Stateful protocol fuzz testing method and system based on uncovered edges

Abstract

The present invention relates to a stateful protocol fuzz testing method based on uncovered edges, and the method comprises the following steps: S1: program preprocessing; S2: fuzz testing seeds; S3: state selection; S4: seed scheduling. The system comprises a test preparation module, a fuzz testing module, a state selection module, and a seed scheduling module. The present invention captures the allocation and use of enumeration type variables in the source code of the protocol entity program to be tested by static analysis. The present invention evaluates the potential benefits of a seed in different fuzzy states by analyzing the code block information not explored by the fuzzifier on the program control flow chart, and analyzes the state information triggered by the seed, so that the fuzzifier can select the state and seed that are easier to cover the new program branch, thereby maximizing the overall vulnerability detection efficiency of the fuzz testing system.

Description

Technical Field

[0001] The present invention belongs to the technical field of fuzzy testing, and in particular relates to a stateful protocol fuzzy testing method and system based on uncovered edges. Background Art

[0002] As the most popular automated software vulnerability mining technology, fuzz testing has been widely used in academia and industry, with the advantages of high automation, low energy consumption, and high computing resource utilization. However, when fuzzing stateful protocols, traditional protocol fuzzers will choose seeds with low benefits for the target state and invalid mutations for the seeds due to the lack of perception of unexplored areas and consideration of the value of candidate seeds in different states.

[0003] Coverage is an important indicator for most existing fuzz tests. Through program coverage information feedback, more effective seeds are retained, guiding fuzz testing to cover more code blocks. Existing stateful protocol fuzzers focus on seeds that cover new program branches as valid seeds, ignoring the information about which states and seeds are more likely to trigger unexplored areas. These fuzzers select seeds and states based on the historical coverage information of seeds and states, ignoring the ability of seeds and states to cover new program branches, which will make it difficult for the selected states and seeds to cover new areas. When a seed reaches different states, it is at different positions on the execution path and contributes differently to different states. Lack of judgment on this information will also affect the efficiency of fuzz testing.

[0004] The existing fuzz testing research based on stateful network protocols mainly includes the following papers:

[0005] 1. AFLNET: A Greybox Fuzzer for Network Protocols proposes a fuzz testing method for stateful protocols. AFLNET believes that the program that implements stateful network protocols is related to the context when processing received messages. Therefore, AFLNET believes that in the process of testing stateful network protocols, the state of the program under test should be considered. In order to improve the efficiency of fuzz testing, it is necessary to reach the target state first and fuzz the specified state. This method effectively solves the problem that stateless fuzzers such as AFL are difficult to reach the deep state of the program under test due to the mutation of unreliable messages when fuzzing stateful protocols. However, AFLNET follows the seed scheduling strategy of AFL and blindly selects seeds that trigger new paths when selecting seeds. It does not consider the potential of seeds to cover new program branches, the different benefits of a seed for different states, and the single mutation point of the seed, which will lead to the overall low efficiency of fuzz testing.

[0006] 2. Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis proposes to calculate the centrality of the code blocks covered by a seed based on the in-and-out degree of each code block in the control flow graph of the program under test, and estimate the probability of reaching unvisited edges based on the centrality. This method can effectively select a seed that can reach more code blocks. Not All Seeds Are Important: Fuzzing Guided by Untouched Edges calculates the uncovered adjacent edges on the execution path of a seed based on the control flow graph of the program, and evaluates the value of the seed as a whole, solving the problem that AFL preferentially selects seeds that can trigger new program branches, regardless of the ability of the seed to cover new program branches. These methods consider the benefits of a seed on the path in the control flow graph of the program under test, but they do not consider that in the fuzz testing of stateful protocols, the benefits brought by a seed in different states are different. The lack of state perception when evaluating the value of the seed will lead to low testing efficiency of the candidate seed in the target state.

[0007] In summary, the fuzz testing system for stateful protocols lacks awareness of the state when evaluating the value of seeds, which makes it difficult to select high-yield states and seeds for testing, affecting the overall efficiency of the stateful protocol fuzz testing system. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a stateful protocol fuzz testing method and system based on uncovered edges. By analyzing the code block information that has not been explored by the fuzzifier on the program control flow chart, the potential benefits of a seed when fuzzing different states are evaluated, and the state information triggered by the seed is analyzed, so that the fuzzifier can select states and seeds that are more likely to cover new program branches, thereby maximizing the overall vulnerability detection efficiency of the fuzz testing system.

