Guided hybrid fuzzing method, apparatus, and storage medium

Abstract

The application provides a guided hybrid fuzz testing method, device and storage medium. The guided hybrid fuzz testing method comprises the following steps: screening an input path generated by fuzz testing based on a prefix path of the input path to obtain a to-be-executed path; determining a priority score of the to-be-executed path based on a prefix path of the to-be-executed path; inputting the to-be-executed path into a symbolic executor in sequence based on the priority score, and performing symbolic execution by using an extended symbolic execution constraint condition to obtain a target input path. The guided hybrid fuzz testing method, device and storage medium provided by the application effectively improve the path exploration efficiency by using an input selection mechanism based on a prefix path, and improve the diversity of input generation by using the extended symbolic execution constraint condition, thereby improving the probability of triggering a target code and improving the efficiency of hybrid fuzz testing.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software testing, and particularly relates to a guided hybrid fuzz testing method and device and a storage medium. BACKGROUND

[0002] Software inevitably has defects, and a considerable part of them are security vulnerabilities, and such vulnerable codes have become a fundamental threat to software security. Software vulnerabilities can be discovered through automated software testing, such as fuzz testing and symbolic execution techniques.

[0003] In order to improve code coverage, hybrid testing is attempted to combine fuzz testing and symbolic execution. The goal of hybrid testing is to use fuzz testing for path exploration, and to solve difficult conditions through symbolic execution. In the hybrid method, fuzz testing is usually run as much as possible. When the progress of fuzz testing is slow, the hybrid controller switches to the symbolic executioner to re-run the input generated by fuzz testing. However, the current hybrid fuzz testing method still has the problem of low testing efficiency. SUMMARY

[0004] The present application provides a guided hybrid fuzz testing method, device and storage medium to solve the technical problem of low efficiency of hybrid fuzz testing in the prior art.

[0005] In a first aspect, the present application provides a guided hybrid fuzz testing method, comprising the following steps.

[0006] Based on the prefix path of the input path generated by the fuzz testing, the input path is filtered to obtain a to-be-executed path;

[0007] Based on the prefix path of the to-be-executed path, a priority score of the to-be-executed path is determined;

[0008] Based on the priority score, the to-be-executed path is sequentially input into a symbolic executioner, and symbolic execution is performed using the extended symbolic execution constraint condition to obtain a target input path.

[0009] In some embodiments, the filtering of the input path based on the prefix path of the input path generated by the fuzz testing to obtain the to-be-executed path comprises:

[0010] Determine the basic block sequence in each input path that has a control dependency relationship with the target code location, and take the basic block sequence as the prefix path;

[0011] The input paths with the same prefix path are de-duplicated to obtain the to-be-executed path.

[0012] In some embodiments, the determining the priority score of the to-be-executed path based on the prefix path of the to-be-executed path comprises:

[0013] determining an initial priority of the to-be-executed path according to the length of the prefix path of the to-be-executed path;

[0014] determining a rarity score of the to-be-executed path for the to-be-executed paths with the same initial priority;

[0015] determining a final priority score of each to-be-executed path through the initial priority and the rarity score.

[0016] In some embodiments, the determining the rarity score of the to-be-executed path comprises:

[0017] determining the length of the common prefix path of the current to-be-executed path and the executed to-be-executed path;

[0018] determining the rarity score of the current to-be-executed path based on the length of the common prefix path.

[0019] In some embodiments, the method further comprises:

[0020] obtaining an extended symbolic execution constraint condition based on the symbolic execution constraint condition of a target branch path and the symbolic execution constraint condition of a subsequent path of the target branch path; the target branch path comprises a control dependent branch path and a data dependent branch path.

[0021] In some embodiments, the obtaining the extended symbolic execution constraint condition based on the symbolic execution constraint condition of a target branch path and the symbolic execution constraint condition of a subsequent path of the target branch path comprises:

[0022] negating the symbolic execution constraint condition of the target branch path;

[0023] combining the negated symbolic execution constraint condition of the target branch path and the symbolic execution constraint condition of the subsequent path to obtain the extended symbolic execution constraint condition.

[0024] In a second aspect, the present application provides a guided hybrid fuzz testing device, comprising the following modules.

[0025] a first obtaining module, configured to filter an input path generated by fuzz testing based on a prefix path of the input path to obtain a to-be-executed path;

[0026] a determining module, configured to determine a priority score of the to-be-executed path based on a prefix path of the to-be-executed path;

[0027] A second obtaining module is configured to input the to-be-executed path into a symbolic executor in sequence based on the priority score, and perform symbolic execution by using the extended symbolic execution constraint condition to obtain a target input path.

