Guided hybrid fuzz testing method and device and storage medium

Abstract

The invention provides a guiding hybrid fuzz testing method and device and a storage medium. The guiding hybrid fuzzy testing method comprises the following steps: screening input paths based on prefix paths of the input paths generated by fuzzy testing to obtain paths to be executed; determining a priority score of the to-be-executed path based on the prefix path of the to-be-executed path; and sequentially inputting the paths to be executed into a symbolic actuator based on the priority scores, and performing symbolic execution by utilizing the expanded symbolic execution constraint conditions to obtain a target input path. According to the guiding hybrid fuzz testing method and device and the storage medium, the path exploration efficiency is effectively improved through an input selection mechanism based on the prefix path, and the diversity of input generation is improved through the extended symbolic execution constraint condition, so that the probability of target code triggering is improved, and the hybrid fuzz testing efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software testing, and in particular to a guided hybrid fuzzy testing method, device and storage medium. Background Art

[0002] Software inevitably has defects, a considerable number of which are security vulnerabilities. Such vulnerable code has become a fundamental threat to software security. Software vulnerabilities can be discovered through automated software testing, such as fuzz testing and symbolic execution.

[0003] In order to improve code coverage, attempts are made to implement hybrid testing, combining fuzz testing with symbolic execution. The goal of hybrid testing is to use fuzz testing for path exploration and to resolve difficult-to-solve conditions through symbolic execution. In the hybrid approach, fuzz tests are usually run as many times as possible. When the progress of fuzz testing is slow, the hybrid controller switches to the symbolic executor and reruns the input generated by the fuzz testing. However, current hybrid fuzz testing methods still face the problem of low testing efficiency. Summary of the invention

[0004] The present invention provides a guided hybrid fuzzy testing method, device and storage medium, which are used to solve the technical problem of low efficiency of hybrid fuzzy testing in the prior art.

[0005] In a first aspect, the present invention provides a guided hybrid fuzz testing method, comprising the following steps.

[0006] Based on the prefix path of the input path generated by the fuzz test, the input path is screened to obtain a path to be executed; Determining a priority score of the path to be executed based on a prefix path of the path to be executed; Based on the priority score, the paths to be executed are sequentially input into the symbolic executor, and the symbolic execution is performed using the expanded symbolic execution constraint conditions to obtain the target input path.

[0007] In some embodiments, the prefix path of the input path generated based on the fuzzy test, filtering the input path to obtain the path to be executed, includes: Determine a basic block sequence in each input path that has a control dependency relationship with a target code location, and use the basic block sequence as a prefix path; The input paths with the same prefix path are deduplicated to obtain paths to be executed.

[0008] In some embodiments, determining the priority score of the path to be executed based on the prefix path of the path to be executed includes: Determining an initial priority of the path to be executed according to the length of a prefix path of the path to be executed; For the to-be-executed paths with the same initial priority, determining the rarity scores of the to-be-executed paths; The final priority score of each to-be-executed path is determined by the initial priority and the rarity score.

[0009] In some embodiments, determining the rarity score of the to-be-executed path includes: Determine the length of the common prefix path between the current to-be-executed path and the executed to-be-executed path; The rarity score of the current to-be-executed path is determined based on the length of the common prefix path.

[0010] In some embodiments, the method further comprises: Based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent path of the target branch path, the expanded symbolic execution constraints are obtained; the target branch path includes a control-dependent branch path and a data-dependent branch path.

[0011] In some embodiments, the obtaining of the expanded symbolic execution constraint condition based on the symbolic execution constraint condition of the target branch path and the symbolic execution constraint condition of the subsequent path of the target branch path includes: Negate the symbolic execution constraints of the target branch path; The symbolic execution constraint condition of the inverted target branch path is combined with the symbolic execution constraint condition of the subsequent path to obtain an expanded symbolic execution constraint condition.

[0012] In a second aspect, the present invention provides a guided hybrid fuzzy testing device, comprising the following modules.

[0013] A first acquisition module, configured to filter the input path based on a prefix path of the input path generated by the fuzzy test to obtain a path to be executed; A determination module, configured to determine a priority score of the path to be executed based on a prefix path of the path to be executed; The second acquisition module is used to input the to-be-executed paths into the symbolic executor in sequence based on the priority scores, and perform symbolic execution using the expanded symbolic execution constraints to obtain the target input path.

