Unmanned aerial vehicle configuration error fuzzy test method and system based on check points

Abstract

The invention belongs to the field of unmanned aerial vehicle software testing, and particularly relates to an unmanned aerial vehicle configuration error fuzzy testing method and system based on check points. The system comprises a check point extraction module which generates an executable program Param2Stp, takes a flight task and configuration as input, and generates a physical state of an unmanned aerial vehicle; the constraint extraction module is used for extracting a configuration range and an association relationship; the heuristic variation module defines the variation range of the configuration parameters by utilizing the boundary and the incidence relation extracted by the configuration constraint extraction module, then, the heuristic variation module varies the values of the configuration parameters, uses Param2Stp as feedback to guide the mutation process and calculate the fitness score, and through the iteration process, the fitness score of the configuration parameters is calculated. And finally, an effective configuration boundary is generated.

Description

Technical Field

[0001] The present invention belongs to the field of unmanned aerial vehicle software testing, and more specifically, relates to a checkpoint-based unmanned aerial vehicle configuration error fuzzy testing method and system. Background Art

[0002] As an automated means of transportation, the core advantage of drones is that they can fly autonomously through preset programs. Users can set flight plans through ground control stations or mobile applications, including parameters such as waypoints, flight altitude, and speed. Drones can automatically complete a series of complex operations such as takeoff, cruising, aerial photography, and landing. Modern drone systems usually allow users to adjust flight performance by modifying configuration parameters (such as flight speed, maximum yaw angle, hovering accuracy, return altitude, etc.) to meet diverse mission requirements. However, this high degree of configurability also brings significant technical challenges: first, existing drone flight control software generally lacks strict constraints on the range of configuration parameters, resulting in the system accepting obviously unreasonable parameter values; second, there are complex correlations between the configuration parameters, and the modification of a single parameter may affect the operation of multiple subsystems; finally, due to the lack of an effective parameter verification mechanism, users are prone to errors when configuring parameters. Such configuration errors may cause drones to fail to perform their missions as planned, or may cause serious accidents such as flight loss of control and crashes, posing a major threat to the safety of people and property. Therefore, ensuring the safety and reliability of drone configuration parameters has become a key issue that needs to be urgently addressed in the field of drone technology.

[0003] Fuzz testing is an automated testing technology that detects potential errors in software by generating a large amount of random or abnormal input data. It is particularly suitable for discovering configuration errors. This method can efficiently cover complex parameter spaces and boundary conditions, reveal hidden correlations between configuration parameters, and effectively identify abnormal behaviors caused by configuration errors in drone systems. Fuzz testing-based configuration error detection methods provide an effective way to solve the above technical challenges.

[0004] At present, the main defects of drone configuration error fuzz testing are as follows: (1) The feedback mutation algorithm based on binary search and simulation execution cannot find discontinuous configuration parameter ranges. At the same time, the time consumption of using simulators as feedback for fuzz testing is huge, resulting in reduced efficiency of fuzz testing. (2) The feedback compilation algorithm based on genetic algorithms and machine learning cannot locate the root cause of configuration errors when too many configuration parameters are mutated in a single time. In addition, the deep learning method requires a large amount of flight data, and has limited prediction effect on flight plans and configuration parameters in new scenarios. Summary of the invention

[0005] In summary, it is crucial to design an efficient fuzz testing feedback tool to improve the fuzz testing of UAV configuration parameters. By means of program analysis, checkpoint generation code is extracted for fuzz testing to feedback the UAV state. At the same time, the constraints on the range and correlation of configuration parameters in the code can also be extracted by program analysis methods to improve the accuracy of configuration space search.

[0006] The purpose of the present invention is to provide a method and system for fuzz testing configuration errors of flight control software based on checkpoints, which are used to solve the challenges in the current fuzz testing technology of flight control software configuration parameters: the configuration errors discovered by the mutation strategy are not accurate enough, and the efficiency and accuracy of fuzz testing feedback are low.

