A kernel fuzz test case generation method and device based on a shuffle algorithm

Abstract

The present application belongs to the field of information technology, and proposes a kernel fuzz testing case generation method and device based on a shuffling algorithm, comprising: randomly taking a kernel test case p from a corpus, applying a shuffling algorithm mathematical model to the kernel test case p to generate a fuzz testing case; generating m fuzz testing cases to generate m fuzz testing cases, …, to form a fuzz testing case set; performing chi-square test on the generated fuzz testing case set; judging the result of the chi-square test, starting a test environment with a to-be-tested kernel and a specified file system, and inputting the fuzz testing case set into the test environment for execution. The present application can disrupt the order of system calls in the test case, generate new fuzz testing cases, increase the diversity of the fuzz testing cases, avoid high dependence on the original corpus, and has small time complexity of the mutated test case, without increasing the generation time.

Description

Technical Field

[0001] This invention belongs to the field of information technology, and specifically relates to a method and apparatus for generating kernel fuzzy test cases based on a shuffling algorithm. Background Technology

[0002] The kernel is the core component of a modern operating system, responsible for managing system resources, providing hardware abstractions, and ensuring system stability and security. Due to its complexity and high-privilege nature, vulnerabilities in the kernel often pose extremely high risks. Once exploited by attackers, the kernel can lead to serious consequences such as system crashes, data breaches, or privilege escalation. Therefore, rigorous testing of the kernel, especially fuzzing, is crucial for ensuring operating system security.

[0003] Kernel fuzzing requires multiple functions, including automatically generating random test cases, running test cases, monitoring system crashes and anomalies, and collecting and analyzing test results. It is specifically designed to detect and report software vulnerabilities and errors in the operating system kernel. Increasing the quantity and diversity of fuzz test cases generated per unit of time significantly enhances the ability of fuzzing to discover problems, which is crucial for maintaining kernel quality.

[0004] The generation of kernel fuzz test cases mainly employs various algorithms to generate corresponding test cases based on combinations of kernel system call interfaces, forming a corpus. Each test case in the corpus is a system call sequence. By randomly mutating the test cases in the corpus, multiple different fuzz test cases are generated, and these fuzz test cases are input into the test environment for testing, thereby achieving fuzz testing of the kernel and discovering potential kernel problems.

[0005] The current methods for generating fuzzy test cases have the following problems: the methods for generating test cases in the random mutation corpus are highly dependent on the corpus, which leads to a decrease in the diversity of generated test cases and a decrease in the coverage path of the kernel code when the corpus does not have the required system calls. This results in the inability to fully discover deep-seated vulnerabilities in the kernel code. Furthermore, the time complexity of multiple test case mutation methods is greater than or equal to O(len(p.Calls)), where len(p.Calls) represents the number of system calls in test case p. At the same time, since the application layer's calls to kernel interfaces cannot be completely and accurately predicted, the order of kernel system call interfaces in fuzzy test cases becomes extremely important.

[0006] The current problem that must be solved is how to ensure the diversity of fuzz test cases while generating new fuzz test cases, uncovering potential vulnerabilities, and continuously improving the fuzz test cases in the corpus. Summary of the Invention

[0007] The purpose of this invention is to provide a kernel fuzz test case generation method and apparatus based on a shuffling algorithm, which can shuffle the order of system calls in test cases to generate new fuzz test cases, increase the diversity of fuzz test cases, avoid high dependence on corpora, and reduce the time complexity of mutated test cases without increasing the fuzz test case generation time.

[0008] To achieve the above objectives, the technical solution of the present invention is as follows:

[0009] A kernel fuzz test case generation method based on a shuffling algorithm includes:

[0010] S1, Shuffling algorithm initialization;

[0011] S2: Randomly select a kernel test case p from the corpus, and apply the shuffling algorithm mathematical model to mutate the kernel test case p to generate a fuzzy test case;

[0012] S3: After m iterations of step S2, m fuzzy test cases are generated. , , ... To form a fuzzy test case set ;

[0013] S4: For the generated fuzzy test case set Perform a chi-square test;

[0014] S5: Judge the result of the chi-square test. If the fuzzy test cases are random, jump to step S6; if the fuzzy test cases are not random, jump back to step S1.

[0015] S6: Start the test environment using the kernel under test and the specified file system. Input the fuzz test case set obtained in step S3 into the test environment for execution. Each fuzz test case calls the interface of the kernel under test to perform fuzz testing on the kernel. When the test environment crashes, generate relevant logs to explain the crash information for analysis.

