A data processing method, apparatus and equipment

Abstract

This specification provides a data processing method, apparatus, and device. The method includes: receiving a fuzzing request for a virtual machine; in response to the fuzzing request, acquiring test data carried in the fuzzing request; performing structural mutation processing on the test data based on the node connection relationship of each data node in the test data to obtain first test data; performing structural repair processing on the first test data to obtain second test data that meets the operating requirements of the virtual machine; performing instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data; and performing fuzzing processing on the virtual machine based on the target test data.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a data processing method, apparatus, and device. Background Technology

[0002] With the rapid development of Internet technology, virtual machines, as a new code runtime environment, have been widely used in browsers. As virtual machines become more common in browsers, ensuring the security of virtual machine operation to protect the security of user privacy data has become crucial.

[0003] For example, fuzz testing can be performed on a program by generating a large amount of random or semi-random input data to test whether a virtual machine exhibits abnormal behavior. However, when testing a virtual machine, due to its complex structure, fuzz testing with randomly generated input data is inefficient and ineffective, making it difficult to effectively discover potential security vulnerabilities. Therefore, this specification provides a superior technical solution for security testing of virtual machines. Summary of the Invention

[0004] The purpose of the embodiments in this specification is to provide a better technical solution for security testing of virtual machines.

[0005] To achieve the above technical solution, the embodiments in this specification are implemented as follows:

[0006] This specification provides a data processing method comprising: receiving a fuzzing request for a virtual machine; in response to the fuzzing request, acquiring test data carried in the fuzzing request; performing structural mutation processing on the test data based on the node connection relationship of each data node in the test data to obtain first test data; performing structural repair processing on the first test data to obtain second test data that meets the operating requirements of the virtual machine; performing instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data; and performing fuzzing processing on the virtual machine based on the target test data.

[0007] This specification provides a data processing apparatus, comprising: a request receiving module for receiving a fuzzing request for a virtual machine; a data acquisition module for acquiring test data carried in the fuzzing request in response to the fuzzing request; a first processing module for performing structural mutation processing on the test data based on the node connection relationship of each data node in the test data to obtain first test data; a structure repair module for performing structure repair processing on the first test data to obtain second test data that meets the operating requirements of the virtual machine; a second processing module for performing instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data; and a testing module for performing fuzzing processing on the virtual machine based on the target test data.

[0008] This specification provides an embodiment of a data processing device, comprising: a processor; and a memory arranged to store computer-executable instructions, wherein, when executed, the executable instructions cause the processor to: receive a fuzzing request for a virtual machine; in response to the fuzzing request, acquire test data carried in the fuzzing request; perform structural mutation processing on the test data based on the node connection relationship of each data node in the test data to obtain first test data; perform structural repair processing on the first test data to obtain second test data that meets the operating requirements of the virtual machine; perform instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data; and perform fuzzing processing on the virtual machine based on the target test data.

[0009] This specification also provides a storage medium for storing computer-executable instructions. When executed by a processor, the executable instructions perform the following process: receiving a fuzzing request for a virtual machine; in response to the fuzzing request, obtaining test data carried in the fuzzing request; performing structural mutation processing on the test data based on the node connection relationship of each data node in the test data to obtain first test data; performing structural repair processing on the first test data to obtain second test data that meets the operating requirements of the virtual machine; performing instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data; and performing fuzzing processing on the virtual machine based on the target test data.

[0010] This specification also provides a computer program product, including a computer program that, when executed by a processor, implements the following process: receiving a fuzzing request for a virtual machine; in response to the fuzzing request, obtaining test data carried in the fuzzing request; performing structural mutation processing on the test data based on the node connection relationship of each data node in the test data to obtain first test data; performing structural repair processing on the first test data to obtain second test data that meets the operating requirements of the virtual machine; performing instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data; and performing fuzzing processing on the virtual machine based on the target test data. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is an embodiment of a data processing method described in this specification;

[0013] Figure 2 This is yet another embodiment of the data processing method described in this specification;

[0014] Figure 3 This is a schematic diagram of a data processing procedure described in this specification;

[0015] Figure 4 This is one embodiment of a data processing device described in this specification;

[0016] Figure 5 This is an embodiment of a data processing device described in this specification. Detailed Implementation

[0017] This specification provides a data processing method, apparatus, and device through its embodiments.

[0018] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0019] This specification provides a superior testing mechanism for security testing of virtual machines. With the rapid development of internet technology, virtual machines, as a new code runtime environment, have been widely used in browsers. As virtual machines become more prevalent in browsers, ensuring their security and protecting user privacy data has become crucial. For example, fuzzing can be performed on programs by generating large amounts of random or semi-random input data to test for abnormal behavior in virtual machines. However, due to the complexity of virtual machine structures, fuzzing with randomly generated input data is inefficient and ineffective in uncovering potential security vulnerabilities. Therefore, this specification provides a superior technical solution for security testing of virtual machines. This scheme receives fuzzing requests for virtual machines, responds to these requests by acquiring the test data carried within them, and performs structural mutation processing on the test data based on the node connections of each data node to obtain first test data. Then, it performs structural repair processing on the first test data to obtain second test data that meets the virtual machine's operational requirements. Next, it performs instruction mutation processing on the second test data based on the instruction nodes to obtain target test data. Finally, it performs fuzzing on the virtual machine based on the target test data. This approach achieves two advantages: firstly, it allows for a deep understanding of the test data structure, enabling structural mutation processing based on the node connections of each data node; secondly, it utilizes an efficient structural repair mechanism to repair file structures that may be corrupted during structural mutation, ensuring the executability of the first test data obtained through structural mutation processing and improving fuzzing efficiency. Then, by performing instruction mutation processing on the second test data obtained from the structural repair process, more complex target test data can be obtained. By performing fuzz testing on the virtual machine using this target test data, potential security vulnerabilities in the virtual machine can be uncovered, improving the effectiveness and depth of virtual machine fuzz testing, promoting the patching of security vulnerabilities, and enhancing the security of the virtual machine. Specific processing details can be found in the following embodiments.

