Fuzzy test method and device, equipment, storage medium and product

Abstract

The invention discloses a fuzzy testing method and device, equipment, a storage medium and a product, and the method comprises the steps: obtaining a target code, carrying out the static analysis of the target code, and determining the possible vulnerability information and vulnerability reachable path information of the target code; generating a test seed according to the possible vulnerability information and the vulnerability reachable path information; performing a fuzzy test on the target code through the test seed, determining vulnerabilities existing in the target code, and collecting dynamic feedback information in the fuzzy test process; and optimizing the test seed according to the dynamic feedback information, and returning to execute the step of performing the fuzzy test on the target code through the test seed until a preset test stop condition is met. According to the fuzzy test method disclosed by the invention, the dynamic feedback information is collected in each fuzzy test process, and the test seeds are optimized according to the dynamic feedback information, so that the test efficiency and accuracy can be improved, and finally efficient vulnerability detection and security evaluation are realized.

Description

Technical Field

[0001] The present invention relates to the field of software testing technology, and in particular to a fuzzy testing method, device, equipment, storage medium and product. Background Art

[0002] Fuzzing is an automated testing technique widely used in software security testing and vulnerability discovery. Its basic principle is to expose potential security vulnerabilities by providing a target program with a large amount of random or mutated input data, triggering abnormal behavior (such as crashes, memory leaks, or undefined behavior). Due to its efficiency and automation, fuzz testing has become a key tool in the security testing field, widely used to detect vulnerabilities in software systems such as operating systems, network protocols, file parsers, compilers, and virtual machines.

[0003] In recent years, directed grey-box fuzzing, a hybrid approach that combines the efficiency of black-box testing with the accuracy of white-box testing, has become an effective means of addressing the challenge of high-risk vulnerability detection. Directed grey-box fuzzing relies on partial knowledge of a program (such as coverage information for functions, paths, or code blocks) to guide test input mutations toward areas where vulnerabilities may exist, thereby improving the efficiency and accuracy of vulnerability discovery. Especially for known Common Vulnerabilities and Exposures (CVEs), directed grey-box fuzzing can not only reproduce these vulnerabilities but also further verify the security of the system.

[0004] However, existing directed gray-box fuzz testing methods still have certain shortcomings. Although these methods can leverage some static information about a program to guide input mutation, most rely on code coverage or heuristic rules, fail to effectively integrate the program's dynamic execution information, and lack in-depth analysis of runtime feedback data, resulting in a certain degree of blindness in the mutation process. Furthermore, existing fuzz testing tools typically rely on randomly generated input seeds or seeds generated based on static analysis. Both methods fail to adjust mutation strategies in real time based on runtime feedback from the program, lacking sufficient flexibility and intelligence. These shortcomings lead to shortcomings in the efficiency and accuracy of existing fuzz testing methods. Summary of the Invention

[0005] The present invention provides a fuzzy testing method, apparatus, device, storage medium and product to improve the efficiency and accuracy of fuzzy testing.

[0006] According to one aspect of the present invention, a fuzzy testing method is provided, comprising:

[0007] Obtaining target code, performing static analysis on the target code, and determining possible vulnerability information and vulnerability reachable path information of the target code;

[0008] Generate a test seed according to the possible vulnerability information and the vulnerability reachable path information;

[0009] Performing fuzz testing on the target code using the test seed to determine vulnerabilities in the target code and collecting dynamic feedback information during the fuzz testing process;

[0010] The test seed is optimized according to the dynamic feedback information, and the step of performing fuzz testing on the target code through the test seed is returned to be executed until a preset test stop condition is reached.

[0011] Furthermore, static analysis is performed on the target code to determine possible vulnerability information and vulnerability reachable path information of the target code, including:

[0012] Obtain the set security analysis tools and reachability analysis tools;

[0013] Scanning the target code using the security analysis tool to identify possible vulnerability information of the target code;

[0014] The target code is subjected to a path reachability analysis by using the reachability analysis tool to determine vulnerability reachable path information of the target code.

[0015] Furthermore, generating a test seed according to the possible vulnerability information and the vulnerability reachable path information includes:

[0016] Obtain the target large language model;

[0017] The possible vulnerability information, the vulnerability reachable path information and the first model prompt information are used as input information of the target large language model to obtain a test seed generated by the target large language model, and the test seed is output.

[0018] Furthermore, performing fuzz testing on the target code through the test seed includes:

[0019] Determine a target insertion location according to the vulnerability reachable path information, and perform an insertion operation on the target code at the target insertion location;

[0020] A set fuzz testing tool is obtained, the test seed is used as an input of the set fuzz testing tool, and the target code is tested by the set fuzz testing tool.

