A format-aware fuzzing method and system based on taint analysis

Abstract

This invention relates to the field of network security technology, specifically disclosing a format-aware fuzzy testing method and system based on taint analysis. The method includes: inputting an input sample and a seed queue into a target program for testing, and performing instruction-level taint analysis on the target program to obtain a list of tainted instructions; based on the tainted instruction list, dividing the input sample into regions according to bytes, identifying region types and dependencies based on the relationship between instruction control flow and data flow, and constructing a file format tree and a dependency table; mutating nodes in the file format tree according to the file format tree, obtaining the dependencies of the mutated nodes, adjusting relevant fields according to the dependencies of the mutated nodes to generate valid test cases, and adding the test cases to the seed queue.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a format-aware fuzzy testing method and system based on taint analysis. Background Technology

[0002] Vulnerability detection is a crucial issue in the field of software security. With the continuous development of software technology and the increasing complexity of related product functions, the number of vulnerabilities is growing daily. Much code with security risks is inevitably exploited by malicious attackers, causing significant distress not only to ordinary users but also resulting in substantial financial losses and security threats to companies.

[0003] Fuzzing, as a dynamic software testing method, has demonstrated significant effectiveness in exploring and revealing unknown security vulnerabilities. Format-aware fuzzing, in particular, understands the format of input based on feedback information during the fuzzing process, thereby more effectively modifying the input and improving fuzzing efficiency. Typically, fuzzing tools generate test cases based on preset strategies to comprehensively test the target application, revealing potential security vulnerabilities by monitoring runtime anomalies. The key to improving fuzzing efficiency is generating validly formatted input. A standard-formatted input test case usually contains a sequence of data fields with specific semantics: for example, buffer size, checksum, etc. The program parses these fields according to its implemented functionality; invalid input test cases may be rejected early in program execution, making it difficult to improve test coverage.

[0004] Therefore, how to solve the problem that existing format-aware fuzzy testing tools mainly focus on identifying fields and lack dependence on input areas and structural recognition, resulting in generated test cases that cannot meet program requirements, is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] To achieve the objectives of this invention, this application provides a format-aware fuzzy testing method based on taint analysis, comprising:

[0006] Step S1: Input the input sample and seed queue into the target program for testing, and perform instruction-level taint analysis on the target program to obtain a list of tainted instructions;

[0007] Step S2: Based on the tainted instruction list, divide the input sample into regions according to bytes, identify the region type and dependency relationship according to the relationship between instruction control flow and data flow, and construct a file format tree and dependency table;

[0008] Step S3: Based on the file format tree, mutate the nodes of the file format tree and obtain the dependencies of the mutated nodes. Adjust the relevant fields according to the dependencies of the mutated nodes to generate valid test cases, and add the test cases to the seed queue.

[0009] In some specific embodiments, step S1 includes:

[0010] Step S11: Perform instruction-level pollution tracing on the target program to obtain the execution trajectory of the input sample;

[0011] Step S12: Using the input sample as the taint source and the byte as the taint propagation granularity, select the byte as the basic taint propagation unit and determine the single offset of the tainted value in the input sample;

[0012] Step S13: Trace the execution instructions of the target program, obtain the behavioral characteristics of the input sample bytes, and generate a list of tainted instructions;

[0013] Step S14: Merge redundant records in the taint instruction list and optimize the record format.

[0014] In some specific embodiments, step S2, constructing the file format tree includes:

[0015] Step S21: Based on the taint instruction list, sort and classify the taint instructions according to the initial bytes of the taint region and the region size;

[0016] Step S22: Traverse the instructions according to the initial byte order of the tainted region, and divide the input sample into file regions according to the region boundary specified by the terminating byte of the tainted instruction;

[0017] Step S23: Initialize the file format tree;

[0018] Step S24: Recursively follow steps S21-S23 to add other file region nodes to the file format tree and initialize the current node. When the region range of the node to be inserted belongs to the region range of the current node, search for a node in the child node list of the current node. If the region range of the node to be inserted belongs to the child node region, and no child node that meets the condition is found, add the node to be inserted to the child node region list. If a child node that meets the condition is found, set the current node to point to the child node.

