Parallel fuzzy testing method and system based on input domain division

Abstract

The application discloses a parallel fuzzy testing method and system based on input domain division, and comprises at least four steps of input domain division, sub-domain adaptive testing, sub-domain cooperation and sub-domain adjustment. The input domain of the fuzzy testing task is divided into a plurality of initial non-intersecting sub-domains with maximum difference according to the number of parallel instances. The local aggregation degree of seeds is calculated according to the distance between the seeds in the sub-domains. The selection order and energy of the seeds are adjusted according to the local aggregation degree and the test benefit. Then, spontaneous cooperation is carried out between the parallel fuzzy testing instances. Information sharing is carried out through the cooperation. The seeds exceeding the range of the sub-domains are dispatched to the sub-domains to which the seeds belong or the nearest sub-domains. The radius of the sub-domains receiving the cooperative seeds is adjusted. The overlapping degree between the sub-domains is checked regularly. When the overlapping degree is greater than a preset threshold, the input domain division is re-performed. The task conflict of the parallel fuzzy testing is effectively reduced, and the test efficiency is improved.

Description

Technical Field

[0001] This invention belongs to the technical field of software fuzzing, and mainly relates to a parallel fuzzing method and system based on input domain partitioning. Background Technology

[0002] With the widespread application of internet information technology and the development of the "software-defined" technology system, internet information technology has gradually integrated into all sectors of the country, and the importance of software security has become increasingly prominent. Fuzz testing, as an automated software testing technique, has greatly improved the efficiency of software testing. Since its inception, it has discovered a large number of undisclosed vulnerabilities in real software and has become an important tool for software testing and vulnerability discovery in many large technology companies. With the accelerating frequency of software version updates, how to perform faster and more comprehensive fuzz testing on the entire program has become a hot research topic in the industry. Parallel fuzz testing technology can extend traditional single-core fuzz testing to multi-core or multi-machine systems, aiming to improve the efficiency of fuzz testing by increasing the investment of computing resources.

[0003] Traditional parallel fuzzing simply involves periodically re-executing the seeds of all instances except itself to synchronize global test progress and avoid instances repeatedly exploring the same paths. However, this approach still suffers from significant redundant testing and does not achieve optimal results. Existing research primarily improves parallel fuzzing by enhancing task partitioning and synchronization, but some issues remain. Patent CN113590281A, "A Distributed Parallel Fuzzing Method and System Based on Dynamic Centralized Scheduling," proposes a distributed parallel fuzzing method based on dynamic centralized scheduling. This method uses a central scheduler node for centralized dynamic scheduling, prioritizing and allocating energy to the central node from a global perspective. Parallel instances then apply for seeds for further testing. Simultaneously, a computational power elastic allocation strategy is used to elastically allocate computing power for fuzzing and seed evaluation, thus avoiding bottlenecks caused by seed evaluation. While centralized scheduling enhances synchronization between different instances, this task partitioning and scheduling at the seed level itself consumes substantial resources.

[0004] The patent with publication number CN118069311A, entitled "A Parallel Fuzzing Task Conflict Mitigation Method, Apparatus, and Storage Medium," uses simhash to calculate hashes for the contents of all seeds and constructs a weighted undirected complete graph using the Hamming distance between seed hashes. Based on this, spectral clustering is used to partition the seeds to different parallel instances. This method assigns seeds with significant differences to different fuzzing instances; however, it lacks sufficient control over task execution during the fuzzing process.

[0005] The patent with publication number CN118535449A, entitled "A Method and System for Engine Task Partitioning Sensitive to Program Structure in Parallel Fuzzy Testing Scenarios," maintains the runtime control flow graph through static analysis and dynamic completion. Based on this, it identifies covered and uncovered boundary basic blocks, assigns these basic blocks to different parallel instances, and allows each parallel instance to select different test cases for testing based on its assigned target basic block. This method achieves task partitioning with a clear program structure objective, effectively reducing the generation and execution of invalid test cases. However, the analysis and dynamic completion of the program structure incur significant overhead in large programs with complex structures.

