An integrated fuzz testing method based on code semantic similarity

Abstract

The present invention discloses an integrated fuzz testing method based on code semantic similarity. The method includes first obtaining a benchmark code base and performing fuzz testing and function-level code slicing to obtain the total edge coverage index of each fuzz testing tool, performing function-level code slicing and encoding processing on the code base to be tested to obtain the total score index of each fuzz testing tool, performing index amplification processing on the total score index according to the total edge coverage index to obtain a new total score index, and using a dynamic resource balancing adjustment method to continuously perform fuzz testing on the code base to be tested according to the new total score index, and finally obtaining the bitmap coverage and the amount of vulnerabilities detected by all fuzz testing tools on the code base to be tested. Based on code semantic similarity, the present invention proposes an integrated fuzz testing method that combines an index amplification method and a dynamic resource balancing adjustment method, which improves the bitmap coverage and the amount of detected vulnerabilities of the fuzz test and realizes more efficient dynamic allocation of computing resources.

Description

Technical Field

[0001] The present invention belongs to the technical field of fuzz testing, and in particular relates to an integrated fuzz testing method based on code semantic similarity. Background Art

[0002] As information systems continue to grow in complexity, automated vulnerability detection technologies are playing an increasingly critical role in software security. Fuzzing, a testing method that automatically generates inputs to trigger anomalous program behavior, is widely used in security testing and program verification due to its simplicity and efficiency. Currently, there are a variety of mature fuzz testing tools, such as AFL, QSYM, Angora, and RedQueen, which optimize testing performance in different dimensions, such as improving path coverage, increasing input diversity, and shortening the time to discover defects.

[0003] Despite this, in practice, the effectiveness of different fuzz testing tools varies significantly, with their adaptability limited by factors such as program structure, input interface complexity, and control flow depth. For example, AFL excels at handling high-frequency mutations in shallow logic, while Angora is more suitable for parsing deep structured code with complex path conditions. Without prior knowledge of a new program under test, it is often difficult to prioritize which fuzzer to use, and it is also difficult to effectively coordinate resource allocation strategies among multiple fuzzers, resulting in wasted resources for some tools and even reduced overall testing efficiency.

[0004] To this end, some research has attempted to combine multiple strategies through ensemble fuzzing frameworks. However, current mainstream approaches often employ fixed or heuristic fuzzer combinations, lacking awareness of code features and quantitative modeling of fuzzer adaptability. Furthermore, resource scheduling mechanisms are often statically configured, failing to dynamically optimize based on real-time performance metrics fed back by the fuzzer during testing. These factors limit the portability and adaptability of fuzz testing across different software systems.

[0005] On the other hand, programs contain a large number of transferable structural features and semantic fragments, such as common input parsing functions, error handling paths, and state transition logic. These code fragments recur in different forms across multiple code bases and exhibit strong semantic similarity. If we can develop a feature representation method based on code semantics, compare function-level code fragments across different code bases, and combine this with the performance of historical fuzzers tested on similar structures, we can intelligently recommend the most suitable fuzzer for new programs, thereby improving testing efficiency and reducing resource overhead.

[0006] Therefore, it is urgent to propose a fuzz testing optimization method based on code semantic representation and historical testing experience, combine function-level code slicing, vectorized modeling and similarity measurement, and establish an intelligent mechanism for fuzzer recommendation and resource scheduling to achieve an efficient, portable and scalable automated vulnerability detection process, breaking through the bottlenecks of existing fuzz testing in generalization ability and resource utilization. Summary of the Invention

[0007] In order to solve the problems existing in the background technology, the present invention provides a fuzz testing and dynamic resource adjustment method based on code semantic similarity, which solves the technical problems of insufficient generalization ability and resource utilization of existing fuzz testing methods.

[0008] The technical solutions adopted in the present invention include:

[0009] 1. An integrated fuzz testing method based on code semantic similarity

[0010] S1. Obtain several benchmark code bases, use multiple fuzz testing tools to perform comprehensive processing on each benchmark code base to obtain several function-level vectors of each benchmark code base and the total edge coverage and index of each fuzz testing tool on the benchmark code base, and obtain the optimal fuzz testing tool for each function-level vector based on the total edge coverage and index and function-level vector.

[0011] S2. Obtain the code base to be tested, perform function-level code slicing and encoding processing on the code base to be tested to obtain several function-level vectors to be tested of the code base to be tested, obtain the total score and index of each fuzz testing tool based on the function-level vector, the optimal fuzz testing tool of the function-level vector and the function-level vector to be tested, and perform index amplification processing on the total score based on the total edge coverage and index to obtain the new total score and index of all fuzz testing tools in the code base to be tested.

[0012] S3. Based on the new total score index of all fuzz testing tools, a dynamic resource balancing adjustment method is used to continuously perform fuzz testing on the code base to be tested, and finally the bitmap coverage and the number of detected vulnerabilities of all fuzz testing tools on the code base to be tested are obtained.

[0013] The benchmark code base is a code base covering different programming languages, application fields, and code complexity. The code base to be tested includes code bases in the image processing field and code bases in the embedded database field. The fuzz testing tool is an automated tool for software testing.

[0014] The step S1 is specifically as follows:

[0015] S11. Obtain several benchmark code bases, use multiple fuzz testing tools to perform fuzz testing on each benchmark code base, and obtain the edge coverage of each fuzz testing tool on each benchmark code base.

[0016] S12. Use a static analysis tool to perform function-level code slicing on each benchmark code base to obtain several function-level code snippets for each benchmark code base.

[0017] S13. According to the edge coverage of each fuzz testing tool on each benchmark code base and several function-level code snippets of each benchmark code base, the edge coverage of each fuzz testing tool on each function-level code snippet is obtained using the gcov parsing method.