[0028] In a third aspect, the present application provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the guided hybrid fuzz testing method according to any one of the above aspects when executing the computer program.

[0029] In a fourth aspect, the present application provides a non-transitory computer readable storage medium, which stores a computer program executable on a processor to implement the guided hybrid fuzz testing method according to any one of the above aspects.

[0030] In a fifth aspect, the present application further provides a computer program product, which comprises a computer program executable on a processor to implement the guided hybrid fuzz testing method according to any one of the above aspects.

[0031] The guided hybrid fuzz testing method, device and storage medium provided by the present application filter the input paths generated by the fuzz testing based on the prefix paths of the input paths to obtain to-be-executed paths, determine the priority scores of the to-be-executed paths based on the prefix paths of the to-be-executed paths, input the to-be-executed paths into a symbolic executor in sequence based on the priority scores, and perform symbolic execution by using the extended symbolic execution constraint condition to obtain target input paths. The input selection mechanism based on the prefix paths effectively improves the path exploration efficiency, and the diversity of the input generation is improved by the extended symbolic execution constraint condition, thereby improving the probability of triggering the target code and improving the efficiency of the hybrid fuzz testing. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort.

[0033] Figure 1 is one of the flowcharts of the guided hybrid fuzz testing method provided by the present application.

[0034] Figure 2 is another flowchart of the guided hybrid fuzz testing method provided by the present application.

[0035] Figure 3 is a structural schematic diagram of the guided hybrid fuzz testing device provided by the present application.

[0036] Figure 4 Figure 1 is a structural schematic diagram of an electronic device provided by the present application. DETAILED DESCRIPTION

[0037] The core goal of guided grey-box fuzzing is to improve the efficiency and accuracy of testing by directing the fuzzing process to focus resources on exploring critical areas of the program. AFLGo, as a representative tool in the early stage, adopts a distance-based guiding mechanism. Specifically, it calculates the static distance between basic blocks and target regions in advance through compile-time instrumentation. At runtime, it dynamically allocates input mutation energy based on the distance between the input execution path and the target, thereby focusing the test on potential vulnerability areas.

[0038] Based on AFLGo, subsequent research has proposed various improvements. For example, the directed grey-box fuzzing techniques Hawkeye and Lolly introduce path similarity metrics and key basic block distance calculations, respectively, further improving the relevance of test case generation. These methods optimize the input selection mechanism, enabling the fuzzing process to prioritize paths that are most likely to approach the target, thereby more efficiently discovering potential vulnerabilities.

[0039] Although guided grey-box fuzzing has made progress in testing efficiency and target guidance, its ability to handle complex path constraints is still insufficient. To address this issue, hybrid fuzzing has emerged. Hybrid fuzzing combines the breadth exploration of fuzzing with the depth analysis capabilities of symbolic execution to expand test coverage and improve the ability to analyze complex paths.

[0040] The typical hybrid fuzzing tool Driller combines fuzzing and symbolic execution through a coordination mechanism: when fuzzing cannot generate new inputs, symbolic execution is started to resolve path constraints and generate new test inputs. This mechanism effectively improves the exploration ability of deep program states. Subsequent research such as hybrid fuzzing tools DigFuzz and SILK, respectively, selects low execution probability paths and complex constraint paths for symbolic execution, further optimizing test coverage and efficiency.

[0041] In view of the respective limitations of guided grey-box fuzzing and hybrid fuzzing, combining the two techniques, i.e., guided hybrid fuzzing (or directed hybrid fuzzing), not only retains the breadth and depth advantages of hybrid fuzzing, but also further improves testing efficiency by introducing a target guiding mechanism. Directed hybrid fuzzing further narrows the analysis scope by utilizing analysis targets, thereby improving the guiding efficiency of the analysis method.

[0042] For example, the guided hybrid fuzzing tool Berry combines sequence-guided strategies with symbolic execution techniques to enable test cases to reach critical locations in the program along predetermined paths, thereby precisely locating potential vulnerabilities. The guided hybrid fuzzing tool LeoFuzz dynamically adjusts input energy scheduling strategies through an adaptive exploration and exploitation phase coordination mechanism to improve multi-objective coverage capabilities. The guided hybrid fuzzing tool HyperGo proposes a metric method based on path uncoverage probability and distance, and simultaneously improves test efficiency by pruning infeasible paths.

