Dynamic adaptive fuzzy test strategy optimization method and system

Abstract

The invention provides a dynamic adaptive fuzzy test strategy optimization method and system. The method comprises the following steps: determining a to-be-tested target program and a seed pool; determining a fine-grained plug-in set; performing a fuzzy test according to the to-be-tested target program and the seed pool, and exploring a combination strategy of a dynamic function plug-in from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm in the running process of the fuzzy test to obtain an exploration result of a plurality of plug-in combinations; determining a utilization plug-in combination according to the exploration result, and performing fuzzy testing on the to-be-tested target program according to the utilization plug-in combination; and using the plug-in combination as the highest reward plug-in combination in the exploration result. According to the method, by combining the fine-grained plug-in architecture and the dynamic strategy optimization algorithm, flexible combination and real-time adjustment of the fuzzy test strategy are realized, and the vulnerability detection capability and the code coverage rate of the fuzzy test on a complex target program are effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a dynamically adaptive fuzzy testing strategy optimization method and system. Background Art

[0002] Fuzz testing is a key technology in software vulnerability detection. It automatically generates and executes large numbers of inputs to uncover potential vulnerabilities in programs under unusual input conditions. In recent years, with the increasing scale and complexity of software, the research and application of fuzz testing has continued to deepen. Modern fuzz testing techniques incorporate genetic algorithms to optimize input data by mimicking the process of natural selection, iteratively generating more effective test cases. During this process, fuzz testing mutates the initial input (called a seed) and evaluates the quality of the mutated input based on feedback from program execution, such as changes in coverage or performance metrics. By prioritizing and further mutating high-performing inputs, fuzz testing gradually penetrates the program's code space, uncovering more hidden vulnerabilities. Building on this process, existing technologies often employ reinforcement learning methods or heuristic algorithms to design fuzz testing strategies to optimize key aspects (such as seed selection and mutation strategy scheduling) to further effectively explore the target program and increase the probability of triggering program vulnerabilities.

[0003] However, research has shown that these single-point improved algorithms perform significantly differently across different test targets, and to date, there is still no optimal strategy for fuzz testing that is universally applicable to different target programs. Furthermore, as fuzz testing continues to explore the target program's state space, the appropriate strategy for different stages of fuzz testing can change over time. This reveals significant deficiencies in the flexibility and adaptability of existing fuzz testing techniques: Traditional fuzz testing tools typically rely on static configurations, such as fixed seed selection strategies or mutation scheduling policies. This one-size-fits-all approach often performs poorly when tested against different target programs. Furthermore, the characteristics of the target program may change as fuzz testing progresses—for example, in the early stages of testing, quickly covering paths is more important, while in the later stages, exploring uncovered paths and optimizing seed quality become crucial. Most existing methods lack the ability to adjust strategies in real time based on feedback. Summary of the Invention

[0004] This invention provides a dynamically adaptive fuzz testing strategy optimization method and system to address the existing fuzz testing technology's inability to support fine-grained strategy combination at runtime. By combining a fine-grained plug-in architecture with a dynamic strategy optimization algorithm, this invention enables flexible combination and real-time adjustment of fuzz testing strategies, effectively improving the vulnerability detection capability and code coverage of fuzz testing on complex target programs.

[0005] The present invention provides a dynamically adaptive fuzz testing strategy optimization method, comprising: determining a target program to be tested and a seed pool; determining a fine-grained plug-in set; the fine-grained plug-in set comprising a plurality of dynamic function plug-ins that decompose a fuzz testing workflow; performing fuzz testing based on the target program to be tested and the seed pool, exploring the combination strategy of the dynamic function plug-ins from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the running of the fuzz testing, and obtaining exploration results of a plurality of plug-in combinations; determining a utilization plug-in combination based on the exploration results, so as to perform fuzz testing on the target program to be tested based on the utilization plug-in combination; the utilization plug-in combination is the plug-in combination with the highest reward in the exploration results.