[0006] In summary, current research and published patents in the field of parallel fuzzing still have the following unresolved issues: ① Low task partitioning efficiency: The method of partitioning tasks through static analysis of information is difficult to apply to large-scale programs, limiting the application scenarios of parallel fuzzing. ② Lack of control over task execution: Many works partition tasks well during the partitioning phase, but lack intervention in the fuzzing execution process, resulting in parallel instances not exploring effectively within the tasks. ③ Lack of collaboration among task instances: Due to the randomness of the fuzzing process, each parallel instance is difficult to be completely independent during execution. Existing parallel fuzzing instances are relatively independent during the task execution phase, lacking a collaborative mechanism. Summary of the Invention

[0007] This invention addresses the problems existing in the prior art by proposing a parallel fuzzing method and system based on input domain partitioning. First, based on the distance difference in seed execution coverage feedback, the input domain of the fuzzing task is divided into multiple initially disjoint subdomains with maximized differences, according to the number of parallel instances. Next, the local aggregation degree of the seeds is calculated based on the distance between seeds within each subdomain. The selection order and energy of the seeds are adjusted based on the local aggregation degree and testing benefits, achieving dynamic adjustment of computational resource allocation and comprehensive coverage of the input domain. Then, parallel fuzzing instances collaborate, scheduling seeds outside their own subdomains to their own or nearest subdomains for mutation testing, and adjusting the radius of subdomains receiving collaborative seeds. Finally, the overlap between subdomains is checked periodically; when the overlap exceeds a preset threshold, the input domain is re-partitioned. This method divides the input domain of parallel fuzzing into different subdomains, constrains different parallel instances to be tested within these subdomains, and enables information sharing between parallel instances through collaboration, effectively reducing task conflicts in parallel fuzzing and improving testing efficiency.

[0008] To achieve the above objectives, the technical solution adopted by this invention is: a parallel fuzzy testing method based on input domain partitioning, comprising the following steps:

[0009] S1. Input domain partitioning: Based on the distance difference of the seed execution coverage feedback, the input domain of the fuzzing test task is divided into multiple initially disjoint subdomains with maximum difference according to the number of parallel instances. Each subdomain consists of a subdomain center and a subdomain radius.

[0010] S2, Subdomain Adaptive Testing: Calculate the local aggregation degree of seeds based on the distance between seeds within the subdomain, and adjust the selection order and energy of seeds based on the local aggregation degree and test benefits to achieve scheduling of computing resources and uniform coverage of the input domain;

[0011] S3, Subdomain Collaboration: Parallel fuzz test instances spontaneously collaborate to relocate seeds that exceed their own subdomain range to their own or nearest subdomain. Subdomains that receive collaborative seeds adjust their radii.

[0012] S4. Subdomain Adjustment: Periodically check the overlap between subdomains. When the overlap exceeds the preset threshold, return to step S1 and re-divide the input domain.

[0013] As an improvement of the present invention, in step S1, the coverage feedback after seed execution is compressed into a bitmap, and the Hamming distance between the two bitmaps is the distance between the two input seeds; the subdomain center is the n seeds that are farthest from each other among all seeds in the current input domain, where n is the number of parallel instances; after selecting the subdomain center, all seeds in the input domain are divided into subdomains using the nearest allocation principle, and the subdomain radius is the maximum distance between the seeds in the subdomain and the subdomain center.

[0014] As another improvement of the present invention, the specific method for seed partitioning in the input domain in step S1 is as follows: select the two seeds with the largest distance as the initial subdomain centers, and determine the remaining n-2 subdomain centers using the maximum-minimum distance method based on the number of parallel instances n (n≥2).

[0015]

[0016] Where Q represents all non-subdomain centers in the current input domain, C represents the currently selected subdomain center, D represents the buffer distance between two seeds, and c ′ To select the next subdomain center;

[0017] After selecting a new subdomain center, add it to the set C of the nearest selected subdomain centers, and continue to select the next farthest subdomain center until a subdomain center is assigned to all parallel instances; assign all seeds in the input domain to the nearest subdomain center.