[0007] To achieve the above purpose, the present invention adopts the following technical solutions:

[0008] A fuzz testing system for UAV configuration errors based on checkpoints, the fuzz testing system for UAV configuration errors includes a checkpoint extraction module, a constraint extraction module, and a heuristic mutation module;

[0009] The checkpoint extraction module generates an executable program Param2Stp, takes the flight mission and configuration as inputs, and generates the physical state of the UAV;

[0010] The constraint extraction module is used to extract the range and correlation of the configuration;

[0011] The heuristic mutation module uses the boundaries and correlation relationships extracted by the configuration constraint extraction module to define the mutation range of configuration parameters. Then, the heuristic mutation module mutates the values of the configuration parameters and uses Param2Stp as feedback to guide the mutation process and calculate the fitness score. Through this iterative process, effective configuration boundaries will eventually be generated.

[0012] For further optimization of this technical solution, the checkpoint refers to the target state or reference value that the UAV system expects to reach, and the ideal flight state calculated by the flight control system according to the preset flight plan and configuration parameters, including position, speed, and attitude information.

[0013] For further optimization of this technical solution, the checkpoint extraction module takes the source code of the flight control system as input and outputs an executable program Param2Stp, which can accept configuration parameters and flight plans as inputs and calculate the physical state of the UAV.

[0014] For further optimization of this technical solution, the range of the configuration refers to the boundary values of the configuration parameters, and the correlation relationship refers to the dependency relationship or interaction between different configuration parameters. Changing one parameter may affect the behavior or effectiveness of another parameter.

[0015] A checkpoint-based fuzz testing method for UAV configuration errors, comprising the following steps:

[0016] Step 1: The checkpoint extraction module takes the source code of the flight control system as input and outputs an executable program Param2Stp, which can accept configuration parameters and flight plans as input and calculate the physical state of the UAV;

[0017] Step 2: The constraint extraction module is used to extract the scope and association relationships of the configuration;

[0018] Step 3: The heuristic mutation module uses the boundaries and association relationships extracted by the configuration constraint extraction module to define the mutation range of the configuration parameters. Then, the heuristic mutation module mutates the values of the configuration parameters and uses Param2Stp as feedback to guide the mutation process and calculate the fitness score. Through this iterative process, effective configuration boundaries will eventually be generated.

[0019] For further optimization of this technical solution, the specific steps of Step 1 are as follows:

[0020] Step 1.1: The unit tests in the flight control code are used to verify whether the key methods can correctly modify the physical state of the UAV. After determining the physical state to be output, match the physical state in the unit test code, and then determine the key methods for modifying this physical state, and construct a mapping from the key methods to the physical state;

[0021] Step 1.2: Perform static data flow analysis on the flight control code starting from the reading points of the configuration parameters. By tracking the propagation path of the configuration parameters in the code, identify all methods affected by the configuration parameters;

[0022] Step 1.3: Based on the mapping from the configuration parameters to the physical state constructed in Steps 1.2 and 1.3, perform data flow analysis on the flight control code. The data flow analysis algorithm is as follows:

[0023] 1. If the right value of the statement is a configuration parameter, add the statement and its associated key functions in the data flow graph to the output code set;

[0024] 2. If the left value of the statement is mapped to the physical state, add it to the checkpoint variable set and add its associated potential code to the potentially relevant code set;

[0025] 3. If the statement contains a function call, recursively extract the relevant code in the function and add it to the potentially relevant code set;

[0026] 4. The algorithm performs data flow backward slicing on each checkpoint variable, extracts the code related to the configuration parameters, and adds it to the output code set;

[0027] Finally, the data flow analysis algorithm returns a set of output codes, that is, checkpoint generation codes related to configuration parameters, and integrates the code snippets into an executable program Param2Stp. Param2Stp takes the flight plan and configuration parameters as inputs, calculates and outputs the physical state of the drone.

[0028] For further optimization of this technical solution, step 2 specifically includes:

[0029] Step 2.1: Locate all read points of configuration parameters in the source code according to the configuration parameter list provided in the user manual, and identify variable declarations and assignment statements related to configuration parameters in the source code through code scanning and pattern matching techniques;

[0030] Step 2.2: Use pointer analysis techniques to identify all reference points and dependencies of configuration parameter variables in the code, and trace the propagation path and usage of configuration parameters in the code by constructing a control flow graph and a data flow graph;

[0031] Step 2.3: Based on the control flow graph and the data flow graph, analyze the bounding functions and conditional judgment statements in the code, and extract the numerical range constraints of the configuration parameters;

[0032] Step 2.4: Analyze the conditional statements in the control flow graph and the data flow graph, identify the implicit association relationships between multiple configuration parameters, and generate a list of configuration parameter combinations with dependency relationships by extracting these association relationships.