[0021] Further, optimizing the test seed according to the dynamic feedback information includes:

[0022] Parsing the dynamic feedback information and extracting key feedback information from the dynamic feedback information; wherein the dynamic feedback information includes log information and coverage information;

[0023] Using the key feedback information and the second model prompt information as input information of the target large language model, and obtaining optimization strategy information output by the target large language model;

[0024] The test seed is optimized according to the optimization strategy information.

[0025] Further, optimizing the test seed according to the optimization strategy information includes:

[0026] Get the custom mutation interface for setting the fuzz testing tool;

[0027] The optimization strategy information is applied to the test seed through the custom mutation interface to obtain a mutated test seed.

[0028] According to another aspect of the present invention, a fuzzy testing device is provided, comprising:

[0029] A possible vulnerability information and vulnerability reachable path information determination module is used to obtain target code, perform static analysis on the target code, and determine possible vulnerability information and vulnerability reachable path information of the target code;

[0030] A test seed generation module, configured to generate a test seed based on the possible vulnerability information and the vulnerability reachable path information;

[0031] A fuzz testing module, configured to perform fuzz testing on the target code using the test seed, determine vulnerabilities in the target code, and collect dynamic feedback information during the fuzz testing process;

[0032] A test seed optimization module is used to optimize the test seed according to the dynamic feedback information, and return to execute the step of fuzz testing the target code through the test seed until a preset test stop condition is reached.

[0033] Optionally, the module for determining possible vulnerability information and vulnerability reachable path information is further configured to:

[0034] Obtain the set security analysis tools and reachability analysis tools;

[0035] Scanning the target code using the security analysis tool to identify possible vulnerability information of the target code;

[0036] The target code is subjected to a path reachability analysis by using the reachability analysis tool to determine vulnerability reachable path information of the target code.

[0037] Optionally, the test seed generation module is also used to:

[0038] Obtain the target large language model;

[0039] The possible vulnerability information, the vulnerability reachable path information and the first model prompt information are used as input information of the target large language model to obtain a test seed generated by the target large language model, and the test seed is output.

[0040] Optionally, the fuzz testing module is also used to:

[0041] Determine a target insertion location according to the vulnerability reachable path information, and perform an insertion operation on the target code at the target insertion location;

[0042] A set fuzz testing tool is obtained, the test seed is used as an input of the set fuzz testing tool, and the target code is tested by the set fuzz testing tool.

[0043] Optionally, the test seed optimization module is also used to:

[0044] Parsing the dynamic feedback information and extracting key feedback information from the dynamic feedback information; wherein the dynamic feedback information includes log information and coverage information;

[0045] Using the key feedback information and the second model prompt information as input information of the target large language model, and obtaining optimization strategy information output by the target large language model;

[0046] The test seed is optimized according to the optimization strategy information.

[0047] Optionally, the test seed optimization module is also used to:

[0048] Get the custom mutation interface for setting the fuzz testing tool;

[0049] The optimization strategy information is applied to the test seed through the custom mutation interface to obtain a mutated test seed.

[0050] According to another aspect of the present invention, an electronic device is provided, comprising:

[0051] at least one processor; and

[0052] a memory communicatively connected to the at least one processor; wherein,

[0053] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the fuzz testing method described in any embodiment of the present invention.

[0054] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the fuzz testing method described in any embodiment of the present invention when executed.

[0055] According to another aspect of the present invention, a computer program product is provided, which includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the fuzz testing method described in any embodiment of the present invention are implemented.

[0056] The fuzz testing method disclosed in the present invention first obtains the target code, performs static analysis on the target code, and determines the possible vulnerability information and vulnerability reachable path information of the target code; then generates a test seed based on the possible vulnerability information and vulnerability reachable path information; then performs fuzz testing on the target code using the test seed to determine the vulnerabilities existing in the target code, and collects dynamic feedback information during the fuzz testing process; finally, optimizes the test seed based on the dynamic feedback information, and returns to the step of performing fuzz testing on the target code using the test seed until a preset test stop condition is reached. The fuzz testing method disclosed in the present invention provides an iterative testing method, which performs fuzz testing on the target code using the test seed, collects dynamic feedback information during each fuzz testing process, and optimizes the test seed based on the dynamic feedback information, thereby improving the efficiency and accuracy of the test and ultimately achieving efficient vulnerability detection and security assessment.

