Network protocol fuzz testing system based on enhanced context information

Abstract

The invention relates to the technical field of software security detection, and particularly discloses a network protocol fuzz test system based on enhanced context information, comprising: an enhanced context information module used for acquiring state information and seed information, and performing instrumentation on enhanced context information through a track adjacent Call instruction; the state selection module is used for selecting a target state for fuzzy testing according to a LinUCB selection algorithm, and the LinUCB selection algorithm obtains the target state based on the context vector of the state and the reward; the seed selection module is used for selecting a target seed for fuzzy testing according to a ternary seed selection algorithm; according to the ternary seed selection algorithm, a seed label, execution information and session information are extracted from each seed in a seed pool to calculate a seed value, and then a target seed is obtained according to the seed value. According to the invention, the coverage rate of fuzzy testing can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software security detection, and in particular to a network protocol fuzzy testing system based on enhanced context information. Background Art

[0002] With the development of the Internet, network protocols play an important role in the Internet, ensuring the integrity, reliability and confidentiality of data in the communication process. However, as network protocols are widely used, programs that carry network protocols are gradually exposed. These vulnerabilities seriously threaten the security of data transmission. Therefore, in order to prevent vulnerabilities in network protocol programs, we urgently need a technical means to effectively mine such programs. Nowadays, network protocol fuzz testing has become a mainstream technical means. Thanks to its lightweight, convenient and efficient advantages, vulnerability mining can disclose effective program vulnerabilities without high labor costs.

[0003] The current mainstream network protocol fuzz testing system, AFLNET, decomposes test cases into message sequences and sends them to the service under test (SUT) through sockets in sequence. Subsequently, the state response code returned by the SUT is converted into a state sequence corresponding to the message sequence. Network protocol gray-box fuzz testing merges the state response codes in all state sequences into a state union, and the elements in the union and their associations constitute a state machine. Each state in the state machine maintains a seed pool containing all seeds that can reach the state. The state machine and the seed pool are updated online. Whenever an interesting test case is generated, the state machine and the seed pool corresponding to the state are learned and updated in real time. The difference between the stateful network protocol gray-box fuzzing system and the traditional gray-box fuzzing system is that it first selects a target state from the state machine and then selects seeds from the seed pool of the state. Then AFLNET mutation determines the infix message sequence in the target seed with the target state to generate new variants as test cases to continuously explore unknown branches of the SUT.

[0004] However, AFLNET has certain limitations in the process of state and seed selection, which are specifically manifested in the following aspects: 1) The original context information lacks indicators that can intuitively predict new branches. This lack limits the system's ability to identify potential new paths in a dynamic environment and reduces the overall test coverage. The lack of effective prediction indicators makes it difficult for AFLNET to prioritize states and seeds that may trigger new paths. 2) The exploration and utilization issues between states are not considered in the process of state selection. This deficiency may lead to excessive concentration on certain specific states during the exploration of the state space, ignoring other potentially valuable states, thereby affecting the comprehensiveness of the test. The lack of a mechanism to balance exploration and utilization may lead to the omission of critical paths and reduce the probability of discovering potential vulnerabilities. 3) The use of a single type of context information in the seed selection process leads to one-sided seed value. This single approach cannot make full use of diverse context information, limiting the effectiveness of seeds in triggering complex behaviors and boundary conditions. The one-sidedness of seed value may lead to insufficient test coverage and the inability to fully evaluate the robustness and security of the SUT in different scenarios. Summary of the invention

[0005] The purpose of the present invention is to provide a network protocol fuzzy testing system based on enhanced context information to solve the above technical problems.

[0006] The purpose of the present invention can be achieved by the following technical solutions: A network protocol fuzz testing system based on enhanced context information, including: An enhanced context information module is used to obtain state information and seed information, and enhance context information by inserting call instructions adjacent to the trace. The context information refers to various feedback data and runtime information obtained by the network protocol fuzz test system through continuous monitoring, collection and analysis of the behavior of the test program. The call instruction adjacent to the trace inserts the call instruction analysis code in the compilation phase of the network protocol program to obtain the number of call instructions adjacent to the execution trace when the program is running; A state selection module, configured to select a target state for fuzz testing according to a LinUCB selection algorithm, wherein the LinUCB selection algorithm derives the target state based on a context vector and a reward of the state; The seed selection module is used to select the target seed for fuzz testing according to the ternary seed selection algorithm; the ternary seed selection algorithm extracts the seed label, execution information and session information from each seed in the seed pool to calculate the seed value, and then obtains the target seed according to the seed value.