[0033] For further optimization of this technical solution, step 3 specifically includes:

[0034] Step 3.1: One-dimensional mutation mutates the values of configuration parameters with the configuration parameters obtained by the constraint extraction module as inputs:

[0035] 1) Using the parameter value range obtained based on pointer analysis as the initial search space, for each target configuration parameter, randomly initialize n candidate values within its value range, keep other configuration parameters default, and the target configuration parameter and other configuration parameters form a configuration set, with a total of n configuration sets;

[0036] 2) Param2Stp takes the flight plan and the configuration set as inputs and calculates the physical state of the drone;

[0037] 3) The fitness function calculates the fitness scores of n configuration sets that may have abnormal states based on the physical state. The higher the score, the higher the possibility of generating an abnormality;

[0038] 4) The system selects the top K target parameters with the highest fitness scores and adds them to the result set;

[0039] 5) The system selects the parameter value with the highest current fitness from the result set as a benchmark, and performs directional mutation within the range of ±50% of its value to generate n new candidate values and recalculate the fitness scores.

[0040] 6) After a specified number of iterations, the system outputs all the configuration parameters marked as incorrect in the result set.

[0041] 7) The system eliminates these incorrect configurations from the original range obtained by pointer analysis and retains the continuous valid value range as the final valid interval of this configuration parameter.

[0042] Step 3.2, Multidimensional Mutation: Using the valid range of a single configuration parameter and the association relationship of configuration parameters obtained in the above steps as inputs, mutate the values of multiple configuration parameters:

[0043] ① For the target parameter, randomly generate n candidate values within its valid range. For the parameters associated with it, fix them at their maximum values or default values, and keep other configuration parameters at their default values, thus constructing a total of 2n configuration sets.

[0044] ② Param2Stp takes the flight plan and the configuration sets as inputs and calculates the physical state of the UAV.

[0045] ③ The fitness function calculates the fitness scores of the 2n configuration sets for possible abnormal states according to the physical state. The higher the score, the higher the possibility of generating an abnormality.

[0046] ④ The system selects the top K target parameters with the highest fitness scores and adds them to the result set.

[0047] ⑤ The system selects the parameter value with the highest current fitness from the result set as a benchmark, and performs directional mutation within the range of ±50% of its value to generate n new candidate values and recalculate the fitness scores.

[0048] ⑥ After a specified number of iterations, the system outputs all the configuration parameters marked as incorrect in the result set.

[0049] ⑦ The system eliminates these incorrect configurations from the original range obtained by pointer analysis and retains the continuous valid value range as the multidimensional mutation valid range of this configuration parameter.

[0050] For further optimization of this technical solution, the calculation of the fitness score takes the following steps:

[0051] Step 3.1.1: For the stuck state, the motion state of the drone is quantified by monitoring the three-dimensional space movement distance of the drone within a unit time. The system collects the position coordinates of the drone in real time and calculates the displacement within a fixed time interval. When the drone is completely stationary, the displacement approaches zero, and the fitness score reaches the maximum value, indicating a risk of getting stuck.

[0052] Step 3.1.2: For the deviation state, a geometric method is used to accurately quantify the deviation degree between the actual flight path of the drone and the predetermined flight route. First, the spatial coordinates of the inspection point are obtained, and then the perpendicular distance from this point to the line connecting the nearest waypoint is calculated. The larger this distance value is, the more serious the degree of the drone deviating from the predetermined flight route.

[0053] Step 3.1.3: For the state of rapid ascent or descent, the flight stability of the drone is evaluated by analyzing its vertical speed. When the vertical speed approaches or exceeds the safety threshold, the fitness score approaches the maximum value, indicating a risk of flight instability.

