A vulnerability mining method and device for an intelligent unmanned system controller program

Abstract

The application relates to a vulnerability mining method and device for an intelligent unmanned system controller program. The method comprises the following steps: obtaining, by a target test program, a communication data packet corresponding to an intelligent unmanned system sent by a fuzzy tester; based on a blocking communication mode, synchronously running a test driving thread and a target data packet receiving thread of the communication data packet corresponding to the intelligent unmanned system by the target test program; based on the target data packet receiving thread, receiving the communication data packet corresponding to the intelligent unmanned system by the target test program, analyzing the communication data packet corresponding to the intelligent unmanned system, and determining execution data; running a synchronous sending program and a synchronous receiving program, synchronously running a target execution thread and the target data packet receiving thread in the target test program, running the execution data based on the target execution thread, and obtaining a vulnerability mining result of the intelligent unmanned system controller program. The above scheme can improve the execution stability of the coverage guided fuzzy test process.

Description

Technical Field

[0001] This application relates to the field of security testing technology for intelligent unmanned systems, and in particular to a method and apparatus for vulnerability discovery in the controller program of an intelligent unmanned system. Background Technology

[0002] The application of intelligent unmanned systems in industrial and consumer environments is becoming increasingly widespread. Unmanned aerial vehicle (UAV) flight control programs are a typical example in the field of intelligent UAV security research. As the core control unit of the UAV, it needs to simultaneously perform multiple core logical functions such as sensor data acquisition and calculation, attitude and position estimation, path navigation control, and motor and servo drive. Therefore, it faces potential intrusion threats from multiple dimensions of channels, including GCS (Ground Control Station) signals, remote controller signals, GPS (Global Positioning System) positioning signals, and sensor signals. The security of UAV flight control programs is directly related to the reliability and safety of UAV operation. However, its core communication protocol, mavlink (MicroAirVehicleLink), lacks various security protection mechanisms due to its lightweight design, making it highly vulnerable to various network attacks such as man-in-the-middle attacks, data tampering, and control hijacking. Therefore, fuzz testing of multi-threaded asynchronous programs like those in intelligent UAV systems through various network interfaces has become an important technical means to improve their security and reliability. Depending on the input generation strategy, intelligent unmanned systems, such as drones, generally exhibit problems like low vulnerability discovery efficiency, poor test stability, and insufficient verifiability of vulnerability triggering results during path coverage-based fuzzing due to their complex architecture and the coupling of their internal mechanisms. Therefore, how to improve the execution stability and test result reproducibility of the coverage-guided fuzzing process while maintaining the testing efficiency of fuzzing intelligent unmanned systems, thereby ensuring the effectiveness of the coverage-guided mechanism and the verifiability of vulnerability triggering results, is a problem that needs to be solved. Summary of the Invention

[0003] Therefore, it is necessary to provide a vulnerability discovery method and apparatus for intelligent unmanned system controller programs that can improve the efficiency of vulnerability discovery when performing fuzz testing on intelligent unmanned systems, while also improving test stability and the verifiability of vulnerability triggering results, in order to address the above-mentioned technical problems.

[0004] In a first aspect, this application provides a method for vulnerability discovery in an intelligent unmanned system controller program. The method is executed by a computer and includes:

[0005] The target test program is used to obtain the communication data packets corresponding to the intelligent unmanned system sent by the fuzz tester; the target test program is the intelligent unmanned system controller program.

[0006] The target test program uses a blocking communication method to synchronously run a test-driven thread and a target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets; the test-driven thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0007] The target test program receives the corresponding communication data packets of the intelligent unmanned system based on the target data packet receiving thread, and analyzes the corresponding communication data packets of the intelligent unmanned system to determine the execution data.

[0008] Run the synchronous sending and receiving programs in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and run the execution data based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program; the vulnerability mining results of the intelligent unmanned system controller program include the data execution path and the data execution result.

[0009] In one embodiment, after running the execution data based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program, the method further includes:

[0010] The vulnerability discovery results of the intelligent unmanned system controller program are sent to the fuzz tester through the target testing program;

[0011] Obtain the updated communication data packet sent by the fuzz tester; the updated communication data packet is determined by the fuzz tester adjusting the data in the corresponding communication data packet of the intelligent unmanned system based on the vulnerability discovery results of the intelligent unmanned system controller program;

[0012] The target test program determines the update test result based on the update communication data packet.

[0013] In one embodiment, after synchronously running the test-driven thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets based on a blocking communication method, the method further includes:

[0014] In the target test program, shut down all protocol communication data packet receiving threads except the target data packet receiving thread to isolate interference information generated by the running of other protocol communication data packet receiving threads;

[0015] The fuzzy test-related code corresponding to the communication data packet of the intelligent unmanned system is determined from the target test program, and the fuzzy test-related code is selectively instrumented to shield the interference information generated by the sensor signal.

[0016] In one embodiment, before obtaining the communication data packet corresponding to the intelligent unmanned system sent by the fuzz tester through the target testing program, the method further includes:

[0017] A test-driven thread is constructed in the source program of the intelligent unmanned system to be tested, and a blocking communication program is added to the source program to be tested;

[0018] In the source code of the intelligent unmanned system to be tested after constructing the test-driven thread and adding the blocking communication program, a synchronous sending program and a synchronous receiving program are constructed to determine the target test program; the synchronous sending program and the synchronous receiving program are used to synchronize the target data packet receiving thread and the target execution thread in the source code of the intelligent unmanned system to be tested after constructing the test-driven thread and adding the blocking communication program.

[0019] In one embodiment, a synchronous sending program and a synchronous receiving program are constructed in the source program of the intelligent unmanned system to be tested after constructing the test-driven thread and adding the blocking communication program, and the target test program is determined, including:

[0020] In the source code of the intelligent unmanned system to be tested, after building the test-driven thread and adding the blocking communication program, build the synchronous sending program and the synchronous receiving program;

[0021] Based on the time constant set by the fuzz tester, the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous sending program and synchronous receiving program and adding the blocking communication program is adjusted, and the adjusted test source program is used as the target test program.

[0022] In one embodiment, the vulnerability discovery method for the aforementioned intelligent unmanned system controller program includes:

[0023] Boolean variables are added to the message structure of the intelligent unmanned system, and identification codes are added to the target test program. After the target test program receives the corresponding communication data packets of the intelligent unmanned system based on the target data packet receiving thread, the variable identifier of the Boolean variable is updated to the target identifier, and message filtering is performed based on the identification code to identify the Boolean variable identifier.