[0016] Furthermore, the method for generating fuzzy test cases through mutation in step S2 includes:

[0017] S21: Generate test case g by deep cloning kernel test case p;

[0018] S22: Use a shuffling algorithm to generate fuzzy test cases from the test cases g generated by deep cloning.

[0019] Furthermore, the specific process of step S21 is as follows:

[0020] S211: Create a new Prog struct object p1;

[0021] S212: Assign the value of p.Target of kernel test case p to p1.Target;

[0022] S213: Copy p.Calls of kernel test case p and assign the result to p1.Calls;

[0023] S214: Create a new Call structure pointer slice `calls` with the same length as the original Call structure pointer slice `origCalls`;

[0024] S215: Iterate through origCalls, copy each element, store the result in the corresponding position of calls, and assign calls to the Calls of the new Prog struct object p1.

[0025] S216: Copy a single Call struct and create a new Call struct object c1;

[0026] S217: Directly assign the value of the Meta field of the original Call structure object to the Meta field of c1;

[0027] S218: Check if the Ret field of the original Call structure object is nil; if not, copy Ret and convert the result to nil. The type is then assigned to the Ret field of c1;

[0028] S219: Iterate through the Args field of the original Call struct object, copy the parameter method of each Arg type, and store the copied result in the corresponding position of the new slice c1.Args;

[0029] S2110: Directly assign the value of the Props field of the original Call structure object to the Props field of c1;

[0030] S2111: Returns a pointer to the newly created Call structure object c1;

[0031] S2112: The above steps are used to complete the deep cloning of kernel test case p to obtain test case g.

[0032] Furthermore, the specific process of step S22 is as follows:

[0033] S221: Treat test case g as a set S, the system calls in test case g correspond to the elements in the set, and the number of system calls in test case g len(g.Calls) is regarded as the number of elements n in the set;

[0034] S222: From the last element of set S Beginning, for each element (i decreases from n to 2), an index is randomly generated based on a uniform distribution. Then swap the elements and The position constitutes an iterative random transformation:

[0035] ;

[0036] Where U(1,i) represents a uniformly distributed random variable on the interval [1,i]. This indicates that j follows a uniform distribution on the interval [1, i]. Let S represent the set before the i-th swap. Let S represent the set after the i-th swap. Indicates exchange Find the two elements with indices i and j, and return a new set. ;

[0037] S223: After n-1 random swaps, the order of elements in set S is completely shuffled;

[0038] S224: Adjust the order of system calls according to the shuffled order of elements in set S to generate a fuzzy test case.

[0039] Furthermore, the chi-square test method in step S4 includes:

[0040] S41: Fuzzy Test Case Set It consists of m fuzzy test cases, each of which consists of an uncertain number of system calls. The actual frequency of each adjacent system call pair in these m fuzzy test cases is counted. The counting method is as follows: when the shuffle algorithm is completed, the frequency of each pair of adjacent system calls in the generated fuzzy test cases is counted, and the frequency data of adjacent system call pairs is stored quickly using a hash table.

[0041] S42: After completing m statistical analyses, calculate the chi-square statistic; chi-square statistic k represents the number of adjacent system call pairs; first, calculate the theoretical frequency. , Combined with the actual frequency of each adjacent system call pair Calculate the contribution value of each adjacent system call. Then, sum up the contributions of all adjacent system calls to obtain the chi-square statistic; look up the chi-square distribution table to obtain the critical value. , The significance level is represented by k, and k-1 represents the degree of freedom. The chi-square statistic and the critical value are compared.

[0042] Furthermore, step S5 involves judging the results of the chi-square test, including:

[0043] S51: If If the fuzzy test case set is considered to follow a uniform distribution, and the fuzzy test cases are considered to have randomness, then the test case set will be... Input the kernel into the test environment and proceed to step S6;

[0044] S52: If If the fuzz test cases are not random, then the process proceeds to step S1.

[0045] Furthermore, in step S52, if the fuzzy test case set... If the actual frequency of adjacent system call pairs is significantly higher than the theoretical frequency, then the test cases generated by the current shuffle algorithm are overly biased towards specific combinations. When jumping to step S1 to perform the next m rounds of shuffling, the high-frequency system call pairs in the hash table storing the frequency data of adjacent system call pairs are given a lower mutation priority, forcing the shuffle algorithm to explore the low-frequency region and increasing the randomness of the test cases after mutation.