[0014] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements any one of the guided hybrid fuzz testing methods described above.

[0015] In a fourth aspect, a non-transitory computer-readable storage medium stores a computer program, which, when executed by a processor, implements any of the guided hybrid fuzz testing methods described above.

[0016] In a fifth aspect, the present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the guided hybrid fuzz testing method as described in any one of the above.

[0017] The guided hybrid fuzz testing method, device and storage medium provided by the present invention screen the input path based on the prefix path of the input path generated by the fuzz test to obtain the path to be executed; determine the priority score of the path to be executed based on the prefix path of the path to be executed; input the path to be executed into the symbolic executor in sequence based on the priority score, and perform symbolic execution using the extended symbolic execution constraint to obtain the target input path. The path exploration efficiency is effectively improved through the input selection mechanism based on the prefix path, and the diversity of input generation is improved through the extended symbolic execution constraint, thereby increasing the probability of target code triggering and improving the efficiency of hybrid fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is one of the flow charts of the guided hybrid fuzzy testing method provided by the present invention.

[0020] Figure 2 This is the second flow chart of the guided hybrid fuzzy testing method provided by the present invention.

[0021] Figure 3 It is a structural schematic diagram of the guided hybrid fuzzy testing device provided by the present invention.

[0022] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] The core goal of guided grey-box fuzz testing is to improve the efficiency and accuracy of testing by focusing resources on exploring the key areas of the program through guiding the fuzz testing process. As an early representative tool, the fuzz testing tool AFLGo adopts a guidance mechanism based on distance measurement. Specifically, it pre-calculates the static distance between the basic blocks in the program and the target area through compile-time instrumentation technology. At runtime, the input mutation energy is dynamically allocated based on the distance between the input execution path and the target, thereby focusing the test on the potential vulnerability area.

[0024] Based on AFLGo, subsequent research has proposed a variety of improvements. For example, the directed gray-box fuzz testing technologies Hawkeye and Lolly introduced path similarity metrics and key basic block distance calculation methods, respectively, to further improve the targetedness of test case generation. These methods optimize the input selection mechanism, allowing the fuzz testing process to prioritize the exploration of paths that are most likely to approach the target, thereby more efficiently discovering potential vulnerabilities.

[0025] Although guided gray-box fuzz testing has made progress in test efficiency and target guidance, its ability to handle complex path constraints is still insufficient. To solve this problem, hybrid fuzz testing came into being. Hybrid fuzz testing combines the breadth exploration of fuzz testing and the depth analysis capabilities of symbolic execution to expand test coverage and improve the ability to parse complex paths.

[0026] Driller, a typical hybrid fuzz testing tool, combines fuzz testing with symbolic execution through a coordination mechanism: when fuzz testing cannot generate new inputs, symbolic execution is initiated to solve path constraints and generate new test inputs. This mechanism effectively improves the ability to explore deep program states. Subsequent studies such as hybrid fuzz testing tools DigFuzz and SILK further optimized test coverage and efficiency by selecting low execution probability paths and complex constraint paths for symbolic execution, respectively.

[0027] Aiming at the respective limitations of guided grey-box fuzz testing and hybrid fuzz testing, the two technologies are combined, namely guided hybrid fuzz testing (or directed hybrid fuzz testing), which not only retains the breadth and depth advantages of hybrid fuzz testing, but also further improves the testing efficiency by introducing a goal-oriented mechanism. Directed hybrid fuzz testing further narrows the analysis scope by using the analysis target, thereby improving the guidance efficiency of the analysis method.

[0028] For example, the guided hybrid fuzz testing tool Berry combines sequence guidance strategy with symbolic execution technology to enable test cases to reach key locations in the program along a predetermined path, thereby accurately locating potential vulnerabilities. The guided hybrid fuzz testing tool LeoFuzz ​​uses an adaptive exploration and exploitation phase coordination mechanism to dynamically adjust the input energy scheduling strategy to improve multi-target coverage capabilities. The guided hybrid fuzz testing tool HyperGo proposes a measurement method based on path uncovered probability and distance, and improves test efficiency by pruning unreachable paths.