[0024] In one embodiment, the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous sending and receiving programs and adding the blocking communication program is adjusted based on the time constant set by the fuzz tester, and the adjusted test source program is used as the target test program, including:

[0025] The time variable function in the test source program of the intelligent unmanned system after the synchronous sending and receiving programs are adjusted based on the time constant set by the fuzz tester.

[0026] Record functions or files that affect the stability of fuzz testing in a blacklist, and record functions or files corresponding to the target execution thread and the target data packet receiving thread in a whitelist;

[0027] By optimizing the instrumentation compiler, and based on the blacklist and whitelist, selective instrumentation is performed on the source code of the intelligent unmanned system to be tested, which consists of a synchronous sending program and a synchronous receiving program after adjusting the time variable function, a test driving thread after adding a blocking communication program, and a message filtering program constructed using Boolean variables, to determine the target test program.

[0028] Secondly, this application also provides a vulnerability discovery device for intelligent unmanned system controller programs. This device is applied to a computer and includes:

[0029] The data packet acquisition module is used to acquire the corresponding communication data packets sent by the fuzz tester to the intelligent unmanned system through the target test program; the target test program is the intelligent unmanned system controller program.

[0030] The driving thread execution module is used to synchronously run the test driving thread and the target data packet receiving thread of the intelligent unmanned system based on the target test program using a blocking communication method; the test driving thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0031] The execution data determination module is used to receive the corresponding communication data packet of the intelligent unmanned system through the target test program based on the target data packet receiving thread, and to analyze the corresponding communication data packet of the intelligent unmanned system to determine the execution data.

[0032] The test result determination module is used to run the synchronous sending and receiving programs in the target test program, causing the target execution thread in the target test program to run synchronously with the target data packet receiving thread, and to run the execution data based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program; the vulnerability discovery results of the intelligent unmanned system controller program include the data execution path and the data execution result;

[0033] The test update module is used to send the vulnerability discovery results of the intelligent unmanned system controller program to the fuzzer through the target test program; obtain the update communication data packet sent by the fuzzer; the update communication data packet is determined by the fuzzer adjusting the data in the corresponding communication data packet of the intelligent unmanned system according to the vulnerability discovery results of the intelligent unmanned system controller program; and determine the update test result through the target test program based on the update communication data packet.

[0034] The information filtering module is used to shut down other protocol communication data packet receiving threads in the target test program, except for the target data packet receiving thread, to isolate interference information generated by other protocol communication data packet receiving threads during operation; it determines the fuzzy test-related code corresponding to the communication data packet of the intelligent unmanned system from the target test program, and selectively instrumentes the fuzzy test-related code to shield interference information generated by sensor signals;

[0035] A forced synchronization module is used to construct a test-driven thread in the source program of the intelligent unmanned system under test, and add a blocking communication program to the source program under test; after constructing the test-driven thread and adding the blocking communication program, a synchronous sending program and a synchronous receiving program are constructed in the source program of the intelligent unmanned system under test, and a target test program is determined; the synchronous sending program and the synchronous receiving program are used to synchronize the target data packet receiving thread and the target execution thread in the source program under test of the intelligent unmanned system under test after constructing the test-driven thread and adding the blocking communication program.

[0036] The time variable replacement module is used to construct synchronous sending and receiving programs in the test source program of the intelligent unmanned system after constructing the test driving thread and adding the blocking communication program; it adjusts the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous sending and receiving programs and adding the blocking communication program based on the time constant set by the fuzz tester, and uses the adjusted test source program as the target test program.

[0037] The time variable replacement module includes a Boolean variable control unit, which is used to add Boolean variables to the message structure of the intelligent unmanned system, add identification codes to the target test program, and after receiving the corresponding communication data packets of the intelligent unmanned system through the target test program based on the target data packet receiving thread, update the variable identifier of the Boolean variable to the target identifier, and perform message filtering based on the identification code to identify the Boolean variable identifier.

[0038] The time variable replacement module further includes a test program adjustment unit, used to adjust the time variable functions in the test source program of the intelligent unmanned system after building the synchronous sending and receiving programs and adding the blocking communication program, based on the time constant set by the fuzz tester; record functions or files that affect the stability of fuzz testing in a blacklist, and record the functions or files corresponding to the target execution thread and the target data packet receiving thread in a whitelist; by optimizing the instrumentation compiler, selectively instrument the test source program of the intelligent unmanned system after building the synchronous sending and receiving programs and adding the blocking communication program, and constructing the message filtering intelligent unmanned system using Boolean variables after adjusting the time variable functions, according to the blacklist and the whitelist, to determine the target test program.

[0039] Thirdly, this application also provides a computer device, the computer device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0040] The target test program is used to obtain the communication data packets corresponding to the intelligent unmanned system sent by the fuzz tester; the target test program is the intelligent unmanned system controller program.

[0041] The target test program uses a blocking communication method to synchronously run a test-driven thread and a target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets; the test-driven thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0042] The target test program receives the corresponding communication data packets of the intelligent unmanned system based on the target data packet receiving thread, and analyzes the corresponding communication data packets of the intelligent unmanned system to determine the execution data.

[0043] Run the synchronous sending and receiving programs in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and run the execution data based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program; the vulnerability mining results of the intelligent unmanned system controller program include the data execution path and the data execution result.

[0044] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0045] The target test program is used to obtain the communication data packets corresponding to the intelligent unmanned system sent by the fuzz tester; the target test program is the intelligent unmanned system controller program.

[0046] The target test program uses a blocking communication method to synchronously run a test-driven thread and a target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets; the test-driven thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0047] The target test program receives the corresponding communication data packets of the intelligent unmanned system based on the target data packet receiving thread, and analyzes the corresponding communication data packets of the intelligent unmanned system to determine the execution data.

[0048] Run the synchronous sending and receiving programs in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and run the execution data based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program; the vulnerability mining results of the intelligent unmanned system controller program include the data execution path and the data execution result.

