Multi-target oriented parallel fuzzy test method and system based on seed characteristics

Abstract

The invention discloses a multi-target oriented parallel fuzzy test method and system based on seed characteristics. The method comprises the steps of dividing tasks of test engines, obtaining seeds for fuzzy testing, recording the triggering times of basic blocks, taking the triggering times as evaluation indexes of exploration difficulty, and screening out a target set according to the exploration difficulty; dividing the seeds into three types according to execution characteristics of the seeds; for different classifications, setting a specific guiding rule to adjust the selection probability and variation times of the seeds; and performing parallel fuzzy testing according to the adjusted selection probability and variation times. According to the method, while concentrated exploration of areas with high difficulty is ensured, wide testing of other parts of a task is kept. By balancing deep exploration and wide testing, the use efficiency of testing resources is improved, the situation that a testing engine is excessively concentrated in a complex area and ignores other areas possibly containing defects is prevented, and therefore the overall effect and efficiency of the parallel fuzzy testing system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software fuzz testing, and in particular to a multi-target oriented parallel fuzz testing method and system based on seed characteristics. Background Art

[0002] In the context of the digital age, the rapid development of the software industry has led to its influence in all fields. Whether in key industries such as national defense, industrial control, aerospace, finance and securities, postal and telecommunications, and medical care, or in software applications related to clothing, food, housing, and transportation in daily life, they all play a core role. As users' expectations for software functions continue to rise, the complexity and amount of code in software are also growing. With the increasing risks and threats brought by software vulnerabilities, the issue of ensuring software security has become particularly important. In recent years, there have been frequent incidents of software vulnerabilities being exploited for malicious network attacks, causing huge losses.

[0003] One of the key steps to ensure software security is to identify and patch software vulnerabilities. To this end, researchers have adopted a variety of technical means, including code review, data flow analysis, dynamic symbolic execution, and fuzz testing. Among these methods, fuzz testing is increasingly recognized by industry and academia due to its advantages of high automation and low false positive rate. However, in the face of large-scale and complex actual software systems, fuzz testing still faces challenges such as low code coverage and low detection efficiency when identifying potential vulnerabilities. With the development of parallel computing technology, parallelization-based fuzz testing methods have begun to gain favor. This method is expected to more efficiently discover vulnerabilities in software by improving test speed and coverage.

[0004] In the current research field of parallel fuzz testing, most of the work focuses on the initial division of tasks, while how to explore these tasks in depth is relatively neglected. These studies usually allocate test cases once according to the characteristics of different tasks at the beginning of parallel testing, and adopt a fixed random exploration strategy. However, in subsequent test iterations, there is a lack of more sophisticated and adaptable exploration optimization methods. This leads to a problem: although the existing methods perform well in task definition and allocation, they are insufficient in achieving efficient exploration of test tasks. Although some studies have tried to use distance-based directional techniques to screen test cases and guide exploration directions in single-instance fuzz testing, and have achieved certain results, these methods often need to rely on specific instrumentation techniques to assist in collecting distance information, which not only increases the computational burden, but also limits the number of test targets that can be processed simultaneously, and it is difficult to update the targets in real time during the test process. Relying solely on the directional strategy cannot meet the dual requirements of parallel fuzz testing to explore challenging areas while ensuring that the entire task range is covered when exploring tasks. Therefore, such methods are not suitable for direct application in the scenario of parallel fuzz testing. Summary of the invention

[0005] The present invention provides a multi-target oriented parallel fuzzy testing method and system based on seed characteristics, and the specific technical scheme is as follows:

[0006] In a first aspect of the present invention, a multi-target oriented parallel fuzz testing method based on seed characteristics is provided, comprising the following steps:

[0007] 1) Divide the program of the software to be tested into multiple task basic block sets; obtain multiple seeds for fuzz testing, input the seeds into the software to be tested in sequence for fuzz testing, track and record the cumulative number of triggering times of each task basic block in the task basic block set, and record the triggered basic blocks as explored basic blocks;

[0008] 2) Evaluate the exploration difficulty of the task basic blocks according to the number of triggers, select some task basic blocks with the highest exploration difficulty, and form the target set corresponding to the current task basic block set; calculate the distance from all explored basic blocks to the target set, and form the distance information corresponding to the current task basic block set;

[0009] 3) Allocate each task basic block set, the corresponding target set and the distance information to different test engines, and execute steps 4)-6) in parallel in each test engine;

[0010] 4) Classify the seeds into three categories according to how they trigger the task basic block and the target basic block;

[0011] 5) Initialize the selection probability and mutation times of all seeds, and adjust the selection probability and mutation times of various seeds according to the classification and distance information of the seeds;

[0012] 6) Selecting seeds from all seeds obtained in step 1) according to the selection probability of various seeds, and mutating the selected seeds a corresponding number of times according to the number of mutations, and using the mutated seeds to perform fuzzy testing on the software to be tested;

[0013] 7) Repeat step 6) until the preset test time is reached, and output the fuzzy test results of step 1) using the original seed and the fuzzy test results of step 6) using the mutated seed.