[0009] The present invention provides a stateful protocol fuzzy testing method based on uncovered edges, comprising the following steps:

[0010] S1: Program preprocessing: statically analyze the program under test, build a program control flow chart, identify the transfer branches of the basic blocks of the program under test in the stub code, compile and insert the program under test, and initialize the fuzzer state and seed;

[0011] S2: Perform fuzz testing on the seed; divide the message sequence of the seed, mutate the message sequence of the seed and generate test cases, send the test cases to the program under test, save the seed that covers the new program branch, and analyze the response information and uncovered information of the seed;

[0012] S3: state selection: use the uncovered information of the state to calculate the state value, select the target state for fuzz testing based on the state value, and obtain the seed queue of the target state;

[0013] S4: Seed scheduling; select seeds from the seed queue of the target state, use the uncovered edges and execution time when the seeds reach the target state to calculate the seed value, and select seeds for fuzz testing based on the seed value.

[0014] Preferably, the step S1 specifically includes the following steps:

[0015] S1.1: Perform static analysis on the program under test; assign a block number to each code basic block, record the block number of the currently executed code block, build a program control flow chart, and check the successor code basic block of the code basic block, and record the XOR value of the successor code basic block number; use the stub compilation tool to insert the code for updating the coverage bitmap and the uncovered bitmap into the entry of the code basic block; the jump of the program under test from one code basic block to another is a program branch. When the seed triggers the program branch, the branch is a covered edge, and the adjacent untriggered program branch is an adjacent uncovered edge; generate a global coverage bitmap and a global uncovered bitmap. The global coverage bitmap records the covered edges on the seed execution path, and the global uncovered bitmap records the adjacent uncovered edges on the seed execution path; compile the program under test and generate the corresponding binary executable file;

[0016] S1.2: The fuzzer initializes the global coverage bitmap and the global uncovered bitmap, creates a shared memory, and associates the shared memory with the global coverage bitmap and the global uncovered bitmap;

[0017] S1.3: The fuzzer uses a subprocess to run the generated binary executable file and sets up pipes and shared memory. The fuzzer and subprocess use pipe communication to execute the program under test, read the initial seed file to generate seeds, send the seeds to the program under test, and build the initial state, seeds, and program branch coverage information.

[0018] Preferably, the step S1.1 further includes the following steps:

[0019] Determine whether there is a successor code block for the current code basic block. If there are two code basic blocks, query the code block number from the program control flow chart, calculate the XOR value of the successor code block number and store it in a global variable; when the current code block is triggered, calculate the uncovered edge index, and the uncovered edge index The calculation formula is as follows:

[0020] ,

[0021] in, Indicates the XOR value of the successor code block number of the current code block, Indicates jumping to the preceding code block number of the current code block. Represented as the exclusive OR operator;

[0022] Specifies the environment variable that stores the shared memory id. When the current program branch is triggered, the shared memory is accessed and the bitmap is not overwritten. The value under the index is increased by 1, and the coverage bitmap is updated;

[0023] Use afl-clang-fast / afl-clang-fast++ to compile and instrument the program under test and generate a binary executable file.

[0024] Preferably, the step S2 specifically includes the following steps:

[0025] S2.1: traverse the message sequence of the current seed and mark the message position that triggers the target state, generate a prefix message sequence that can make the program under test reach the target state, traverse the message sequence after the prefix message sequence, and use the message sequence of the trigger state as the infix message sequence for mutation. The remaining message sequences are suffix message sequences;

[0026] S2.2: Calculate the seed mutation energy. Traverse the seed message sequence and calculate the mutation energy based on the seed's ability to cover program branches, execution time, mutation rounds, and the number of uncovered edges when the target state is triggered. , the calculation formula is as follows:

[0027] ,

[0028] in, Indicates the number of program branches covered by the current seed and the average coverage branch ratio, Indicates the seed depth of the current seed. Indicates the number of uncovered edges contained when the current seed triggers the target state. Indicates the execution time of the seed;

[0029] S2.3: Allocate mutation times; allocate the total mutation times for the seed according to the mutation energy; traverse each prefix message sequence, and allocate mutation times according to the uncovered information value of the message when it reaches the target state, and the proportion of the uncovered information value of all prefix message sequences. , the calculation formula is as follows:

[0030] ,

[0031] in, Indicates the prefix message sequence The number of mutations assigned, Indicates the prefix message sequence The number of uncovered edges included, represents the number of mutations of the entire seed distribution, Represents the sum of the number of uncovered edges contained in all prefix message sequences;