[0049] The aforementioned method and apparatus for vulnerability discovery in an intelligent unmanned system controller program involves: acquiring communication data packets corresponding to the intelligent unmanned system sent by a fuzzer through a target test program; synchronously running a test-driven thread and a target data packet receiving thread for the intelligent unmanned system's corresponding communication data packets using a blocking communication method within the target test program; constructing the data packet interface corresponding to the target data packet receiving thread through the target test program; receiving the communication data packets corresponding to the intelligent unmanned system based on the target data packet receiving thread, and analyzing the communication data packets to determine the execution data; running the synchronous sending and receiving programs in the target test program, causing the target execution thread in the target test program to run synchronously with the target data packet receiving thread, and executing the execution data based on the target execution thread to obtain vulnerability discovery results for the intelligent unmanned system controller program; the vulnerability discovery results for the intelligent unmanned system controller program include data execution paths and data execution results. This method solves the problems of low vulnerability discovery efficiency, poor test stability, and insufficient verifiability of vulnerability triggering results during path coverage-based fuzzing of intelligent unmanned systems due to their complex architecture and the coupling of their internal mechanisms. The above scheme, when conducting fuzzy testing on intelligent unmanned systems, uses a blocking communication method to synchronously run the test-driven thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets. Simultaneously, the target test program receives the corresponding communication data packets from the intelligent unmanned system through the target data packet receiving thread, analyzes these packets to determine the execution data, and sets up a bidirectional blocking communication method between the input-driven thread and the message-receiving thread. This ensures that after sending test results, the input thread must wait for the receiving thread to complete processing and return an acknowledgment signal, and the receiving thread must also wait for new input data to arrive before continuing processing, thus forming a lockstep operation relationship. A start / stop signal mechanism is introduced between the message-receiving thread and the function execution thread. The system ensures that the function execution thread can only begin execution after receiving a start signal, and sends an end signal to the receiving thread upon completion of the task. The receiving thread then enters the next round of scheduling upon receiving this signal. Through this two-layer synchronization mechanism, the timing drift between threads can be effectively eliminated, ensuring a strict correspondence and controllability between test input, task execution, and result acquisition stages. This avoids problems such as low vulnerability discovery efficiency, poor test stability, and insufficient verifiability of vulnerability triggering results caused by thread asynchrony. It can improve the execution stability and test result reproducibility of the coverage-guided fuzzing process while maintaining the testing efficiency of fuzzing intelligent unmanned systems, thereby ensuring the effectiveness of the coverage-guided mechanism and the verifiability of vulnerability triggering results. Attached Figure Description

[0050] Figure 1This is a flowchart illustrating a vulnerability discovery method for an intelligent unmanned system controller program in one embodiment.

[0051] Figure 2 This is a communication example diagram of a micro-object request broker in one embodiment;

[0052] Figure 3 Here is an example diagram of a message filtering method in one embodiment;

[0053] Figure 4 This is a schematic diagram of a method for filtering external signal interference in one embodiment;

[0054] Figure 5 This is a flowchart illustrating a method for determining a target test procedure in one embodiment;

[0055] Figure 6 This is a flowchart illustrating the selective instrumentation of the source program to be tested in one embodiment.

[0056] Figure 7 This is a flowchart illustrating a vulnerability discovery method for an intelligent unmanned system controller program in another embodiment.

[0057] Figure 8 This is a structural block diagram of a vulnerability discovery device for an intelligent unmanned system controller program in one embodiment.

[0058] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] In one embodiment, such as Figure 1 As shown, a method for vulnerability discovery in an intelligent unmanned system controller program is provided, and this method is applied to a computer. In this embodiment, the method includes the following steps:

[0061] S110. Obtain the corresponding communication data packet of the intelligent unmanned system sent by the fuzz tester through the target test program.

[0062] The target test program is the intelligent unmanned system controller program.

[0063] It's important to note that current fuzzing tools like AFL++ (American Fuzzy Lop++) are often used for fuzzing intelligent unmanned systems. Fuzzing requires repeating the "start-receive-parse / execute-close" process, with each fuzzing test requiring a complete cycle that can take tens of seconds. This results in very few test cases that can be executed per unit of time, leading to low vulnerability detection efficiency. For vulnerability discovery in intelligent unmanned system controller programs with complex startup processes, AFL++ proposes a persistent mode to effectively improve testing efficiency. This mode avoids repeatedly running the complete process, instead executing loop tests after entering critical code, thus increasing testing speed. However, the complex nature of intelligent unmanned systems causes their testing stability in AFL++ persistent mode to continuously decline until it approaches zero. This leads to the failure of the coverage guidance mechanism, fuzzer performance degradation, and the testing strategy degenerating into black-box fuzzing, resulting in low vulnerability discovery efficiency. Stability refers to whether the execution path of the intelligent unmanned system's program remains consistent when the same test input data is run multiple times. If the execution path is consistent each time the program is run, the stability is high; if the execution paths differ significantly, the stability is low.

[0064] Intelligent unmanned systems typically consist of three core modules: perception, decision-making, and control, corresponding to a multi-threaded asynchronous structure. In this structure, the message receiving thread is responsible for the real-time reception and parsing of communication protocol frames such as external commands, telemetry data, and task data; the sensor data processing thread handles the acquisition, preprocessing, and state calculation of data from multiple sensors; and the control execution thread converts desired commands into control variables and drives specific actuators. Because these threads are decoupled and run asynchronously, fuzz testing of intelligent unmanned systems often doesn't require waiting for the current test case to complete before sending the next input. This leads to a significant misalignment between input timing and program execution timing, and also decouples the coverage statistics period from the actual program execution period. This can result in the data packets that actually trigger an anomaly being overwritten by new inputs, making them difficult to reproduce. To ensure real-time state updates, intelligent unmanned systems need to continuously process multi-source signal inputs. Key signal types affecting test stability include sensor data, inter-thread broadcast signals, and irrelevant network data packets. These internal and external signals are not entirely constrained by the fuzz test input data. When the same test case is repeatedly executed, random fluctuations in irrelevant signals can lead to different paths, causing unpredictable changes in coverage. Fuzz testing employs a continuous interactive mode, where the target test program is not closed once started. Due to the time-dependent nature of the operation, it is necessary to maintain various state information from the previous moment. This residual information can interfere with the predictability of subsequent test case execution results, causing changes in program coverage. This can result in time residues, space residues, and state residues, leading to problems such as difficulty in reproducing vulnerabilities, failure of coverage guidance, and strategy degradation into black-box testing when fuzz testing intelligent unmanned systems.

[0065] Due to the instability of vulnerability discovery in intelligent unmanned system controller programs, fuzzers may misclassify invalid test cases as valid inputs. Valid test cases may have already been discarded when a system crash is triggered. In other words, the test cases captured by the fuzzer are not the actual test cases that trigger the vulnerability, increasing the difficulty of vulnerability reproduction and verification. A crash is an abnormal termination phenomenon that occurs during the operation of a computer system. For example, 4DFuzzer, which performs black-box fuzzing on a typical intelligent unmanned system—the UAV flight control program—determines whether a test case triggers a program vulnerability by checking if the current test case's response timeout occurs. However, because the message receiving thread and command execution thread of the UAV flight control program execute asynchronously, the message receiving thread can receive the next message without waiting for the command execution thread to finish. A vulnerability in the UAV flight control program might be caused by the previous test case, but the receiving thread has already started receiving the next test case. The fuzzer cannot correctly capture the test case causing the program crash. This makes it impossible for 4DFuzzer to reliably reproduce the triggered vulnerability even if it can trigger it, requiring additional reliance on target-side logs for tracing the vulnerability's origin.