[0018] S14. Count the total edge coverage of all function-level code snippets of each fuzz testing tool, and sort the total edge coverage of each fuzz testing tool from high to low to obtain the total edge coverage index of each fuzz testing tool.

[0019] S15. For each function-level code snippet, select the fuzz testing tool corresponding to the highest edge coverage as the optimal fuzz testing tool for the corresponding function-level code snippet.

[0020] S16. Use the UniXcoder model to encode each function-level code snippet to obtain a function-level vector, and then the optimal fuzz testing tool for the function-level code snippet is also used as the optimal fuzz testing tool for the corresponding function-level vector.

[0021] The step S2 is specifically as follows:

[0022] S21. Obtain a code base to be tested, and use a static analysis tool to perform function-level code slicing on the code base to be tested to obtain several function-level code snippets to be tested of the code base to be tested.

[0023] S22. Use the UniXcoder model to encode each function-level code snippet to obtain a function-level vector to be tested.

[0024] S23. Process each function-level vector to be tested and all function-level vectors of the benchmark code library using a cosine similarity method to obtain similarity values ​​between each function-level vector to be tested and each function-level vector.

[0025] S24. For each function-level code snippet to be tested, the highest similarity value is selected from the similarity values ​​between the function-level vector to be tested and all function-level vectors corresponding to the function-level code snippet to be tested as the most similarity value of the function-level vector to be tested, and then as the most similarity value of the corresponding function-level code snippet to be tested.

[0026] S25. The optimal fuzz testing tool of the function-level vector corresponding to the most similarity value is used as the optimal fuzz testing tool of the function-level vector to be tested, and then the optimal fuzz testing tool of the function-level vector to be tested is also used as the optimal fuzz testing tool of the corresponding function-level code fragment to be tested.

[0027] S26. Use the similarity update method based on cyclomatic complexity to process the most similarity value of each function-level code snippet to be tested, and obtain the most similarity value of each function-level code snippet to be tested after processing; the most similarity value of each function-level code snippet to be tested after processing is used as the score of the corresponding fuzz testing tool.

[0028] The cyclomatic complexity is an indicator that measures the complexity of a function or code snippet, and is mainly used to evaluate the structural complexity and testing difficulty of the code.

[0029] S27. For the code base to be tested, the total score of each fuzz testing tool in all function-level code snippets to be tested is counted, that is, the total score of each fuzz testing tool on the code base to be tested is obtained, and the total scores of each fuzz testing tool are sorted from high to low to obtain the total score index of each fuzz testing tool.

[0030] S28. Use the index amplification method to process the total score of the fuzz testing tool on the code base to be tested, and obtain a new total score and index of each fuzz testing tool in the code base to be tested.

[0031] The similarity updating method based on cyclomatic complexity in step S26 is specifically as follows:

[0032] D1. Using the cyclomatic complexity calculation method for each function-level code snippet to be tested, obtain the cyclomatic complexity of the function-level code snippet to be tested.

[0033] D2. Process each function-level code snippet to be tested using a cyclomatic complexity weight adjustment method according to the cyclomatic complexity of all function-level code snippets to be tested, to obtain a cyclomatic complexity weight of each function-level code snippet to be tested.

[0034] D3. For each function-level code snippet to be tested, the product of the most similarity value of the function-level code snippet to be tested and the cyclomatic complexity weight is added to the most similarity value as the most similarity value of the function-level code snippet to be tested after processing.

[0035] The cyclomatic complexity weight adjustment method in step D2 is set according to the following formula:

[0036] W i =ln((f i -min(f)+ε) / (max(f)-min(f)+ε))+f i / max(f)

[0037] Among them, W i is the cyclomatic complexity weight of the i-th function-level code snippet to be tested; f iis the cyclomatic complexity of the i-th function-level code snippet to be tested; min(f) is the minimum cyclomatic complexity of all function-level code snippets to be tested; max(f) is the maximum cyclomatic complexity of all function-level code snippets to be tested; ln( ) represents the natural logarithm; ε is a constant.

[0038] The index amplification method in step S28 is specifically as follows:

[0039] Compare each fuzz testing tool's total edge coverage index and total score index: If the total score index is higher than the total edge coverage index, the fuzz testing tool's total score is amplified; if the total score index is lower than the total edge coverage index or remains unchanged, the fuzz testing tool's total score is not adjusted. After all fuzz testing tools are compared, they are re-sorted from high to low based on their amplified total scores to obtain their new total scores and indexes.

[0040] The amplification process is set according to the following formula:

[0041] S'=S(1+αR')

[0042] R'=R pre -R rec

[0043] Where S' represents the total score after the fuzz test tool is amplified; S represents the total score before the fuzz test tool is amplified; α represents the adjustment coefficient; R' represents the change in the fuzz test tool index; R pre represents the total edge coverage index of the fuzz testing tool; R rec Indicates the total score index of the fuzz testing tool.

[0044] The step S3 is specifically as follows:

[0045] S31. Normalize the new total scores of all fuzz testing tools to obtain the new total score percentage of each fuzz testing tool.

[0046] S32. Divide the fuzz testing tools into initial resource allocation ratios according to the new total score percentage of each fuzz testing tool, and perform fuzz testing on the code base to be tested according to the initial resource allocation ratio of each fuzz testing tool.

[0047] S33. When the fuzz test reaches the end of a preset time window, the AFL detection instrumentation tool is used to perform detection, and the increase in the bitmap coverage of each fuzz test tool and the increase in the number of detected vulnerabilities are obtained respectively.

[0048] S34. According to the bitmap coverage and the increase in the number of vulnerabilities of each fuzz testing tool, the bitmap coverage and the number of detected vulnerabilities of all fuzz testing tools on the code base to be tested at the end of the preset time window are obtained.