[0054] Different from the prior art, the beneficial effects of the above technical solutions are as follows:

[0055] The present invention extracts the generation code of the inspection points in the flight code through program analysis as the feedback for fuzz testing, greatly improving the feedback speed. For a flight plan with 10 points, the time for the simulator to generate the physical state exceeds 3 minutes, and the time for Param2Stp is 3.8 milliseconds. At the same time, compared with the machine learning method, the present invention does not require log training, has a higher accuracy, and can adapt to more flight scenarios. The differences between the inspection points generated by Param2Stp and the inspection points of the flight record are 7.57 cm in latitude, 8.77 cm in longitude, 4.26 cm in altitude, and 0.64 seconds in flight time, and the relative error rates are 1.77%, 0.64%, 5.96%, and 8.92% respectively.

[0056] The one-dimensional and multi-dimensional mutation methods designed by the present invention can accurately locate the root cause of configuration errors compared with the mutation based on the genetic algorithm. Taking a random way in the mutation initialization can also find discontinuous finite ranges. Compared with the mutation strategy of binary search, 2 configuration errors with discontinuous ranges are found, and the effective range generated by the present invention has an efficiency of 88% compared with the genetic algorithm. Through average sampling detection, the effectiveness of the effective range of the present invention can reach 99.85%, which can effectively assist users to complete the reasonable configuration of the drone. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a schematic diagram of the overall architecture of the drone configuration error fuzz testing system based on inspection points. DETAILED DESCRIPTION OF THE INVENTION

[0058] To elaborate in detail on the technical content, structural features, achieved objectives, and effects of the technical solution, the following will be described in detail in conjunction with specific embodiments and with the aid of the accompanying drawings.

[0059] As Figure 1 shown, it is a schematic diagram of the overall architecture of an unmanned aerial vehicle (UAV) configuration error fuzz testing system based on checkpoints. The UAV configuration error fuzz testing system based on checkpoints includes a checkpoint extraction module, a constraint extraction module, and a heuristic mutation module.

[0060] The checkpoint extraction module generates an executable program Param2Stp, takes the flight mission and configuration as inputs, and generates the physical state of the UAV.

[0061] The constraint extraction module is used to extract the range and correlation relationships of the configuration.

[0062] The heuristic mutation module uses the boundaries and correlation relationships extracted by the configuration constraint extraction module to define the mutation range of the configuration parameters. Then, the heuristic mutation module mutates the values of the configuration parameters and uses Param2Stp as feedback to guide the mutation process and calculate the fitness score. Through this iterative process, the present invention will ultimately generate effective configuration boundaries to ensure its correctness and reliability.

[0063] A checkpoint refers to the target state or reference value that the UAV system expects to reach, the ideal flight state calculated by the flight control system based on the preset flight plan and configuration parameters, including information such as position, speed, and attitude. By extracting the checkpoints related to the configuration parameters, the prediction of the physical state of the UAV can be achieved, and using it as feedback for fuzz testing can improve the testing efficiency.

[0064] The method for fuzz testing UAV configuration errors based on checkpoints includes the following steps:

[0065] Step 1: The checkpoint extraction module takes the source code of the flight control system as input and outputs an executable program Param2Stp, which can accept configuration parameters and a flight plan as inputs and calculate the physical state of the UAV;

[0066] Step 2: The constraint extraction module is used to extract the range and correlation relationships of the configuration;

[0067] Step 3: The heuristic mutation module uses the boundaries and correlation relationships extracted by the configuration constraint extraction module to define the mutation range of the configuration parameters. Then, the heuristic mutation module mutates the values of the configuration parameters and uses Param2Stp as feedback to guide the mutation process and calculate the fitness score. Through this iterative process, effective configuration boundaries will ultimately be generated.

[0068] The steps included in the checkpoint code extraction module are as follows:

[0069] Step 1.1. Unit tests in the flight control code are used to verify whether key methods can correctly modify the physical state of the drone (such as position, speed, attitude, etc.). After determining the physical state to be output, match the physical state in the unit test code, and then determine the key methods for modifying this physical state, and construct a mapping from the key methods to the physical state;

[0070] Step 1.2. Perform static data flow analysis on the flight control code starting from the reading point of the configuration parameters (the position in the code where the configuration parameters are read from the configuration file). By tracking the propagation path of the configuration parameters in the code, identify all functions affected by the configuration parameters;

[0071] Step 1.3. Based on the mapping from the configuration parameters to the physical state constructed in Steps 1.2 and 1.3, perform data flow analysis on the flight control code. The data flow analysis algorithm is as follows:

[0072] 1. If the right value of the statement is a configuration parameter, add the statement and its associated key functions in the data flow graph to the output code set.