[0046] In another aspect, this invention proposes a kernel fuzz test case generation device based on a shuffling algorithm, comprising:

[0047] Initialization module: Shuffling algorithm initialization;

[0048] Shuffling module: Randomly select a kernel test case p from the corpus, and apply the shuffling algorithm mathematical model to mutate the kernel test case p to generate a fuzzy test case;

[0049] Test Case Set Module: Generates m fuzzy test cases after m steps S2. , , ... To form a fuzzy test case set ;

[0050] Chi-square test module: for the generated fuzzy test case set Perform a chi-square test;

[0051] Judgment Module: Judges the results of the chi-square test. If the fuzzy test cases are random, it jumps to the test module; if the fuzzy test cases are not random, it jumps back to the initialization module.

[0052] Test Module: Start the test environment with the kernel under test and the specified file system. Input the fuzz test case set obtained from the test case set module into the test environment for execution. Each fuzz test case calls the interface of the kernel under test to perform fuzz testing on the kernel. When the test environment crashes, generate relevant logs to explain the crash information for analysis.

[0053] In another aspect, the present invention also proposes a computer-readable storage medium storing a computer program for executing the above-described kernel fuzz test case generation method based on the shuffle algorithm.

[0054] In another aspect, the present invention also proposes a computer program product, including a computer program that, when executed by a processor, implements the above-described kernel fuzz test case generation method based on the shuffle algorithm.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1. This invention introduces a shuffling algorithm and applies it to the mutation of test cases in fuzzing testing. This can efficiently generate new test cases. The original mutation algorithm requires multiple mutations to obtain test cases, while the shuffling algorithm only requires one mutation, reducing mutation time, improving the efficiency of fuzzing test case generation, increasing the diversity of fuzzing test cases generated per unit time, and improving the efficiency and ability of fuzzing testing to discover problems.

[0057] 2. This invention introduces a chi-square test to verify whether the test cases obtained by the shuffling algorithm are completely random. The newly generated test cases are merged into a test case set, and the chi-square test is performed on the set. Only test cases that pass the test will be input into the test environment for testing, thus ensuring the randomness of the system call order and ensuring the diversity of test cases.

[0058] 3. By combining fuzz testing, shuffling algorithms, and chi-square tests, this invention can efficiently generate new test cases and ensure the correctness and randomness of the shuffling algorithm, thereby improving the diversity of fuzz test cases, accelerating the generation of fuzz test cases, discovering more potential kernel defects, and improving the reliability and security of the kernel. Attached Figure Description

[0059] Figure 1 This is a flowchart illustrating Embodiment 1 of the present invention.

[0060] Figure 2 This is a schematic diagram of the shuffling algorithm and chi-square test for generating fuzzy test cases in Embodiment 2 of the present invention.

[0061] Figure 3This is a comparison diagram of the technical solutions in Embodiment 3 of the present invention. Detailed Implementation

[0062] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0063] First, the abbreviations and key terms used in the embodiments will be explained.

[0064] Fuzzing: Fuzzing discovers potential vulnerabilities by providing unexpected, random, or anomalous inputs to a target system and monitoring the system's response. The basic idea is to use a large amount of random data to input into an application, observe and record the program's behavior after receiving this input, thereby discovering potential vulnerabilities such as memory leaks, null pointer dereferences, deadlocks, and other anomalies or crashes.

[0065] The corpus ctx.corpus is used to store and manage test cases generated during the fuzzing process. These fuzzing test cases consist of a series of kernel system calls used to fuzz the kernel to discover potential vulnerabilities and bugs.

[0066] Shuffling algorithm: The name of the shuffling algorithm.

[0067] len(g.Calls): The number of system calls in fuzzy test case g.

[0068] g.Calls[i]: The i-th system call in fuzzy test case g.

[0069] Time complexity: An important metric for measuring the efficiency of an algorithm, it describes the trend of the algorithm's running time increasing as the input size grows.

[0070] O(x): a symbol for time complexity, where x is a variable.

[0071] newargs: is a map whose keys and values ​​are pointers to type ResultArg.

[0072] ResultArg: A parameter type used to describe the return value of a system call.

[0073] Chi-square test: Used to test whether system calls in test cases are completely random.

[0074] The present invention will now be described in detail with reference to specific embodiments and accompanying drawings.

[0075] Example 1:

[0076] like Figure 1As shown in Example 1, the kernel fuzz test case generation method based on the shuffling algorithm proposed in this embodiment includes:

[0077] S1, Shuffling algorithm initialization;

[0078] In this step, the counter count is initialized to 0. count is used to record the number of fuzzy test cases generated by mutation. In this embodiment, the kernel fuzzy test requires m fuzzy test cases, where m can be 100. When the counter count is 100, a fuzzy test case set is formed for chi-square test.