[0066] Fuzz testing is an automated testing method that discovers software vulnerabilities by inputting unexpected data into a target system and monitoring the abnormal results. A fuzz tester is an automated testing tool that generates random or mutated data as input and monitors abnormal program behavior to discover software vulnerabilities. For example, the communication data packets corresponding to the PX4 flight control program are MAVLINK data packets. The target test program is the program to be tested, such as the PX4 UAV flight control program. The target test program for an intelligent unmanned system refers to the set of original code in the intelligent unmanned system that needs to be tested; this original code can include core code such as the operating system, applications, and middleware.

[0067] Taking the PX4 UAV flight control system as an example, the PX4 UAV flight control system internally uses the uORB (Microobject request broker) mechanism to realize asynchronous message passing between threads. This mechanism adopts a publish-subscribe design paradigm to build an asynchronous communication model. When data producers need to share specific information, they will broadcast data through topics. These topics, as semantic information channels, typically carry data structures with clear physical meaning, such as attitude estimation and control commands. On the topic subscription side, data consumers can obtain the latest data in two ways: polling and event-triggered mechanisms. The polling mechanism involves subscribers actively querying topic data at a self-defined frequency. These subscribers typically have their own independent stacks and undertake relatively heavy computational tasks. The event-triggered mechanism involves the system immediately waking up dormant subscription threads when new data is written to a topic. These threads are managed by a work queue, share and reuse the same stack space and thread priority, and cannot be interrupted or have their input / output blocked. The uORB architecture is as follows: Figure 2 As shown. Figure 2 In this context, Thread 1 and Thread 2 are both threads that can publish and subscribe to topics, and the work queue refers to the collection of threads that subscribe to topics. Figure 2 The diagram illustrates the communication mechanism: a topic published by one thread can be subscribed to by multiple threads, and a single thread can also subscribe to multiple topics. Solid arrows represent the target's actions, including publishing and subscribing, while dashed arrows represent the transmission of topic messages.

[0068] Specifically, the fuzz tester automatically generates abnormal input data for fuzz testing of the intelligent unmanned system, and sends the abnormal input data to the target test program of the intelligent unmanned system in the form of corresponding communication data packets.

[0069] S120. The target test program synchronously runs the test driver thread and the target data packet receiving thread of the intelligent unmanned system based on the blocking communication method.

[0070] The test-driven thread is used to build the data packet interface corresponding to the target data packet receiving thread.

[0071] Blocking communication refers to a process that blocks when the pipeline is full or empty, continuing execution only when a certain condition is met. A blocking communication program refers to a process where read / write operations block the process until a specific condition is met. It can be understood that by strictly aligning test inputs with the system execution state through blocking communication, a synchronization mechanism can be established between the test-driven thread and the target data packet receiving thread, forcing synchronization between them. Taking the PX4 flight control program as an example, the target data packet receiving thread is the mavlink_receiver thread in its system. The mavlink_receiver thread primarily receives commands and data sent from the ground control station and remote controller via the mavlink protocol, and then passes this information to other parts of the program for processing. It is a crucial link in the UAV's communication with the outside world. For example, commands sent via the mavlink protocol can be takeoff or turn commands.

[0072] S130. Through the target test program, the corresponding communication data packets of the intelligent unmanned system are received based on the target data packet receiving thread, and the corresponding communication data packets of the intelligent unmanned system are analyzed to determine the execution data.

[0073] Among them, the execution data is the data executed by the target execution thread, such as control data that controls the drone to fly upwards.

[0074] S140. Run the synchronous sending and receiving programs in the target test program, so that the target execution thread and the target data packet receiving thread in the target test program run synchronously, and execute the data based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program.

[0075] The vulnerability discovery results of the intelligent unmanned system controller program include the data execution path and the data execution results.

[0076] It should be noted that the vulnerability discovery results of the intelligent unmanned system controller program are the vulnerability discovery results of the intelligent unmanned system control program or firmware.

[0077] It's important to note that the target test program includes two dedicated synchronization topics: PubSend and PubReturn. The message receiving thread, i.e., the mavlink_receiver thread, broadcasts the PubSend topic to notify the target execution thread. The target execution thread subscribes to the PubSend topic and waits for this signal before continuing execution. Upon starting a single execution cycle, the target execution thread broadcasts the PubReturn topic to notify the message receiving thread, i.e., the mavlink_receiver thread, after the cycle ends. The mavlink_receiver thread subscribes to PubReturn and waits for this signal. Upon receiving the signal, it can receive the next data packet, thus achieving synchronization between the mavlink_receiver thread and the target execution thread. Execution results may include error messages. The script is a pre-compiled program used to modify the test-driving thread and the receiving program in the target test program.

[0078] For example, after running the execution data based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program, the method further includes:

[0079] The target test program sends the vulnerability discovery results of the intelligent unmanned system controller program to the fuzzer; obtains the update communication data packet sent by the fuzzer; the update communication data packet is determined by the fuzzer adjusting the data in the corresponding communication data packet of the intelligent unmanned system based on the vulnerability discovery results of the intelligent unmanned system controller program; and the target test program determines the update test result based on the update communication data packet.

[0080] Specifically, the synchronous sending and receiving programs in the target test program are run, causing the target execution thread and the target data packet receiving thread in the target test program to run synchronously. Based on the execution data from the target execution thread, the vulnerability discovery results of the intelligent unmanned system controller program are obtained. The vulnerability discovery results of the intelligent unmanned system controller program are then sent to the fuzzer through the target test program. The fuzzer determines the test result for the next round of fuzz testing on the intelligent unmanned system based on the vulnerability discovery results, i.e., updating the communication data packets, and sends the updated communication data packets to the target test program. The target test program then determines the updated test result based on the updated communication data packets.