[0020] like Figure 1 As shown in the embodiments of this specification, a data processing method is provided. The execution subject of this method can be a server, which can be a single independent server or a server cluster composed of multiple servers. This embodiment uses a server as the execution subject for detailed explanation, and the method specifically includes the following steps:

[0021] In step S102, a fuzzing request for the virtual machine is received.

[0022] The virtual machine can be any virtual machine that can run in a browser. For example, it can be a WebAssembly Virtual Machine (WASM VM). A WebAssembly VM is a component used to execute WebAssembly code. It can be integrated into web browsers and server-side environments, providing near-native code performance. The WASM VM can be used to load, verify, and execute WASM (a binary instruction format for stack-based virtual machines) modules and ensure that the code runs in a secure environment. It allows developers to compile code written in high-level languages ​​(such as C, C++, Rust, etc.) into WASM format and run it in a web environment with near-native performance. Fuzzing is an automated software testing technique that tests programs by generating a large amount of random or semi-random input data to discover errors, vulnerabilities, or abnormal behaviors. Fuzzing tools (fuzzers) can continuously provide this test data to the program under test to detect abnormalities such as crashes, illegal memory access, and data corruption based on the program's response. Fuzzing can be used to improve the security and stability of software.

[0023] In practice, the server can trigger fuzzing requests for virtual machines according to a preset detection period, or the server can also receive fuzzing requests for virtual machines triggered by users.

[0024] In step S104, in response to the fuzzing request, the test data carried in the fuzzing request is obtained.

[0025] The test data can be random or semi-random test data generated by a preset fuzzing tool (such as a fuzzer) for testing virtual machines.

[0026] In step S106, structural variation processing is performed on the test data based on the node connection relationship of each data node in the test data to obtain the first test data.

[0027] In practice, the server can perform file structure parsing on the test data. For example, the server can decompose the test data into header files and other part files, and then further analyze each part to extract control information and related data. The file structure parsing process can utilize the inherent control mechanism of the WASM format, enabling fuzz testing to accurately map the basic structure of the test data.

[0028] Then, the server can obtain the node connection relationship between data nodes in the test data based on the file structure information obtained from the file structure parsing process. Then, based on the connection relationship, the server can perform structural mutation processing on the test data for each data node in the test data.

[0029] Structural variation processing can involve adding or deleting node associations between nodes and their parent (or child) nodes. For example, assuming the test data contains data node 1, data node 2, and data node 3, where data node 1 is the parent node of data node 2, the server can perform structural variation processing on the test data based on this node connection relationship. Specifically, the server can delete the node connection relationship between data node 1 and data node 2, or the server can add a node connection relationship between data node 1 and data node 3 (such as making data node 3 a child (or parent) node of data node 1) to obtain the first test data.

[0030] Furthermore, the above-mentioned structural variation processing method is an optional and implementable processing method. In actual application scenarios, there can be a variety of different processing methods. Different processing methods can be selected according to different actual application scenarios. This specification does not specifically limit this in the embodiments.

[0031] In step S108, the first test data is subjected to structural repair processing to obtain second test data that meets the requirements for virtual machine operation.

[0032] In practice, since the test data obtained from structural variation processing may not be correctly parsed and executed during the testing process, in order to improve testing efficiency, the first test data can be structurally repaired to obtain the second test data that meets the requirements of virtual machine operation.

[0033] There can be a variety of structural repair processing methods. For example, the server can perform structural repair processing on the first test data according to a preset repair model to obtain the second test data that meets the requirements for virtual machine operation. The repair model can be a model built based on a preset machine learning algorithm. In addition, there can be a variety of different structural repair processing methods. Different structural repair processing methods can be selected according to different actual application scenarios. This specification does not specifically limit the embodiments in this way.

[0034] The structure repair mechanism can automatically repair the file structure that may be damaged during the mutation process, ensuring the executability of mutated files and improving fuzz testing efficiency.

[0035] In step S110, for the instruction nodes in the second test data, instruction mutation processing is performed on the second test data to obtain the target test data.

[0036] In implementation, the server can perform instruction mutation processing on the instruction nodes in the second test data according to the preset instruction mutation model to obtain the target test data. The preset instruction mutation model can be a model constructed according to a preset machine learning algorithm.

[0037] Alternatively, the server can perform instruction mutation processing on the instruction nodes in the second test data according to the preset instruction correspondence to obtain the target test data. For example, the server can obtain the instruction type to which the instruction of each instruction node belongs, and then obtain the mutation type corresponding to the instruction type to which the instruction of each instruction node belongs according to the preset instruction correspondence in Table 1 below, and then perform instruction mutation processing on the instruction of each instruction node according to the mutation type.