[0018] As another improvement of the present invention, the method for calculating the local aggregation degree of the seed in step S2 is specifically as follows:

[0019]

[0020] Where A s Let be the local aggregation degree of seed s, D be the Hamming distance between the two seed stake point cover bitmaps, and Q be the local aggregation degree of seed s. i Let i be the set of seeds within the subdomain i;

[0021] The specific test benefits of the seed are as follows:

[0022]

[0023] Where d(s) is the number of offspring that trigger new coverage and are added to the seed queue after one round of mutation of seed s, and fuzz_level(s) is the number of times seed s is selected and subjected to one round of mutation test;

[0024] The seed energy adjustment factor f(s) is calculated as follows:

[0025]

[0026] in For the normalized local aggregation degree, The normalized test return is represented by α, which is the memory factor.

[0027] As another improvement of the present invention, the subdomain collaboration step S3 specifically includes the following steps:

[0028] S31: After a parallel instance discovers a new interesting seed, it determines whether the seed is within the current subdomain based on the subdomain center and subdomain radius. If the new seed is not within the subdomain of the current instance, proceed to step S32. If the new seed is within the subdomain of the current instance, add the new seed to the seed queue of the current instance for the next mutation test.

[0029] S32: Determine its distance from the center of all subdomains and forward it to the nearest subdomain;

[0030] S33: According to step S32, the subdomain of the cooperative seed is received, the seed is added to the seed queue of the fuzzy test instance, and the distance between the seed and the center of the subdomain is calculated. If the distance is greater than the radius of the subdomain, the radius is adjusted to the distance between the cooperative seed and the center of the subdomain.

[0031] As a further improvement of the present invention, the method for calculating the subdomain overlap in step S1 is as follows:

[0032]

[0033] Where overlap(i,j) is the overlap degree between subdomains i and j, Q i and Q jThese are the seed sets in the input domain whose distance from the center of subdomains i and j is less than the radius of the corresponding subdomain.

[0034] To achieve the above objectives, the present invention also adopts the following technical solution: a parallel fuzzy testing system based on input domain partitioning, comprising at least an input domain update and partitioning module, a subdomain adaptive testing module, and a cooperative scheduling module.

[0035] The input domain update and partitioning module is used to summarize all newly discovered seeds in the system, calculate and cache the distance between the deduplicated seeds, and update the distribution of the test domain; it also includes monitoring the degree of subdomain overlap and partitioning the input domain into subdomains as appropriate.

[0036] The subdomain adaptive testing module: based on the subdomain allocated by the input domain update and partitioning module, completes the seed selection, energy allocation, and mutation execution process within the subdomain to complete the adaptive testing of the subdomain; at the same time, it transmits the newly discovered seeds to the input domain update and partitioning module;

[0037] The collaborative scheduling module exists among parallel instances. When an instance mutates and discovers a new seed that is not within its own subdomain, it schedules the seed to the instance that is closest to it. When a new seed is received, it determines whether it needs to be retained. If it is retained, the subdomain radius is adjusted according to the distance of the collaborative seed from the center of the subdomain.

[0038] Compared with the prior art, the present invention has the following advantages:

[0039] (1) The method of this invention uses an input domain-based partitioning approach to divide the task. Based on the distribution of the input domain, the farthest subdomain center is determined, and all seeds are assigned to the nearest subdomain, achieving efficient task partitioning. Compared with existing parallel fuzzy testing task partitioning methods, this method has higher efficiency and stronger scalability.

[0040] (2) The method of this invention restricts the testing of different parallel instances in different subdomains by limiting the subdomain radius, thereby constraining the execution process of the subtasks of parallel fuzzing and reducing the redundancy caused by the randomness of fuzzing during execution. At the same time, the local aggregation degree of each seed is calculated in the subdomain, and the allocation of computing resources is adjusted according to the differences in the distribution of each seed in the input subdomain, so as to achieve a more balanced and comprehensive test in the subdomain.

