Dynamic clustering fuzzing method and system based on efficient byte exploration

Abstract

This invention belongs to the field of general software fuzzing and discloses a dynamic clustering fuzzing method and system based on efficient byte exploration. The method uses a density-based spatial clustering algorithm to cluster seed bytes for fuzzing, identifying key byte positions and recording their effective mutation counts. Then, based on the clustering results and their effective mutation counts, bytes are assigned corresponding weights, and the energy allocation strategy is dynamically adjusted by combining path coverage and path novelty information to improve the efficiency of exploring new paths. For high-weighted bytes that generate effective seeds for new paths through mutation, their key byte positions are locked, and other positions are normalized before continuing mutation operations. The repeated execution of the above steps continuously optimizes the testing strategy, effectively improving the efficiency of fuzzing and vulnerability discovery capabilities.

Description

Technical Field

[0001] This invention belongs to the field of general software fuzzing, specifically relating to a dynamic clustering fuzzing method and system based on efficient byte exploration. Background Technology

[0002] As software complexity increases, hidden security vulnerabilities become increasingly difficult to detect. Traditional manual auditing and static analysis are inefficient and struggle to uncover complex vulnerabilities. Fuzz testing, by inputting random or mutated data into a program and continuously observing its execution results, can efficiently trigger abnormal behavior in the program under boundary conditions. Therefore, it plays an irreplaceable role in uncovering unknown vulnerabilities and improving software security.

[0003] Chinese patent CN115292206A discloses a software vulnerability detection method, apparatus, electronic device, and storage medium. Its vulnerability detection methods include symbolic execution or random mutation. By using these methods to perform fuzzing on the target code, the vulnerability detection method can be determined based on the path characteristics, achieving a combination of random mutation and symbolic execution. However, its fuzzing method relies on random mutation, lacks precise control over the mutation location of key byte segments, and easily generates a large amount of redundant input, resulting in low testing efficiency and hindering further discovery of complex vulnerabilities. Summary of the Invention

[0004] To overcome the shortcomings of existing technologies, this invention provides a dynamic clustering fuzzy testing method and system based on efficient byte exploration. It can identify the location of key bytes through clustering algorithms, dynamically adjust mutation strategies, and improve software testing efficiency and vulnerability discovery capabilities.

[0005] The above-mentioned objective of this invention is achieved through the following technical solution: The dynamic clustering fuzzy testing method based on efficient byte exploration includes the following steps: S1. By analyzing the mutation effect of fuzzy test seeds at different byte positions, and combining density-based spatial clustering algorithms, the DBSCAN algorithm is preferred to cluster similar bytes and record their effective mutation counts; S2. Assign corresponding weights based on the clustering information obtained in step S1 and the number of effective mutations; S3. Based on the weight information obtained in step S2, mutate the fuzzy test seed, and at the same time use path coverage and path novelty information to allocate energy to the seed to increase the probability of generating new paths.

[0006] S4. For the valid seeds of the new path generated in step S3, lock their key mutation positions, and after excluding these key mutation positions, normalize the remaining positions. Combine the byte weight information and energy allocation value obtained in steps S2 and S3, and continue to mutate other bytes to break through more complex or difficult-to-trigger code branches.

[0007] S5. When all seeds in the fuzzing queue have been tested, reset the weight information obtained in step S2 to zero to ensure that bytes that have been fully explored will not continue to occupy excessive weights; repeat steps S1 to S4 to continuously optimize and adjust the mutation strategy of fuzzing to achieve more efficient software fuzzing.

[0008] Clustering byte positions using a density-based spatial clustering algorithm identifies key byte locations that significantly impact software behavior. Therefore, during fuzzing, these key byte locations can be mutated more effectively, reducing the number of invalid tests and significantly improving testing efficiency. This method dynamically adjusts the mutation strategy, combining path coverage and path novelty information to gradually reduce focus on explored paths and prioritize exploring unexplored code paths. Through continuous iteration and optimization of the mutation strategy, it can gradually adapt to software changes, ensuring the continued effectiveness of fuzzing. As testing progresses, the weight of fully explored bytes gradually decreases to zero, avoiding over-focus on these bytes and ensuring the rational allocation of testing resources. By locking key mutation locations and normalizing the remaining locations, fuzzing can more effectively explore the software's code space, especially complex or difficult-to-trigger code branches, increasing the chance of discovering potential vulnerabilities and improving software security.