[0007] As a further solution of the present invention: in the enhanced context information module, The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional successor basic block Call instruction analysis code; the conditional successor basic block Call instruction analysis code includes a basic block number, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the maximum value of the basic block number; The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes; The successor-associated conditional basic block code includes the associated successor basic block number, the shared memory Succ_Map, and the number M of Call instructions for calling non-system functions and library functions in the associated successor basic block; the successor-associated conditional basic block code stores the number M in Cur_Map[m], where m represents the maximum value of the successor basic block number; The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

[0008] As a further solution of the present invention: the context vector of the state refers to evaluating the exploration value of the state from the state branch prediction, the seed generation capability of the state, the seed pool quality of the state, the state execution depth and the state association degree; The reward of the state is to give a reward score for the performance of the state in the fuzzy test, which is used to evaluate the utilization value of the state; the performance of the state is determined by the state transfer ability of the state in the fuzzy test and the number of state discovery paths.

[0009] As a further solution of the present invention: the state branch prediction PP refers to the ability of the state to find a unique path when the state is selected, and its calculation formula is: ; Among them, C p Indicates the number of unique paths found in the past for a state, N st Indicates the number of times a state is selected, max(C tac ) represents the maximum value of the number of adjacent Call instructions in the execution trace; The seed generation capacity SG of a state refers to the number of test cases that reach the state converted into seeds, and its calculation formula is: ; Among them, C p Indicates the number of unique paths found in the past for a state, N sIndicates the number of times the state is accessed during the fuzz testing process, N p The number of seeds in the seed pool under state; The seed pool quality SQ of a state represents the ability of the seeds in the seed pool to find a unique path, and its calculation formula is: ; Among them, C p represents the number of unique paths found in the past state, C tac Indicates the number of adjacent Call instructions in the execution trace, N p The number of seeds in the seed pool under state; The state execution depth ED represents the state depth inferred from the execution time during the execution of the SUT, and its calculation formula is: ; Among them, T ae represents the average time it takes to execute a seed once, T ape represents the average execution time of the seed prefix message sequence; The state association SA represents the number of state transitions and reflects the diversity of seeds in the state. Its calculation formula is: ; Among them, D i and D o represent the number of transitions from the other states to a state and the number of transitions from a state to the other states respectively; The context vector v of the state is constructed as follows: ; Where T represents the transpose of the matrix; The calculation formula for the reward is: ; Among them, r represents the reward of the state, δ represents the weight coefficient of the number of preferred paths or state transitions, and C tp Indicates the number of paths that trigger the test state, C op Indicates the number of paths that trigger other states, C tr Indicates the number of times the test state is triggered, C or Indicates the number of times other states are triggered; the test state refers to the next state triggered by the original seed that triggers the target state, and the other state refers to the next state of the target state triggered by the test case generated by the original seed and is not a test state.

[0010] As a further solution of the present invention: in the state selection module, the process of determining the target state specifically includes: Calculate the confidence upper bound for each state, and the calculation formula is: ; Among them, p s A represents the confidence upper bound when the state is s. s represents the covariance matrix when the state is s, b s represents the cumulative state reward vector when the state is s, v s represents the context vector when the state is s, α represents the weight factor of exploration, and T represents the transpose of the matrix; The state corresponding to the highest confidence upper bound is taken as the target state s t , and its calculation formula is: ; Among them, S represents the set of states; The covariance matrix A is initialized with a 5*5 identity matrix, and when the target state s t After being selected for testing, the context vector is used to calculate the updated covariance matrix A', which is calculated as: ; Indicates that the state is the target state s t The covariance matrix when Indicates that the state is the target state s t The context vector at time ; The cumulative state reward vector is initialized with a 5*1 zero vector, and when the target state s t After being selected for testing, the new cumulative state reward vector is calculated using the state reward and context vector , and its calculation formula is: ; in, Indicates that the state is the target state s t The cumulative state reward vector at time .

