A method for generating and scheduling seeds related to kernel fuzzing configuration

Abstract

The present invention discloses a method for generating and scheduling kernel fuzz test configuration-related seeds, which includes the following: 1. Configuration system call classification generation based on a large language model; 2. Test execution scheduling and generation based on behavior association; 3. Test efficiency optimization driven by configuration code association. Compared with the existing technology, the advantages of this invention are as follows: theoretically, it explores configuration-sensitive fuzz testing theory in kernel testing scenarios, constructs a kernel fuzz testing framework based on configuration sensitivity, and improves kernel defect detection capabilities and efficiency; technically, it deeply integrates large language models, relational learning, and dynamic analysis technologies, with technical characteristics and innovations; and in terms of application, it implements a kernel configuration code detection tool, intends to build code-related configuration detection services for the Linux mainline kernel and domestic open source operating system kernels, and improves kernel defect detection capabilities and automation levels.

Description

Technical Field

[0001] The present invention relates to the technical field of computer operating system kernels, and in particular to a method for generating and scheduling kernel fuzzy test configuration-related seeds. Background Art

[0002] The kernel is the core component of a computer operating system, responsible for managing the file system, I / O, scheduling, memory, and more. The kernel directly impacts system stability and efficiency, making its security extremely important. In recent years, numerous testing methods have emerged to detect vulnerabilities.

[0003] Fuzz testing is currently a mainstream software testing method. It uses automatic or semi-automatic methods to generate test cases, then inputs the test cases into the target system. During the execution of the test cases, it monitors abnormal system behavior to capture vulnerabilities. Currently, the application of fuzz testing in the field of kernel security has achieved good results.

[0004] Operating system kernel fuzz testing uses the system call sequence as the seed input in the fuzz testing process, generates random parameters and sequences for the operating system to execute, and monitors the operating system operation through defect detection tools in the kernel to discover abnormal states during the operating system operation.

[0005] In today's kernel fuzz testing field, seed-generated system calls usually do not involve system calls related to kernel dynamic configuration. First, due to the complexity and diversity of kernel configuration itself, generating configuration-related system calls becomes very difficult. Second, the uniqueness of kernel configuration means that configuration changes may have significant impacts. Unguided modification of kernel configuration may lead to irreversible serious consequences. Therefore, how to reasonably schedule configuration-related system calls is worthy of attention. However, how to reasonably schedule configuration-related system call seeds has not been deeply studied. Third, the application scenarios of configuration-related system calls in actual testing have not been deeply explored.

[0006] Seed generation is one of the key steps in fuzz testing. A reasonable seed generation scheme can significantly increase the probability of discovering vulnerabilities. The current kernel fuzz test seed generation does not take into account system calls related to kernel configuration modifications. Adding the generation of such system calls can better help improve the coverage collection and vulnerability discovery capabilities of kernel fuzz testing. Summary of the Invention

[0007] The technical problem to be solved by the present invention is to provide a method for generating and scheduling kernel fuzzy test configuration-related seeds in response to the deficiencies raised in the above-mentioned background technology.

[0008] To solve the above technical problems, the present invention provides a technical solution: a method for generating and scheduling kernel fuzz test configuration-related seeds, which includes the following: 1. Classification and generation of configuration system calls based on a large language model: Using a large language model to analyze the kernel feature configuration range, the gap between traditional use case descriptions and actual kernel configurations is studied, a unified representation of test input that integrates kernel configurations is constructed, and test specification templates for kernel fuzz test system calls are automatically generated, obtaining an initial corpus input that is highly relevant to kernel configuration items;

[0009] 2. Test execution scheduling and generation based on behavioral correlation: By constructing a correlation representation between configuration system calls and traditional system calls, we design a targeted use case scheduling and mutation mechanism for kernel configuration, enabling test execution that covers all feature configuration combinations. The correlation representation is a correlation table used to guide the generation of fuzz test seeds.

[0010] 3. Test efficiency optimization driven by configuration code association: Through feature code coverage extraction, build configuration-code association representation, improve the quality of configuration-related fuzz test output, and improve the utilization rate of configuration-related fuzz test output; through feature code coverage extraction, perform fuzz testing based on the generated fuzz test seeds and scheduling strategies, and collect code coverage.