[0038] Table 1

[0039]

[0040] For example, assuming that the instruction corresponding to instruction node 1 belongs to the instruction type of insertion instruction, then according to the instruction correspondence shown in Table 1 above, it can be determined that the mutation type corresponding to this instruction node is deletion instruction. The server can perform instruction mutation processing on the instruction corresponding to instruction node 1 (that is, mutate the instruction corresponding to instruction node 1 into deletion instruction).

[0041] Furthermore, the above-mentioned instruction mutation processing method is an optional and implementable mutation processing method. In actual application scenarios, there can be a variety of different instruction mutation processing methods. Different methods can be selected according to different actual application scenarios. This specification does not specifically limit this.

[0042] In step S112, the virtual machine is subjected to fuzz testing based on the target test data.

[0043] In implementation, the server can perform fuzz testing on the virtual machine based on the target test data, monitor its runtime behavior, record and analyze behaviors that may lead to crashes or anomalies to identify potential security vulnerabilities. Then, the server can generate a security assessment result for the virtual machine based on the fuzz test results. The server can input the fuzz test results into a preset large language model to utilize the semantic extraction capabilities of the large language model to generate a security assessment result for the virtual machine.

[0044] In this way, if the server determines that a virtual machine does not meet security requirements based on the fuzzing results, it can generate a security remediation policy for that virtual machine based on the security assessment results. According to the security remediation policy, vulnerabilities and other anomalies discovered through fuzzing can be repaired so that the repaired virtual machine can meet the security requirements.

[0045] This specification provides a data processing method that involves receiving a fuzzing request for a virtual machine, responding to the request by acquiring test data carried in the fuzzing request, performing structural mutation processing on the test data based on the node connection relationships of each data node in the test data to obtain first test data, then performing structural repair processing on the first test data to obtain second test data that meets the virtual machine's operating requirements, performing instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data, and finally performing fuzzing processing on the virtual machine based on the target test data. This approach achieves two advantages: firstly, by deeply understanding the data structure of the test data and performing structural mutation processing on the test data based on the node connection relationships of each data node; and secondly, by using an efficient structural repair mechanism to repair the file structure that may be damaged during the structural mutation process, ensuring the executability of the first test data obtained through structural mutation processing, thus improving fuzzing efficiency. Then, by performing instruction mutation processing on the second test data obtained from the structural repair process, more complex target test data can be obtained. By performing fuzz testing on the virtual machine using the target test data, potential security vulnerabilities of the virtual machine can be discovered, improving the effectiveness and depth of virtual machine fuzz testing, promoting the patching of security vulnerabilities, and improving the security of the virtual machine.

[0046] In practical applications, step S106 involves structural variation processing of the test data based on the node connection relationships of each data node to obtain the first test data. The specific processing methods for this can vary; one optional method is provided below. Figure 2 As shown, the process may specifically include the following steps, S1062.

[0047] In step S1062, based on the character field of each data node in the test data, and considering the node connection relationship of each data node in the test data, structural variation processing is performed on the test data to obtain the first test data.

[0048] The character field may include a field for representing a set of bytes (BytesField) and / or a field for representing repetition (RepeatField).

[0049] In practice, by further subdividing different parts of the test data into nodes, a more detailed understanding and control of the binary file (i.e., the test data) can be achieved, laying the foundation for precise byte mutation processing (i.e., byte-level structural mutation processing).

[0050] The fields corresponding to data nodes in the test data can include: BytesField, RepeatField, UnsignedLeb128Field, SignedLeb128Field, and UIntNField. BytesField can represent a sequence of bytes (or an array of bytes, a set of bytes) and can be used to store binary data, such as images, audio files, or other binary formats. RepeatField can be used for a field that can repeat multiple times and can store a variable number of data items, such as lists or arrays. UnsignedLeb128Field can represent fields encoded using unsigned LEB128 (Little Endian Base 128) encoding, a variable-length encoding scheme for integers, particularly suitable for scenarios requiring efficient encoding of large ranges of integers. SignedLeb128Field can represent fields encoded using signed LEB128 encoding. The purpose of SignedLeb128Field is similar to unsigned LEB128, but it supports negative numbers. UIntNField can be used to represent a fixed-length unsigned integer field, where N represents the number of bits (e.g., UInt8Field represents an 8-bit unsigned integer). It can be used to store fixed-size integers, such as counters, status codes, or flags.

[0051] The server can perform structural mutation processing on the test data based on the node connection relationship of each data node in the test data according to BytesField and / or RepeatField to obtain the first test data, so as to achieve structural-level mutation, while adjusting child nodes to introduce changes and maintaining the integrity of the overall structure.

[0052] For example, the server can add or delete node connections for each data node in the test data based on the BytesField, or it can reverse the connection relationships for each data node in the test data based on the RepeatField.

[0053] In practical applications, the specific processing method for performing structural repair processing on the first test data in step S108 to obtain the second test data that meets the virtual machine running requirements can vary. Virtual machine running requirements include format specification requirements and logical specification requirements. Accordingly, the following provides one optional processing method, such as... Figure 2 As shown, the specific process may include the following steps, S1082.