[0006] According to a dynamically adaptive fuzz testing strategy optimization method provided by the present invention, the fine-grained plug-in set includes an input scheduling plug-in, a mutation scheduling plug-in, a mutation operator plug-in and an execution plug-in; the input scheduling plug-in is used to select seeds from the seed pool and allocate energy to the selected seeds; the mutation scheduling plug-in is used to schedule mutation operations on the selected seeds; the mutation operator plug-in is used to apply the mutation operations to the selected seeds to generate test cases; the execution plug-in is used to input the generated test cases into the target program to be tested and collect feedback information.

[0007] According to a dynamically adaptive fuzz testing strategy optimization method provided by the present invention, during the running process of the fuzz test, the combination strategy of the dynamic function plug-in is explored from the fine-grained plug-in collection according to a preset dynamically adaptive plug-in combination algorithm to obtain the exploration results of several plug-in combinations, including: modeling the strategy selection of the fuzz test as a non-stationary multi-armed bandit problem, using the Thompson sampling algorithm based on a sliding window to explore the selected plug-in combination strategy at multiple levels during the running process of the fuzz test, and determining the reward value of the plug-in combination strategy based on a reward mechanism of rare coverage paths to obtain the exploration results of the plug-in combination.

[0008] According to a dynamically adaptive fuzz testing strategy optimization method provided by the present invention, the reward mechanism based on rare coverage paths determines the reward value of the plug-in combination, including: tracking the path hit by each test case in the coverage bitmap of the target program to be tested, and determining the reward value of the plug-in combination based on the rare paths.

[0009] According to a dynamically adaptive fuzz testing strategy optimization method provided by the present invention, the input scheduling plug-in is an AFLFast plug-in or an EcoFuzz ​​plug-in, the mutation scheduling plug-in is a MOpt plug-in or a Havoc plug-in, and the mutation operator plug-in is a Bitflip mutation plug-in, an Interest mutation plug-in, an Arith mutation plug-in or a Delete mutation plug-in.

[0010] A dynamically adaptive fuzz testing strategy optimization method provided by the present invention further includes: preserving and restoring data of the global state, seed state, and plug-in state when the dynamic function plug-in is switched.

[0011] The present invention also provides a dynamically adaptive fuzz testing strategy optimization system, comprising: a first determination module, used to determine a target program to be tested and a seed pool; a second determination module, used to determine a fine-grained plug-in set; the fine-grained plug-in set includes several dynamic function plug-ins that decompose the fuzz testing workflow; an exploration module, used to perform fuzz testing based on the target program to be tested and the seed pool, and during the running of the fuzz test, explore the combination strategy of the dynamic function plug-ins from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm to obtain exploration results of several plug-in combinations; a utilization module, used to determine a utilization plug-in combination based on the exploration results, so as to perform fuzz testing on the target program to be tested based on the utilization plug-in combination; the utilization plug-in combination is the plug-in combination with the highest reward in the exploration results.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, the dynamically adaptive fuzzy testing strategy optimization method as described above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described dynamically adaptive fuzzy testing strategy optimization methods.

[0014] The present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements any of the above-described dynamically adaptive fuzzy testing strategy optimization methods.

[0015] The present invention provides a dynamically adaptive fuzz testing strategy optimization method and system, the method comprising: determining a target program to be tested and a seed pool; determining a fine-grained plug-in set; performing fuzz testing based on the target program to be tested and the seed pool, exploring the combination strategy of dynamic function plug-ins from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the running of the fuzz testing, and obtaining exploration results of several plug-in combinations; determining a plug-in combination to be utilized based on the exploration results, so as to perform fuzz testing on the target program to be tested based on the plug-in combination; and utilizing the plug-in combination as the plug-in combination with the highest reward in the exploration results. The present invention realizes the flexible combination and real-time adjustment of fuzz testing strategies by combining a fine-grained plug-in architecture with a dynamic strategy optimization algorithm, effectively improving the vulnerability detection capability and code coverage of fuzz testing on complex target programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a flow chart of a dynamic adaptive fuzzy testing strategy optimization method provided by the present invention.

[0018] Figure 2 It is a schematic diagram of the principle of a dynamic adaptive fuzzy testing strategy optimization method provided by the present invention.

