Fuzzy test tool detection method and system based on dynamic behavior analysis
By reading and analyzing software running data, using sliding window technology and dynamic behavior analysis, the limitations of existing fuzz testing tool detection methods are solved, and efficient and accurate identification of fuzz testing tools and security protection of software systems are achieved.
Patent Information
- Application Number
- CN202510331139.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-20
- Publication Date
- 2025-08-05
AI Technical Summary
The existing fuzz testing tool detection methods are difficult to cope with diversified attack modes and rapidly evolving technical means. Static analysis cannot capture the dynamic behavior characteristics of the software when running, and it is difficult to distinguish the behavior of normal user operations from the fuzz testing tool. It cannot adapt to the needs of rapid iteration of software and complex operating environments.
By reading the number of triggers of each branch basic block during the software run, calculating the product sum and standard deviations in continuous time periods, designing curve evaluation indicators, determining whether the characteristic curve is within the preset range, using sliding window technology for real-time analysis, defining the behavioral differences between the fuzzy testing tool and normal users, and setting a threshold range for accurate detection.
It realizes efficient and accurate detection of fuzz testing tools, adapts to the environment of rapid software updates, flexibly adjusts detection strategies, and improves the security protection capabilities of the software system.
Smart Images
Figure CN120429243A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of software security technology, and specifically relates to a fuzz testing tool detection method and system based on dynamic behavior analysis, which is suitable for scenarios such as software vulnerability protection and automated attack defense. Background Art
[0002] With the rapid development of computer technology and the internet, software systems are increasingly being used in mobile terminals, IoT devices, industrial control equipment, and cloud computing platforms. However, software systems are also facing increasing security threats, particularly from automated attack methods such as fuzz testing tools. Fuzz testing tools generate large amounts of random or semi-random input data in an attempt to trigger abnormal software behavior and discover potential vulnerabilities, posing a serious threat to the security and stability of software systems.
[0003] Since its emergence in the 1990s, fuzz testing technology has evolved from random input generation to today's intelligent, targeted testing. Modern fuzz testing tools (such as AFL and LibFuzzer) combine code coverage analysis, genetic algorithms, and symbolic execution to efficiently discover software vulnerabilities. However, the misuse of this technology also poses new security challenges. Attackers use fuzz testing tools to conduct large-scale scanning and vulnerability discovery on target systems, potentially leading to sensitive data leaks, service interruptions, and even system failures.
[0004] Currently, detection methods for fuzz testing tools primarily rely on static analysis and rule-based matching techniques, both of which have numerous limitations. First, traditional methods struggle to cope with the diverse attack modes and rapidly evolving techniques of fuzz testing tools. Second, static analysis cannot effectively capture the dynamic behavior of software at runtime. Third, rule-based matching techniques struggle to distinguish between normal user operations and fuzz testing tool behavior. Finally, existing methods struggle to adapt to the demands of rapid software iteration and complex operating environments.
[0005] With the increasing popularity of open source software and the shortening of software delivery cycles, traditional detection methods are becoming inadequate when dealing with new fuzz testing tools. Therefore, a fuzz testing tool detection method based on dynamic behavior analysis is urgently needed to improve the security protection capabilities of software systems. Summary of the Invention
[0006] In response to the above problems, the present invention discloses a fuzz testing tool detection method and system based on dynamic behavior analysis, which realizes sustainable and accurate detection of fuzz testing tools by effectively acquiring and analyzing software operation data.
[0007] The specific technical solutions are as follows:
[0008] In a first aspect, the present invention proposes a fuzz testing tool detection method based on dynamic behavior analysis, comprising:
[0009] Read the current trigger count of each branch basic block when the software is running;
[0010] Calculate the sum of the products of the weights and the triggering times of each branch basic block at each moment in a continuous time period, as well as the standard deviation of the triggering times of each branch basic block; the sum of the products and the standard deviation in the continuous time period form a product sum curve and a standard deviation curve respectively;
[0011] Design evaluation indicators of the curve to determine whether the evaluation indicators of the product sum curve and the standard deviation curve are within the preset range. When the number of evaluation indicators that do not meet the preset range exceeds the threshold, it is considered that the software is currently attacked by the fuzz testing tool.
[0012] Furthermore, the evaluation indicators include the standard deviation of each point on the curve, the slope of the curve, and the fluctuation amplitude of the curve.
[0013] In a second aspect, the present invention proposes a fuzz testing tool detection system based on dynamic behavior analysis, which is used to implement the above-mentioned fuzz testing tool detection method based on dynamic behavior analysis.
[0014] In a third aspect, the present invention proposes a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned fuzz testing tool detection method based on dynamic behavior analysis is implemented.