[0029] However, directed hybrid fuzz testing still faces the problem of low efficiency. How to more effectively integrate fuzz testing and symbolic execution to improve the efficiency of hybrid fuzz testing remains an important challenge.

[0030] In particular, there are two reasons that hinder the improvement of targeted hybrid fuzzing: First, current approaches fail to select appropriate inputs to drive symbolic executors.

[0031] For example, for the following code snippet 1: x =2, y =0; if(input1>0){ / / br 1 if(input2>1) x =1 / / br 2 if(input3>2) y =1 / / br 3 if(input4>3) / / br 4 if( x+y= =10) / / br 5 / / target; } For the four different inputs of this code snippet, namely I 1 (I 1 :1,2,3,4)、I 2 (I 2 :1,2,2,4)、I 3 (I 3 :1,1,2,4)、I 4 (I 4 : 1,2,3,3), obviously input I1 Ratio Input I 4 It is more suitable for starting symbolic analysis to generate new input. 4 Unable to pass the branch that the target depends on 4 , while I1 can. However, identifying the appropriate input is not an intuitive task. For example, it is not straightforward to determine whether I 1 ,I 2 ,I 3 and I 4 In addition, fuzz testing tends to be executed on a large number of inputs, so efficiently selecting inputs from this large pool of inputs poses a major challenge.

[0032] Second, current approaches do not fully utilize the constraint generation capabilities of symbolic executors.

[0033] For example, when using input I 3 When performing symbolic analysis, the symbolic executor generates a new input based on the constraint Br1 ∧ ¬ Br2 ∧ Br3 of the prefix path. However, it directly ignores the information in the suffix path. In fact, the suffix path clearly shows that Br4 and Br5 are True is a necessary condition to cover the target of line 7 of the above code snippet. This information can be further used to guide the generation of inputs that are more likely to cover the target. How to effectively use the information in symbolic execution to construct more effective input constraints is the second challenge.

[0034] Based on the above technical problems, the present invention proposes a hybrid fuzz testing method, which screens the input path based on the prefix path of the input path generated by the fuzz test to obtain the path to be executed; determines the priority score of the path to be executed based on the prefix path of the path to be executed; inputs the path to be executed into the symbolic executor in sequence based on the priority score, and performs symbolic execution using the extended symbolic execution constraint to obtain the target input path. The path exploration efficiency is effectively improved through the input selection mechanism based on the prefix path, and the diversity of input generation is improved through the extended symbolic execution constraint, thereby increasing the probability of target code triggering and improving the efficiency of hybrid fuzz testing.

[0035] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Figure 1This is one of the flow charts of the guided hybrid fuzzy testing method provided by the present invention, such as Figure 1 As shown, the present invention provides a guided hybrid fuzzy testing method. The method comprises: Step 101: Based on the prefix path of the input path generated by the fuzzy test, the input path is screened to obtain a path to be executed.

[0037] Specifically, multiple input paths generated by fuzz testing are obtained, which cover a variety of paths, but not all paths have the potential to trigger specific target codes. The input paths are filtered based on the prefix paths of the input paths, and inputs with higher exploration value are filtered out to obtain the paths to be executed.

[0038] In the embodiment of the present application, the prefix path refers to the basic block sequence in the input path that has a control dependency relationship with the target code position. It reflects the trajectory of the input in the execution path and its potential relevance to the target code by tracking the key control dependency branch basic blocks involved in the input path.

[0039] Step 102: Determine the priority score of the path to be executed based on the prefix path of the path to be executed.

[0040] Specifically, since there is a higher probability of generating valid inputs on path prefixes with lower exploration, as only a small number of existing inputs can cover these paths, in contrast, fully explored path prefixes have lower coverage value. To achieve efficient input selection, a novel quantization method is proposed to evaluate the priority score of each to-be-executed path, thereby guiding the to-be-executed paths to the symbolic execution stage according to the priority score, so as to increase the probability of triggering the target code in deeper paths.

[0041] Step 103: input the to-be-executed paths into the symbolic executor in sequence according to the priority scores, and perform symbolic execution using the expanded symbolic execution constraints to obtain a target input path.

