Virtual machine vulnerability mining method and device, equipment and storage medium

Abstract

The invention provides a virtual machine vulnerability mining method and device, equipment and a storage medium, and the method comprises the steps that a plurality of execution tracks of a plurality of input programs input into a virtual machine when the input programs are executed by the virtual machine are obtained, each input program corresponds to one execution track, and the execution tracks are no-vulnerability tracks when the virtual machine executes; according to the trajectory similarity of the execution trajectories, N target execution trajectories with the similarity meeting a preset condition are obtained from the execution trajectories, a target input program corresponding to each target execution trajectory is obtained, and N is a natural number; and according to each target execution track and the corresponding target input program, obtaining a test input program for mining virtual machine vulnerabilities through a large language model. According to the method provided by the invention, the technical effect of deeply mining the vulnerabilities of the virtual machine while ensuring the grammatical structure is realized.

Description

Technical Field

[0001] The present application relates to communication technology, and in particular to a virtual machine vulnerability mining method, device, equipment and storage medium. Background Art

[0002] Fuzz testing of virtual machines is a security testing method used to detect potential vulnerabilities and security issues in virtual machine software. In recent years, fuzz testing has become an effective technology for testing software systems, and fuzz testing technology has achieved remarkable success in the field of vulnerability detection.

[0003] The basic idea of ​​fuzz testing is to provide a large amount of random, abnormal or uncommon data to the virtual machine to observe how the system processes this input information, which helps to identify potential vulnerabilities and abnormal behaviors. In the prior art, the general fuzz testing technology is to generate a new input program through random mutation for execution to mine vulnerabilities inside the virtual machine. Since the input is a program, and a program usually has typical grammatical structure characteristics, if the input program does not meet the grammatical characteristics, it will not be able to run in the virtual machine, and thus cannot deeply mine the vulnerabilities inside the virtual machine.

[0004] In the existing fuzz testing methods, the new input program after random mutation may not conform to the grammatical structure, which reduces the efficiency of deep vulnerability mining inside the virtual machine. Summary of the invention

[0005] The present application provides a virtual machine vulnerability mining method, device, equipment and storage medium, which are used to solve the problem in the prior art that the input program generated by mutation using fuzzy testing technology cannot meet the legal structure and thus cannot deeply mine virtual machine vulnerabilities.

[0006] In a first aspect, the present application provides a virtual machine vulnerability mining method, comprising:

[0007] Acquire multiple execution traces of multiple input programs input into the virtual machine when the virtual machine executes the multiple input programs, wherein each input program corresponds to an execution trace, and the execution trace is a trace without vulnerabilities when the virtual machine executes the multiple input programs;

[0008] According to the trajectory similarities of the multiple execution trajectories, N target execution trajectories whose similarities meet a preset condition are obtained from the multiple execution trajectories, and a target input program corresponding to each target execution trajectory is obtained, wherein N is a natural number;

[0009] According to each target execution trajectory and the corresponding target input program, a test input program for mining virtual machine vulnerabilities is generated through a large language model.

[0010] Optionally, obtaining a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and a corresponding target input program includes:

[0011] Perform code analysis processing according to each target execution trajectory and the corresponding target input program to obtain the correlation between the program difference point and the trajectory difference point, wherein the program difference point is the difference part between the target input program and other target input programs, and the trajectory difference point is the trajectory corresponding to the difference part in the target execution trajectory;

[0012] According to the association between the program difference points and the trajectory difference points and the target coverage information, a test input program for mining virtual machine vulnerabilities is generated through the large language model, wherein the target coverage information includes the program and / or trajectory to be covered.

[0013] Optionally, acquiring, according to the trajectory similarities of the multiple execution trajectories, N target execution trajectories whose similarities satisfy a preset condition from the multiple execution trajectories includes:

[0014] According to the code lines in each execution trace, obtaining a feature vector corresponding to the execution trace;

[0015] For the multiple execution trajectories, obtaining the Euclidean distance between feature vectors corresponding to any two execution trajectories;

[0016] According to the ascending order of the multiple Euclidean distances, a preset number of target execution trajectories corresponding to the top-ranked Euclidean distances are obtained.

[0017] Optionally, the acquiring of multiple execution traces of multiple input programs input into the virtual machine when being executed by the virtual machine includes:

[0018] A preset number of probes deployed in the virtual machine are used to obtain multiple execution traces of multiple input programs input into the virtual machine when the programs are executed by the virtual machine; wherein the probes are pre-deployed in the virtual machine by using the plugging technology.

