An operating system kernel-oriented fuzz testing method based on LLM assisted system call inference

Abstract

The application discloses a kind of operating system kernel directed fuzz testing methods based on LLM auxiliary system call inference, belong to network security technical field.The method includes: triggering condition analysis submodule is based on the analysis result of first input triggering LLM generation call chain;System call sequence inference submodule is based on the sequence of second input triggering LLM generation call target system call and the variant of system call;System call dependency inference submodule is based on the third input triggering LLM generation system call dependency, for each system call pair Construction template;Directed fuzz testing module uses fuzzer to generate several seeds;Based on seed, multiple rounds of test cases for testing operating system kernel are constructed.The application can accelerate the efficiency of kernel directed fuzz testing, to promote the vulnerability reproduction process.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an operating system kernel targeted fuzzing method based on LLM assisted system call inference. BACKGROUND

[0002] In recent years, with the continuous growth of the complexity of the operating system kernel, the number of vulnerability reports and patch submissions in the Linux kernel has increased sharply, and there is an urgent need for efficient and reliable kernel-level vulnerability reproduction and patch verification mechanisms. Fuzzing is an automated vulnerability detection technology that has discovered thousands of security defects in the Linux kernel, significantly promoting the development of vulnerability detection capabilities. However, to achieve rapid reproduction of discovered vulnerabilities, especially targeted testing for specific code paths or patch points, there are still serious challenges. Targeted fuzzing is a promising approach that generates test cases that can reach or trigger a given target location, achieving testing for a specific target location.

[0003] For the kernel, the test case is a sequence of system calls. However, generating test cases for the kernel faces many challenges. First, the system calls that make up the kernel test case do not exist independently, but have sequential dependencies. The execution of some system calls may depend on the state or results of previous system calls, which increases the complexity of test case generation. Second, the combination space of system calls and their parameters is extremely large. For example, the Linux kernel defines more than 300 system calls, while Syzkaller, a mainstream kernel fuzzing framework, describes nearly 4500 system call variants. Such a large combination space makes it extremely challenging to generate test cases that can trigger a specific target.

[0004] The existing technology of kernel targeted fuzzing has a serious false positive and false negative problem in the inference of target-related system calls due to the limitations of static analysis, making it difficult to generate test cases that trigger target vulnerabilities during fuzzing. SUMMARY

[0005] The present application proposes an operating system kernel targeted fuzzing method based on LLM assisted system call inference, which solves the problem of difficulty in inferring target-related system calls in existing kernel targeted fuzzing method research, synthesizes templates based on inferred system calls to generate effective test cases, and improves the efficiency of fuzzing.

[0006] The first aspect of the present application proposes an operating system kernel targeted fuzzing method based on LLM assisted system call inference, which comprises:

[0007] Step S1: extracting target information from the operating system kernel source code using static analysis;

[0008] The target information includes a target position, a function code where the target is located, a target line, a function name where the target is located, and a call trace record, which refers to a function call trace record at the time of kernel crash.

[0009] Step S2: constructing a system call inference module based on LLM, including a trigger condition analysis submodule, a system call sequence inference submodule, and a system call dependency inference submodule;

[0010] Step S3: calling the trigger condition analysis submodule, triggering the LLM to generate an analysis result of a call chain composed of operating system kernel objects that directly or indirectly call the target based on the first input of the user;

[0011] The first input is generated based on a first prompt word related to the target information.

[0012] Step S4: constructing a knowledge base about system calls; calling the system call sequence inference submodule, triggering the LLM to generate a sequence composed of system calls that call the target and variants of the system calls based on the second input of the user;

[0013] The second input is generated based on a second prompt word, which includes a context related to the analysis result of the call chain, a second example, and the analysis result of the call chain, which are queried from the knowledge base by a first retriever, and the second example is a first sentence pattern that triggers the LLM.

[0014] Step S5: calling the system call dependency inference submodule, triggering the LLM to generate system call dependencies based on the third input generated by the user according to a third prompt word, constructing system call pairs, and constructing templates for each system call pair;

[0015] Each system call pair includes a system call dependency and an item in a sequence, and the third prompt word includes a context related to the sequence, a third example, and the sequence, which are queried from the knowledge base by a second retriever, and the third example includes a second sentence pattern that triggers the LLM.