[0043] However, directed hybrid fuzzing still faces the problem of low efficiency, and how to more effectively integrate fuzzing and symbolic execution to improve the efficiency of hybrid fuzzing is still an important challenge.

[0044] In particular, there are two reasons that hinder the improvement of directed hybrid fuzzing:

[0045] First, the current method fails to select appropriate inputs to drive the symbolic executor.

[0046] For example, for the following example of code snippet 1:

[0047] x =2, y =0;

[0048] if(input1>0){ / / br 1

[0049] if(input2>1) x =1 / / br 2

[0050] if(input3>2) y =1 / / br 3

[0051] if(input4>3) / / br 4

[0052] if( x + y = 1 =10) / / br 5

[0053] / / target;

[0054] }

[0055] For four different inputs of this code snippet, i.e., I1 (I1: 1,2,3,4), I2 (I2: 1,2,2,4), I3 (I3: 1,1,2,4), and I4 (I4: 1,2,3,3), it is obvious that input I1 is more suitable than input I4 for starting the symbolic analysis to generate new inputs. Because I4 cannot pass the branch br4 that the target depends on, while I1 can. However, it is not an intuitive task to identify the appropriate input. For example, it cannot be directly judged which one of I1, I2, I3, and I4 is better. In addition, fuzz testing often executes a large number of inputs, so it is a big challenge to efficiently select inputs from this huge pool of inputs.

[0056] Secondly, the current method does not fully utilize the constraint generation capability of the symbolic executor.

[0057] For example, when using input I3 to perform symbolic analysis, the symbolic executor will generate a new input based on the constraint Br1 ^ ¬ Br2 ^ Br3 of the prefix path. However, it directly ignores the information in the suffix path. In fact, the suffix path explicitly indicates that Br4 and Br5 being True are necessary conditions for covering the target of line 7 of the above code snippet. These information can be further used to guide the generation of inputs that are more likely to cover the target. How to effectively utilize the information in symbolic execution to construct more effective input constraints is the second challenge faced.

[0058] Based on the above technical problems, the present application provides a hybrid fuzz testing method, based on the prefix path of the input path generated by the fuzz testing, screening the input path to obtain a to-be-executed path; based on the prefix path of the to-be-executed path, determining the priority score of the to-be-executed path; based on the priority score, inputting the to-be-executed path into the symbolic executor in turn, and performing symbolic execution by using the extended symbolic execution constraint condition to obtain a target input path. Through the input selection mechanism based on the prefix path, the path exploration efficiency is effectively improved, and through the extended symbolic execution constraint condition, the diversity of input generation is improved, thereby improving the probability of triggering the target code and improving the efficiency of hybrid fuzz testing.

[0059] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0060] Figure 1 is one of the flowcharts of the guided hybrid fuzz testing method provided by the present application, as Figure 1As shown, the application provides a guided hybrid fuzz testing method. The method comprises:

[0061] Step 101, filtering the input path based on the prefix path of the input path generated by the fuzz testing to obtain a to-be-executed path.

[0062] Specifically, a plurality of input paths generated by the fuzz testing are obtained, which cover diversified paths, but not all paths have the potential to trigger specific target code. The input path is filtered based on the prefix path of the input path to filter out inputs with higher exploration value to obtain a to-be-executed path.

[0063] In the embodiment of the application, the prefix path refers to a sequence of basic blocks in the input path that has a control dependency relationship with the target code position. It reflects the trajectory of the input in the execution path and its potential relevance to the target code by tracking the key control dependency branch basic blocks involved in the input path.

[0064] Step 102, determining the priority score of the to-be-executed path based on the prefix path of the to-be-executed path.

[0065] Specifically, since the possibility of generating effective inputs on a path prefix with lower exploration degree is higher, because only a small number of existing inputs can cover these paths. In contrast, the path prefix that is completely explored has a lower coverage value. To achieve efficient input selection, a novel quantification method is proposed to evaluate the priority score of each to-be-executed path, so as to guide the to-be-executed path to the symbolic execution stage according to the priority score, so as to improve the triggering probability of the target code in the deeper path.

[0066] Step 103, inputting the to-be-executed path into the symbolic executor in sequence according to the priority score, and performing symbolic execution using the extended symbolic execution constraint condition to obtain a target input path.

[0067] Specifically, the to-be-executed path is input into the symbolic executor in sequence according to the priority score. In the symbolic execution stage, the symbolic execution constraint condition is extended to generate more efficient target-oriented inputs through symbolic execution, and the symbolic execution is performed using the extended symbolic execution constraint condition to obtain a higher-quality seed, i.e., a target input path.