[0042] Specifically, the paths to be executed are input into the symbolic executor in sequence according to the priority scores. In the symbolic execution stage, in order to generate more efficient goal-oriented input through symbolic execution, the symbolic execution constraints are expanded, and symbolic execution is performed using the expanded symbolic execution constraints to obtain higher quality seeds, i.e., the target input path.

[0043] The guided hybrid fuzz testing method provided in the embodiment of the present application can screen out more unique and incompletely explored paths based on prefix sequences, and guide the paths to be executed to the symbolic executor according to priority scores, thereby improving the path exploration efficiency in the dynamic symbolic execution (Concolic Execution) stage; by expanding the symbolic execution constraints, more potential paths can be discovered, thereby improving the breadth of path exploration.

[0044] In some embodiments, the prefix path of the input path generated based on the fuzzy test, filtering the input path to obtain the path to be executed, includes: Determine a basic block sequence in each input path that has a control dependency relationship with a target code location, and use the basic block sequence as a prefix path; The input paths with the same prefix path are deduplicated to obtain paths to be executed.

[0045] Specifically, a basic block sequence having a control dependency relationship with a target code position in an input path, ie, a prefix path or a prefix sequence, is obtained.

[0046] During the execution of fuzz testing, the input control dependency basic block sequence can be dynamically recorded through instrumentation, the prefix path can be obtained, and stored for subsequent input screening.

[0047] Since most of the inputs generated in the fuzz testing phase have the same prefix sequence, after obtaining the prefix path, the input paths can be screened based on the common prefix path. Specifically, the input paths with the same prefix path are deduplicated to obtain the path to be executed.

[0048] In order to optimize the efficiency of computing resource usage, the input path of the first appearing unique prefix sequence is recorded, and the input paths of exactly the same prefix sequence are deduplicated to exclude redundant paths in the symbolic execution stage.

[0049] The guided hybrid fuzz testing method provided in the embodiment of the present application reduces unnecessary repeated calculations by deduplicating input paths with the same prefix path, avoids repeated exploration of covered paths, and thus focuses symbolic execution on the exploration of potential new paths, thereby increasing the probability of detecting uncovered paths and improving the efficiency of hybrid fuzz testing.

[0050] In some embodiments, determining the priority score of the path to be executed based on the prefix path of the path to be executed includes: Determining an initial priority of the path to be executed according to the length of a prefix path of the path to be executed; For the to-be-executed paths with the same initial priority, determining the rarity scores of the to-be-executed paths; The final priority score of each to-be-executed path is determined by the initial priority and the rarity score.

[0051] Specifically, in the input selection process, the longer the control dependency sequence of the input, the more likely it is that the input has explored a deeper path and is closer to the target code location. Therefore, the initial priority of the path to be executed can be determined based on the length of the prefix path of the path to be executed (i.e., the prefix sequence length), so that the path to be executed with a longer prefix sequence is preferentially selected, which helps to generate inputs that reach the target location through symbolic execution. In addition, a longer prefix sequence means that the input may have covered more control dependency branches, a feature that increases the chances of triggering the target code or discovering new paths. By prioritizing on the prefix sequence length, the path exploration efficiency in the symbolic execution stage can be significantly improved, while avoiding the calculation of low-potential paths, thereby focusing on in-depth exploration of uncovered paths.

[0052] When the prefix sequence lengths are the same, that is, the initial priorities are the same, the uniqueness of the path to be executed is further evaluated by the rarity score.

[0053] The final priority score of each path to be executed is determined by combining the initial priority and rarity score of the path to be executed. The formula for the priority score is: Priority Rating = × prefix sequence length + ×Rarity Rating in, and are weight coefficients controlling the prefix sequence length and rarity score, respectively. By adjusting these two weights, we can flexibly select inputs with higher priority scores to cover more unique paths.

[0054] The guided hybrid fuzz testing method provided in the embodiment of the present application determines the initial priority of the path to be executed according to the length of the prefix path of the path to be executed. When the length of the prefix sequence is the same, the uniqueness of the path to be executed is further evaluated by the rarity score, which helps to avoid repeated calculation of the explored area and improve the detection efficiency of the uncovered path, thereby effectively expanding the path diversity and improving the triggering probability of the target code in the symbolic execution stage.

