Fuzzy test-based static false alarm confirmation method and system, terminal and storage medium

Abstract

The invention relates to the technical field of data processing, and discloses a static false alarm confirmation method and system based on fuzzy testing, a terminal and a storage medium, and the method comprises the steps: obtaining static alarm data corresponding to a target source code, and carrying out the preprocessing, and obtaining a preprocessing result; performing correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiling code snippet according to the preprocessing result and the correlation analysis result; performing program slicing processing on the minimum compilation code snippet to obtain an execution code snippet, and performing fuzzy test processing on the execution code snippet to obtain a fuzzy test result; and performing alarm classification processing on the fuzzy test result to obtain an alarm classification result. According to the method, the minimum compilation code snippet is generated according to the static alarm data, and program slicing processing, fuzzy test processing and alarm classification processing are performed, so that the alarm classification result is obtained, and the accuracy and efficiency of static alarm automatic confirmation can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a static false alarm confirmation method, system, terminal and computer-readable storage medium based on fuzzy testing. Background Art

[0002] When static analysis tools report true positive alerts (i.e., reported vulnerabilities that actually exist), they often generate a large number of false positives, which severely impacts their usefulness. To address this issue, static analysis tools currently employ automated confirmation methods based on dynamic methods.

[0003] However, the existing static alarm automatic confirmation method based on dynamic methods can only solve part of the static alarm automatic confirmation problem, and the processing time is long, which cannot meet user needs.

[0004] Therefore, the existing technology still needs to be improved and developed. Summary of the Invention

[0005] The main purpose of the present invention is to provide a static false alarm confirmation method, system, terminal and computer-readable storage medium based on fuzzy testing, aiming to solve the problem that the static alarm automatic confirmation method based on dynamic methods in the existing technology can only solve part of the static alarm automatic confirmation problem, and the processing time is long and cannot meet user needs.

[0006] To achieve the above object, the present invention provides a static false alarm confirmation method based on fuzzy testing, the static false alarm confirmation method based on fuzzy testing comprising the following steps: Obtaining static alarm data corresponding to the target source code, and preprocessing the static alarm data to obtain a preprocessing result; Performing a correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiled code fragment according to the preprocessing result and the correlation analysis result; Performing program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and performing fuzz testing processing on the execution code fragment to obtain a fuzz testing result; Perform alarm classification processing on the fuzzy test result to obtain an alarm classification result.

[0007] Optionally, in the static false alarm confirmation method based on fuzz testing, the preprocessing result includes static alarm data, compilation commands, structured information and target variables; The step of obtaining static alarm data corresponding to the target source code and preprocessing the static alarm data to obtain a preprocessing result specifically includes: Determine a target program, and download and configure a static analysis tool on the target program; Determining a target source code, and performing static analysis processing on the target source code using the static analysis tool to obtain the static alarm data; Generate the compilation command by using the Bear tool, and generate the structured information of the target program by using srcML; The vulnerability occurrence position corresponding to the vulnerability in the static alarm data is obtained, and the target source code is traversed according to the vulnerability occurrence position until the traversed character is non-space or non-special symbol, thereby obtaining the target variable.

[0008] Optionally, the static false alarm confirmation method based on fuzz testing, wherein the performing of correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiled code fragment based on the preprocessing result and the correlation analysis result, specifically includes: Determine a target function according to the structured information in the preprocessing result and the vulnerability occurrence location, and obtain multiple target parameters in the target function; Calculating the correlation between each of the target parameters and the target variable to obtain a correlation analysis result; Obtain a parameter type corresponding to each target parameter, and perform assignment processing on each target parameter according to the parameter type and the correlation analysis result to obtain a minimum compiled code fragment.

[0009] Optionally, in the static false alarm confirmation method based on fuzz testing, the correlation analysis result includes control dependency and data dependency; The calculation of the correlation between each target parameter and the target variable to obtain a correlation analysis result further includes: Determine the basic block where the target variable is located, and mark the basic block to obtain a target basic block; Determine an entry node, and obtain multiple path constraints from the entry node to the target basic block; If the target parameter is included in the plurality of path constraints, determining that the target parameter and the target variable have the control dependency relationship; Determine variable nodes, and construct a target set according to the variable nodes and the target parameters; It is determined whether the parameters in the target set reach the target basic block, and if so, it is determined that the target parameters have the data dependency relationship with the target variables.

[0010] Optionally, the static false alarm confirmation method based on fuzz testing, wherein obtaining the parameter type corresponding to each target parameter and performing value assignment processing on each target parameter according to the parameter type and the correlation analysis result to obtain a minimum compiled code fragment, specifically includes: Obtaining the parameter type corresponding to each target parameter in the target function; If the parameter type is a non-struct type, generating a declaration statement and an assignment statement for each target parameter, and obtaining the minimum compiled code fragment according to the declaration statement and the assignment statement; If the parameter type is a structure type, a complete assignment strategy or a simple assignment strategy is used to perform assignment processing according to the correlation analysis result to obtain a minimum compiled code fragment.