[0068] The guided hybrid fuzz testing method provided by the embodiment of the application can filter out more unique and not completely explored paths based on the prefix sequence, and guide the to-be-executed path to the symbolic executor according to the priority score, thereby improving the path exploration efficiency in the dynamic symbolic execution (Concolic Execution) stage. By extending the symbolic execution constraint condition, more potential paths can be mined, and the breadth of path exploration is improved.

[0069] In some embodiments, the prefix path of the input path generated based on the fuzz testing is used to filter the input path to obtain the to-be-executed path, including:

[0070] determining a basic block sequence in each input path having a control dependency relationship with the target code location, and taking the basic block sequence as the prefix path;

[0071] de-duplicating the input paths having the same prefix path to obtain the to-be-executed path.

[0072] Specifically, the basic block sequence in the input path having a control dependency relationship with the target code location, i.e., the prefix path or the prefix sequence, is obtained.

[0073] During the execution of the fuzz testing, the control dependency basic block sequence of the input can be dynamically recorded in a way of instrumentation to obtain the prefix path, which is stored for subsequent input filtering.

[0074] Since the inputs generated in the fuzz testing stage mostly have the same prefix sequence, after the prefix path is obtained, the input path can be filtered based on the common prefix path, specifically, the input paths having the same prefix path are de-duplicated to obtain the to-be-executed path.

[0075] To optimize the use efficiency of the computing resources, the input path of the unique prefix sequence appearing for the first time is recorded, and the input paths having the completely same prefix sequence are de-duplicated to exclude the redundant paths in the symbolic execution stage.

[0076] The guided hybrid fuzz testing method provided by the embodiments of the present application reduces unnecessary repeated calculation by de-duplicating the input paths having the same prefix path, avoids repeated exploration of the already covered paths, thereby focusing the symbolic execution on the exploration of potential new paths, improving the detection probability of the uncovered paths, and improving the hybrid fuzz testing efficiency.

[0077] In some embodiments, the prefix path of the to-be-executed path is used to determine the priority score of the to-be-executed path, including:

[0078] determining an initial priority of the to-be-executed path according to the length of the prefix path of the to-be-executed path;

[0079] for the to-be-executed paths having the same initial priority, determining a rarity score of the to-be-executed path;

[0080] determining the final priority score of each to-be-executed path through the initial priority and the rarity score.

[0081] Specifically, in the input selection process, the longer the input control dependency sequence is, the more likely it is that the input has explored a deeper path, and the closer it is to the target code location. Therefore, the initial priority of the to-be-executed path can be determined according to the length of the prefix path of the to-be-executed path (i.e., the prefix sequence length), so that the to-be-executed path with a longer prefix sequence is preferentially selected, which helps to generate an input reaching the target location through symbolic execution. In addition, a longer prefix sequence means that the input can have covered more control dependency branches, and this feature increases the opportunity to trigger the target code or discover new paths. By prioritizing on the prefix sequence length, the path exploration efficiency of the symbolic execution stage can be significantly improved, while avoiding the calculation of low-potential paths, thereby focusing on the in-depth exploration of unexplored paths.

[0082] When the prefix sequence length is the same, i.e., the initial priority is the same, the uniqueness of the to-be-executed path is further evaluated by the rarity score.

[0083] The initial priority of the to-be-executed path and the rarity score are combined to determine the final priority score of each to-be-executed path. The formula of the priority score is:

[0084] Priority score = × prefix sequence length + × rarity score

[0085] wherein, and are weight coefficients of the control prefix sequence length and the rarity score, respectively. By adjusting these two weights, inputs with higher priority scores can be flexibly selected to cover more unique paths.

[0086] The guided hybrid fuzzing method provided by the embodiments of the present application determines the initial priority of the to-be-executed path according to the length of the prefix path of the to-be-executed path, and when the prefix sequence length is the same, further evaluates the uniqueness of the to-be-executed path by the rarity score, which helps to avoid repeated calculation of the explored area and improve the detection efficiency of unexplored paths, thereby effectively expanding path diversity and improving the triggering probability of the target code in the symbolic execution stage.

[0087] In some embodiments, the determination of the rarity score of the to-be-executed path comprises:

[0088] determining the length of the common prefix path of the current to-be-executed path and the executed path;

[0089] determining the rarity score of the current to-be-executed path based on the length of the common prefix path.

[0090] Specifically, the executed path refers to an input path that has completed execution in the input symbolic executor.