[0055] In some embodiments, determining the rarity score of the to-be-executed path includes: Determine the length of the common prefix path between the current path to be executed and the executed path; The rarity score of the current to-be-executed path is determined based on the length of the common prefix path.

[0056] Specifically, the executed path refers to the input path that has completed execution in the input symbolic executor.

[0057] The calculation of the rarity score first requires determining the length of the common prefix path. Compare the prefix path of the current path to be executed with one or more paths that have been executed, and identify the number of common basic blocks in its prefix path with the executed path (i.e., the length of the common prefix path or the length of the common prefix sequence). A shorter common prefix sequence generally indicates that the current path to be executed has less overlap with the executed path, thus having a higher path uniqueness.

[0058] The rarity of a path is measured by the length and variance of the common prefix sequence, as follows: in, It is a tuning parameter to control the relative weight of the average common prefix sequence length and variance. The variance is calculated based on the common prefix sequence length of the current path to be executed and each executed path. A short average common prefix sequence length and a large variance mean that the current path has a higher uniqueness in the uncovered area, thereby increasing its potential to explore new paths.

[0059] Dynamically adjust the rarity score based on the update of the executed path: Whenever the path to be executed is selected and executed, the prefix information of the current path to be executed is added to the executed path pool so that it can participate in the statistics of the common prefix sequence in the next round of input selection. Specifically, the rarity score is updated by comparing the prefix sequence in the executed path pool before each selection, thereby dynamically reflecting the difference between the input to be selected and the explored path. This method prioritizes inputs with higher rarity scores, that is, more "unique" paths, further increasing the probability of exploring new paths and avoiding repeated exploration of redundant paths.

[0060] The guided hybrid fuzz testing method provided in the embodiment of the present application screens inputs with unique path characteristics through rarity scoring, and preferentially guides them to the symbolic execution stage, so as to increase the probability of triggering the target code in deeper paths.

[0061] In some embodiments, the method further comprises: Based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent path of the target branch path, the expanded symbolic execution constraints are obtained; the target branch path includes a control-dependent branch path and a data-dependent branch path.

[0062] Specifically, in the traditional dynamic symbolic execution process, seed generation mainly depends on the current path execution information, saving the symbolic execution constraints on the path and generating new seeds (i.e., target input) through the solver. In this process, the constraint information on the path is saved and used to call the solver at the branch statement to generate new seeds.

[0063] In the embodiment of the present application, a delayed solution strategy is introduced to obtain the extended symbolic execution constraints based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent path, providing more potential paths for symbolic execution. Among them, the target branch path can be a target control dependency branch set (TCD-BSet) and a target data dependency branch set (TDD-BSet), both of which are basic block sequences in the path to be executed.

[0064] In the process of delayed solving, symbolic execution needs to dynamically record the extended conditions of control dependencies and data dependencies in addition to the normal collection of path constraints. In the seed generation phase, more potential paths are mined through the extended symbolic execution constraints to generate higher quality seeds.

[0065] In some embodiments, unsolvable constraint combinations can also be recorded to eliminate invalid solutions in advance, greatly improving solution efficiency.

[0066] The guided hybrid fuzz testing method provided in the embodiment of the present application takes into account the symbolic execution constraints of target branch paths such as TCD-BSet and TDD-BSet. These basic blocks not only play a key role in path control, but also indirectly affect the reachability of the target path through the constraints of their subsequent basic blocks, providing more potential paths for symbolic execution.

[0067] In some embodiments, the obtaining of the expanded symbolic execution constraint condition based on the symbolic execution constraint condition of the target branch path and the symbolic execution constraint condition of the subsequent path of the target branch path includes: Negate the symbolic execution constraints of the target branch path; The symbolic execution constraint condition of the inverted target branch path is combined with the symbolic execution constraint condition of the subsequent path to obtain an expanded symbolic execution constraint condition.

[0068] Specifically, the symbolic execution constraint condition of the target branch path is inverted to obtain inverted constraint information, which is combined with the symbolic execution constraint condition of the subsequent path of the target branch path to obtain the final expanded symbolic execution constraint condition.