[0054] In step S1082, the length field of the data nodes in the first test data is adjusted, and the dependencies and data flow between the data nodes in the first test data are corrected to obtain the second test data that meets the format specification requirements and logical specification requirements.

[0055] In implementation, the structural repair phase aims to restore the file (i.e., the first test data) after structural mutation processing to a structurally sound and executable file in the WASM runtime environment without reducing the effectiveness of the introduced mutations. This phase includes two main tasks: 1. length adjustment, and 2. dependency and data flow correction.

[0056] Length adjustment involves recalculating and adjusting the length attributes of various sections and nodes in the WASM file. Since structural variation processing may alter the byte size of sections or elements, the length field needs to be adjusted to ensure that the structurally repaired file conforms to the WASM format specification so that it can be correctly parsed and executed at runtime.

[0057] The dependency and data flow correction phase can use UnsignedLeb128Field, SignedLeb128Field, and UIntNField to check the relationships between different parts and elements, repair broken links, and ensure the logical consistency of data flow and dependencies.

[0058] In practical applications, the above step S110 involves performing instruction mutation processing on the instruction nodes in the second test data to obtain the target test data. The specific processing methods can vary widely, and instruction mutation can include byte-level mutation. Accordingly, the following provides an optional processing method, such as... Figure 2 As shown, the process may specifically include the following steps, S1102.

[0059] In step S1102, the second test data is subjected to instruction mutation processing based on the character field of the instruction node in the second test data to obtain a first instruction node that does not have the preset instruction semantics, and the target test data is determined based on the first instruction node.

[0060] In implementation, during the instruction mutation processing phase, the server can perform instruction mutation processing based on the analysis results of different fields in the WASM file structure. For example, when encountering a BytesField in an instruction node, the server can determine whether to perform instruction mutation processing on that instruction node using a byte mutation generator or an instruction mutation generator.

[0061] Since fuzzing can perform mutations unrelated to the specific instruction semantics, it is possible to perform instruction mutation processing on the second test data by using a byte mutator based on the character fields of the instruction nodes in the second test data, without considering the instruction semantics, to obtain a first instruction node that does not have the preset instruction semantics. This first instruction node that does not have the preset instruction semantics can be used to demonstrate the virtual machine's ability to run instructions that do not have the preset instruction semantics.

[0062] In practical applications, the above step S110 involves performing instruction mutation processing on the instruction nodes in the second test data to obtain the target test data. The specific processing methods can vary widely, and instruction mutation can include instruction-level mutation. Accordingly, the following provides an optional processing method, such as... Figure 2 As shown, the process may specifically include the following steps, S1104.

[0063] In step S1104, a preset mutation function is used to perform instruction mutation processing on the instruction nodes in the second test data to obtain a second instruction node with preset instruction semantics, and the target test data is determined based on the second instruction node.

[0064] The mutation function can include instruction addition functions (such as insertInstruction) and instruction removal functions (such as eraseInstruction). The insertInstruction function can randomly insert instructions into the data of relevant child nodes, allowing new behaviors or functions to be dynamically added to the code structure. The eraseInstruction function, on the other hand, can remove existing instructions from child nodes. By randomly erasing instructions, the impact on the robustness and behavior of the program can be evaluated.

[0065] In implementation, the server can use instruction mutants to prompt fuzzing to handle semantically sensitive mutations, processing data at a more granular instruction-aware level. For example, the server can use two mutation functions, instruction addition (such as insertInstruction) and instruction removal (such as eraseInstruction), to perform instruction mutation processing on the instruction nodes in the second test data, obtaining second instruction nodes with preset instruction semantics.

[0066] By introducing or removing instructions, the robustness of the WASM virtual machine running on the browser can be explored, thereby simulating potential points of failure or vulnerabilities.

[0067] In practical applications, the specific processing method for the instruction nodes in the second test data in step S110 above, which involves instruction mutation processing to obtain the target test data, can be varied. One optional processing method is provided below, such as... Figure 2 As shown, the specific process may include the following steps S1106 to S1108.

[0068] In step S1106, for the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the third test data.

[0069] In step S1108, using a preset large language model and based on a preset mutation strategy, the instruction nodes in the third test data are mutated to obtain the target test data.

[0070] The preset mutation strategy can include insertion strategy, injection strategy, and modification strategy.

[0071] In implementation, a pre-defined Large Language Model (LLM) can be integrated into the WebAssembly fuzzing process. Specifically, WASM instructions in the third test data can be converted into WebAssembly text format (WAT) and then input into the LLM to leverage the LLM's complex understanding and generation capabilities of the code, thereby enhancing the complexity of the application and exposing potential vulnerabilities.

[0072] The process of large language models mutating instruction nodes in test data can be controlled by preset mutation strategies. Each mutation strategy can be used to introduce or amplify specific aspects of code behavior (or structure). Specifically, under the insertion strategy, the task of LLM can be to insert new WAT instructions into third test data. This method aims to increase the overall complexity of the application and discover hidden vulnerabilities by complicating the execution path.

[0073] The modification strategy involves using LLM to modify existing parts of the third test data WAT ​​code, with the goal of increasing code complexity while ensuring minimal changes to control flow.

[0074] The injection strategy focuses on adding potentially vulnerable code snippets to the current third-party test data WAT ​​code. This strategy aims to simulate real-world attack vectors and test the application's resilience.

