Software supply chain vulnerability verification code generation method based on guide fuzzy testing
Through guided fuzz testing technology, the three-party library dependency graph and function call graph are generated, the vulnerability function layer distance and priority are calculated, and the energy allocation is performed, solving the problem of inefficient fuzz testing and achieving more efficient vulnerability detection in binary software supply chain.
CN120408645AActive Publication Date: 2025-08-01NAT UNIV OF DEFENSE TECH
5 Cites 2 Cited by
Patent Information
- Application Number
- CN202510875594.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-27
- Publication Date
- 2025-08-01
- Estimated Expiration
- 2045-06-27
AI Technical Summary
Technical Problem
Existing fuzz testing techniques are inefficient in detecting binary software supply chain vulnerabilities and fail to effectively consider the impact of component vulnerabilities.
Method used
Using a guided fuzz testing method, the vulnerability function layer distance, pre-function and function priority are calculated by generating three-party library dependency graphs, static component analysis and function call graphs, and directed utility calculations and energy allocation are carried out to improve the targetedness of fuzz testing.
Benefits of technology
It improves the efficiency of binary file vulnerability detection and can more effectively detect security defects in the software supply chain.
✦ Generated by Eureka AI based on patent content.
Abstract
The invention discloses a software supply chain vulnerability verification code generation method based on guiding fuzzy testing. The method comprises the steps that s1, a tripartite library dependency graph with a binary program as a starting node is generated; s2, performing static component analysis on the target application software component to form a component dependency graph; analyzing the component dependency graph layer by layer, and constructing an overall function call graph; s3, matching all vulnerability functions existing in the three-party component based on CVE information, calculating vulnerability function layer distance according to an overall function call graph, and performing directed utility calculation on a prepositioned function and a function priority for fuzzy test energy distribution; s4, performing key node identification and vulnerability distance calculation on a tripartite library critical function in the overall function call graph; and s5: transmitting binary static analysis results of s1 to s4 to a fuzzy test tool for directional fuzzy test. The method has the advantages of being simple in principle, easy to implement, higher in testing capacity, better in applicability and the like.
Need to check novelty before this filing date? Find Prior Art