[0011] Furthermore, the configuration system call classification generation based on the large language model specifically includes the following steps:

[0012] (1): Kernel dynamic configuration extraction and screening;

[0013] (2): Data structure classification;

[0014] (3): Dynamic configuration system call template generation;

[0015] (4): Pseudo system call classification generation based on large language model;

[0016] (5): Fuzz testing.

[0017] Furthermore, the kernel dynamic configuration extraction and screening specifically involves extracting all dynamic configuration options from the operating system kernel source code and screening out feature items that significantly affect kernel behavior;

[0018] The data structure classification specifically divides the kernel dynamic configuration items into Boolean, integer, floating-point and string types, etc., to facilitate subsequent processing;

[0019] The dynamic configuration system call template generation specifically includes: formulating generation strategies for different types of configuration items and writing pseudo system call templates;

[0020] The pseudo system call classification generation based on the large language model specifically includes using the large language model to analyze the value range of the kernel feature option, generating the system call to modify the dynamic configuration item and incorporating it into the seed generation tool;

[0021] The fuzzy test is specifically about optimizing the test efficiency based on configuration code association drive.

[0022] Furthermore, the test execution scheduling and generation based on behavior association specifically includes the following steps:

[0023] (1): Scheduling system calls based on the execution of configured behavior use cases;

[0024] (2): Minimize the system call sequence;

[0025] (3): Generation of execution use cases based on call associations.

[0026] Furthermore, the configuration behavior-based execution use case scheduling system call specifically inserts a recovery system call at the end of a sequence containing configuration-related system calls to ensure a stable kernel environment.

[0027] The system call sequence minimization specifically involves traversing the system call sequence in reverse, extracting the system calls that generate new coverage information, and obtaining a minimum sequence with unchanged coverage.

[0028] The execution case generation based on call association is specifically test execution scheduling and generation based on behavior association, performing static and dynamic combined correlation analysis on the minimized test cases, and using the obtained correlation table to guide the generation of fuzzy test seeds.

[0029] Furthermore, the test efficiency optimization based on configuration code association drive specifically includes the following steps:

[0030] (1): Continuous fuzz testing;

[0031] (2): Extract the code coverage of a single configuration system call;

[0032] (3): Establish a configuration item code relationship database;

[0033] (4): Input the target fuzz testing code location;

[0034] (5): Automatically enable configuration items related to the targeted code;

[0035] (6): Deep targeted fuzz testing.

[0036] Furthermore, the continuous fuzz testing specifically involves performing kernel fuzz testing for a long time using the previously generated fuzz testing seeds and scheduling strategies.

[0037] The extracting of the code coverage of a single configuration system call is specifically extracting the code coverage of a single configuration system call. After performing multiple long-term fuzz tests, the code coverage of the single configuration system call can be collected.

[0038] The establishment of the configuration item code relationship database is specifically to establish a database based on the code coverage of a single configuration item, and record the code location affected by the configuration item system call.

[0039] The input target fuzz test code location is specifically the input target code block, and the relevant configuration is searched in the database.

[0040] The automatic activation of the target code related configuration items is specifically to generate a system call sequence with a script and add the fuzz test sequence after finding the relevant dynamic configuration items.

[0041] The deep targeted fuzz testing specifically combines the original system calls and the targeted code-related configuration system calls to test and explore coverage and vulnerabilities.

[0042] The above solution of the present application has the following beneficial effects:

[0043] Theoretical aspects: Explore the configuration-sensitive fuzz testing theory in kernel testing scenarios, build a kernel fuzz testing framework based on configuration sensitivity, and improve kernel defect detection capabilities and efficiency.

[0044] Technical aspects: Deep integration of large language models, relational learning and dynamic analysis technology, with technical characteristics and innovation.

[0045] Application: Implement kernel configuration code detection tools, and plan to build code-related configuration detection services for the Linux mainline kernel and domestic open source operating system kernels to improve kernel defect detection capabilities and automation levels.