[0081] For example, after obtaining the vulnerability discovery results of the intelligent unmanned system controller program, the fuzz tester determines whether there are new data execution paths in the vulnerability discovery results. If there are new data execution paths, it is determined that the corresponding communication data packets of the intelligent unmanned system are more efficient for testing. The new execution path can be triggered by changing the data in the corresponding communication data packets of the intelligent unmanned system. Further data mutation is performed on the corresponding communication data packets of the intelligent unmanned system, that is, the corresponding communication data packets of the intelligent unmanned system are updated. The updated communication data packets are determined and sent to the target test program. The target test program then conducts a new round of fuzz testing on the intelligent unmanned system based on the updated communication data packets.

[0082] In the aforementioned vulnerability discovery method for the intelligent unmanned system controller program, the following steps are taken: First, the target test program obtains the communication data packets corresponding to the intelligent unmanned system sent by the fuzzer. Second, the target test program, based on a blocking communication method, synchronously runs a test-driven thread and a target data packet receiving thread for the corresponding communication data packets of the intelligent unmanned system. The test-driven thread is used to construct the data packet interface corresponding to the target data packet receiving thread. Third, the target test program receives the communication data packets corresponding to the intelligent unmanned system based on the target data packet receiving thread, analyzes the communication data packets, and determines the execution data. Fourth, the synchronous sending and receiving programs in the target test program are run, causing the target execution thread in the target test program to run synchronously with the target data packet receiving thread, and the execution data is run based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program. The vulnerability discovery results of the intelligent unmanned system controller program include the data execution path and the data execution result. This method solves the problems of low vulnerability discovery efficiency, poor test stability, and insufficient verifiability of vulnerability triggering results in the path coverage-based fuzzing process of intelligent unmanned systems due to their complex architecture and the coupling of their internal mechanisms. The above scheme, when conducting fuzzy testing on intelligent unmanned systems, uses a blocking communication method to synchronously run the test-driven thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets. Simultaneously, the target test program receives the corresponding communication data packets from the intelligent unmanned system through the target data packet receiving thread, analyzes these packets to determine the execution data, and sets up a bidirectional blocking communication method between the input-driven thread and the message-receiving thread. This ensures that after sending test results, the input thread must wait for the receiving thread to complete processing and return an acknowledgment signal, and the receiving thread must also wait for new input data to arrive before continuing processing, thus forming a lockstep operation relationship. A start / stop signal mechanism is introduced between the message-receiving thread and the function execution thread. The system ensures that the function execution thread can only begin execution after receiving a start signal, and sends an end signal to the receiving thread upon completion of the task. The receiving thread then enters the next round of scheduling upon receiving this signal. Through this two-layer synchronization mechanism, the timing drift between threads can be effectively eliminated, ensuring a strict correspondence and controllability between test input, task execution, and result acquisition stages. This avoids problems such as low vulnerability discovery efficiency, poor test stability, and insufficient verifiability of vulnerability triggering results caused by thread asynchrony. It can improve the execution stability and test result reproducibility of the coverage-guided fuzzing process while maintaining the testing efficiency of fuzzing intelligent unmanned systems, thereby ensuring the effectiveness of the coverage-guided mechanism and the verifiability of vulnerability triggering results.

[0083] In one embodiment, after synchronously running the test-driven thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets based on a blocking communication method, the method further includes:

[0084] In the target test program, shut down all protocol communication data packet receiving threads except the target data packet receiving thread to isolate interference information generated by the running of other protocol communication data packet receiving threads; determine the fuzzy test-related code corresponding to the communication data packet of the intelligent unmanned system from the target test program, and selectively instrument the fuzzy test-related code to shield interference information generated by sensor signals.

[0085] Specifically, to address the issue of interference from external communication data packets, all protocol communication data packet receiving threads in the target test program of the intelligent unmanned system, except for the target data packet receiving thread, can be shut down. A one-way data injection channel can be constructed to isolate interference information generated by other protocol communication data packet receiving threads during runtime. For randomly changing sensor signals, since they only affect the code coverage of a single function or file, fuzz-related code can be identified from the target test program and selectively instrumented to shield the interference information generated by sensor signals. Instrumentation, or program instrumentation, is a dynamic testing technique that involves inserting probes or code statements into the program to collect runtime data for checking program execution, variable changes, and obtaining control flow and data flow information.

[0086] The above solution addresses the issue of internal and external signal interference by constructing a multi-layered isolation and filtering mechanism to ensure a clean execution environment for the intelligent unmanned system during testing. First, at the communication channel level, all external data receiving threads except those receiving test input are shut down, and a one-way data injection channel is reconstructed to fundamentally isolate external signal interference. Second, at the sensor data level, signals that may fluctuate randomly and only affect local code coverage are selectively instrumented to prevent irrelevant data from interfering with test statistics.

[0087] In one embodiment, the vulnerability discovery method for the intelligent unmanned system controller program further includes: adding a Boolean variable to the message structure of the intelligent unmanned system, adding an identification code to the target test program, and updating the variable identifier of the Boolean variable to the target identifier after receiving the corresponding communication data packet of the intelligent unmanned system through the target test program based on the target data packet receiving thread, and filtering messages by identifying the Boolean variable identifier according to the identification code.

[0088] It should be noted that the drone flight control program communicates via the uORB mechanism, and the threads waiting to run in the system are divided into subscribers and subscribers. A subscriber can subscribe to multiple topics, and topics exchange information through broadcasting via the Publish function.

[0089] Specifically, such as Figure 3 As shown, the main thread is the corresponding communication protocol processing thread, i.e., the thread that sends test cases from the fuzzer. The information flowing between the main thread, execution thread 1, execution thread 2, and execution thread 3 is all communication data packets corresponding to the intelligent unmanned system sent by the fuzzer. Execution thread 4 prepares to publish communication data packets corresponding to the intelligent unmanned system that are not sent by the fuzzer. The filter is an identifier identification code added to the target program, used to determine whether the message the target thread is preparing to publish is a communication data packet corresponding to the intelligent unmanned system sent by the fuzzer. If it is, the identifier is set to True and the sending is allowed through the filtering code. A boolean variable `fromreceiver` is added to the uORB message structure of the intelligent unmanned system. The default identifier of the boolean variable is false, and the identifier identification code is added to the system. When the communication data packet corresponding to the intelligent unmanned system sent by the fuzzer is received and processed by the target data packet receiving thread, the intelligent unmanned system automatically updates the default identifier of the boolean variable to the target identifier, which is True. In the target test program, threads subscribing to the related topics of the boolean variable will have the identifier of the boolean variable in the broadcast message structure set to True during subsequent broadcasts. Therefore, the identification code can determine whether to broadcast the broadcast information based on whether the identifier of the boolean variable in the broadcast information is the target identifier. That is, if the identifier of the boolean variable in the broadcast information is True, then the broadcast information is allowed to be broadcast, thereby filtering out the broadcast Topic signals of asynchronous threads.