[0011] Optionally, the static false alarm confirmation method based on fuzz testing, wherein the program slicing processing is performed on the minimum compiled code fragment to obtain an execution code fragment, and the fuzz testing processing is performed on the execution code fragment to obtain a fuzz testing result, specifically includes: Determine the preset program slicing tool, and determine the preset slicing standards and the location of the code to be sliced; Using the preset program slicing tool to perform program slicing processing on the minimum compiled code fragment according to the preset slicing standard and the position of the code to be sliced, to obtain an execution code fragment; Determine a preset fuzz testing tool and obtain the target file location corresponding to the execution code snippet; The target file location is fuzz tested by the preset fuzz testing tool to obtain a fuzz testing result.

[0012] Optionally, in the static false alarm confirmation method based on fuzzy testing, the alarm classification result includes true positive alarms and false positive alarms; The alarm classification processing is performed on the fuzzy test result to obtain the alarm classification result, specifically including: Determine whether data corruption occurs at the target file location according to the fuzzy test result; If data corruption occurs at the target file location, and the cause of the corruption is consistent with the cause of the vulnerability in the static alarm data, then the fuzzy test result is determined to be the true positive alarm; If no data corruption occurs at the target file location, the fuzzy test result is determined to be the false positive alarm.

[0013] In addition, to achieve the above-mentioned purpose, the present invention further provides a static false alarm confirmation system based on fuzzy testing, wherein the static false alarm confirmation system based on fuzzy testing includes: A preprocessing module, configured to obtain static alarm data corresponding to the target source code, and preprocess the static alarm data to obtain a preprocessing result; A correlation analysis module is used to perform a correlation analysis on the preprocessing result to obtain a correlation analysis result, and construct a minimum compiled code fragment according to the preprocessing result and the correlation analysis result; A fuzz testing module is used to perform program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and to perform fuzz testing on the execution code fragment to obtain a fuzz testing result; The alarm classification module is used to perform alarm classification processing on the fuzzy test result to obtain an alarm classification result.

[0014] In the present invention, static alarm data corresponding to the target source code is obtained, and the static alarm data is preprocessed to obtain a preprocessing result; a correlation analysis is performed on the preprocessing result to obtain a correlation analysis result, and a minimum compiled code fragment is constructed based on the preprocessing result and the correlation analysis result; program slicing is performed on the minimum compiled code fragment to obtain an execution code fragment, and fuzz testing is performed on the execution code fragment to obtain a fuzz testing result; and alarm classification is performed on the fuzzy testing result to obtain an alarm classification result. The present invention generates a minimum compiled code fragment by preprocessing and correlation analysis of static alarm data, and performs program slicing, fuzz testing, and alarm classification on the minimum compiled code fragment to finally obtain an alarm classification result, which can effectively improve the accuracy and efficiency of automatic confirmation of static alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a flow chart of a preferred embodiment of the static false alarm confirmation method based on fuzzy testing of the present invention; Figure 2 Schematic diagram of the overall implementation process of a preferred embodiment of the static false alarm confirmation method based on fuzzy testing of the present invention; Figure 3 Schematic diagram of a code snippet generation algorithm of a preferred embodiment of a static false alarm confirmation method based on fuzz testing of the present invention; Figure 4 It is a structural diagram of a preferred embodiment of a static false alarm confirmation system based on fuzzy testing of the present invention; Figure 5 It is a structural diagram of a preferred embodiment of the terminal of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the present invention more clear and distinct, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0017] When static analysis tools report true positive alerts (i.e., the vulnerabilities (bugs) reported in the alerts actually exist), they are often accompanied by a large number of false positives. This is because accurate static analysis takes a long time, so static analysis tools usually sacrifice some accuracy to ensure that the analysis time is not too long. However, because of the sacrifice of accuracy, the analysis is inaccurate and false positives are generated. This seriously affects the practicality of static analysis tools.

[0018] At present, static alarm automatic confirmation solutions based on dynamic methods can be divided into two categories according to the dynamic technology used: static alarm automatic confirmation methods based on fuzz testing and static alarm automatic confirmation methods based on symbolic execution.

[0019] Regarding static alarm automatic confirmation methods based on fuzz testing: Existing technologies typically achieve efficient static alarm automatic confirmation by breaking down complex binary programs within a real-time operating system (RTOS) into independent task slices and performing fuzz testing on these slices with irrelevant paths pruned. Alternatively, methods can be used to obtain bug-related functions based on alarm information, use a compiler and GDB (GNU symbolic debugger) to generate executable code snippets containing the bug-related functions, and then perform fuzz testing on these code snippets to achieve automatic confirmation of static alarms.