[0046] Other beneficial effects of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a flowchart of a method for scheduling generation of kernel fuzz testing configuration related seeds;

[0048] Figure 2 This is a schematic diagram of the research framework for configuration system call generation based on a large language model;

[0049] Figure 3 This is a comparison diagram between traditional system calls and pseudo system calls;

[0050] Figure 4 It is a schematic diagram of the execution use case scheduling based on the configuration behavior;

[0051] Figure 5 Generates a schematic diagram based on the execution use case associated with the call;

[0052] Figure 6 It is a schematic diagram of the static and dynamic detection framework;

[0053] Figure 7 This is a schematic diagram of a test efficiency enhancement framework based on configuration code association drive. DETAILED DESCRIPTION

[0054] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0055] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0056] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0057] The following is an explanation of the relevant professional terms of this application.

[0058] Operating System Kernel: The operating system kernel is the core component of the operating system, responsible for managing system hardware resources and providing basic services for upper-layer software. The kernel provides an interface for user programs to interact with the hardware through system calls and is responsible for key functions such as process management, memory management, and file system management.

[0059] Kernel dynamic configuration: Kernel dynamic configuration refers to kernel parameter configuration items that can be manually changed. These configuration items allow users and administrators to adjust kernel behavior and system performance while the operating system is running.

[0060] System calls: System calls are the interface between user-space programs and the kernel. When a user program requires operating system services (such as file operations, process control, and memory allocation), it initiates a system call. System calls are the programming interface provided by the operating system to applications for interaction with hardware or the kernel.

[0061] Kernel dynamic configuration related system calls: In this article, it specifically refers to system calls that modify kernel dynamic configuration item parameters.

[0062] Fuzz testing: Fuzz testing is an automated software program testing technique that detects vulnerabilities, abnormal behaviors, or security holes in the software by inputting random, invalid, or abnormal data into the software program.

[0063] Test Case: A test case is a specific test scenario or condition used during software testing to verify software functionality or performance. Each test case consists of a set of input data, expected output, and execution steps. In kernel fuzz testing, a test case represents a sequence of system calls.

[0064] Kernel fuzz testing: Fuzz testing tools pass random, abnormal, or invalid system call sequences to kernel system calls and observe how the system processes this data to discover potential vulnerabilities or abnormal behavior.

[0065] Code coverage is a metric used to measure the quality of software testing. It indicates how much of the code was executed and checked during testing. The primary purpose of code coverage is to ensure that as many code paths as possible are tested, thereby improving software reliability and stability. Code coverage can be accurately measured down to specific lines of code within the kernel.

[0066] Kernel-targeted fuzz testing: Kernel-targeted fuzz testing is a security testing technique primarily used to discover vulnerabilities in the operating system kernel and its modules. Its core concept is to test the robustness and security of kernel code by automatically generating large amounts of random or specially formatted input. Compared to standard fuzz testing, it focuses on testing specific modules or code.

[0067] Target: In fuzz testing, a target refers to the system component or function being tested. Targets are typically specific modules, functions, or interfaces within the operating system kernel that are vulnerable to exploitation by attackers. Target selection is crucial to the effectiveness of fuzz testing.

[0068] The present invention will be described in further detail below with reference to the accompanying drawings.

[0069] The seed generation schemes in the existing technology have their advantages and disadvantages. In actual use, multiple methods are usually combined to improve the comprehensiveness and effectiveness of the test. In kernel fuzz testing, choosing a suitable seed generation scheme can effectively improve the probability and efficiency of vulnerability discovery. However, the seed generation strategies mentioned above do not take into account the generation and scheduling of seeds related to kernel dynamic configuration items. In this regard, combined with the attached Figure 1 , the present invention adopts the following method:

[0070] A method for generating and scheduling kernel fuzz testing configuration-related seeds includes the following:

[0071] 1. Classification and generation of configuration system calls based on a large language model: This approach uses a large language model to analyze the range of kernel feature configurations, study the gap between traditional use case descriptions and actual kernel configurations, build a unified representation of test input that integrates kernel configurations, and automatically generate test specification templates for kernel fuzz testing system calls, obtaining an initial corpus input that is highly correlated with kernel configuration items.