[0090] The above scheme, such as Figure 4 As shown, to address the interference of redundant network communication interfaces on fuzzing, data filtering of redundant network communication interfaces is achieved by shutting down unnecessary communication channels, i.e., closing all external data receiving threads except those receiving test inputs. To address the interference of internal thread signal interactions on fuzzing, a "message tagging + transmission filtering" system is introduced. By attaching source tags to the message structure and performing tag verification and call chain verification before distribution, only messages associated with the test input are allowed to be transmitted across threads, thus completely blocking interference from non-target signals to the testing process. Specifically, the target file function is obtained, and it is determined whether to publish a message based on the target file function. If no message is published, no processing is performed; if a message is published, the publishing function is located based on the target file function, and the presence of an external message source is determined based on the publishing function and filtering code. If no external message source is found, no processing is performed; if an external message source is found, the message source is located. To address the interference of redundant and meaningless sensor data on fuzzing, sensor data is selectively instrumented to mask it.

[0091] In one embodiment, such as Figure 5 As shown, before obtaining the corresponding communication data packet for the intelligent unmanned system from the fuzz tester through the target testing program, the following steps are also included:

[0092] S510. Construct a test-driven thread in the source code of the intelligent unmanned system to be tested, and add a blocking communication program to the source code to be tested.

[0093] It should be noted that a test-driven thread is built within the source code of the intelligent unmanned system to be tested. This means creating a data interface within the intelligent unmanned system to receive the corresponding communication data packets sent by the fuzz tester. The source code to be tested refers to the source code of the intelligent unmanned system that requires fuzz testing.

[0094] For example, the source code of the intelligent unmanned system to be tested is modified to build a test-driven thread, which continuously injects communication data packets sent by the fuzz tester into the intelligent unmanned system in persistent mode. A blocking communication program is added to the source code to be tested to synchronize the test-driven thread and the message receiving thread through blocking communication.

[0095] S520. In the source program to be tested of the intelligent unmanned system after constructing the test-driven thread and adding the blocking communication program, construct the synchronous sending program and the synchronous receiving program, and determine the target test program.

[0096] The synchronous sending program and synchronous receiving program are used to synchronize the target data packet receiving thread and the target execution thread in the source program to be tested of the intelligent unmanned system after the test driving thread is constructed and the blocking communication program is added.

[0097] Specifically, in the test source code of the intelligent unmanned system after constructing the test-driven thread and adding the blocking communication program, two dedicated synchronization semaphores are added: the synchronization send signal PubSend and the synchronization receive signal PubReturn. The message receiving thread broadcasts the PubSend signal to notify the target execution thread to start a single execution cycle. After the target execution thread finishes its current cycle, it broadcasts the PubReturn signal to notify the message receiving thread to receive the next data packet. Blocking code for receiving PubSend is inserted at the main loop entry point of each target execution thread, forcing the thread to wait for the synchronization signal from the message receiving thread before entering a new execution cycle. A PubReturn release instruction is inserted at the main loop exit point of each execution thread, and blocking code for PubReturn is added at the corresponding position in the message receiving thread, forming a complete execution cycle synchronization closed loop.

[0098] The above scheme can set up a bidirectional blocking communication mode between the input driving thread and the message receiving thread, so that after the input thread sends the test result, it must wait for the receiving thread to complete the processing and return an acknowledgment signal. The receiving thread also needs to wait for new input data to arrive before it can continue processing, thus forming a lockstep operation relationship.

[0099] For example, in the source code of the intelligent unmanned system to be tested after constructing the test-driven thread and adding the blocking communication program, a synchronous sending program and a synchronous receiving program are constructed, and the target test program is determined, including:

[0100] In the test source program of the intelligent unmanned system after constructing the test driving thread and adding the blocking communication program, a synchronous sending program and a synchronous receiving program are constructed; the time variable function in the test source program of the intelligent unmanned system after constructing the test driving thread and adding the blocking communication program is adjusted based on the time constant set by the fuzz tester, and the adjusted test source program is used as the target test program.

[0101] For example, taking the PX4 UAV flight control system as an example, the time variable function is determined from the test source program of the intelligent unmanned system after constructing the synchronous transmission and reception programs and adding the blocking communication program. The time variable function is hrt_absolute_time(). Based on the time constant CONST_TIME set by the fuzz tester, the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous transmission and reception programs and adding the blocking communication program is adjusted, and the adjusted test source program is used as the target test program. For example, the adjusted time variables in the test source program of the intelligent unmanned system after constructing the synchronous transmission and reception programs and adding the blocking communication program are shown in Table 1:

[0102] Table 1

[0103]

[0104] The above scheme adjusts the time variable functions in the test source program of the intelligent unmanned system after building the synchronous sending and receiving programs and adding the blocking communication program, based on the time constant CONST_TIME set by the fuzzer. This eliminates the influence of time variables on fuzzing and improves the stability and reliability of vulnerability discovery results in the intelligent unmanned system controller program. Parameterization of multiple time-related and runtime-related variables, controlled by a unified fuzzer input test case, eliminates the influence of residual time states and ensures the stability of coverage feedback.

[0105] In one embodiment, the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous sending and receiving programs and adding the blocking communication program is adjusted based on the time constant set by the fuzz tester, and the adjusted test source program is used as the target test program, including:

[0106] Based on the time constant set by the fuzzer, the time variable functions in the test source program of the intelligent unmanned system after building the test drive thread of the synchronous sending and receiving programs and adding the blocking communication program are adjusted; functions or files that affect the stability of fuzzing are recorded in a blacklist, and functions or files corresponding to the target execution thread and the target data packet receiving thread are recorded in a whitelist; by optimizing the instrumentation compiler, selective instrumentation is performed on the test source program of the intelligent unmanned system after building the test drive thread of the synchronous sending and receiving programs and adding the blocking communication program, based on the blacklist and the whitelist, to determine the target test program.

[0107] Selective instrumentation is performed on the source code of the intelligent unmanned system to be tested after adjusting the time variable function to build the synchronous sending and receiving programs, building the test driving thread, and adding the blocking communication program. Figure 6 As shown. An optimized instrumentation compiler is an instrumentation compiler that can selectively instrument programs based on blacklists and whitelists.

[0108] Functions or files that affect the stability of fuzz testing can be related to sensor data. Instrumentation involves inserting additional monitoring code into the program's source code. This code does not affect the core functionality of the program but records key information during program execution, such as which code was executed and the values ​​of variables.