[0009] Furthermore, step 1 specifically includes: S1.1. Select any unvisited data point as the current point, using bytes as the unit. Center the current point and specify the density threshold MinPts. Then, use the radius... Form a neighborhood, calculate the number of points in the neighborhood, and if the number is greater than or equal to the specified minimum number of points MinPts, then the current point is the "core point"; S1.2. If the current point is a "core point", then all points in its neighborhood are grouped into the same cluster and these points are marked as visited; S1.3. For unvisited points in the neighborhood, continue to determine their core points, repeating steps S1.1 and S1.2 until all points have been processed and assigned to different clusters.

[0010] By forming neighborhoods byte-by-byte and selecting a density threshold MinPts and a radius, this method can accurately identify which byte positions are critical—that is, those bytes that can significantly affect software behavior or trigger specific code paths. This helps to more effectively target mutations during subsequent fuzzing. The core point determination and neighborhood point classification processes in steps S1.1 and S1.2 efficiently cluster similar bytes together, improving the stability and targeting of the mutation process and avoiding positional shifts and omissions of some critical positions caused by irregular mutations.

[0011] Furthermore, the number of points within the neighborhood is equal to the length of the fuzzy test seed before and after it. The number of times a mutation within a byte generates a new path.

[0012] Furthermore, the effective mutation count mentioned in step S2 is the number of times the fuzzy test seed generates a new path by mutating at the corresponding cluster position.

[0013] Furthermore, the formula for assigning corresponding weights based on clustering information and the number of effective mutations is as follows: in, The weights for variations in cluster positions; The effective number of mutations for each cluster; A smoothing term is introduced to ensure that all byte positions are assigned a minimum weight; The effective number of mutations at each mutation location includes the effective number of mutations at cluster locations and the effective number of mutations at non-cluster locations; This represents the total number of mutation locations.

[0014] Furthermore, the energy allocation formula for seeds using path coverage and path novelty information in step S3 is as follows: in: Distribute energy to the seeds; This is the path value triggered by the current fuzz test seed; For the novel path value that is triggered; The weight representing the path coverage of the current fuzz test seed; Weights representing path novelty

[0015] Furthermore, the weight of the path coverage of the current fuzz test seed. The calculation formula is as follows: The weight of path novelty The calculation formula is as follows: in This represents the path novelty weighting factor that changes over time, and it is adjusted using the Sigmoid algorithm.

[0016] This application also provides a dynamic clustering fuzzy testing system based on efficient byte exploration, wherein the method described includes: The data processing module is used to receive and process fuzz test seeds, cluster similar bytes, and record their effective mutation counts. The weight allocation module, connected to the data processing module, is used to allocate corresponding weights based on the clustering information and the number of effective mutations provided by the data processing module. The mutation and energy allocation module, connected to the weight allocation module, is used to mutate the fuzzy test seed based on the weight information provided by the weight allocation module, and to allocate energy to the seed using path coverage and path novelty information. The key mutation location locking and normalization module, connected to the mutation and energy allocation module, is used to lock the key mutation locations of the effective seeds for generating new paths, and normalize the remaining locations after excluding these key mutation locations. Based on the weight information and energy allocation value obtained from the weight allocation module and the mutation and energy allocation module, other bytes are mutated. The loop control module, connected to the data processing module, weight allocation module, mutation and energy allocation module, and key mutation location locking and normalization processing module, is used to control the loop execution of the entire testing process. That is, after all seeds in the fuzzy testing queue have been detected, the weight information obtained in the weight allocation module is reset to zero, and the data processing module is triggered to restart the execution of steps S1 to S4 until the test termination condition is met.

[0017] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on it, wherein the processor executes the program to implement the dynamic clustering fuzzy testing method based on efficient byte exploration.

[0018] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned dynamic clustering fuzzy testing method based on efficient byte exploration.