[0073] 2. If the left value of the statement maps to a physical state, add it to the checkpoint variable set and add its associated potential code to the potentially related code set.

[0074] 3. If the statement contains a function call, recursively extract the relevant code in the function and add it to the potentially related code set.

[0075] 4. The algorithm performs backward slicing of the data flow for each checkpoint variable, extracts the code related to the configuration parameters, and adds it to the output code set.

[0076] Finally, the data flow analysis algorithm returns the output code set, that is, the checkpoint generation code related to the configuration parameters, and integrates the code fragments into an executable program Param2Stp. Param2Stp takes the flight plan and configuration parameters as inputs and calculates and outputs the physical state of the drone.

[0077] The constraint extraction module is used to extract the scope and association relationships of the configuration. The scope of the configuration refers to the boundary values (maximum and minimum values) of the configuration parameters, and the association relationship refers to the dependency or interaction between different configuration parameters. Changing one parameter may affect the behavior or validity of another parameter.

[0078] Step 2.1. According to the list of configuration parameters provided in the user manual, locate all the reading points of the configuration parameters in the source code. By using code scanning and pattern matching techniques, identify the variable declarations and assignment statements related to the configuration parameters in the source code;

[0079] Step 2.2: Using pointer analysis techniques, identify all reference points and dependencies of configuration parameter variables in the code. By constructing a control flow graph (CFG) and a data flow graph (DFG), trace the propagation paths and usage of configuration parameters in the code;

[0080] Step 2.3: Based on the control flow graph and the data flow graph, analyze the bounding functions (such as min(), max(), etc.) and conditional judgment statements in the code, and extract the numerical range constraints of the configuration parameters;

[0081] Step 2.4: Analyze the conditional statements in the control flow graph and the data flow graph, and identify the implicit correlation relationships between multiple configuration parameters. For example, some configuration parameters may be used simultaneously in the same conditional statement, or the value of one parameter depends on the value of another parameter. By extracting these correlation relationships, generate a list of configuration parameter combinations with dependency relationships.

[0082] The specific implementation steps of the heuristic mutation algorithm module are as follows:

[0083] Step 3.1: One-dimensional mutation takes the configuration parameters obtained by the configuration constraint extraction module as input to mutate the values of the configuration parameters:

[0084] 1. Using the parameter value range obtained based on pointer analysis as the initial search space, for each target configuration parameter, randomly initialize n candidate values within its value range, and keep other configuration parameters at their default values. The target configuration parameter and other configuration parameters form a configuration set, with a total of n configuration sets;

[0085] 2. Param2Stp takes the flight plan and the configuration set as input and calculates the physical state of the UAV.

[0086] 3. The fitness function calculates the fitness scores of the n configuration sets for possible abnormal states based on the physical state. The higher the score, the higher the possibility of generating an abnormality;

[0087] 4. The system selects the top K target parameters with the highest fitness scores and adds them to the result set.

[0088] 5. The system selects the parameter value with the highest current fitness in the result set as the benchmark, and performs directional mutation within the range of ±

[0089] 50% of its value to generate n new candidate values and recalculate the fitness scores.

[0090] 6. After a specified number of iterations, the system outputs all the configuration parameters marked as errors in the result set.

[0091] 7. The system will eliminate these incorrect configurations from the original range obtained from the pointer analysis, and retain the continuous valid value range as the final valid interval of this configuration parameter.

[0092] Step 3.2: Use the valid range of a single configuration parameter and the association relationship of the configuration parameters obtained in the above steps as input, and mutate the values of multiple configuration parameters:

[0093] 1. For the target parameter, randomly generate n candidate values within its valid range. For the associated parameters, fix them at their maximum values or default values. Other configuration parameters remain at their default values. A total of 2n configuration sets are constructed;

[0094] 2. Param2Stp takes the flight plan and the configuration set as input and calculates the physical state of the UAV.

[0095] 3. The fitness function calculates the fitness scores of the 2n configuration sets for possible abnormal states based on the physical state. The higher the score, the higher the likelihood of an abnormality;

[0096] 4. The system selects the top K target parameters with the highest fitness scores and adds them to the result set.