[0016] Step S6: calling the directed fuzzing test module, generating a number of seeds using a fuzzer, and constructing test cases for testing the operating system kernel based on the seeds;

[0017] The seeds are generated by randomly selecting a number of template combinations.

[0018] Preferably, the first prompt word includes the target information, multi-step instructions for analyzing the target, and a first example, and the first example includes a multi-step instruction example and a call chain analysis result example.

[0019] Preferably, step S4 specifically comprises:

[0020] Building a knowledge base about system calls;

[0021] The first retriever in the system call sequence inference sub-module queries the knowledge base based on the analysis result of the call chain and the second example to build a query formula and obtains the context related to the query formula;

[0022] Generating a second input based on the second prompt word;

[0023] The second prompt word includes the context related to the analysis result of the call chain, the second example, and the analysis result of the call chain.

[0024] The system call sequence inference sub-module triggers the LLM to generate a sequence composed of the system call of the call target and the variants of the system call based on the second input of the user.

[0025] Preferably, in step S6, the seed is generated by randomly selecting a plurality of template combinations, wherein:

[0026] The template has a weight, and the weight is determined according to the frequency of occurrence of the system call pair corresponding to the template; the frequency of occurrence of the system call pair refers to the number of times the system call pair is constructed and occurs;

[0027] When randomly selecting a template, the higher the weight of the template, the greater the probability of being selected.

[0028] Preferably, in step S6, the test case for testing the content of the operating system is constructed based on the seed, and further comprises:

[0029] Step S611: When the expected test result is not obtained, step S612 is performed; otherwise, the method ends;

[0030] Step S612: constructing a test case based on the seed variation, executing the test case to obtain the test result of the operating system kernel; determining the distance of each test result from the basic block where the target is located according to the test result corresponding to each seed; updating the weight of each template corresponding to each seed based on the distance; storing the seed with the smallest distance in the seed library, selecting a seed from the seed library, and generating a new seed according to the selected seed variation; entering step S611;

[0031] The smaller the distance of the seed, the greater the weight of each template corresponding to the seed.

[0032] Preferably, in step S6, the test case for testing the content of the operating system is constructed based on the seed, and further comprises:

[0033] Step S621: When the expected test result is not obtained, step S622 is performed; otherwise, the method ends;

[0034] Step S622: calculate the seed distance between each seed and the basic block where the target is located, store the seed with the minimum seed distance to the seed library, and increase the weight of the template corresponding to each seed in the seed library;

[0035] Wherein, the seed distance is the minimum value of the distance between each basic block covered in the execution path of the test case corresponding to the seed and the basic block where the target is located;

[0036] Wherein, the distance between the basic block and the basic block where the target is located is determined in the following manner:

[0037] Compiling and inserting the operating system kernel source code to generate a kernel image file used for booting, determining the program control flow graph corresponding to the operating system kernel source code, and calculating the distance between the basic block and the basic block where the target is located based on the kernel image file and the program control flow graph;

[0038] Step S623: determine the first template set composed of all templates corresponding to all seeds, calculate the template distance corresponding to each template in the first template set, and calculate the average value of the seed distance, and adjust the weight of the template according to the template distance corresponding to each template;

[0039] Wherein, the template distance is the seed with the minimum seed distance selected from all seeds corresponding to the template; the average value of the seed distance is equal to the sum of the seed distances of the selected k seeds divided by k; the smaller the template distance, the greater the weight of the template;

[0040] Step S624: select a seed from the seed library, generate a new seed according to the selected seed variation; construct a test case based on the seed, and execute the test case to obtain the test result of the operating system kernel.

[0041] Preferably, the second retriever in the system call dependency inference submodule constructs a query formula query the knowledge base based on the sequence and the second example and obtains the context related to the sequence.