[0019] In summary, the beneficial effects of this invention compared to the prior art are: This application dynamically adjusts the mutation strategy through a clustering algorithm. Based on the mutation effects of different byte positions in the seed, it focuses on key bytes with greater potential to trigger new paths, thereby reducing redundant mutation operations and significantly improving testing efficiency. Furthermore, by dynamically allocating seed energy by combining path coverage and path novelty information, this application performs deeper mutation operations on seeds with high exploration value, ensuring that the potential of these seeds is fully explored during testing, thereby improving test coverage and increasing the probability of discovering new paths. Attached Figure Description

[0020] Figure 1 This is a flowchart of a dynamic clustering fuzzy testing method based on efficient byte exploration. Detailed Implementation

[0021] The technical solutions of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention. Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0022] Example 1 A dynamic clustering fuzzing testing method based on efficient byte exploration, such as Figure 1 As shown, the detailed implementation steps are as follows: S1, by analyzing the mutation effect of the fuzzy test seed at different byte positions, uses the density-based spatial clustering algorithm DBSCAN to cluster the byte positions. Similar byte positions are clustered together, and the effective mutation count for each position is recorded. This step is the basis for assigning weights to each byte position.

[0023] S2, based on the clustering information in step S1, assigns corresponding weights to each byte position according to the number of effective mutations in each cluster. This is achieved by introducing a smoothing term. This ensures that all byte positions receive a minimum weight, preventing some positions from having zero weight. Simultaneously, the seed is mutated based on this weight information to improve the exploration of potential effective paths.

[0024] S3 allocates energy to seeds based on path coverage and path novelty information to increase the probability of discovering new paths.

[0025] S4. For the new path seeds discovered in step S3, lock their key mutation positions. These locked byte positions will no longer participate in further mutation operations, while for the unlocked byte positions, mutation will continue according to the normalized weights to break through more complex or difficult-to-trigger paths.

[0026] S5: When all seeds in the fuzzing queue have been tested, the weight information obtained in stage S2 is reset to zero to ensure that bytes that have been fully explored will not continue to occupy too high a weight. Then the program returns to S1 and repeats the execution.

[0027] Example 2 A dynamic clustering fuzz testing system based on efficient byte exploration, using the method described in Example 1, includes: The data processing module is used to receive and process fuzz test seeds, and to perform the analysis of the mutation effect of fuzz test seeds at different byte positions in step S1. Combined with the density-based spatial clustering algorithm, similar bytes are clustered and their effective mutation counts are recorded. The weight allocation module, connected to the data processing module, is used to allocate corresponding weights based on the clustering information and the number of effective mutations provided by the data processing module, according to the following formula: in: The weights for variations in cluster positions; The effective number of mutations for each cluster, For the introduction of smoothing terms; The effective number of mutations at each mutation location includes the effective number of mutations at cluster locations and the effective number of mutations at non-cluster locations; This represents the total number of mutation locations.

[0028] The mutation and energy allocation module, connected to the weight allocation module, is used to mutate the fuzzy test seed based on the weight information provided by the weight allocation module, and to allocate energy to the seed using path coverage and path novelty information; the energy allocation is performed according to the following formula: in: Distribute energy to the seeds; This is the path value triggered by the current fuzz test seed; For the novel path value that is triggered; The weight representing the path coverage of the current fuzz test seed; Weights representing path novelty

[0029] The weights for path coverage and path novelty are determined according to the following formulas: The key mutation location locking and normalization module, connected to the mutation and energy allocation module, is used to lock the key mutation locations of the effective seeds for generating new paths, and normalize the remaining locations after excluding these key mutation locations. Based on the weight information and energy allocation value obtained from the weight allocation module and the mutation and energy allocation module, other bytes are mutated. The loop control module, connected to the data processing module, weight allocation module, mutation and energy allocation module, and key mutation location locking and normalization processing module, is used to control the loop execution of the entire testing process. That is, after all seeds in the fuzzy testing queue have been detected, the weight information obtained in the weight allocation module is reset to zero, and the data processing module is triggered to restart the execution of steps S1 to S4 until the test termination condition is met.

[0030] An electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and running on it, characterized in that the processor implements the dynamic clustering fuzzy testing method based on efficient byte exploration when executing the program.

[0031] A computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the aforementioned dynamic clustering fuzzy testing method based on efficient byte exploration.

[0032] Since this fuzzing test program employs all the technical solutions of all the foregoing embodiments when executed by the processor, it possesses at least all the beneficial effects brought about by all the technical solutions of all the foregoing embodiments, which will not be elaborated upon here.