[0019] Figure 3 This is a schematic diagram of the principle of the dynamic adaptive plug-in combination algorithm provided by the present invention.

[0020] Figure 4 It is a structural diagram of a dynamically adaptive fuzzy testing strategy optimization system provided by the present invention.

[0021] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0023] Please refer to Figure 1 , Figure 1 A flowchart of a dynamically adaptive fuzzy testing strategy optimization method provided by the present invention.

[0024] The present invention provides a dynamically adaptive fuzzy testing strategy optimization method, comprising: 101: Determine the target program to be tested and the seed pool; 102: Determine a fine-grained plug-in set; the fine-grained plug-in set includes a number of dynamic function plug-ins that decompose the fuzz testing workflow; 103: Performing fuzz testing based on the target program to be tested and the seed pool, exploring a combination strategy of dynamic function plug-ins from a fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the fuzz testing process, and obtaining exploration results of several plug-in combinations; 104: Determine an exploitation plug-in combination based on the exploration result, and perform fuzz testing on the target program to be tested based on the exploitation plug-in combination; the exploitation plug-in combination is the plug-in combination with the highest reward in the exploration result.

[0025] To address the shortcomings of existing fuzz testing technologies, which lack support for fine-grained strategy combination at runtime, the present invention provides a dynamically adaptive fuzz testing strategy optimization method. By combining a fine-grained plug-in architecture with a dynamic strategy optimization algorithm, the present invention enables flexible combination and real-time adjustment of fuzz testing strategies, effectively improving the vulnerability detection capability and code coverage of fuzz testing on complex target programs. Specifically, the target program to be tested and a seed pool are first determined. After instrumentation and compilation, the target program to be tested, along with an initial seed selected from the seed pool, serves as the input for the present invention. A modular plug-in design is used to create a fine-grained plug-in collection. Utilizing a dynamic code loading mechanism, the dynamic loading of plug-ins for key fuzz testing functions (such as input scheduling, mutation scheduling, and mutation operations) is enabled to independently run and dynamically load. Subsequently, the present invention performs fuzz testing on the target program to be tested based on the user-specified plug-in configuration. A preset dynamically adaptive plug-in combination algorithm is introduced to dynamically optimize the selection of plug-in combination strategies during the fuzz testing process. This design allows for the performance of different plug-in combination strategies to be evaluated based on real-time feedback, allowing for flexible strategy switching during the testing process to adapt to different test phases and target program characteristics. The reward value is updated based on the dynamically adaptive plug-in combination algorithm. By comparing the reward values ​​of different plug-in combinations, the plug-in combination to be utilized is determined, that is, the plug-in combination with the highest reward value in the exploration results. Finally, the target program is further fuzz tested using the determined plug-in combination. During the test process, if it is found that the performance has degraded or the new path is difficult to be discovered, the plug-in combination will be dynamically adjusted and its performance will be re-evaluated. This dynamic adaptation mechanism enables fuzz testing to be continuously optimized and adapt to changes in the target program. The present invention pays special attention to the refinement and dynamism of strategy optimization, which makes up for the shortcomings of existing fuzz testing methods. It is particularly suitable for testing complex software, and is superior to existing advanced fuzz testing tools in key indicators such as vulnerability discovery efficiency and code coverage, showing great application potential and practical value.

[0026] In addition, dynamic function plug-ins can be implemented in C++ and designed as dynamic libraries to support flexible loading and unloading at runtime. The implementation of the plug-in adopts class polymorphism technology to define a unified interface for each type of strategy, so that different implementations can implement specific functions by inheriting the interface. Plug-in loading and unloading use standard dynamic library management methods, loading dynamic library files by calling dlopen, extracting function symbols in the plug-in using dlsym, and unloading plug-ins that are no longer needed through dlclose. During the operation of the framework, the plug-in is managed by xFUZZ Manager, whose functions include parsing configuration files in JSON format, dynamically selecting and loading specified plug-in combinations, and the present invention is not particularly limited here.

