A multi-target oriented parallel fuzzing method and system based on seed characteristics

Abstract

The application discloses a multi-target oriented parallel fuzzy testing method and system based on seed characteristics. The method comprises the following steps: dividing the tasks of each test engine, obtaining seeds for fuzzy testing, recording the triggering times of basic blocks and taking the triggering times as an evaluation index of exploration difficulty, screening out a target set according to the exploration difficulty; according to the execution characteristics of the seeds, the seeds are divided into three types; for different classifications, specific guiding rules are set to adjust the selection probability and the number of mutations of the seeds; and parallel fuzzy testing is performed according to the adjusted selection probability and the number of mutations. The application ensures the concentrated exploration of the high-difficulty area while maintaining extensive testing of other parts of the task. By balancing in-depth exploration and extensive testing, the application improves the use efficiency of test resources, prevents the test engine from excessively concentrating on the complex area and ignoring other areas that may contain defects, and thus improves the overall effect and efficiency of the parallel fuzzy testing system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software fuzz testing, and in particular to a multi-target oriented parallel fuzz testing method and system based on seed characteristics. BACKGROUND

[0002] Under the background of the digital era, the rapid development of the software industry has brought its influence to various fields. Whether in key industries such as national defense, industrial control, aerospace, finance and securities, postal and telecommunication, medical and health care, or in daily life involving clothing, food, shelter and transportation, software applications play a core role. With the increasing expectations of users for software functions, the complexity and code volume of software also increase. Consequently, the risks and threats posed by software vulnerabilities are increasing, and ensuring software security has become particularly important. In recent years, software vulnerabilities have been exploited for malicious cyber attacks, causing significant losses.

[0003] One of the key steps to ensure software security is to identify and patch software vulnerabilities. To this end, researchers have adopted various technical means, including code review, data flow analysis, dynamic symbolic execution, and fuzz testing. Among these methods, fuzz testing is increasingly recognized by industry and academia for its high automation and low false positive rate. However, in the face of large and complex actual software systems, fuzz testing still faces challenges such as low code coverage and low detection efficiency in identifying potential vulnerabilities. With the development of parallel computing technology, parallel-based fuzz testing methods have begun to be favored. This approach is expected to more efficiently discover vulnerabilities in software by improving test speed and coverage.

[0004] In the current research field of parallel fuzz testing, most work focuses on the initial partitioning phase of tasks, while how to explore these tasks in depth is relatively neglected. These studies usually assign test cases once based on the characteristics of different tasks at the beginning of parallel testing, and use a fixed random exploration strategy, but lack more refined and adaptive exploration optimization methods in subsequent test iterations. This leads to a problem: although existing methods perform well in task definition and allocation, they are insufficient in achieving efficient exploration of test tasks. Although some research has attempted to use distance-based directional techniques to filter test cases and guide exploration direction in single-instance fuzz testing, and has achieved certain results, these methods often need to rely on specific instrumentation techniques to assist in collecting distance information, which not only increases the computational burden, but also limits the number of test targets that can be processed simultaneously, and it is difficult to update the targets in real time during the testing process. Relying solely on directional strategies cannot meet the dual requirements of both challenging areas and ensuring coverage of all task ranges when exploring tasks in parallel fuzz testing. Therefore, such methods are not suitable for direct application in the context of parallel fuzz testing. SUMMARY

[0005] The application provides a multi-target oriented parallel fuzzy testing method and system based on seed characteristics, and the specific technical solutions are as follows.

[0006] In the first aspect of the application, a multi-target oriented parallel fuzzy testing method based on seed characteristics is provided, comprising the following steps:

[0007] 1) dividing the program of the software to be tested into a plurality of task basic block sets; obtaining a plurality of seeds for fuzzy testing, inputting the seeds into the software to be tested in sequence for fuzzy testing, tracking and recording the cumulative trigger times of each task basic block in the task basic block set, and recording the triggered basic block as an explored basic block;

[0008] 2) evaluating the exploration difficulty of the task basic block according to the trigger times, selecting part of the task basic blocks with the highest exploration difficulty to form a target set corresponding to the current task basic block set; calculating the distance from all the explored basic blocks to the target set to form distance information corresponding to the current task basic block set;

[0009] 3) distributing the task basic block sets, the corresponding target sets and the distance information to different test engines, and performing steps 4)-6) in parallel in each test engine;

[0010] 4) classifying the seeds into three categories according to the trigger conditions of the seeds on the task basic blocks and the target basic blocks;

[0011] 5) initializing the selection probability and the mutation times of all seeds, and adjusting the selection probability and the mutation times of the seeds according to the classification and the distance information of the seeds;

[0012] 6) selecting seeds from all the seeds obtained in step 1) according to the selection probability of the seeds, and performing mutation on the selected seeds according to the mutation times thereof, and using the mutated seeds to perform fuzzy testing on the software to be tested;

[0013] 7) repeating step 6) until a preset test time is reached, and outputting the fuzzy testing results of step 1) using the original seeds and the fuzzy testing results of step 6) using the mutated seeds.