[0041] (3) In the fuzzing test process, each parallel instance of the present invention shares all the subdomain centers and radii, and effectively coordinates the valuable seeds that exceed the subdomain range during the random test process, realizing lightweight coordination between parallel instances, and effectively utilizing the benefits brought by each random mutation under the premise that the tasks are relatively independent. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of a parallel fuzz testing method based on input domain partitioning;

[0043] Figure 2 This is a schematic diagram of a parallel fuzz testing system architecture based on input domain partitioning. Detailed Implementation

[0044] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0045] Example 1

[0046] A parallel fuzz testing method based on input domain partitioning, such as Figure 1 As shown, it includes the following steps:

[0047] Step S1: Input domain partitioning: Based on the distance difference of the seed execution coverage feedback, the input domain of the fuzzing test task is divided into multiple initially disjoint subdomains with maximum difference according to the number of parallel instances. Each subdomain consists of a subdomain center and a subdomain radius.

[0048] Based on the bitmap of the stub points after seed execution, the Hamming distance between seeds is calculated to analyze the distribution of the input domain. The n farthest seeds are selected as subdomain centers based on the number of parallel instances, and the remaining seeds are assigned to the nearest subdomain centers. The maximum distance from a seed within a subdomain to its center is taken as the subdomain radius.

[0049] The resulting cover bitmap (trace_bits) is compressed. Each bit in the compressed cover bitmap (trace_min_i) represents the coverage of a stake point. The Hamming distance of the compressed cover bitmap is used as the metric for the distance between seeds. Therefore, the distance between seeds s1 and s2 is calculated as follows: Where n is the number of stake points inserted in the program being tested. and These represent the coverage of the i-th stake point by seeds s1 and s2, respectively. This indicates that the seed execution path does not cover the stub. This indicates the stub points covered by the seed execution path. Using the Hamming distance as the evaluation criterion for the input domain distribution, the distances between seeds are cached using an upper triangular matrix.

[0050] First, select the two seeds with the largest distance as the initial subdomain centers. Then, based on the number of parallel instances n (n≥2), use the maximum-minimum distance method to determine the remaining n-2 subdomain centers:

[0051]

[0052] Where Q represents all non-subdomain centers in the current input domain, C represents the currently selected subdomain center, D represents the buffer distance between two seeds, and c ′ The next subdomain center to be selected. After each new subdomain center is selected, it is added to the set C of the nearest selected subdomain centers, and the next farthest subdomain center is selected, until a subdomain center is assigned to all parallel instances.

[0053] All seeds in the input domain are assigned to the nearest subdomain center, and the maximum distance of all seeds in the subdomain from the subdomain center is calculated as the subdomain radius.

[0054] Step S2, Subdomain Adaptive Testing: Parallel fuzz test instances are tested on seeds within subdomains. The local aggregation degree of the seeds is calculated based on the distance between seeds within the subdomain. The selection order and energy of the seeds are adjusted based on the local aggregation degree and test benefits, thereby achieving the scheduling of computing resources and uniform coverage of the input domain.

[0055] Based on the distribution of seeds within the subdomain, the local aggregation degree of each seed is calculated. Seeds in sparse regions within the subdomain are prioritized for testing and allocated more initial energy. For seeds that have completed at least one mutation test, their test benefits are calculated and evaluated, and their energy is adjusted accordingly.

[0056] First, calculate the local aggregation degree of all seeds within the subdomain, as follows: Where A s Let be the local aggregation degree of seed s, D be the Hamming distance between the two seed stake point cover bitmaps, and Q be the local aggregation degree of seed s. i Let i be the set of seeds within the range of subdomain i.

[0057] Next, calculate the test payoff for seeds within the subdomain. During the testing process, the payoff for each seed mutation test is updated after selecting a seed for mutation. The calculation method is as follows: Where d(s) is the number of offspring that trigger new coverage and are added to the seed queue after one round of mutation of seed s, and fuzz_level(s) is the number of times seed s is selected and subjected to one round of mutation test.