[0072] 2. Test execution scheduling and generation based on behavioral correlation: By constructing a correlation representation between configuration system calls and traditional system calls, we design a targeted use case scheduling and mutation mechanism for kernel configuration, enabling test execution that covers all feature configuration combinations. The correlation representation is a correlation table used to guide the generation of fuzz test seeds.

[0073] 3. Test efficiency optimization driven by configuration code association: Based on feature code coverage extraction, we build a configuration-code association representation to improve the quality of configuration-related fuzz test output and increase the utilization rate of configuration-related fuzz test output. We perform fuzz testing based on the generated fuzz test seeds and scheduling strategies through feature code coverage extraction and collect code coverage.

[0074] Combine Figure 2-3 As shown in the figure, the configuration system call classification generation based on the large language model: the kernel feature configuration range is analyzed through the large language model, the gap between the traditional use case description and the actual kernel configuration is studied, a unified representation of the test input that integrates the kernel configuration is constructed, and the test specification template for the kernel fuzz test system call is automatically generated to obtain the initial corpus input that is highly relevant to the kernel configuration items.

[0075] (1) Kernel dynamic configuration extraction and screening: Extract all dynamic configuration options from the operating system kernel source code. These options are usually defined when the kernel is running and determine the kernel's functions and behaviors. Then, screen the extracted feature options, focusing on those that have a significant impact on kernel behavior and excluding some configuration items that are not related to kernel operation. The goal of this step is to identify options that have a critical impact on kernel features to ensure that the subsequently generated system calls can cover these core functions and features.

[0076] (2) Data structure classification: Classify the data structure types of kernel dynamic configuration items. Among the filtered dynamic configuration items, classify these dynamic configuration items into data structure types, which may include classification into Boolean, integer, floating-point and string types, etc., to facilitate subsequent processing and analysis. Through this classification, the type and generation strategy of each feature item can be systematically understood, thus laying the foundation for subsequent system call generation.

[0077] (3) Dynamic configuration system call template generation: Different generation strategies are formulated based on different types of configuration items obtained by data structure classification, and different dynamic configuration item pseudo system call templates are written to ensure that system calls that can be detected by fuzz testing tools can be generated. The reason for choosing to use pseudo system calls is that compared with traditional single system calls, it can achieve unified packaging of multiple system calls and can realize more functions. The differences between traditional system calls and pseudo system calls are as follows Figure 3 As shown, the pseudo system call function can achieve more functional encapsulation than the traditional system call, such as error detection during execution and result output.

[0078] (4) Generate pseudo system calls based on large language model classification: For different kernel feature options, use large language model to analyze the value range of its features, and formulate different generation strategies based on different types of features obtained by data structure classification, generate all pseudo system calls that modify dynamic configuration items, and ensure the validity of the generated pseudo system calls, such as Figure 3 The parameter range of the configuration item is 0 to 1, and the actual preset value is 0 to 2. A certain amount of invalid space is reserved to facilitate the observation of the behavior of the test case when processing the invalid interval, ensuring the depth and breadth of the test. All the filtered feature configuration items are sorted out and input into the fuzzifier as the initial corpus of the test.

[0079] (5) Fuzz testing: Use the previously generated fuzz test seeds and scheduling strategies to perform kernel fuzz testing for a long time. More specifically, the generated dynamic configuration related system calls are combined with the original system calls in the kernel fuzz testing tool to perform fuzz testing.

[0080] Combine Figure 4-6 As shown in the figure, test execution scheduling and generation based on behavior association: the problem of difficulty in reproducing related vulnerabilities is solved by scheduling execution cases based on configuration behavior, and the generation of configuration system calls is guided by generating execution cases based on call association.