[0019] Optionally, after obtaining a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program, the method further includes:

[0020] Acquire a candidate crash type of the test input program according to target coverage information corresponding to the test input program;

[0021] According to the candidate crash type of the test input program, the test input program is stored in an input program set; wherein the test input programs in the input program set are classified and stored according to the candidate crash type.

[0022] Optionally, before obtaining the candidate crash type of the test input program according to the target coverage information corresponding to the test input program, the method further includes:

[0023] Determine whether the test input program and the corresponding test execution trajectory meet the target coverage information;

[0024] If so, determining that the test input program is valid;

[0025] If not, the test input program is discarded and a new test input program is generated.

[0026] Optionally, after obtaining a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program, the method further includes:

[0027] Inputting the test input program into the virtual machine;

[0028] Controlling the virtual machine to execute the test input program to determine whether the virtual machine has a vulnerability;

[0029] If yes, create a vulnerability report file, wherein the vulnerability report file includes a description of the vulnerability, a test input program that triggers the vulnerability, and a location of the vulnerability;

[0030] If not, a new test input program is obtained according to the execution trace corresponding to the test input program.

[0031] In a second aspect, the present application provides a virtual machine vulnerability mining device, comprising:

[0032] An acquisition module, used for acquiring a plurality of execution traces of a plurality of input programs input into a virtual machine when the input programs are executed by the virtual machine, wherein each input program corresponds to an execution trace, and the execution trace is a trace without vulnerabilities when the virtual machine executes the program;

[0033] The acquisition module is further used to acquire, according to the trajectory similarities of the multiple execution trajectories, N target execution trajectories whose similarities meet a preset condition from the multiple execution trajectories, and acquire a target input program corresponding to each target execution trajectory, wherein N is a natural number;

[0034] The generation module is used to generate a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program.

[0035] Optionally, the acquisition module is specifically used to:

[0036] Perform code analysis processing according to each target execution trajectory and the corresponding target input program to obtain the correlation between the program difference point and the trajectory difference point, wherein the program difference point is the difference part between the target input program and other target input programs, and the trajectory difference point is the trajectory corresponding to the difference part in the target execution trajectory;

[0037] According to the association between the program difference points and the trajectory difference points and the target coverage information, a test input program for mining virtual machine vulnerabilities is generated through the large language model, wherein the target coverage information includes the program and / or trajectory to be covered.

[0038] Optionally, the acquisition module is further used to:

[0039] According to the code lines in each execution trace, obtaining a feature vector corresponding to the execution trace;

[0040] For the multiple execution trajectories, obtaining the Euclidean distance between feature vectors corresponding to any two execution trajectories;

[0041] According to the ascending order of the multiple Euclidean distances, a preset number of target execution trajectories corresponding to the top-ranked Euclidean distances are obtained.

[0042] Optionally, the acquisition module is further used to:

[0043] A preset number of probes deployed in the virtual machine are used to obtain multiple execution traces of multiple input programs input into the virtual machine when the programs are executed by the virtual machine; wherein the probes are pre-deployed in the virtual machine by using the plugging technology.

[0044] Optionally, the generating module is specifically used to:

[0045] After generating a test input program for mining virtual machine vulnerabilities through a large language model based on each target execution trajectory and the corresponding target input program,

[0046] Acquire a candidate crash type of the test input program according to target coverage information corresponding to the test input program;

[0047] According to the candidate crash type of the test input program, the test input program is stored in an input program set; wherein the test input programs in the input program set are classified and stored according to the candidate crash type.

[0048] Optionally, the acquisition module is further used to:

[0049] Before obtaining the candidate crash type of the test input program according to the target coverage information corresponding to the test input program,

[0050] Determine whether the test input program and the corresponding test execution trajectory meet the target coverage information;

[0051] If so, determining that the test input program is valid;

[0052] If not, the test input program is discarded and a new test input program is generated.

[0053] Optionally, the generating module is further used to:

[0054] After generating a test input program for mining virtual machine vulnerabilities through a large language model based on each target execution trajectory and the corresponding target input program,

[0055] Inputting the test input program into the virtual machine;

[0056] Controlling the virtual machine to execute the test input program to determine whether the virtual machine has a vulnerability;

[0057] If yes, create a vulnerability report file, wherein the vulnerability report file includes a description of the vulnerability, a test input program that triggers the vulnerability, and a location of the vulnerability;

[0058] If not, a new test input program is obtained according to the execution trace corresponding to the test input program.