[0058] Energy is adjusted based on the local aggregation degree of the seed and the testing benefit, allocating computational resources to regions within the input subdomain where test cases are sparsely distributed and exploration value is high. Normalized local aggregation degree needs to be calculated. and normalized test benefits The seed energy adjustment factor f(s) is calculated as follows:

[0059]

[0060] Where α is the memory factor, which reduces the influence of local aggregation degree as the number of seed test rounds increases, and is usually set to 0.1. Finally, the influence factor is applied to the original energy of AFL++ to amplify or reduce the energy: p(s) = p o (s)·2 8 ·f(s)-4 , where p o (s) represents the energy allocated for the original AFL++ calculation.

[0061] Step S3, Subdomain Collaboration: Parallel fuzz test instances spontaneously collaborate. After discovering a new seed, the instances will schedule seeds that are outside their own subdomain to their own or the nearest subdomain. The subdomain that receives the collaborative seed will adjust its radius.

[0062] When a parallel instance discovers a new interesting seed, it determines whether the seed is within the current subdomain based on its distance from the current subdomain center. If the new seed is not within the current instance's subdomain, it forwards it to the nearest subdomain. Upon receiving a cooperative seed, the subdomain adds the seed to the fuzzy test instance's seed queue and calculates the distance between the seed and the subdomain center. If the distance is greater than the subdomain radius, the radius is adjusted to the distance between the cooperative seed and the subdomain center. The specific algorithm is as follows:

[0063]

[0064]

[0065] As seen in Algorithm 1, after discovering a new interesting seed, the parallel fuzzing instance calculates the distance between the new seed and the center of the subdomain. If this distance is greater than the radius of the current subdomain, it calculates the distance to the centers of the remaining subdomains and forwards the new seed to the nearest subdomain for collaboration. Upon receiving a collaborative seed, the instance deduplicates the seed, adds it, and calculates the distance to the center of the subdomain. If this distance is greater than the radius of the subdomain, it modifies the subdomain radius to the distance between the current collaborative seed and the center of the subdomain.

[0066] Step S4, Subdomain Adjustment: Periodically check the overlap between subdomains. When the overlap exceeds a preset threshold, re-divide the input domain.

[0067] After receiving the new seeds aggregated from the parallel instances, the primary instance deduplicates them, calculates the Hamming distance for the valuable new seeds, and caches them. Every 10 minutes, it calculates the overlap between subdomains. The specific calculation method for the overlap between subdomains is as follows: Where overlap(i,j) is the overlap degree between subdomains i and j, Q i and Q j These are the seed sets in the input domain whose distance from the center of subdomains i and j is less than the radius of the corresponding subdomain.

[0068] If the overlap between two instances exceeds a threshold, the input domain division in step S1 is performed again, and the parallel instances are notified to update the subdomain range. In this embodiment, the threshold can be set to 0.5.

[0069] Example 2

[0070] A parallel fuzz testing system based on input domain partitioning, implementing the method described in Example 1, has the following system structure: Figure 2 As shown, it consists of at least three parts: an input domain update and partitioning module, a subdomain adaptive testing module, and a collaborative scheduling module.

[0071] The input domain update and partitioning module iterates through and summarizes all newly discovered seeds from parallel instances, updates and maintains the currently discovered input domain, and simultaneously partitions the input domain into disjoint subdomains. This module consists of four sub-modules: a seed aggregation and deduplication component, a distance calculation and caching component, an input domain partitioning component, and a subdomain overlap detection component. The seed aggregation and deduplication component collects newly discovered seeds from all parallel instances during fuzzing, performs deduplication on the main instance to discard seeds that trigger duplicate coverage, and retains all seeds that trigger new coverage. The distance calculation and caching component calculates the distance between newly added global seeds and other seeds in the seed queue. It starts asynchronously based on the signal of a newly added seed in the seed queue, providing support for subsequent input domain partitioning. The input domain partitioning component uses distance to evaluate the distribution of the input domain, selects the farthest seed as the subdomain center based on the number of parallel instances, and partitions all seeds to each subdomain center as close as possible, using the maximum distance between a seed and the subdomain center within a subdomain as the subdomain radius. The subdomain overlap monitoring module starts cyclically at short time intervals, evaluates the subdomain overlap based on the intersection of seeds within each subdomain, and dynamically re-partitions and adjusts the input domain when the subdomain range changes, resulting in a large overlap.

