Confrontation protection method and system of anti-fuzz testing technology under software operation situation

Abstract

The invention discloses an adversarial protection method and system of an anti-fuzzy test technology under a software operation situation, and belongs to the field of network security. The method comprises the following steps: obtaining a source code with a standard format; analyzing the source code, dividing the source code into a plurality of basic blocks, and determining important basic blocks; carrying out pile pitching operation on the important basic blocks; recording the triggering times of the important basic blocks, and judging whether the important basic blocks are abnormal or not according to the triggering times; and if the condition is abnormal, calling a confrontation technology. The method has the advantages that in the instrumentation process, all the basic blocks are not blindly subjected to instrumentation, the important basic blocks are subjected to instrumentation, whether a user is normal or not is judged according to the triggering condition of the important basic blocks, and resources are saved to a great extent; and the triggering condition of each important basic block can be recorded in real time during the software running period, and if malicious behaviors are identified, the confrontation technology can be quickly switched, so that the safety of the software is protected, and the loss of a user is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a countermeasure protection method and system for anti-fuzzy testing technology in a software running scenario. Background Art

[0002] With the rapid development of computer technology and Internet information technology, software security issues have become increasingly prominent. In particular, when various security vulnerabilities and high-risk zero-day vulnerabilities occur frequently, many manufacturers lack sufficient consideration for security when developing programs, resulting in potential risks being gradually exposed. Once these vulnerabilities are maliciously exploited by criminals, it may cause huge political and economic losses.

[0003] In recent years, fuzz testing technology has developed rapidly. It can analyze the behavior of software at runtime, identify security risks hidden in complex code structures, and provide repair suggestions, thereby significantly improving the security and reliability of the software.

[0004] However, these powerful technologies also have the risk of being abused by malicious users. Malicious users can use existing fuzz testing tools to actively find and exploit vulnerabilities in software to carry out attacks and sabotage activities. This not only threatens the security of software systems, but may also lead to serious consequences such as user privacy leakage, data loss, and system paralysis. Especially in the commercial and government fields, the losses caused by malicious exploitation of software vulnerabilities can be huge, not only causing economic losses, but also posing a threat to national security.

[0005] In the prior art, when performing security checks on software, the software is generally disabled first and then tested. This method will cause users to be unable to work for a period of time, affecting work efficiency; or the software is tested after the software program is finished running. This method may cause the software to be attacked by malicious behavior while it is running, causing losses to users.

[0006] Therefore, there is an urgent need to invent an adversarial protection system that can quickly detect malicious users during software operation and call adversarial technology to reduce user losses. Summary of the invention

[0007] The technical problem to be solved by the present invention is how to protect software security in a shorter time and with less computing power without stopping the software running.

[0008] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for countermeasure protection of anti-fuzz testing technology in a software running scenario, comprising the following steps:

[0009] Get source code in a standard format;

[0010] Analyze the source code, divide the source code into a plurality of basic blocks, and determine important basic blocks;

[0011] Perform instrumentation operations on important basic blocks;

[0012] Record the triggering times of important basic blocks and judge whether there is an abnormality based on the triggering times;

[0013] If it is an abnormal situation, the countermeasure technology is called.

[0014] Preferably, the step of obtaining a source code with a standardized format is specifically as follows: first, using automatic code format specification tools, including clang-format and uncrustify, based on the set format specification requirements, writing a format configuration file, formatting the software source code, and saving the source code after format standardization, overwriting the original code; using the automatic code format specification tool to automatically add code structure, including adding curly braces to loops and conditional statements, ensuring that the same statement is on the same line.

[0015] Preferably, the steps of determining the important basic blocks are as follows: the first step is to process each basic block from the outside to the inside according to the module-function-basicblock hierarchy; the second step is to number each basic block in the access order, and call the llvm method in the code to obtain the position of each basic block in the source code; the third step is to obtain the instruction set of each basic block, and determine whether the instruction set contains a conditional branch statement. If so, the current basic block is considered to be an important basic block.

[0016] Preferably, the process of performing the plugging operation on the important basic blocks is specifically as follows: using a Python script to number all the important basic blocks and their corresponding positions in the source code, storing them in a result file, and obtaining a dictionary of the number of each important basic block and its corresponding source code position; based on the dictionary, obtaining the source code position corresponding to each number in the order of the important basic block numbers from front to back, inserting the plugging code in the next line, and obtaining the plugged source code after the traversal is completed.