[0059] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0060] Memory stores computer-executable instructions;

[0061] The processor executes the computer execution instructions stored in the memory to implement various optional virtual machine vulnerability mining methods as in the first aspect.

[0062] In a fourth aspect, the present application provides a computer-readable storage medium, comprising computer execution instructions. When a processor executes the computer execution instructions, various optional virtual machine vulnerability mining methods such as the first aspect are executed.

[0063] In a fifth aspect, the present application provides a program product, which includes a computer program, and the computer program is executed by a processor to implement various optional virtual machine vulnerability mining methods such as the first aspect.

[0064] The virtual machine vulnerability mining method, device, equipment and storage medium provided by the present application obtain multiple execution trajectories of multiple input programs of the input virtual machine when they are executed by the virtual machine, wherein each input program corresponds to an execution trajectory, and the execution trajectory is a trajectory without vulnerabilities when the virtual machine is executed; according to the trajectory similarity of the multiple execution trajectories, N target execution trajectories whose similarity meets the preset conditions are obtained in the multiple execution trajectories, and the target input program corresponding to each target execution trajectory is obtained, wherein N is a natural number; according to each target execution trajectory and the corresponding target input program, a test input program for mining virtual machine vulnerabilities is obtained through a large language model. Thus, it is possible to use a large language model to generate a test input program that conforms to the grammatical structure according to the grammatical structure characteristics in the virtual machine, and further mine virtual machine vulnerabilities. The large language model ensures the legitimacy of the grammatical structure through its own advantages, avoids the legitimacy check of the test input program, and reduces the program execution time. At the same time, the generated test program can further mine the deep vulnerabilities of the virtual machine, improve the efficiency of vulnerability mining, and reduce the effect of the number of times the virtual machine is attacked. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0066] Figure 1 Virtual machine vulnerability mining method process provided in the embodiment of the present application Figure 1 ;

[0067] Figure 2 Virtual machine vulnerability mining method process provided in the embodiment of the present application Figure 2 ;

[0068] Figure 3 Virtual machine vulnerability mining method process provided in the embodiment of the present application Figure 3 ;

[0069] Figure 4 A schematic diagram of a virtual machine vulnerability mining device provided in an embodiment of the present application;

[0070] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0071] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0072] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0073] Fuzz testing of virtual machines is an important security test. By simulating malicious inputs and abnormal situations, it helps to discover and fix potential vulnerabilities in virtual machine software, operating systems, and applications, improve the security and stability of virtualized environments, prevent virtual machine escape attacks, and ensure isolation between virtual machines in cloud computing, reducing the risks brought by shared hardware.

[0074] In the prior art, fuzz testing technology can generate test input programs through random mutation to discover potential deep vulnerabilities in virtual machines. However, due to the mismatch between the grammatical structure features generated by random mutation and the grammatical structure features of the program in the virtual machine, it cannot further discover the vulnerabilities in the virtual machine.

[0075] Based on this, the present application proposes a method for virtual machine vulnerability mining, which analyzes the execution trajectory of the input program, establishes a correlation between the difference points between the input program and the execution trajectory, and uses a large language program model to generate an input program that conforms to the grammatical structure of the virtual machine, thereby ensuring the legitimacy of the generated grammatical structure, avoiding the grammar checking process, and improving the efficiency of virtual machine vulnerability mining.

[0076] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0077] Figure 1 A virtual machine vulnerability mining process provided in the embodiment of the present application Figure 1 .like Figure 1 As shown, the method includes:

[0078] S101, obtaining multiple execution traces of multiple input programs input into a virtual machine when the virtual machine executes the programs, wherein each input program corresponds to an execution trace, and the execution trace is a trace without vulnerabilities when the virtual machine executes the program;

[0079] In this embodiment, the execution trace is information about the program execution process recorded during the execution of the input program in the virtual machine, including the execution path and branch coverage information. The input program is a computer program used to perform vulnerability testing on the virtual machine.

[0080] Multiple input programs are input into the virtual machine in sequence, and then the virtual machine is run to execute them, and then a vulnerability-free execution trace corresponding to each input program is obtained.