[0081] (1) Scheduling system calls based on configuration behavior execution cases: For sequences containing configuration-related system calls, insert recovery system calls at the end to ensure kernel environment stability. Figure 4As shown, for a set of initial system call sequences, whenever there are one or more feature configuration system calls in the set of execution sequences, a corresponding recovery system call will be inserted at the end of the sequence execution. Each dynamic configuration system call has a corresponding recovery system call. The recovery system call is extracted from the kernel before each kernel fuzz test starts. It is a fixed value and is written as a normal system call that can be recognized by the kernel through the first step. The purpose is to restore the value modified by the feature configuration system call to the value of the initial state of the system after the recovery system call is executed, ensuring that the modification of the dynamic configuration system call will not affect the overall kernel, and thus affect the subsequent test process.

[0082] (2) System call sequence minimization: traverse the system call sequence in reverse order, extract the system calls that generate new coverage information, and obtain the smallest sequence with unchanged coverage. Specifically, a set of test data (i.e., system call sequence) is minimized. The minimization logic is to traverse the system call sequence in reverse order and extract the system calls that generate new coverage information. These system calls include ordinary system calls and feature-related system calls. In this way, a system call sequence that is as small as possible and with unchanged coverage can be obtained.

[0083] (3) Generation of execution use cases based on call association: Figure 5-6 As shown in the figure, we first perform static detection on the dynamic configuration-related system calls extracted from the kernel, and preliminarily build a correlation representation between configuration-related seed cases and common seed cases. This is used as the basis for test case generation and then put into test execution. During the execution process, each set of system call sequences is continuously collected, and dynamic analysis is performed based on the minimized system call sequences. The correlation representation between configuration-related seed cases and common seed cases is continuously improved to guide the generation of test cases and improve the breadth and depth of the test, including:

[0084] 1. Static detection: First, static detection is performed on the dynamic configuration related system calls extracted from the kernel. Based on the information contained in the system call itself and whether the same module is accessed, a string comparison mechanism is used to analyze the relationship between the configuration system call and the normal system call. For example, Figure 6 As shown in the figure, assuming that the cfg2 configuration system call modifies a configuration item under / proc / sys / net / netfilte, and sys1 and sys2 access the net directory and / net / netfilte respectively, it is determined that cfg2 has a certain association with sys1 and sys2, and the data in their relationship table are set to 5 and 10 respectively. The association degree increases by 5 for each additional identical string, and the association table is continuously maintained.

[0085] 2. Dynamic detection: During the test execution process, the fuzzer performs correlation analysis on each set of system call sequences actually tested. First, the system call sequence is minimized, that is, the system call sequence is traversed in reverse, and those system calls that generate new coverage information (including ordinary system calls and configuration-related system calls) are extracted to obtain a minimum system call sequence with the least number but does not affect the overall coverage. Then, the sequence is analyzed. If there is a configuration system call in the sequence, it is determined that it has a relationship with other ordinary system calls in the sequence. The data in the relationship table is set to 10, and it is combined with the correlation table obtained by static detection to form a static and dynamic combined correlation table.

[0086] 3. Use case generation guidance: Through a combination of static and dynamic analysis, the system call association table is continuously maintained during the test process. The sparse characteristics of the association table are used for optimization, and hash tables are used to improve retrieval efficiency. Based on the association table, after each instantiation of the system call, the data in the table is used to probabilistically generate the related configuration system call, thereby enhancing the configuration-sensitive kernel fuzz testing capabilities and efficiency.

[0087] Combine Figure 7 As shown in the figure, the test efficiency optimization based on configuration code association drive is carried out: the configuration-sensitive kernel fuzz testing is combined with the targeted fuzz testing to enhance the configuration fuzz testing capability and efficiency. Specifically, the output results of the dynamic configuration-sensitive kernel fuzz testing are used as the entry point to construct the association relationship representation between configuration-related system calls and kernel code to enhance the dynamic configuration-sensitive kernel fuzz testing capability under resource constraints.

[0088] Combine Figure 7 The test efficiency optimization based on configuration code association drive specifically includes the following steps:

[0089] (1) Continuous fuzz testing: Use the test cases and scheduling strategies generated in the above steps to conduct long-term continuous kernel fuzz testing, in order to better adjust the system call generation strategy of the kernel fuzz testing tool as much as possible and better explore and play the role of dynamic configuration in the fuzz testing process;

[0090] (2) Extracting the code coverage of a single configuration system call: Extracting the code coverage of a single configuration system call. After multiple long-term fuzz tests, the code coverage of a single configuration system call can be collected. This data shows the code location that can be directly affected by the change of this configuration item, which can help perform targeted fuzz testing.