[0017] Preferably, the process of judging whether an abnormality occurs based on the number of trigger times is as follows: designing an algorithm to distinguish whether a user is a malicious user or a normal user (a user distinction algorithm based on data analysis); adding the code of the algorithm to the source code after the plug-in, and obtaining the source code after adding the distinction algorithm; the algorithm calculates the triggering number data of important basic blocks within a period of time, and then judges the status of the software user.

[0018] Preferably, the process of calling the adversarial technology is specifically as follows: reading the software user status information, including two information: the current status and the status duration, the current status is divided into two types: normal user and fuzz testing tool, the normal user is represented by 0, and the fuzz testing tool is represented by 1; the status duration indicates how long the current status is maintained; if the software user status is a fuzz testing tool and there is no status duration, indicating the first occurrence, then two adversarial technologies are enabled to resist the attack of the fuzz testing technology; if the software user status is a fuzz testing tool and the status duration is greater than a set threshold, automatically injecting forged error information or causing the program to crash, triggering a false crash signal to mislead the execution of the fuzz testing tool.

[0019] The present invention also provides a countermeasure protection system of anti-fuzzy testing technology in a software running scenario, including:

[0020] Source code acquisition module, used to obtain source code in a standardized format;

[0021] Determine an important basic block module, which is used to analyze the source code, divide the source code into a plurality of basic blocks, and determine the important basic blocks;

[0022] The instrumentation module is used to perform instrumentation operations on important basic blocks;

[0023] The software user status module is used to record the triggering times of important basic blocks and judge whether there is an abnormality based on the triggering times;

[0024] And a switching confrontation technology module is used to call confrontation technology under abnormal circumstances.

[0025] Preferably, the working steps for determining the important basic block module are as follows: the first step is to process each basic block from the outside to the inside according to the module-function-basicblock hierarchy; the second step is to number each basic block in the access order, and call the llvm method in the code to obtain the position of each basic block in the source code; the third step is to obtain the instruction set of each basic block, and determine whether the instruction set contains a conditional branch statement. If so, the current basic block is considered to be an important basic block.

[0026] Preferably, the working process of the module for distinguishing the status of software users is specifically as follows: designing an algorithm for distinguishing whether a user is a malicious user or a normal user; adding the code of the algorithm to the source code after the plug-in to obtain the source code after adding the distinguishing algorithm; the algorithm calculates the triggering number data of important basic blocks within a period of time, and then determines the status of the software user.

[0027] Preferably, the working process of the switching countermeasure technology module is specifically as follows: the step of calling the countermeasure technology: reading the software user status information, including two information: the current status and the status duration. The current status is divided into two types: normal user and fuzz testing tool. The normal user is represented by 0 and the fuzz testing tool is represented by 1; the status duration indicates how long the current status is maintained; if the software user status is a fuzz testing tool and there is no status duration, indicating the first appearance, then two countermeasure technologies are enabled to resist the attack of the fuzz testing technology; if the software user status is a fuzz testing tool and the status duration is greater than the set threshold, automatically inject forged error information or make the program crash, triggering a false crash signal to mislead the execution of the fuzz testing tool.

[0028] The advantages of the present invention are:

[0029] (1) Before instrumentation, the module for determining important basic blocks is used to determine whether a basic block is an important basic block, and then guides the subsequent automatic instrumentation at the source code level. Instead of blindly instrumenting all basic blocks, the user is judged to be normal by judging the triggering status of important basic blocks, which saves resources to a great extent.

[0030] (2) The present invention can record the triggering status of each important basic block in real time during the software operation, providing a reliable data basis for subsequent data analysis and user status judgment. If malicious behavior is identified, the anti-countermeasure technology can be quickly switched to protect the security of the software, saving the user's time and reducing the user's loss.

[0031] The present invention aims to develop a protection system against fuzzy testing technology in the context of software operation. Through the collaborative work of multiple modules, it prevents malicious users from using fuzzy testing technology to attack, thus providing comprehensive and effective security protection for the software system.

[0032] In summary, the anti-virus protection system of the present invention ensures the security of the software in the running scenario through effective technical means, prevents malicious users from using fuzz testing technology to attack, and provides comprehensive and effective security protection for the software system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of the architecture of the anti-fuzzy testing technology of the embodiment of the present invention;

[0034] Figure 2 A schematic diagram of the workflow of a source code acquisition module according to an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of a workflow for determining important basic block modules according to an embodiment of the present invention;

[0036] Figure 4 A schematic diagram of the working process of the plugging module according to an embodiment of the present invention;

[0037] Figure 5 A schematic diagram of the workflow of a module for distinguishing software user status according to an embodiment of the present invention;

[0038] Figure 6 The figure is a schematic diagram of the working process of the switching countermeasure technology module according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Example 1

[0041] like Figure 1 The anti-fuzz testing technology countermeasure protection method in the software running scenario includes the following steps:

[0042] Get source code in a standard format;

[0043] Analyze the source code, divide the source code into a plurality of basic blocks, and determine important basic blocks;

[0044] Perform instrumentation operations on important basic blocks;

[0045] Record the triggering times of important basic blocks and judge whether there is an abnormality based on the triggering times;

[0046] If it is an abnormal situation, the countermeasure technology is called.