[0079] S2: Randomly select a kernel test case p from the corpus, and apply the shuffling algorithm mathematical model to mutate the kernel test case p to generate a fuzzy test case;

[0080] In this embodiment, each test case in the corpus ctx.corpus is a system call sequence, which is a corresponding test case generated based on the combination of kernel system call interfaces. A test case p is randomly selected from the corpus ctx.corpus and used to generate a fuzzy test case through mutation.

[0081] The method for generating a fuzz test case through mutation is as follows:

[0082] S21: First, after deep cloning test case p, test case g is generated. The specific process is as follows:

[0083] S211: Create a new Prog struct object p1;

[0084] S212: Assign the value of p.Target to p1.Target;

[0085] S213: Call cloneCalls(p.Calls,newargs) to copy p.Calls and assign the result to p1.Calls;

[0086] S214: Create a new Call structure pointer slice `calls` with the same length as the original Call structure pointer slice `origCalls`;

[0087] S215: Traverse the original Call structure pointer slice origCalls, call cloneCall(c,newargs) for each element c to copy it, and store the result in the corresponding position of the new Call structure pointer slice calls, and assign calls to the new Prog's Calls;

[0088] S216: cloneCall copies a single Call struct and creates a new Call struct object c1;

[0089] S217: Directly assign the value of the Meta field of the original Call structure object c to the Meta field of c1;

[0090] S218: Check if the Ret field of the original Call struct object c is nil. If it is not nil, call the clone method to copy c.Ret and convert the result to nil. The type is then assigned to the Ret field of c1. The clone method's copy operation is as follows: a new Arg type slice c1.Args is created, with a length identical to the Args field of the original Call struct object c;

[0091] S219: Iterate through the Args field of the original Call structure object c. For each Arg type parameter, call the clone method to copy it and store the copied result in the corresponding position of the new slice c1.Args.

[0092] S2110: Directly assign the value of the Props field of the original Call structure object c to the Props field of c1;

[0093] S2111: Returns a pointer to the newly created Call structure object c1;

[0094] S2112: The above steps are used to complete the deep cloning of test case p to obtain test case g. The purpose of deep cloning is to avoid the subsequent shuffling algorithm mutation of test cases from affecting the original test cases in the corpus.

[0095] S22: Next, the test cases g generated by deep cloning are shuffled using a shuffling algorithm to generate fuzzy test cases. The specific process is as follows:

[0096] S221: Treat test case g as a set S, the system calls in the test case correspond to the elements in the set, and the number of system calls in test case g len(g.Calls) is regarded as the number of elements in the set n;

[0097] S222: From the last element of set S Beginning, for each element (i decreases from n to 2), use the time.Now().UnixNano() function to get the number of nanoseconds of the current time as the random number seed, use the rand.Seed function to initialize the random number generator in the standard library, and use the rand.Intn(i+1) function to convert the random time seed into a random integer j in the range of 1 to i; Then swap the elements and The position, this process can be formally described as an iterative random transformation:

[0098] ;

[0099] S223: The step of swapping the elements of g.Calls[i] and g.Calls[j] is implemented using the multiple assignment syntax g.Calls[i], g.Calls[j] = g.Calls[j], g.Calls[i]. After n-1 random swap operations, the order of the elements in set S is completely shuffled. According to the principle of equal probability in probability theory, the probability of each element being in any position in the final arrangement is equal to 1 / 2. This ensures that the generated test data has a uniform distribution across all possible permutations, greatly improving the randomness and diversity of test cases.

[0100] S224: Adjust the order of the corresponding system calls according to the order of the elements in the shuffled set S, and use the resulting test cases as fuzzy test cases. The test case counter count = count + 1.

[0101] S3: After m iterations of step S2, m fuzzy test cases are generated. , , ... To form a fuzzy test case set ;

[0102] After m steps S2, i.e. when count equals m, the generated m fuzzy test cases form a fuzzy test case set.

[0103] S4: For the generated fuzzy test case set Perform a chi-square test;

[0104] S5: Judge the result of the chi-square test. If the fuzzy test cases are random, jump to step S6; if the fuzzy test cases are not random, jump back to step S1.

[0105] S6: Start the test environment using the kernel under test and the specified file system. Input the fuzz test case set obtained in step S3 into the test environment for execution. Each fuzz test case calls the interface of the kernel under test to perform fuzz testing on the kernel. When the test environment crashes, generate relevant logs to explain the crash information for analysis.