[0091] The calculation of the rarity score first determines the length of the common prefix path. The prefix path of the current to-be-executed path is compared with one or more executed paths to identify the number of common basic blocks in the prefix path (i.e., the length of the common prefix path or the length of the common prefix sequence) of the to-be-executed path. A shorter common prefix sequence generally indicates that the current to-be-executed path overlaps less with the executed paths, thereby having higher path uniqueness.

[0092] The rarity of the path is measured by the length of the common prefix sequence and the variance, as follows:

[0093]

[0094] wherein, is an adjustment parameter used to control the relative weight of the average common prefix sequence length and the variance. The variance is calculated based on the common prefix sequence length of the current to-be-executed path and each executed path. A short average common prefix sequence length and a large variance mean that the current path has higher uniqueness in the uncovered area, thereby improving its potential to explore new paths.

[0095] According to the update of the executed paths, the rarity score is dynamically adjusted: whenever a to-be-executed path is selected and executed, the prefix information of the current to-be-executed path is added to the executed path pool to participate in the statistics of the common prefix sequence in the next round of input selection. Specifically, the rarity score is updated by comparing the prefix sequence in the executed path pool before each selection, thereby dynamically reflecting the difference between the selected input and the explored paths. This method preferentially selects inputs with higher rarity scores, i.e., paths that are more "unique", thereby further improving the probability of exploring new paths and avoiding the repeated exploration of redundant paths.

[0096] The guided hybrid fuzzing method provided by the embodiments of the present application selects inputs with unique path characteristics through the rarity score, preferentially guides them to the symbolic execution stage, and thereby improves the triggering probability of the target code in deeper paths.

[0097] In some embodiments, the method further comprises:

[0098] Based on the symbolic execution constraint condition of the target branch path and the symbolic execution constraint condition of the subsequent path of the target branch path, an extended symbolic execution constraint condition is obtained; the target branch path includes a control-dependent branch path and a data-dependent branch path.

[0099] Specifically, in a conventional dynamic symbolic execution process, seed generation mainly relies on current path execution information, saves symbolic execution constraint conditions on the path, and generates a new seed (i.e., a target input) through a solver. In this process, constraint information passed on the path is saved for calling the solver to generate a new seed at a branch statement.

[0100] In the embodiments of the present application, a delayed solving strategy is introduced, and an extended symbolic execution constraint condition is obtained based on a symbolic execution constraint condition of a target branch path and a symbolic execution constraint condition of a subsequent path, to provide more potential paths for symbolic execution. The target branch path can be a target control dependency branch set (TCD-BSet) and a target data dependency branch set (TDD-BSet), both of which are sequences of basic blocks in a path to be executed.

[0101] In the delayed solving process, the symbolic execution needs to dynamically record extended conditions of control dependency and data dependency in addition to normally collecting path constraints. In the seed generation stage, more potential paths are mined through the extended symbolic execution constraint condition, and seeds with higher quality are generated.

[0102] In some embodiments, unsolvable constraint combinations can also be recorded to exclude invalid solving in advance and greatly improve solving efficiency.

[0103] The guided hybrid fuzzing method provided in the embodiments of the present application considers symbolic execution constraint conditions of target branch paths such as TCD-BSet and TDD-BSet. These basic blocks not only play a key role in path control, but also indirectly affect the reachability of the target path through constraint conditions of their successor basic blocks, to provide more potential paths for symbolic execution.

[0104] In some embodiments, the extended symbolic execution constraint condition is obtained based on the symbolic execution constraint condition of the target branch path and the symbolic execution constraint condition of a subsequent path of the target branch path, and includes:

[0105] The symbolic execution constraint condition of the target branch path is negated.

[0106] The negated symbolic execution constraint condition of the target branch path is combined with the symbolic execution constraint condition of the subsequent path to obtain the extended symbolic execution constraint condition.

[0107] Specifically, the symbolic execution constraint condition of the target branch path is negated to obtain negated constraint information, which is combined with the symbolic execution constraint condition of the subsequent path of the target branch path to obtain the final extended symbolic execution constraint condition.

[0108] The principle of traditional dynamic symbolic execution and its limitations are described below through specific examples, and the delay solving strategy in the embodiments of the application is described.

[0109] The following is an example program (referred to as code snippet 2) containing three input variables and three conditional statements:

[0110]

[0111] The example program contains a vulnerability that occurs at line 16. When the value of the variable (a) at line 15 is greater than 10, line 16 will trigger a segment error. Although traditional dynamic symbolic execution can detect the vulnerability, in actual execution, dynamic symbolic execution will generate multiple inputs that will iterate multiple times for dynamic symbolic execution, and eventually generate an input that triggers the vulnerability.