[0081] S102, according to the trajectory similarities of the multiple execution trajectories, obtaining N target execution trajectories whose similarities meet a preset condition from the multiple execution trajectories, and obtaining a target input program corresponding to each target execution trajectory, where N is a natural number;

[0082] In this embodiment, the trajectory similarity refers to calculating the similarity between different execution trajectories using the Euclidean distance, that is, the size of the spatial distance between different execution trajectories. The target execution trajectory refers to selecting an execution trajectory whose similarity meets a preset condition. The preset condition refers to a user-defined threshold used to determine the target execution trajectory.

[0083] By using the Euclidean distance to calculate the similarity of multiple execution trajectories, and according to the calculation results, obtaining N execution trajectories that meet the preset conditions as target execution trajectories, and for each target execution trajectory, obtaining the corresponding input program as the target input program.

[0084] S103: Generate a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program.

[0085] In this embodiment, the test input program refers to a program generated by the large language model through sample learning and user demand instructions using the target execution trajectory and the target input program.

[0086] Based on the execution trace of each target and the corresponding target input program obtained as the learning sample of the large language model, the required test input program is generated through the natural language generation capability of the large language model to further explore the virtual machine vulnerabilities.

[0087] The present application provides a method, device, equipment and storage medium for mining vulnerabilities in a virtual machine. The method includes: obtaining multiple execution trajectories of multiple input programs of an input virtual machine when they are executed by the virtual machine, wherein each input program corresponds to an execution trajectory, and the execution trajectory is a trajectory without vulnerabilities when the virtual machine executes; according to the trajectory similarity of the multiple execution trajectories, obtaining N target execution trajectories whose similarity meets preset conditions in the multiple execution trajectories, and obtaining the target input program corresponding to each target execution trajectory, wherein N is a natural number; according to each target execution trajectory and the corresponding target input program, obtaining a test input program for mining vulnerabilities in the virtual machine through a large language model. The method of the present application achieves the technical effect of deeply mining vulnerabilities in the virtual machine while ensuring the grammatical structure.

[0088] Figure 2 A virtual machine vulnerability mining process provided in the embodiment of the present application Figure 2 .like Figure 2 As shown, based on the above embodiment, this embodiment describes in detail how to obtain the target execution trace and perform validity testing on the generated test input program. The method includes:

[0089] S201. Using a preset number of probes deployed in a virtual machine, obtain multiple execution traces of multiple input programs input into the virtual machine when the virtual machine executes the programs; wherein the probes are pre-deployed in the virtual machine by using the plug-in technology.

[0090] In this embodiment, the probe is a code segment deployed in a virtual machine using the instrumentation technology and used to collect execution traces.

[0091] A preset number of probes are deployed in the virtual machine using the instrumentation technology to obtain multiple execution traces of multiple input programs input into the virtual machine when they are executed in the virtual machine.

[0092] S202, obtaining a feature vector corresponding to each execution trace according to the code lines in each execution trace;

[0093] In this embodiment, the code lines in the execution trace refer to the code lines that the input program passes through during execution in the virtual machine. The feature vector refers to a vector composed of codes corresponding to the code lines in the execution trace.

[0094] The feature vector corresponding to the execution trajectory is obtained according to the encoding numbers corresponding to the code lines passed by the input program during execution in the virtual machine.

[0095] S203, for multiple execution trajectories, obtaining the Euclidean distance between feature vectors corresponding to any two execution trajectories;

[0096] In this embodiment, the Euclidean distance refers to the distance value between different execution trajectories, and is used to indicate the similarity or difference between different execution trajectories.

[0097] For multiple execution trajectories corresponding to multiple input programs, the feature vectors corresponding to any two execution trajectories are calculated using the Euclidean distance algorithm to obtain the similarity between different execution trajectories.

[0098] S204, according to the ascending order of the multiple Euclidean distances, obtaining a preset number of target execution trajectories corresponding to the Euclidean distances with the highest order;

[0099] In this embodiment, the different trajectories are sorted in ascending order according to the calculated Euclidean distances, and the corresponding preset N target execution trajectories with the highest Euclidean distances are obtained.

[0100] S205, performing code analysis processing according to each target execution trajectory and the corresponding target input program to obtain the correlation between the program difference point and the trajectory difference point, wherein the program difference point is the difference part between the target input program and other target input programs, and the trajectory difference point is the trajectory corresponding to the difference part in the target execution trajectory;

[0101] In this embodiment, each target execution trajectory and the corresponding target input program are processed through code analysis to obtain the correlation between the difference between the target input program and other target input programs and the trajectory corresponding to the difference in the target execution trajectory, that is, which part of the target input program will cause the execution trajectory to change. For example, the correlation between the difference point of the input program and the difference point of the trajectory can be expressed as<input1,path1> , where input1 is the target input program 1 and path1 is the target execution trajectory 1.