[0019] Step S25: Recursively execute step S24 until the node to be inserted is added to the file format tree;

[0020] Step S26: Continue with steps S24 and S25 until all region nodes are added to the file format tree.

[0021] In some specific embodiments, step S2, constructing the dependency table based on the dependency mutation method, includes:

[0022] The file format tree is traversed using the Depth-First Search (DFS) method to find the leaf nodes of the file format tree;

[0023] Get the dependency table elements of all nodes on the path from the leaf node to the root node, and add them to the dependency queue of the leaf node;

[0024] Exploratory and destructive mutations are performed based on the set of region dependency rules;

[0025] Continue traversing other nodes until all leaf nodes have been traversed.

[0026] In some specific embodiments, step S3 further includes:

[0027] Retrieve the first test case from the seed queue; input it into the target program for execution or exception handling; determine if an exception has occurred, and if so, perform exception handling; otherwise, determine if the current test case contains illegal characters or out-of-bounds access to structure members, and discard the current test case if illegal characters or out-of-bounds access to structure members are found.

[0028] To achieve the same inventive objective, this application also provides a format-aware fuzzy testing system based on taint analysis, comprising:

[0029] Tainted instruction analysis module: used to input the input sample and seed queue into the target program for testing, and to perform instruction-level taint analysis on the target program to obtain a list of tainted instructions;

[0030] The structural variation module is used to divide the input sample into regions according to bytes based on the tainted instruction list, identify the region type and dependency relationship according to the relationship between instruction control flow and data flow, and construct a file format tree and dependency table.

[0031] Test case generation module: used to mutate the nodes of the file format tree according to the file format tree, obtain the dependencies of the mutated nodes, adjust the relevant fields according to the dependencies of the mutated nodes to generate valid test cases, and add the test cases to the seed queue.

[0032] In some specific embodiments, the taint instruction analysis module is used to perform the following steps:

[0033] Step S11: Perform instruction-level pollution tracing on the target program to obtain the execution trajectory of the input sample;

[0034] Step S12: Using the input sample as the taint source and the byte as the taint propagation granularity, select the byte as the basic taint propagation unit and determine the single offset of the tainted value in the input sample;

[0035] Step S13: Trace the execution instructions of the target program, obtain the behavioral characteristics of the input sample bytes, and generate a list of tainted instructions;

[0036] Step S14: Merge redundant records in the taint instruction list and optimize the record format.

[0037] In some specific embodiments, the structural variation module includes constructing the file format tree as follows:

[0038] Step S21: Based on the taint instruction list, sort and classify the taint instructions according to the initial bytes of the taint region and the region size;

[0039] Step S22: Traverse the instructions according to the initial byte order of the tainted region, and divide the input sample into file regions according to the region boundary specified by the terminating byte of the tainted instruction;

[0040] Step S23: Initialize the file format tree;

[0041] Step S24: Recursively follow steps S21-S23 to add other file region nodes to the file format tree and initialize the current node. When the region range of the node to be inserted belongs to the region range of the current node, search for a node in the child node list of the current node. If the region range of the node to be inserted belongs to the child node region, and no child node that meets the condition is found, add the node to be inserted to the child node region list. If a child node that meets the condition is found, set the current node to point to the child node.

[0042] Step S25: Recursively execute step S24 until the node to be inserted is added to the file format tree;

[0043] Step S26: Continue with steps S24 and S25 until all region nodes are added to the file format tree.

[0044] In some specific embodiments, the structural mutation module, which constructs a dependency table based on the dependency mutation method, includes:

[0045] The file format tree is traversed using the Depth-First Search (DFS) method to find the leaf nodes of the file format tree;

[0046] Get the dependency table elements of all nodes on the path from the leaf node to the root node, and add them to the dependency queue of the leaf node;

[0047] Exploratory and destructive mutations are performed based on the set of region dependency rules;

[0048] Continue traversing other nodes until all leaf nodes have been traversed.