[0011] As a further solution of the present invention: the seed value is mainly exponentially calculated by using part of the execution information and the session information as the base and the seed label as the exponent, and decreases with the increase of resource consumption in the fuzzy test. The index of the seed value is determined based on whether the seed in the seed label is tested, whether it is liked, whether it is generated in the current state, and whether a new edge has been found; The base number of the seed value is determined based on the feedback information generated when the seed protocol program is executed and the information generated during the communication between the seed and the protocol program.

[0012] As a further solution of the present invention: in the seed selection module, the calculation formula of the seed value is: ; Among them, value represents the seed value, b represents the base of the seed value, p represents the exponent of the seed value, and ε represents the exponential weight for reducing the seed value. represents the mean execution time of all seeds in the seed pool, B lp 、N ss and T e They represent whether packets are lost during seed transmission, the number of seed selections, and the execution time of the seed. When packets are lost during seed transmission, B lp =1, when there is no packet loss during seed transmission, B lp =0; The calculation formula of the base number b of the seed value is: ; Among them, C tac Indicates the number of adjacent Call instructions in the execution trace, N e represents the number of edges in the execution trajectory of the seed, C h Indicates the number of state transition hits of the seed; is the average number of state transition hits of all seeds, is the average number of edges in the execution traces of all seeds; The calculation formula of the seed value index p is: ; Among them, the tag set composed of seed tags , li represents the i-th element in the tag set, n represents the total number of elements in the tag set, B cov , B fr , B sg , B pd indicates whether the seed has found a unique edge, whether the seed has a favorite path in the current fuzz test round, whether the seed is generated in the current state, and whether the candidate subsequence of the seed is used for fuzz testing. k is the number of labels in the label set. μ and β represent the minimum threshold and minimum index value of the label set respectively. When the seed has found a unique edge, then B cov = 1, when the seed has not found a unique edge, then B cov = 0; when the seed has a favorite path in the current fuzzing round, B fr = 1, when the seed does not have a favorite path in the current fuzzing round, B fr =0; when the seed is generated in the current state, B sg = 1, when the seed is not generated in the current state, B sg = 0; when the candidate subsequence of the seed is used for fuzz testing, B pd= 1; when the candidate subsequence of the seed is not used for fuzz testing, B pd =0.

[0013] Beneficial effects of the present invention: The present invention enhances the richness of context information by introducing the number of adjacent call instructions in the trajectory, and adopts the LinUCB state selection algorithm and the ternary feature seed selection algorithm to improve the coverage of fuzz testing. The state selection process uses the LinUCB state selection algorithm to solve the exploration and utilization problems between states, improving the effectiveness of the target state; the seed selection is based on the label, execution information and session information, comprehensively calculating the value of the seed and tapping the seed potential. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The present invention will be further described below in conjunction with the accompanying drawings.

[0015] Figure 1 It is a flow chart of a network protocol fuzzy testing system based on enhanced context information of the present invention; Figure 2 It is a schematic diagram of the process of extracting the number of adjacent Call instructions of a trajectory according to the present invention; Figure 3 It is a schematic diagram of the experimental results of the present invention testing the branch coverage of PureFTPD changing with time. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] See also Figure 1-2 As shown, the present invention is a network protocol fuzzy testing system based on enhanced context information, comprising: An enhanced context information module is used to obtain state information and seed information, and enhance context information by inserting call instructions adjacent to the trace. The context information refers to various feedback data and runtime information obtained by the network protocol fuzz test system through continuous monitoring, collection and analysis of the behavior of the test program. The call instruction adjacent to the trace inserts the call instruction analysis code in the compilation phase of the network protocol program to obtain the number of call instructions adjacent to the execution trace when the program is running; In a preferred embodiment of the present invention, in the enhanced context information module, The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional successor basic block Call instruction analysis code; the conditional successor basic block Call instruction analysis code includes a basic block number, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the maximum value of the basic block number; The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes; The successor-associated conditional basic block code includes the associated successor basic block number, the shared memory Succ_Map, and the number M of Call instructions for calling non-system functions and library functions in the associated successor basic block; the successor-associated conditional basic block code stores the number M in Cur_Map[m], where m represents the maximum value of the successor basic block number; The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