[0049] S35. Normalize the increase in bitmap coverage at the end of the preset time window of all fuzz testing tools to obtain the percentage increase in bitmap coverage of each fuzz testing tool, and use the percentage increase in bitmap coverage as the contribution rate of the fuzz testing tool.

[0050] S36. When the preset time window ends, the resource allocation ratios of the various fuzz testing tools are readjusted and allocated according to the dynamic resource balancing adjustment method.

[0051] S37. Repeat steps S33 to S36 until the preset fuzz test termination time is reached, then stop the fuzz test and obtain the final bitmap coverage and the number of detected vulnerabilities of all fuzz test tools on the code base to be tested.

[0052] In step S36, each of the fuzz testing tools adjusts the resource allocation ratio according to the following formula of the dynamic resource balancing adjustment method:

[0053] A=Min((BC)×C,θrh),B≥C

[0054] A=Min((BC)×C,-θrh),B<C

[0055] Where A represents the resource allocation ratio that needs to be adjusted for the fuzz testing tool; B represents the contribution rate of the fuzz testing tool at the end of the preset time window; C represents the resource allocation ratio of the fuzz testing tool within the preset time window; θrh represents the preset adjusted resource allocation ratio threshold, and Min( ) represents the minimum.

[0056] 2. A computer device comprising a memory and a processor, wherein the memory stores a computer program and the processor implements the steps of the above method when executing the computer program.

[0057] 3. A computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0058] The innovation of the present invention lies in that an integrated fuzz testing method combining an index amplification method and a dynamic resource balancing adjustment method is proposed based on code semantic similarity, which improves the bitmap coverage and the amount of detected vulnerabilities of the fuzz test and realizes more efficient dynamic allocation of computing resources.

[0059] The beneficial effects of the present invention are:

[0060] 1. This paper proposes a new integrated fuzz testing method based on code semantic similarity, which realizes code semantics-driven fuzzer recommendation and resource dynamic scheduling mechanism.

[0061] 2. The index amplification method and dynamic resource balancing adjustment method proposed in the present invention significantly improve the bitmap coverage of fuzz testing and achieve more efficient dynamic allocation of computing resources.

[0062] 3. This invention realizes a fully automated process, reducing the need for manual intervention. From code analysis and recommendation to resource adjustment, no manual intervention is required, which greatly reduces the configuration time compared with traditional methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 The figure is a comparison chart of the change curves of the bitmap coverage obtained by using the fuzzy test method of the present invention and using a single fuzzy test tool for fuzzy testing.

[0064] Figure 2 The figure is a comparison chart of the change curve of the vulnerability amount obtained by using the fuzzy test method of the present invention and using a single fuzzy test tool for fuzzy testing.

[0065] Figure 3 This is a comparison chart of the bitmap coverage change curves obtained by the method of the present invention and the method without dynamic resource balancing adjustment.

[0066] Figure 4 This is a comparison chart of the vulnerability amount change curves obtained by the method of the present invention and the method without dynamic resource balancing adjustment.

[0067] Figure 5 This is a comparison chart of the bitmap coverage change curves obtained by the method of the present invention and the method without index amplification.

[0068] Figure 6 This is a comparison chart of the vulnerability amount change curves obtained by the method of the present invention and the method without index amplification.

[0069] Figure 7 This is a comparison chart of the bitmap coverage change curves obtained by the method of the present invention and the existing integrated fuzz testing method Autofz.

[0070] Figure 8 This is a comparison chart of the vulnerability change curves obtained by the method of the present invention and the existing integrated fuzz testing method Autofz. DETAILED DESCRIPTION

[0071] The present invention is described in more detail below with reference to the accompanying drawings and examples. However, the present invention is not limited thereto. A person skilled in the art may make various improvements and modifications without departing from the principles of the present invention, and such improvements and modifications are considered to be within the scope of protection of the present invention. Any matters not described in detail in this specification constitute prior art known to those skilled in the art.

[0072] The specific embodiments of the present invention are as follows:

[0073] Example 1

[0074] The integrated fuzz testing method of this embodiment includes the following steps:

[0075] S1. Obtain several benchmark code libraries through the computer's data link and store the benchmark code libraries in a data hard disk. Use the central processing unit to use multiple fuzz testing tools to perform fuzz testing on each benchmark code library in turn, slice the function-level code to obtain several function-level vectors of each benchmark code library, obtain the total edge coverage and index of each fuzz testing tool based on all function-level vectors, and obtain the optimal fuzz testing tool for each function-level vector based on the total edge coverage and index.

[0076] S11. Obtain several benchmark code libraries through the computer's data link and store the benchmark code libraries in a data hard disk. Use a central processing unit to use multiple fuzz testing tools to perform fuzz testing on each benchmark code library to obtain the edge coverage of each fuzz testing tool on each benchmark code library.

[0077] In specific implementation, fuzz testing tools include afl, aflfast, angora, fairfuzz, laf-intel, learnafl, mopt, qsym, radamsa and redqeen.

[0078] Edge coverage is a fine-grained code coverage measurement method in fuzz testing.

[0079] S12. Use a static analysis tool to perform function-level code slicing on each benchmark code base to obtain several function-level code snippets for each benchmark code base.

[0080] In the specific implementation, the static analysis tool uses the LLVM parser. Function-level code snippets are code blocks extracted from the program in units of functions.

[0081] S13. According to the edge coverage of each fuzz testing tool on each benchmark code base and several function-level code snippets of each benchmark code base, the edge coverage of each fuzz testing tool on each function-level code snippet is obtained using the gcov parsing method.

