module, a task allocation module, and a parallel fuzzing execution module.

[0032] The real-time monitoring and analysis module continuously tracks the real-time changes of the code coverage during the testing process, provides the necessary basic data for the adaptive adjustment of the task allocation frequency, can accurately collect the growth trend of the coverage, and provides accurate reference information for the dynamic adjustment of the system according to these data. The code coverage is the ratio of the number of executed basic blocks to the total number of basic blocks in the software program to be tested. Specifically, the real-time monitoring and analysis module records the current code coverage after the end of each period during the parallel fuzzing testing process and calculates the coverage increment (except for the first period). The coverage increment is the difference between the code coverage of the current period and the code coverage of the previous period. After the end of the first period, since there is no previous period, the coverage increment is not calculated.

[0033] The dynamic period adjustment module sets the minimum and maximum limits of the period to ensure the rationality of the task allocation period, and adjusts the period length according to the real-time growth of the coverage. The allocation frequency of the testing task is directly adjusted to ensure the efficiency of the parallel fuzzing testing system and the optimization of resource usage, and to speed up the exploration speed of new code regions. In this embodiment, the minimum period is set to 10 minutes and the maximum period is set to 3 hours.

[0034] The threshold fine-tuning module is responsible for dynamically adjusting the threshold during the testing process, continuously monitors the changes of the coverage and the effects of the task allocation period. The threshold is fine-tuned in real time according to the collected data, so that the parallel fuzzing testing system can flexibly adapt to various testing scenarios and ensure the stability and efficiency of the testing process.

[0035] The task allocation module effectively allocates test tasks to each test engine according to the current test requirements and available resource conditions. Through reasonable task allocation, it ensures that each test engine can accept appropriate test tasks according to its performance and characteristics, thereby optimizing the overall test efficiency.

[0036] In a specific embodiment of the present application, the specific task allocation process of the task allocation module is as follows: all basic blocks of the software program to be tested are divided into a predecessor part containing only explored basic blocks and a successor part containing unexplored basic blocks, and the successor part is divided into multiple tasks and allocated to multiple test engines.

[0037] The division of the successor part can be uniform division with basic blocks as the granularity, or other existing division methods according to the performance and characteristics of each test engine to improve test efficiency.

[0038] The parallel fuzzy test execution module includes multiple test engines, which are responsible for starting and managing multiple test engines to ensure their effective execution of allocated test tasks. Through the parallel execution mechanism, the test process is accelerated, and the efficiency of discovering potential problems is improved.

[0039] In a specific embodiment of the present application, the parallel execution mechanism of the parallel fuzzy test execution module is as follows: in each cycle, multiple test engines perform fuzzy testing for a corresponding duration according to the size of the current task allocation cycle; after each cycle, the number of times each basic block in the successor part is executed in this fuzzy test is counted, and the basic blocks that have been executed at least once are recorded as explored basic blocks.

[0040] In a specific embodiment of the present application, the dynamic cycle adjustment module executes the process as shown in Figure 2 The dynamic cycle adjustment module ensures the rationality of the task allocation cycle through preset minimum and maximum cycle limits, and intelligently adjusts according to the real-time incremental data of code coverage. When the increment is less than or equal to the set threshold, it indicates that the current test speed is slow, and the system will automatically extend the task allocation cycle to twice the existing cycle, but not more than the maximum cycle value, so as to invest more resources to explore new paths. If twice the existing cycle exceeds the maximum cycle value, the cycle is adjusted to the maximum cycle value. Conversely, if the increment is higher than the threshold, it indicates that the test is rapidly covering new code regions, and the system will shorten the cycle to half of the existing value, but not less than the minimum cycle value, to update the task to adapt to the new test requirements to speed up the overall test process. If half of the existing value is less than the minimum cycle value, the cycle is adjusted to the minimum cycle value. This adaptive adjustment mechanism directly affects the allocation of test tasks, ensuring that the test can be efficiently and stably performed under different conditions.

[0041] In one embodiment of the present application, the threshold fine-tuning module implements a process as shown in Figure 3 The threshold fine-tuning module dynamically adjusts the threshold value by continuously monitoring the effects of coverage changes and task allocation periods. When the calculated coverage increment is higher than the set threshold, the module adjusts the threshold to 110% of the existing threshold, reducing resource consumption and avoiding frequent adjustments to the task allocation period. Conversely, if the coverage increment does not exceed the threshold, the module adjusts the threshold to 90% of the existing threshold, making the system more sensitive to coverage changes, thus triggering the adjustment of the task allocation period earlier to explore more potential test paths. This adaptive adjustment mechanism enables the system to flexibly respond to various testing situations, maintaining the stability and efficiency of the test.