[0091] (3) Establish a configuration item code relationship database: Establish a configuration item code relationship database based on the code coverage of a single configuration item, and record the code locations that can be directly affected by all configuration item system calls

[0092] (4) Input the target fuzz test code location: Input the target fuzz test code location, input the target code block for the program, and search the code block related configuration in the database in step 8. For example, for the targeted fuzz test of the net module, all dynamic configuration items related to the net module can be directly found in the configuration item code relationship database.

[0093] (5) Automatically enable configuration items related to the target code: After searching for dynamic configuration items related to the target code, the system call sequence of the relevant dynamic configuration items can be automatically generated through the script and synchronously added to the fuzz test system call sequence.

[0094] (6) Deep targeted fuzz testing: Utilize the original system calls and the configured system calls related to the target code to perform fuzz testing, so as to better explore the coverage and vulnerabilities related to the target.

[0095] The present invention proposes an innovative method, which can use a large language model to automatically generate targeted system calls related to dynamic configuration, and equip the generated configuration-related system calls and ordinary system calls with a comprehensive analysis and scheduling mechanism. This mechanism can effectively manage and schedule the generation and mutation of ordinary system calls and configuration-related system calls to ensure that they can cover a wider range of operating system kernel scenarios, thereby helping to discover more potential kernel vulnerabilities. At the same time, the present invention also conducts in-depth mining of relevant application scenarios of configuration-related system calls, establishes a configuration item code relationship database, and proposes a practical operation method for adding target-related kernel configuration items in kernel targeted fuzz testing.

[0096] Specifically, after analyzing the kernel configuration, the large language model can intelligently generate system calls suitable for specific kernel configurations. These system calls can trigger various boundary conditions and special scenarios, thereby revealing potential defects in the kernel implementation. In addition, the scheduling mechanism of this method ensures the effectiveness and efficiency of the testing process by intelligently sorting and adjusting the priority of the generated system calls. Based on the configuration item code relationship database obtained from multiple tests, it empowers kernel targeted fuzz testing, improves the code coverage related to the target, and safeguards kernel security. Through this system, the tool of the present invention significantly improves the coverage and depth of kernel targeted fuzz testing, providing a more powerful guarantee for the security of the operating system.

[0097] By adopting the above content, the present invention aims at the quality assurance of the operating system kernel and explores key technologies to improve the kernel fuzz testing defect detection capability and efficiency. By building a configuration-sensitive kernel fuzz testing framework, it systematically solves the problems of poor testing capability and lack of targeted testing in kernel configuration-related fields by fuzz testing methods. The specific features and innovations are reflected in:

[0098] Theoretical Innovation: This project addresses the current lack of kernel configuration-related detection capabilities in kernel fuzz testing. By addressing the contradiction between test input and test requirements, it explores configuration-sensitive fuzz testing theory in kernel testing scenarios. By building a kernel fuzz testing framework based on configuration sensitivity, it improves kernel defect detection capabilities and efficiency, demonstrating its theoretical uniqueness and innovation.

[0099] Technological Innovation: The project deeply integrates large language models, relational learning, and dynamic analysis technologies to propose a configuration-sensitive kernel fuzz testing method with certain technical characteristics and innovations. Specifically, the project uses a large language model to construct an initial corpus input that is highly relevant to the kernel configuration. It uses relational learning to analyze and schedule configuration-related test cases, and uses dynamic analysis technology to improve the utilization rate of configuration-related fuzz testing output.

[0100] Application innovation: The project implements a kernel configuration code detection tool based on the configuration kernel fuzz testing method. It plans to build code-related configuration detection services for the Linux mainline kernel and domestic open source operating system kernels, improve kernel defect detection capabilities and automation levels, and has certain application characteristics and innovations.