[0075] WAT (WebAssembly Text Format) is the text representation of WebAssembly. It's a human-readable format used for writing and editing WebAssembly code. A WAT file contains a series of instructions and declarations that can be converted into binary format by the WASM compiler for execution within the WASM virtual machine. The WAT format is similar to source code formats in other programming languages, but it's designed with a specific instruction set and semantics for WebAssembly. Through WAT, developers can more easily understand and debug WASM programs, and can also manually write or modify WASM code.

[0076] Integrating large language models into the fuzzing process can leverage their advanced semantic understanding capabilities to guide mutation strategies, thereby enhancing the complexity and coverage of test cases.

[0077] In practical applications, the above step S1108 utilizes a preset large language model and a preset mutation strategy to perform mutation processing on the instruction nodes in the third test data. The specific processing methods for obtaining the target test data can be varied. The following provides an optional processing method, which may specifically include the processing of the following steps A1 to A2.

[0078] In step A1, the code coverage corresponding to the target test data is determined based on the target test data and the preset code database.

[0079] In step A2, if the code coverage is less than the preset coverage threshold, the preset large language model is used to perform mutation processing on the instruction nodes in the third test data based on the preset mutation strategy to obtain the target test data.

[0080] In practice, since calling the large language model requires a lot of processing power in terms of both computing resources and time, the operating cost increases. In order to optimize the efficiency of the system and effectively manage resources, the frequency of LLM calls can be reduced based on code coverage.

[0081] Alternatively, a large language model (LLM) can be invoked only after no new path is found within a preset detection period (such as 5 minutes, 10 minutes, etc.). This ensures the effective use of LLMs, concentrating their powerful capabilities in scenarios where traditional methods have reached their effectiveness bottlenecks.

[0082] This approach strikes a balance between leveraging the advanced capabilities of LLM and controlling associated costs, offering the following advantages: 1. Cost efficiency, significantly reducing the costs associated with frequent LLM calls; 2. Resource optimization, using computing resources more effectively and ensuring they are allocated to where they have the greatest impact; 3. Performance improvement, maintaining high performance without the overhead of continuous LLM processing by calling LLM only when necessary.

[0083] Furthermore, this incremental application of LLM not only maximizes the utilization of existing resources but also reserves more computing power for critical issues, resulting in more accurate and efficient solutions.

[0084] In practical applications, the specific processing method for performing fuzz testing on the virtual machine based on the target test data in step S112 above can vary. The following provides one optional processing method, such as... Figure 2 As shown, the process may specifically include the following steps, S1122.

[0085] In step S1122, semantic checking is performed on the target test data, and fuzz testing is performed on the virtual machine based on the target test data that has passed the semantic checking.

[0086] In implementation, such as Figure 3 As shown, following the LLM-assisted mutation phase, it is crucial to perform semantic checks to verify the correctness of the mutated WAT code (i.e., the target test data). Semantic checks ensure that despite the introduced changes, the mutated code remains valid, executable, and reflects its intended functionality.

[0087] Semantic inspection can involve analyzing the mutated code to confirm whether the compiled code contains syntax errors, whether the logical structure has been preserved, and whether there are any unexpected changes in the program's behavior. This step strikes a balance between exploring the application's security boundaries and ensuring the relevance and applicability of the fuzzing process.

[0088] The structure-aware fuzzing method described above for the browser's WebAssembly (WASM) virtual machine can improve the security and stability of the WASM virtual machine. Traditional fuzzing methods, lacking a deep understanding of the WASM file structure, struggle to effectively detect potential security vulnerabilities during WASM runtime. By gaining a deeper understanding of the WASM file's internal structure and execution logic, test inputs more likely to trigger hidden vulnerabilities in the deep state space can be generated. Furthermore, LLM can be used to mutate the WASM file's instruction portion, and the mutated instruction portion can be integrated to generate complex fuzzing inputs (i.e., target test data), thereby improving the effectiveness and depth of fuzzing the browser's WASM virtual machine.

[0089] The above implementation method effectively enables fuzzing of browser WASM files, revealing potential security vulnerabilities and facilitating collaboration with developers to patch them. This structure-aware fuzzing approach provides robust security for the WASM virtual machine and sets a new standard for WebAssembly security testing.

[0090] This specification provides a data processing method that involves receiving a fuzzing request for a virtual machine, responding to the request by acquiring test data carried in the fuzzing request, performing structural mutation processing on the test data based on the node connection relationships of each data node in the test data to obtain first test data, then performing structural repair processing on the first test data to obtain second test data that meets the virtual machine's operating requirements, performing instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data, and finally performing fuzzing processing on the virtual machine based on the target test data. This approach achieves two advantages: firstly, by deeply understanding the data structure of the test data and performing structural mutation processing on the test data based on the node connection relationships of each data node; and secondly, by using an efficient structural repair mechanism to repair the file structure that may be damaged during the structural mutation process, ensuring the executability of the first test data obtained through structural mutation processing, thus improving fuzzing efficiency. Then, by performing instruction mutation processing on the second test data obtained from the structural repair process, more complex target test data can be obtained. By performing fuzz testing on the virtual machine using the target test data, potential security vulnerabilities of the virtual machine can be discovered, improving the effectiveness and depth of virtual machine fuzz testing, promoting the patching of security vulnerabilities, and improving the security of the virtual machine.