[0014] As a preferred solution of the present invention, in step 4), the first category is seeds that can trigger the target basic block, the second category is seeds that can trigger the task basic block but fail to trigger the target basic block, and the third category is seeds that neither trigger the target basic block nor the task basic block.

[0015] As a preferred solution of the present invention, in step 5), for the first and second categories of seeds, the specific method for adjusting their selection probabilities and mutation times is: first increase the selection probability and mutation times of the first category of seeds; for the second category of seeds, adjust the selection probability and mutation times of the seeds according to the number of their triggered basic blocks, so that the selection probability and mutation times of the second category of seeds with more triggered basic blocks are higher than those of the second category of seeds with fewer triggered basic blocks, but the selection probability and mutation times of the second category of seeds do not exceed the selection probability and mutation times of any first category of seeds.

[0016] As a preferred solution of the present invention, in step 5), for the third type of seeds, the specific method of adjusting the selection probability and the number of mutations is:

[0017] Based on the distance information obtained in step 3), the distances from all basic blocks passed in the execution path of the third type of seeds to the target set are counted, and the minimum value of the counted distances is obtained, which is the distance value of the seed;

[0018] Based on the distance value of the seeds, the selection probability and mutation times of the third category seeds are adjusted so that the selection probability and mutation times of the seeds with smaller distance values ​​in the third category seeds are higher, but the selection probability and mutation times of the third category seeds do not exceed the selection probability and mutation times of any second category seeds.

[0019] In a second aspect of the present invention, a multi-target guided parallel fuzz testing system based on seed characteristics is provided, which is used to implement the above-mentioned multi-target guided parallel fuzz testing method based on seed characteristics.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] 1) The present invention can formulate specific test rules for different test difficulties and requirements by screening target basic blocks with higher task difficulty and dynamically adjusting seed selection and mutation strategies, thereby improving the pertinence and flexibility of task-specific test strategies on each test engine;

[0022] 2) The present invention ensures in-depth exploration of high-difficulty areas while maintaining extensive coverage of other task areas, effectively optimizing resource allocation, avoiding excessive concentration or neglect of resources during the testing process, and achieving a balance between in-depth exploration and extensive testing;

[0023] 3) The distance calculation method of the present invention adopts the minimum mathematical principle to quantify the distance between the seed and the target basic block set as the minimum distance between the basic blocks on the execution path, which effectively avoids the problem of reducing the seed distance discrimination as the number of targets increases, thereby supporting multiple exploration targets and meeting the needs of parallel fuzz testing;

[0024] 4) The present invention classifies the basic blocks of exploration according to the difficulty of each given test task through precise classification-oriented strategies and dynamic adjustment mechanisms, sets corresponding exploration rules according to the execution characteristics of the seeds in the exploration tasks, and dynamically adjusts the selection probability and mutation times of the seeds, so that the parallel test engine can concentrate resources to break through the difficult areas of the given target tasks, while ensuring that other areas of the test tasks are also systematically explored, achieving a balance between depth and breadth of exploration, thereby improving the code coverage of parallel fuzz testing, enhancing the ability to discover vulnerabilities, and improving the overall efficiency of testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 The schematic diagram of the architecture of the seed-based multi-objective parallel fuzz testing optimization system;

[0026] Figure 2 This is a schematic diagram of the workflow of the distance calculation module;

[0027] Figure 3 Schematic diagram of the workflow of the optimization and adjustment module. DETAILED DESCRIPTION

[0028] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0029] like Figure 1 As shown, a multi-objective-oriented parallel fuzzy testing optimization system based on seed characteristics of the present invention is composed of a program partitioning module, a pre-exploration module, a distance calculation module, a task allocation module, a seed classification module, an optimization adjustment module, and a test module. In the multi-objective-oriented parallel fuzzy testing optimization system of the present invention, the program partitioning module is used to divide the program of the software to be tested into a plurality of task basic block sets.