[0049] In some specific embodiments, the test case generation module is further used for:

[0050] Retrieve the first test case from the seed queue; input it into the target program for execution or exception handling; determine if an exception has occurred, and if so, perform exception handling; otherwise, determine if the current test case contains illegal characters or out-of-bounds access to structure members, and discard the current test case if illegal characters or out-of-bounds access to structure members are found.

[0051] The beneficial effects of the above technical solution are as follows:

[0052] This invention proposes a format-aware fuzzing method based on taint analysis. By employing taint analysis-based input file region boundary and type identification methods, it can effectively identify input file regions and their relationships. Furthermore, it proposes a method for storing the input structure based on a file format tree and dependency table, which can more efficiently store seed file region information and improve fuzzing mutation efficiency. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A flowchart illustrating a format-aware fuzzy testing method based on taint analysis, provided as an embodiment of the present invention;

[0055] Figure 2 A schematic diagram of the structure of a format-aware fuzzy testing system based on taint analysis is provided as an embodiment of the present invention;

[0056] Figure 3 A schematic diagram of the framework of a format-aware fuzzy testing method based on taint analysis is provided for one embodiment of the present invention;

[0057] Figure 4 A simplified diagram illustrating dynamic taint analysis and instruction analysis of a format-aware fuzzy testing method based on taint analysis, provided as an embodiment of the present invention;

[0058] Figure 5A schematic diagram of a field dependency table recording method for a format-aware fuzzy testing method based on taint analysis, provided as an embodiment of the present invention;

[0059] Figure 6 A schematic diagram of the header format tree of a JPG file generated by a format-aware fuzzy testing method based on taint analysis, provided as an embodiment of the present invention;

[0060] Figure 7 This is a schematic diagram of the dependency records of some nodes in a format-aware fuzzy testing method based on taint analysis, provided as an embodiment of the present invention. Detailed Implementation

[0061] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0062] Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar symbols denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the invention, and should not be construed as limiting the invention.

[0063] Example 1

[0064] One embodiment of the present invention provides a format-aware fuzzy testing method based on taint analysis, referring to... Figure 1 , Figure 3 As shown, it includes:

[0065] Step S1: Input the input sample and seed queue into the target program for testing, and perform instruction-level taint analysis on the target program to obtain a list of tainted instructions;

[0066] Step S2: Based on the tainted instruction list, divide the input sample into regions according to bytes, identify the region type and dependency relationship according to the relationship between instruction control flow and data flow, and construct a file format tree and dependency table;

[0067] Step S3: Based on the file format tree, mutate the nodes of the file format tree and obtain the dependencies of the mutated nodes. Adjust the relevant fields according to the dependencies of the mutated nodes to generate valid test cases, and add the test cases to the seed queue.

[0068] Specifically, a defined file region is a segment generated from a series of consecutive bytes in the input file, including the initial byte position, region length, and region type, represented as follows: When the region type is ignored, it can be simply referred to as An input format tree is defined as a fine-grained representation of the structure of an input file. Following the general definition of a tree, its nodes consist of a list of file regions and pointers to their sub-regions. The leaf nodes of the file format tree are represented as follows: A region dependency table is defined as a record table representing the relationships between input regions. The region dependency table records the dependent fields or sets of valid values ​​corresponding to each field. The region dependency table records are expressed as follows: ,in, Record the key value of the field. For a valid set of values, record the corresponding dependent fields or dependent value set of field F.