[0027] As a preferred embodiment, the fine-grained plug-in set includes an input scheduling plug-in, a mutation scheduling plug-in, a mutation operator plug-in and an execution plug-in; the input scheduling plug-in is used to select seeds from a seed pool and allocate energy to the selected seeds; the mutation scheduling plug-in is used to schedule mutation operations on the selected seeds; the mutation operator plug-in is used to apply mutation operations to the selected seeds to generate test cases; the execution plug-in is used to input the generated test cases into the target program to be tested and collect feedback information.

[0028] As a preferred embodiment, the input scheduling plug-in is an AFLFast plug-in or an EcoFuzz ​​plug-in, the mutation scheduling plug-in is an MOpt plug-in or a Havoc plug-in, and the mutation operator plug-in is a Bitflip mutation plug-in, an Interest mutation plug-in, an Arith mutation plug-in or a Delete mutation plug-in.

[0029] Please refer to Figure 2 , Figure 2 A schematic diagram of the principle of a dynamically adaptive fuzzy testing strategy optimization method provided by the present invention.

[0030] In this embodiment, a fine-grained plug-in collection designed as a plug-in breaks down the core process of fuzz testing into multiple independent dynamic function plug-ins, including input scheduling plug-ins, mutation scheduling plug-ins, mutation operator plug-ins, and execution plug-ins. These plug-ins are implemented as independent dynamic shared libraries, which support dynamic loading or unloading during the fuzz test runtime without interrupting the test process. Each plug-in can run independently, and different plug-ins are orthogonal to each other, allowing flexible combination of different strategies. The fine-grained plug-in collection not only improves the flexibility of fuzz testing, but also facilitates the expansion of more fuzz testing strategies in the future.

[0031] The input scheduling plugin is responsible for selecting seeds and allocating energy (i.e., testing resources) to the selected seeds. Each scheduling strategy (such as AFLFast's probabilistic allocation or EcoFuzz's entropy-aware scheduling) can be dynamically loaded. During testing, the present invention uses real-time performance feedback to select the optimal input scheduling plugin to maximize code coverage.

[0032] The mutation scheduling plugin's primary function is to schedule mutation operations on a selected seed and guide the location and frequency of mutation operations. For example, the random distribution-based Havoc strategy and the particle swarm optimization-based MOpt strategy are both implemented as independent plugins. By dynamically switching the mutation scheduling plugin, the mutation strategy that best suits the target program can be selected.

[0033] Mutation operator plugins can perform mutation operations such as bit flipping, arithmetic operations, and dictionary replacement. These mutation operators, as the finest-grained plugins, can be flexibly combined to generate diverse test cases. In practice, the mutation scheduling plugin selects the appropriate mutation operator plugin based on the specific characteristics of the seed. The mutation operator plugin then applies the mutation operation to the selected seed, thereby increasing the probability of generating valid inputs (test cases).

[0034] The execution plug-in is responsible for inputting the generated test cases into the target program to be tested and collecting feedback information (such as code coverage bitmap). Once the target program crashes, it will record the input that caused the crash and the context information when the target program crashed.

[0035] As a preferred embodiment, the method further includes: preserving and restoring data of the global state, seed state, and plug-in state when the dynamic function plug-in is switched.

[0036] On this basis, the present invention fully preserves and restores key data such as global state, seed state, and plug-in state when switching plug-ins to ensure the continuity of the fuzz testing process. In terms of global state, the overall statistical information of the current fuzz test is retained, such as the number of discovered seeds, the number of covered paths, the total number of test cases generated, etc. This data provides a global view, allowing it to continue to execute tests based on existing progress after the plug-in is switched without losing historical information. In terms of seed state, the present invention records the priority, allocated energy (computing resources), historical mutation records, and coverage paths of each seed, ensuring that the seed maintains execution consistency after switching plug-ins, thereby avoiding wasting test resources or missing potential vulnerabilities due to state resets. In terms of plug-in state, the present invention records in detail the internal state of the plug-in during runtime, such as the priority statistics of each mutation operation in the mutation scheduler and the energy allocation strategy of the seed in the input scheduler. By fully recording and restoring these internal states, the present invention achieves seamless connection during the plug-in switching process, ensuring that the newly loaded plug-in can efficiently utilize historical context data and continuously optimize fuzz testing performance.