[0102] S206. Generate a test input program for mining virtual machine vulnerabilities through a large language model according to the correlation between program difference points and trajectory difference points and target coverage information, wherein the target coverage information includes programs and / or trajectories to be covered.

[0103] In this embodiment, the target coverage information refers to the programs and / or tracks to be covered defined by the user according to the requirements of the virtual machine vulnerability test. For example, the target coverage information is<s1,s2,s3,……> , where s1, s2, and s3 are different program path indicators.

[0104] According to the correlation between the difference points of the code analysis processing program and the difference points of the trajectory and the defined target coverage information as input, the large language model is used for sample learning and to generate a test input program for mining virtual machine vulnerabilities. For example, the prompt format of the virtual machine valid input program generated by the large language model is:

[0105] ###

[0106] You are a virtual machine fuzzer

[0107] Here is the code <code>used to be fuzzed

[0108] We illustrate the relationship between inputs and execution paths with some samples.

[0109] Code input,execution path=<input1,path1>

[0110] Code input,execution path=<input2,path2>

[0111] Code input,execution path=<input3,path3>

[0112] When we aim at the target statements<s1,s2,s3,……> ,please generate the corresponding input and its execution trace would cover target statements<s1,s2,s3,……>

[0113] ###

[0114] S207, determine whether the test input program and the corresponding test execution trajectory meet the target coverage information, if not, execute S208, if yes, execute S209;

[0115] In this embodiment, the corresponding test execution trace obtained by executing the test input program in the virtual machine is compared with the target coverage information to check whether the test execution trace has covered the target coverage information. If not, S208 is executed; if already covered, S209 is executed.

[0116] S208, discard the test input program and return to execute S206;

[0117] In this embodiment, if the corresponding test execution trace obtained by executing the test input program in the virtual machine does not meet the coverage target, the test input program is an invalid program and is discarded, and the test input program is regenerated using the large language model.

[0118] S209, determining that the test input program is valid;

[0119] In this embodiment, if the corresponding test execution trace obtained by executing the test input program in the virtual machine has covered the target coverage information, then the test input program is a valid program.

[0120] S210, obtaining candidate crash types of the test input program according to target coverage information corresponding to the test input program;

[0121] In this embodiment, the candidate crash type refers to a crash type that may be caused in a virtual machine vulnerability test according to the execution and coverage information of a test input program.

[0122] The target coverage information corresponding to the test input program that has been verified for validity is used to obtain the crash type that may be caused by the test input program as a candidate crash type.

[0123] S211 . According to the candidate crash types of the test input program, store the test input program into an input program set; wherein the test input programs in the input program set are classified and stored according to the candidate crash types.

[0124] According to the obtained candidate crash types of the test input program, the input program is classified and stored in the input program set according to the candidate crash types.

[0125] The present application provides a virtual machine vulnerability mining method, device, equipment and storage medium. The method uses Euclidean distance to screen out target execution trajectories provided to a large language model from multiple execution trajectories, thereby screening multiple execution trajectories according to similarity, reducing the complexity of trajectory analysis by the system, providing better learning samples for subsequent large language models, and performing validity checks on the input program to ensure the coverage of the generated test code on the code in the virtual machine.

[0126] Figure 3 A virtual machine vulnerability mining process provided in the embodiment of the present application Figure 3 .like Figure 3 As shown, based on the above embodiment, this embodiment describes in detail the process of using a virtual machine to mine vulnerabilities in a test input program. The method includes:

[0127] S301, inputting a test input program into a virtual machine;

[0128] In this embodiment, the test input program that has been checked for validity is input into the virtual machine.

[0129] S302, control the virtual machine to execute the test input program to determine whether the virtual machine has a vulnerability, if not, execute S303, if yes, execute S304;

[0130] In this embodiment, the input test input program is executed by controlling the virtual machine to determine whether a vulnerability occurs in the virtual machine. If no vulnerability occurs, S303 is executed; if a vulnerability is detected, S304 is executed.

[0131] S303, obtaining a new test input program according to the execution trace corresponding to the test input program;

[0132] In this embodiment, since the test input program does not detect a virtual machine vulnerability, a new test input program is obtained using a large language model according to the execution trace corresponding to the test input program.