[0047] The following are detailed descriptions of the above five steps:

[0048] The specific steps to obtain source code with standard format are as follows: first, use the automatic code format standardization tools, including clang-format and uncrustify, write the format configuration file based on the set format specification requirements, format the software source code, and save the formatted source code to overwrite the original code; use the automatic code format standardization tools to automatically add code structure, including adding curly braces to loops and conditional statements, and ensure that the same statement is on the same line.

[0049] The specific steps to determine important basic blocks are as follows: Step 1, process each basic block from the outside to the inside according to the module-function-basicblock hierarchy; Step 2, number each basic block in the access order, and call the llvm method in the code to obtain the location of each basic block in the source code, including information such as the number of rows and columns; Step 3, obtain the instruction set of each basic block, and determine whether the instruction set contains conditional branch statements. If so, the current basic block is considered to be an important basic block.

[0050] The specific process of inserting important basic blocks is as follows: use Python script to store the numbers of all important basic blocks and their corresponding positions in the source code, including the number of rows and columns, in the result file, and obtain a dictionary of the number of each important basic block and its corresponding source code position; based on the dictionary, obtain the source code position corresponding to each number in the order of the important basic block numbers from front to back, insert the insert code in the next line, and obtain the source code after inserting after the traversal is completed.

[0051] The process of judging whether there is an abnormality based on the number of trigger times is specifically as follows: designing an algorithm to distinguish whether the user is a malicious user or a normal user; adding the code of the algorithm to the source code after the plug-in to obtain the source code after adding the distinguishing algorithm; the algorithm calculates the triggering number data of important basic blocks within a period of time, and then judges the status of the software user.

[0052] The specific process of calling the adversarial technology is as follows: reading the software user status information, including two information: the current status and the status duration. The current status is divided into two types: normal user and fuzz testing tool. The normal user is represented by 0 and the fuzz testing tool is represented by 1; the status duration indicates how long the current status is maintained; if the software user status is a fuzz testing tool and there is no status duration, indicating the first appearance, then two adversarial technologies are enabled to resist the attack of the fuzz testing technology; if the software user status is a fuzz testing tool and the status duration is greater than the set threshold, automatically inject forged error information or make the program crash, triggering a false crash signal to mislead the execution of the fuzz testing tool.

[0053] The working principle of this embodiment is: first, obtain source code with a standard format, which is conducive to source code reading analysis and automatic source code instrumentation; further determine the important basic blocks, obtain the location information of the important basic blocks and the depth and breadth information in the data flow graph; then instrument the important basic blocks, and automatically add instructions to record the number of times each important basic block is triggered, which is convenient for subsequent data analysis; then distinguish the status of the software user based on data such as the number of times each important basic block is triggered within a period of time; call the countermeasure technology when it is judged to be an abnormal situation, and set different countermeasure technologies in a targeted manner according to the different status of the software user, taking into account the performance and effect of the system.

[0054] This embodiment avoids blindly inserting all basic blocks by inserting stubs for important basic blocks, and judges whether the user is normal by judging the triggering conditions of important basic blocks, thereby saving resources to a great extent. In addition, this embodiment can record the triggering conditions of each important basic block in real time during software operation, providing a reliable data basis for subsequent data analysis and user status judgment. If malicious behavior is identified, the anti-countermeasure technology can be quickly switched to protect the security of the software, which can save the user's time and reduce the user's loss.

[0055] Example 2

[0056] Figure 1 The schematic diagram of the architecture of the anti-fuzzy testing technology in the software running scenario provided by the embodiment of the present invention is as follows: Figure 1 As shown, the system comprises:

[0057] Source code acquisition module, used to obtain source code in a standardized format;

[0058] Determine an important basic block module, which is used to analyze the source code, divide the source code into a plurality of basic blocks, and determine the important basic blocks;

[0059] The instrumentation module is used to perform instrumentation operations on important basic blocks;

[0060] The software user status module is used to record the triggering times of important basic blocks and judge whether there is an abnormality based on the triggering times;

[0061] Switch the confrontation technology module to call the confrontation technology in abnormal situations.