[0069] In a specific embodiment of the present invention, step S1 includes:

[0070] Step S11: Perform instruction-level pollution tracing on the target program to obtain the execution trajectory of the input sample;

[0071] Step S12: Using the input sample as the taint source and the byte as the taint propagation granularity, select the byte as the basic taint propagation unit and determine the single offset of the tainted value in the input sample;

[0072] Specifically, to obtain the behavioral characteristics of test sample bytes, the taint tracing engine tracks the execution instructions of the target program, recording program jumps and numerical operation instructions such as cmp, load, and je, generating an execution trace list. The execution trace list consists of taint tracing instructions, containing all instructions involving tainted variables during program execution.

[0073] The taint tracking instruction is defined as a quadruple. ,in: Indicates the address of the instruction. The opcode indicates the operation type of the instruction. This instruction has two operands, each operand record being further defined as a tuple. ,in, The byte offset of the input file corresponding to the tainted operand is recorded. Record the specific values ​​of constant variables.

[0074] The presence of loop structures and single-byte comparison statements in the code results in a large number of redundant statements in the trace instruction list. In addition, many identical field data execute instructions at the same address, but generate multiple taint trace instructions, affecting the efficiency of field identification.

[0075] Step S13: Trace the execution instructions of the target program, obtain the behavioral characteristics of the input sample bytes, and generate a list of tainted instructions;

[0076] Step S14: Merge redundant records in the taint instruction list and optimize the record format.

[0077] Specifically, based on the characteristics of the tracking instruction list, redundant records are merged and the record format is optimized. The tracking records are merged according to the following rules:

[0078] (1) For consecutive instructions at the same address, merge the variable offset fields to generate one instruction.

[0079] (2) If the operators of instructions at adjacent addresses are the same and the taint fields of some operands are the same, then the two instructions are merged and the taint fields of different operands are merged.

[0080] (3) Since the program loop statement generates repeated instructions, only one is kept.

[0081] Based on the above rules, FieldsFuzz merges fine-grained operation instructions, simplifies the instruction analysis list, and reduces the computational overhead of region identification.

[0082] In a specific embodiment of the present invention, step S2, constructing the file format tree, includes:

[0083] Step S21: Based on the taint instruction list, sort and classify the taint instructions according to the initial bytes of the taint region and the region size;

[0084] Step S22: Traverse the instructions according to the initial byte order of the tainted region, and divide the input sample into file regions according to the region boundary specified by the terminating byte of the tainted instruction;

[0085] Step S23: Initialize the file format tree;

[0086] Step S24: Recursively follow steps S21-S23 to add other file region nodes to the file format tree and initialize the current node. When the region range of the node to be inserted belongs to the region range of the current node, search for a node in the child node list of the current node. If the region range of the node to be inserted belongs to the child node region, and no child node that meets the condition is found, add the node to be inserted to the child node region list. If a child node that meets the condition is found, set the current node to point to the child node.

[0087] Step S25: Recursively execute step S24 until the node to be inserted is added to the file format tree;

[0088] Step S26: Continue with steps S24 and S25 until all region nodes are added to the file format tree.

[0089] Specifically, distinguishing the boundaries of different fields is the basis for input file region partitioning. Due to the existence of overlapping valid regions in instructions, field partitioning based on the instruction level is often inappropriate. For example, a byte-reading instruction may parse multiple regions, leading to the incorrect merging of different fields or the subdivision of fields of the same type. This invention determines the boundaries of input file regions and the nesting relationships of adjacent regions by creating an input format tree. The method for constructing the file format tree is described below:

[0090] Step 1: Sort and classify the tainted instructions in the simplified instruction analysis list according to the initial bytes of the tainted region and the region size.

[0091] Step 2: Traverse the instructions according to the initial byte order, and divide the input sample into file regions according to the region boundaries specified by the terminating byte of the instruction. .

[0092] Step 3: Initialize the file format tree. First, define the root node as... .in, , This indicates the length of the input seed.

[0093] Step 4: Following the order of Step 1, recursively add other file region nodes to the file format tree. Initialize the current node as... When the region range of the node to be inserted belongs to the region range of the current node, that is... In the list of child nodes of the current node Find nodes in the middle that satisfy If no matching criteria can be found Then Add to If a match is found Set the current node to point to .