[0018] It should be noted that, first, the system will pre-test the external initial seeds and pass the test feedback information to the enhanced information module; The enhanced information module will process the feedback information and generate state information and seed information. Since the SUT has been instrumented in advance, the feedback information contains unprocessed runtime data. The enhanced information module will process these unprocessed runtime data and extract enhanced context information, which is mainly divided into two categories: state information and seed information. The information contained in the state information is not limited to the state information itself, such as the number of times the state is visited, the number of times the state is selected, etc., but also includes seed pool information under the state, such as the number of seeds in the seed pool. The seed information includes seed tags, seed execution information, and session information, etc., which are used to describe the characteristics of a single seed. The enhanced information module enhances the seed execution information and adds the number of adjacent Call instructions in the execution trace. The number of adjacent Call instructions in the execution trace is mainly extracted through the Call instruction instrumentation code; The Call instruction stub code is divided into a conditional basic block Call instruction stub code and a conditional successor basic block Call instruction stub code; the conditional successor basic block Call instruction stub code includes a basic block number n, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction stub code forms a "(n,N)" stub in order to store the number N in Cur_Map[n]; the conditional basic block Call instruction stub code is composed of a plurality of successor associated conditional basic block codes; the successor associated conditional basic block code includes an associated successor basic block number m, a shared memory Succ_Map, and the number M of Call instructions that call non-system functions and library functions in the associated successor basic block; the successor associated conditional basic block code forms a "[m,M]" stub in order to store the number M in Cur_Map[m]; the number of Call instructions adjacent to the execution trace is obtained by accumulating valuable elements in Succ_Map. The Succ_Map has a valuable element that has a non-zero value in a certain index and a zero value in the Cur_Map. After the stub is inserted in a certain protocol program, the control flow of the stub is partially inserted as follows Figure 2 As shown. Figure 2 In the example, when the execution trajectory is A->B->D->G, the corresponding shared memory Cur_Map and Succ_Map are updated in time. The system then analyzes the value of the shared memory and finds that the number of adjacent Call instructions in the execution trajectory A->B->D->G is 2 (Succ_Map[1] +Succ_Map[4]).

[0019] In another preferred embodiment of the present invention, the context vector of the state refers to evaluating the exploration value of the state from the state branch prediction, the seed generation capability of the state, the seed pool quality of the state, the state execution depth and the state association degree; The reward of the state is to give a reward score for the performance of the state in the fuzzy test, which is used to evaluate the utilization value of the state; the performance of the state is determined by the state transfer ability of the state in the fuzzy test and the number of state discovery paths; In a preferred case of this embodiment, the state branch prediction PP refers to the ability of the state to find a unique path when the state is selected, and its calculation formula is: ; Among them, C p Indicates the number of unique paths found in the past for a state, N st Indicates the number of times a state is selected, max(C tac ) represents the maximum value of the number of adjacent Call instructions in the execution trace; The seed generation capacity SG of a state refers to the number of test cases that reach the state converted into seeds, and its calculation formula is: ; Among them, C p Indicates the number of unique paths found in the past for a state, N s Indicates the number of times the state is accessed during the fuzz testing process, N p The number of seeds in the seed pool under state; The seed pool quality SQ of a state represents the ability of the seeds in the seed pool to find a unique path, and its calculation formula is: ; Among them, C p represents the number of unique paths found in the past state, C tac Indicates the number of adjacent Call instructions in the execution trace, N p The number of seeds in the seed pool under state; The state execution depth ED represents the state depth inferred from the execution time during the execution of the SUT, and its calculation formula is: ; Among them, T ae represents the average time it takes to execute a seed once, T ape represents the average execution time of the seed prefix message sequence; The state association SA represents the number of state transitions and reflects the diversity of seeds in the state. Its calculation formula is: ; Among them, D i and D o represent the number of transitions from the other states to a state and the number of transitions from a state to the other states respectively; The context vector v of the state is constructed as follows: ; Where T represents the transpose of the matrix; The calculation formula for the reward is: ; Among them, r represents the reward of the state, δ represents the weight coefficient of the number of preferred paths or state transitions, and C tp Indicates the number of paths that trigger the test state, C op Indicates the number of paths that trigger other states, C tr Indicates the number of times the test state is triggered, C orIndicates the number of times other states are triggered; the test state refers to the next state triggered by the original seed that triggers the target state, and the other state refers to the next state of the target state triggered by the test case generated by the original seed and is not a test state; It is worth noting that in the state selection module, the process of determining the target state specifically includes: Calculate the confidence upper bound for each state, and the calculation formula is: ; Among them, p s A represents the confidence upper bound when the state is s. s represents the covariance matrix when the state is s, b s represents the cumulative state reward vector when the state is s, v s represents the context vector when the state is s, α represents the weight factor of exploration, and T represents the transpose of the matrix; The state corresponding to the highest confidence upper bound is taken as the target state s t , and its calculation formula is: ; Among them, S represents the set of states; The covariance matrix A is initialized with a 5*5 identity matrix, and when the target state s t After being selected for testing, the context vector is used to calculate the updated covariance matrix A', which is calculated as: ; Indicates that the state is the target state s t The covariance matrix when Indicates that the state is the target state s t The context vector at time ; The cumulative state reward vector is initialized with a 5*1 zero vector, and when the target state s t After being selected for testing, the new cumulative state reward vector is calculated using the state reward and context vector , and its calculation formula is: ; in, Indicates that the state is the target state s t The cumulative state reward vector at time ; In a preferred embodiment of the present invention, in the enhanced context information module, The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional successor basic block Call instruction analysis code; the conditional successor basic block Call instruction analysis code includes a basic block number, a shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the maximum value of the basic block number; The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes; The successor-associated conditional basic block code includes the associated successor basic block number, the shared memory Succ_Map, and the number M of Call instructions for calling non-system functions and library functions in the associated successor basic block; the successor-associated conditional basic block code stores the number M in Cur_Map[m], where m represents the maximum value of the successor basic block number; The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