[0020] Regarding automatic confirmation of static alarms based on symbolic execution: Conventional methods generally automatically confirm static alarms by executing symbols guided by reachability analysis results on the program. Alternatively, reachability analysis is used to eliminate invalid alarms, and hybrid symbolic execution is used to confirm the remaining alarms. Alternatively, irrelevant paths are pruned using reachability analysis and path constraint solving, and then symbolic execution is used to automatically confirm the alarms. Alternatively, program slicing can be used to simplify the code, and symbolic execution can be executed on the simplified code to confirm static alarms. However, these methods often suffer from high time consumption and even timeouts.

[0021] Existing dynamic methods for automatically confirming static alarms only partially address the problem of long processing times. This paper proposes Fcs4sa (Fuzzing Code Snippet for Static Analysis), a method for automatically confirming static alarms. This method uses alarm information (primarily including the file where the bug is located, its location (including line and column numbers), the bug type, and the process in which the bug occurred, and may also include variables related to the bug) to synthesize code snippets and perform fuzz testing on these code snippets, enabling more targeted alarm confirmation.

[0022] Understandably, the high false positive rate of static alerts significantly impacts the practicality of static analysis techniques. Dynamic methods (those that analyze programs or trigger bugs by executing them) are currently widely used to automatically confirm static alerts (static alerts are alerts generated when problems are detected by analyzing source code before execution). However, current solutions for automatically confirming static alerts based on dynamic methods typically only partially confirm static alerts, leaving room for further improvement in terms of timeliness. Therefore, this paper proposes Fcs4sa, a method specifically designed for automatically confirming static alerts. It first generates a minimal compiled code snippet containing the relevant functions based on the alert information, optimizing efficiency through parameter generation strategies. It then uses program slicing to prune irrelevant paths within the minimal compiled code snippet, and finally confirms the alert using fuzz testing. The performance of Fcs4sa is evaluated on a pre-set test set, three open-source libraries, and one open-source dataset. The results are compared with three traditional dynamic-based static alert automatic confirmation methods. The results demonstrate that Fcs4sa, designed in this paper, outperforms other methods in terms of accuracy and efficiency in automatically confirming static alerts.

[0023] The static false alarm confirmation method based on fuzzy testing described in the preferred embodiment of the present invention is as follows: Figure 1 As shown, the static false alarm confirmation method based on fuzz testing includes the following steps: Step S10: Obtain static alarm data corresponding to the target source code, and preprocess the static alarm data to obtain a preprocessing result, wherein the preprocessing result includes the static alarm data, compilation commands, structured information, and target variables.

[0024] like Figure 2 As shown in FIG, the overall process of Fcs4sa set in the present invention is composed of four main parts: preprocessing, code snippet generation, fuzz testing and alarm classification.

[0025] Preprocessing: 1. Obtain the necessary information, including running a static analysis tool on the target program to generate static alert data (first, you need to download the static analysis tool and configure the necessary environment, then prepare the target source code for static analysis, and finally run the static analysis tool to analyze the target source code to obtain static alert data). 2. Use the Bear tool to build the project and store the build commands for subsequent creation of a minimum compilable code snippet. 3. Use srcML (Source Code Markup Language, an XML format for source code used for source code format conversion) to generate structured information about the target program and extract target variables related to the bug for correlation analysis (where the target variables are the bug-related variables in the static alert data).

[0026] Specifically, a target program is determined, and a static analysis tool is downloaded and configured on the target program; a target source code is determined, and the target source code is statically analyzed by the static analysis tool to obtain the static alarm data; the compilation command is generated by the Bear tool, and the structured information of the target program is generated by srcML; the vulnerability location corresponding to the vulnerability in the static alarm data is obtained, and the target source code is traversed according to the vulnerability location until the traversed character is non-space or non-special symbol, thereby obtaining the target variable.

[0027] The target variable extraction process is as follows: The target variable refers to the variable that triggers the bug. For example, when a variable is used again after being released, the alarm will indicate that a variable was released on a certain line (release refers to the release of memory. The program allocates memory for a variable and then reclaims the memory in the subsequent process. This memory recycling is called release). If the variable is still used in the subsequent code lines, then this variable is the target variable.

[0028] The target variable may be explicitly identified in the alert, allowing you to directly retrieve its information, including its name and type. However, in some cases, the alert may not directly identify the specific variable. In this case, you need to traverse the source code based on the bug location (i.e., line and column numbers) provided in the alert. This traversal ends when the current traversal character is non-space and non-special symbol. This determines the end position of the target variable name and extracts the target variable. After extracting the target variable information, it is returned in the "line number and variable name" format for subsequent code snippet generation.

[0029] Step S20: performing a correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiled code segment based on the preprocessing result and the correlation analysis result.

[0030] The generation of the minimum compilable code snippet includes three parts: 1. Performing correlation analysis to obtain the correlation between the various parameters of the target function and the target variable; 2. Combining the preprocessing information (i.e., the preprocessing results in the present invention, including static alarm data, compilation commands, structured information, and target variables) and the results of the correlation analysis to create a minimum compilable code snippet (first generating the initial code snippet, then generating the declaration statements and assignment statements of the parameters in the target function, and finally passing the parameters to the target function to generate the calling code of the target function. The result is the minimum compilable code snippet, which can be used for subsequent fuzz testing); 3. Program slicing of the code snippet to reduce irrelevant paths.