[0062] The following is a detailed description of the workflow of the above modules:

[0063] like Figure 2As shown, it is a schematic diagram of the workflow of the source code acquisition module in an embodiment of the present invention. The source code acquisition module first uses the code automatic format specification tools, including clang-format and uncrustify, to write a format configuration file based on the set format specification requirements, format the software source code, and save the format-standardized source code to overwrite the original code; the code automatic format specification tool is used to automatically add code structures, including adding curly braces to loops and conditional statements, to ensure that the same statement is on the same line.

[0064] like Figure 3 As shown, it is a schematic diagram of the workflow for determining the important basic block module in an embodiment of the present invention. The first step of the important basic block module is to process each basic block from the outside to the inside according to the module-function-basicblock hierarchy; the second step is to number each basic block in the access order, and call the llvm method in the code to obtain the position of each basic block in the source code, including information such as the number of rows and columns; the third step is to obtain the instruction set of each basic block, and determine whether the instruction set contains a conditional branch statement. If so, the current basic block is considered to be an important basic block.

[0065] like Figure 4 As shown, it is a schematic diagram of the work flow of the plug-in module in an embodiment of the present invention. The plug-in module uses Python script to store the numbers of all important basic blocks and the corresponding positions in the source code, including the number of rows and columns, in the result file, and obtains a dictionary of the number of each important basic block and its corresponding source code position; based on the dictionary, according to the order of the important basic block numbers from front to back, the source code position corresponding to each number is obtained, and the plug-in code is inserted in the next line, and the source code after the traversal is completed is obtained.

[0066] like Figure 5 As shown, it is a schematic diagram of the workflow of the module for distinguishing the status of software users in an embodiment of the present invention. The module for distinguishing the status of software users designs an algorithm for distinguishing whether a user is a malicious user or a normal user; the code of the algorithm is added to the source code after the stub is inserted to obtain the source code after adding the distinguishing algorithm; the algorithm calculates the triggering number data of important basic blocks within a period of time, and then determines the status of the software user.

[0067] like Figure 6As shown, it is a schematic diagram of the workflow of the switching confrontation technology module of an embodiment of the present invention. The switching confrontation technology module reads the software user state information, including two information: the current state and the state duration. The current state is divided into two types: normal user and fuzz test tool. The normal user is represented by 0 and the fuzz test tool is represented by 1. The state duration indicates how long the current state is maintained. If the software user state is a fuzz test tool and there is no state duration, it is represented as the first appearance, and two confrontation technologies are enabled to resist the attack of the fuzz test technology. If the software user state is a fuzz test tool and the state duration is greater than the set threshold, a fake error message is automatically injected or the program is fake crashed, triggering a fake crash signal to mislead the execution of the fuzz test tool.

[0068] The working principle of this embodiment is: first, use the source code acquisition module to obtain source code with a standardized format, which is conducive to source code reading analysis and automatic source code instrumentation; further, by determining the important basic block module, obtain the location information of the important basic block and the depth and breadth information in the data flow graph; then, through the instrumentation module, automatically add instructions to record the number of times each important basic block is triggered, which is convenient for subsequent data analysis; then, through the software user status distinction module, according to the data such as the number of times each important basic block is triggered within a period of time, the status of the software user is judged; finally, through the switching confrontation technology module, according to the different software user states, different confrontation technology responses are set in a targeted manner, taking into account the performance and effect of the system.

[0069] The plug-in module of this embodiment only plugs in important basic blocks, avoiding blindly plugging in all basic blocks. It determines whether the user is normal by judging the triggering conditions of important basic blocks, thus saving resources to a great extent. In addition, this embodiment can record the triggering conditions of each important basic block in real time during software operation, providing a reliable data basis for subsequent data analysis and user status judgment. If malicious behavior is identified, the anti-countermeasure technology can be quickly switched to protect the security of the software, saving user time and reducing user losses.

[0070] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for countering and protecting against anti-fuzz testing technology in a software running scenario, characterized in that: The following steps are involved: Get source code in a standard format; Analyze the source code, divide the source code into a plurality of basic blocks, and determine important basic blocks; Perform instrumentation operations on important basic blocks; Record the triggering times of important basic blocks and judge whether there is an abnormality based on the triggering times; If it is an abnormal situation, the countermeasure technology is called.

2. The method for countering protection of anti-fuzzy testing technology in software running scenarios according to claim 1 is characterized in that: The steps of obtaining the source code with standard format are as follows: first, use the automatic code format standardization tools, including clang-format and uncrustify, write the format configuration file based on the set format specification requirements, format the software source code, and save the source code after format standardization, overwriting the original code; use the automatic code format standardization tool to automatically add code structure, including adding curly braces to loops and conditional statements, and ensure that the same statement is on the same line.