[0020] A state selection module, configured to select a target state for fuzz testing according to a LinUCB selection algorithm, wherein the LinUCB selection algorithm derives the target state based on a context vector and a reward of the state; The seed selection module is used to select the target seed for fuzz testing according to the ternary seed selection algorithm; the ternary seed selection algorithm extracts the seed label, execution information and session information from each seed in the seed pool to calculate the seed value, and then obtains the target seed according to the seed value.

[0021] In a preferred embodiment of the present invention, the seed value is mainly exponentially calculated by taking part of the execution information and the session information as the base and the seed label as the exponent, and decreases with the increase of resource consumption in the fuzzy test. The index of the seed value is determined based on whether the seed in the seed label is tested, whether it is liked, whether it is generated in the current state, and whether a new edge has been found; The base value of the seed is determined based on the feedback information generated during the execution of the seed protocol program and the information generated during the communication between the seed and the protocol program; In a preferred embodiment of this embodiment, in the seed selection module, the calculation formula of the seed value is: ; Among them, value represents the seed value, b represents the base of the seed value, p represents the exponent of the seed value, and ε represents the exponential weight for reducing the seed value. represents the mean execution time of all seeds in the seed pool, B lp 、N ss and T e They represent whether packets are lost during seed transmission, the number of seed selections, and the execution time of the seed. When packets are lost during seed transmission, B lp =1, when there is no packet loss during seed transmission, B lp =0; The calculation formula of the base number b of the seed value is: ; Among them, C tac Indicates the number of adjacent Call instructions in the execution trace, N e represents the number of edges in the execution trajectory of the seed, C h Indicates the number of state transition hits of the seed; is the average number of state transition hits of all seeds, is the average number of edges in the execution traces of all seeds; The calculation formula of the seed value index p is: ; Among them, the tag set composed of seed tags , li represents the i-th element in the tag set, n represents the total number of elements in the tag set, B cov , B fr , B sg , B pd indicates whether the seed has found a unique edge, whether the seed has a favorite path in the current fuzz test round, whether the seed is generated in the current state, and whether the candidate subsequence of the seed is used for fuzz testing. k is the number of labels in the label set. μ and β represent the minimum threshold and minimum index value of the label set respectively. When the seed has found a unique edge, then B cov = 1, when the seed has not found a unique edge, then B cov = 0; when the seed has a favorite path in the current fuzzing round, B fr = 1, when the seed does not have a favorite path in the current fuzzing round, B fr =0; when the seed is generated in the current state, B sg = 1, when the seed is not generated in the current state, B sg = 0; when the candidate subsequence of the seed is used for fuzz testing, B pd = 1; when the candidate subsequence of the seed is not used for fuzz testing, B pd =0.