[0032] S2.4: Apply mutation strategies to the seed infix message sequence, including bit flipping, bit addition and subtraction, and bit replacement, use the prefix message sequence, the mutated infix message sequence, and the suffix message sequence to form a test case, start the program under test, use the socket to send the test case to the program under test, and receive the response message;

[0033] S2.5: After the test case is sent and the response result is received, the coverage bitmap in the shared memory is read and analyzed. When a new program branch is covered, the test case is saved as a seed, and the branch is marked as covered in the global coverage bitmap, and the global coverage bitmap is updated;

[0034] S2.6: Analyze the response message of the seed, establish a triggered state queue and message structure for the seed, resend the current test case, record the uncovered bitmap when the response message is received after each message is sent, traverse the global uncovered bitmap and the global coverage bitmap and each bit of the global uncovered bitmap, record the index number of the program branch with less than 5 fuzzy times and no coverage on the global uncovered bitmap, and record the currently triggered state on the program branch in the global uncovered bitmap;

[0035] S2.7: traverse the state queue triggered by the seed, and add the seed to the seed queue of the triggered state;

[0036] S2.8: Update the optimal seed set for covering edges, traverse each program branch, combine the number of triggered states, seed execution time, and uncovered information, calculate the priority of the seed, and record the optimal seed covering the current program branch , the calculation formula is as follows:

[0037] ,

[0038] in, Indicates the number of states triggered by the seed, represents the number of uncovered edges contained in the seed, Indicates the execution time of the seed.

[0039] Preferably, the step S3 specifically includes the following steps:

[0040] S3.1: Traverse the states in the state pool and calculate the state value based on the number of fuzzy times of the current state, the number of test cases generated, and the fuzzy information of the uncovered edges included , the calculation formula is as follows:

[0041] ,

[0042] in, Indicates the number of seeds generated to cover the new path when the current state is blurred. Indicates that the index number of the current state is The number of blurs for uncovered edges, Indicates the number of test cases generated when the current state is fuzzy. Indicates the number of times the current state is selected;

[0043] S3.2: Select the state with the maximum value for fuzzification and modify the number of times the state is selected.

[0044] Preferably, the step S4 specifically includes the following steps:

[0045] S4.1: Calculate the seed value, traverse the optimal seed set covering the edge, and when the seed triggers the target state, mark it as a seed of interest, then traverse the seed queue of the target state and calculate the seed value , the calculation formula is as follows:

[0046] ,

[0047] in, Indicates the number of times the current seed triggers the target state, including the number of fuzzy edges that are not covered. Indicates the repeated selection cost of the current seed under the favor adjustment. When the seed is selected once, it can be offset once if it has a favor. Indicates the seed execution time;

[0048] S4.2: Select a seed, select the seed with the greatest value for fuzzy testing, and modify the number of fuzzy times of uncovered edges in the seed-triggered target state message.

[0049] A system for a stateful protocol fuzz testing method based on uncovered edges, comprising a test preparation module, a fuzz testing module, a state selection module, and a seed scheduling module;

[0050] Test preparation module: Use the stub compilation tool to perform static analysis on the program under test, calculate the index number of the adjacent uncovered program branch on the execution path, compile the target protocol entity stub to generate a binary executable program, allocate shared memory for the global coverage bitmap and the global uncovered bitmap, and record the coverage information and uncovered information of the execution path of the program under test; provide the initial seed, and send the initial seed to the program under test to build the initial state, seed and coverage information;

[0051] Fuzzy testing module: Analyze the state queue triggered by the seed, divide the prefix message sequence used to reach the target state, the infix message sequence used for mutation, and the remaining suffix message sequence, calculate the seed mutation energy and allocate the seed mutation times, calculate the mutation energy of each infix message sequence according to the uncovered information, and allocate the seed mutation times to each infix message sequence according to the mutation energy of each infix; apply the random mutation strategy to the infix message sequence, use the prefix message sequence, infix message sequence, and suffix message sequence to generate test cases, send the test cases to the program under test, analyze the test case coverage information, save the test cases that cover the new program branches, and resend the message of the seed to record the uncovered information of the seed when the state is triggered, analyze the uncovered information, add the seed to the seed queue of the triggered state, and complete this test;

[0052] State selection module: traverses the state pool and selects the state with the highest value for fuzzification based on the number of fuzzification times, uncovered information, and the number of seeds covering the new program branch;

[0053] Seed scheduling module: According to the selected target state, the seed with the highest seed value is selected from the seed queue of the target state for fuzzification.