[0030] The pre-exploration module is used to obtain seeds, input the seeds into the software to be tested, track and record the number of times each task basic block in the task basic block set is triggered, output the explored basic blocks, and also record some task basic blocks with a large number of triggering times as target basic blocks to form a target set output. The seeds are test cases and can be used as input for the software to be tested.

[0031] The distance calculation module is responsible for determining the distance of the test seed, that is, the shortest distance from each basic block passed on its execution path to the target basic block set. This calculation result will directly affect the selection probability of the seed that does not touch the task basic block and the target basic block and the allocation strategy of the number of mutations, thereby guiding the test process to more accurately locate the potential defect area.

[0032] The task allocation module intelligently allocates these data to the corresponding test engines for parallel testing based on the task set information, the set information of the target basic block, the pre-calculated basic block level, and the distance information from the basic block to the target set level. This ensures that the test resources are reasonably utilized and that each test engine can work efficiently and collaboratively. The test engine is a fuzzy testing tool, and the test engine used in this embodiment is AFL++.

[0033] The seed classification module divides seeds into three categories based on their behavior during testing: seeds that can trigger the target basic block, seeds that can only trigger other basic blocks in the task but not the target basic block, and seeds that neither touch the target basic block nor other basic blocks in the task. This classification helps to implement differentiated testing strategies for seeds with different behaviors.

[0034] The optimization and adjustment module includes a scheduling rule setting module and an exploration optimization module. The scheduling rule setting module formulates specific scheduling rules for different types of seeds. Seeds that can trigger the target basic block will have a higher selection probability and mutation times to fully utilize their exploration potential to break through difficult areas. For seeds that only trigger other basic blocks in the task, their selection probability and mutation times will be adjusted according to their actual performance. For seeds that fail to effectively trigger any task-related basic blocks, their selection probability and mutation times will be determined based on their distance information to ensure the reasonable allocation of test resources. The exploration optimization module dynamically adjusts the selection probability and mutation times of the test seeds based on the execution characteristics of the seeds and the established scheduling rules. This is intended to improve the exploration efficiency of the test task, especially for those areas that are difficult to break through, to achieve balanced exploration with other test areas, thereby comprehensively improving the test coverage and the ability to discover potential defects.

[0035] The test module is used to select and mutate seeds according to the selection probability and mutation times of the seeds, perform fuzzy testing using the mutated seeds, and output the test results. The mutation can be performed by deleting, adding or replacing several bits in the seeds, or by other existing methods.

[0036] In a specific embodiment of the present invention, the distance calculation module performs the following process: Figure 2As shown in the figure, the shortest paths between different basic blocks in the program control flow graph are first determined by the basic block distance calculation component using the Dijkstra algorithm. Then, the basic block to target set distance calculation component calls these shortest path information to calculate the distance from each basic block to all basic blocks in the target set, and selects the minimum value as the shortest distance from the basic block to the target set. Finally, the seed distance analysis component combines these shortest distance information, analyzes all the basic blocks that each test seed passes through on its execution path, and calculates their shortest distance to the target set, and selects the minimum value as the seed distance to guide subsequent seed selection and mutation strategies, optimize the test process and improve the efficiency of discovering potential defects.

[0037] In a specific embodiment of the present invention, the scheduling rule setting module executes the following process: Figure 3 As shown in the figure, the scheduling rule setting module is responsible for formulating and adjusting the execution order and mutation strategy of the test seeds. The module first identifies the seeds that can trigger the target basic blocks and increases the selection probability and mutation times of these seeds to prioritize the exploration of key areas that may hide software defects. Next, the module analyzes the seeds that trigger the task basic blocks during execution, and adjusts the selection probability and mutation times according to the number of task basic blocks they trigger, thereby optimizing the allocation of resources and promoting wider path coverage. For those seeds that fail to trigger any target or task basic blocks, the module calculates their distance from the target basic blocks, optimizes their selection probability and mutation times accordingly, and guides these seeds to conduct in-depth exploration towards the difficult areas within the task scope. Through this series of steps, the optimization and adjustment module can dynamically adjust the test strategy to ensure the efficiency and comprehensiveness of the fuzz testing system and increase the probability of discovering potential software defects.