[0082] S14. Count the total edge coverage of all function-level code snippets of each fuzz testing tool, and sort the total edge coverage of each fuzz testing tool from high to low to obtain the total edge coverage index of each fuzz testing tool.

[0083] S15. For each function-level code snippet, select the fuzz testing tool corresponding to the highest edge coverage as the optimal fuzz testing tool for the corresponding function-level code snippet.

[0084] Furthermore, a threshold of edge coverage is preset. If the highest edge coverage is less than the threshold, the function-level code snippet and the corresponding fuzz testing tool are discarded. If not, the function-level code snippet and the corresponding fuzz testing tool are retained. Step S16 is not executed for all discarded function-level code snippets.

[0085] S16. Use the UniXcoder model to encode each function-level code snippet to obtain a function-level vector, and then the optimal fuzz testing tool for the function-level code snippet is also used as the optimal fuzz testing tool for the corresponding function-level vector.

[0086] The vector dimension is 768 × n, where n is related to the length of the function code snippet.

[0087] S2. Obtain the code base to be tested through the computer's data link and store the code base to be tested in a data hard disk. Use the central processing unit to perform function-level code slicing and encoding processing on the code base to be tested to obtain several function-level vectors to be tested of the code base to be tested. Obtain the total score and index of each fuzz testing tool based on the function-level vector, the optimal fuzz testing tool of the function-level vector and the function-level vector to be tested. Perform index amplification processing on the total score based on the total edge coverage and index of the fuzz testing tool to obtain a new total score and index of all fuzz testing tools in the code base to be tested.

[0088] S21. Obtain a code base to be tested through a computer data link and store the code base to be tested in a data hard disk. Use a static analysis tool on a central processing unit to perform function-level code slicing on the code base to be tested, and obtain a plurality of function-level code fragments to be tested of the code base to be tested.

[0089] S22. Use the UniXcoder model to encode each function-level code snippet to obtain a function-level vector to be tested.

[0090] S23. Process each function-level vector to be tested and all function-level vectors of the benchmark code library using a cosine similarity method to obtain similarity values ​​between each function-level vector to be tested and each function-level vector of the benchmark code library.

[0091] The cosine similarity method is set according to the following formula:

[0092] sim(u,v)=(u·v) / (||u||·||v||)

[0093] Here, sim(u,v) represents the similarity between u and v; u represents the function-level vector of the codebase under test; v represents the function-level vector of the benchmark codebase; ||u|| represents the modulus of the function-level vector u under test; and ||v|| represents the modulus of the function-level vector v. In practice, sim(u,v) values ​​are in the range [-1,1]. Values ​​closer to 1 indicate higher semantic similarity, while values ​​closer to -1 indicate lower semantic similarity.

[0094] S24. For each function-level code snippet to be tested, the highest similarity value is selected from the similarity values ​​of the function-level vector to be tested corresponding to the function-level code snippet to be tested and all function-level vectors of the benchmark code library as the most similarity value of the function-level vector to be tested, and then as the most similarity value of the corresponding function-level code snippet to be tested.

[0095] S25. The optimal fuzz testing tool for the function-level vector of the benchmark code library corresponding to the most similarity value is used as the optimal fuzz testing tool for the function-level vector to be tested corresponding to the most similarity value, and then the optimal fuzz testing tool for the function-level vector to be tested is also used as the optimal fuzz testing tool for the corresponding function-level code fragment to be tested.

[0096] S26. Use the similarity update method based on cyclomatic complexity to process the most similarity value of each function-level code snippet to be tested, and obtain the most similarity value of each function-level code snippet to be tested after processing; the most similarity value of each function-level code snippet to be tested after processing is used as the score of the corresponding fuzz testing tool.

[0097] The cyclomatic complexity is an indicator that measures the complexity of a function or code snippet, and is mainly used to evaluate the structural complexity and testing difficulty of the code.

[0098] The specific similarity update method based on cyclomatic complexity is:

[0099] D1. Using the cyclomatic complexity calculation method for each function-level code snippet to be tested, obtain the cyclomatic complexity of the function-level code snippet to be tested.

[0100] In specific implementation, the cyclomatic complexity calculation method is set according to the following formula:

[0101] CCN=E-N+2P

[0102] Among them, CCN represents the cyclomatic complexity of the function-level code snippet; E represents the total number of process transfer paths in the function-level code snippet, and also represents the number of edges in the control flow graph after the function-level code snippet is converted into a control flow graph; N represents the total number of points such as program blocks or conditional judgments in the function-level code snippet, and also represents the number of nodes in the control flow graph after the function-level code snippet is converted into a control flow graph; P represents the number of function-level code snippets, which here refers to the number of function-level code snippets themselves, so it is 1.

[0103] D2. Process each function-level code snippet to be tested using a cyclomatic complexity weight adjustment method according to the cyclomatic complexity of all function-level code snippets to be tested, to obtain a cyclomatic complexity weight of each function-level code snippet to be tested.

[0104] The cyclomatic complexity weight adjustment method in step D2 is set according to the following formula:

[0105] W i =ln((f i -min(f)+ε) / (max(f)-min(f)+ε))+f i / max(f)

[0106] Among them, W i is the cyclomatic complexity weight of the i-th function-level code snippet to be tested; f i is the cyclomatic complexity of the i-th function-level code snippet to be tested; min(f) is the minimum cyclomatic complexity of all function-level code snippets to be tested; max(f) is the maximum cyclomatic complexity of all function-level code snippets to be tested; ln( ) represents the natural logarithm, a logarithmic function with the natural constant e as the base; ε is a small constant, which is set to 10 in the specific implementation. -6 , used to prevent division by zero.

[0107] D3. For each function-level code snippet to be tested, the product of the most similarity value of the function-level code snippet to be tested and the cyclomatic complexity weight is added to the most similarity value as the most similarity value of the function-level code snippet to be tested after processing.