[0069] The following describes the principles and limitations of traditional dynamic symbolic execution through specific examples, and explains how the delayed solution strategy in the embodiments of the present application overcomes these shortcomings.

[0070] The following is an example program containing three input variables and three conditional statements (recorded as code snippet 2): The sample program contains a vulnerability that occurs on line 16. When the variable ( ) is greater than 10, a segmentation fault will be triggered on line 16. Although traditional dynamic symbolic execution can detect the vulnerability, in actual execution, dynamic symbolic execution will generate multiple inputs, which will iterate dynamic symbolic execution multiple times and may eventually generate inputs that trigger the vulnerability.

[0071] For ease of explanation, the three conditional statements are marked as A: a>10, B: b>0, and C: c>5. Assuming the initial input is initInput = {a = 11, b = -2, c = 4}, the symbolic execution process is as follows: The execution path of the initial input is {AT, BF, CF}. After the first symbolic execution, three inputs will be generated, namely : {a = 10, b = -2, c = 4}, : {a = 11, b = 0, c = 4}, : {a = 11, b = -2, c = 6}, which correspond to the negation constraints at the three conditional branches { }, { }, { Next, we re-perform symbolic execution on the three inputs generated above to obtain inputs that trigger the crash. Ideally, we want to generate inputs that meet { } The path input requires at least Symbolic execution is performed again. However, the actual process may not be as we wish. It may select other inputs and perform multiple iterations before finally obtaining the input that triggers the crash.

[0072] Compared with traditional symbolic execution tools, the symbolic execution tool SymCC has reduced the path explosion problem to a certain extent and improved the efficiency of the overall symbolic execution. However, as shown in the example, SymCC limits the diversity of input generation and only allows the generation of inputs along the negated constraints of the execution path. To obtain { Such inputs that directly trigger crashes often require multiple iterations of symbolic execution.

[0073] To improve the diversity and possibility of symbolic execution input generation, it can be directly generated from { }Generates a }, selectively retaining the earlier negated constraints and combining them with subsequent constraints. These conditions are passed to a constraint solver (such as Z3) through conjunction operations to obtain new possible inputs. For example, in Code Snippet 1, during symbolic execution, (b>0) constraint, when running to condition C, the calculation is performed in the normal symbol {}, the constraint before condition B { }、Current negation constraint{ }and{ } conjunction, thus obtaining the } input directly triggers a crash.

[0074] The guided hybrid fuzz testing method provided in the embodiment of the present application can explore more potential paths by trying to invert the path constraints of TCD-BSet and TDD-BSet and combining them with their successor path constraints in the seed generation stage. This delayed solution strategy not only improves the breadth of path exploration, but also generates higher quality seeds, which helps to analyze the behavior of the target program more comprehensively. This delayed solution strategy combines the advantages of dynamic analysis and path constraint combination, makes full use of control dependency and data dependency information, expands the path space of symbolic execution, and effectively optimizes computing efficiency, providing new ideas for the exploration and seed generation of complex programs.

[0075] Figure 2 This is the second flow chart of the guided hybrid fuzzy testing method provided by the present invention. Figure 2 As shown, the embodiment of the present application proposes a new hybrid fuzz testing technology, which uses input selection based on the longest common path calculation and input generation based on extended path conditions.

[0076] By giving priority to inputs with longer and rarer prefix paths, the efficiency of path exploration is effectively improved. This mechanism avoids repeated exploration of redundant paths by removing duplication and optimizing the use of computing resources, ensuring that symbolic execution focuses on deep exploration of potential new paths. At the same time, by dynamically adjusting the rarity score, inputs with unique path features can be screened out, enhancing path diversity, thereby improving the probability of target code triggering and the efficiency of vulnerability discovery.

[0077] By retaining the negated constraints of some path conditions and combining them with subsequent constraints, more potential paths can be explored and more different seeds can be generated. In particular, during symbolic execution, dynamic path expansion combined with control dependency and data dependency information can generate inputs with higher quality and wider coverage. This approach significantly enhances the diversity of input generation for symbolic execution and improves the comprehensiveness of program behavior analysis.