[0014] As a preferred scheme of the application, in step 4), the first category is seeds capable of triggering the target basic blocks, the second category is seeds capable of triggering the task basic blocks but failing to trigger the target basic blocks, and the third category is seeds neither triggering the target basic blocks nor triggering the task basic blocks.

[0015] As a preferred scheme of the present application, in step 5), the specific method for adjusting the selection probability and the mutation times of the first type and the second type seeds is: first, increasing the selection probability and the mutation times of the first type seeds; and for the second type seeds, adjusting the selection probability and the mutation times of the seeds according to the number of triggered basic blocks, so that the selection probability and the mutation times of the second type seeds triggering more basic blocks are higher than those of the second type seeds triggering less basic blocks, but the selection probability and the mutation times of the second type seeds do not exceed those of any first type seeds.

[0016] As a preferred scheme of the present application, in step 5), the specific method for adjusting the selection probability and the mutation times of the third type seeds is:

[0017] Based on the distance information obtained in step 3), the distance of all basic blocks passed in the execution path of the third type seeds to the target set is counted, and the minimum value of the counted distance is the distance value of the seed;

[0018] Based on the distance value of the seed, the selection probability and the mutation times of the third type seeds are adjusted, so that the selection probability and the mutation times of the third type seeds with smaller distance values are higher, but the selection probability and the mutation times of the third type seeds do not exceed those of any second type seeds.

[0019] In the second aspect of the present application, a multi-target oriented parallel fuzzy testing system based on seed characteristics is provided, which is used to implement the multi-target oriented parallel fuzzy testing method based on seed characteristics.

[0020] Compared with the prior art, the present application has the following beneficial effects:

[0021] 1) The present application can formulate specific test rules for different test difficulties and requirements by screening target basic blocks with higher difficulty and dynamically adjusting seed selection and mutation strategies, thereby improving the pertinence and flexibility of specific task test strategies on each test engine;

[0022] 2) The present application ensures in-depth exploration of high-difficulty areas while maintaining extensive coverage of other task areas, effectively optimizes resource allocation, avoids excessive concentration or neglect of resources in the test process, and achieves a balance between in-depth exploration and extensive testing;

[0023] 3) The distance calculation method of the present application quantifies the distance between the seed and the target basic block set as the minimum value of the distance between the basic blocks on the execution path, effectively avoiding the problem of reduced seed distance differentiation with the increase of the number of targets, thereby supporting multiple exploration targets and adapting to the needs of parallel fuzzy testing;

[0024] 4) This invention, through a precise classification-oriented strategy and dynamic adjustment mechanism, classifies the basic exploration blocks in a given test task according to their difficulty, and sets corresponding exploration rules based on the execution characteristics of the seeds in the exploration task. It dynamically adjusts the selection probability and mutation number of the seeds, enabling the parallel testing engine to concentrate resources to break through the difficult areas of the given target task, while ensuring that other areas of the test task are also systematically explored. This achieves a balance between depth and breadth of exploration, thereby improving the code coverage of parallel fuzzing, enhancing the ability to discover vulnerabilities, and improving the overall efficiency of testing. Attached Figure Description

[0025] Figure 1 A schematic diagram of the architecture of a seed-based multi-objective-oriented parallel fuzzy testing optimization system;

[0026] Figure 2 This is a schematic diagram of the workflow of the distance calculation module;

[0027] Figure 3 A flowchart illustrating the workflow of the optimized and adjusted modules. Detailed Implementation

[0028] The present invention will be further described and illustrated below with reference to specific embodiments. The embodiments described are merely examples of the content of this disclosure and do not limit the scope of the invention. The technical features of each embodiment in the present invention can be combined accordingly, provided that there is no mutual conflict.