[0108] The most similarity value of each function-level code snippet to be tested is processed according to the following formula to obtain the updated most similarity value:

[0109] Sim (i)max '=(1+W i )Sim (i)max

[0110] Among them, Sim (i)max 'Represents the most similarity value after processing of the i-th function-level code snippet to be tested; Sim (i)max W represents the most similarity value of the i-th function-level code snippet to be tested;i Represents the cyclomatic complexity weight of the i-th function-level code snippet to be tested.

[0111] S27. For the code base to be tested, the total score of each fuzz testing tool in all function-level code snippets to be tested is counted, that is, the total score of each fuzz testing tool on the code base to be tested is obtained, and the total scores of each fuzz testing tool are sorted from high to low to obtain the total score index of each fuzz testing tool.

[0112] S28. In order to highlight the advantages of fuzz testing tools that may perform well in the code base to be tested but have a low index in the benchmark test, the index amplification method is used to process the total score of the fuzz testing tools on the code base to be tested, and a new total score and index of each fuzz testing tool in the code base to be tested are obtained.

[0113] The index amplification method specifically compares the total edge coverage index and total score index of each fuzz testing tool. If the total score index is higher than the total edge coverage index, the fuzz testing tool's total score is amplified; if the total score index is lower than the total edge coverage index or remains unchanged, the fuzz testing tool's total score is not adjusted. After all fuzz testing tools are compared, they are re-sorted from high to low according to their amplified total scores to obtain their new total scores and indexes.

[0114] The amplification process is set according to the following formula:

[0115] S'=S(1+αR')

[0116] R'=R pre -R rec

[0117] Where S' represents the total score after the fuzz test tool is amplified; S represents the total score before the fuzz test tool is amplified; α represents the adjustment coefficient; R' represents the change in the fuzz test tool index; R pre represents the total edge coverage index of the fuzz testing tool; R rec Indicates the total score index of the fuzz testing tool.

[0118] S3. Based on the new total score index of all fuzz testing tools, a dynamic resource balancing adjustment method is used to continuously perform fuzz testing on the code base to be tested, and finally the bitmap coverage and the number of detected vulnerabilities of all fuzz testing tools on the code base to be tested are obtained.

[0119] The benchmark code base covers different programming languages, application domains, and code complexity. The code bases to be tested include those in the image processing field and the embedded database field.

[0120] Bitmap coverage is a metric used in fuzz testing to measure the coverage of code paths during testing.

[0121] S31. Normalize the new total scores of all fuzz testing tools to obtain the new total score percentage of each fuzz testing tool.

[0122] S32. Divide the fuzz testing tools into initial resource allocation ratios according to the new total score percentage of each fuzz testing tool, and perform fuzz testing on the code base to be tested according to the initial resource allocation ratio of each fuzz testing tool.

[0123] S33. When the fuzz test time reaches the end of a preset time window, the AFL detection instrumentation tool is used to perform detection to obtain the increase in the bitmap coverage of each fuzz test tool and the increase in the number of detected vulnerabilities.

[0124] S34. According to the bitmap coverage and the increase in the number of vulnerabilities of each fuzz testing tool, the bitmap coverage and the number of detected vulnerabilities of all fuzz testing tools on the code base to be tested at the end of the preset time window are obtained.

[0125] S35. Normalize the increase in bitmap coverage at the end of the preset time window of all fuzz testing tools to obtain the percentage increase in bitmap coverage of each fuzz testing tool, and use the percentage increase in bitmap coverage as the contribution rate of the fuzz testing tool.

[0126] S36. When the preset time window ends, the resource allocation ratios of the various fuzz testing tools are readjusted and allocated according to the dynamic resource balancing adjustment method.

[0127] In step S36, each fuzz testing tool adjusts its resource allocation ratio according to the following formula of the dynamic resource balancing adjustment method:

[0128] A=Min((BC)×C,θrh),B≥C

[0129] A=Min((BC)×C,-θrh),B<C

[0130] Where A represents the resource allocation ratio that needs to be adjusted for the fuzz testing tool; B represents the contribution rate of the fuzz testing tool at the end of the preset time window; C represents the resource allocation ratio of the fuzz testing tool within the preset time window; θrh represents the preset adjusted resource allocation ratio threshold, and Min( ) represents the minimum.

[0131] In a specific implementation, if the new total score percentage of one of the fuzz testing tools is 30%, the initial resource allocation ratio is 30% CPU resources, the preset adjustment resource allocation ratio threshold θrh is 5%, the preset time window is 5 minutes, and the percentage increase in the bitmap coverage of the fuzz testing tool in the first preset time window is 25%, that is, the contribution rate of the fuzz testing tool in the first preset time window is 25%. The resource allocation ratio that needs to be adjusted for the fuzz testing tool is: A=Min((25%-30%)×30%,-5%)=-1.5%. Therefore, at the end of the preset time window, the resource allocation ratio of the fuzz testing tool is reduced by 1.5%. If the result of A is negative, the resource allocation ratio of the fuzz testing tool is reduced; if the result of A is positive, the resource allocation ratio of the fuzz testing tool is increased.

[0132] S37. Repeat steps S33 to S36 until the preset fuzz test termination time is reached, then stop the fuzz test and obtain the final bitmap coverage and the number of detected vulnerabilities of all fuzz test tools on the code base to be tested.

[0133] The innovation of the present invention lies in that an integrated fuzz testing method combining an index amplification method and a dynamic resource balancing adjustment method is proposed based on code semantic similarity, which improves the bitmap coverage and the amount of detected vulnerabilities of the fuzz test and realizes more efficient dynamic allocation of computing resources.