[0038] Based on the above introduction to the execution process of the two main modules, each main module is composed of several sub-modules, and the distance calculation module includes:

[0039] The basic block distance calculation component receives the program control flow graph as input, and then uses the Dijkstra algorithm to calculate the shortest path between each pair of basic blocks in the graph. These paths represent the shortest distance between basic blocks and are the basis for subsequent calculations;

[0040] The distance calculation component from the basic block to the target set uses the distance information between the basic blocks calculated in the previous step to calculate the shortest distance from each basic block to all basic blocks in the target set. For each basic block, it finds the shortest distance to all possible target basic blocks in the target set and selects the minimum value of these distances as the shortest distance from the basic block to the target set;

[0041] The seed distance analysis component combines the calculation results of the previous steps to analyze all the basic blocks that each test seed passes through on its execution path. It calculates the shortest distance from these basic blocks to the target set obtained by the previous steps, thereby obtaining the overall proximity of the seed to the test target.

[0042] The optimization and adjustment module includes the scheduling rule setting module and the exploration and optimization module:

[0043] The target trigger seed optimization component, after identifying the seeds that can trigger the target basic block, is used to prioritize the selection probability and mutation times of these seeds, so that the test is more focused on the code areas that may reveal potential defects;

[0044] The task trigger seed adjustment component allocates exploration resources according to the number of basic blocks triggered by the seed when executing the task. If a seed triggers more basic blocks, it means that it has the potential to cover a wider range of paths, so its selection probability and mutation times will be adjusted accordingly, so that the selection probability and mutation times of seeds that trigger more basic blocks are higher than those of seeds that trigger fewer basic blocks, so as to give priority to exploring seeds that may quickly trigger new basic blocks, thereby improving the coverage breadth and coverage efficiency within the task scope;

[0045] Seed distance adjustment component,For seeds that fail to trigger any target or task basic blocks, this component calculates their proximity to the target basic blocks.,Based on this proximity, it optimizes the selection probability and mutation times of these seeds,,ensuring that test resources are used effectively and promoting in-depth testing of,unexplored areas.

[0046] The adjustment goals are: 1) The selection probability and mutation times of the first type of seeds are higher than those of the second type of seeds, and the selection probability and mutation times of the second type of seeds are higher than those of the third type of seeds; 2) The selection probability and mutation times of seeds with more triggered basic blocks in the second type of seeds are higher; 3) The selection probability and mutation times of seeds with smaller distance values ​​in the third type of seeds are higher.

[0047] In the above adjustment, the higher or lower selection probability and mutation number between seeds means that the selection probability of a seed is compared with the selection probability of another seed, and the mutation number of a seed is compared with the mutation number of another seed, and both meet the higher or lower numerical values ​​at the same time.

[0048] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Those of ordinary skill in the art may understand and implement the scheme without creative work.

[0049] The system embodiment of the present invention can be applied to any device with data processing capability, and the device with data processing capability can be a device or apparatus such as a computer. The system embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capability and run.

[0050] Based on the same inventive concept, a multi-target oriented parallel fuzz testing method based on seed characteristics is proposed, and the main steps are:

[0051] 1) Divide the program of the software to be tested into multiple task basic block sets, wherein the task basic block set includes multiple continuously executed basic blocks; obtain multiple seeds for fuzz testing, input the seeds into the software to be tested in sequence, and for each task basic block set, track and record the number of executions of each basic block, that is, the number of test cases that trigger the basic block; identify all explored basic blocks according to the number of executions. The triggering of the basic block means that the basic block is executed, and the number of triggers is the number of executions of the basic block.

[0052] 2) After the task division is completed, the basic block execution count data obtained in step 1) is used to evaluate the exploration difficulty of the basic blocks in each task basic block set; the basic block set with higher exploration difficulty is taken as the target set, and the distance from all explored basic blocks to the target set is calculated and recorded.

[0053] The step 2) comprises:

[0054] 2.1) According to the execution count information in step 2), the program basic blocks in each task basic block set are sorted into ascending order; in this arrangement, the seeds in the front represent that they are more difficult to trigger, while the seeds in the back represent that they are less difficult to trigger.

[0055] 2.2) According to the difficulty of triggering basic blocks in the assessed tasks, the top 30% of the most difficult basic blocks are selected to form the target set; if the number of selected basic blocks does not form an integer, it is rounded up to the nearest integer;

[0056] 2.3) For each explored basic block, the Dijkstra algorithm is used to calculate the distance from it to all basic blocks in the target set on the program control flow graph, and the minimum value of these distances is taken as the shortest distance from the basic block to the target set.