[0106] In this embodiment, a shuffling algorithm is introduced and applied to the mutation of test cases in fuzzing testing. This can efficiently generate new test cases. The original mutation algorithm requires multiple mutations to obtain test cases, while the shuffling algorithm only requires one mutation, reducing the mutation time, improving the efficiency of fuzzing test case generation, increasing the diversity of fuzzing test cases generated per unit time, and improving the efficiency and ability of fuzzing testing to discover problems.

[0107] Example 2:

[0108] This embodiment is a further optimization based on the method described in Embodiment 1, and provides a detailed explanation of the chi-square test method.

[0109] The kernel fuzz test case generation method based on the shuffling algorithm in this embodiment includes the following:

[0110] S1, Shuffling algorithm initialization;

[0111] S2: Randomly select a kernel test case p from the corpus, and apply the shuffling algorithm mathematical model to mutate the kernel test case p to generate a fuzzy test case;

[0112] S3: After m iterations of step S2, m fuzzy test cases are generated. , , ... To form a fuzzy test case set ;

[0113] The specific methods and steps included in steps S1-S3 above are the same as those in Example 1. Please refer to the specific steps in Example 1, which will not be repeated here.

[0114] S4: For the generated fuzzy test case set Perform a chi-square test;

[0115] S41: Test Case Set It consists of m fuzzy test cases, each of which consists of an uncertain number of system calls. The actual frequency of each adjacent system call pair in these m fuzzy test cases is counted. The counting method is as follows: when the shuffle algorithm is completed in each step S224, the frequency of each pair of adjacent system calls in the generated fuzzy test cases is counted. The frequency data of adjacent system call pairs is stored quickly using a hash table. The key value of the hash table stores the two system calls, and the value value stores the frequency of the two adjacent system calls. After completing m counts, the chi-square statistic is calculated.

[0116] S42: Chi-square statistic k represents the number of adjacent system call pairs; first, calculate the theoretical frequency. , Combined with the actual frequency of each adjacent system call pair That is, the value in the hash table, calculating the contribution of each adjacent system call. Then, sum the contributions of all adjacent system calls to obtain the chi-square statistic. Where: if the test case set... There are a total of e system calls, then the number of possible adjacent system call pairs r is: The total number of adjacent system call pairs o is the number of keys in the hash table (the number of keys can be found in the hash table mentioned above), which is actually the number of adjacent system call pairs k;

[0117] After obtaining the chi-square statistic, calculate the critical value and significance level. This is a probability value pre-set during hypothesis testing; in this case, we take... =0.05; Determine the value of the degrees of freedom. Since the number of keys in the hash table storing adjacent system call pairs is k, the degrees of freedom df can be determined; based on the significance level... The critical value is obtained by looking up the chi-square distribution table of the degrees of freedom df. .

[0118] S5: Judge the result of the chi-square test. If the fuzzy test cases are random, jump to step S6; if the fuzzy test cases are not random, jump back to step S1.

[0119] The specific methods for this step include:

[0120] S51: If If the null hypothesis is accepted, then the fuzzy test case set is considered to follow a uniform distribution, indicating that the generated fuzzy test cases are random. Input the kernel into the test environment and proceed to step S6;

[0121] S52: If If so, then the fuzzy test cases are considered not to have randomness, and the test case set is considered to be... If the actual frequency of adjacent system call pairs is significantly higher than the theoretical frequency, it indicates that the test cases generated by the current shuffle algorithm may be overly biased towards specific combinations. In the next m-th shuffle, the adjacent system call pairs of high-frequency combinations in the hash table are given a lower mutation priority, forcing the shuffle algorithm to explore low-frequency areas. This can effectively increase the randomness of the test cases after mutation. Then, jump to step S1.

[0122] S6: Start the test environment using the kernel under test and the specified file system. Input the fuzz test case set obtained in step S3 into the test environment for execution. Each fuzz test case calls the interface of the kernel under test to perform fuzz testing on the kernel. When the test environment crashes, generate relevant logs to explain the crash information for analysis.

[0123] The complete process of this embodiment is as follows: Figure 2 As shown, based on Example 1, the chi-square test is introduced to verify whether the test cases obtained by the shuffling algorithm are completely random. The newly generated test cases are merged into a test case set, and the chi-square test is performed on the set. Only test cases that pass the test will be input into the test environment for testing, thus ensuring the randomness of the system call order and ensuring the diversity of test cases.

[0124] Example 3:

[0125] This embodiment demonstrates the technical effects of the method described in Embodiment 2 in practical application.

[0126] like Figure 3 As shown in the figure, the comparison results of kernel fuzzing before optimization (existing solution) and after optimization (solution described in Example 2) are presented, including the comparison of running time, types of problems found, number of problems found, number of test cases generated, and total number of system calls executed.