[0134] Example 2

[0135] The benchmark code libraries used in this example include: boringssl, muparser, bzip, openssl101f, eigen, openssl102d, freetype2, openssl110c, guetzli, openh264, haproxy, openthread, harfbuzz, pcre2, jbig2dec, phmap, libarchive, proj4, libevent, quickjs, libexif, re2, libgd, spdlog, libjpeg, sqlite, libpng, tidy-html, libraw, unit, libssh, uriparser, libunwind, vorbis, libxml2, woff2, lcms, zlib, libyaml, and zopfli, totaling 40 benchmark code libraries. The code library to be tested is exiv2.

[0136] Among them, boringssl, openssl101f, openssl102d, openssl110c, libssh and libyaml are code libraries in the field of encryption and security, libarchive, libexif, libxml2 and tidy-html are code libraries in the field of file parsing, libjpeg, libpng, libraw, guetzli, lcms, jbig2dec, freetype2, harfbuzz, libgd, exiv2 and woff2 are code libraries in the field of image processing, haproxy, libevent and openthrea d is a code library in the field of network protocols, sqlite is a code library in the field of databases, vorbis and openh264 are code libraries in the field of multimedia processing, quickjs and unit are code libraries in the field of web development, pcre2, re2, spdlog and uriparser are code libraries in the field of text processing, bzip2, zlib and zopfli are code libraries in the field of compression algorithms, eigen and proj4 are code libraries in the field of mathematics and scientific computing, muparser is a code library for parsing mathematical expressions, libunwind is a code library for processing function call stacks, and phmap is a high-performance hash table code library.

[0137] The fuzz testing tools used in this embodiment include: afl, aflfast, angora, fairfuzz, laf-intel, learnafl, mopt, qsym, radamsa and redqeen, a total of 10 fuzz testing tools.

[0138] This embodiment is implemented using the same method and steps as embodiment 1.

[0139] During the implementation process, static analysis tools were used to perform function-level code slicing on each benchmark code base, and a total of 36,734 function-level code snippets were obtained.

[0140] During the implementation process, the statistically obtained fuzz testing tools are ranked from high to low according to the total edge coverage as shown in Table 1.

[0141] Table 1

[0142] Fuzz testing tools Total edge coverage Total edge coverage index redqueen 82.1% 1 lafintel 69.6% 2 qsym 64.7% 3 fairfuzz 59.5% 4 learnafl 58.9% 5 mopt 58.8% 6 angora 57.8% 7 radamsa 55.9% 8 afl 55.3% 9 aflfast 55.0% 10

[0143] During the implementation process, the statistically obtained fuzz testing tools are ranked from high to low according to their total scores as shown in Table 2.

[0144] Table 2

[0145] Fuzz testing tools Total score Total score index redqueen 1218.205337 1 lafintel 1006.198804 2 qsym 911.487161 3 learnafl 898.780717 4 angora 861.809616 5 mopt 858.846206 6 fairfuzz 834.319373 7 radamsa 819.102313 8 afl 800.735747 9 aflfast 764.344617 10

[0146] During the implementation process, after using the index amplification method, the statistically obtained fuzz testing tools are sorted from high to low according to the new total scores as shown in Table 3.

[0147] Table 3

[0148] Fuzz testing tools New total score New total score index redqueen 1218.205337 1 lafintel 1006.198804 2 angora 930.754385 3 qsym 911.487161 4 learnafl 898.780717 5 fairfuzz 858.846206 6 mopt 834.319373 7 radamsa 819.102313 8 afl 800.735747 9 aflfast 764.344617 10

[0149] According to the new total scores of each fuzz testing tool in Table 3, the new total scores are normalized, and the new total score percentages of each fuzz testing tool are: redqueen: 14.18%, lafintel: 10.34%, angora: 12.53%, qsym: 9.68%, learnafl: 9.38%, radamsa: 8.93%, mopt: 8.86%, fairfuzz: 9.01%, afl: 8.64%, aflfast: 8.45%.

[0150] Initially, the resource allocation ratio is divided according to the new total score percentage obtained above, and the fuzz test is performed on the code base to be tested according to the obtained initial resource allocation ratio.

[0151] The dynamic resource balancing adjustment method proposed in the present invention is used to readjust the resource allocation ratio of each fuzz testing tool until the preset fuzz testing termination time is reached, then the fuzz testing is stopped. Finally, the total bitmap coverage and total number of vulnerabilities that can be achieved by fuzz testing the code base to be tested are obtained based on the bitmap coverage and number of vulnerabilities of all fuzz testing tools.

[0152] The curves of bitmap coverage and time variation of all fuzz testing tools implemented in this embodiment on the code base to be tested are as follows: Figure 1 shown.

[0153] Comparative Example 1

[0154] In this comparative example, redqueen, lafintel, angora, qsym, learnafl, radamsa, mopt, fairfuzz, afl and aflfast fuzz testing tools are used to perform fuzz testing on the exiv2 test code base. The bitmap coverage and time variation curves of each fuzz testing tool on the test code base are shown in the figure. Figure 1 The curve of the number of vulnerabilities detected by each fuzz testing tool on the code base under test and the change of time is shown in Figure 2 As shown. Figure 1 and Figure 2It can be seen that the method of the present invention has great advantages over the conventional use of a single fuzz testing tool to perform fuzz testing on the code base to be tested.

[0155] Comparative Example 2

[0156] This comparative example is implemented using the same steps as Example 2. However, after obtaining the initial resource allocation ratio of each fuzz test tool, this comparative example directly performs fuzz testing according to the initial resource allocation ratio without dynamic resource balancing adjustment. Finally, the bitmap coverage and time variation curves of all fuzz test tools on the code base to be tested are obtained as shown in FIG. Figure 3 As shown in the figure, the final curve of the number of vulnerabilities detected by all fuzz testing tools on the code base to be tested and the change of time is as follows Figure 4 As shown. Figure 3 and Figure 4 It can be seen that the dynamic resource balancing adjustment method adopted by the method of the present invention significantly improves the performance during fuzzy testing.