[0033] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A dynamic clustering fuzzy testing method based on efficient byte exploration, characterized by the following steps: include: S1. By analyzing the mutation effect of fuzzy test seeds at different byte positions, and combining density-based spatial clustering algorithm, similar bytes are clustered and their effective mutation counts are recorded; S2. Assign corresponding weights based on the clustering information obtained in step S1 and the number of effective mutations; S3. Based on the weight information obtained in step S2, mutate the fuzzy test seed, and at the same time use the path coverage and path novelty information to allocate energy to the seed to increase the probability of generating new paths. S4. For the valid seeds of the new path generated in step S3, lock their key mutation positions, and after excluding these key mutation positions, normalize the remaining positions. Based on the weight information and energy allocation value obtained in steps S2 and S3, continue to mutate other bytes. S5. When all seeds in the fuzz test queue have been tested, reset the weight information obtained in step S2 to zero, and repeat steps S1 to S4.

2. The dynamic clustering fuzzy testing method based on efficient byte exploration according to claim 1, characterized in that, Step S1 specifically involves: S1.

1. Select any unvisited data point as the current point, using bytes as the unit. With the current point as the center, specify the minimum number of points, MinPts, and set the radius... Form a neighborhood, calculate the number of points in the neighborhood, and if the number is greater than or equal to the specified minimum number of points MinPts, then the current point is the "core point"; S1.

2. If the current point is a "core point", then all points in its neighborhood are grouped into the same cluster and these points are marked as visited; S1.

3. For unvisited points in the neighborhood, continue to determine their core points, repeating steps S1.1 and S1.2 until all points have been processed and assigned to different clusters.

3. The dynamic clustering fuzzy testing method based on efficient byte exploration according to claim 2, characterized in that, The number of points in the neighborhood is equal to the length of the fuzzy test seed before and after. The number of times a mutation within a byte generates a new path.

4. The dynamic clustering fuzzy testing method based on efficient byte exploration according to claim 1 or 2, characterized in that, The effective mutation count mentioned in step S2 is the number of times the fuzzy test seed generates a new path by mutating at the corresponding cluster position.

5. The dynamic clustering fuzzy testing method based on efficient byte exploration according to claim 4, characterized in that, Weights are assigned based on clustering information and the number of effective mutations, using the following formula: in: The weights for variations in cluster positions; The effective number of mutations at the cluster location. For the introduction of smoothing terms; The effective number of mutations at each mutation location includes the effective number of mutations at cluster locations and the effective number of mutations at non-cluster locations; This represents the total number of mutation locations.

6. The dynamic clustering fuzzy testing method based on efficient byte exploration according to claim 1, characterized in that, Step S3 involves allocating energy to the seed using path coverage and path novelty information, using the following specific formula: in: Distribute energy to the seeds; This is the path value triggered by the current fuzz test seed; For the novel path value that is triggered; The weight representing the path coverage of the current fuzz test seed; The weight representing the novelty of the path.

7. The dynamic clustering fuzzy testing method based on efficient byte exploration according to claim 6, characterized in that, The weight of the path coverage of the current fuzz test seed The calculation formula is as follows: The weight of path novelty The calculation formula is as follows: in This represents the path novelty weighting factor that changes over time, and it is adjusted using the Sigmoid algorithm.

8. A dynamic clustering fuzzy testing system based on efficient byte exploration, using the method described in any one of claims 1-7, characterized in that, include: The data processing module is used to receive and process fuzz test seeds, cluster similar bytes, and record their effective mutation counts. The weight allocation module, connected to the data processing module, is used to allocate corresponding weights based on the clustering information and the number of effective mutations provided by the data processing module. The mutation and energy allocation module, connected to the weight allocation module, is used to mutate the fuzzy test seed based on the weight information provided by the weight allocation module, and to allocate energy to the seed using path coverage and path novelty information. The key mutation location locking and normalization module, connected to the mutation and energy allocation module, is used to lock the key mutation locations of the effective seeds for generating new paths, and normalize the remaining locations after excluding these key mutation locations. Based on the weight information and energy allocation value obtained from the weight allocation module and the mutation and energy allocation module, other bytes are mutated. The loop control module, connected to the data processing module, weight allocation module, mutation and energy allocation module, and key mutation location locking and normalization processing module, is used to control the loop execution of the entire testing process. That is, after all seeds in the fuzzy testing queue have been detected, the weight information obtained in the weight allocation module is reset to zero, and the data processing module is triggered to restart the execution of steps S1 to S4 until the test termination condition is met.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and running thereon, characterized in that, When the processor executes the program, it implements the dynamic clustering fuzzy testing method based on efficient byte exploration as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the dynamic clustering fuzzy testing method based on efficient byte exploration as described in any one of claims 1-7.

Images