[0057] 3) Allocate each task basic block set, the corresponding target set and the distance information to different test engines, and execute steps 4)-6) in parallel in each test engine;

[0058] 4) Classify the seeds according to the task basic block set, the target set, and the characteristics exhibited by the seeds during execution. The classification includes: seeds that can trigger the target basic block, seeds that can trigger other basic blocks in the task but fail to trigger the target basic block, and seeds that neither trigger the target basic block nor other basic blocks in the task;

[0059] The step 4) comprises:

[0060] 4.1) Classify each seed according to the basic blocks covered by each seed during execution, combined with task and target information, to determine its specific type;

[0061] 4.2) For the seed set that is not triggered by either the task basic block or the target basic block, the minimum distance from all basic blocks executed to the task is calculated as the seed distance.

[0062] 5) Initialize the selection probability and mutation times of all seeds; for different types of seeds in step 4), set corresponding exploration optimization rules. For the first two types of seeds that can touch the basic blocks in the task area, their selection and mutation mechanisms will be adjusted according to the triggering situation, giving a greater preference to seeds that can trigger the target basic blocks; for seeds that fail to trigger the basic blocks in the task area, give them different selection probabilities and mutation times according to the distance information of the seeds, and give priority to seeds that are closer to the target. The distance of the seed is the minimum value of the distance from all basic blocks passed in the seed execution path to the target set. The seed execution path is all basic blocks triggered in sequence after the seed is input into the software to be tested.

[0063] The step 5) comprises:

[0064] 5.1) Initialize the selection probability and mutation times of all seeds; in this embodiment, the initial values ​​of the selection probability and mutation times are calculated by the fuzz testing tool according to factors such as seed execution time and seed file size, and the fuzz testing tool is AFL++;

[0065] 5.1) Based on the ability of the seed to trigger the task basic block, adjust its selection probability and mutation times to achieve balanced exploration of the entire task area;

[0066] 5.2) For the seeds that trigger the target set, increase their selection probability and mutation times, and give priority to exploring areas with higher difficulty;

[0067] 5.3) For the seed set that is not triggered by both the task basic block and the target basic block, its selection probability and mutation times are adjusted according to the seed distance value, so that the seeds with smaller distance values ​​have higher selection probability and mutation times.

[0068] 6) Allocate each task basic block set to a different test engine. The test engine selects seeds from all seeds obtained in step 1) according to the selection probability of various seeds, and mutates the selected seeds a corresponding number of times according to the number of mutations. The mutated seeds are used to perform fuzz testing on the software to be tested. Repeat this step until the preset test time is reached.

[0069] The mutating the selected seeds a corresponding number of times according to the number of mutations thereof means: mutating the selected seeds in different mutation modes to obtain the same number of mutated seeds as the number of mutations thereof.

[0070] 7) Combining the fuzzy test results of the original seed in step 1) and the fuzzy test results of each test engine using the mutated seed in step 6).

[0071] Experiments show that compared with other parallel fuzz testing tools, the fuzz tester after applying the test case scheduling method and system proposed in the present invention has higher testing efficiency. Under the same experimental settings, compared with the parallel mode of the fuzz testing tool AFL++, the present invention has achieved significant improvements in common fuzz testing performance indicators such as edge coverage and the number of vulnerabilities found. Among them, compared with the most widely used tool AFL++, for nine commonly used programs of various types, the present invention has improved the program edge coverage index by an average of 21.45%, and the number of vulnerabilities mined has increased by 37.74%; compared with the default task exploration mode, the exploration proportion of difficult areas has increased by an average of 31.10%. When allocating the same computing resources, the present invention explores the program under test more fully.

[0072] The above-mentioned embodiments only express several implementation methods of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A multi-target oriented parallel fuzz testing method based on seed characteristics, characterized in that: The following steps are involved: 1) Divide the program of the software to be tested into multiple task basic block sets; Obtain multiple seeds for fuzz testing, input the seeds into the software to be tested in sequence for fuzz testing, track and record the cumulative number of triggering of each task basic block in the task basic block set, and record the triggered basic blocks as explored basic blocks; 2) Evaluate the exploration difficulty of the task basic blocks according to the number of triggers, select some task basic blocks with the highest exploration difficulty, and form the target set corresponding to the current task basic block set; calculate the distance from all explored basic blocks to the target set, and form the distance information corresponding to the current task basic block set; 3) Allocate each task basic block set, the corresponding target set and the distance information to different test engines, and execute steps 4)-6) in parallel in each test engine; 4) Classify the seeds into three categories according to how they trigger the task basic block and the target basic block; 5) Initialize the selection probability and mutation times of all seeds, and adjust the selection probability and mutation times of various seeds according to the classification and distance information of the seeds; 6) Selecting seeds from all seeds obtained in step 1) according to the selection probability of various seeds, and mutating the selected seeds a corresponding number of times according to the number of mutations, and using the mutated seeds to perform fuzzy testing on the software to be tested; 7) Repeat step 6) until the preset test time is reached, and output the fuzzy test results of step 1) using the original seed and the fuzzy test results of step 6) using the mutated seed.