[0157] Comparative Example 3

[0158] This comparative example is implemented using the same steps as Example 2. However, after obtaining the total score index of each fuzz testing tool, this comparative example does not use the index amplification method for processing. Instead, it directly performs normalization, resource allocation ratio division, and dynamic resource balance adjustment based on the total score without index amplification. Finally, the bitmap coverage and time variation curves of all fuzz testing tools on the code base to be tested are obtained as shown in FIG. Figure 5 As shown in the figure, the final curve of the change in the number of vulnerabilities detected by all fuzz testing tools on the code base to be tested and time is as follows Figure 6 As shown. Figure 5 and Figure 6 It can be seen that the index amplification method adopted by the method of the present invention also significantly improves the performance during fuzzy testing.

[0159] Comparative Example 4

[0160] This comparative example uses the existing integrated fuzz testing method Autofz to perform fuzz testing on the exiv2 test code base. The bitmap coverage obtained by the fuzz test and the time change curve are shown in the figure. Figure 7 As shown in the figure, the curve of the change of the number of vulnerabilities detected by fuzz testing and time is as follows: Figure 8 As shown. Figure 7 and Figure 8 It can be seen that the method of the present invention has better effects in bitmap coverage and the number of detected vulnerabilities than the existing integrated fuzz testing method Autofz.

[0161] The present invention is not limited to the embodiments described above. The above description of the specific embodiments is intended to describe and illustrate the technical solutions of the present invention. The above specific embodiments are merely illustrative and not restrictive. Without departing from the scope of the present invention and the scope of protection of the claims, those skilled in the art may make various specific modifications based on the teachings of the present invention, all of which fall within the scope of protection of the present invention.

Claims

1. An integrated fuzz testing method based on code semantic similarity, characterized in that: The method comprises the following steps: S1. Obtain several benchmark code bases, use multiple fuzz testing tools to perform comprehensive processing on each benchmark code base to obtain several function-level vectors and edge coverage of each function-level code snippet of each benchmark code base, calculate the total edge coverage of all function-level code snippets of each fuzz testing tool, and sort the total edge coverage of each fuzz testing tool from high to low to obtain the total edge coverage index of each fuzz testing tool. For each function-level code snippet, select the fuzz testing tool corresponding to the highest edge coverage as the optimal fuzz testing tool for the corresponding function-level code snippet; S2. Obtain a code base to be tested, perform function-level code slicing and encoding processing on the code base to be tested to obtain several function-level vectors to be tested of the code base to be tested, select the highest similarity value from the similarity values ​​of the function-level vector to be tested and all function-level vectors corresponding to the function-level code fragment to be tested as the most similarity value of the function-level vector to be tested, adopt a similarity update method based on cyclomatic complexity to process the most similarity value of each function-level code fragment to be tested, and obtain the most similarity value of each function-level code fragment to be tested after processing, and use the most similarity value of each function-level code fragment to be tested after processing as the score of the corresponding fuzz testing tool, for the code base to be tested, count the total score of each fuzz testing tool in all function-level code fragments to be tested, that is, obtain the total score of each fuzz testing tool on the code base to be tested, and perform index amplification processing on the total score according to the total edge coverage and index to obtain a new total score and index of all fuzz testing tools in the code base to be tested; The index amplification process is specifically as follows: comparing the total edge coverage index and the total score index of each fuzz test tool: if the total score index is higher than the total edge coverage index, the total score of the fuzz test tool is amplified; if the total score index is lower than the total edge coverage index or remains unchanged, the total score of the fuzz test tool is not processed; S3. Based on the new total score index of all fuzz testing tools, a dynamic resource balancing adjustment method is used to continuously perform fuzz testing on the code base to be tested, and finally the bitmap coverage and the number of detected vulnerabilities of all fuzz testing tools on the code base to be tested are obtained.

2. The integrated fuzz testing method according to claim 1, characterized in that The step S1 is specifically as follows: S11. Obtain several benchmark code bases, use multiple fuzz testing tools to perform fuzz testing on each benchmark code base, and obtain the edge coverage of each fuzz testing tool on each benchmark code base; S12. Use a static analysis tool to perform function-level code slicing on each benchmark code base to obtain several function-level code snippets for each benchmark code base; S13, obtaining the edge coverage of each fuzz testing tool on each benchmark code base and several function-level code snippets of each benchmark code base using the gcov parsing method; S14. Count the total edge coverage of all function-level code snippets of each fuzz testing tool, and sort the total edge coverage of each fuzz testing tool from high to low to obtain a total edge coverage index of each fuzz testing tool; S15. For each function-level code snippet, select the fuzz testing tool corresponding to the highest edge coverage as the optimal fuzz testing tool for the corresponding function-level code snippet; S16. Use the UniXcoder model to encode each function-level code snippet to obtain a function-level vector, and then the optimal fuzz testing tool for the function-level code snippet is also used as the optimal fuzz testing tool for the corresponding function-level vector.