[0054] The present invention has the following technical effects:

[0055] 1. The present invention calculates the adjacent uncovered program branches of the test case execution path based on the program control flow chart, and evaluates the exploration value of a state from the benefit of covering new program branches according to the uncovered program branch information in the triggered state, so that the fuzzifier selects a state with higher benefits. The value of the seed in different states is evaluated according to the uncovered information of the seed when the target state is triggered, and the seed that brings higher benefits to the target state is selected. In addition, the mutation energy is allocated to different mutation points that meet the fuzzy target state, and the mutation times of each mutation point are adjusted, so that the fuzzification of the target state is more efficient and it is easier to cover new program branches.

[0056] 2. The present invention effectively solves the problem that traditional stateful protocol fuzzers have a single dimension for measuring state value, and the problem that the selected seed benefit is inconsistent with the state during seed scheduling. The seed mutation of the present invention selects qualified mutation points on the preceding message sequence, and reallocates the number of mutations according to their benefits, thereby increasing the benefit of seed mutation, so that more program branches can be explored in the same time, thereby improving the efficiency of fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 The flowchart of the stateful protocol fuzzy testing method based on uncovered edges of the present invention.

[0058] Figure 2A schematic diagram of adjacent uncovered edges of the stateful protocol fuzzy testing method based on uncovered edges of the present invention.

[0059] Figure 3 This is a state selection flowchart of the stateful protocol fuzz testing method based on uncovered edges of the present invention.

[0060] Figure 4 This is a seed scheduling flowchart of the stateful protocol fuzz testing method based on uncovered edges of the present invention. DETAILED DESCRIPTION

[0061] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings.

[0062] like Figure 1 As shown, the stateful protocol fuzz testing method based on uncovered edges includes the following steps:

[0063] S1: Program preprocessing: statically analyze the program under test, build a program control flow chart, identify the transfer branches of the code blocks of the program under test, generate a global coverage bitmap and a global uncovered bitmap, compile and instrument the program under test, and initialize the fuzzer state and seed;

[0064] S1.1: Perform static analysis on the program under test; assign a block number to each code basic block, record the block number of the currently executed code block, build a program control flow chart, and check the successor code basic block of the code basic block, and record the XOR value of the successor code basic block number; use the stub compilation tool to insert the code that updates the coverage bitmap and the uncovered bitmap into the entry of the code basic block; the jump from one code basic block of the program under test to another code basic block is a program branch, when the seed triggers the program branch, the branch is a covered edge, and the adjacent untriggered program branch is an adjacent uncovered edge; generate a global coverage bitmap and a global uncovered bitmap, the global coverage bitmap records the covered edges on the seed execution path, and the global uncovered bitmap records the adjacent uncovered edges on the seed execution path; compile the program under test and generate the corresponding binary executable file;

[0065] Traverse the functions in the program module and build a program control flow graph based on the basic code blocks contained in the functions. Traverse the code basic blocks, generate a 32-bit random number for each code to assign a block number to the code basic block, and record the block number in the program control flow graph.

[0066] Determine whether there is a subsequent code block of the current code basic block. If there are two code basic blocks, query the code block number from the program control flow chart, calculate the XOR value of the subsequent code block number and store it in a global variable. When the current code block is triggered, such as Figure 2 As shown, the uncovered edge index is calculated for the code block. The calculation formula for the uncovered edge index is as follows:

[0067]

[0068] in is the XOR value of the code block number following the current code block. It is the code block number preceding the current code block. Represents the exclusive OR operator.

[0069] Specifies the environment variable that stores the shared memory id. When the current program branch is triggered, the shared memory is accessed and the bitmap is not overwritten. The value under the index is +1, updating the uncovered bitmap.

[0070] Use afl-clang-fast / afl-clang-fast++ to compile and instrument the program under test and generate a binary executable file.

[0071] S1.2: The fuzzer initializes the global coverage bitmap and the global uncovered bitmap, creates a shared memory, and associates the shared memory with the global coverage bitmap and the global uncovered bitmap; starts the fuzzer, the fuzzer reads the initial seeds from the seed folder and builds an initial seed set, and applies for two 64KB shared memories, which are used to record the program branches covered by the program under test and the adjacent uncovered program branches during the test. The fuzzer uses a child process to run the program under test, and communicates with the child process through a pipe to restart or kill the program under test, and obtains the process ID of the program under test, so that it can communicate with the program under test through a socket.