[0133] S304: Create a vulnerability report file, wherein the vulnerability report file includes a description of the vulnerability, a test input program that triggers the vulnerability, and a location of the vulnerability.

[0134] In this embodiment, if the test input program detects a virtual machine vulnerability, a report file containing a description of the vulnerability, the test input program that triggers the vulnerability, and the location information of the vulnerability is automatically created.

[0135] The present application provides a virtual machine vulnerability mining method, device, equipment and storage medium. The method provides the established association relationship between program difference points and trajectory difference points and target coverage information to a large language model and generates a test input program, and then executes it in a virtual machine, thereby reducing the verification of the legitimacy of the grammatical structure, reducing the execution time of the virtual machine, and improving the effect of the test code on the ability to mine deep vulnerabilities in the virtual machine.

[0136] Figure 4 A schematic diagram of a virtual machine vulnerability mining device provided in an embodiment of the present application; Figure 4 As shown, the device comprises:

[0137] The acquisition module 401 is used to acquire multiple execution traces of multiple input programs input into the virtual machine when the virtual machine executes the multiple execution traces, wherein each input program corresponds to an execution trace, and the execution trace is a trace without vulnerabilities when the virtual machine executes the multiple execution traces;

[0138] The acquisition module 401 is further used to acquire N target execution trajectories whose similarities meet preset conditions from the multiple execution trajectories according to the trajectory similarities of the multiple execution trajectories, and acquire the target input program corresponding to each target execution trajectory, where N is a natural number;

[0139] The generation module 402 is used to generate a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program.

[0140] In a possible implementation, the acquisition module 401 is specifically used to:

[0141] Perform code analysis processing according to each target execution trajectory and the corresponding target input program to obtain the correlation between the program difference point and the trajectory difference point, wherein the program difference point is the difference part between the target input program and other target input programs, and the trajectory difference point is the trajectory corresponding to the difference part in the target execution trajectory;

[0142] According to the correlation between program difference points and trajectory difference points and target coverage information, a test input program for mining virtual machine vulnerabilities is generated through a large language model, wherein the target coverage information includes programs and / or trajectories to be covered.

[0143] In a possible implementation, the acquisition module 401 is further configured to:

[0144] According to the code lines in each execution trace, obtain the feature vector corresponding to the execution trace;

[0145] For multiple execution trajectories, obtain the Euclidean distance between the feature vectors corresponding to any two execution trajectories;

[0146] According to the ascending order of the multiple Euclidean distances, a preset number of target execution trajectories corresponding to the top-ranked Euclidean distances are obtained.

[0147] In a possible implementation, the acquisition module 401 is further configured to:

[0148] By using a preset number of probes deployed in the virtual machine, multiple execution traces of multiple input programs input into the virtual machine when being executed by the virtual machine are obtained; wherein the probes are pre-deployed in the virtual machine by means of the plugging technology.

[0149] In a possible implementation, the generation module 402 is specifically used to generate a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program.

[0150] Obtaining candidate crash types of the test input program according to target coverage information corresponding to the test input program;

[0151] According to the candidate crash types of the test input programs, the test input programs are stored in an input program set; wherein the test input programs in the input program set are classified and stored according to the candidate crash types.

[0152] In a possible implementation, the generating module 402 is further configured to, before obtaining the candidate crash type of the test input program according to the target coverage information corresponding to the test input program,

[0153] Determine whether the test input program and the corresponding test execution trajectory meet the target coverage information;

[0154] If so, the test input program is determined to be valid;

[0155] If not, the test input program is discarded and a new test input program is generated.

[0156] In a possible implementation, the generating module 402 is further configured to generate a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trace and the corresponding target input program.

[0157] Inputting a test input program into the virtual machine;

[0158] Control the virtual machine to execute the test input program to determine whether the virtual machine has a vulnerability;

[0159] If yes, create a vulnerability report file, wherein the vulnerability report file includes a description of the vulnerability, a test input program that triggers the vulnerability, and a location of the vulnerability;

[0160] If not, a new test input program is obtained according to the execution trace corresponding to the test input program.

[0161] Figure 5 Schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: at least one processor 501 and a memory 502. The device 50 also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0162] In the specific implementation process, at least one processor 501 executes the computer execution instructions stored in the memory 502, so that at least one processor 501 executes the above-mentioned virtual machine vulnerability mining method.