[0042] The second aspect of the present application proposes an operating system kernel directed fuzz testing device based on LLM assisted system call inference, the device comprises:

[0043] An initialization module configured to extract target information from operating system kernel source code using static analysis;

[0044] Wherein, the target information includes target position, function code where the target is located, target line, function name where the target is located, and call tracking record, the call tracking record refers to the function call tracking record when the kernel crashes;

[0045] A model construction module configured to construct an LLM-based system call inference module, including a trigger condition analysis submodule, a system call sequence inference submodule, and a system call dependency inference submodule;

[0046] A first analysis module configured to invoke the trigger condition analysis submodule to trigger the LLM to generate an analysis result of a call chain composed of direct or indirect call targets of operating system kernel objects based on a first input of a user;

[0047] The first input is generated based on a first prompt word related to target information;

[0048] A second analysis module configured to construct a knowledge base about system calls; invoke the system call sequence inference submodule to trigger the LLM to generate a sequence composed of system calls of call targets and variants of the system calls based on a second input of a user;

[0049] The second input is generated based on a second prompt word, and the second prompt word includes context related to the analysis result of the call chain, a second example, and the analysis result of the call chain, which are obtained by a first retriever from the knowledge base, and the second example is a first sentence pattern for triggering the LLM;

[0050] A third analysis module configured to invoke the system call dependency inference submodule to trigger the LLM to generate system call dependencies based on a third input of a user generated according to a third prompt word, construct system call pairs, and construct templates for each system call pair;

[0051] Each system call pair includes a system call dependency and an item in a sequence, and the third prompt word includes context related to the sequence, a third example, and the sequence, which are obtained by a second retriever from the knowledge base, and the third example includes a second sentence pattern for triggering the LLM;

[0052] A test case generation module configured to invoke a directed fuzzing module to generate a plurality of seeds using a fuzzer and construct test cases for testing an operating system kernel based on the seeds;

[0053] The seeds are generated by randomly selecting a plurality of template combinations.

[0054] A third aspect of the present application provides an electronic device, which comprises:

[0055] at least one processor; and

[0056] a memory in communication connection with the at least one processor; wherein

[0057] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0058] The fourth aspect of the present application provides a non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method as described above.

[0059] The present application prompts engineering (Prompt Engineering) to guide the large language model to understand the target code context and infer the system call related thereto. Further, combined with the static analysis of the control flow and data constraints in the target position source code, the retrieval-augmented generation (RAG) strategy is introduced to realize the accurate inference of the system call variants. On this basis, by analyzing the functional semantics of the inferred system call, the calling dependency relationship is further deduced, and a system call sequence with consistent semantics and reasonable logic is constructed.

[0060] The present application has the following technical effects:

[0061] (1) The present application can infer the target related system call, which is used to narrow down the exploration space of the sequence;

[0062] (2) The present application can realize the inference of the system call dependency related to the functional semantics, narrow down the range of the system call, and further reduce the false positives;

[0063] (3) The present application can accelerate the efficiency of the kernel directed fuzz testing, thereby promoting the vulnerability reproduction process. BRIEF DESCRIPTION OF DRAWINGS

[0064] Fig. 1 The present application provides a flowchart of an operating system kernel directed fuzz testing method based on LLM assisted system call inference;

[0065] Fig. 2 The present application provides a schematic diagram of the system call inference module and the directed fuzz testing module based on LLM. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be described clearly and completely in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present disclosure.

[0067] As shown in Figs. 1-2 , an operating system kernel directed fuzz testing method based on LLM assisted system call inference comprises:

[0068] Step S1: extracting target information from the operating system kernel source code using static analysis;

[0069] The target information includes a target location, function code where the target is located, a target line, a function name where the target is located, and call trace records, which refer to function call trace records at the time of kernel crash;

[0070] Step S2: constructing a system call inference module based on LLM, including a trigger condition analysis submodule, a system call sequence inference submodule, and a system call dependency inference submodule;

[0071] Step S3: calling the trigger condition analysis submodule to trigger the LLM based on the user's first input to generate an analysis result of a call chain composed of operating system kernel objects that directly or indirectly call the target;

[0072] The first input is generated based on a first prompt word related to the target information;

[0073] Step S4: constructing a knowledge base about system calls; calling the system call sequence inference submodule to trigger the LLM based on the user's second input to generate a sequence composed of system calls that call the target and variants of the system calls;