[0072] S1.3: The fuzzer uses a subprocess to run the generated binary executable file and sets up pipes and shared memory. The fuzzer and subprocess use pipe communication to execute the program under test, read the initial seed file to generate seeds, send the seeds to the program under test, and build the initial state, seeds, and program branch coverage information.

[0073] S2: Perform fuzzy testing on the seeds; divide the message sequence of the seeds, mutate the message sequence of the seeds and generate test cases, send the test cases to the program under test, save the seeds that cover the new program branches, and analyze the response information and uncovered information of the seeds; traverse the message sequence of the seeds, determine the prefix message sequence and mutation position according to the state of the message trigger, calculate the mutation energy and allocate the number of mutations, mutate the message sequence to generate test cases, send the test cases to the program under test, analyze the response information and coverage information, retain the test cases that cover the new program branches, and add the seeds to the seed queue in the triggered state.

[0074] S2.1: Traverse the message sequence of the current seed and mark the message position that triggers the target state, generate a prefix message sequence that can make the program under test reach the target state, traverse the message sequence after the prefix message sequence, and use the message sequence of the trigger state as an infix message sequence for mutation; according to the state triggered by the message, mark the message that triggers the target state, generate a prefix message sequence M1_Message that triggers the target state, continue to traverse the message after the prefix message sequence, and use the first trigger state message sequence as the infix message sequence M2_Message. Before sending the mutated message sequence to the server, send the prefix message sequence first to make the server reach the target state, thereby achieving fuzziness of the target state.

[0075] S2.2: Calculate the seed mutation energy. Traverse the seed message sequence and calculate the mutation energy based on the seed's ability to cover program branches, execution time, mutation rounds, and the number of uncovered edges when the target state is triggered. , the calculation formula is as follows:

[0076] ,

[0077] in, Indicates the number of program branches covered by the current seed and the average coverage branch ratio, Indicates the seed depth of the current seed. Indicates the number of uncovered edges contained when the current seed triggers the target state. Indicates the execution time of the seed;

[0078] The coverage branches and average coverage branch ratio of the seed indicate the priority of the seed's ability to cover program branches among all seeds. The seed depth indicates the time when the current seed was generated. The larger the value, the newer the seed. The number of uncovered edges of the target state triggered by the seed indicates the seed's ability to cover new program branches. The longer the seed execution time, the lower the fuzz testing efficiency.

[0079] S2.3: Allocate mutation times; allocate the total mutation times for the seed according to the mutation energy; traverse each prefix message sequence, and allocate mutation times according to the uncovered information value of the message when it reaches the target state, and the proportion of the uncovered information value of all prefix message sequences. , the calculation formula is as follows:

[0080] ,

[0081] in, Indicates the prefix message sequence The number of mutations assigned, Indicates the prefix message sequence The number of uncovered edges included, represents the number of mutations of the entire seed distribution, Represents the sum of the number of uncovered edges contained in all prefix message sequences.

[0082] Seeds with greater mutation energy should be assigned more mutation times. Since each message sequence that reaches the target state has different uncovered side information and different abilities to cover new program branches, the number of mutations is allocated based on the uncovered side information of each prefix message sequence. Message sequences that are easier to cover new program branches will get more mutation times.

[0083] S2.4: Apply mutation strategies to the seeds, including bit flipping, bit addition and subtraction, and bit replacement, generate test cases, start the program under test, send the test cases to the program under test using a socket, and receive response messages; select the infix message sequence of the seed and randomly apply the mutation strategy, combine the mutated infix message sequence and the corresponding prefix message sequence, as well as the suffix message sequence to form a test case, start the program under test, send the test case to the program under test, and when the number of mutations is used up, replace the next prefix message sequence for mutation.

[0084] S2.5: After the test case is sent and the response result is received, the coverage bitmap in the shared memory is read and analyzed. When a new program branch is covered, the test case is saved as a seed, and the branch is marked as covered in the global coverage bitmap, and the global coverage bitmap is updated;

[0085] S2.6: Analyze the response information of the seed, extract the return code of each response message in the response information, use the return code as the state, establish a triggered state queue and message structure for the seed, resend the current test case, record the uncovered bitmap when the response message is received after each message is sent, traverse the global uncovered bitmap and the global coverage bitmap and each bit of the global uncovered bitmap, record the index number of the program branch with less than 5 fuzzy times and no coverage on the global uncovered bitmap, and record the currently triggered state on the program branch in the global uncovered bitmap;

[0086] S2.7: traverse the state queue triggered by the seed, and add the seed to the seed queue of the triggered state;

[0087] S2.8: Update the optimal seed set for covering edges. The fuzzer maintains an optimal seed set for covering edges, and records the optimal seed for currently covering a certain edge. When a seed triggers more states and uncovers more edges, it should be selected with a high priority. However, since the number of fuzzy times has a greater impact on the seed value, the optimal seed set is used to adjust the seed value. Each program branch is traversed, and the priority of the seed is calculated based on the number of triggered states, seed execution time, and uncovered information. The optimal seed covering the current program branch is recorded. , the calculation formula is as follows:

[0088] ,

[0089] in, Indicates the number of states triggered by the seed, represents the number of uncovered edges contained in the seed, Indicates the execution time of the seed.