[0091] The above describes the data processing method provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a data processing device, such as... Figure 4 As shown.

[0092] The data processing device includes: a request receiving module 401, a data acquisition module 402, a first processing module 403, a structure repair module 404, a second processing module 405, and a testing module 406, wherein:

[0093] The request receiving module 401 is used to receive fuzzing requests for virtual machines;

[0094] The data acquisition module 402 is used to acquire the test data carried in the fuzz test request in response to the fuzz test request;

[0095] The first processing module 403 is used to perform structural variation processing on the test data based on the node connection relationship of each data node in the test data to obtain the first test data;

[0096] The structural repair module 404 is used to perform structural repair processing on the first test data to obtain second test data that meets the virtual machine operation requirements.

[0097] The second processing module 405 is used to perform instruction mutation processing on the second test data for the instruction nodes in the second test data to obtain the target test data;

[0098] The testing module 406 is used to perform fuzz testing on the virtual machine based on the target test data.

[0099] In this embodiment of the specification, the first processing module 403 is used for:

[0100] Based on the character field of each data node in the test data, and considering the node connection relationship of each data node in the test data, structural mutation processing is performed on the test data to obtain the first test data. The character field includes a field for representing a byte set and / or a field for representing repetition multiple times.

[0101] In this embodiment of the specification, the virtual machine operation requirements include format specification requirements and logical specification requirements. The structure repair module 404 is used for:

[0102] The length field of the data nodes in the first test data is adjusted, and the dependencies and data flow between the data nodes in the first test data are corrected to obtain the second test data that meets the format specification requirements and logical specification requirements.

[0103] In the embodiments described in this specification, the instruction variation includes byte-level variation, and the second processing module 405 is used for:

[0104] Based on the character fields of the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain a first instruction node that does not have the preset instruction semantics, and the target test data is determined based on the first instruction node.

[0105] In the embodiments described in this specification, the instruction variation includes instruction-level variation, and the second processing module 405 is used for:

[0106] By using a preset mutation function, the second test data is subjected to instruction mutation processing for the instruction nodes in the second test data to obtain a second instruction node with preset instruction semantics, and the target test data is determined based on the second instruction node. The mutation function includes an instruction addition function and an instruction removal function.

[0107] In this embodiment of the specification, the second processing module 405 is used for:

[0108] For the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the third test data;

[0109] Using a preset large language model and based on a preset mutation strategy, the instruction nodes in the third test data are mutated to obtain the target test data. The preset mutation strategy includes an insertion strategy, an injection strategy, and a modification strategy.

[0110] In this embodiment of the specification, the second processing module 405 is used for:

[0111] Based on the target test data and the preset code database, determine the code coverage corresponding to the target test data;

[0112] If the code coverage is less than a preset coverage threshold, the preset large language model is used to perform mutation processing on the instruction nodes in the third test data based on the preset mutation strategy to obtain the target test data.

[0113] In this embodiment of the specification, the test module 406 is used for:

[0114] The target test data is subjected to semantic inspection, and the virtual machine is subjected to fuzz testing based on the target test data that passes the semantic inspection.

[0115] This specification provides a data processing apparatus that receives a fuzzing request for a virtual machine, and in response to the fuzzing request, obtains the test data carried in the fuzzing request. Based on the node connection relationships of each data node in the test data, structural mutation processing is performed on the test data to obtain first test data. Then, structural repair processing is performed on the first test data to obtain second test data that meets the virtual machine's operating requirements. Based on the instruction nodes in the second test data, instruction mutation processing is performed on the second test data to obtain target test data. Finally, fuzzing processing is performed on the virtual machine based on the target test data. Thus, firstly, by deeply understanding the data structure of the test data and performing structural mutation processing on the test data based on the node connection relationships of each data node, and secondly, by using an efficient structural repair mechanism to repair the file structure that may be damaged during the structural mutation process, the executability of the first test data obtained through structural mutation processing is ensured, thereby improving fuzzing efficiency. Then, by performing instruction mutation processing on the second test data obtained from the structural repair process, more complex target test data can be obtained. By performing fuzz testing on the virtual machine using the target test data, potential security vulnerabilities of the virtual machine can be discovered, improving the effectiveness and depth of virtual machine fuzz testing, promoting the patching of security vulnerabilities, and improving the security of the virtual machine.

[0116] The above are the data processing apparatuses provided in the embodiments of this specification. Based on the same idea, the embodiments of this specification also provide a data processing device, such as... Figure 5 As shown.

[0117] The data processing device can provide terminal equipment or servers, etc., for the above embodiments.

[0118] Data processing devices can vary considerably depending on configuration or performance, and may include one or more processors 501 and memory 502. Memory 502 may store one or more application programs or data. Memory 502 may be temporary or persistent storage. The application programs stored in memory 502 may include one or more modules (not shown), each module including a series of computer-executable instructions for the data processing device. Furthermore, processor 501 may be configured to communicate with memory 502 and execute the series of computer-executable instructions stored in memory 502 on the data processing device. The data processing device may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input / output interfaces 505, and one or more keyboards 506.