3. The method for countering protection of anti-fuzzy testing technology in software running scenarios according to claim 1, characterized in that: The steps of determining the important basic blocks are specifically as follows: the first step is to process each basic block from the outside to the inside according to the module-function-basicblock hierarchy; the second step is to number each basic block in the access order, and call the llvm method in the code to obtain the position of each basic block in the source code; the third step is to obtain the instruction set of each basic block, and determine whether the instruction set contains a conditional branch statement. If so, the current basic block is considered to be an important basic block.

4. The method for countering protection of anti-fuzzy testing technology in software running scenarios according to claim 3 is characterized in that: The process of performing the plugging operation on the important basic blocks is specifically as follows: using a Python script to store the numbers of all the important basic blocks and the corresponding positions in the source code in a result file, and obtaining a dictionary of the number of each important basic block and its corresponding source code position; Based on the dictionary, the source code position corresponding to each number is obtained in the order of important basic block numbers from front to back, and the stub code is inserted in the next line. After the traversal is completed, the source code after stub is obtained.

5. The method for countering protection of anti-fuzzy testing technology in software running context according to claim 1, characterized in that: The process of judging whether an abnormality is present according to the number of triggers is specifically as follows: designing an algorithm to distinguish whether a user is a malicious user or a normal user; adding the code of the algorithm to the source code after the stub is inserted, and obtaining the source code after the algorithm is added; The algorithm calculates the triggering times of important basic blocks within a period of time, and then determines the status of the software user.

6. The method for countermeasure protection of anti-fuzzy testing technology in software running scenarios according to any one of claims 1 to 5, characterized in that: The process of calling the countermeasure technology is specifically as follows: reading the software user status information, including two information, the current status and the status duration. The current status is divided into two types: normal user and fuzz test tool. The normal user is represented by 0 and the fuzz test tool is represented by 1. The status duration indicates how long the current status is maintained. If the software user status is a fuzz test tool and there is no status duration, two countermeasure technologies are enabled to resist the attack of the fuzz test technology. If the software user state is a fuzz testing tool and the state duration is greater than a set threshold, fake error information is automatically injected or the program is caused to crash falsely, triggering a false crash signal to mislead the execution of the fuzz testing tool.

7. A countermeasure protection system for anti-fuzz testing technology in a software running situation, characterized by: include: Source code acquisition module, used to obtain source code in a standardized format; Determine an important basic block module, which is used to analyze the source code, divide the source code into a plurality of basic blocks, and determine the important basic blocks; The instrumentation module is used to perform instrumentation operations on important basic blocks; The software user status module is used to record the triggering times of important basic blocks and judge whether there is an abnormality based on the triggering times; And a switching confrontation technology module is used to call confrontation technology under abnormal circumstances.

8. The anti-fuzzy testing technology countermeasure protection system in the software running situation according to claim 7 is characterized in that: The working steps of determining the important basic block module are specifically as follows: The steps of determining the important basic block: the first step is to process each basic block from the outside to the inside in the hierarchy of module-function-basicblock; The second step is to number each basic block in the order of access, and call the llvm method in the code to obtain the location of each basic block in the source code; the third step is to obtain the instruction set of each basic block and determine whether the instruction set contains conditional branch statements. If so, the current basic block is considered to be an important basic block.

9. The anti-fuzzy testing technology countermeasure protection system in the software running situation according to claim 7 is characterized in that: The working process of the software user status distinguishing module is specifically as follows: designing an algorithm to distinguish whether a user is a malicious user or a normal user; adding the code of the algorithm to the source code after the stub is inserted, and obtaining the source code after the distinguishing algorithm is added; The algorithm calculates the triggering times of important basic blocks within a period of time, and then determines the status of the software user.

10. The anti-fuzzy testing technology countermeasure protection system in the software running scenario according to claims 7 to 9 is characterized in that: The working process of the switching confrontation technology module is specifically as follows: the step of calling the confrontation technology: reading the software user status information, including two information of the current status and the status duration, the current status is divided into two types: normal user and fuzz test tool, the normal user is represented by 0, and the fuzz test tool is represented by 1; the status duration indicates how long the current status is maintained; if the software user status is a fuzz test tool and there is no status duration, then two confrontation technologies are enabled to resist the attack of the fuzz test technology; If the software user state is a fuzz testing tool and the state duration is greater than a set threshold, fake error information is automatically injected or the program is caused to crash falsely, triggering a false crash signal to mislead the execution of the fuzz testing tool.

Images