[0031] Specifically, a target function is determined based on the structured information in the preprocessing result and the vulnerability location, and multiple target parameters in the target function are obtained; the basic block where the target variable is located is determined, and the basic block is marked to obtain a target basic block.

[0032] The purpose and function of correlation analysis is to determine whether there is a data flow or control flow correlation between the parameters of the target function (the target function refers to the function where the code line where the bug occurs is located, which is obtained based on the bug location information in the static alert data combined with the structured information obtained through srcML) and the target variable, and further guide the generation of code snippets.

[0033] Specifically, correlation analysis primarily analyzes two types of static information: the control flow graph (CFG), a directed graph showing all possible control flow paths during program execution, and the data flow graph (DFG), a directed graph representing data dependencies and the order of operations in a program. The CFG can be used to analyze whether the parameters of the target function are related to the execution of the relevant paths (if so, the parameters are considered to be correlated with the target variable). The DGF can be used to analyze whether the parameters of the target function affect the value of the target variable (the DGF analyzes whether the parameters of the target function are related to the value of the target variable; if so, the parameters are considered to be correlated with the target variable). Based on the correlation, the parameters of the target function are divided into a relevant parameter set (rp) and an irrelevant parameter set (urp). (Correlation is determined by analyzing the CFG and DGF. Parameters are then divided into relevant and irrelevant parameter sets based on the correlation. If a correlation exists, the parameter is placed in the relevant parameter set; if not, the parameter is placed in the irrelevant parameter set.)

[0034] An entry node is determined, and multiple path constraints from the entry node to the target basic block are obtained; if the multiple path constraints include the target parameter, it is determined that the target parameter has the control dependency relationship with the target variable.

[0035] During the code generation process, different collections select different generation strategies. The following will introduce the analysis process of the two types of static information in detail.

[0036] The control flow graph analysis process is as follows: 1. The present invention specifically marks the basic block where the target variable resides, calling it the target basic block. 2. Starting from the entry node, all paths reachable from the entry node are traversed, collecting the paths that can reach the target basic block and their associated path constraints. 3. If a path constraint contains a parameter, the parameter is considered to have a control dependency relationship with the target variable and is added to the relevant parameter set rp. If a parameter is not included in any path constraint, the present invention assumes that the parameter does not have a control dependency relationship with the target variable.

[0037] Determine the variable node, and construct a target set based on the variable node and the target parameter; determine whether the parameters in the target set reach the target basic block, and if so, determine that the target parameter and the target variable have the data dependency relationship.

[0038] Regarding data flow graph analysis: The data flow graph describes the data dependencies in the program. For each parameter of the target function, the present invention propagates the parameter along the data flow graph. The propagation process is as follows: 1. Initially, the set of elements only contains the parameters of the target function being analyzed. 2. The elements in the set are traversed, and variable nodes in the data flow graph that have edges with the elements (i.e., variable nodes that may have data dependencies with the elements) are added to the set. 3. This process is repeated until the target variable or the end of the function is reached. If the target variable is successfully reached, the parameter is considered to have a data dependency with the target variable and is added to the relevant parameter set rp (the set rp is used to guide code snippet generation).

[0039] Obtaining the parameter type corresponding to each target parameter in the target function; if the parameter type is a non-structural type, generating a declaration statement and an assignment statement for each target parameter, and obtaining the minimum compiled code fragment based on the declaration statement and the assignment statement; if the parameter type is a structural type, performing assignment processing using a complete assignment strategy or a simple assignment strategy based on the correlation analysis result to obtain the minimum compiled code fragment.

[0040] The present invention also provides an irrelevant parameter set urp. Only when there is neither a control dependency nor a data dependency between the target parameter and the target variable, the parameters of the target function will be added to the irrelevant parameter set.

[0041] like Figure 3 As shown in the figure, the code snippet generation algorithm diagram is used, which takes the bug alert W (i.e., the static alert data in the present invention) and the source code C (i.e., the target source code in the present invention) as input and outputs the generated code snippet CS (i.e., the minimum compiled code snippet in the present invention). First, the target variable (i.e., Figure 3 TargetVar in ); secondly, perform program dependency analysis on the target function on the source code to generate a program dependency graph, including a control flow graph CFG and a data flow graph DFG; then, analyze the correlation between each parameter of the target function and the target variable on the control flow graph and the data flow graph, and return a parameter set rp related to the target variable.