[0074] The second input is generated based on a second prompt word, which includes context related to the analysis result of the call chain, a second example, and the analysis result of the call chain, which are obtained by the first retriever from the knowledge base, and the second example is a first sentence pattern that triggers the LLM;

[0075] Step S5: calling the system call dependency inference submodule to trigger the LLM based on the third input generated by the user according to a third prompt word to generate system call dependencies, construct system call pairs, and construct templates for each system call pair;

[0076] Each system call pair includes a system call dependency and an item in a sequence, and the third prompt word includes context related to the sequence, a third example, and the sequence, which are obtained by the second retriever from the knowledge base, and the third example includes a second sentence pattern that triggers the LLM;

[0077] Step S6: calling the directed fuzzing test module to generate a number of seeds using a fuzzer and constructing test cases for testing the operating system kernel based on the seeds;

[0078] The seeds are generated by randomly selecting a number of template combinations.

[0079] The present application firstly designs multiple prompt words and corresponding sample to guide the inference of system call of LLM, and introduces retrieval enhancement generation technology to assist LLM to realize the generation of system call through retriever; then, the inference result is used as a template to guide the generation of seed in fuzz testing, and the distance between the seed and the target is determined according to the fuzz testing, and the template is dynamically updated. Finally, the inference of system call sequence and the corresponding directed kernel fuzz testing are realized. Through the given operating system kernel source code and target position, the distance information and the kernel image that can be guided are obtained by inserting and compiling, and the template is used to guide the fuzz testing to finally trigger the bug, that is, the test case triggering the bug is generated.

[0080] Since the LLM does not have enough knowledge about the field of kernel system call, the present application designs to use the document of system call as input, which includes the name, parameter type and return value of each system call and its variant. The vector database is constructed according to the division of document or paragraph. When the LLM generates the system call, the Top-k related document fragments are dynamically retrieved (based on the semantic similarity between the code fragment and the document), and the retrieval result is used as an explicit constraint to inject the generation process: filter the candidate calls that do not conform to the syzlang grammar and complete the missing variant rules.

[0081] The target refers to the target code line in the kernel source code that needs to be directed to test. The call trace is obtained through static analysis or from the crash report crawled from the Syzbot website. The call trace is the function call tracking record when the kernel crashes, which shows the execution path of the kernel before the crash, specifically the calling order from the inner function to the outer function.

[0082] The multi-step instruction includes the instruction of analyzing the information of the site where the target is located, the instruction of analyzing the call trace and the instruction of analyzing the kernel code corresponding to the target; the first sample is a question and answer form sample of the multi-step instruction of the call trace analysis submodule and the generated call chain analysis result.

[0083] The call trace analysis submodule obtains the call chain analysis result by combining the first prompt word to query the LLM. The multi-step instruction uses the thought chain technology to let the LLM know what to think at each step and proceed step by step. The multi-step instruction, for example, includes three-step instructions, 1, understand the target site information (or vulnerability information): view the provided information and analyze the mechanism of triggering the target site (or bug); 2, analyze the call trace: use the call trace to determine the kernel function call sequence that triggers the target location (or bug). 3, analyze the kernel source code: analyze the kernel code related to the target to understand the context and behavior related to the target. The first example is a pair of correct questions and answers, for example, the question is: For the trigger condition analysis of the target, analyze according to the multi-step instruction step by step. The answer is: The reasonable analysis result includes "key path identification", "call trace analysis" and "key branch code analysis".

[0084] Further, the first prompt word includes target information, multi-step instructions for analyzing the target, and the first example, which includes multi-step instruction examples and call chain analysis result examples.

[0085] Further, step S4 specifically includes:

[0086] Building a knowledge base about system calls;

[0087] The first retriever in the system call sequence inference submodule constructs a query formula based on the analysis result of the call chain and the second example to query the knowledge base and obtains the context related to the query formula;

[0088] Generating a second input based on the second prompt word;

[0089] The second prompt word includes the context related to the analysis result of the call chain, the second example, and the analysis result of the call chain.

[0090] The system call sequence inference submodule triggers the LLM to generate a sequence of system calls and variants of system calls that target the call based on the second input of the user.