[0112] For ease of illustration, the three conditional statements are labeled as A: a>10, B: b>0, and C: c>5. Assuming the initial input is initInput = {a = 11, b = -2, c = 4}, the process of symbolic execution is as follows: the execution path of the initial input is {AT, BF, CF}. After the first symbolic execution, three inputs are generated, respectively : {a =10, b = -2, c = 4}, : {a = 11, b = 0, c = 4}, : {a = 11, b = -2,c = 6} which correspond to the negation constraints { }, { }, { } at the three conditional branches. Next, the three inputs generated above are re-executed for symbolic execution in order to obtain an input that triggers a crash. Ideally, we want to generate an input that meets the { } path, which requires at least to be executed again for symbolic execution. However, in actual practice, it may not be as we wish, and it may choose other inputs and iterate multiple times to finally obtain an input that triggers a crash.

[0113] Compared with traditional symbolic execution tools, the symbolic execution of the symbolic execution tool SymCC to some extent reduces the path explosion problem and improves the efficiency of the overall symbolic execution. However, as the example shows, SymCC limits the diversity of input generation and only allows inputs to be generated along the negation constraints of the execution path. To obtain an input that directly triggers a crash { }, multiple iterations of the symbolic execution process are often required.​

[0114] To improve the diversity and possibility of symbolic execution generated inputs, make it directly generate inputs that meet { } from { }, selectively retain the early negated constraints and combine them with the subsequent constraints. By passing these conditions to the constraint solver (such as Z3) through the conjunction operation, new possible inputs can be obtained. For example, in code snippet 1, the constraint of (b>0) is retained during symbolic execution, when running to condition C, the constraint before condition B, the current negated constraint and { } are conjuncted to get inputs that meet { }, directly trigger the crash.

[0115] The guided hybrid fuzzing method provided by the embodiment of the present application can mine more potential paths by trying to negate the path constraints of TCD-BSet and TDD-BSet and combining them with the subsequent path constraints in the seed generation stage. This delayed solving strategy not only improves the breadth of path exploration, but also generates higher-quality seeds, which helps to more comprehensively analyze the behavior of the target program. This delayed solving strategy combines the advantages of dynamic analysis and path constraint combination, fully utilizes control dependency and data dependency information, expands the path space of symbolic execution, and effectively optimizes the computing efficiency, providing a new idea for the exploration and seed generation of complex programs.

[0116] Figure 2 is a flowchart of the guided hybrid fuzzing method provided by the present application, as shown in Figure 2 The present application provides a new hybrid fuzzing technology, which uses input selection based on the longest common path calculation and input generation based on extended path conditions.

[0117] By preferentially selecting inputs with longer and rare prefix paths, the path exploration efficiency is effectively improved. This mechanism avoids repeated exploration of redundant paths by deduplication and optimized use of computing resources, ensuring that symbolic execution focuses on the depth exploration of potential new paths. At the same time, by dynamically adjusting the rarity score, inputs with unique path characteristics can be screened, enhancing path diversity and thus improving the probability of target code triggering and the efficiency of vulnerability discovery.

[0118] ​​​​By reserving the negation constraint of part of the path condition and combining it with the subsequent constraint, more potential paths can be explored, and more different seeds can be generated. Especially in the process of symbolic execution, combined with control dependence and data dependence information for dynamic path expansion, higher quality and more comprehensive input can be generated. This way significantly enhances the diversity of symbolic execution input generation and improves the comprehensiveness of program behavior analysis.

[0119] Figure 3 is a structural schematic diagram of the guided hybrid fuzz testing device provided by the present application, as shown in Figure 3 The present application provides a guided hybrid fuzz testing device, comprising a first acquisition module 301, a determination module 302 and a second acquisition module 303.

[0120] The first acquisition module 301 is used for screening the input path based on the prefix path of the input path generated by the fuzz testing, to obtain a to-be-executed path;

[0121] The determination module 302 is used for determining the priority score of the to-be-executed path based on the prefix path of the to-be-executed path;

[0122] The second acquisition module 303 is used for inputting the to-be-executed path into a symbolic executor in sequence based on the priority score, and performing symbolic execution by using the extended symbolic execution constraint condition to obtain a target input path.

[0123] Specifically, the guided hybrid fuzz testing device provided by the present application can realize all the method steps realized by the guided hybrid fuzz testing method embodiment, and can achieve the same technical effects. Therefore, the same parts and beneficial effects in the method embodiment will not be described in detail.