[0042] Finally, the code snippet is synthesized (i.e. Figure 3 ), the process is as follows: 1. The algorithm will first generate an initial code snippet (the initial code snippet only contains the target function, other functions mentioned in the static alarm data, and related dependent functions. This generation process is based on the information in the static alarm data and the source code structured information generated by srcML to obtain all related functions, and then extract the code of the related functions and put them into the initial code snippet). The initial code snippet contains the target function, related functions, and entry functions. 2. The algorithm traverses each parameter of the target function and generates declaration statements and assignment statements for each parameter (the type of each parameter can be known through the source code of the target function, and then declaration statements are generated based on these types. The assignment statement needs to first calculate the memory size required for the parameter, and then allocate memory for assignment). 3. For the currently traversed parameter, if the parameter is a non-structure type parameter, it can be directly declared and assigned; if the parameter is a structure type parameter, it is necessary to further select different generation strategies based on whether it has a correlation with the target variable.

[0043] The generation strategies include complete assignment strategy and simple assignment strategy. The detailed processes of these two strategies are as follows: For the full assignment strategy: The full assignment strategy is applied when there is a correlation between the parameter and the target variable. Under this strategy, Fcs4sa adds a declaration statement for the parameter in the entry function of the initial code snippet.

[0044] This parameter is added to the Worklist collection as an initial element, and the following processing is performed: 1. Compile the code snippet and collect incomplete type variables based on the error message. 2. Use GDB to collect the subfields of the currently processed parameter, add declaration statements for these subfields in the entry function and generate new code snippets. These subfields will be replaced into the Worklist collection as the elements to be processed in the next round. 3. After obtaining all the variables that need to be generated and the incomplete type variables therein, assign values ​​to these variables. Since the size of the incomplete type variables is uncertain, when assigning values ​​to the incomplete type variables, the present invention uses the smallest char type size as the memory size parameter for memory allocation and assignment to ensure that the assignment operation does not exceed the memory usage range of the variable. 4. Execute the above processing in a loop until no new elements are replaced into the Worklist collection, that is, the Worklist is an empty set. Finally, assign the corresponding type variables to the subfields of their parent type variables based on the type relationship.

[0045] For the simple assignment strategy: the simple assignment strategy is applied when there is no correlation between the parameter and the target variable. Under this strategy, Fcs4sa also adds the declaration statement of the parameter in the entry function of the initial code snippet. Since the parameter has nothing to do with the occurrence of the bug in terms of data flow and control flow, a simple processing method is adopted to directly randomly assign a value to the memory location of the parameter through the memcpy function (memorycopy, memory copy function). This method only requires one compilation (used to determine whether the parameter is an incomplete type to determine the assignment strategy). The memcpy function is suitable for most cases, but is not suitable for complex structures (such as pointers and imaginary functions, etc.). The present invention adopts a normal assignment method for complex structures to avoid causing program errors. After the above process, the final code snippet CS (that is, the minimum compiled code snippet in the present invention) is obtained.

[0046] Step S30: performing program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and performing fuzz testing processing on the execution code fragment to obtain a fuzz testing result.

[0047] After generating a fuzzy target (ie, an execution code snippet in the present invention), a fuzz testing tool is called to perform fuzz testing on the fuzzy target and collect the resulting crashes.

[0048] Specifically, a preset program slicing tool is determined, and a preset slicing standard and a location of the code to be sliced ​​are determined; the preset program slicing tool is used to perform program slicing processing on the minimum compiled code fragment according to the preset slicing standard and the location of the code to be sliced ​​to obtain an execution code fragment.

[0049] After obtaining the minimum compiled code snippet, it must first be sliced. Program slicing is a technique that extracts code snippets related to specific variables or statements (slicing criteria) from the original code by analyzing the data flow and control flow dependencies within the program. The program slicing process is as follows: First, the slicing criteria are defined. In this invention, the criteria in Fcs4sa is set as the target variable. Program slicing then retrieves code snippets related to the target variable. A program dependency graph is then constructed and analyzed to determine the code associated with the target variable. Finally, these related codes are extracted to form code snippets, completing program slicing.

[0050] The program slicing in the present invention is achieved through a program slicing tool. First, the program slicing tool is downloaded and the environment is configured. The tool is called through the command line, and the slicing standard and the location of the code to be sliced ​​are passed as parameters to the program slicing tool to complete the slicing.

[0051] Determine a preset fuzz testing tool and obtain the target file location corresponding to the execution code fragment; perform fuzz testing on the target file location through the preset fuzz testing tool to obtain a fuzz testing result.

[0052] The fuzz testing process is as follows: 1. Select the target program and determine the test scope; 2. Construct a large number of abnormal inputs through random generation; 3. Automatically inject the abnormal inputs into the target program and monitor its running status; 4. Record the input samples that trigger the anomaly, analyze the root cause and reproduce the problem so that developers can fix the vulnerability.

[0053] Fuzz testing in this invention is performed using the fuzz testing tool (LibFuzzer). The fuzz testing process is as follows: download LibFuzzer and configure the environment. Then, you need to write the entry point function, which is generated during the code snippet generation process. Finally, call LibFuzzer from the command line and pass the code snippet's file location as a parameter to complete the fuzz testing. The fuzz test results are displayed on the command line, and Fcs4sa further classifies the alerts based on the fuzz test results.