[0015] In a fourth aspect, the present invention provides a computer electronic device comprising a memory and a processor;
[0016] The memory is used to store computer programs;
[0017] The processor is used to implement the above-mentioned fuzz testing tool detection method based on dynamic behavior analysis when executing the computer program.
[0018] The beneficial effects of the present invention are as follows: the present invention efficiently obtains runtime data such as the triggering times of each branch basic block in the software, providing basic support for subsequent analysis and detection; performs real-time analysis of local data based on sliding window technology, and achieves an optimal balance between real-time performance, accuracy and resource consumption; defines the sum of the product of the weight of each branch basic block and the triggering times, and the standard deviation of the triggering times of each branch basic block as two core features according to the behavioral differences between fuzz testing tools and normal users, accurately reflecting the specific behavioral patterns of fuzz testing tools; sets a threshold range according to the trend of the core features over a period of time (including the standard deviation of each point on the curve, the slope of the curve, and the curve fluctuation amplitude); if the characteristic value exceeds the threshold range, it is determined to be a fuzz testing tool, thereby achieving efficient detection and accurate identification of the behavior of the fuzz testing tool, and providing an innovative solution for the security protection of software systems. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] Figure 1 This is a schematic diagram of the architecture of the fuzz testing tool detection method based on dynamic behavior analysis;
[0020] Figure 2 This is a schematic diagram of the workflow of the runtime data acquisition module;
[0021] Figure 3 This is a schematic diagram of the workflow of the sliding window dynamic analysis module;
[0022] Figure 4 Schematic diagram of the workflow of the behavioral feature modeling module;
[0023] Figure 5 This is a schematic diagram of the workflow of the dynamic threshold decision module;
[0024] Figure 6 This is a workflow diagram of the behavior detection module of the fuzz testing tool. DETAILED DESCRIPTION
[0025] The present invention will be further described and illustrated below in conjunction with specific embodiments. The embodiments are merely illustrative of the present disclosure and do not limit the scope of the present invention. The technical features of the various embodiments of the present invention may be combined accordingly, provided that there is no conflict between them.
[0026] like Figure 1 As shown, the present invention's fuzz testing tool detection method based on dynamic behavior analysis consists of five modules: a runtime data acquisition module, a sliding window dynamic analysis module, a behavioral feature modeling module, a dynamic threshold decision module, and a fuzz testing tool behavior detection module. Through the collaborative operation of these five modules, the present invention can effectively acquire and analyze software execution data, achieving accurate detection of fuzz testing tools.
[0027] In a specific embodiment of the present invention, the software program is divided into several branch basic blocks, and the runtime data acquisition module is as follows: Figure 2 As shown in the figure, the basic process is as follows: First, the runtime data acquisition module uses memory-mapped I / O technology to map the software execution data file into the process address space and read the trigger counts of each branch basic block in the software in array form. The file stores the array of the current trigger counts of each branch basic block in the software. After the program runs, the runtime data acquisition module updates the array and rewrites the new data into the software execution data file. By mapping the file directly into the process address space, memory mapping technology avoids the data copying required in traditional I / O operations, significantly improving data reading efficiency. This method can obtain detailed data during software execution in real time, including system call sequences, memory access patterns, and exception handling paths, providing basic support for subsequent data analysis and behavioral detection by fuzz testing tools. This efficient data processing method is particularly suitable for high-concurrency and large-scale data scenarios, ensuring the real-time and stability of the system.
[0028] In a specific embodiment of the present invention, the sliding window dynamic analysis module is as follows: Figure 3 As shown in Figure 1, this module uses a sliding window technique for data sampling and analysis. The basic process is as follows: First, the sliding window dynamic analysis module specifies the window width (window size) and sliding step size (step size). Then, the sliding window technique is used to sample data and obtain local data. For example, for 200 data items, with a window width of 100 and a sliding step size of 50, the sliding window can generate three local data samples: 0-100, 50-150, and 100-200. Each data sample is an array of the number of triggers of each branch basic block at a specific moment. Here, the window width determines the amount of data analyzed each time, while the sliding step size controls the sampling frequency. By properly configuring the window width and sliding step size, an optimal balance can be achieved between real-time performance, accuracy, and resource consumption. A larger window width can smooth short-term fluctuations and capture long-term trends, making it suitable for steady-state analysis; a smaller window width can sensitively respond to short-term changes, making it suitable for dynamic detection. The choice of sliding step size directly affects the sampling frequency and data continuity. A smaller step size provides higher sampling accuracy and real-time performance, while a larger step size reduces computational and storage overhead. Sliding window technology can dynamically capture and analyze data changes, which is crucial for real-time monitoring and detecting abnormal behavior in the system.