3. The integrated fuzz testing method according to claim 1, characterized in that: The step S2 is specifically as follows: S21. Obtain a code base to be tested, and use a static analysis tool to perform function-level code slicing on the code base to be tested to obtain several function-level code snippets to be tested in the code base to be tested; S22, using the UniXcoder model to encode each function-level code snippet to obtain a function-level vector to be tested; S23, processing each function-level vector to be tested and all function-level vectors of the benchmark code library using a cosine similarity method to obtain similarity values ​​between each function-level vector to be tested and each function-level vector; S24. For each function-level code snippet to be tested, select the highest similarity value from the similarity values ​​between the function-level vector to be tested and all function-level vectors corresponding to the function-level code snippet to be tested as the most similarity value of the function-level vector to be tested, and further as the most similarity value of the corresponding function-level code snippet to be tested; S25. The optimal fuzz testing tool for the function-level vector corresponding to the most similarity value is used as the optimal fuzz testing tool for the function-level vector to be tested, and the optimal fuzz testing tool for the function-level vector to be tested is also used as the optimal fuzz testing tool for the corresponding function-level code snippet to be tested; S26. Processing the most similarity value of each function-level code snippet to be tested using a similarity update method based on cyclomatic complexity to obtain the most similarity value of each function-level code snippet to be tested after processing; the most similarity value of each function-level code snippet to be tested after processing is used as the score of the corresponding fuzz testing tool; S27. For the code base to be tested, calculate the total score of each fuzz testing tool on all function-level code snippets to be tested, that is, obtain the total score of each fuzz testing tool on the code base to be tested, and sort the total scores of the fuzz testing tools from high to low to obtain the total score index of each fuzz testing tool; S28. Use the index amplification method to process the total score of the fuzz testing tool on the code base to be tested, and obtain a new total score and index of each fuzz testing tool in the code base to be tested.

4. The integrated fuzz testing method according to claim 3, characterized in that: The similarity updating method based on cyclomatic complexity in step S26 is specifically as follows: D1. Use the cyclomatic complexity calculation method to obtain the cyclomatic complexity of each function-level code snippet to be tested; D2. Processing each function-level code snippet to be tested using a cyclomatic complexity weight adjustment method based on the cyclomatic complexity of all function-level code snippets to be tested, thereby obtaining a cyclomatic complexity weight for each function-level code snippet to be tested; D3. For each function-level code snippet to be tested, the product of the most similarity value of the function-level code snippet to be tested and the cyclomatic complexity weight is added to the most similarity value as the most similarity value of the function-level code snippet to be tested after processing.

5. The integrated fuzz testing method according to claim 4, characterized in that: The cyclomatic complexity weight adjustment method in step D2 is set according to the following formula: W i =ln((f i -min(f)+ε) / (max(f)-min(f)+ε))+f i / max(f) Among them, W i is the cyclomatic complexity weight of the i-th function-level code snippet to be tested; f i is the cyclomatic complexity of the i-th function-level code snippet to be tested; min(f) is the minimum cyclomatic complexity of all function-level code snippets to be tested; max(f) is the maximum cyclomatic complexity of all function-level code snippets to be tested; ln( ) represents the natural logarithm; ε is a constant.

6. The integrated fuzz testing method according to claim 3, characterized in that: The index amplification method in step S28 is specifically as follows: Compare the total edge coverage index and total score index of each fuzz testing tool: If the total score index is higher than the total edge coverage index, the total score of the fuzz testing tool is amplified; if the total score index is lower than the total edge coverage index or remains unchanged, the total score of the fuzz testing tool is not processed; After all fuzz testing tools are compared, they are re-sorted from high to low according to their amplified total scores to obtain their new total scores and indexes. The amplification process is set according to the following formula: S'=S(1+αR') R’=R pre -R rec Where S' represents the total score after the fuzz test tool is amplified; S represents the total score before the fuzz test tool is amplified; α represents the adjustment coefficient; R' represents the change in the fuzz test tool index; R pre represents the total edge coverage index of the fuzz testing tool; R rec Indicates the total score index of the fuzz testing tool.

7. The integrated fuzz testing method according to claim 3, characterized in that: The step S3 is specifically as follows: S31. Normalize the new total scores of all fuzz testing tools to obtain the new total score percentage of each fuzz testing tool; S32. Divide the fuzz testing tools into initial resource allocation ratios according to the new total score percentage of each fuzz testing tool, and perform fuzz testing on the code base to be tested according to the initial resource allocation ratio of each fuzz testing tool; S33, when the fuzz test time reaches the end of a preset time window, the AFL detection instrumentation tool is used to perform detection, and the increase in the bitmap coverage of each fuzz test tool and the increase in the number of detected vulnerabilities are respectively obtained; S34. Obtaining the bitmap coverage and the number of detected vulnerabilities of all fuzz testing tools on the code base to be tested at the end of a preset time window based on the bitmap coverage and the increase in the number of vulnerabilities of each fuzz testing tool; S35. Normalize the increases in bitmap coverage at the end of a preset time window for all fuzz testing tools to obtain a percentage increase in bitmap coverage for each fuzz testing tool, and use the percentage increase in bitmap coverage as the contribution rate of the fuzz testing tool. S36. When the preset time window ends, the resource allocation ratios of the various fuzz testing tools are readjusted according to the dynamic resource balancing adjustment method. S37. Repeat steps S33 to S36 until the preset fuzz test termination time is reached, then stop the fuzz test and obtain the final bitmap coverage and the number of detected vulnerabilities of all fuzz test tools on the code base to be tested.

8. The integrated fuzz testing method according to claim 7, wherein: In step S36, each of the fuzz testing tools adjusts the resource allocation ratio according to the following formula of the dynamic resource balancing adjustment method: A=Min((BC)×C,θrh),B≥C A=Min((BC)×C,-θrh),B<C Where A represents the resource allocation ratio that needs to be adjusted for the fuzz testing tool; B represents the contribution rate of the fuzz testing tool at the end of the preset time window; C represents the resource allocation ratio of the fuzz testing tool within the preset time window; θrh represents the preset adjusted resource allocation ratio threshold, and Min( ) represents the minimum.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images