[0091] The content of the knowledge base is stored in a Syzlang format document, which describes the name, parameter type, direction (input / output), dependency condition, resource life cycle, permission constraint, error code path, and semantic association with other operating system calls of each operating system call. The knowledge base is used to guide the fuzzers to generate effective and contextually consistent operating system call sequences.

[0092] The second retriever in the system call dependency inference submodule constructs a query formula based on the sequence and the second example to query the knowledge base and obtains the context related to the sequence.

[0093] Further, in step S6, the seed is generated by randomly selecting several template combinations, wherein:

[0094] The template has a weight, and the weight is determined according to the frequency of occurrence of the system call pair corresponding to the template; the frequency of occurrence of the system call pair refers to the number of times the system call pair is built and occurs when the system call pair is built;

[0095] When the templates are randomly selected, the higher the weight of the template, the greater the probability of being selected.

[0096] Further, in step S6, the test case for testing the content of the operating system is constructed based on the seed, and the method further comprises:

[0097] Step S611: when the expected test result is not obtained, step S612 is performed; otherwise, the method ends;

[0098] Step S612: a test case is constructed based on the seed variation, the test case is executed to obtain the test result of the operating system kernel; the distance between each test result and the basic block where the target is located is determined according to the test result corresponding to each seed; the weight of each template corresponding to each seed is updated based on the distance; the seed with the smallest distance is stored in the seed library, a seed is selected from the seed library, and a new seed is generated according to the selected seed variation; step S611 is entered;

[0099] Wherein, the smaller the distance of the seed, the greater the weight of the template corresponding to the seed.

[0100] Further, in step S6, the test case for testing the content of the operating system is constructed based on the seed, and the method further comprises:

[0101] Step S621: when the expected test result is not obtained, step S622 is performed; otherwise, the method ends;

[0102] Step S622: the seed distance between each seed and the basic block where the target is located is calculated, the seed with the smallest seed distance is stored in the seed library, and the weight of the template corresponding to each seed in the seed library is increased;

[0103] Wherein, the seed distance is the minimum value of the distance between each basic block covered in the execution path of the test case corresponding to the seed and the basic block where the target is located;

[0104] Wherein, the distance between the basic block and the basic block where the target is located is determined in the following manner:

[0105] The operating system kernel source code is compiled and instrumented to generate a kernel image file for booting, the program control flow graph corresponding to the operating system kernel source code is determined, and the distance between the basic block and the basic block where the target is located is calculated based on the kernel image file and the program control flow graph;

[0106] Step S623: determine a first template set composed of all template groups corresponding to all seeds, calculate the template distance corresponding to each template in the first template set, and calculate the average value of the seed distance, and adjust the weight of the template according to the template distance corresponding to each template;

[0107] Wherein, the template distance is the seed with the smallest seed distance selected from all seeds corresponding to the template; the average value of the seed distance is equal to the sum of the seed distances of the selected k seeds divided by k; the smaller the template distance, the greater the template weight;

[0108] Step S624: selecting a seed from the seed library, generating a new seed according to the selected seed variation; constructing a test case based on the seed, and executing the test case to obtain the test result of the operating system kernel.

[0109] Optionally, the application can also combine the method of intelligent agent, and the large language model judges the kernel source code to be analyzed to generate call tracking, and generates new system call variants according to the constraints to improve the accuracy and comprehensiveness of system call inference.

[0110] The following describes the device for performing the device provided by the application, and the specific implementation process and technical effects are described above, and the following will not be described again.

[0111] Optionally, the application embodiment provides an operating system kernel directed fuzz testing device based on LLM assisted system call inference, the device comprises:

[0112] The initialization module is configured to extract target information from the operating system kernel source code using static analysis;

[0113] Wherein, the target information includes target position, function code where the target is located, target line, function name where the target is located, and call tracking record, the call tracking record refers to the function call tracking record when the kernel crashes;

[0114] The model construction module is configured to construct a system call inference module based on LLM, including a trigger condition analysis submodule, a system call sequence inference submodule and a system call dependency inference submodule;

[0115] The first analysis module is configured to call the trigger condition analysis submodule, and generate an analysis result of a call chain composed of operating system kernel objects directly or indirectly calling the target based on the first input of the user triggering the LLM;