[0101] The above description of the present invention and its embodiments is non-limiting, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by the above, and does not deviate from the purpose of the invention, without creatively designing a structure and embodiment similar to the technical solution, they shall fall within the scope of protection of the present invention.

Claims

1. A method for generating and scheduling kernel fuzz testing configuration-related seeds, characterized by: It includes the following: Configuration system call classification generation based on a large language model: A large language model is used to analyze the value ranges of different kernel feature options. Different generation strategies are then formulated based on the different types of features obtained through data structure classification to generate pseudo system calls for modifying dynamic configuration items. Compared to traditional system calls, pseudo system call functions can encapsulate more functions. Behavior-association-based test execution scheduling and generation: First, statically inspect the dynamically configured system calls extracted from the kernel, initially constructing a representation of the association between configuration-related seed cases and common seed cases. This representation serves as the basis for test case generation and is then put into test execution. During execution, each set of system call sequences is continuously collected, and the representation of the association between configuration-related seed cases and common seed cases is continuously refined. Test efficiency optimization driven by configuration code association: extract the code coverage of a single configuration system call, conduct multiple long-term fuzz tests, collect the code coverage of a single configuration system call, establish a configuration item code relationship database based on the code coverage of a single configuration item, record the code locations that can be directly affected by all configuration item system calls, input the targeted fuzz test code location, input the targeted code block for the program, search the database for code block related configurations, generate the system call sequence of related dynamic configuration items and synchronously add it to the fuzz test system call sequence, use the original system call and the target code related configuration system call for fuzz testing, and explore the coverage and vulnerabilities related to the target to a greater extent.

2. A method for generating and scheduling kernel fuzz test configuration-related seeds according to claim 1, characterized in that: The configuration system call classification generation based on the large language model specifically includes the following steps: (1): Kernel dynamic configuration extraction and screening: Extract all dynamic configuration options from the operating system kernel source code and screen out the feature items that have a significant impact on kernel behavior; (2): Data structure classification: Kernel dynamic configuration items are divided into Boolean, integer, floating point and string types to facilitate subsequent processing; (3): Dynamic configuration system call template generation: formulate generation strategies for different types of configuration items and write pseudo system call templates; (4): Generate pseudo system calls based on large language model classification: Use large language model to analyze the value range of kernel feature options, generate system calls that modify dynamic configuration items and incorporate them into the seed generation tool; (5): Fuzz testing: content based on test efficiency optimization driven by configuration code association.

3. The method for generating and scheduling kernel fuzz test configuration-related seeds according to claim 1, characterized in that: The test execution scheduling and generation based on behavior association specifically includes the following steps: (1): Scheduling system calls based on the execution of configuration-related system calls: For sequences containing configuration-related system calls, a recovery system call is inserted at the end to ensure a stable kernel environment. (2): Minimize the system call sequence: traverse the system call sequence in reverse, extract the system calls that generate new coverage information, and obtain the minimum sequence with unchanged coverage; (3): Generation of execution cases based on call association: Test execution scheduling and generation based on behavior association, static and dynamic correlation analysis of the minimized test cases, and use the obtained correlation table to guide the generation of fuzzy test seeds.

4. The method for generating and scheduling kernel fuzz test configuration-related seeds according to claim 1, characterized in that: The test efficiency optimization based on configuration code association drive specifically includes the following steps: (1): Continuous fuzz testing: Use the previously generated fuzz test seeds and scheduling strategies to perform kernel fuzz testing for a long time; (2): Extracting the code coverage of a single configuration system call: Extracting the code coverage of a single configuration system call. After multiple long-term fuzz tests, the code coverage of a single configuration system call can be collected; (3): Establish a configuration item code relationship database: Establish a database based on the code coverage of a single configuration item to record the code location affected by the configuration item system call; (4): Enter the target fuzz test code location: Enter the target code block and search the database for related configurations; (5): Automatically enable the configuration items related to the target code: After finding the relevant dynamic configuration items, use the script to generate the system call sequence and add it to the fuzz test sequence; (6): Deep targeted fuzz testing: Combine the original system calls and the targeted code-related configuration system calls for testing to explore coverage and vulnerabilities.

Images