[0094] Step 5: Recursively execute step 4 until the node to be inserted is added to the file format tree.

[0095] Step 6: Continue with Steps 4 and 5 until all region nodes are added to the file format tree.

[0096] The type of file region directly affects the ability and efficiency of generating valid test cases during the mutation process in fuzz testing. Based on file format standards and functions, this invention identifies the main classifications of valid file region types, as shown in Table 1. Different types of regions differ in the number of instructions recorded and the number of tainted bytes in comparison instructions. In the region type identification stage, the method of this invention initializes a region rule set, which contains some common rule features. In the type identification stage, the method of this invention enumerates the regions of all nodes in the file format tree, reads the tainted instruction list of that region, extracts instruction features, and identifies the corresponding region type based on the tainted instruction feature rules corresponding to different regions.

[0097] Table 1. Region Identification Field Types and Rules

[0098]

[0099] The purpose of dependency reasoning is to analyze the effective scope of tainted instructions within a region, thereby obtaining the dependencies between different regions. Dependency reasoning focuses on the correlation between regions of type length, checksum, and offset in the input file and other regions. This invention determines the dependencies between these special types of regions and other data regions by extracting the tainted instruction lists of these regions and tracing the tainted byte regions tainted by the operands of cmp and load instructions. For example, the checksum field is compared with a variable, and the tainted byte region covered by this variable is usually the region checked by this checksum field. To efficiently implement the insertion and lookup operations of region relationships, this invention constructs a region dependency table based on a hash table to store region dependencies. The structure of the region dependency table is as follows: Figure 4 , Figure 5 As shown, for each field, the related fields and valid value sets are recorded. For the Magic number and Enumeration fields, the dependency table stores their valid value sets. For the Length, Checksum, and Offset fields, a hash table records their scope, and the data field records other related fields, stored in a linked list. Based on the field dependency table, dependencies between regions can be quickly added and queried.

[0100] In a specific embodiment of the present invention, step S2, constructing the dependency table based on the dependency mutation method, includes:

[0101] The file format tree is traversed using the Depth-First Search (DFS) method to find the leaf nodes of the file format tree;

[0102] Get the dependency table elements of all nodes on the path from the leaf node to the root node, and add them to the dependency queue of the leaf node;

[0103] Exploratory and destructive mutations are performed based on the set of region dependency rules;

[0104] Continue traversing other nodes until all leaf nodes have been traversed.

[0105] Based on taint analysis to obtain the file format tree and dependency table, this invention employs a file format mutation method to improve fuzzing efficiency. The dependency-based mutation method aims to achieve region-level mutation, rather than being limited to byte-level mutation. During field mutation, the dependent fields of the mutated field are simultaneously modified according to rules to ensure the validity of the mutated test cases. The rules of the dependency-based mutation method are as follows:

[0106] Table 2. Field Mutation Rules for Dependency-Based Mutation Methods

[0107]

[0108] In one specific embodiment of the present invention, step S3 further includes:

[0109] Retrieve the first test case from the seed queue; input it into the target program for execution or exception handling; determine if an exception has occurred, and if so, perform exception handling; otherwise, determine if the current test case contains illegal characters or out-of-bounds access to structure members, and discard the current test case if illegal characters or out-of-bounds access to structure members are found.

[0110] To evaluate the format-aware fuzz testing method proposed in this invention, this application implements the method in the fuzz testing tool AFL and the taint analysis tool pin, and names it FieldsFuzz.