[0127] The comparison shows that, with the same number of crashes exceeding 9,000, the optimized solution can be used 4 days less. After 11 days of joint testing with the unoptimized solution, the optimized solution generated 40,000+ more test cases, found 7,000+ more issues (a 76% improvement), identified nearly 40 more types of issues (a 55% improvement), and executed 4 million more system calls.

[0128] The above comparison illustrates that by combining fuzz testing, shuffling algorithms, and chi-square tests, new test cases can be generated efficiently, while ensuring the correctness and randomness of the shuffling algorithm. This improves the diversity of fuzz test cases, accelerates fuzz test case generation, discovers more potential kernel defects, and enhances the reliability and security of the kernel.

[0129] Example 4:

[0130] This embodiment proposes a kernel fuzzy test case generation device based on a shuffling algorithm, including:

[0131] Initialization module: Shuffling algorithm initialization;

[0132] Shuffling module: Randomly select a kernel test case p from the corpus, and apply the shuffling algorithm mathematical model to mutate the kernel test case p to generate a fuzzy test case;

[0133] Test Case Set Module: Generates m fuzzy test cases after m steps S2. , , ... To form a fuzzy test case set ;

[0134] Chi-square test module: for the generated fuzzy test case set Perform a chi-square test;

[0135] Judgment Module: Judges the results of the chi-square test. If the fuzzy test cases are random, it jumps to the test module; if the fuzzy test cases are not random, it jumps back to the initialization module.

[0136] Test Module: Start the test environment with the kernel under test and the specified file system. Input the fuzz test case set obtained from the test case set module into the test environment for execution. Each fuzz test case calls the interface of the kernel under test to perform fuzz testing on the kernel. When the test environment crashes, generate relevant logs to explain the crash information for analysis.

[0137] The shuffling module includes:

[0138] Deep clone unit: Generates test case g by deep cloning kernel test case p;

[0139] Shuffling Unit: The test cases g generated by deep cloning are shuffled using a shuffling algorithm to generate fuzzy test cases.

[0140] Deep cloning units include:

[0141] Create a new Prog struct object p1;

[0142] Assign the value of p.Target of kernel test case p to p1.Target;

[0143] Copy p.Calls of kernel test case p and assign the result to p1.Calls;

[0144] Create a new Call structure pointer slice `calls` with the same length as the original Call structure pointer slice `origCalls`;

[0145] Iterate through origCalls, copy each element, store the result in the corresponding position of calls, and assign calls to the Calls of the new Prog struct object p1.

[0146] Copy a single Call struct and create a new Call struct object c1.

[0147] The value of the Meta field of the original Call structure object is directly assigned to the Meta field of c1;

[0148] Check if the Ret field of the original Call structure object is nil; if not, copy Ret and convert the result to nil. The type is then assigned to the Ret field of c1;

[0149] Iterate through the Args field of the original Call struct object, copy the parameter method of each Arg type, and store the copied result in the corresponding position of the new slice c1.Args;

[0150] The value of the Props field of the original Call structure object is directly assigned to the Props field of c1;

[0151] Returns a pointer to the newly created Call structure object c1;

[0152] The above steps are used to perform a deep clone of kernel test case p to obtain test case g.

[0153] The shuffling unit includes:

[0154] Treat test case g as a set S, system calls in test case g correspond to elements in the set, and the number of system calls in test case g len(g.Calls) is regarded as the number of elements n in the set;

[0155] From the last element of set S Beginning, for each element (i decreases from n to 2), an index is randomly generated based on a uniform distribution. Then swap the elements and The position constitutes an iterative random transformation:

[0156] ;

[0157] Where U(1,i) represents a uniformly distributed random variable on the interval [1,i]. This indicates that j follows a uniform distribution on the interval [1, i]. Let S represent the set before the i-th swap. Let S represent the set after the i-th swap. Indicates exchange Find the two elements with indices i and j, and return a new set. ;

[0158] After n-1 random swaps, the order of elements in set S is completely shuffled.

[0159] Adjust the order of system calls according to the shuffled order of elements in set S, and generate a fuzz test case.

[0160] The chi-square test module includes:

[0161] Fuzzy test case set It consists of m fuzzy test cases, each of which consists of an uncertain number of system calls. The actual frequency of each adjacent system call pair in these m fuzzy test cases is counted. The counting method is as follows: when the shuffle algorithm is completed, the frequency of each pair of adjacent system calls in the generated fuzzy test cases is counted, and the frequency data of adjacent system call pairs is stored quickly using a hash table.