[0078] Figure 3 Schematic diagram of the structure of the guided hybrid fuzzy testing device provided by the present invention. Figure 3 As shown, the present invention provides a guided hybrid fuzzy testing device, including a first acquisition module 301, a determination module 302 and a second acquisition module 303.

[0079] The first acquisition module 301 is used to filter the input path based on the prefix path of the input path generated by the fuzzy test to obtain a path to be executed; The determination module 302 is used to determine the priority score of the path to be executed based on the prefix path of the path to be executed; The second acquisition module 303 is used to input the to-be-executed paths into the symbolic executor in sequence based on the priority scores, and perform symbolic execution using the expanded symbolic execution constraints to obtain the target input path.

[0080] Specifically, the guided hybrid fuzzy testing device provided by the present invention can implement all the method steps implemented by the guided hybrid fuzzy testing method embodiment, and can achieve the same technical effects. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0081] It should be noted that the division of units / modules in the above-mentioned embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional units in the various embodiments of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software functional units.

[0082] Figure 4 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor 401, a communications interface 402, a memory 403 and a communication bus 404, wherein the processor 401, the communications interface 402 and the memory 403 communicate with each other via the communication bus 404. The processor 401 may call the logic instructions in the memory 403 to execute the guided hybrid fuzz testing method, which includes: Based on the prefix path of the input path generated by the fuzz test, the input path is screened to obtain a path to be executed; Determining a priority score of the path to be executed based on a prefix path of the path to be executed; Based on the priority score, the paths to be executed are sequentially input into the symbolic executor, and the symbolic execution is performed using the expanded symbolic execution constraint conditions to obtain the target input path.

[0083] In some embodiments, the prefix path of the input path generated based on the fuzzy test, filtering the input path to obtain the path to be executed, includes: Determine a basic block sequence in each input path that has a control dependency relationship with a target code location, and use the basic block sequence as a prefix path; The input paths with the same prefix path are deduplicated to obtain paths to be executed.

[0084] In some embodiments, determining the priority score of the path to be executed based on the prefix path of the path to be executed includes: Determining an initial priority of the path to be executed according to the length of a prefix path of the path to be executed; For the to-be-executed paths with the same initial priority, determining the rarity scores of the to-be-executed paths; The final priority score of each to-be-executed path is determined by the initial priority and the rarity score.

[0085] In some embodiments, determining the rarity score of the to-be-executed path includes: Determine the length of the common prefix path between the current to-be-executed path and the executed to-be-executed path; The rarity score of the current to-be-executed path is determined based on the length of the common prefix path.

[0086] In some embodiments, the method further comprises: Based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent path of the target branch path, the expanded symbolic execution constraints are obtained; the target branch path includes a control-dependent branch path and a data-dependent branch path.

[0087] In some embodiments, the obtaining of the expanded symbolic execution constraint condition based on the symbolic execution constraint condition of the target branch path and the symbolic execution constraint condition of the subsequent path of the target branch path includes: Negate the symbolic execution constraints of the target branch path; The symbolic execution constraint condition of the inverted target branch path is combined with the symbolic execution constraint condition of the subsequent path to obtain an expanded symbolic execution constraint condition.

[0088] Specifically, the processor 401 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD), and the processor may also adopt a multi-core architecture.

[0089] The logic instructions in the memory 403 can be implemented in the form of software functional units and can be stored in a processor-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.

[0090] In some embodiments, a computer program product is further provided, the computer program product comprising a computer program, the computer program may be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the guided hybrid fuzz testing method provided by the above-mentioned method embodiments, the method comprising: Based on the prefix path of the input path generated by the fuzz test, the input path is screened to obtain a path to be executed; Determining a priority score of the path to be executed based on a prefix path of the path to be executed; Based on the priority score, the paths to be executed are sequentially input into the symbolic executor, and the symbolic execution is performed using the expanded symbolic execution constraint conditions to obtain the target input path.