[0163] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0164] In the above Figure 5 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0165] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0166] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0167] The present application also provides a computer program product, including a computer program, which implements the above-mentioned virtual machine vulnerability mining method when executed by a processor.

[0168] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above-mentioned virtual machine vulnerability mining method is implemented.

[0169] The computer-readable storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0170] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0171] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0172] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0173] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0174] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0175] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0176] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.< / code>

Claims

1. A virtual machine vulnerability mining method, characterized in that: include: Acquire multiple execution traces of multiple input programs input into the virtual machine when the virtual machine executes the multiple input programs, wherein each input program corresponds to an execution trace, and the execution trace is a trace without vulnerabilities when the virtual machine executes the multiple input programs; According to the trajectory similarities of the multiple execution trajectories, N target execution trajectories whose similarities meet a preset condition are obtained from the multiple execution trajectories, and a target input program corresponding to each target execution trajectory is obtained, wherein N is a natural number; According to each target execution trajectory and the corresponding target input program, a test input program for mining virtual machine vulnerabilities is generated through a large language model.

2. The method according to claim 1, characterized in that The method generates a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program, including: Perform code analysis processing according to each target execution trajectory and the corresponding target input program to obtain the correlation between the program difference point and the trajectory difference point, wherein the program difference point is the difference part between the target input program and other target input programs, and the trajectory difference point is the trajectory corresponding to the difference part in the target execution trajectory; According to the association between the program difference points and the trajectory difference points and the target coverage information, a test input program for mining virtual machine vulnerabilities is generated through the large language model, wherein the target coverage information includes the program and / or trajectory to be covered.

3. The method according to claim 2, characterized in that The step of acquiring, according to the trajectory similarities of the plurality of execution trajectories, N target execution trajectories whose similarities satisfy a preset condition from the plurality of execution trajectories includes: According to the code lines in each execution trace, obtaining a feature vector corresponding to the execution trace; For the multiple execution trajectories, obtaining the Euclidean distance between feature vectors corresponding to any two execution trajectories; According to the ascending order of the multiple Euclidean distances, a preset number of target execution trajectories corresponding to the top-ranked Euclidean distances are obtained.

4. The method according to claim 1, characterized in that: The obtaining of multiple execution traces of multiple input programs input into the virtual machine when the multiple input programs are executed by the virtual machine includes: A preset number of probes deployed in the virtual machine are used to obtain multiple execution traces of multiple input programs input into the virtual machine when the programs are executed by the virtual machine; wherein the probes are pre-deployed in the virtual machine by using the plugging technology.

5. The method according to claim 2, characterized in that: After generating a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program, the method further includes: Acquire a candidate crash type of the test input program according to target coverage information corresponding to the test input program; According to the candidate crash type of the test input program, the test input program is stored in an input program set; wherein the test input programs in the input program set are classified and stored according to the candidate crash type.

6. The method according to claim 5, characterized in that Before obtaining the candidate crash type of the test input program according to the target coverage information corresponding to the test input program, the method further includes: Determine whether the test input program and the corresponding test execution trajectory meet the target coverage information; If so, determining that the test input program is valid; If not, the test input program is discarded and a new test input program is generated.

7. The method according to any one of claims 1 to 6, characterized in that: After generating a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program, the method further includes: Inputting the test input program into the virtual machine; Controlling the virtual machine to execute the test input program to determine whether the virtual machine has a vulnerability; If yes, create a vulnerability report file, wherein the vulnerability report file includes a description of the vulnerability, a test input program that triggers the vulnerability, and a location of the vulnerability; If not, a new test input program is obtained according to the execution trace corresponding to the test input program.

8. A virtual machine vulnerability mining device, comprising: An acquisition module, used for acquiring a plurality of execution traces of a plurality of input programs input into a virtual machine when the input programs are executed by the virtual machine, wherein each input program corresponds to an execution trace, and the execution trace is a trace without vulnerabilities when the virtual machine executes the program; The acquisition module is further used to acquire, according to the trajectory similarities of the multiple execution trajectories, N target execution trajectories whose similarities meet a preset condition from the multiple execution trajectories, and acquire a target input program corresponding to each target execution trajectory, wherein N is a natural number; The generation module is used to generate a test input program for mining virtual machine vulnerabilities through a large language model according to each target execution trajectory and the corresponding target input program.

9. An electronic device, comprising: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the virtual machine vulnerability mining method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the virtual machine vulnerability mining method according to any one of claims 1 to 7.

Images