[0022] It is worth noting that after all the target states and target seeds are selected, the system uses the target state to define the target seed's range of mutation for fuzz testing, and saves the interesting test cases after mutation. If the system is not finished, the feedback information of the new interesting test cases will be passed to the enhanced context information module, and then the state information and seed information will be updated for use by subsequent modules. Then a new round of fuzz testing will be started, and this cycle will continue until the user terminates the system.

[0023] See also Figure 3 As shown in Figure 1, the system tests the PureFTPD protocol program and compares it with the current first-class network protocol fuzz testing system AFLNET. The system and AFLNET conduct a 24-hour experiment on PureFTPD and repeat it 10 times, and the results are as follows: Figure 3 Experimental results of branch coverage over time. Figure 3 In this paper, the system is represented by caflnet, and its experimental results far exceed AFLNET.

[0024] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A network protocol fuzz testing system based on enhanced context information, characterized in that: include: An enhanced context information module is used to obtain state information and seed information, and enhance context information by inserting call instructions adjacent to the trace. The context information refers to various feedback data and runtime information obtained by the network protocol fuzz test system through continuous monitoring, collection and analysis of the behavior of the test program. The call instruction adjacent to the trace inserts the call instruction analysis code in the compilation phase of the network protocol program to obtain the number of call instructions adjacent to the execution trace when the program is running; A state selection module, configured to select a target state for fuzz testing according to a LinUCB selection algorithm, wherein the LinUCB selection algorithm derives the target state based on a context vector and a reward of the state; The seed selection module is used to select the target seed for fuzz testing according to the ternary seed selection algorithm; the ternary seed selection algorithm extracts the seed label, execution information and session information from each seed in the seed pool to calculate the seed value, and then obtains the target seed according to the seed value.

2. The network protocol fuzz testing system based on enhanced context information according to claim 1 is characterized in that: In the enhanced context information module, The Call instruction analysis code is divided into a conditional basic block Call instruction analysis code and a conditional successor basic block Call instruction analysis code; The conditional successor basic block Call instruction analysis code includes the basic block number, the shared memory Cur_Map, and the number N of Call instructions that call non-system functions and library functions in the basic block; the conditional successor basic block Call instruction analysis code stores the number N in Cur_Map[n], where n represents the maximum value of the basic block number; The conditional basic block Call instruction analysis code is composed of a plurality of subsequent associated conditional basic block codes; The successor-associated conditional basic block code includes the associated successor basic block number, the shared memory Succ_Map, and the number M of Call instructions for calling non-system functions and library functions in the associated successor basic block; the successor-associated conditional basic block code stores the number M in Cur_Map[m], where m represents the maximum value of the successor basic block number; The number of adjacent Call instructions in the execution trace is obtained by accumulating valuable elements in Succ_Map, and the valuable elements in Succ_Map have the characteristics that the element value in a certain index is not zero and the element value of the same index in Cur_Map is zero.

3. The network protocol fuzz testing system based on enhanced context information according to claim 1, characterized in that: The context vector of the state refers to evaluating the exploration value of the state from the state branch prediction, the seed generation capability of the state, the seed pool quality of the state, the state execution depth and the state association degree; The reward of the state is to give a reward score for the performance of the state in the fuzzy test, which is used to evaluate the utilization value of the state; the performance of the state is determined by the state transfer ability of the state in the fuzzy test and the number of state discovery paths.

4. The network protocol fuzz testing system based on enhanced context information according to claim 3 is characterized in that: State branch prediction PP refers to the ability of a state to find a unique path when the state is selected, and its calculation formula is: ； Among them, C p Indicates the number of unique paths found in the past for a state, N st Indicates the number of times a state is selected, max(C tac ) represents the maximum value of the number of adjacent Call instructions in the execution trace; The seed generation capacity SG of a state refers to the number of test cases that reach the state converted into seeds, and its calculation formula is: ； Among them, C p Indicates the number of unique paths found in the past for a state, N s Indicates the number of times the state is accessed during the fuzz testing process, N p The number of seeds in the seed pool under state; The seed pool quality SQ of a state represents the ability of the seeds in the seed pool to find a unique path, and its calculation formula is: ； Among them, C p represents the number of unique paths found in the past state, C tac Indicates the number of adjacent Call instructions in the execution trace, N p The number of seeds in the seed pool under state; The state execution depth ED represents the state depth inferred from the execution time during the execution of the SUT, and its calculation formula is: ； Among them, T ae represents the average time it takes to execute a seed once, T ape represents the average execution time of the seed prefix message sequence; The state association SA represents the number of state transitions and reflects the diversity of seeds in the state. Its calculation formula is: ； Among them, D i and D o represent the number of transitions from the other states to a state and the number of transitions from a state to the other states respectively; The context vector v of the state is constructed as follows: ； Where T represents the transpose of the matrix; The calculation formula for the reward is: ； Among them, r represents the reward of the state, δ represents the weight coefficient of the number of preferred paths or state transitions, and C tp Indicates the number of paths that trigger the test state, C op Indicates the number of paths that trigger other states, C tr Indicates the number of times the test state is triggered, C or Indicates the number of times other states are triggered; the test state refers to the next state triggered by the original seed that triggers the target state, and the other state refers to the next state of the target state triggered by the test case generated by the original seed and is not a test state.