[0029] In a specific embodiment of the present invention, the behavior feature modeling module is as follows: Figure 4As shown, the basic process is as follows: First, the behavioral feature modeling module defines features that can distinguish between the fuzz testing tool and normal users by analyzing the behavioral differences between the two. For example, under the same sliding window parameters, the standard deviation of the number of branch basic block triggers, the weight of the branch basic block, and the change in the number of triggers of the branch basic block are analyzed. Based on LLVM, the software is statically analyzed to obtain the depth (Depth) and in-degree (In-degree) of each branch basic block. Considering that fuzz testing tools usually give priority to exploring more paths, they are more inclined to trigger basic blocks with large in-degree; while normal users, due to their single function, usually trigger branch basic blocks with large depth. Based on this, the basic block weight is defined as the in-degree divided by the depth. The larger the weight, the easier it is to be triggered by the fuzz testing tool. The formula is as follows.
[0030]
[0031] Among them, score i Indicates the weight of the i-th branch basic block, indegree i 、depth i represents the in-degree and depth of the i-th branch basic block.
[0032] Ultimately, we defined two core features: 1) the sum Y of the product of the weight of each basic block in the software and the number of times it was triggered; and 2) the standard deviation Std of the number of times each basic block in the software was triggered. These features accurately reflect the specific behavioral patterns of the fuzz testing tool and lay the foundation for subsequent threshold design. The formula is as follows, where N represents the number of basic blocks in the software.
[0033]
[0034] Among them, counter i Indicates the number of times the i-th branch basic block is triggered.
[0035] In a specific embodiment of the present invention, the dynamic threshold decision module is as follows: Figure 5 The basic process is as follows: First, the dynamic threshold decision module uses the feature definitions and calculation formulas determined in the previous module, combined with the training and test sets consisting of normal users and fuzz testing tools, to calculate feature values and describe the feature array using three metrics: 1) the standard deviation of the feature array; 2) the slope of the trend line of the feature array; and 3) the fluctuation amplitude of the feature array. By optimizing the optimal detection threshold for each metric and continuously adjusting it during the training phase, we ensure accurate identification of fuzz testing tool behavior in real applications.
[0036] Here, when constructing the training set and test set, the number of triggering basic blocks of each branch of the software under normal user manual control and the number of triggering basic blocks of each branch of the software under the control of the fuzz testing tool are obtained respectively, and the human control and fuzz testing tool control are used as data labels to generate a data set. Combined with the data set, the dichotomy method is used to determine the optimal detection threshold for each indicator.
[0037] In a specific embodiment of the present invention, the fuzz testing tool behavior detection module is as follows: Figure 6 As shown, the basic process is as follows: First, the fuzz testing tool behavior detection module reads the sampled local software execution data, calculates the values of two features, Y and Std, and analyzes the changing trends of these two features over a continuous period of time within a sliding window. For the curve formed by the two features, Y and Std, three indicators are used to describe the fluctuations of the feature array: 1) the standard deviation of the feature array; 2) the slope of the trend line of the feature array; and 3) the fluctuation amplitude of the feature array. Therefore, the two feature arrays generate a total of six indicators. If less than half of the indicators fall within the threshold range, the current software user is considered a fuzz testing tool. By continuously monitoring and analyzing the feature array, changing trends in user behavior can be dynamically captured. This method not only detects anomalies at a single point in time, but also identifies behavioral patterns over long periods of time, thereby improving the accuracy and robustness of fuzz testing tool behavior detection.
[0038] In summary, the present invention provides a fuzz testing tool detection method based on dynamic behavior analysis through the collaborative work of the above five modules, which mainly includes the following steps:
[0039] S1, reads the current triggering times of each branch basic block during software runtime;
[0040] S2, calculate the sum of the products of the weights and the triggering times of each branch basic block at each moment in a continuous time period, as well as the standard deviation of the triggering times of each branch basic block; the sum of the products and the standard deviation in the continuous time period form a product sum curve and a standard deviation curve respectively;
[0041] S3, design the evaluation indicators of the curve, determine whether the evaluation indicators of the product sum curve and the standard deviation curve are within the preset range, when the number of evaluation indicators that do not meet the preset range exceeds the threshold, it is considered that the software is currently under attack by the fuzz testing tool.
[0042] This method monitors and analyzes data in real time during software execution, identifies the behavior of fuzz testing tools, and implements appropriate protective measures to ensure the security and stability of software systems. This method not only adapts to rapidly updating software but also flexibly adjusts detection strategies based on diverse user behavior patterns, providing an innovative and effective solution for the security of modern software systems.
[0043] It should also be noted that the fuzz testing tool detection method based on dynamic behavior analysis in the above embodiment can essentially be executed through a computer program. Therefore, similarly, based on the same inventive concept, another preferred embodiment of the present invention also provides a computer electronic device corresponding to the method provided in the above embodiment, which includes a memory and a processor;
[0044] The memory is used to store computer programs;
[0045] The processor is used to implement the fuzz testing tool detection method based on dynamic behavior analysis in the above embodiment when executing the computer program.