[0057] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0059] Figure 1 This is a flowchart of a fuzzy testing method provided according to the first embodiment of the present invention;

[0060] Figure 2This is a flowchart of a fuzzy testing method provided according to the second embodiment of the present invention;

[0061] Figure 3 This is a structural diagram of a fuzzy testing device provided according to a third embodiment of the present invention;

[0062] Figure 4 It is a structural diagram of an electronic device for implementing the fuzzy testing method of embodiment 4 of the present invention. DETAILED DESCRIPTION

[0063] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0064] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0065] Example 1

[0066] Figure 1 This is a flowchart of a fuzz testing method provided in the first embodiment of the present invention. This embodiment is applicable to the case of vulnerability detection of software code. The method can be executed by a fuzz testing device. The fuzz testing device can be implemented in the form of hardware and / or software. The fuzz testing device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0067] S110: Obtain target code, perform static analysis on the target code, and determine possible vulnerability information and vulnerability reachable path information of the target code.

[0068] The target code is the test object of the current fuzz testing method. Possible vulnerability information is information about possible vulnerabilities in the target code, such as the possible vulnerability name, vulnerability location, vulnerability format, and vulnerability code context. Vulnerability reachable path information is the reachable path from the main entry function to the vulnerability location.

[0069] In this embodiment, the target code can be statically analyzed to obtain possible vulnerability information and vulnerability reachable path information of the target code. The static analysis method can be to use a set code analysis tool to scan the target code to identify potential security vulnerabilities and vulnerability reachable paths. Preferably, the set code analysis tool can include but is not limited to CodeQL and SCA tools. Among them, CodeQL is a semantic analysis tool that treats code as data. It constructs a queryable database by extracting information such as the abstract syntax tree (AST), control flow (CFG), and data flow (DFG) of the source code. Users can write QL query statements to locate vulnerabilities (such as unsafe deserialization, SQL injection, etc.). The SCA (Software Composition Analysis) tool can be used to analyze code (source code, binary code) and build files (such as Maven's pom.xml file) to determine the third-party components used in the project and the vulnerabilities they contain, and can identify which components are called by self-developed code and which vulnerabilities may be triggered.

[0070] S120: Generate a test seed based on the possible vulnerability information and the vulnerability reachable path information.

[0071] The test seed is information used to test the target code, including a specific format string, an overlong input, and the like.

[0072] In this embodiment, when generating test seeds, a fixed seed can be generated based on possible vulnerability information and vulnerability reachable path information, so that the same random sequence can be generated each time the test is run, which is convenient for reproducing the problem; different test seeds can also be dynamically generated each time the test is run based on possible vulnerability information and vulnerability reachable path information combined with time information; hash and other algorithms can also be combined to generate a unique and stable seed based on possible vulnerability information and vulnerability reachable path information, which is suitable for parameterized testing.

[0073] S130. Perform fuzz testing on the target code through the test seed to determine the vulnerabilities in the target code and collect dynamic feedback information during the fuzz testing process.

[0074] Fuzz testing is a security testing technique that detects vulnerabilities and errors by inputting unusual or random data into a target program. Its core goal is to discover unusual program behavior (such as crashes and memory leaks) under unexpected input, thereby improving software security and stability. Dynamic feedback refers to test-related information collected during fuzz testing, such as code execution logs and the coverage rate of each test.

[0075] In this embodiment, the target code can be fuzz tested by setting a fuzz testing tool. Preferably, the fuzz testing tool can be a directed fuzz testing tool, such as DAFL (Directed American Fuzzy Lop). The test seed is used as the input of the fuzz testing tool, and the fuzz testing tool can drive the fuzz testing engine to carry out fuzz testing. Unlike traditional fuzz testing methods, directed fuzz testing does not perform random input mutations without a target, but based on the results of the previous vulnerability analysis, it focuses on the input patterns that may trigger vulnerabilities, thereby improving the efficiency of vulnerability discovery. During the fuzz testing process, dynamic feedback information such as code execution logs and coverage can be collected in real time, and this information can be used to optimize subsequent test seed mutation strategies.

[0076] S140: Optimize the test seed according to the dynamic feedback information, and return to the step of performing fuzz testing on the target code through the test seed until a preset test stop condition is reached.

[0077] In this embodiment, based on the dynamic feedback information collected in the previous step, the effectiveness of the current test seed can be analyzed, and a more accurate mutation strategy can be generated to optimize the test seed. The core goal of this stage is to build an intelligent dynamic feedback loop, enabling fuzz testing to automatically adjust testing strategies based on the current execution status, thereby increasing the probability of vulnerability triggering and accelerating the vulnerability discovery process.