[0037] As a preferred embodiment, during the running of fuzz testing, the combination strategy of dynamic function plug-ins is explored from a fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm to obtain exploration results of several plug-in combinations, including: modeling the strategy selection of fuzz testing as a non-stationary multi-armed bandit problem, using the Thompson sampling algorithm based on a sliding window to explore the plug-in combination strategy at multiple levels during the running of fuzz testing, and determining the reward value of the plug-in combination strategy based on a reward mechanism of rare coverage paths to obtain the exploration results of the plug-in combination.

[0038] As a preferred embodiment, a reward mechanism based on rare coverage paths is used to determine the reward value of a plug-in combination, including: tracking the paths hit by each test case in the coverage bitmap of the target program to be tested, and determining the reward value of the plug-in combination based on the rare paths.

[0039] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the principle of the dynamically adaptive plug-in combination algorithm provided by the present invention.

[0040] During the fuzz testing process, the present invention continuously tries new plugin combinations and uses the sliding-window Thompson sampling (SW-TS) algorithm to explore the optimal plugin combination for the fuzz testing process. SW-TS models fuzz testing strategy selection as a non-stationary multi-armed bandit (NS-MAB) problem. Using a sliding window mechanism, it only considers performance data from the most recent fuzz test, dynamically adjusting the strategy combination to adapt to changes in the target program during testing. Specifically, the SW-TS algorithm consists of two phases: exploration and exploitation. In the exploration phase, each plugin category in the candidate plugin set is explored one by one (i.e., a multi-level exploration strategy). The reward for each plugin combination is calculated based on the code coverage or rare paths generated by each plugin. After the exploration of each plugin category is completed, the exploitation phase begins. The optimal plugin combination is selected from the results of several previous exploration rounds and "exploited" for a fixed period of time. This combination is then used to continuously fuzz test the target program. After the fixed period of fuzz testing, the next round begins, and the above steps are repeated.

[0041] What needs to be explained is: To address the issue of excessive exploration time due to the large number of plugin combinations, this paper designs a multi-level exploration strategy. By optimizing the selection of plugins for each category in stages, evaluating only one category of plugins in each round and gradually pinning down the best-performing plugins in other categories, this significantly reduces the time and computing resources required for exploration. Furthermore, by reducing the combination space, this multi-level strategy effectively avoids the significant exploration costs associated with global search, thereby improving exploration efficiency while maintaining optimization results.

[0042] To address the sparse reward distribution problem caused by the scarcity of new path discoveries in the later stages of fuzz testing, this paper proposes a reward mechanism based on rare covered paths, building on the code coverage approach. The specific approach tracks the paths hit by each test case in the target program's coverage bitmap and prioritizes paths with low coverage (rare paths) as the basis for rewarding. This mechanism enhances reward sensitivity and effectively avoids ineffective exploration caused by sparse reward distribution.

[0043] To facilitate understanding by those skilled in the art, the above-described method is a preferred embodiment of the present invention. Without departing from the above principles, the present invention can be widely used in the fields of vulnerability detection, security auditing, and code quality analysis, and the scope of application can be further expanded by increasing the plug-in categories and executor types. For example, by implementing a closed-source program test plug-in based on QEMU, the present invention can further support more target programs; by introducing a network fuzz test plug-in, the framework can be applied to scenarios such as protocol vulnerability mining; by introducing a kernel fuzz test executor plug-in, the framework can be applied to scenarios such as kernel vulnerability mining.

[0044] In summary, the present invention provides an efficient, flexible, and adaptable fuzz testing framework that significantly improves testing performance and strategy combination optimization capabilities. The above embodiments are only preferred examples of the present invention, and those skilled in the art may make improvements within the spirit and scope of the present invention.

[0045] The technical solution of the present invention has the following significant advantages: (1) Dynamic adaptability of strategy combination: Through the combination of plug-in architecture and SW-TS algorithm, the present invention realizes real-time adjustment of fuzz testing strategy, overcoming the performance bottleneck caused by fixed strategy configuration in traditional framework.