[0097] 5. The system selects the parameter value with the highest current fitness in the result set as the benchmark, and performs directional mutation within the range of ±

[0098] 50% of its value to generate n new candidate values and recalculate the fitness scores.

[0099] 6. After a specified number of iterations, the system outputs all the configuration parameters marked as incorrect in the result set.

[0100] 7. The system will eliminate these incorrect configurations from the original range obtained from the pointer analysis, and retain the continuous valid value range as the multi-dimensional mutation valid range of this configuration parameter.

[0101] Multi-dimensional mutation narrows the search range of mutation by introducing the association relationship of configuration parameters, improving the efficiency of fuzz testing.

[0102] The present invention focuses on three typical abnormal states that may occur during the flight of a UAV: jamming, deviation, and rapid ascent / descent. The following steps are taken for calculating the fitness scores:

[0103] Step 3.1.1: For the jamming state, quantify its motion state by monitoring the three-dimensional space movement distance of the UAV within a unit time. The system collects the position coordinates of the UAV in real time and calculates the displacement within a fixed time interval. When the UAV is completely stationary, the displacement approaches zero and the fitness score reaches the maximum value, indicating a risk of jamming.

[0104] Step 3.1.2: For the deviation state, use geometric methods to accurately quantify the deviation degree between the actual flight path of the UAV and the predetermined flight route. The system first obtains the spatial coordinates of the inspection point, and then calculates the perpendicular distance from this point to the line connecting to the nearest waypoint. The larger this distance value is, the more serious the deviation of the UAV from the predetermined flight route is.

[0105] Step 3.1.3: For the rapid ascent or descent state, evaluate the flight stability of the UAV by analyzing its vertical speed. When the vertical speed approaches or exceeds the safety threshold, the fitness score approaches the maximum value, indicating the risk of flight instability.

[0106] Through the fuzz testing system of the present invention, it is possible to obtain the physical state of the UAV in real time without relying on a simulator, and use it as the feedback information for fuzz testing, thereby quickly guiding the subsequent mutation process and significantly improving the efficiency of fuzz testing. Compared with traditional methods, the present invention not only avoids the time consumption caused by the simulator, but also does not rely on a large amount of training data, can adapt to more complex and changeable flight scenarios, and has stronger versatility and practicality.

[0107] In terms of the mutation strategy, the present invention adopts a method combining one-dimensional mutation and multi-dimensional mutation. One-dimensional mutation can quickly locate the root cause of configuration errors by generating the effective range of a single configuration parameter; while multi-dimensional mutation can deeply study the mutual relationship between multiple configuration errors by adjusting multiple configuration parameters simultaneously, so as to comprehensively cover the possibility of configuration errors. In the mutation initialization process, the present invention adopts the method of randomly initializing seeds, which significantly improves the efficiency and diversity of the search, can effectively discover discontinuous configuration spaces, and avoid the search blind area caused by the fixed initialization strategy of traditional methods. In the multi-dimensional mutation process, the present invention extracts the correlation relationship between configuration parameters through program analysis technology, and generates mutation values of configuration parameters based on these correlation relationships. This method can not only reduce the search space of multi-configuration combinations, but also significantly improve the search efficiency of mutation. For example, by analyzing the dependency relationship between configuration parameters, invalid configuration combinations can be avoided, so as to focus the search on the configuration space that may cause exceptions. In addition, the present invention further optimizes the search process by dynamically adjusting the mutation strategy to ensure that more configuration errors are discovered within a limited time.

[0108] In summary, through the innovative fuzz testing system and mutation strategy of the present invention, the efficient detection and optimization of UAV configuration parameters are realized, the testing efficiency and coverage rate are significantly improved, and a strong technical guarantee is provided for the safety and reliability of the UAV flight control system.

[0109] It should be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprising", "including" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or terminal device. Without further limitation, an element defined by the statement "comprising..." or "including..." does not exclude the existence of additional elements in the process, method, article or terminal device comprising the said element. In addition, in this text, "greater than", "less than", "exceeding" etc. are understood not to include the present number; "above", "below", "within" etc. are understood to include the present number.