[0119] Specifically, in this embodiment, the data processing device includes a memory and one or more programs, wherein one or more programs are stored in the memory, and one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the data processing device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0120] Receive fuzz test requests for virtual machines;

[0121] In response to the fuzzing request, obtain the test data carried in the fuzzing request;

[0122] Based on the node connection relationship of each data node in the test data, structural mutation processing is performed on the test data to obtain the first test data;

[0123] The first test data is subjected to structural repair processing to obtain second test data that meets the virtual machine's operating requirements;

[0124] For the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the target test data;

[0125] Based on the target test data, the virtual machine is subjected to fuzz testing.

[0126] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the data processing device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0127] This specification provides a data processing device that receives a fuzzing request for a virtual machine, responds to the fuzzing request by acquiring test data carried in the fuzzing request, performs structural mutation processing on the test data based on the node connection relationships of each data node in the test data to obtain first test data, then performs structural repair processing on the first test data to obtain second test data that meets the virtual machine's operating requirements, and performs instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data, and finally performs fuzzing processing on the virtual machine based on the target test data. In this way, firstly, by deeply understanding the data structure of the test data and performing structural mutation processing on the test data based on the node connection relationships of each data node in the test data, and secondly, by using an efficient structural repair mechanism to repair the file structure that may be damaged during the structural mutation process, the executability of the first test data obtained through structural mutation processing is ensured, thus improving fuzzing efficiency. Then, by performing instruction mutation processing on the second test data obtained from the structural repair process, more complex target test data can be obtained. By performing fuzz testing on the virtual machine using the target test data, potential security vulnerabilities of the virtual machine can be discovered, improving the effectiveness and depth of virtual machine fuzz testing, promoting the patching of security vulnerabilities, and improving the security of the virtual machine.

[0128] Furthermore, based on the above Figures 1 to 3 The method shown in this specification, along with one or more embodiments, also provides a storage medium for storing computer-executable instruction information. In one specific embodiment, the storage medium can be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can achieve the following process:

[0129] Receive fuzz test requests for virtual machines;

[0130] In response to the fuzzing request, obtain the test data carried in the fuzzing request;

[0131] Based on the node connection relationship of each data node in the test data, structural mutation processing is performed on the test data to obtain the first test data;

[0132] The first test data is subjected to structural repair processing to obtain second test data that meets the virtual machine's operating requirements;

[0133] For the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the target test data;

[0134] Based on the target test data, the virtual machine is subjected to fuzz testing.

[0135] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described storage medium embodiment is basically similar to the method embodiment, so the description is relatively simple; relevant parts can be referred to the description of the method embodiment.

[0136] This specification provides a storage medium that receives a fuzzing request for a virtual machine, responds to the fuzzing request by acquiring test data carried in the fuzzing request, performs structural mutation processing on the test data based on the node connection relationships of each data node in the test data to obtain first test data, then performs structural repair processing on the first test data to obtain second test data that meets the virtual machine's operating requirements, and performs instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data, and finally performs fuzzing processing on the virtual machine based on the target test data. In this way, firstly, by deeply understanding the data structure of the test data and performing structural mutation processing on the test data based on the node connection relationships of each data node in the test data, and secondly, by using an efficient structural repair mechanism to repair the file structure that may be damaged during the structural mutation process, the executability of the first test data obtained through structural mutation processing is ensured, thus improving fuzzing efficiency. Then, by performing instruction mutation processing on the second test data obtained from the structural repair process, more complex target test data can be obtained. By performing fuzz testing on the virtual machine using the target test data, potential security vulnerabilities of the virtual machine can be discovered, improving the effectiveness and depth of virtual machine fuzz testing, promoting the patching of security vulnerabilities, and improving the security of the virtual machine.

[0137] Furthermore, based on the above Figures 1 to 3 The method shown in this specification, along with one or more embodiments, also provides a computer program product including a computer program that, when executed by a processor, performs the following process:

[0138] Receive fuzz test requests for virtual machines;

[0139] In response to the fuzzing request, obtain the test data carried in the fuzzing request;

[0140] Based on the node connection relationship of each data node in the test data, structural mutation processing is performed on the test data to obtain the first test data;

[0141] The first test data is subjected to structural repair processing to obtain second test data that meets the virtual machine's operating requirements;

[0142] For the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the target test data;

[0143] Based on the target test data, the virtual machine is subjected to fuzz testing.

[0144] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the above-described embodiment of a computer program product is relatively simple in description because it is fundamentally similar to the method embodiment; relevant parts can be referred to the description of the method embodiment.

[0145] This specification provides a computer program product that receives a fuzzing request for a virtual machine, responds to the fuzzing request by acquiring test data carried in the fuzzing request, performs structural mutation processing on the test data based on the node connection relationships of each data node in the test data to obtain first test data, then performs structural repair processing on the first test data to obtain second test data that meets the virtual machine's operating requirements, and performs instruction mutation processing on the second test data based on the instruction nodes in the second test data to obtain target test data, and finally performs fuzzing processing on the virtual machine based on the target test data. Thus, firstly, by deeply understanding the data structure of the test data and performing structural mutation processing on the test data based on the node connection relationships of each data node, and secondly, by using an efficient structural repair mechanism to repair the file structure that may be damaged during the structural mutation process, the executableness of the first test data obtained through structural mutation processing is ensured, thereby improving fuzzing efficiency. Then, by performing instruction mutation processing on the second test data obtained from the structural repair process, more complex target test data can be obtained. By performing fuzz testing on the virtual machine using the target test data, potential security vulnerabilities of the virtual machine can be discovered, improving the effectiveness and depth of virtual machine fuzz testing, promoting the patching of security vulnerabilities, and improving the security of the virtual machine.