[0042] Based on the above introduction of the execution process of the two main modules, each main module is composed of several sub-modules, and the dynamic period adjustment module includes:

[0043] The period limit maintenance component implements and monitors the preset minimum and maximum period limits, ensuring that all task allocation periods fall within this safe range. By maintaining these period boundaries, this component prevents excessively short or long period changes, thus protecting the system from unstable period changes. This helps maintain the continuity and reliability of the testing process, enabling the system to operate stably in a dynamic environment;

[0044] The coverage growth analysis component is used to analyze the growth data of coverage to identify the growth trend therein. These analysis results provide a solid basis for dynamic period adjustment, enabling the system to more accurately respond to changes in testing requirements. This component ensures the flexibility and adaptability of the testing process, allowing adjustments based on actual testing conditions;

[0045] The period length adjustment component dynamically adjusts the length of the task allocation period based on the data provided by the coverage growth analysis component. If the analysis results show slow coverage growth, this component will lengthen the period to reduce resource consumption and optimize efficiency; conversely, if the coverage grows rapidly, it will shorten the period to accelerate the exploration of new code regions. This flexible adjustment mechanism optimizes resource usage and improves testing efficiency, ensuring that parallel fuzz testing can efficiently progress.

[0046] The threshold fine-tuning module includes:

[0047] The threshold trend analysis component is responsible for receiving and in-depth analysis of coverage data to identify growth trends and patterns therein. Through precise analysis of these data, this component provides a solid basis for dynamic adjustment of the threshold, ensuring that the adjustment process is both accurate and efficient;

[0048] A threshold adjustment component, based on the analysis results provided by the threshold trend analysis component, is responsible for dynamically adjusting the threshold. If the coverage increment is higher than the set threshold, it will adjust the threshold upward by a certain percentage to reduce the frequency of periodic updates and maintain stable test speed; on the contrary, if the coverage increment is lower than or equal to the threshold, it will adjust the threshold downward by a certain percentage to increase the sensitivity of the system to coverage changes. This flexible adjustment mechanism enables the system to respond more accurately to actual testing needs, ensuring testing efficiency.

[0049] The system embodiments described above are only illustrative, wherein the units illustrated as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place or distributed to multiple network units. Part or all of the modules can be selected to achieve the purpose of the present application according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0050] The system embodiments of the present application can be applied to any device with data processing capability, which can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory for execution by the processor of the device with data processing capability.

[0051] Based on the same inventive concept, a coverage-driven parallel fuzzy testing task dynamic scheduling method is proposed, the main steps of which are:

[0052] 1) Construct a fuzzy testing running environment for the software program to be tested, including multiple test engines; determine the minimum and maximum limits of the task allocation period to define the adjustment range. Set the initial period to twice the minimum value to allow subsequent adjustments based on actual conditions; the test engine is a fuzzy testing tool, and the test engine used in this embodiment is AFL++.

[0053] 2) Considering the differences in testing efficiency under different programs and environments, using a fixed initial threshold is not appropriate. Set the initial threshold of coverage increment through preliminary testing as a benchmark to measure testing efficiency and provide guidance for subsequent task allocation period adjustment. According to the initial period, expand parallel fuzzy testing, record the current coverage at the end of the minimum period, and record it again after the initial period, calculate the increment of the two coverages as the threshold.

[0054] 3) divide all basic blocks of the software program to be tested into a predecessor part containing only explored basic blocks and a successor part containing unexplored basic blocks, divide the successor part into multiple tasks and assign to multiple test engines, and the multiple test engines perform fuzz testing on the multiple tasks for a corresponding duration according to the size of the current task assignment period; count the number of times the basic blocks in the successor part are executed in this round of fuzz testing, and record the basic blocks that have been executed at least once as explored basic blocks. At the end of each period, update the coverage rate and the coverage rate increment.

[0055] The unexplored basic block refers to a basic block that has not been executed in the test of the current period and historical periods. The predecessor part is located before the execution sequence of the successor part, and the predecessor part and the successor part are both a plurality of basic blocks that are executed continuously. The division method of dividing the successor part into multiple tasks and assigning to multiple test engines is uniform division with basic blocks as the granularity.

[0056] 4) Based on the calculation result of the coverage rate increment, the task period is adjusted adaptively. When the increment is lower than the threshold, the period is extended to trigger more test path exploration; and when the increment exceeds the threshold, the period is shortened to speed up the coverage of new code regions. The specific adjustment strategy is: if the increment is lower than the threshold, the period is adjusted to twice the current length, but not more than the maximum limit set; if the increment exceeds the threshold, the period is halved, but not less than the minimum set value.

[0057] 5) Monitor the changes of the coverage rate and the effect of the task period, and dynamically adjust the threshold value accordingly. When the coverage rate increment is higher than the set threshold, it means that the current system test efficiency is better than expected, the exploration difficulty of the current exploration area is low, and the coverage rate grows faster. The system raises the threshold to 110% of the current threshold to reduce the sensitivity to the change of the coverage rate, thereby delaying the time point of period adjustment and avoiding frequent period adjustment; on the contrary, if the increment is lower than the threshold, it means that the current system coverage rate grows slowly, the exploration difficulty of the current test area is large, and the slight increase of the coverage rate may have a significant impact on the overall test and vulnerability mining of the program. Therefore, the threshold is lowered to 90% of the existing threshold to improve the sensitivity to the change of the coverage rate and start the period adjustment earlier.