[0029] like Figure 1 As shown, the multi-objective-oriented parallel fuzzy testing optimization system based on seed characteristics of the present invention consists of a program partitioning module, a pre-exploration module, a distance calculation module, a task allocation module, a seed classification module, an optimization adjustment module, and a testing module. In the multi-objective-oriented parallel fuzzy testing optimization system of the present invention, the program partitioning module is used to divide the program of the software to be tested into multiple sets of task basic blocks.

[0030] The pre-exploration module is used to acquire seeds, input the seeds into the software under test, track and record the number of times each task basic block in the task basic block set is triggered, output the explored basic blocks, and also to record the task basic blocks with the most triggers as target basic blocks, forming a target set for output. The seeds are test cases and can be used as input to the software under test.

[0031] The distance calculation module is responsible for determining the distance of the test seed, that is, the shortest distance from each basic block it passes through on its execution path to the target basic block set. This calculation result will directly affect the selection probability and mutation number allocation strategy of seeds that have not touched the task basic blocks and target basic blocks, thereby guiding the testing process to more accurately locate potential defect areas.

[0032] The task allocation module intelligently allocates the data to the corresponding test engines for parallel testing according to the task set information, the set information of the target basic block, the pre-calculated basic block level and the distance information of the basic block to the target set level. This ensures that the test resources are reasonably utilized, and the various test engines can work efficiently in coordination. The test engine is a kind of fuzzing tool, and the test engine adopted in the embodiment is AFL++.

[0033] The seed classification module classifies the seeds into three categories according to their behavior in the testing process: seeds that can trigger the target basic block, seeds that can only trigger other basic blocks in the task without reaching the target basic block, and seeds that neither reach the target basic block nor reach other basic blocks in the task. This classification helps to implement differentiated testing strategies for seeds with different performances.

[0034] The optimization adjustment module includes a scheduling rule setting module and an exploration optimization module. The scheduling rule setting module formulates specific scheduling rules for different types of seeds. Seeds that can trigger the target basic block will have a higher selection probability and mutation times to fully utilize their exploration potential to break through difficult areas. For seeds that only trigger other basic blocks in the task, their selection probability and mutation times will be adjusted according to their actual performance. For seeds that fail to effectively trigger any task-related basic block, their selection probability and mutation times will be determined based on their distance information to ensure reasonable allocation of test resources. The exploration optimization module dynamically adjusts the selection probability and mutation times of the test seeds in combination with the execution characteristics of the seeds and the established scheduling rules. This is done to improve the exploration efficiency of the test task, especially for difficult-to-break areas, to achieve balanced exploration with other areas, thereby improving overall test coverage and the ability to discover potential defects.

[0035] The test module is used to select seeds and perform mutations according to the selection probability and mutation times of the seeds, perform fuzz testing using the mutated seeds, and output test results. The mutation can be performed by deleting, adding or replacing several bits in the seed, or other existing methods.

[0036] In a specific embodiment of the present application, the distance calculation module performs the process as follows: Figure 2As shown, first, the inter-basic block distance calculation component uses Dijkstra's algorithm to determine the shortest paths between different basic blocks in the program control flow graph. Then, the basic block to target set distance calculation component calls these shortest path information to calculate the distance of each basic block to all basic blocks in the target set, and filters out the minimum value as the shortest distance of the basic block to the target set. Finally, the seed distance analysis component synthesizes these shortest distance information, analyzes all basic blocks passed by each test seed on its execution path, and calculates their shortest distance to the target set, selects the minimum value as the seed distance, to guide the subsequent seed selection and mutation strategy, optimize the test process and improve the efficiency of discovering potential defects.

[0037] In one embodiment of the present application, the scheduling rule setting module performs the process as shown in Figure 3 As shown, the scheduling rule setting module is responsible for formulating and adjusting the execution order of test seeds and mutation strategy. The module first identifies seeds that can trigger target basic blocks, and increases the selection probability and mutation times of these seeds, to preferentially explore the key areas that may hide software defects. Then, the module analyzes the seeds that trigger task basic blocks in the execution process, adjusts the selection probability and mutation times according to the number of task basic blocks they trigger, to optimize the allocation of resources and promote wider path coverage. For those seeds that fail to trigger any target or task basic blocks, the module calculates their distance to the target basic blocks, and optimizes their selection probability and mutation times accordingly, to guide these seeds to explore the difficult areas within the task range in depth. Through these steps, the optimization and adjustment module can dynamically adjust the test strategy, ensure the efficiency and comprehensiveness of the fuzz testing system, and improve the probability of discovering potential software defects.