[0054] Step S40: Perform alarm classification processing on the fuzzy test result to obtain an alarm classification result, wherein the alarm classification result includes true positive alarms and false positive alarms.

[0055] After Fcs4sa finishes running, it will directly indicate whether a crash has occurred at the target location (i.e., the line of code where the bug mentioned in the alert occurred) with the same cause as the bug in the alert. If so, it will provide detailed information about the crash (i.e., the fuzz test results in this invention).

[0056] Regarding alarm classification, the alarm can be classified into possible true positives (i.e., true positive alarms in this invention) and possible false positives (i.e., false positive alarms in this invention) based on whether there is a crash whose occurrence location and cause are consistent with the alarm (i.e., determining whether the cause and location of the crash in the fuzz test results are consistent with the cause and location of the crash in the alarm data). In addition to true positive alarms and false positive alarms, the alarm classification results can also include unreachable and uncompilable types.

[0057] Specifically, whether data corruption occurs at the target file location is determined based on the fuzzy test result; if data corruption occurs at the target file location, and the cause of the corruption is consistent with the cause of the vulnerability in the static alarm data, the fuzzy test result is determined to be the true positive alarm; if data corruption does not occur at the target file location, the fuzzy test result is determined to be the false positive alarm.

[0058] It is understandable that static alarm data can be classified according to the crash results (i.e., the fuzz test results in the present invention). If the crash is triggered at the bug occurrence location (target location) in the alarm, and the cause of the crash is the same as the cause of the fuzz test result, the alarm is classified as a possible true positive; if the fuzz test of the target location is performed, but no crash with the same cause is triggered, the alarm is classified as a possible false positive; if the fuzz test does not execute the target location, it is classified as unreachable; if the generated code snippet shows that the compilation failed, it is classified as uncompilable.

[0059] Furthermore, many of the alerts generated by static analysis tools may be incorrectly judged. The purpose of Fcs4sa in the present invention is to eliminate these incorrectly judged alerts and only filter out those classified as possible true positive alerts (i.e., true positive alerts in the present invention) and send them to developers for further confirmation, thereby reducing the workload of developers.

[0060] Experimental results: This paper selected 30 buffer overflow alerts from the Helium dataset as an experimental dataset, including 2 true positives and 28 false positives. The results were compared with the dynamic tools Helium, Unit+KLEE, and FUZZSLICE (Helium, Unit+KLEE, and FUZZSLICE are all fuzz testing tools).

[0061] Regarding the effectiveness of code snippet generation: Table 1 shows the effectiveness of the code snippets generated by each tool. The Unit+KLEE method fails to generate executable code snippets in a significant number of cases, with a success rate of only 40%. Although Helium successfully generates 29 executable code snippets, only 20 of these 29 snippets are valid. This is because the remaining 9 snippets contain switch blocks, and Helium's handling of switch blocks is imperfect. It only generates the switch (condition) judgment code, omitting the branch content. This code results in semantic discrepancies with the source code, leading to biased results and invalid code snippets. In contrast, FUZZSLICE and Fcs4sa both generate executable and valid code snippets for all alerts, and both are more efficient than Helium and Unit+KLEE. This is because Helium and Unit+KLEE generate code snippets by generating code with the same semantics based on the source code. However, this approach is prone to generating invalid code snippets due to incomplete or inaccurate semantic parsing, and Helium has flaws in its handling of switch block generation. Fcs4sa and FUZZSLICE, on the other hand, utilize the compiler and GDB to extract the necessary code from the source code to generate the call code for the target function, thereby generating valid code snippets. This process primarily focuses on generating valid compilation commands and correctly defining definitions. Compared to Helium's semantic parsing, this is simpler, making it easier to synthesize valid code snippets. Furthermore, due to optimizations in parameter generation, Fcs4sa is more efficient than FUZZSLICE.

[0062] Table 1: Effectiveness of code snippet generation

[0063] Table 2: Validity of Alarm Acknowledgement

[0064] As shown in Table 2 (TP (true positive) in Table 2 refers to the number of alarms identified as true positives by the tool, and RTP (real true positive) refers to the number of alarms identified as TP that are actually true positives, i.e., the number of correctly identified alarms; similarly, FP and RFP refer to the number of false positives), Fcs4sa outperformed the other three dynamic methods in terms of precision and recall. Specifically, Fcs4sa correctly confirmed 2 true positive alarms and 18 false positive alarms. In contrast, Unit+KLEE only confirmed 1 true positive alarm and 10 false positive alarms, Helium confirmed 1 true positive alarm and 13 false positive alarms, and FUZZSLICE confirmed 2 true positive alarms and 14 false positive alarms. This is primarily due to the high number of invalid code snippets generated by Unit+KLEE and Helium. UK (unknown) results occur when code snippets are invalid or when dynamic testing fails to cover the target location. Fcs4sa has significantly fewer UK results than Helium and Unit+KLEE. Moreover, since irrelevant paths are pruned using program slicing, Fcs4sa's fuzz testing can more easily cover target locations, so the number of UKs is less than FUZZSLICE. The above results show that Fcs4sa achieves the best experimental performance.