[0116] Wherein, the first input is generated based on the first prompt word related to the target information;

[0117] The second analysis module is configured to construct a knowledge base about system calls; and call a system call sequence inference submodule to trigger the LLM to generate a sequence composed of system calls and variants of the system calls based on the second input of the user;

[0118] The second input is generated based on a second prompt word, and the second prompt word includes context related to the analysis result of the call chain, the second example, and the analysis result of the call chain, which are obtained by the second retriever from the knowledge base, and the second example is a first sentence pattern triggering the LLM;

[0119] The third analysis module is configured to call a system call dependency inference submodule to trigger the LLM to generate system call dependencies based on third input of the user generated according to a third prompt word, construct system call pairs, and construct templates for each system call pair;

[0120] Each system call pair includes a system call dependency and an item in a sequence, and the third prompt word includes context related to the sequence, the third example, and the sequence, which are obtained by the second retriever from the knowledge base, and the third example includes a second sentence pattern triggering the LLM;

[0121] The test case generation module is configured to call a directed fuzzing module to generate a plurality of seeds using a fuzzer, and construct test cases for testing the operating system kernel based on the seeds;

[0122] The seeds are generated by randomly selecting a plurality of template combinations.

[0123] The apparatus is used to execute the method provided by the foregoing embodiments, and has similar implementation principles and technical effects, which will not be described here.

[0124] The above modules can be one or more integrated circuits configured to implement the above method, for example, one or more application specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs), etc. For another example, when a certain module above is implemented in the form of a processing element scheduling program code, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can invoke program code. For another example, the modules can be integrated together in the form of a system on a chip (SOC).

[0125] The above modules can be connected or communicate with each other via wired connection or wireless connection. The wired connection can include metal cable, optical cable, hybrid cable, etc., or any combination thereof. The wireless connection can include connection in the form of LAN, WAN, Bluetooth, ZigBee, or NFC, etc., or any combination thereof. Two or more modules can be combined into a single module, and any one module can be divided into two or more units. It can be clearly understood by those skilled in the art that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, which will not be repeated herein.

[0126] It should be noted that the above modules can be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs), etc. For example, when a certain module above is implemented in the form of a processing element scheduling code, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor that can invoke program code. For another example, the modules can be integrated together in the form of a system on a chip (SOC).

[0127] The electronic device includes a processor, a memory, a communication interface, a display screen and an input device connected by a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the electronic device is used for wired or wireless communication with external terminals. Wireless communication can be achieved through WIFI, operator network, near field communication (NFC) or other technologies. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen. The input device of the electronic device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the electronic device, or an external keyboard, touchpad or mouse, etc.

[0128] The application also provides a program product, such as a computer readable storage medium, comprising a program for executing the above method embodiments when executed by a processor.

[0129] In several embodiments provided by the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the described apparatus embodiments are merely schematic. The division of the units is merely a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0130] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0131] In addition, each functional unit in the various embodiments of the present application can be integrated into one processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be implemented in the form of hardware, or in the form of hardware plus software functional units.

[0132] The integrated unit implemented in the form of software functional units can be stored in a computer readable storage medium. The software functional units stored in the storage medium include a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (English: Read-Only Memory, abbreviated as: ROM), a random access memory (English: Random Access Memory, abbreviated as: RAM), a magnetic disk or an optical disk, and various media that can store program codes.