[0146] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0147] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0148] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0149] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0150] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0151] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0152] Embodiments in this specification are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0153] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0154] These computer program instructions can also be loaded onto a computer or other programmable device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0155] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0156] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0157] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0158] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0159] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0160] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0161] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0162] The above description is merely an embodiment of this specification and is not intended to limit this document. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A data processing method, comprising: Receive fuzz test requests for virtual machines; In response to the fuzzing request, obtain the test data carried in the fuzzing request; For each data node in the test data, the test data is subjected to structural mutation processing to obtain the first test data; wherein, the structural mutation processing includes adding or deleting node associations between a node and nodes with which it has a hierarchical relationship; The first test data is subjected to structural repair processing to obtain second test data that meets the virtual machine's operating requirements; For the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the target test data; Based on the target test data, the virtual machine is subjected to fuzz testing. The step of performing fuzz testing on the virtual machine based on the target test data includes: The target test data is subjected to semantic inspection, and the virtual machine is subjected to fuzz testing based on the target test data that passes the semantic inspection.

2. The method according to claim 1, wherein the step of performing structural variation processing on the test data based on the node connection relationship of each data node in the test data to obtain the first test data includes: Based on the character field of each data node in the test data, and considering the node connection relationship of each data node in the test data, structural mutation processing is performed on the test data to obtain the first test data. The character field includes a field for representing a byte set and / or a field for representing repetition multiple times.

3. The method according to claim 2, wherein the virtual machine operation requirements include format specification requirements and logical specification requirements, and the step of performing structural repair processing on the first test data to obtain second test data that meets the virtual machine operation requirements includes: The length field of the data nodes in the first test data is adjusted, and the dependencies and data flow between the data nodes in the first test data are corrected to obtain the second test data that meets the format specification requirements and logical specification requirements.

4. The method according to claim 1, wherein the instruction mutation includes byte-level mutation, and the step of performing instruction mutation processing on the second test data for the instruction nodes in the second test data to obtain the target test data includes: Based on the character fields of the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain a first instruction node that does not have the preset instruction semantics, and the target test data is determined based on the first instruction node.

5. The method according to claim 1, wherein the instruction mutation includes instruction-level mutation, and the step of performing instruction mutation processing on the second test data for the instruction nodes in the second test data to obtain the target test data includes: By using a preset mutation function, the second test data is subjected to instruction mutation processing for the instruction nodes in the second test data to obtain a second instruction node with preset instruction semantics, and the target test data is determined based on the second instruction node. The mutation function includes an instruction addition function and an instruction removal function.

6. The method according to claim 1, wherein the step of performing instruction mutation processing on the second test data for the instruction nodes in the second test data to obtain the target test data includes: For the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the third test data; Using a preset large language model and based on a preset mutation strategy, the instruction nodes in the third test data are mutated to obtain the target test data. The preset mutation strategy includes an insertion strategy, an injection strategy, and a modification strategy.

7. The method according to claim 6, wherein the step of using a preset large language model and based on a preset mutation strategy to mutate the instruction nodes in the third test data to obtain the target test data includes: Based on the target test data and the preset code database, determine the code coverage corresponding to the target test data; If the code coverage is less than a preset coverage threshold, the preset large language model is used to perform mutation processing on the instruction nodes in the third test data based on the preset mutation strategy to obtain the target test data.

8. A data processing apparatus, comprising: The request receiving module is used to receive fuzzing requests for virtual machines; The data acquisition module is used to respond to the fuzz test request and acquire the test data carried in the fuzz test request; The first processing module is used to perform structural variation processing on the test data based on the node connection relationship of each data node in the test data to obtain the first test data; wherein, the structural variation processing includes adding or deleting node association relationships between a node and nodes with which it has a hierarchical relationship; The structural repair module is used to perform structural repair processing on the first test data to obtain second test data that meets the virtual machine's operating requirements. The second processing module is used to perform instruction mutation processing on the second test data for the instruction nodes in the second test data to obtain the target test data; The testing module is used to perform fuzz testing on the virtual machine based on the target test data. The testing module is used to perform semantic inspection on the target test data and to perform fuzz testing on the virtual machine based on the target test data that has passed the semantic inspection.

9. A data processing apparatus, the data processing apparatus comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to: Receive fuzz test requests for virtual machines; In response to the fuzzing request, obtain the test data carried in the fuzzing request; For each data node in the test data, the test data is subjected to structural mutation processing to obtain the first test data; wherein, the structural mutation processing includes adding or deleting node associations between a node and nodes with which it has a hierarchical relationship; The first test data is subjected to structural repair processing to obtain second test data that meets the virtual machine's operating requirements; For the instruction nodes in the second test data, the second test data is subjected to instruction mutation processing to obtain the target test data; Based on the target test data, the virtual machine is subjected to fuzz testing. The step of performing fuzz testing on the virtual machine based on the target test data includes: The target test data is subjected to semantic inspection, and the virtual machine is subjected to fuzz testing based on the target test data that passes the semantic inspection.

Images