[0065] In summary, Fcs4sa achieves automatic confirmation of static alerts by generating executable code snippets for targeted fuzz testing. Fcs4sa improves the efficiency of code snippet generation by introducing parameter generation optimization strategies. It also performs program slicing on code snippets, reducing irrelevant paths and improving fuzz testing efficiency. Compared to other methods, Fcs4sa is more efficient and offers advantages in both the success rate of generating code snippets and fuzzing target code lines, as well as the accuracy of alert confirmation.

[0066] Furthermore, if Figure 4 As shown, based on the above-mentioned static false alarm confirmation method based on fuzzy testing, the present invention also provides a static false alarm confirmation system based on fuzzy testing, wherein the static false alarm confirmation system based on fuzzy testing includes: A preprocessing module 51 is used to obtain static alarm data corresponding to the target source code and preprocess the static alarm data to obtain a preprocessing result; a correlation analysis module 52 for performing a correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiled code segment based on the preprocessing result and the correlation analysis result; A fuzz testing module 53 is configured to perform program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and perform fuzz testing on the execution code fragment to obtain a fuzz testing result; The alarm classification module 54 is used to perform alarm classification processing on the fuzzy test result to obtain an alarm classification result.

[0067] Furthermore, if Figure 5 As shown, based on the above-mentioned static false alarm confirmation method and system based on fuzzy testing, the present invention also provides a terminal, which includes a processor 10, a memory 20 and a display 30. Figure 5 Only some of the components of the terminal are shown, but it should be understood that implementation of all of the shown components is not required, and more or fewer components may be implemented instead.

[0068] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard drive or memory of the terminal. In other embodiments, the memory 20 may also be an external storage device of the terminal, such as a plug-in hard drive, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. equipped with the terminal. Furthermore, the memory 20 may include both the internal storage unit of the terminal and an external storage device. The memory 20 is used to store application software installed in the terminal and various types of data, such as program code of the terminal. The memory 20 may also be used to temporarily store data that has been output or is about to be output. In one embodiment, the memory 20 stores a static false alarm confirmation program 40 based on fuzz testing. The static false alarm confirmation program 40 based on fuzz testing can be executed by the processor 10, thereby implementing the static false alarm confirmation method based on fuzz testing in the present application.

[0069] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor, or other data processing chip, configured to execute program code or process data stored in the memory 20, such as executing the fuzz testing-based static false alarm confirmation method.

[0070] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, an OLED (Organic Light-Emitting Diode) touch screen, etc. The display 30 is used to display information on the terminal and to display a visual user interface.

[0071] In one embodiment, the steps of the static false alarm confirmation method based on fuzzy testing are implemented when the processor 10 executes the static false alarm confirmation program 40 based on fuzzy testing in the memory 20 .

[0072] In summary, the present invention provides a static false alarm confirmation method, system and terminal based on fuzz testing, the method comprising: obtaining static alarm data corresponding to the target source code, and preprocessing the static alarm data to obtain a preprocessing result; performing correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiled code fragment based on the preprocessing result and the correlation analysis result; performing program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and performing fuzz testing processing on the execution code fragment to obtain a fuzz testing result; performing alarm classification processing on the fuzzy test result to obtain an alarm classification result. The present invention generates a minimum compiled code fragment by preprocessing and correlation analysis on static alarm data, and performs program slicing processing, fuzz testing processing and alarm classification processing on the minimum compiled code fragment, and finally obtains an alarm classification result, which can effectively improve the accuracy and efficiency of automatic confirmation of static alarms.

[0073] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or terminal comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or terminal comprising the element.

[0074] Of course, those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware (such as a processor, controller, etc.) through a computer program. The program can be stored in a computer-readable storage medium that can be read by a computer. When executed, the program can include the processes in the above-described method embodiments. The computer-readable storage medium can be a memory, a magnetic disk, an optical disk, etc.

[0075] It should be understood that the application of the present invention is not limited to the above examples. For those skilled in the art, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A static false alarm confirmation method based on fuzzy testing, characterized in that: The static false alarm confirmation method based on fuzz testing includes: Obtaining static alarm data corresponding to the target source code, and preprocessing the static alarm data to obtain a preprocessing result; Performing a correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiled code fragment according to the preprocessing result and the correlation analysis result; Performing program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and performing fuzz testing processing on the execution code fragment to obtain a fuzz testing result; Perform alarm classification processing on the fuzzy test result to obtain an alarm classification result.