[0090] S3: state selection; calculate the state value and select the target state, such as Figure 3 shown.

[0091] S3.1: Traverse the states in the state pool and calculate the state value based on the number of fuzzy times of the current state, the number of test cases generated, and the fuzzy information of the uncovered edges included , the calculation formula is as follows:

[0092] ,

[0093] in, Indicates the number of seeds generated to cover the new path when the current state is blurred. Indicates that the index number of the current state is The number of blurs for uncovered edges, Indicates the number of test cases generated when the current state is fuzzy. Indicates the number of times the current state is selected;

[0094] The number of state fuzzification times indicates the number of times the current state is selected, and the test cases generated indicate how many test cases have been sent to the program under test when the current state is reached. These values ​​represent the fuzzification cost of the fuzzifier in the current state. The higher the cost, the less likely the state should be selected. The number of seeds covering new paths and uncovered information generated by the fuzzy state represent the benefits and potential benefits of the state to the fuzzifier. The higher the benefit, the more likely the state should be fuzzified.

[0095] S3.2: Select the state with the maximum value for fuzzification and modify the number of times the state is selected.

[0096] S4: Seed scheduling; traverse the seeds in the target state seed queue, calculate the seed value, and select the seed with the highest value for fuzz testing, such as Figure 4 shown.

[0097] S4.1: Calculate the seed value, traverse the optimal seed set covering the edge, and when the seed triggers the target state, mark it as a seed of interest, then traverse the seed queue of the target state and calculate the seed value , the calculation formula is as follows:

[0098] ,

[0099] in, Indicates the number of times the current seed triggers the target state, including the number of fuzzy edges that are not covered. Indicates the repeated selection cost of the current seed under the favor adjustment. When the seed is selected once, it can be offset once if it has a favor. Indicates the seed execution time;

[0100] The uncovered edge information when the seed triggers the target state indicates the ability of the seed to cover new program branches when it reaches the target state. The higher the ability to cover new program branches, the greater the seed value. The number of seed selections is the number of times the fuzzer selects the seed for fuzz testing. When the number of fuzzing times becomes higher, the selection of the seed should be reduced to leave the fuzzing opportunity to other seeds. The seed execution time is the time from sending the first message to the server to receiving the last response message of the test case that generates the seed. It is the time cost of the fuzzer to execute the seed. The higher the cost, the lower the value of the seed should be.

[0101] S4.2: Select a seed, select the seed with the greatest value for fuzzy testing, and modify the number of fuzzy times of uncovered edges in the seed-triggered target state message.

[0102] This embodiment performs instrumentation compilation on the target protocol entity program and extracts uncovered information on the execution path, which is effective for the target protocol entity program that provides source code. For this embodiment, experimental verification was carried out on the RTSP protocol and the DTLS protocol, where the control group selected the most advanced fuzzer AFLNET, where each group of tests lasted 12 hours. In order to reduce the impact of randomness in the fuzz test, all experiments were repeated three times and the results were averaged.

[0103] The experimental results are shown in Table 1 and Table 2 below:

[0104] Table 1

[0105] Target Protocol Number of ALNET covered branches This embodiment covers the number of branches Improvements of this embodiment compared to AFLNET RTSP 6055 6219 2.7% DTLS 1053 1091 3.6%

[0106] Table 2

[0107] Target Protocol ALNET new path seed number The number of new path seeds in this embodiment Improvements of this embodiment compared to AFLNET RTSP 712 763 7.1% DTLS 231 243 5.2%

[0108] As can be seen from Table 1 above, in the RTSP protocol, the number of branches covered by this embodiment is 164 more than that of ALNET, a relative increase of 2.7%, and the number of seeds for new paths found is 51 more, a relative increase of 7.1%; as can be seen from Table 2 above, in the DTLS protocol, the number of branches covered by this embodiment is 38 more than that of AFLNET, a relative increase of 3.6%, and the number of seeds for new paths found is 12 more, a relative increase of 5.2%; this embodiment has a significant improvement in the number of covered branches and seed effectiveness.