[0078] Furthermore, after optimizing the test seed, the target code is fuzz tested using the optimized test seed to further improve the vulnerability trigger rate. This forms a closed-loop optimization mechanism, continuously iterating the test input until a preset test stop condition is reached. Preferably, the preset test stop condition can be triggering a vulnerability or reaching a preset coverage threshold. The core goal of this stage is to enable adaptive adjustment of the test process through continuous iterative optimization of the test seed, thereby improving fuzz testing efficiency and vulnerability discovery capabilities.

[0079] The fuzz testing method disclosed in the present invention first obtains the target code, performs static analysis on the target code, and determines the possible vulnerability information and vulnerability reachable path information of the target code; then generates a test seed based on the possible vulnerability information and vulnerability reachable path information; then performs fuzz testing on the target code using the test seed to determine the vulnerabilities existing in the target code, and collects dynamic feedback information during the fuzz testing process; finally, optimizes the test seed based on the dynamic feedback information, and returns to the step of performing fuzz testing on the target code using the test seed until a preset test stop condition is reached. The fuzz testing method disclosed in the present invention provides an iterative testing method, which performs fuzz testing on the target code using the test seed, collects dynamic feedback information during each fuzz testing process, and optimizes the test seed based on the dynamic feedback information, thereby improving the efficiency and accuracy of the test and ultimately achieving efficient vulnerability detection and security assessment.

[0080] Example 2

[0081] Figure 2 This is a flowchart of a fuzzy testing method provided in the second embodiment of the present invention. This embodiment is a refinement of the above embodiment. Figure 2 As shown, the method includes:

[0082] S210: Obtain target code, and obtain set security analysis tools and reachability analysis tools.

[0083] The target code is the test object of the current fuzz testing method. A security analysis tool, such as CodeQL, analyzes vulnerabilities in the target code. A reachability analysis tool, such as an SCA tool, analyzes the reachability paths of vulnerabilities in the target code.

[0084] S220. Scan the target code using a security analysis tool to identify possible vulnerability information of the target code.

[0085] In this embodiment, a comprehensive scan of the target code can be performed using security analysis tools such as CodeQL to automatically identify potential security vulnerabilities. CodeQL is a security analysis tool based on a code query language. Using predefined security rules, it can detect vulnerabilities in the code, such as buffer overflows, unsafe pointer operations, and format string vulnerabilities. It can also identify suspicious branches in conditional statements (such as improperly handled boundary conditions and null pointer dereferences). The system can record information about potential vulnerabilities detected, including the possible vulnerability name, vulnerability location, vulnerability format, and vulnerability code context.

[0086] For example, CodeQL can be used to statically analyze the code in LibTIFF (an open-source library for processing TIFF image files, a widely used raster image format) to identify potential vulnerabilities and generate initial testing information. Through CodeQL queries, the vulnerability CVE-2016-5314 was identified as primarily located in the readContigTilesIntoBuffer() function in the tiffcrop.c file. This function does not properly check the boundaries of the input data when processing TIFF image files, resulting in a buffer overflow.

[0087] S230: Perform path reachability analysis on the target code using a reachability analysis tool to determine vulnerability reachable path information of the target code.

[0088] In this embodiment, a reachability analysis tool, such as an SCA tool, can be used to perform path reachability analysis on the target code. This tool can extract vulnerability reachability path information, i.e., the reachable path from the main entry function to the vulnerability point location, through forward traversal or reverse backtracking, and analyze function call chains, parameter dependencies, and conditional branch characteristics to obtain information such as function call sequences, key variables, and conditional branch characteristics. Preferably, to optimize analysis efficiency, a path pruning strategy can be adopted, which prioritizes retaining the shortest paths and paths with a high probability of vulnerability triggering, thereby reducing computational complexity.

[0089] For example, by performing path reachability analysis on the target code, it is determined that there is a vulnerable reachable path in the target code: main()→processCommandLine()→readImage()→readContigTilesIntoBuffer(). Since there are multiple call paths for readContigTilesIntoBuffer(), the path with the highest probability of triggering the vulnerability can be prioritized, and irrelevant code blocks can be filtered out to improve analysis efficiency.

[0090] S240: Obtain a target large language model, use the possible vulnerability information, the vulnerability reachable path information, and the first model prompt information as input information of the target large language model, obtain a test seed generated by the target large language model, and output the test seed.

[0091] A large language model (LLM) is a deep learning model trained using large amounts of text data, enabling it to generate natural language text or understand the meaning of text. The target LLM is the one used to generate test seeds in this fuzz testing method.