[0109] Because AFL++'s built-in selective instrumentation mechanism is too coarse-grained, its coverage instrumentation mechanism has been optimized to selectively instrument basic block-level code, significantly reducing random sensor / thread noise. While maintaining throughput, instrumentation is only enabled for critical logic such as protocol parsing, command routing, mode switching, and execution paths, suppressing interference from irrelevant thread path coverage and improving signal-to-noise ratio and feedback effectiveness.

[0110] It's understandable that selective instrumentation doesn't involve instrumenting all code in a program, but rather selecting only critical code blocks relevant to the test objective. For example, when testing the protocol security of a drone, instrumentation might focus on the code that parses the Mavlink protocol and the code that executes specific commands based on the parsed results, while ignoring irrelevant code related to sensor data acquisition. This approach obtains effective test information while minimizing the interference of redundant code on program speed and test results, thus improving testing efficiency.

[0111] Based on the above embodiments, the method for vulnerability discovery in the intelligent unmanned system controller program is as follows: Figure 7 As shown.

[0112] In the message structure of the intelligent unmanned system (such as the uORB message structure), add a boolean variable `fromreceiver`, with a default flag of `false`. Add identifier recognition code to the target test program. When the communication data packet corresponding to the intelligent unmanned system sent by the fuzz tester is received and processed by the target data packet receiving thread, the identifier recognition code automatically updates the default flag of the boolean variable to the target flag, which is set to `True`. In the target test program, threads subscribing to the related topics of the boolean variable will maintain the flag of the boolean variable in the broadcast message structure as `True` during subsequent broadcasts. Therefore, the identifier recognition code can determine whether to broadcast the information based on whether the flag of the boolean variable in the broadcast message is the target flag. That is, if the flag of the boolean variable in the broadcast message is `True`, then broadcasting the information is allowed, thus filtering out broadcast topic signals from asynchronous threads.

[0113] Modify the source code of the intelligent unmanned system to be tested to build a test-driven thread, continuously inject the corresponding communication data packets sent by the fuzz tester into the intelligent unmanned system in persistent mode, and use the processing module to perform thread-forced synchronization, message filtering and time variable replacement on the source code to be tested to determine the target test source code.

[0114] Add a blocking communication program to the source code under test to synchronize the test-driven thread and the message receiving thread via blocking communication. Use the source code with the test-driven thread and blocking communication program added as the test source code for the intelligent unmanned system after the test-driven thread and blocking communication program have been built.

[0115] In the test source code of the intelligent unmanned system after constructing the test-driven thread and adding the blocking communication program, two dedicated synchronization semaphores are added: the synchronization send signal PubSend and the synchronization receive signal PubReturn. The message receiving thread broadcasts the PubSend signal to notify the target execution thread to start a single execution cycle. After the target execution thread finishes its current cycle, it broadcasts the PubReturn signal to notify the message receiving thread to receive the next data packet. Blocking code for receiving PubSend is inserted at the main loop entry point of each target execution thread, forcing the thread to wait for the synchronization signal from the message receiving thread before entering a new execution cycle. A PubReturn release instruction is inserted at the main loop exit point of each execution thread, and blocking code for PubReturn is added at the corresponding position in the message receiving thread, forming a complete execution cycle synchronization closed loop. The time variable function, hrt_absolute_time(), is determined from the test source code of the intelligent unmanned system after constructing the synchronization send and receive programs and adding the blocking communication program. Based on the time constant CONST_TIME set by the fuzzer, the time variable functions in the test source program of the intelligent unmanned system after building the synchronous sending and receiving programs and adding the blocking communication program are adjusted. Functions or files that affect the stability of fuzz testing are recorded in a blacklist, while functions or files corresponding to the target execution thread and the target data packet receiving thread are recorded in a whitelist. By optimizing the compiler, selective instrumentation is performed on the test source program of the intelligent unmanned system after the time variable function is adjusted, based on the blacklist and whitelist. The test source program of the intelligent unmanned system after the time variable function is adjusted, after the time variable function is adjusted, is compiled to obtain the target test program.

[0116] An abnormal input data for fuzz testing of an intelligent unmanned system is automatically generated using a fuzz tester. This abnormal input data is then sent to the target test program of the intelligent unmanned system in the form of corresponding communication data packets. Based on a blocking communication method, the test driver thread and the target data packet receiving thread for the corresponding communication data packets of the intelligent unmanned system run synchronously. Other protocol communication data packet receiving threads in the target test program, except for the target data packet receiving thread, are shut down to isolate interference generated by other protocol communication data packet receiving threads. Fuzz testing-related code is identified from the target test program and selectively instrumented to shield interference generated by sensor signals. The target test program receives the corresponding communication data packets of the intelligent unmanned system based on the target data packet receiving thread, and analyzes these packets to determine the execution data. The synchronous sending and receiving programs in the target test program are run, causing the target execution thread and the target data packet receiving thread to run synchronously. The execution data is then executed based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program. The target test program sends the vulnerability discovery results of the intelligent unmanned system controller program to the fuzz tester. The fuzz tester determines the test result of the next round of fuzz testing on the intelligent unmanned system based on the vulnerability discovery results of the intelligent unmanned system controller program, that is, updates the communication data packet and sends the updated communication data packet to the target test program. The target test program then determines the updated test result based on the updated communication data packet.

[0117] The above scheme obtains the communication data packets corresponding to the intelligent unmanned system sent by the fuzzer through the target testing program; the target testing program synchronously runs the test driving thread and the target data packet receiving thread of the intelligent unmanned system's corresponding communication data packets based on a blocking communication method; the test driving thread is used to construct the data packet interface corresponding to the target data packet receiving thread; the target testing program receives the communication data packets corresponding to the intelligent unmanned system based on the target data packet receiving thread, analyzes the communication data packets corresponding to the intelligent unmanned system's corresponding communication data packets, and determines the execution data; the synchronous sending program and synchronous receiving program in the target testing program are run, so that the target execution thread in the target testing program runs synchronously with the target data packet receiving thread, and the execution data is run based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program; the vulnerability mining results of the intelligent unmanned system controller program include the data execution path and the data execution result. This solves the problems of low vulnerability mining efficiency, poor test stability, and insufficient verifiability of vulnerability triggering results in the path coverage-based fuzzing process of intelligent unmanned systems due to their complex architecture and the coupling of their internal mechanisms. The above scheme, when conducting fuzzy testing on intelligent unmanned systems, uses a blocking communication method to synchronously run the test-driven thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets. Simultaneously, the target test program receives the corresponding communication data packets from the intelligent unmanned system through the target data packet receiving thread, analyzes these packets to determine the execution data, and sets up a bidirectional blocking communication method between the input-driven thread and the message-receiving thread. This ensures that after sending test results, the input thread must wait for the receiving thread to complete processing and return an acknowledgment signal, and the receiving thread must also wait for new input data to arrive before continuing processing, thus forming a lockstep operation relationship. A start / stop signal mechanism is introduced between the message-receiving thread and the function execution thread. The system ensures that the function execution thread can only begin execution after receiving a start signal, and sends an end signal to the receiving thread upon completion of the task. The receiving thread then enters the next round of scheduling upon receiving this signal. Through this two-layer synchronization mechanism, the timing drift between threads can be effectively eliminated, ensuring a strict correspondence and controllability between test input, task execution, and result acquisition stages. This avoids problems such as low vulnerability discovery efficiency, poor test stability, and insufficient verifiability of vulnerability triggering results caused by thread asynchrony. It can improve the execution stability and test result reproducibility of the coverage-guided fuzzing process while maintaining the testing efficiency of fuzzing intelligent unmanned systems, thereby ensuring the effectiveness of the coverage-guided mechanism and the verifiability of vulnerability triggering results.