Claims

1. A method for targeted fuzz testing of the operating system kernel based on LLM-assisted system call inference, characterized in that, include: Step S1: Extract target information from the operating system kernel source code using static analysis; The target information includes the target location, the function code containing the target, the target line, the name of the function containing the target, and the call trace. The call trace refers to the function call trace at the time of the kernel crash. Step S2: Construct an LLM-based system call inference module, including a trigger condition analysis submodule, a system call sequence inference submodule, and a system call dependency inference submodule; Step S3: Invoke the trigger condition analysis submodule to trigger LLM to generate analysis results of the call chain consisting of the operating system kernel objects that directly or indirectly call the target, based on the user's first input; The first input is generated based on a first prompt word related to the target information; Step S4: Construct a knowledge base about system calls; invoke the system call sequence inference submodule to trigger LLM to generate a sequence of system calls and variants of the system calls of the call target based on the user's second input; The second input is generated based on the second prompt word. The second prompt word includes the context related to the analysis results of the call chain obtained by the first retrieval machine from the knowledge base, the second example, and the analysis results of the call chain. The second example is the first sentence that triggers the LLM. Step S5: Invoke the system call dependency inference submodule, trigger the LLM to generate system call dependencies based on the third input generated by the user according to the third prompt word, construct system call pairs, and build a template for each system call pair; Each system call pair includes a system call dependency and an item in the sequence. The third prompt word includes the sequence-related context, the third sample, and the sequence obtained by the second retrieval machine from the knowledge base. The third sample includes the second statement that triggers the LLM. Step S6: Call the directional fuzzing module, use the fuzzer to generate several seeds, and build test cases for testing the operating system kernel based on the seeds; The seed is generated by randomly selecting several templates and combining them. In step S6, constructing test cases for testing operating system content based on the seed also includes: Step S621: If the expected test result is not obtained, proceed to step S622; otherwise, the method ends. Step S622: Calculate the seed distance between each type of sub and the basic block containing the target, store the seed with the smallest seed distance in the seed bank, and increase the weight of the template corresponding to each type of sub in the seed bank; The seed distance is the minimum distance between each basic block covered in the execution path of the test case corresponding to the seed and the basic block where the target is located. The distance between a basic block and the basic block containing the target is determined as follows: The operating system kernel source code is compiled and instrumented to generate a kernel image file for booting, the program control flow graph corresponding to the operating system kernel source code is determined, and the distance between the basic block and the target basic block is calculated based on the kernel image file and the program control flow graph. Step S623: Determine the first template set consisting of all templates corresponding to all seeds, calculate the template distance corresponding to each template in the first template set, calculate the average seed distance, and adjust the template weights according to the template distances corresponding to each template. Here, template distance is selected from all the seeds corresponding to the template, and the seed with the smallest seed distance is selected; the average seed distance is equal to the sum of the seed distances of the selected k seeds divided by k; the smaller the template distance, the greater the template weight. Step S624: Select a seed from the seed library, generate a new seed by mutating the selected seed; build test cases based on the seed, execute the test cases to obtain the test results of the operating system kernel.

2. The method as described in claim 1, characterized in that, The first prompt includes target information, multi-step instructions for analyzing the target, and the first example. The first example includes a multi-step instruction example and a call chain analysis result example.

3. The method as described in claim 2, characterized in that, Step S4 specifically includes: Build a knowledge base about system calls; The first retrieval unit in the system call sequence inference submodule constructs a query based on the analysis results of the call chain and the second sample to query the knowledge base and obtain the context related to the query. Generate a second input based on the second prompt word; The second prompt includes the context related to the analysis results of the call chain, the second example, and the analysis results of the call chain; The system call sequence inference submodule triggers the LLM to generate a sequence of system calls and variants of the system calls targeting the call target based on the user's second input.

4. The method as described in claim 3, characterized in that, In step S6, the seed is generated by randomly selecting several template combinations, wherein: Templates have weights, which are determined by the frequency of occurrence of the system call pair corresponding to that template; the frequency of occurrence of a system call pair refers to the number of times the system call pair is constructed when it is constructed. When randomly selecting templates, the template with the higher weight has a greater probability of being selected.

5. The method as described in claim 4, characterized in that, In step S6, constructing test cases for testing operating system content based on the seed also includes: Step S611: If the expected test result is not obtained, proceed to step S612; otherwise, the method ends. Step S612: Construct test cases based on seed mutation, execute test cases to obtain test results of the operating system kernel; determine the distance between each test result and the basic block where the target is located based on the test results corresponding to various sub-subs; update the weight of each template corresponding to various sub-subs based on the distance; store the seed with the smallest distance in the seed library, select a seed from the seed library, and generate a new seed based on the mutation of the selected seed; proceed to step S611. Among them, the smaller the distance between the seeds, the greater the weight of each template corresponding to them.

6. The method as described in claim 5, characterized in that, The second retrieval unit in the system call dependency inference submodule builds a query-based knowledge base based on the sequence and the second example and obtains the context related to the sequence.

Images