[0092] In this embodiment, the powerful text generation and pattern recognition capabilities of the large language model can be utilized, combined with the possible vulnerability information and vulnerability reachable path information extracted in the static analysis phase to intelligently generate initial test seeds to improve the efficiency and pertinence of fuzz testing. Specifically, the input information of the target large language model includes possible vulnerability information, vulnerability reachable path information and first model prompt information, wherein the first model prompt information is prompt text information that indicates the test seed generation task of the target large language model. Furthermore, the target large language model can also access the vulnerability pattern knowledge base and historical vulnerability cases. By combining the vulnerability pattern knowledge base and historical vulnerability cases, the large language model can infer the input that is most likely to trigger the vulnerability, thereby improving the test coverage and accelerating vulnerability mining.

[0093] Preferably, the first model prompt information can be encapsulated based on the path information (including function call sequence, key variables, conditional branch characteristics, etc.) obtained in the static analysis phase and provided to the target large language model. The target large language model generates a test seed based on possible vulnerability information, vulnerability reachable path information, and the first model prompt information. The test seed may include information such as a specific format string and an overlong input to detect security vulnerabilities in the program. In this way, the large language model can not only generate foreseen vulnerability inputs, but also generate innovative inputs for testing based on potential undisclosed security risks.

[0094] For example, the first model prompt information may be: "The TIFF file processing library LibTIFF has a known vulnerability CVE-2016-5314. The vulnerability is located in the readContigTilesIntoBuffer() function, and the trigger condition is a buffer overflow caused by an incorrect tileSize calculation. Please generate a test case that conforms to the TIFF structure, making the tileSize too large and covering the boundary of the tilebuf." Based on the first model prompt information and combined with the possible vulnerability information and the vulnerability reachable path information, the target large language model can generate a test seed, such as a specially constructed TIFF file: the key fields tileWidth and tileHeight are set to values outside the reasonable range, and tileOffsets are forged to point to an incorrect memory address, increasing the possibility of triggering a crash.

[0095] S250: Determine a target insertion location according to the vulnerability reachable path information, and perform an insertion operation on the target code at the target insertion location.

[0096] Instrumentation in code testing refers to inserting additional code into the source code to collect information, change program behavior or perform debugging.

[0097] In this embodiment, based on the vulnerability reachable path information obtained in the static analysis phase and the test seeds generated by the target large language model, targeted instrumentation can be performed on the target code, and combined with the targeted fuzz testing method, the vulnerability triggering path can be explored more accurately and efficiently, thereby significantly improving the targetedness of the test and the vulnerability mining capabilities.

[0098] Preferably, a targeted instrumentation operation is performed on the target source code, that is, monitoring code is inserted at key functions and their key conditional branches, with the purpose of dynamically collecting execution path information when the program is running. This information can be used to evaluate the effectiveness of the fuzz test input and provide feedback data for the subsequent optimization of the intelligent mutation strategy. The determination of the instrumentation location is mainly based on the vulnerability reachable path information in the static analysis phase, specifically covering multiple key locations, for example: one is the function where the target vulnerability point is located, so as to ensure comprehensive coverage of the key vulnerability locations; the second is the conditional branch that controls the vulnerability triggering, which is used to monitor whether the input meets the necessary conditions for the vulnerability triggering; the third is the key data flow transfer location, such as parameter transfer points, loop entries, etc., in order to analyze how the input affects the program execution flow. After completing the instrumentation, the target code can be recompiled into an executable binary file to build the necessary operating environment for subsequent fuzz testing.

[0099] S260, obtaining a set fuzz testing tool, using a test seed as input to the set fuzz testing tool, testing the target code through the set fuzz testing tool, determining the vulnerabilities in the target code, and collecting dynamic feedback information during the fuzz testing process.

[0100] The dynamic feedback information refers to the test-related information collected during the fuzz testing process, including but not limited to code execution logs, coverage of each test, and other information.

[0101] In this embodiment, after the instrumentation work is completed, a directed fuzz testing tool, such as DAFL (Directed AFL), can be started. At this time, the test seed generated by the target large language model can be used as the input of the directed fuzz testing tool to drive the fuzz testing engine to carry out fuzz testing. Unlike traditional fuzz testing methods, directed fuzz testing does not perform random input mutations without a target. Instead, based on the results of the previous vulnerability analysis, it focuses on input patterns that may trigger vulnerabilities, thereby improving the efficiency of vulnerability discovery.

[0102] Furthermore, during the fuzz testing process, dynamic feedback information can be collected in real time, such as code execution logs and coverage information, which may include but are not limited to: explored paths, which record the currently triggered program execution paths to avoid redundant testing; unsatisfied branch conditions, which identify the key conditions that the current test seed fails to trigger, and provide clear guidance for subsequent input mutations; key input fields, which optimize subsequent input mutation strategies by analyzing which input parts have a substantial impact on the program execution flow.