[0038] Based on the above introduction of the execution process of the two main modules, each main module is composed of several sub-modules, and the distance calculation module includes:

[0039] The inter-basic block distance calculation component receives the program control flow graph as input, and then uses Dijkstra's algorithm to calculate the shortest paths between each pair of basic blocks in the graph. These paths represent the shortest distances between basic blocks, which are the basis for subsequent calculations;

[0040] The basic block to target set distance calculation component uses the distance information between basic blocks calculated in the previous step to calculate the shortest distance of each basic block to all basic blocks in the target set. For each basic block, it finds the shortest distance to all possible target basic blocks in the target set, and selects the minimum value among these distances as the shortest distance of the basic block to the target set;

[0041] Seed distance analysis component, which analyzes all basic blocks that each test seed passes through in its execution path based on the results of the previous steps. It calculates the shortest distance from these basic blocks to the target set obtained by the previous steps, thereby obtaining the overall closeness of the seed to the test target.

[0042] The optimization adjustment module includes a scheduling rule setting module and an exploration optimization module.

[0043] Target trigger seed optimization component, after identifying seeds that can trigger target basic blocks, used to preferentially increase the selection probability and mutation times of these seeds, so that the test is more focused on the code area that may reveal potential defects.

[0044] Task trigger seed adjustment component, which allocates exploration resources based on the number of basic blocks triggered by the seed when executing the task. If a seed triggers more basic blocks, it means it has the potential to cover a wider range of paths, so its selection probability and mutation times will be adjusted accordingly, so that the selection probability and mutation times of seeds that trigger more basic blocks are higher than those of seeds that trigger fewer basic blocks, in order to preferentially explore seeds that may quickly trigger new basic blocks, improve the coverage breadth and coverage efficiency within the task range.

[0045] Seed distance adjustment component, for seeds that fail to trigger any target or task basic blocks, this component calculates their closeness to the target basic blocks. Based on this closeness, it optimizes the selection probability and mutation times of these seeds, ensuring that test resources are effectively utilized and promoting in-depth testing of unexplored areas.

[0046] The adjustment targets are: 1) the selection probability and mutation times of the first type of seed are higher than those of the second type of seed, and the selection probability and mutation times of the second type of seed are higher than those of the third type of seed; 2) the selection probability and mutation times of seeds that trigger more basic blocks in the second type of seed are higher; 3) the selection probability and mutation times of seeds with smaller distance values in the third type of seed are higher.

[0047] In the above adjustment, higher or lower selection probability and mutation times between seeds refer to the selection probability of a seed compared to the selection probability of another seed, and the mutation times of a seed compared to the mutation times of another seed, both of which satisfy the higher or lower value.

[0048] The system embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purposes of the present application according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0049] The system embodiments of the present application can be applied to any data processing device, which can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory for execution by the processor of the data processing device where it is located.

[0050] Based on the same inventive concept, a multi-target oriented parallel fuzzy testing method based on seed characteristics is proposed, and the main steps are:

[0051] 1) Divide the program of the software to be tested into a plurality of task basic block sets, wherein the task basic block set includes a plurality of continuously executed basic blocks; obtain a plurality of seeds for fuzzy testing, and input the seeds into the software to be tested in sequence; for each task basic block set, track and record the execution times of each basic block, i.e., the number of test cases triggering the basic block; and identify all explored basic blocks according to the execution times. The triggering of the basic block refers to the execution of the basic block, and the triggering times are the execution times of the basic block.

[0052] 2) After the task division is completed, the execution times of the basic blocks obtained in step 1) are used to evaluate the exploration difficulty of the basic blocks in each task basic block set; the basic block set with higher exploration difficulty is taken as a target set, and the distances from all explored basic blocks to the target set are calculated and recorded.

[0053] The step 2) includes:

[0054] 2.1) According to the execution times in step 2), the program basic blocks in each task basic block set are sorted to form an ascending arrangement; in this arrangement, the seed in the front represents higher triggering difficulty, and the seed in the back indicates lower triggering difficulty.

[0055] 2.2) According to the evaluation of the triggering difficulty of the basic blocks in the task, the first 30% of the task basic blocks with the highest difficulty are selected to form the target set; if the number of selected basic blocks is not an integer, it is rounded up to the nearest integer;

[0056] 2.3) For each explored basic block, calculate its distance to all basic blocks in the target set on the program control flow graph using Dijkstra algorithm, and take the minimum value of these distances as the shortest distance of this basic block to the target set.