[0046] (2) Fine-grained plug-in implementation: This invention fully decouples the fuzz testing process, laying an engineering foundation for fine-grained policy scheduling while ensuring the scalability of the framework.

[0047] (3) Stronger vulnerability detection capability: The present invention demonstrates superior vulnerability detection capability and higher program space exploration capability in a variety of complex target programs compared with existing solutions, and can effectively adapt to different types of target programs.

[0048] Through the above technical solution, the present invention provides a new fuzz testing solution with flexibility, scalability and high performance, supports fine-grained runtime adaptive strategy combinations, and has a wide range of applicable scenarios and application potential.

[0049] The dynamically adaptive fuzzy testing strategy optimization system provided by the present invention is described below. The dynamically adaptive fuzzy testing strategy optimization system described below and the dynamically adaptive fuzzy testing strategy optimization method described above can refer to each other.

[0050] Please refer to Figure 4 , Figure 4 A structural diagram of a dynamically adaptive fuzzy testing strategy optimization system provided by the present invention.

[0051] The present invention also provides a dynamically adaptive fuzz testing strategy optimization system, including: a first determination module 401, used to determine the target program to be tested and the seed pool; a second determination module 402, used to determine a fine-grained plug-in set; the fine-grained plug-in set includes several dynamic function plug-ins that decompose the fuzz testing workflow; an exploration module 403, used to perform fuzz testing based on the target program to be tested and the seed pool, and explore the combination strategy of dynamic function plug-ins from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the running of the fuzz test, to obtain exploration results of several plug-in combinations; a utilization module 404, used to determine the utilization plug-in combination based on the exploration results, so as to perform fuzz testing on the target program to be tested based on the utilization plug-in combination; the utilization plug-in combination is the plug-in combination with the highest reward in the exploration results.

[0052] Figure 5 The following is a schematic diagram of the structure of an electronic device, such as Figure 5 As shown, the electronic device may include: a processor 501, a communications interface 502, a memory 503, and a communications bus 504, wherein the processor 501, the communications interface 502, and the memory 503 communicate with each other via the communications bus 504. The processor 501 may call logic instructions in the memory 503 to execute a dynamically adaptive fuzz testing strategy optimization method, the method comprising: determining a target program to be tested and a seed pool; determining a fine-grained plug-in set; the fine-grained plug-in set including a plurality of dynamic function plug-ins that decompose a fuzz testing workflow; performing fuzz testing based on the target program to be tested and the seed pool; exploring a combination strategy of dynamic function plug-ins from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the fuzz testing process, and obtaining exploration results for a plurality of plug-in combinations; determining a plug-in combination to be utilized based on the exploration results, and performing fuzz testing on the target program to be tested based on the utilized plug-in combination; the utilized plug-in combination being the plug-in combination with the highest reward in the exploration results.

[0053] Furthermore, the logic instructions in the aforementioned memory 503 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0054] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the dynamically adaptive fuzz testing strategy optimization method provided by the above methods, which includes: determining the target program to be tested and the seed pool; determining a fine-grained plug-in set; the fine-grained plug-in set includes several dynamic function plug-ins that decompose the fuzz testing workflow; performing fuzz testing based on the target program to be tested and the seed pool, and exploring the combination strategy of dynamic function plug-ins from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the running of the fuzz test, to obtain exploration results of several plug-in combinations; determining the plug-in combination to be utilized based on the exploration results, so as to perform fuzz testing on the target program to be tested based on the plug-in combination; the plug-in combination to be utilized is the plug-in combination with the highest reward in the exploration results.

[0055] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the dynamically adaptive fuzz testing strategy optimization method provided by the above-mentioned methods, the method comprising: determining a target program to be tested and a seed pool; determining a fine-grained plug-in set; the fine-grained plug-in set comprises several dynamic function plug-ins that decompose the fuzz testing workflow; performing fuzz testing based on the target program to be tested and the seed pool, and exploring the combination strategy of dynamic function plug-ins from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the running of the fuzz test, to obtain exploration results of several plug-in combinations; determining a plug-in combination to be utilized based on the exploration results, so as to perform fuzz testing on the target program to be tested based on the utilized plug-in combination; the utilized plug-in combination is the plug-in combination with the highest reward in the exploration results.