[0103] Preferably, during fuzz testing, if the test input triggers a program crash, undefined behavior, or abnormal state, a crash log can be recorded and information such as the vulnerability triggering path, input data, and register status can be extracted. This information is also used as dynamic feedback information for subsequent in-depth analysis and effective utilization. At the same time, all collected dynamic feedback information will serve as input to the dynamic feedback processing stage, allowing the target large language model to generate more accurate input mutation strategies based on this data, further improving the efficiency of fuzz testing and vulnerability discovery capabilities.

[0104] For example, targeted instrumentation can be used to insert monitoring points at the code related to readContigTilesIntoBuffer() and tileSize calculation. This will record the calculated tileSize value, buffer size, and out-of-bounds access, allowing for subsequent optimization of test inputs. DAFL can then be used for targeted fuzz testing, using the test seed generated by the target large language model as the initial input. Dynamic feedback such as execution path logs and coverage information can be collected during the process.

[0105] S270: Optimize the test seed according to the dynamic feedback information, and return to the step of performing fuzz testing on the target code through the test seed until a preset test stop condition is reached.

[0106] In this embodiment, after obtaining dynamic feedback information during the fuzz testing process, the generated test seeds can be optimized based on this information to obtain new test seeds, and then the new test seeds can be used to continue fuzz testing the target code until the test is terminated after the preset test stop condition is reached.

[0107] Optionally, the method for optimizing the test seed based on dynamic feedback information may be: parsing the dynamic feedback information, extracting key feedback information from the dynamic feedback information; wherein the dynamic feedback information includes log information and coverage information; using the key feedback information and the second model prompt information as input information of the target large language model, and obtaining optimization strategy information output by the target large language model; and optimizing the test seed based on the optimization strategy information.

[0108] Specifically, based on the dynamic feedback information collected during the instrumentation and fuzz testing phases (including log information and coverage information), and with the help of the large language model reasoning capabilities of the target large language model, the effectiveness of the current test seed can be intelligently analyzed, and a more accurate input mutation strategy can be generated. The core goal of this phase is to build an intelligent dynamic feedback closed loop so that the fuzz test can automatically adjust the test strategy according to the current execution status, thereby increasing the probability of vulnerability triggering and accelerating the vulnerability discovery process. In this phase, the input of the target large language model is key feedback information and second model prompt information, where the key feedback information is obtained by parsing the dynamic feedback information, and the second model prompt information is prompt text information that indicates the test seed optimization task of the target large language model. When optimizing the test seed, the dynamic feedback information collected during the fuzz testing process is first parsed to extract key feedback information, such as crash points and error patterns. If a test input causes a program crash or exception, the corresponding input data is recorded and the root cause of the crash is analyzed. After receiving key feedback, this data is used as input for a new round of large language models. A second model prompt is constructed to guide the large language model to intelligently generate the next round of mutation strategies based on the current fuzz test coverage and unexplored paths. Specifically, the target large language model uses the feedback data to infer the adjustment direction of the test input and optimize the test seed to cover unexplored code paths or meet key conditional branches.

[0109] Preferably, the optimization strategy information may include but is not limited to:

[0110] (1) Prioritized byte positions for mutation: Based on unsatisfied branch conditions and the value range of key variables, determine which byte positions are more likely to trigger new code paths or vulnerabilities.

[0111] (2) Recommended mutation methods: Provide appropriate input mutation strategies, such as byte-level mutation: randomly modify the bytes in the input file, such as 0x00->0xFF; splicing mutation: combine multiple seeds together to form new input data; different mutation methods are suitable for different test scenarios and vulnerability types, and the model will select the most appropriate mutation method based on the current test situation.

[0112] (3) Input length adjustment: Based on the input processing logic of the target program and the uncovered code paths, it is recommended to adjust the input length. For example, for a program that may have a buffer overflow vulnerability, appropriately increasing the input length may trigger a new code path.

[0113] (4) Input splicing strategy: In some cases, splicing multiple input fragments may trigger more complex program logic. The model will propose a reasonable input splicing strategy based on the existing test results and the characteristics of the target program.

[0114] The target large language model outputs an optimized set of input mutation strategies, or optimization strategy information, which is directly applied to test seed optimization, enabling fuzz testing to accurately explore uncovered paths and further enhance vulnerability discovery capabilities. Through this dynamic feedback mechanism, the fuzz testing process no longer relies solely on random mutation. Instead, it leverages the intelligent reasoning capabilities of the large language model to continuously optimize input, improve testing efficiency, and achieve a highly efficient closed-loop vulnerability discovery process.