5. The network protocol fuzz testing system based on enhanced context information according to claim 4 is characterized in that: In the state selection module, the process of determining the target state specifically includes: Calculate the confidence upper bound for each state, and the calculation formula is: ； Among them, p s A represents the confidence upper bound when the state is s. s represents the covariance matrix when the state is s, b s represents the cumulative state reward vector when the state is s, v s represents the context vector when the state is s, α represents the weight factor of exploration, and T represents the transpose of the matrix; The state corresponding to the highest confidence upper bound is taken as the target state s t , and its calculation formula is: ； Among them, S represents the set of states; The covariance matrix A is initialized with a 5*5 identity matrix, and when the target state s t After being selected for testing, the context vector is used to calculate the updated covariance matrix A', which is calculated as: ； Indicates that the state is the target state s t The covariance matrix when Indicates that the state is the target state s t The context vector at time ; The cumulative state reward vector is initialized with a 5*1 zero vector, and when the target state s t After being selected for testing, the new cumulative state reward vector is calculated using the state reward and context vector , and its calculation formula is: ； in, Indicates that the state is the target state s t The cumulative state reward vector at time .

6. The network protocol fuzz testing system based on enhanced context information according to claim 1, characterized in that: The seed value is mainly exponentially calculated with partial execution information and session information as the base and seed label as the exponent, and decreases with the increase of resource consumption in fuzz testing. The index of the seed value is determined based on whether the seed in the seed label has been tested, whether it is liked, whether it is generated in the current state, and whether new edges have been found; The base number of the seed value is determined based on the feedback information generated when the seed protocol program is executed and the information generated during the communication between the seed and the protocol program.

7. The network protocol fuzz testing system based on enhanced context information according to claim 6 is characterized in that: In the seed selection module, the calculation formula of the seed value is: ； Among them, value represents the seed value, b represents the base of the seed value, p represents the exponent of the seed value, and ε represents the exponential weight for reducing the seed value. represents the mean execution time of all seeds in the seed pool, B lp 、N ss and T e They represent whether packets are lost during seed transmission, the number of seed selections, and the execution time of the seed. When packets are lost during seed transmission, B lp =1, when there is no packet loss during seed transmission, B lp =0; The calculation formula of the base number b of the seed value is: ； Among them, C tac Indicates the number of adjacent Call instructions in the execution trace, N e represents the number of edges in the execution trajectory of the seed, C h Indicates the number of state transition hits of the seed; is the average number of state transition hits of all seeds, is the average number of edges in the execution traces of all seeds; The calculation formula of the seed value index p is: ； Among them, the tag set composed of seed tags , li represents the i-th element in the tag set, n represents the total number of elements in the tag set, B cov , B fr , B sg , B pd indicates whether the seed has found a unique edge, whether the seed has a favorite path in the current fuzz test round, whether the seed is generated in the current state, and whether the candidate subsequence of the seed is used for fuzz testing. k is the number of labels in the label set. μ and β represent the minimum threshold and minimum index value of the label set respectively. When the seed has found a unique edge, then B cov = 1, when the seed has not found a unique edge, then B cov = 0; when the seed has a favorite path in the current fuzzing round, B fr = 1, when the seed does not have a favorite path in the current fuzzing round, B fr =0; when the seed is generated in the current state, B sg = 1, when the seed is not generated in the current state, B sg = 0; when the candidate subsequence of the seed is used for fuzz testing, B pd = 1; when the candidate subsequence of the seed is not used for fuzz testing, B pd =0.

Images