[0111] The open-source software jhead was tested using the method proposed in this invention. The results of the JPG file format analysis were recorded and a visual file format tree was generated. The start and end bytes of the file format tree nodes were recorded as labels. Figure 6The format tree for the APP0 field and DQT dat[0] field of the seed file not_kitty.jpg is shown. At the same time, the seed not_kitty.jpg provided by AFL is parsed using 010editor, and its field division is recorded as shown in Table 3. By comparing and analyzing the generated results, it can be verified that FieldsFuzz largely restores the syntax structure corresponding to the test cases. Although the tool shows high accuracy and consistency, there is a certain deviation in the identification of certain specific areas. This is because the program does not completely follow the specification for the file parsing process. FieldsFuzz uses the taint analysis method to identify the program processing process, and the identified file structure is consistent with the program parsing method. This application exports the dependency table generated by FieldsFuzz as a json file record. Figure 7 Displaying records that depend on the Magic Number, Enumeration, and Length fields, via... Figure 7 The recorded results show that FieldsFuzz can effectively record the set of valid values ​​or dependent fields for three types of fields, indicating that the field dependency table can effectively record and identify field types and dependency records.

[0112] Table 3 JPG File Header Format Record

[0113]

[0114] To evaluate the performance of the method of this invention in identifying input file regions, this application compares and analyzes it with other input structure reasoning methods (i.e., WEIZZ, ProFuzzerer, and NestFuzz). To correctly calculate the region identification accuracy, the input files are first preprocessed. For each input file, a common format template from 010 Editor is used to parse the file and export all field records with boundary and type information, while manually marking incorrectly identified fields and deleting some redundant fields. Subsequently, region types are labeled according to field function. Since different fuzzing tools have different granularities for field region division, the accuracy of boundary analysis is defined as the number of regions correctly identified by the fuzzing tool divided by the total number of regions identified by the tool. For region categories, the accuracy is determined by comparing the region type defined by the tool with the actual function of the region; the accuracy is defined as the number of correctly identified region types divided by the total number of regions identified by the tool. Since WEIZZ only identifies checksum fields, the region type identification accuracy of WEIZZ is not calculated. The accuracy of fuzzing attacks in identifying input file regions is shown in Table 4. The results show that FieldsFuzz achieves an average accuracy of 96.23% in region identification and 94.13% in type identification, which is higher than other comparative programs.

[0115] Table 4 shows the accuracy results of the format-aware fuzzy testing tool in identifying file regions.

[0116]

[0117] Example 2

[0118] One embodiment of the present invention provides a format-aware fuzzy testing system based on taint analysis, referring to... Figure 2 As shown, it includes:

[0119] Tainted instruction analysis module 10: used to input the input sample and seed queue into the target program for testing, and to perform instruction-level taint analysis on the target program to obtain a list of tainted instructions;

[0120] Structural variation module 20: Based on the tainted instruction list, the input sample is divided into regions according to bytes, the region type and dependency relationship are identified according to the relationship between instruction control flow and data flow, and a file format tree and dependency table are constructed;

[0121] Test case generation module 30: is used to mutate the nodes of the file format tree according to the file format tree, obtain the dependency relationship of the mutated node, adjust the relevant fields according to the dependency relationship of the mutated node to generate a valid test case, and add the test case to the seed queue.

[0122] In one specific embodiment of the present invention, the taint instruction analysis module 10 is used to perform the following steps:

[0123] Step S11: Perform instruction-level pollution tracing on the target program to obtain the execution trajectory of the input sample;

[0124] Step S12: Using the input sample as the taint source and the byte as the taint propagation granularity, select the byte as the basic taint propagation unit and determine the single offset of the tainted value in the input sample;

[0125] Step S13: Trace the execution instructions of the target program, obtain the behavioral characteristics of the input sample bytes, and generate a list of tainted instructions;

[0126] Step S14: Merge redundant records in the taint instruction list and optimize the record format.