2. The multi-target oriented parallel fuzz testing method based on seed characteristics according to claim 1 is characterized in that: In step 1), the task basic block set includes a plurality of basic blocks that are executed continuously.

3. The multi-target oriented parallel fuzz testing method based on seed characteristics according to claim 1 is characterized in that: In step 2), the specific method of evaluating the exploration difficulty of the task basic block according to the number of triggers is: For each task basic block in the task basic block set, the task basic blocks in the current set are sorted in ascending order according to the number of triggering times. The task basic blocks in the front order are considered to have a higher exploration difficulty, and the task basic blocks in the back order are considered to have a lower exploration difficulty.

4. The multi-target oriented parallel fuzz testing method based on seed characteristics according to claim 3 is characterized in that: In step 2), the basic blocks of some tasks with the highest exploration difficulty are specifically the first 20% to 40% of the basic blocks with the highest triggering difficulty; if the number of the first 20% to 40% of the basic blocks does not constitute an integer, it is rounded up to the nearest integer.

5. The multi-target oriented parallel fuzz testing method based on seed characteristics according to claim 1 is characterized in that: In step 2), the method for calculating the distance from the explored basic block to the target set is specifically as follows: obtaining the program control flow graph of the software to be tested, using the Dijkstra algorithm to calculate the shortest path between the explored basic block and each target basic block in the target set on the program control flow graph, and the minimum value of the shortest path between the explored basic block and all target basic blocks is the distance from the explored basic block to the target set.

6. The multi-target oriented parallel fuzz testing method based on seed characteristics according to claim 1 is characterized in that: In step 4), the first category is seeds that can trigger the target basic block, the second category is seeds that can trigger the task basic block but fail to trigger the target basic block, and the third category is seeds that neither trigger the target basic block nor the task basic block.

7. The multi-target oriented parallel fuzz testing method based on seed characteristics according to claim 6 is characterized in that: In step 5), for the first and second category seeds, the specific method for adjusting their selection probabilities and mutation times is: first increase the selection probability and mutation times of the first category seeds; for the second category seeds, adjust the selection probability and mutation times of the seeds according to the number of their triggered basic blocks, so that the selection probability and mutation times of the second category seeds with more triggered basic blocks are higher than those of the second category seeds with fewer triggered basic blocks, but the selection probability and mutation times of the second category seeds do not exceed the selection probability and mutation times of any first category seeds.

8. The multi-target oriented parallel fuzz testing method based on seed characteristics according to claim 6 is characterized in that: In step 5), for the third type of seeds, the specific method of adjusting the selection probability and the number of mutations is as follows: Based on the distance information obtained in step 3), the distances from all basic blocks passed in the execution path of the third type of seeds to the target set are counted, and the minimum value of the counted distances is obtained, which is the distance value of the seed; Based on the distance value of the seeds, the selection probability and mutation times of the third category seeds are adjusted so that the selection probability and mutation times of the seeds with smaller distance values ​​in the third category seeds are higher, but the selection probability and mutation times of the third category seeds do not exceed the selection probability and mutation times of any second category seeds.

9. A fuzzy testing system for implementing the multi-target oriented parallel fuzzy testing method based on seed characteristics as claimed in claim 1, characterized in that: The system includes: A program partitioning module is used to divide the program of the software to be tested into a plurality of task basic block sets; The pre-exploration module is used to obtain seeds, input the seeds into the software to be tested for fuzz testing, track and record the number of times each task basic block in the task basic block set is triggered, output the explored basic blocks, and also record some task basic blocks with a large number of triggering times as target basic blocks to form a target set output; The distance calculation module is used to calculate the distance from all explored basic blocks to the target set and output it as distance information; A task allocation module, used to allocate task basic block sets, target sets and distance information to corresponding test engines; The seed classification module is used to classify the seeds into three categories according to the triggering conditions of the basic blocks; The optimization and adjustment module is used to adjust the selection probability and mutation times of the seeds by using specific scheduling rules according to the type of seeds; The test module is used to select and mutate seeds according to the seed selection probability and mutation times, and use the mutated seeds for fuzzy testing.

Images