[0056] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0057] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A dynamic adaptive fuzzy testing strategy optimization method, characterized in that: include: Determine the target program and seed pool to be tested; Determine a fine-grained plug-in set; the fine-grained plug-in set includes a plurality of dynamic function plug-ins that decompose the fuzz testing workflow; Performing a fuzz test based on the target program to be tested and the seed pool, and exploring a combination strategy of the dynamic function plug-in from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm during the fuzz test, to obtain exploration results of multiple plug-in combinations; Determine a plug-in combination to be utilized according to the exploration result, so as to perform fuzz testing on the target program to be tested according to the plug-in combination; the plug-in combination to be utilized is the plug-in combination with the highest reward in the exploration result.

2. The method for dynamically adapting fuzzy testing strategy optimization according to claim 1, characterized in that: The fine-grained plug-in set includes an input scheduling plug-in, a mutation scheduling plug-in, a mutation operator plug-in and an execution plug-in; The input scheduling plug-in is used to select seeds from the seed pool and allocate energy to the selected seeds; The mutation scheduling plug-in is used to schedule the mutation operation on the selected seed; The mutation operator plug-in is used to apply the mutation operation to the selected seed to generate a test case; The execution plug-in is used to input the generated test case into the target program to be tested and collect feedback information.

3. The dynamic adaptive fuzzy testing strategy optimization method according to claim 1 is characterized in that: During the fuzz test, a combination strategy of the dynamic function plug-in is explored from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm, and several plug-in combination exploration results are obtained, including: The strategy selection of fuzz testing is modeled as a non-stationary multi-armed bandit problem. The Thompson sampling algorithm based on sliding windows is used to explore the plug-in combination strategy at multiple levels during the fuzz testing process. The reward value of the plug-in combination strategy is determined based on the reward mechanism of rare coverage paths to obtain the exploration result of the plug-in combination.

4. The method for dynamically adapting fuzzy testing strategy optimization according to claim 3, wherein: The reward mechanism based on rare coverage paths determines the reward value of the plug-in combination, including: The paths hit by each test case in the coverage bitmap of the target program to be tested are tracked, and the reward value of the plug-in combination is determined according to the rare paths.

5. The method for dynamically adapting fuzzy testing strategy optimization according to claim 2, wherein: The input scheduling plug-in is an AFLFast plug-in or an EcoFuzz ​​plug-in, the mutation scheduling plug-in is an MOpt plug-in or a Havoc plug-in, and the mutation operator plug-in is a Bitflip mutation plug-in, an Interest mutation plug-in, an Arith mutation plug-in or a Delete mutation plug-in.

6. The method for dynamically adapting fuzzy testing strategy optimization according to any one of claims 1 to 5, characterized in that: Also includes: When the dynamic function plug-in is switched, the data of the global state, seed state and plug-in state are retained and restored.

7. A dynamically adaptive fuzzy testing strategy optimization system, characterized in that: include: A first determination module is used to determine the target program to be tested and the seed pool; The second determination module is used to determine the fine-grained plug-in set; The fine-grained plug-in set includes a plurality of dynamic function plug-ins that decompose the fuzz testing workflow; an exploration module, configured to perform fuzz testing based on the target program to be tested and the seed pool, and during the fuzz testing process, explore the combination strategy of the dynamic function plug-in from the fine-grained plug-in set according to a preset dynamically adaptive plug-in combination algorithm to obtain exploration results of multiple plug-in combinations; An utilization module is used to determine an utilization plug-in combination according to the exploration result, so as to perform fuzz testing on the target program to be tested according to the utilization plug-in combination; The utilized plug-in combination is the plug-in combination with the highest reward in the exploration result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the dynamically adaptive fuzzy testing strategy optimization method as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the dynamically adaptive fuzzy testing strategy optimization method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the dynamically adaptive fuzzy testing strategy optimization method according to any one of claims 1 to 6 is implemented.

Images