[0110] Although the above-described embodiments have been described, those skilled in the art can make additional changes and modifications once they learn the basic creative concept. Therefore, the above are only the embodiments of the present invention, and do not limit the patent protection scope of the present invention. Any equivalent structure or equivalent process transformation made by using the content of the specification and drawings of the present invention, or directly or indirectly applied in other related technical fields, are equally included in the patent protection scope of the present invention.

Claims

1. A checkpoint-based fuzz testing system for UAV configuration errors, characterized in that The UAV configuration error fuzz testing system includes a checkpoint extraction module, a constraint extraction module, and a heuristic mutation module; The checkpoint extraction module generates an executable program Param2Stp, takes the flight mission and configuration as inputs, and generates the physical state of the UAV; The constraint extraction module is used to extract the range and association relationships of the configuration; The heuristic mutation module uses the boundaries and association relationships extracted by the configuration constraint extraction module to define the mutation range of the configuration parameters. Then, the heuristic mutation module mutates the values of the configuration parameters and uses Param2Stp as feedback to guide the mutation process and calculate the fitness score. Through this iterative process, effective configuration boundaries will eventually be generated.

2. The checkpoint-based UAV configuration error fuzz testing system according to claim 1, wherein The checkpoint refers to the target state or reference value that the UAV system expects to reach, and the ideal flight state calculated by the flight control system according to the preset flight plan and configuration parameters, including position, speed, and attitude information.

3. The checkpoint-based UAV configuration error fuzz testing system according to claim 1, wherein The checkpoint extraction module takes the source code of the flight control system as input and outputs an executable program Param2Stp, which can accept configuration parameters and a flight plan as inputs and calculate the physical state of the UAV.

4. The checkpoint-based UAV configuration error fuzz testing system according to claim 1, characterized in that The range of the configuration refers to the boundary values of the configuration parameters, and the association relationship refers to the dependency or interaction between different configuration parameters. Changing one parameter may affect the behavior or effectiveness of another parameter.

5. The checkpoint-based drone configuration error fuzz testing method according to any one of claims 1-4, characterized in that It includes the following steps: Step 1: The checkpoint extraction module takes the source code of the flight control system as input and outputs an executable program Param2Stp, which can accept configuration parameters and a flight plan as inputs and calculate the physical state of the UAV; Step 2: The constraint extraction module is used to extract the range and association relationships of the configuration; Step 3: The heuristic mutation module uses the boundaries and association relationships extracted by the configuration constraint extraction module to define the mutation range of the configuration parameters. Then, the heuristic mutation module mutates the values of the configuration parameters and uses Param2Stp as feedback to guide the mutation process and calculate the fitness score. Through this iterative process, effective configuration boundaries will eventually be generated.

6. The checkpoint-based drone configuration error fuzz testing method according to the claim, characterized in that The specific content of Step 1 is as follows: Step 1.1: The unit tests in the flight control code are used to verify whether the key methods can correctly modify the physical state of the UAV. After determining the physical state to be output, match the physical state in the unit test code, and then determine the key methods for modifying this physical state, and construct a mapping from the key methods to the physical state; Step 1.2: Start static data flow analysis of the flight control code from the reading points of the configuration parameters. By tracking the propagation path of the configuration parameters in the code, identify all the methods affected by the configuration parameters; Step 1.3: Based on the mapping from the configuration parameters to the physical state constructed in Steps 1.2 and 1.3, perform data flow analysis on the flight control code. The data flow analysis algorithm is as follows:

1. If the right value of the statement is a configuration parameter, add the statement and its associated key functions in the data flow graph to the output code set; 2. If the left value of the statement maps to a physical state, add it to the checkpoint variable set and add its associated potential code to the potential related code set; 3. If the statement contains a function call, recursively extract the relevant code in the function and add it to the set of potentially relevant codes; 4. The algorithm slices the data stream backward for each checkpoint variable, extracts the code related to the configuration parameters, and adds it to the output code set; Finally, the data flow analysis algorithm returns a set of output codes, namely, the checkpoint generation code related to the configuration parameters, and integrates the code fragments into an executable program Param2Stp, which calculates and outputs the physical state of the drone based on the flight plan and configuration parameters.