[0115] Optionally, the method for optimizing the test seed according to the optimization strategy information may be: obtaining a custom mutation interface for setting a fuzzy testing tool; applying the optimization strategy information to the test seed through the custom mutation interface to obtain a mutated test seed.

[0116] Specifically, the generated optimization strategy information can be applied to the targeted fuzz testing process to further improve vulnerability triggering rates and form a closed-loop optimization mechanism that continuously iterates test inputs until a preset test stopping condition is reached. This condition can be triggering a vulnerability or reaching a preset coverage threshold. The core goal of this phase is to effectively integrate the optimization strategy information generated by the target large language model into the fuzz testing framework, enabling adaptive adjustments during the testing process, thereby improving fuzz testing efficiency and vulnerability discovery capabilities. By leveraging targeted fuzz testing tools such as DAFL and using their custom mutation interface, the optimization strategy information generated by the target large language model can be applied to the current test seed. The custom mutation interface allows testers to customize mutation logic, allowing them to directly apply the refined mutation strategies generated by the large language model to the seed data. Based on the optimization strategy information, specific mutation operations can be performed on the test seed, such as bitflipping at specified byte positions, replacing specific bytes, or inserting magic numbers. These mutation operations are designed to explore new code paths and trigger uncovered branches, thereby increasing the chance of discovering vulnerabilities.

[0117] After obtaining the optimized test seed, the fuzz testing process can be rerun, using the mutation-optimized test seed as input. The targeted fuzz tester is then launched to continue testing the target code. During this round of testing, the tester executes the program based on the mutated seed data and collects new dynamic feedback. This new data reflects the impact of the mutation strategy on the testing process, including newly explored paths, newly covered code blocks, and unsatisfied branch conditions. In this way, after each test iteration, the collected dynamic feedback is fed back to the target large language model. Based on this latest data, the model analyzes the current test coverage and unexplored paths, further optimizing the mutation strategy. This strategy application and iteration process continues, forming a closed-loop optimization system. In each iteration, a more effective mutation strategy is generated based on the latest dynamic feedback and applied to the test seed for a new round of testing. This process is repeated until the target vulnerability is triggered or a preset code coverage threshold is reached. The preset coverage threshold can be set based on testing objectives and resource constraints, such as achieving a specific branch coverage or code block coverage.

[0118] The fuzz testing method provided by the embodiments of the present invention provides an iterative testing approach. It fuzz tests the target code using test seeds, collects dynamic feedback information during each fuzz test, and optimizes the test seeds based on this dynamic feedback. This improves testing efficiency and accuracy, ultimately achieving efficient vulnerability detection and security assessment. Furthermore, the fuzz testing method provided by the embodiments of the present invention leverages the powerful generation capabilities of large language models when generating test seeds and test seed optimization strategy information, further improving the intelligence and efficiency of detection.

[0119] Example 3

[0120] Figure 3 A schematic diagram of the structure of a fuzzy testing device provided in the third embodiment of the present invention is shown in FIG. Figure 3 As shown, the device includes: a possible vulnerability information and vulnerability reachable path information determination module 310, a test seed generation module 320, a fuzzy test module 330 and a test seed optimization module 340.

[0121] The possible vulnerability information and vulnerability reachable path information determination module 310 is used to obtain target code, perform static analysis on the target code, and determine the possible vulnerability information and vulnerability reachable path information of the target code.

[0122] The test seed generation module 320 is used to generate a test seed according to possible vulnerability information and vulnerability reachable path information.

[0123] The fuzz testing module 330 is used to perform fuzz testing on the target code through the test seeds, determine the vulnerabilities in the target code, and collect dynamic feedback information during the fuzz testing process.

[0124] The test seed optimization module 340 is used to optimize the test seed according to the dynamic feedback information and return to the step of performing fuzz testing on the target code through the test seed until a preset test stop condition is reached.

[0125] Optionally, the possible vulnerability information and vulnerability reachable path information determination module 310 is further configured to:

[0126] Obtain the set security analysis tool and reachability analysis tool; scan the target code through the security analysis tool to identify possible vulnerability information of the target code; perform path reachability analysis on the target code through the reachability analysis tool to determine the vulnerability reachable path information of the target code.

[0127] Optionally, the test seed generation module 320 is further configured to:

[0128] Obtain a target large language model; use the possible vulnerability information, the vulnerability reachable path information, and the first model prompt information as input information of the target large language model, obtain a test seed generated by the target large language model, and output the test seed.