[0072] The subdomain adaptive testing module tests seeds within a subdomain and adjusts resource allocation during testing based on their local aggregation level and the returns after computational resource investment. This module consists of three sub-modules: an aggregation degree evaluation component, a return evaluation component, and an energy control component. The aggregation degree evaluation component assesses the local aggregation level of a seed within the subdomain based on its distance from other seeds. The return evaluation component evaluates the return of seeds within the subdomain based on the number of mutations and the number of newly discovered seeds. The energy control component amplifies or reduces the energy of seeds within the subdomain based on their local aggregation degree and return, tilting computational resources towards seeds with lower local aggregation degrees and higher returns.

[0073] The collaborative scheduling module receives seeds that exceed the subdomain's range from the subdomain adaptive testing module and sends them to their assigned or nearest subdomain, adjusting the subdomain's range accordingly. This module comprises two parts: a seed subdomain identification component and a subdomain range adjustment component. The seed subdomain identification component evaluates the distance between seeds exceeding the current subdomain's range and the centers of other subdomains, identifies the subdomain to which it should belong or its nearest neighbor, and forwards it to the corresponding subdomain for subsequent mutation testing. The subdomain range adjustment component activates when a seed exceeds the range of its forwarded destination subdomain, adjusting the radius of the destination subdomain to include the forwarded seed within its subdomain's range.

[0074] In summary, this invention discloses a parallel fuzzing method and system based on input domain partitioning. According to the distance difference in seed execution coverage feedback, the input domain of the fuzzing task is divided into multiple initially disjoint subdomains with maximized differences based on the number of parallel instances. Parallel fuzzing instances test on seeds within subdomains, calculating the local aggregation degree of seeds based on the distance between seeds within subdomains. The selection order and energy of seeds are adjusted based on the local aggregation degree and testing benefits, achieving dynamic adjustment of computational resource allocation and comprehensive coverage of the input domain. Parallel fuzzing instances collaborate, scheduling seeds exceeding their own subdomain range to their own or nearest subdomain for mutation testing. Subdomains receiving collaborative seeds adjust their radii. The overlap between subdomains is periodically checked; when the overlap exceeds a preset threshold, the input domain is re-partitioned. This method achieves efficient task partitioning, and parallel instances can effectively and evenly test the partitioned subtasks, thereby improving resource utilization efficiency and ultimately enhancing the effectiveness of parallel fuzzing, discovering vulnerabilities in the program.

[0075] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A parallel fuzz testing method based on input domain partitioning, characterized in that, The method comprises the following steps: S1, input domain division: according to the distance difference of the seed execution coverage feedback, the input domain of the fuzz testing task is divided into a plurality of initial non-intersecting sub-domains with maximum difference according to the number of parallel instances, and the sub-domain is composed of a sub-domain center and a sub-domain radius; S2, sub-domain adaptive testing: the local aggregation degree of the seed is calculated according to the distance between the seeds in the sub-domain, the selection order and energy of the seed are adjusted according to the local aggregation degree and the test yield, the scheduling of the computing resources and the uniform coverage of the input domain are realized; wherein the local aggregation degree calculation method is specifically: ； wherein is a seed of local degree of polymerization, is a Hamming distance between two seed post coverage bitmaps, is a seed set in a sub-domain The test yield of the seed is specifically: ； wherein seed the number of offspring that are triggered to new coverage and added to the seed queue after one round of mutation, seed the number of times selected and tested for one round of mutation S3, sub-domain coordination: spontaneous coordination is performed between the parallel fuzz testing instances, the seeds exceeding the range of the sub-domain are scheduled to the sub-domain to which the seeds belong or the nearest sub-domain, and the radius of the sub-domain receiving the coordinated seeds is adjusted; S4, sub-domain adjustment: the overlap degree between each sub-domain is checked regularly, when the overlap degree is greater than a preset threshold, the input domain division is performed again in step S1; the calculation method of the sub-domain overlap degree is: ； wherein is the overlap degree between the sub-domain and , respectively, is the distance from the center of the sub-domain and to the seed set, respectively, is the distance from the center of the sub-domain and to the input domain.