7. The checkpoint-based drone configuration error fuzz testing method according to the claim, characterized in that The step 2 specifically includes: Step 2.1, according to the configuration parameter list provided in the user manual, locate the reading points of all configuration parameters in the source code, and identify the variable declarations and assignment statements related to the configuration parameters in the source code through code scanning and pattern matching technology; Step 2.2: Use pointer analysis technology to identify all reference points and dependencies of configuration parameter variables in the code, and trace the propagation path and usage of configuration parameters in the code by constructing control flow graphs and data flow graphs; Step 2.3: Based on the control flow graph and data flow graph, analyze the bounded functions and conditional judgment statements in the code to extract the numerical range constraints of the configuration parameters; Step 2.4: Analyze the conditional statements in the control flow graph and the data flow graph, identify the implicit associations between multiple configuration parameters, and generate a list of configuration parameter combinations with dependencies by extracting these associations.

8. The checkpoint-based method for fuzz testing of UAV configuration errors as claimed in the claim, wherein The step 3 specifically includes: Step 3.1: One-dimensional mutation uses the configuration parameters obtained by the constraint extraction module as the values of the input mutation configuration parameters: 1) The parameter value range obtained based on pointer analysis is used as the initial search space. For each target configuration parameter, n candidate values are randomly initialized within its value range. Other configuration parameters remain default. The target configuration parameter and other configuration parameters form a configuration set, totaling n configuration sets; 2) Param2Stp takes the flight plan and configuration set as input and calculates the physical state of the drone; 3) The fitness function calculates the fitness scores of the n configuration sets that may have abnormal states based on the physical state. The higher the score, the higher the possibility of abnormality. 4) The system selects the top K target parameters with the highest fitness scores and adds them to the result set; 5) The system selects the parameter value with the highest current fitness from the result set as the benchmark, performs directed mutation within the range of ±50% of its value, generates n new candidate values and recalculates the fitness score; 6) After the specified number of iterations, the system outputs all configuration parameters marked as errors in the result set; 7) The system will remove these incorrect configurations from the original range obtained by pointer analysis and retain the continuous valid value range as the final valid range of the configuration parameter; Step 3.2: Multidimensional mutation The valid range of a single configuration parameter and the relationship between configuration parameters obtained in the above steps are used as input to mutate the values of multiple configuration parameters: ①For the target parameter, randomly generate n candidate values within its valid range. For the parameter associated with it, fix it to its maximum value or default value, and keep other configuration parameters as default values. A total of 2n configuration sets are constructed. ②Param2Stp takes the flight plan and configuration sets as inputs and calculates the physical state of the UAV. ③The fitness function calculates the fitness scores of the 2n configuration sets for possible abnormal states based on the physical state. The higher the score, the higher the possibility of an abnormality. ④The system selects the top K target parameters with the highest fitness scores and adds them to the result set. ⑤The system selects the parameter value with the highest current fitness in the result set as the benchmark, performs directional mutation within the range of ±50% of its value, generates n new candidate values, and recalculates the fitness scores. ⑥After a specified number of iterations, the system outputs all the configuration parameters marked as errors in the result set. ⑦The system eliminates these incorrect configurations from the original range obtained from the pointer analysis and retains the continuous valid value range as the multi-dimensional mutation valid range for this configuration parameter.

9. The checkpoint-based drone configuration error fuzz testing method according to the claim, characterized in that The calculation of the fitness score is carried out as follows: Step 3.1.1: For the stuck state, quantify its motion state by monitoring the three-dimensional space movement distance of the UAV within a unit time. The system collects the position coordinates of the UAV in real time and calculates the displacement within a fixed time interval. When the UAV is completely stationary, the displacement approaches zero, and the fitness score reaches the maximum value, indicating a risk of getting stuck. Step 3.1.2: For the deviation state, use geometric methods to accurately quantify the deviation degree between the actual flight path of the UAV and the predetermined flight route. First, obtain the spatial coordinates of the inspection point, and then calculate the perpendicular distance from this point to the line connecting to the nearest waypoint. The larger this distance value, the more serious the deviation of the UAV from the predetermined flight route. Step 3.1.3: For the rapid ascent or descent state, evaluate the flight stability of the UAV by analyzing its vertical speed. When the vertical speed approaches or exceeds the safety threshold, the fitness score approaches the maximum value, indicating a risk of flight instability.

Images