[0057] 3) Distribute the task basic block set, the corresponding target set and the distance information to different test engines, and execute steps 4)-6) in parallel in each test engine;

[0058] 4) According to the characteristics of the task basic block set, the target set and the seed in the execution process, classify the seed. The classification includes: seeds that can trigger target basic blocks, seeds that can trigger other basic blocks in the task but fail to trigger target basic blocks, and seeds that neither trigger target basic blocks nor trigger other basic blocks in the task;

[0059] The step 4) includes:

[0060] 4.1) According to the basic block covered by each seed in the execution process, combine the task and target information to classify each seed to determine its specific type;

[0061] 4.2) For the seed set that neither triggers the task basic block nor the target basic block, calculate the minimum value of the distance from all basic blocks executed to the task as the seed distance.

[0062] 5) Initialize the selection probability and mutation times of all seeds; for different types of seeds in step 4), set the corresponding exploration optimization rules, for the first two types of seeds that can touch the basic blocks in the task area, the selection and mutation mechanism will be adjusted according to the triggering condition, and the seeds that can trigger the target basic block will be given greater tendency; for the seeds that fail to trigger the basic blocks in the task area, different selection probabilities and mutation times are assigned to them according to the distance information of the seeds, and the seeds with shorter distance to the target are preferentially processed. The distance of the seed is the minimum value of the distance from all basic blocks in the seed execution path to the target set. The seed execution path is all the basic blocks triggered by the seed in sequence after the seed inputs the software to be tested.

[0063] The step 5) includes:

[0064] 5.1) Initialize the selection probability and mutation times of all seeds; in this embodiment, the initial values of the selection probability and the mutation times are calculated by the fuzz testing tool according to the seed execution time, the seed file size and other influencing factors, and the fuzz testing tool is AFL+ +;

[0065] 5.1) Based on the ability of the seed to trigger the task basic block, adjust its selection probability and mutation times to achieve balanced exploration of the entire task area;

[0066] 5.2) For the seeds triggering the target set, increase their selection probability and mutation times, and preferentially explore the areas with higher difficulty;

[0067] 5.3) For the seed set which neither triggers the task basic block nor the target basic block, adjust their selection probability and mutation times according to the seed distance value, so that the seed with smaller distance value obtains higher selection probability and mutation times.

[0068] 6) Distribute each task basic block set to different test engines, and the test engine selects seeds from all seeds obtained in step 1) according to the selection probability of each seed, and mutates the selected seed according to the mutation times, and uses the mutated seed to perform the fuzzy test on the software to be tested, and repeats the step until the preset test time is reached.

[0069] The mutation of the selected seed according to the mutation times refers to mutating the selected seed in different mutation modes to obtain the same number of mutated seeds as the mutation times.

[0070] 7) Integrate the fuzzy test results of the original seeds in step 1) and the fuzzy test results of the mutated seeds used by each test engine in step 6).

[0071] Experiments show that, compared with other parallel fuzzy test tools, the fuzzy tester after applying the test case scheduling method and system of the present application has higher test efficiency. Under the same experimental settings, compared with the parallel mode of the fuzzy test tool AFL++, the present application has achieved a substantial improvement in commonly used fuzzy test performance indicators such as edge coverage and the number of discovered vulnerabilities. Among them, compared with the most widely used tool AFL++, for nine commonly used programs of various types, the present application has improved the program edge coverage indicator by an average of 21.45%, and the number of vulnerability mining has increased by 37.74%; compared with the default task exploration mode, the exploration proportion of difficult areas has increased by an average of 31.10%. Under the condition of allocating the same computing resources, the present application explores the program to be tested more fully.

[0072] The above-described embodiments only express several embodiments of the present application, and the description is more specific and detailed, but it cannot be understood as limiting the scope of the present patent. For ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application.