[0162] After completing m statistical analyses, calculate the chi-square statistic; chi-square statistic k represents the number of adjacent system call pairs; first, calculate the theoretical frequency. , Combined with the actual frequency of each adjacent system call pair Calculate the contribution value of each adjacent system call. Then, sum up the contributions of all adjacent system calls to obtain the chi-square statistic; look up the chi-square distribution table to obtain the critical value. , The significance level is represented by k, and k-1 represents the degree of freedom. The chi-square statistic and the critical value are compared.

[0163] The judgment module includes:

[0164] like If the fuzzy test case set is considered to follow a uniform distribution, and the fuzzy test cases are considered to have randomness, then the test case set will be... Input the data into the test environment for kernel testing, then jump to the test module;

[0165] like If the fuzz test cases are not random, then the test will jump to the initialization module.

[0166] If the fuzz test case set If the actual frequency of adjacent system call pairs is significantly higher than the theoretical frequency, then the test cases generated by the current shuffle algorithm are overly biased towards specific combinations. When jumping to step S1 to perform the next m rounds of shuffling, the high-frequency system call pairs in the hash table storing the frequency data of adjacent system call pairs are given a lower mutation priority, forcing the shuffle algorithm to explore the low-frequency region and increasing the randomness of the test cases after mutation.

[0167] The kernel fuzzy test case generation device based on the shuffle algorithm proposed in this embodiment can realize the kernel fuzzy test case generation method based on the shuffle algorithm proposed in either embodiment 1 or 2, and has the same technical effect as embodiment 1 or 2.

[0168] The above-described embodiments are merely preferred embodiments of the present invention and are only used to help understand the method and core ideas of this application. The scope of protection of the present invention is not limited to the above embodiments, and all technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A kernel fuzz test case generation method based on a shuffling algorithm, characterized in that, include: S1, Shuffling algorithm initialization; S2: Randomly select a kernel test case p from the corpus, and apply the shuffling algorithm mathematical model to mutate the kernel test case p to generate a fuzzy test case; S3: After m iterations of step S2, m fuzzy test cases are generated. , , ... To form a fuzzy test case set ; S4: For the generated fuzzy test case set Perform a chi-square test; S5: Judge the result of the chi-square test. If the fuzzy test cases are random, jump to step S6; if the fuzzy test cases are not random, jump back to step S1. S6: Start the test environment using the kernel under test and the specified file system. Input the fuzz test case set obtained in step S3 into the test environment for execution. Each fuzz test case calls the interface of the kernel under test to perform fuzz testing on the kernel. When the test environment crashes, generate relevant logs to explain the crash information for analysis. The methods for generating fuzzy test cases through mutation in step S2 include: S21: Generate test case g by deep cloning kernel test case p; S22: Use a shuffling algorithm to generate fuzzy test cases from the test cases g generated by deep cloning; The specific process of step S22 is as follows: S221: Treat test case g as a set S, the system calls in test case g correspond to the elements in the set, and the number of system calls in test case g len(g.Calls) is regarded as the number of elements n in the set; S222: From the last element of set S Beginning, for each element i decreases from n to 2, and an index is randomly generated based on a uniform distribution. Then swap the elements and The position constitutes an iterative random transformation: ； Where U(1,i) represents a uniformly distributed random variable on the interval [1,i]. This indicates that j follows a uniform distribution on the interval [1, i]. Let S represent the set before the i-th swap. Let S represent the set after the i-th swap. Indicates exchange Find the two elements with indices i and j, and return a new set. ; S223: After n-1 random swaps, the order of elements in set S is completely shuffled; S224: Adjust the order of system calls according to the shuffled order of elements in set S to generate a fuzzy test case.

2. The kernel fuzz test case generation method based on the shuffling algorithm according to claim 1, characterized in that, The specific process of step S21 is as follows: S211: Create a new Prog struct object p1; S212: Assign the value of p.Target of kernel test case p to p1.Target; S213: Copy p.Calls of kernel test case p and assign the result to p1.Calls; S214: Create a new Call structure pointer slice `calls` with the same length as the original Call structure pointer slice `origCalls`; S215: Iterate through origCalls, copy each element, store the result in the corresponding position of calls, and assign calls to the Calls of the new Prog struct object p1. S216: Copy a single Call struct and create a new Call struct object c1; S217: Directly assign the value of the Meta field of the original Call structure object to the Meta field of c1; S218: Check if the Ret field of the original Call structure object is nil; if not, copy Ret and convert the result to nil. The type is then assigned to the Ret field of c1; S219: Iterate through the Args field of the original Call struct object, copy the parameter method of each Arg type, and store the copied result in the corresponding position of the new slice c1.Args; S2110: Directly assign the value of the Props field of the original Call structure object to the Props field of c1; S2111: Returns a pointer to the newly created Call structure object c1; S2112: The above steps are used to complete the deep cloning of kernel test case p to obtain test case g.