2. The static false alarm confirmation method based on fuzzy testing according to claim 1 is characterized in that: The preprocessing results include static alarm data, compilation commands, structured information and target variables; The step of obtaining static alarm data corresponding to the target source code and preprocessing the static alarm data to obtain a preprocessing result specifically includes: Determine a target program, and download and configure a static analysis tool on the target program; Determining a target source code, and performing static analysis processing on the target source code using the static analysis tool to obtain the static alarm data; Generate the compilation command by using the Bear tool, and generate the structured information of the target program by using srcML; The vulnerability occurrence position corresponding to the vulnerability in the static alarm data is obtained, and the target source code is traversed according to the vulnerability occurrence position until the traversed character is non-space or non-special symbol, thereby obtaining the target variable.

3. The static false alarm confirmation method based on fuzzy testing according to claim 2 is characterized in that: The performing of correlation analysis on the preprocessing result to obtain a correlation analysis result, and constructing a minimum compiled code fragment according to the preprocessing result and the correlation analysis result, specifically includes: Determine a target function according to the structured information in the preprocessing result and the vulnerability occurrence location, and obtain multiple target parameters in the target function; Calculating the correlation between each of the target parameters and the target variable to obtain a correlation analysis result; Obtain a parameter type corresponding to each target parameter, and perform assignment processing on each target parameter according to the parameter type and the correlation analysis result to obtain a minimum compiled code fragment.

4. The static false alarm confirmation method based on fuzzy testing according to claim 3 is characterized in that: The correlation analysis results include control dependency and data dependency; The calculation of the correlation between each target parameter and the target variable to obtain a correlation analysis result further includes: Determine the basic block where the target variable is located, and mark the basic block to obtain a target basic block; Determine an entry node, and obtain multiple path constraints from the entry node to the target basic block; If the target parameter is included in the plurality of path constraints, determining that the target parameter and the target variable have the control dependency relationship; Determine variable nodes, and construct a target set according to the variable nodes and the target parameters; It is determined whether the parameters in the target set reach the target basic block, and if so, it is determined that the target parameters have the data dependency relationship with the target variables.

5. The static false alarm confirmation method based on fuzzy testing according to claim 3 is characterized in that: The obtaining of the parameter type corresponding to each target parameter and performing value assignment processing on each target parameter according to the parameter type and the correlation analysis result to obtain a minimum compiled code fragment specifically includes: Obtaining the parameter type corresponding to each target parameter in the target function; If the parameter type is a non-struct type, generating a declaration statement and an assignment statement for each target parameter, and obtaining the minimum compiled code fragment according to the declaration statement and the assignment statement; If the parameter type is a structure type, a complete assignment strategy or a simple assignment strategy is used to perform assignment processing according to the correlation analysis result to obtain a minimum compiled code fragment.

6. The static false alarm confirmation method based on fuzzy testing according to claim 2 is characterized in that: The performing program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and performing fuzz testing processing on the execution code fragment to obtain a fuzz testing result, specifically includes: Determine the preset program slicing tool, and determine the preset slicing standards and the location of the code to be sliced; Using the preset program slicing tool to perform program slicing processing on the minimum compiled code fragment according to the preset slicing standard and the position of the code to be sliced, to obtain an execution code fragment; Determine a preset fuzz testing tool and obtain the target file location corresponding to the execution code snippet; The target file location is fuzz tested by the preset fuzz testing tool to obtain a fuzz testing result.

7. The static false alarm confirmation method based on fuzzy testing according to claim 6 is characterized in that: The alarm classification results include true positive alarms and false positive alarms; The alarm classification processing is performed on the fuzzy test result to obtain the alarm classification result, specifically including: Determine whether data corruption occurs at the target file location according to the fuzzy test result; If data corruption occurs at the target file location, and the cause of the corruption is consistent with the cause of the vulnerability in the static alarm data, then the fuzzy test result is determined to be the true positive alarm; If no data corruption occurs at the target file location, the fuzzy test result is determined to be the false positive alarm.

8. A static false alarm confirmation system based on fuzzy testing, characterized in that: The static false alarm confirmation system based on fuzz testing includes: A preprocessing module, configured to obtain static alarm data corresponding to the target source code, and preprocess the static alarm data to obtain a preprocessing result; A correlation analysis module is used to perform a correlation analysis on the preprocessing result to obtain a correlation analysis result, and construct a minimum compiled code fragment according to the preprocessing result and the correlation analysis result; A fuzz testing module is used to perform program slicing processing on the minimum compiled code fragment to obtain an execution code fragment, and to perform fuzz testing on the execution code fragment to obtain a fuzz testing result; The alarm classification module is used to perform alarm classification processing on the fuzzy test result to obtain an alarm classification result.

9. A terminal, characterized in that: The terminal includes: a memory, a processor, and a static false alarm confirmation program based on fuzz testing stored in the memory and runnable on the processor. When the static false alarm confirmation program based on fuzz testing is executed by the processor, the steps of the static false alarm confirmation method based on fuzz testing as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a static false alarm confirmation program based on fuzz testing, and when the static false alarm confirmation program based on fuzz testing is executed by a processor, the steps of the static false alarm confirmation method based on fuzz testing according to any one of claims 1 to 7 are implemented.

Images