[0129] Optionally, the fuzz testing module 330 is further configured to:

[0130] Determine the target insertion position according to the vulnerability reachable path information, and perform an insertion operation on the target code at the target insertion position; obtain a set fuzz testing tool, use the test seed as the input of the set fuzz testing tool, and test the target code through the set fuzz testing tool.

[0131] Optionally, the test seed optimization module 340 is further configured to:

[0132] Parse the dynamic feedback information and extract key feedback information from the dynamic feedback information; the dynamic feedback information includes log information and coverage information; use the key feedback information and the second model prompt information as input information of the target large language model to obtain optimization strategy information output by the target large language model; and optimize the test seed according to the optimization strategy information.

[0133] Optionally, the test seed optimization module 340 is further configured to:

[0134] Obtain the custom mutation interface for setting the fuzz testing tool; apply the optimization strategy information to the test seed through the custom mutation interface to obtain the mutated test seed.

[0135] The fuzzy testing device provided by the embodiment of the present invention can execute the fuzzy testing method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0136] Example 4

[0137] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0138] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0139] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0140] The processor 11 may be any general-purpose and / or specialized processing component with processing and computing capabilities. Examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors for running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the fuzz testing method.

[0141] In some embodiments, the fuzz testing method can be implemented as a computer program that is tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the fuzz testing described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the fuzz testing method in any other appropriate manner (e.g., by means of firmware).

[0142] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0143] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0144] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0145] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0146] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0147] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

Claims

1. A fuzz testing method, characterized in that: include: Obtaining target code, performing static analysis on the target code, and determining possible vulnerability information and vulnerability reachable path information of the target code; Generate a test seed according to the possible vulnerability information and the vulnerability reachable path information; Performing fuzz testing on the target code using the test seed to determine vulnerabilities in the target code and collecting dynamic feedback information during the fuzz testing process; The test seed is optimized according to the dynamic feedback information, and the step of performing fuzz testing on the target code through the test seed is returned to be executed until a preset test stop condition is reached.

2. The method according to claim 1, characterized in that Performing static analysis on the target code to determine possible vulnerability information and vulnerability reachable paths of the target code, including: Obtain the set security analysis tools and reachability analysis tools; Scanning the target code using the security analysis tool to identify possible vulnerability information of the target code; The target code is subjected to a path reachability analysis by using the reachability analysis tool to determine vulnerability reachable path information of the target code.

3. The method according to claim 1, characterized in that Generating a test seed according to the possible vulnerability information and the vulnerability reachable path information includes: Obtain the target large language model; The possible vulnerability information, the vulnerability reachable path information and the first model prompt information are used as input information of the target large language model to obtain a test seed generated by the target large language model, and the test seed is output.

4. The method according to claim 1, wherein Performing fuzz testing on the target code using the test seed includes: Determine a target insertion location according to the vulnerability reachable path information, and perform an insertion operation on the target code at the target insertion location; A set fuzz testing tool is obtained, the test seed is used as an input of the set fuzz testing tool, and the target code is tested by the set fuzz testing tool.

5. The method according to claim 3, characterized in that Optimizing the test seed according to the dynamic feedback information includes: Parsing the dynamic feedback information and extracting key feedback information from the dynamic feedback information; wherein the dynamic feedback information includes log information and coverage information; Using the key feedback information and the second model prompt information as input information of the target large language model, and obtaining optimization strategy information output by the target large language model; The test seed is optimized according to the optimization strategy information.

6. The method according to claim 5, characterized in that Optimizing the test seed according to the optimization strategy information includes: Get the custom mutation interface for setting the fuzz testing tool; The optimization strategy information is applied to the test seed through the custom mutation interface to obtain a mutated test seed.

7. A fuzzy testing device, characterized in that: include: A possible vulnerability information and vulnerability reachable path information determination module is used to obtain target code, perform static analysis on the target code, and determine possible vulnerability information and vulnerability reachable path information of the target code; A test seed generation module, configured to generate a test seed based on the possible vulnerability information and the vulnerability reachable path information; A fuzz testing module, configured to perform fuzz testing on the target code using the test seed, determine vulnerabilities in the target code, and collect dynamic feedback information during the fuzz testing process; A test seed optimization module is used to optimize the test seed according to the dynamic feedback information, and return to execute the step of fuzz testing the target code through the test seed until a preset test stop condition is reached.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the fuzz testing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the fuzz testing method according to any one of claims 1 to 6 when executed.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the fuzz testing method according to any one of claims 1 to 6 are implemented.

Images