[0091] Specifically, the above-mentioned computer program product provided in the embodiment of the present application can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0092] In some embodiments, a computer-readable storage medium is further provided, wherein the computer-readable storage medium stores a computer program, wherein the computer program is used to enable a computer to execute the guided hybrid fuzz testing method provided by the above-mentioned method embodiments, and the method comprises: Based on the prefix path of the input path generated by the fuzz test, the input path is screened to obtain a path to be executed; Determining a priority score of the path to be executed based on a prefix path of the path to be executed; Based on the priority score, the paths to be executed are sequentially input into the symbolic executor, and the symbolic execution is performed using the expanded symbolic execution constraint conditions to obtain the target input path.

[0093] Specifically, the above-mentioned computer-readable storage medium provided by the present invention can implement all the method steps implemented by the above-mentioned method embodiments, and can achieve the same technical effects. The parts and beneficial effects that are the same as the method embodiments in this embodiment will not be described in detail here.

[0094] It should be noted that the computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)), etc.

[0095] In the present invention, the term "plurality" refers to two or more than two, and other quantifiers are similar to them.

[0096] In the present invention, "determine B based on A" means that the factor A should be considered when determining B. It is not limited to "B can be determined based on A alone", but should also include: "determine B based on A and C", "determine B based on A, C and E", "determine C based on A, and further determine B based on C", etc. In addition, it can also include taking A as a condition for determining B, for example, "when A meets the first condition, use the first method to determine B"; for another example, "when A meets the second condition, determine B", etc.; for another example, "when A meets the third condition, determine B based on the first parameter", etc. Of course, it can also be a condition that takes A as a factor for determining B, for example, "when A meets the first condition, use the first method to determine C, and further determine B based on C", etc.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A guided hybrid fuzz testing method, characterized in that: include: Based on the prefix path of the input path generated by the fuzz test, the input path is screened to obtain a path to be executed; Determining a priority score of the path to be executed based on a prefix path of the path to be executed; The paths to be executed are sequentially input into the symbolic executor according to the priority scores, and the symbolic execution is performed using the expanded symbolic execution constraints to obtain the target input path.

2. The guided hybrid fuzz testing method according to claim 1, characterized in that: The prefix path of the input path generated based on the fuzzy test, screening the input path to obtain a path to be executed, includes: Determine a basic block sequence in each input path that has a control dependency relationship with a target code location, and use the basic block sequence as a prefix path; The input paths with the same prefix path are deduplicated to obtain paths to be executed.

3. The guided hybrid fuzz testing method according to claim 1, characterized in that: The determining the priority score of the path to be executed based on the prefix path of the path to be executed includes: Determining an initial priority of the path to be executed according to the length of a prefix path of the path to be executed; For the to-be-executed paths with the same initial priority, determining the rarity scores of the to-be-executed paths; The final priority score of each to-be-executed path is determined by the initial priority and the rarity score.

4. The guided hybrid fuzz testing method according to claim 3 is characterized in that: The determining the rarity score of the to-be-executed path comprises: Determine the length of the common prefix path between the current path to be executed and the executed path; The rarity score of the current to-be-executed path is determined based on the length of the common prefix path.

5. The guided hybrid fuzz testing method according to claim 1, characterized in that: The method further comprises: Based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent path of the target branch path, the expanded symbolic execution constraints are obtained; the target branch path includes a control-dependent branch path and a data-dependent branch path.

6. The guided hybrid fuzz testing method according to claim 5, characterized in that: The step of obtaining the extended symbolic execution constraint condition based on the symbolic execution constraint condition of the target branch path and the symbolic execution constraint condition of the subsequent path of the target branch path includes: Negate the symbolic execution constraints of the target branch path; The symbolic execution constraint condition of the inverted target branch path is combined with the symbolic execution constraint condition of the subsequent path to obtain an expanded symbolic execution constraint condition.

7. A guided hybrid fuzzy testing device, characterized in that: include: A first acquisition module, configured to filter the input path based on a prefix path of the input path generated by the fuzzy test to obtain a path to be executed; A determination module, configured to determine a priority score of the path to be executed based on a prefix path of the path to be executed; The second acquisition module is used to input the to-be-executed paths into the symbolic executor in sequence based on the priority scores, and perform symbolic execution using the expanded symbolic execution constraints to obtain the target input path.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the guided hybrid fuzz testing method as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the guided hybrid fuzz testing method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the guided hybrid fuzz testing method as described in any one of claims 1 to 6 is implemented.

Images