[0127] In one specific embodiment of the present invention, the structural variation module 20 includes constructing a file format tree, which includes:

[0128] Step S21: Based on the taint instruction list, sort and classify the taint instructions according to the initial bytes of the taint region and the region size;

[0129] Step S22: Traverse the instructions according to the initial byte order of the tainted region, and divide the input sample into file regions according to the region boundary specified by the terminating byte of the tainted instruction;

[0130] Step S23: Initialize the file format tree;

[0131] Step S24: Recursively follow steps S21-S23 to add other file region nodes to the file format tree and initialize the current node. When the region range of the node to be inserted belongs to the region range of the current node, search for a node in the child node list of the current node. If the region range of the node to be inserted belongs to the child node region, and no child node that meets the condition is found, add the node to be inserted to the child node region list. If a child node that meets the condition is found, set the current node to point to the child node.

[0132] Step S25: Recursively execute step S24 until the node to be inserted is added to the file format tree;

[0133] Step S26: Continue with steps S24 and S25 until all region nodes are added to the file format tree.

[0134] In a specific embodiment of the present invention, the structural mutation module 20, in which the dependency table is constructed based on the dependency mutation method, includes:

[0135] The file format tree is traversed using the Depth-First Search (DFS) method to find the leaf nodes of the file format tree;

[0136] Get the dependency table elements of all nodes on the path from the leaf node to the root node, and add them to the dependency queue of the leaf node;

[0137] Exploratory and destructive mutations are performed based on the set of region dependency rules;

[0138] Continue traversing other nodes until all leaf nodes have been traversed.

[0139] In one specific embodiment of the present invention, the test case generation module 30 is further configured to:

[0140] Retrieve the first test case from the seed queue; input it into the target program for execution or exception handling; determine if an exception has occurred, and if so, perform exception handling; otherwise, determine if the current test case contains illegal characters or out-of-bounds access to structure members, and discard the current test case if illegal characters or out-of-bounds access to structure members are found.

[0141] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

[0142] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the functions specified in one or more boxes. Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the invention. Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0143] The methods and apparatus provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

[0144] In the description of this specification, references to terms such as "an embodiment," "some embodiments," "example," "specific example," or "a specific embodiment" or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0145] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A format-aware fuzzy testing method based on taint analysis, characterized in that, include: Step S1: Input the input sample and seed queue into the target program for testing, and perform instruction-level taint analysis on the target program to obtain a list of tainted instructions; Step S2: Based on the tainted instruction list, divide the input sample into regions according to bytes, identify the region type and dependency relationship according to the relationship between instruction control flow and data flow, and construct a file format tree and dependency table; Step S3: Based on the file format tree, mutate the nodes of the file format tree and obtain the dependencies of the mutated nodes. Adjust the relevant fields according to the dependencies of the mutated nodes to generate valid test cases, and add the test cases to the seed queue. Step S1 includes: Step S11: Perform instruction-level pollution tracing on the target program to obtain the execution trajectory of the input sample; Step S12: Using the input sample as the taint source and the byte as the taint propagation granularity, select the byte as the basic taint propagation unit and determine the single offset of the tainted value in the input sample; Step S13: Trace the execution instructions of the target program, obtain the behavioral characteristics of the input sample bytes, and generate a list of tainted instructions; Step S14: Merge redundant records in the taint instruction list and optimize the record format; In step S2, constructing the file format tree includes: Step S21: Based on the taint instruction list, sort and classify the taint instructions according to the initial bytes of the taint region and the region size; Step S22: Traverse the instructions according to the initial byte order of the tainted region, and divide the input sample into file regions according to the region boundary specified by the terminating byte of the tainted instruction; Step S23: Initialize the file format tree; Step S24: Recursively follow steps S21-S23 to add other file region nodes to the file format tree and initialize the current node. When the region range of the node to be inserted belongs to the region range of the current node, search for a node in the child node list of the current node. If the region range of the node to be inserted belongs to the child node region, and no child node that meets the condition is found, add the node to be inserted to the child node region list. If a child node that meets the condition is found, set the current node to point to the child node. Step S25: Recursively execute step S24 until the node to be inserted is added to the file format tree; Step S26: Continue with steps S24 and S25 until all region nodes are added to the file format tree.