3. The kernel fuzz test case generation method based on the shuffling algorithm according to claim 1, characterized in that, The chi-square test method in step S4 includes: S41: Fuzzy Test Case Set It consists of m fuzzy test cases, each of which consists of an uncertain number of system calls. The actual frequency of each adjacent system call pair in these m fuzzy test cases is counted. The counting method is as follows: when the shuffle algorithm is completed, the frequency of each pair of adjacent system calls in the generated fuzzy test cases is counted, and the frequency data of adjacent system call pairs is stored quickly using a hash table. S42: After completing m statistical analyses, calculate the chi-square statistic; chi-square statistic k represents the number of adjacent system call pairs; first, calculate the theoretical frequency. , Combined with the actual frequency of each adjacent system call pair Calculate the contribution value of each adjacent system call. Then, sum up the contributions of all adjacent system calls to obtain the chi-square statistic; look up the chi-square distribution table to obtain the critical value. , The significance level is represented by k, and k-1 represents the degree of freedom. The chi-square statistic and the critical value are compared.

4. The kernel fuzz test case generation method based on the shuffling algorithm according to claim 1, characterized in that, Step S5 involves judging the results of the chi-square test, including: S51: If If the fuzzy test case set is considered to follow a uniform distribution, and the fuzzy test cases are considered to have randomness, then the test case set will be... Input the kernel into the test environment and proceed to step S6; S52: If If the fuzz test cases are not random, then the process proceeds to step S1.

5. The kernel fuzz test case generation method based on the shuffling algorithm according to claim 4, characterized in that, In step S52, if the fuzz test case set If the actual frequency of adjacent system call pairs is significantly higher than the theoretical frequency, then the test cases generated by the current shuffle algorithm are overly biased towards specific combinations. When jumping to step S1 to perform the next m rounds of shuffling, the high-frequency system call pairs in the hash table storing the frequency data of adjacent system call pairs are given a lower mutation priority, forcing the shuffle algorithm to explore the low-frequency region and increasing the randomness of the test cases after mutation.

6. A kernel fuzzy test case generation device based on a shuffling algorithm, characterized in that, include: Initialization module: Shuffling algorithm initialization; Shuffling module: Randomly select a kernel test case p from the corpus, and apply the shuffling algorithm mathematical model to mutate the kernel test case p to generate a fuzzy test case; Test Case Set Module: Generates m fuzzy test cases after m steps S2. , , ... To form a fuzzy test case set ; Chi-square test module: for the generated fuzzy test case set Perform a chi-square test; Judgment Module: Judges the results of the chi-square test. If the fuzzy test cases are random, it jumps to the test module. If the fuzz test cases are not random, then jump back to the initialization module; Test module: Start the test environment with the kernel under test and the specified file system, input the fuzz test case set obtained by the test case set module into the test environment for execution, and call the interface of the kernel under test to perform fuzz testing on the kernel. When the test environment crashes, generate relevant logs to explain the crash information for analysis. The shuffling module includes: Deep clone unit: Generates test case g by deep cloning kernel test case p; Shuffling Unit: The test cases g generated by deep cloning are shuffled using a shuffling algorithm to generate fuzzy test cases; The shuffling unit includes: treating test case g as a set S, system calls in test case g as elements in the set, and the number of system calls in test case g len(g.Calls) as the number of elements n in the set; From the last element of set S Beginning, for each element i decreases from n to 2, and an index is randomly generated based on a uniform distribution. Then swap the elements and The position constitutes an iterative random transformation: ； Where U(1,i) represents a uniformly distributed random variable on the interval [1,i]. This indicates that j follows a uniform distribution on the interval [1, i]. Let S represent the set before the i-th swap. Let S represent the set after the i-th swap. Indicates exchange Find the two elements with indices i and j, and return a new set. ; After n-1 random swaps, the order of elements in set S is completely shuffled. Adjust the order of system calls according to the shuffled order of elements in set S, and generate a fuzz test case.

7. A computer-readable storage medium storing a computer program, characterized in that, The computer program is used to execute the kernel fuzz test case generation method based on the shuffle algorithm as described in any one of claims 1-5.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the kernel fuzz test case generation method based on the shuffling algorithm as described in any one of claims 1-5.

Images