[0124] It should be noted that the division of units / modules in the above embodiments of the present application is illustrative, and is only a logical functional division. In actual implementation, another division mode can be used. In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0125] Figure 4 is a structural schematic diagram of the electronic device provided by the present application, as shown in Figure 4As shown, the electronic device can include a processor (processor) 401, a communications interface (Communications Interface) 402, a memory (memory) 403 and a communication bus 404, wherein the processor 401, the communications interface 402, the memory 403 complete the communication between each other through the communication bus 404. The processor 401 can call the logic instruction in the memory 403 to execute the directed hybrid fuzz testing method, which includes:

[0126] Filtering the input path based on the prefix path of the input path generated by the fuzz testing to obtain a to-be-executed path;

[0127] Determine the priority score of the to-be-executed path based on the prefix path of the to-be-executed path;

[0128] Input the to-be-executed path into the symbolic executor in turn based on the priority score, and perform symbolic execution using the extended symbolic execution constraint condition to obtain a target input path.

[0129] In some embodiments, the filtering of the input path based on the prefix path of the input path generated by the fuzz testing to obtain a to-be-executed path includes:

[0130] Determine the basic block sequence in each input path that has a control dependency relationship with the target code location, and take the basic block sequence as a prefix path;

[0131] De-duplicate the input paths with the same prefix path to obtain a to-be-executed path.

[0132] In some embodiments, the determination of the priority score of the to-be-executed path based on the prefix path of the to-be-executed path includes:

[0133] Determine the initial priority of the to-be-executed path according to the length of the prefix path of the to-be-executed path;

[0134] For the to-be-executed paths with the same initial priority, determine the rarity score of the to-be-executed path;

[0135] Determine the final priority score of each to-be-executed path through the initial priority and the rarity score.

[0136] In some embodiments, the determination of the rarity score of the to-be-executed path includes:

[0137] Determine the length of the common prefix path of the current to-be-executed path and the executed to-be-executed path;

[0138] determine rarity scores of the current to-be-executed paths based on lengths of the common prefix paths.

[0139] In some embodiments, the method further comprises:

[0140] obtaining extended symbolic execution constraints based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent paths of the target branch path; the target branch path comprises a control dependent branch path and a data dependent branch path.

[0141] In some embodiments, the obtaining the extended symbolic execution constraints based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent paths of the target branch path comprises:

[0142] negating the symbolic execution constraints of the target branch path;

[0143] combining the negated symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent paths to obtain the extended symbolic execution constraints.

[0144] Specifically, the processor 401 can be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor can also adopt a multi-core architecture.

[0145] The logic instructions in the memory 403 can be implemented in the form of software functional units and sold or used as independent products. When used, they can be stored in a processor-readable storage medium. Based on this understanding, the technical solutions of the present application or the essential part or the whole or part of the technical solutions that make contributions to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0146] In some embodiments, a computer program product is also provided, which comprises a computer program, the computer program being stored in a non-transitory computer-readable storage medium, and the computer program being executable by a processor to enable a computer to perform the guided hybrid fuzz testing method provided by any of the above method embodiments, and the method comprises the following steps:

[0147] filtering the input paths based on the prefix paths of the input paths generated by the fuzz testing to obtain to-be-executed paths;

[0148] determining a priority score of the to-be-executed paths based on the prefix paths of the to-be-executed paths;

[0149] inputting the to-be-executed paths into a symbolic executor in sequence based on the priority scores, and performing symbolic execution by using the extended symbolic execution constraint conditions to obtain target input paths.

[0150] Specifically, the above computer program product provided by the embodiments of the present application can implement all the method steps achieved by the above method embodiments and achieve the same technical effects. Here, the same parts and beneficial effects of the embodiments as the method embodiments will not be described in detail.

[0151] In some embodiments, a computer-readable storage medium is also provided, which stores a computer program, and the computer program is used to enable a computer to perform the guided hybrid fuzz testing method provided by any of the above method embodiments, and the method comprises the following steps:

[0152] filtering the input paths based on the prefix paths of the input paths generated by the fuzz testing to obtain to-be-executed paths;

[0153] determining a priority score of the to-be-executed paths based on the prefix paths of the to-be-executed paths;

[0154] inputting the to-be-executed paths into a symbolic executor in sequence based on the priority scores, and performing symbolic execution by using the extended symbolic execution constraint conditions to obtain target input paths.