2. The format-aware fuzzy testing method based on taint analysis according to claim 1, characterized in that, In step S2, constructing the dependency table based on the dependency mutation method includes: The file format tree is traversed using the Depth-First Search (DFS) method to find the leaf nodes of the file format tree; Get the dependency table elements of all nodes on the path from the leaf node to the root node, and add them to the dependency queue of the leaf node; Exploratory and destructive mutations are performed based on the set of region dependency rules; Continue traversing other nodes until all leaf nodes have been traversed.

3. The format-aware fuzzy testing method based on taint analysis according to claim 1, characterized in that, Step S3 also includes: Retrieve the first test case from the seed queue; input it into the target program for execution or exception handling; determine if an exception has occurred, and if so, perform exception handling; otherwise, determine if the current test case contains illegal characters or out-of-bounds access to structure members, and discard the current test case if illegal characters or out-of-bounds access to structure members are found.

4. A format-aware fuzzy testing system based on taint analysis, characterized in that, include: Tainted instruction analysis module: used to input the input sample and seed queue into the target program for testing, and to perform instruction-level taint analysis on the target program to obtain a list of tainted instructions; The structural variation module is used to divide the input sample into regions according to bytes based on the tainted instruction list, identify the region type and dependency relationship according to the relationship between instruction control flow and data flow, and construct a file format tree and dependency table. Test case generation module: used to mutate the nodes of the file format tree according to the file format tree, obtain the dependency relationship of the mutated node, adjust the relevant fields according to the dependency relationship of the mutated node to generate a valid test case, and add the test case to the seed queue; The taint instruction analysis module is used to perform the following steps: Step S11: Perform instruction-level pollution tracing on the target program to obtain the execution trajectory of the input sample; Step S12: Using the input sample as the taint source and the byte as the taint propagation granularity, select the byte as the basic taint propagation unit and determine the single offset of the tainted value in the input sample; Step S13: Trace the execution instructions of the target program, obtain the behavioral characteristics of the input sample bytes, and generate a list of tainted instructions; Step S14: Merge redundant records in the taint instruction list and optimize the record format; The structural variation module includes the following steps for constructing the file format tree: Step S21: Based on the taint instruction list, sort and classify the taint instructions according to the initial bytes of the taint region and the region size; Step S22: Traverse the instructions according to the initial byte order of the tainted region, and divide the input sample into file regions according to the region boundary specified by the terminating byte of the tainted instruction; Step S23: Initialize the file format tree; Step S24: Recursively follow steps S21-S23 to add other file region nodes to the file format tree and initialize the current node. When the region range of the node to be inserted belongs to the region range of the current node, search for a node in the child node list of the current node. If the region range of the node to be inserted belongs to the child node region, and no child node that meets the condition is found, add the node to be inserted to the child node region list. If a child node that meets the condition is found, set the current node to point to the child node. Step S25: Recursively execute step S24 until the node to be inserted is added to the file format tree; Step S26: Continue with steps S24 and S25 until all region nodes are added to the file format tree.

5. The format-aware fuzzy testing system based on taint analysis according to claim 4, characterized in that, The structural mutation module, which constructs a dependency table based on the dependency mutation method, includes: The file format tree is traversed using the Depth-First Search (DFS) method to find the leaf nodes of the file format tree; Get the dependency table elements of all nodes on the path from the leaf node to the root node, and add them to the dependency queue of the leaf node; Exploratory and destructive mutations are performed based on the set of region dependency rules; Continue traversing other nodes until all leaf nodes have been traversed.

6. The format-aware fuzzy testing system based on taint analysis according to claim 4, characterized in that, The test case generation module is also used for: Retrieve the first test case from the seed queue; input it into the target program for execution or exception handling; determine if an exception has occurred, and if so, perform exception handling; otherwise, determine if the current test case contains illegal characters or out-of-bounds access to structure members, and discard the current test case if illegal characters or out-of-bounds access to structure members are found.

Images