[0058] 6) Repeat steps 3) to 5), continuously drive the optimization of the task period as the coverage rate changes, ensure the effective use of resources and the in-depth exploration of test paths, until the total duration of the fuzz testing reaches the expectation.

[0059] Experiments show that compared with other parallel fuzz testing tools, the parallel fuzz tester after applying the coverage-driven parallel fuzz testing task dynamic scheduling method and system has higher testing efficiency. Under the same experimental setting, compared with the parallel mode of the fuzz testing tool AFL++, the present application has achieved a substantial improvement in the commonly used fuzz testing performance indicators such as edge coverage and the number of discovered vulnerabilities. Among them, compared with the most widely used tool AFL++, for nine commonly used programs of various types, the present application has an average improvement of 18.45% in the program edge coverage indicator, and an increase of 18.75% in the number of vulnerability mining.

[0060] The above-described embodiments only express several embodiments of the present application, and the description is more specific and detailed, but it cannot be understood as a limitation on the scope of the patent of the present application. For ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application.

Claims

1. A coverage-driven method for dynamic scheduling of parallel fuzzing tasks, characterized in that, Includes the following steps: 1) Determine the initial value, minimum period, and maximum period of the task allocation period, wherein the initial value is twice the minimum period; 2) Based on the initial value and minimum period of the task allocation cycle, set the initial value of the coverage increment threshold; 3) Assign tasks to the software program to be tested, and perform parallel fuzz tests of the corresponding duration on the assigned tasks according to the current task assignment cycle. After the test, record the current code coverage and calculate the coverage increment. 4) Compare the coverage increment with the threshold, and adjust the task allocation period in real time based on the comparison results. If the current coverage increment is lower than or equal to the threshold, the task allocation period will be extended to twice the current value, but not exceeding the maximum period. If the current coverage increment is higher than the threshold, the task allocation period will be shortened to half the current value, but not lower than the minimum period. 5) Adjust the threshold size in real time based on the coverage increment. If the current coverage increment is lower than or equal to the threshold, lower the threshold; if the current coverage increment is higher than the threshold, raise the threshold. 6) Repeat steps 3)-5) until the preset total test duration is reached.

2. The coverage-driven parallel fuzzing task dynamic scheduling method according to claim 1, characterized in that, The code coverage rate is the ratio of the number of executed basic blocks to the total number of basic blocks in the software program under test.

3. The coverage-driven parallel fuzzing task dynamic scheduling method according to claim 1, characterized in that, Before step 2), a fuzz test environment for the software program to be tested needs to be built, including multiple test engines.

4. The coverage-driven parallel fuzzing task dynamic scheduling method according to claim 3, characterized in that, Step 2) specifically refers to: 2.1) Assign the software program to be tested to multiple test engines. The multiple test engines perform parallel fuzz testing on the assigned program until the test duration reaches the minimum cycle, and record the first code coverage. 2.2) The test engine continues to execute parallel fuzz tests until the initial value of the task allocation cycle is reached, then the test ends, the second code coverage is recorded, and the coverage increment is calculated based on the first and second code coverage as the initial value of the threshold.

5. The coverage-driven parallel fuzzing task dynamic scheduling method according to claim 3, characterized in that, Step 3) describes the task allocation for the software program under test, and the execution of parallel fuzz tests for the allocated tasks according to the current task allocation period. Specifically, all basic blocks of the software program under test are divided into a predecessor part containing only explored basic blocks and a successor part containing unexplored basic blocks. The successor part is divided into multiple tasks and allocated to multiple test engines. The multiple test engines execute fuzz tests for the multiple tasks in parallel for the corresponding duration according to the current task allocation period. The number of times the basic blocks of the successor part are executed in this fuzz test is counted, and the basic blocks that have been executed at least once are recorded as explored basic blocks.

6. The coverage-driven parallel fuzzing task dynamic scheduling method according to claim 5, characterized in that, The method of dividing the subsequent part into multiple tasks and assigning them to multiple test engines is as follows: uniformly dividing at the granularity of basic blocks.

7. The coverage-driven parallel fuzzing task dynamic scheduling method according to claim 1, characterized in that, The coverage increment mentioned in step 3) is the difference between the code coverage of the current period and the code coverage of the previous period.

8. A scheduling system for implementing the coverage-driven parallel fuzzing task dynamic scheduling method of claim 1, characterized in that the system... include: The dynamic cycle adjustment module is used to set the minimum cycle, maximum cycle, and initial cycle, and also to continuously adjust the task allocation cycle based on the current coverage increment. The real-time monitoring and analysis module is used to record code coverage during parallel fuzzing and calculate coverage increments. The threshold fine-tuning module is used to set the initial value of the threshold and to continuously adjust the threshold size based on the current coverage increment. The task allocation module is used to allocate tasks to the software program to be tested. The parallel fuzzing execution module is used to perform parallel fuzzing tests according to the assigned tasks.

Images