Claims

1. A multi-target oriented parallel fuzzing method based on seed characteristics, characterized in that, The method comprises the following steps: 1) dividing a program of the software to be tested into a plurality of task basic block sets; a plurality of seeds for fuzz testing are obtained, the seeds are input into the software to be tested in sequence for fuzz testing, and the cumulative triggering number of each task basic block in the task basic block set is tracked and recorded; the triggered basic block is recorded as an explored basic block; 2) evaluating the exploration difficulty of the task basic block according to the triggering number, selecting part of the task basic block with the highest exploration difficulty to form a target set corresponding to the current task basic block set; the distance of all the explored basic blocks to the target set is calculated to form distance information corresponding to the current task basic block set; the distance of the explored basic block to the target set is calculated in the following manner: a program control flow graph of the software to be tested is obtained, and the Dijkstra algorithm is used to calculate the shortest path between the explored basic block and each target basic block in the target set on the program control flow graph; the minimum value of the shortest paths between the explored basic block and all the target basic blocks is the distance of the explored basic block to the target set; 3) distributing the task basic block sets, the corresponding target sets and the distance information to different test engines, and performing steps 4)-6) in parallel in the test engines; 4) classifying the seeds into three categories according to the triggering of the task basic block and the target basic block by the seeds; the first category is seeds capable of triggering the target basic block, the second category is seeds capable of triggering the task basic block but failing to trigger the target basic block, and the third category is seeds neither triggering the target basic block nor the task basic block; 5) initializing the selection probability and the mutation number of all the seeds, and adjusting the selection probability and the mutation number of the seeds according to the classification and the distance information of the seeds; for the first category and the second category of seeds, the selection probability and the mutation number of the seeds are adjusted in the following manner: the selection probability and the mutation number of the first category of seeds are first increased; for the second category of seeds, the selection probability and the mutation number of the seeds are adjusted according to the number of the triggered basic blocks, so that the selection probability and the mutation number of the second category of seeds triggering more basic blocks are higher than those of the second category of seeds triggering less basic blocks, but the selection probability and the mutation number of the second category of seeds do not exceed those of any first category of seeds; for the third category of seeds, the selection probability and the mutation number of the seeds are adjusted in the following manner: the distance of all the basic blocks passed in the execution path of the third category of seeds is calculated based on the distance information obtained in step 3), and the minimum value of the calculated distances is the distance value of the seed; the selection probability and the mutation number of the third category of seeds are adjusted based on the distance value of the seed, so that the selection probability and the mutation number of the third category of seeds with smaller distance values are higher, but the selection probability and the mutation number of the third category of seeds do not exceed those of any second category of seeds; 6) selecting seeds from all the seeds obtained in step 1) according to the selection probability of the seeds, and performing mutation on the selected seeds according to the mutation number of the seeds, and then using the mutated seeds to perform fuzz testing on the software to be tested. 7) repeating step 6) until a preset test time is reached, outputting the fuzz test result of the original seed in step 1) and the fuzz test result of the mutated seed in step 6).

2. The multi-target oriented parallel fuzzing method based on seed characteristics according to claim 1, characterized in that, In step 1), the set of task basic blocks includes a plurality of continuously executed basic blocks.

3. The multi-target oriented parallel fuzzing method based on seed characteristics according to claim 1, characterized in that, In step 2), the specific method for evaluating the exploration difficulty of the task basic blocks according to the number of triggers is: For each task basic block in the set of task basic blocks, the task basic blocks in the current set are sorted in ascending order according to the number of triggers, and the task basic blocks sorted in the front are considered to have a higher exploration difficulty, and the task basic blocks sorted in the back are considered to have a lower exploration difficulty.

4. The multi-target oriented parallel fuzzing method based on seed characteristics according to claim 3, characterized in that, In step 2), the part of task basic blocks with the highest exploration difficulty are specifically the top 20%-40% of basic blocks with the highest trigger difficulty; if the number of the top 20%-40% of basic blocks does not constitute an integer, then it is rounded up to the nearest integer.

5. A fuzz testing system for implementing the multi-objective oriented parallel fuzz testing method based on seed characteristics according to claim 1, characterized in that, The system comprises: a program division module for dividing a program of the software to be tested into a plurality of sets of task basic blocks; a pre-exploration module for obtaining a seed, inputting the seed into the software to be tested for fuzz testing, tracking and recording the number of times each task basic block in the set of task basic blocks is triggered, outputting the explored basic blocks, and further recording a part of task basic blocks with a higher number of triggers as target basic blocks to form a target set for output; a distance calculation module for calculating the distance of all explored basic blocks to the target set as distance information for output; a task allocation module for allocating the set of task basic blocks, the target set, and the distance information to a corresponding test engine; a seed classification module for classifying the seeds into three categories according to the triggering of the seeds on the basic blocks; an optimization adjustment module for adjusting the selection probability and the number of mutations of the seeds according to the type of the seeds using specific scheduling rules; a test module for selecting and mutating the seeds according to the selection probability and the number of mutations of the seeds, and performing fuzz testing using the mutated seeds.

Images