[0109] The embodiments described above are only descriptions of the preferred modes of the present invention, and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. A stateful protocol fuzz testing method based on uncovered edges, characterized in that: The steps include: S1: Program preprocessing: statically analyze the program under test, build a program control flow chart, identify the transfer branches of the basic blocks of the program under test in the stub code, compile and insert the program under test, and initialize the fuzzer state and seed; S2: Fuzz test the seed; Divide the message sequence of the seed, mutate the message sequence of the seed and generate test cases, send the test cases to the program under test, save the seeds that cover the new program branches, and analyze the response information and uncovered information of the seed; S3: state selection: use the uncovered information of the state to calculate the state value, select the target state for fuzz testing based on the state value, and obtain the seed queue of the target state; S4: Seed scheduling: select seeds from the seed queue of the target state, calculate the seed value using the uncovered edges and execution time when the seeds reach the target state, and select seeds for fuzz testing based on the seed value; The step S2 specifically includes the following steps: S2.1: traverse the message sequence of the current seed and mark the message position that triggers the target state, generate a prefix message sequence that can make the program under test reach the target state, traverse the message sequence after the prefix message sequence, and use the message sequence of the trigger state as the infix message sequence for mutation. The remaining message sequences are suffix message sequences; S2.2: Calculate the seed mutation energy. Traverse the seed message sequence and calculate the mutation energy based on the seed's ability to cover program branches, execution time, mutation rounds, and the number of uncovered edges when the target state is triggered. , the calculation formula is as follows: ， in, Indicates the number of program branches covered by the current seed and the average coverage branch ratio, Indicates the seed depth of the current seed. Indicates the number of uncovered edges contained when the current seed triggers the target state. Indicates the execution time of the seed; S2.3: Allocate mutation times; allocate the total mutation times for the seed according to the mutation energy; traverse each prefix message sequence, and allocate mutation times according to the uncovered information value of the message when it reaches the target state, and the proportion of the uncovered information value of all prefix message sequences. , the calculation formula is as follows: ， in, Indicates the prefix message sequence The number of mutations assigned, Indicates the prefix message sequence The number of uncovered edges included, represents the number of mutations of the entire seed distribution, Represents the sum of the number of uncovered edges contained in all prefix message sequences; S2.4: Apply mutation strategies to the seed infix message sequence, including bit flipping, bit addition and subtraction, and bit replacement, use the prefix message sequence, the mutated infix message sequence, and the suffix message sequence to form a test case, start the program under test, use the socket to send the test case to the program under test, and receive the response message; S2.5: After the test case is sent and the response result is received, the coverage bitmap in the shared memory is read and analyzed. When a new program branch is covered, the test case is saved as a seed, and the branch is marked as covered in the global coverage bitmap, and the global coverage bitmap is updated; S2.6: Analyze the response message of the seed, establish a triggered state queue and message structure for the seed, resend the current test case, record the uncovered bitmap when the response message is received after each message is sent, traverse the global uncovered bitmap and the global coverage bitmap and each bit of the global uncovered bitmap, record the index number of the program branch with less than 5 fuzzy times and no coverage on the global uncovered bitmap, and record the currently triggered state on the program branch in the global uncovered bitmap; S2.7: traverse the state queue triggered by the seed, and add the seed to the seed queue of the triggered state; S2.8: Update the optimal seed set for covering edges, traverse each program branch, combine the number of triggered states, seed execution time, and uncovered information, calculate the priority of the seed, and record the optimal seed covering the current program branch , the calculation formula is as follows: ， in, Indicates the number of states triggered by the seed, represents the number of uncovered edges contained in the seed, Indicates the execution time of the seed.

2. The stateful protocol fuzz testing method based on uncovered edges according to claim 1, characterized in that: The step S1 specifically includes the following steps: S1.1: Perform static analysis on the program under test; assign a block number to each code basic block, record the block number of the currently executed code block, build a program control flow chart, and check the subsequent code basic blocks of the code basic block, and record the XOR value of the subsequent code basic block number; The code for updating the coverage bitmap and the uncovered bitmap is inserted into the entry of the code basic block by using the instrumentation compilation tool; the jump of the tested program from one code basic block to another is a program branch. When the seed triggers the program branch, the branch is a covered edge, and the adjacent untriggered program branch is an adjacent uncovered edge; Generate a global coverage bitmap and a global uncovered bitmap, the global coverage bitmap records the covered edges on the seed execution path, and the global uncovered bitmap records the adjacent uncovered edges on the seed execution path; Compile the program under test and generate the corresponding binary executable file; S1.2: The fuzzer initializes the global coverage bitmap and the global uncovered bitmap, creates a shared memory, and associates the shared memory with the global coverage bitmap and the global uncovered bitmap; S1.3: The fuzzer uses a subprocess to run the generated binary executable file and sets up pipes and shared memory. The fuzzer and subprocess use pipe communication to execute the program under test, read the initial seed file to generate seeds, send the seeds to the program under test, and build the initial state, seeds, and program branch coverage information.