[0155] Specifically, the above computer program product provided by the embodiments of the present application can implement all the method steps achieved by the above method embodiments and achieve the same technical effects. Here, the same parts and beneficial effects of the embodiments as the method embodiments will not be described in detail.

[0156] It should be noted that the computer-readable storage medium can be any available media or data storage device that can be accessed by the processor, including but not limited to magnetic storage (e.g. floppy disk, hard disk, tape, magnetic disk (MO) and the like), optical storage (e.g. CD, DVD, BD, HVD and the like), and semiconductor memory (e.g. ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state disk (SSD) and the like).

[0157] In the present application, the term "a plurality of" refers to two or more, and other quantifiers are similar.

[0158] In the present application, "determining B based on A" means that A is considered as a factor when determining B. It is not limited to "determining B based on A only", but also includes "determining B based on A and C", "determining B based on A, C and E", "determining C based on A, and determining B based on C further", and the like. In addition, it can also include A as a condition for determining B, for example, "when A meets the first condition, determining B using the first method"; for example, "when A meets the second condition, determining B"; for example, "when A meets the third condition, determining B based on the first parameter"; and the like. Of course, A can also be a condition for determining B as a factor, for example, "when A meets the first condition, determining C using the first method, and further determining B based on C"; and the like.

[0159] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage and optical storage, etc.) containing computer-usable program code.

[0160] The present application is described with reference to flowcharts and / or block diagrams according to the method, device (system) and computer program product of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer executable instructions. These computer executable instructions can be provided to the processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The function specified in one flow or multiple flows and / or blocks Figure 1 The device that implements the function specified in one block or multiple blocks.

[0161] These processor-executable instructions can also be stored in a processor-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the processor-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart Figure 1 of flows or blocks and / or a function specified in the flowchart Figure 1 of flows or blocks and / or a function specified in the flowchart

[0162] These processor-executable instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the function specified in the flowchart Figure 1 of flows or blocks and / or a function specified in the flowchart Figure 1 of flows or blocks and / or a function specified in the flowchart

[0163] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A guided hybrid fuzzy testing method, characterized in that, include: Based on the prefix path of the input path generated by fuzz testing, the input path is filtered to obtain the path to be executed; Based on the prefix path of the path to be executed, determine the priority score of the path to be executed; The paths to be executed are sequentially input into the symbolic executor based on the priority score, and symbolic execution is performed using the extended symbolic execution constraints to obtain the target input path. The prefix path of the input path generated based on fuzz testing is used to filter the input path to obtain the path to be executed, including: Determine the basic block sequence in each input path that has a control dependency relationship with the target code location, and use the basic block sequence as the prefix path; Deduplication is performed on the input paths with the same prefix path to obtain the path to be executed; The method further includes: Based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent paths of the target branch path, the extended symbolic execution constraints are obtained; the target branch path includes control dependency branch paths and data dependency branch paths. The extended symbolic execution constraints are obtained based on the symbolic execution constraints of the target branch path and the symbolic execution constraints of the subsequent paths of the target branch path, including: Invert the constraint conditions of the target branch path; The symbolic execution constraints of the inverted target branch path are combined with the symbolic execution constraints of the subsequent path to obtain the extended symbolic execution constraints.

2. The guided hybrid fuzzy testing method according to claim 1, characterized in that, The step of determining the priority score of the path to be executed based on the prefix path of the path to be executed includes: The initial priority of the path to be executed is determined based on the length of the prefix path of the path to be executed; For the paths to be executed with the same initial priority, a rarity score is determined for each path to be executed. The final priority score for each path to be executed is determined by the initial priority and the rarity score.

3. The guided hybrid fuzzy testing method according to claim 2, characterized in that, The determination of the rarity score of the path to be executed includes: Determine the length of the common prefix path between the current path to be executed and the already executed paths; The rarity score of the current path to be executed is determined based on the length of the common prefix path.

4. A guided hybrid fuzzy testing apparatus applying the guided hybrid fuzzy testing method as described in claim 1, characterized in that, include: The first acquisition module is used to filter the input path based on the prefix path of the input path generated by fuzz testing to obtain the path to be executed; The determination module is used to determine the priority score of the path to be executed based on the prefix path of the path to be executed; The second acquisition module is used to sequentially input the paths to be executed into the symbolic executor based on the priority score, and perform symbolic execution using the extended symbolic execution constraints to obtain the target input path.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the guided hybrid fuzz testing method as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores a computer program that, when executed by a processor, implements the guided hybrid fuzz testing method as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the guided hybrid fuzz testing method as described in any one of claims 1 to 3.

Images