[0046] Furthermore, the logic instructions in the aforementioned memory can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention.
[0047] Therefore, based on the same inventive concept, another preferred embodiment of the present invention also provides a computer-readable storage medium corresponding to the method provided in the above embodiment, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the fuzzy testing tool detection method based on dynamic behavior analysis in the above embodiment can be implemented.
[0048] It is understood that the storage medium may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Furthermore, the storage medium may be any medium capable of storing program code, such as a USB flash drive, a mobile hard drive, a magnetic disk, or an optical disk.
[0049] It is understandable that the above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.
[0050] It should also be noted that those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the various embodiments provided in this application, the division of steps or modules in the system and method is only a logical function division. In actual implementation, there may be other division methods, for example, multiple modules or steps can be combined or integrated together, and a module or step can also be split.
[0051] The embodiment described above is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Persons skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, any technical solution obtained by equivalent substitution or equivalent transformation falls within the scope of protection of the present invention.
Claims
1. A fuzz testing tool detection method based on dynamic behavior analysis, characterized in that: include: Read the current trigger count of each branch basic block when the software is running; Calculate the sum of the products of the weights and the triggering times of each branch basic block at each moment in a continuous time period, as well as the standard deviation of the triggering times of each branch basic block; The product sum and standard deviation in consecutive time periods form a product sum curve and a standard deviation curve respectively; Design the evaluation indicators of the curve and determine whether the evaluation indicators of the product sum curve and the standard deviation curve are within the preset range. When the number of evaluation indicators that do not meet the preset range exceeds the threshold, it is considered that the software is currently attacked by the fuzz testing tool.
2. The fuzz testing tool detection method based on dynamic behavior analysis according to claim 1 is characterized in that: The memory mapping technology is used to read the current triggering times of each branch basic block during software operation, and the read array is written into the software operation data file. The array is updated after the program is completed.
3. The fuzz testing tool detection method based on dynamic behavior analysis according to claim 1 is characterized in that: The calculation formula for the sum of the products of the weights of the basic blocks of each branch and the number of triggering times is as follows: Among them, Y represents the product of the weight of each branch basic block and the number of triggers, score i represents the weight of the i-th branch basic block, that is, the ratio of the in-degree and depth of the branch basic block; counter i represents the current triggering count of the i-th branch basic block, and N represents the number of branch basic blocks.
4. The fuzz testing tool detection method based on dynamic behavior analysis according to claim 1 is characterized in that: The calculation formula for the standard deviation of the number of times each branch basic block is triggered is as follows: Among them, Std represents the standard deviation of the number of times each branch basic block is triggered, counter i represents the current triggering count of the i-th branch basic block, and N represents the number of branch basic blocks.
5. The fuzz testing tool detection method based on dynamic behavior analysis according to claim 1 is characterized in that: The evaluation indicators include the standard deviation of each point on the curve, the slope of the curve, and the fluctuation range of the curve.
6. The fuzz testing tool detection method based on dynamic behavior analysis according to claim 1 is characterized in that: A sliding window method is used to obtain data in a continuous time period to calculate the product sum and standard deviation. The step size of the sliding window does not exceed the width of the sliding window.
7. The fuzz testing tool detection method based on dynamic behavior analysis according to claim 1 is characterized in that: The preset ranges corresponding to the evaluation indicators of the product sum curve and the standard deviation curve are optimized based on the training set.
8. A fuzz testing tool detection system based on dynamic behavior analysis, used to implement the fuzz testing tool detection method according to claim 1, characterized in that: The system comprises: Runtime data acquisition module, which is used to read the current triggering times of each branch basic block during software runtime; Sliding window dynamic analysis module, which is used to obtain data for continuous time periods; The behavioral feature modeling module is used to calculate the sum of the products of the weights of each branch basic block and the number of triggering times at each moment in a continuous time period, as well as the standard deviation of the number of triggering times of each branch basic block. The sum of the products and the standard deviation in the continuous time period form a product sum curve and a standard deviation curve respectively. Dynamic threshold decision module, which is used to design the evaluation indicators of the curve and optimize the preset range of each indicator; The fuzz testing tool behavior detection module is used to determine whether the evaluation indicators of the product sum curve and the standard deviation curve are within the preset range. When the number of evaluation indicators that do not meet the preset range exceeds the threshold, it is considered that the software is currently under attack by the fuzz testing tool.
9. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by the processor, the fuzz testing tool detection method based on dynamic behavior analysis as described in any one of claims 1 to 7 is implemented.
10. A computer electronic device, characterized in that: including memory and processor; The memory is used to store computer programs; The processor is configured to implement the fuzz testing tool detection method based on dynamic behavior analysis as described in any one of claims 1 to 7 when executing the computer program.