3. The stateful protocol fuzz testing method based on uncovered edges according to claim 2 is characterized in that: The step S1.1 specifically also includes the following steps: Determine whether the current code basic block has a successor code block. If there are two code basic blocks, query the code block number from the program control flow chart, calculate the XOR value of the successor code block number and store it in a global variable; When the current code block is triggered, the uncovered edge index is calculated. The calculation formula is as follows: ， in, Indicates the XOR value of the successor code block number of the current code block, Indicates jumping to the preceding code block number of the current code block. Represented as the exclusive OR operator; Specifies the environment variable that stores the shared memory id. When the current program branch is triggered, the shared memory is accessed and the bitmap is not overwritten. The value under the index is increased by 1, and the coverage bitmap is updated; Use afl-clang-fast / afl-clang-fast++ to compile and instrument the program under test and generate a binary executable file.

4. The stateful protocol fuzz testing method based on uncovered edges according to claim 1, characterized in that: The step S3 specifically includes the following steps: S3.1: Traverse the states in the state pool and calculate the state value based on the number of fuzzy times of the current state, the number of test cases generated, and the fuzzy information of the uncovered edges included , the calculation formula is as follows: ， in, Indicates the number of seeds generated to cover the new path when the current state is blurred. Indicates that the index number of the current state is The number of blurs for uncovered edges, Indicates the number of test cases generated when the current state is fuzzy. Indicates the number of times the current state is selected; S3.2: Select the state with the maximum value for fuzzification and modify the number of times the state is selected.

5. The stateful protocol fuzz testing method based on uncovered edges according to claim 1, characterized in that: The step S4 specifically includes the following steps: S4.1: Calculate the seed value, traverse the optimal seed set covering the edge, and when the seed triggers the target state, mark it as a seed of interest, then traverse the seed queue of the target state and calculate the seed value , the calculation formula is as follows: ， in, Indicates the number of times the current seed triggers the target state, including the number of uncovered edge fuzzies. Indicates the repeated selection cost of the current seed under the favor adjustment. When the seed is selected once, it can be offset once if it has a favor. Indicates the seed execution time; S4.2: Select a seed, select the seed with the greatest value for fuzzy testing, and modify the number of fuzzy times of uncovered edges in the seed-triggered target state message.

6. A system for the stateful protocol fuzz testing method based on uncovered edges according to claim 1, characterized in that: It includes test preparation module, fuzzy test module, state selection module and seed scheduling module; Test preparation module: Use the stub compilation tool to perform static analysis on the program under test, calculate the index numbers of adjacent uncovered program branches on the execution path, compile and insert the target protocol entity to generate a binary executable program, allocate shared memory for the global coverage bitmap and the global uncovered bitmap, and record the coverage information and uncovered information of the execution path of the program under test; Provide initial seeds, send the initial seeds to the program under test to build initial state, seeds and coverage information; Fuzz testing module: Analyze the state queue triggered by the seed, divide the prefix message sequence used to reach the target state, the infix message sequence used for mutation, and the remaining suffix message sequence, calculate the seed mutation energy and allocate the seed mutation times, calculate the mutation energy of each infix message sequence based on the uncovered information, and allocate the seed mutation times to each infix message sequence based on the mutation energy of each infix; Apply random mutation strategy to infix message sequence, use prefix message sequence, infix message sequence, and suffix message sequence to generate test cases, send the test cases to the program under test, analyze the test case coverage information, save the test cases that cover the new program branch, and resend the message of the seed to record the uncovered information of the seed in the triggered state, analyze the uncovered information, add the seed to the seed queue in the triggered state, and complete this test; State selection module: traverses the state pool and selects the state with the highest value for fuzzification based on the number of fuzzification times, uncovered information, and the number of seeds covering the new program branch; Seed scheduling module: According to the selected target state, the seed with the highest seed value is selected from the seed queue of the target state for fuzzification.

Images