2. The parallel fuzz testing method based on input domain partitioning of claim 1, wherein: In step S1, the coverage feedback after the seed execution is compressed into a bitmap, the Hamming distance of two bitmaps is the distance between two input seeds; the sub-domain center is the n farthest seeds among all seeds of the current input domain, and n is the number of parallel instances; after the sub-domain center is selected, all seeds in the input domain are divided into the sub-domain using the nearest allocation principle, and the sub-domain radius is the maximum value of the distance between the seeds in the sub-domain and the sub-domain center.

3. The parallel fuzz testing method based on input domain partitioning of claim 2, wherein: The specific method for seed partitioning in the input domain in step S1 is as follows: select the two seeds with the largest distance as the initial subdomain centers, and then partition the subdomains according to the number of parallel instances. Use the maximum-minimum distance method to determine the remaining Subdomain center: ； wherein, is the seed for the current input domain, is the currently selected sub-domain center, is the distance between two seeds, is the next sub-domain center to be selected; Each time a new subdomain center is selected, it is added to the set of selected subdomain centers and the next farthest subdomain center is selected until a subdomain center is assigned to all parallel instances; all seeds in the input domain are assigned to the nearest subdomain center.

4. The parallel fuzz testing method based on input domain division according to claim 1, characterized in that: Seed energy adjustment factor is calculated as follows: ； wherein is the normalized local degree of polymerization is the normalized test yield, is the memory factor.

5. The parallel fuzz testing method based on input domain partitioning of claim 1, wherein: The step S3 of sub-domain coordination specifically comprises the following steps: S31: after the parallel instance finds a new interesting seed, it is judged whether the new seed is in the current sub-domain according to the sub-domain center and the sub-domain radius; if the new seed is not in the sub-domain range of the current instance, step S32 is entered; if the new seed is in the sub-domain range of the current instance, the new seed is added to the seed queue of the current instance for mutation testing; S32: the distance of the new seed from all sub-domain centers is judged, and the new seed is forwarded to the nearest sub-domain; S33: according to step S32, the sub-domain receiving the coordinated seed adds the seed to the seed queue of the fuzz testing instance and calculates the distance between the seed and the sub-domain center, and if the distance is greater than the sub-domain radius, the radius is adjusted to the distance between the coordinated seed and the sub-domain center.

6. A parallel fuzz testing system based on input domain partitioning, implementing the method of claim 1, characterized in that: The method comprises at least an input domain updating and division module, a sub-domain adaptive testing module and a coordination scheduling module, The input domain updating and division module: used for collecting all newly found seeds in the system, calculating and caching the distance between the seeds after deduplication, updating the distribution of the test domain, monitoring the sub-domain overlap degree, and dividing the input domain into sub-domains; The sub-domain adaptive testing module: according to the sub-domain allocated by the input domain updating and division module, the seed selection, energy allocation and mutation execution process are completed within the sub-domain range, the adaptive testing of the sub-domain is completed, and the newly found seed is transmitted to the input domain updating and division module; The cooperative scheduling module: exists between parallel instances, when the instance variation finds a new seed not in its own sub-domain, the seed is scheduled to the nearest instance; after receiving the new seed, it is judged whether it needs to be retained, and after retention, the sub-domain radius is adjusted according to the distance of the cooperative seed from the center of the sub-domain.

Images