[0118] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0119] Based on the same inventive concept, this application also provides a vulnerability mining device for an intelligent unmanned system controller program, used to implement the vulnerability mining method for the intelligent unmanned system controller program described above. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations of one or more embodiments of the vulnerability mining device for an intelligent unmanned system controller program provided below can be found in the limitations of the vulnerability mining method for the intelligent unmanned system controller program described above, and will not be repeated here.

[0120] In one embodiment, such as Figure 8 As shown, a vulnerability discovery device for an intelligent unmanned system controller program is provided. This device is applied to a computer and includes: a data packet acquisition module 101, a drive thread execution module 102, an execution data determination module 103, a test result determination module 104, a test update module 105, an information filtering module 106, a forced synchronization module 107, and a time variable replacement module 108.

[0121] The data packet acquisition module 101 is used to acquire the corresponding communication data packets sent by the fuzz tester to the intelligent unmanned system through the target test program; the target test program is the intelligent unmanned system controller program.

[0122] The driving thread running module 102 is used to synchronously run the test driving thread and the target data packet receiving thread of the intelligent unmanned system based on the target test program using a blocking communication method; the test driving thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0123] The execution data determination module 103 is used to receive the corresponding communication data packet of the intelligent unmanned system based on the target data packet receiving thread through the target test program, and to analyze the corresponding communication data packet of the intelligent unmanned system to determine the execution data.

[0124] The test result determination module 104 is used to run the synchronous sending program and synchronous receiving program in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and runs the execution data based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program; the vulnerability mining results of the intelligent unmanned system controller program include the data execution path and the data execution result;

[0125] The test update module 105 is used to send the vulnerability discovery results of the intelligent unmanned system controller program to the fuzz tester through the target test program; obtain the update communication data packet sent by the fuzz tester; the update communication data packet is determined by the fuzz tester by adjusting the data in the corresponding communication data packet of the intelligent unmanned system according to the vulnerability discovery results of the intelligent unmanned system controller program; and determine the update test result through the target test program based on the update communication data packet.

[0126] The information filtering module 106 is used to close other protocol communication data packet receiving threads in the target test program except for the target data packet receiving thread, so as to isolate the interference information generated by the other protocol communication data packet receiving threads during operation; to determine the fuzzy test related code corresponding to the communication data packet of the intelligent unmanned system from the target test program, and to selectively instrument the fuzzy test related code to shield the interference information generated by the sensor signal;

[0127] The forced synchronization module 107 is used to construct a test-driven thread in the source program of the intelligent unmanned system under test, and add a blocking communication program to the source program under test; construct a synchronous sending program and a synchronous receiving program in the source program of the intelligent unmanned system under test after constructing the test-driven thread and adding the blocking communication program, and determine the target test program; the synchronous sending program and the synchronous receiving program are used to synchronize the target data packet receiving thread and the target execution thread in the source program of the intelligent unmanned system under test after constructing the test-driven thread and adding the blocking communication program.

[0128] The time variable replacement module 108 is used to construct a synchronous sending program and a synchronous receiving program in the test source program of the intelligent unmanned system after constructing the test driving thread and adding the blocking communication program; it adjusts the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous sending program and synchronous receiving program and adding the blocking communication program based on the time constant set by the fuzz tester, and uses the adjusted test source program as the target test program;

[0129] The time variable replacement module includes a Boolean variable control unit, which is used to add Boolean variables to the message structure of the intelligent unmanned system, add identification codes to the target test program, and after receiving the corresponding communication data packets of the intelligent unmanned system through the target test program based on the target data packet receiving thread, update the variable identifier of the Boolean variable to the target identifier, and perform message filtering based on the identification code to identify the Boolean variable identifier.

[0130] The time variable replacement module also includes a test program adjustment unit, used to adjust the time variable functions in the test source program of the intelligent unmanned system after building the synchronous sending and receiving programs and adding the blocking communication program, based on the time constant set by the fuzz tester; record functions or files that affect the stability of fuzz testing in a blacklist, and record the functions or files corresponding to the target execution thread and the target data packet receiving thread in a whitelist; by optimizing the instrumentation compiler, selectively instrument the test source program of the intelligent unmanned system after building the synchronous sending and receiving programs and adding the blocking communication program, and constructing the message filtering intelligent unmanned system using Boolean variables after adjusting the time variable functions, according to the blacklist and the whitelist, to determine the target test program.

[0131] The various modules in the vulnerability discovery device of the aforementioned intelligent unmanned system controller program can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0132] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 9As shown, the computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a vulnerability discovery method for an intelligent unmanned system controller program. The display unit is used to form a visually visible image and can be a display screen, projection device, or virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0133] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0134] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0135] Step 1: Obtain the corresponding communication data packets sent by the fuzz tester to the intelligent unmanned system through the target test program; the target test program is the intelligent unmanned system controller program;

[0136] Step 2: Using a blocking communication method, the target test program synchronously runs the test driver thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets; the test driver thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0137] Step 3: Through the target test program, the corresponding communication data packets of the intelligent unmanned system are received based on the target data packet receiving thread, and the corresponding communication data packets of the intelligent unmanned system are analyzed to determine the execution data;

[0138] Step 4: Run the synchronous sending and receiving programs in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and run the execution data based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program; the vulnerability discovery results of the intelligent unmanned system controller program include the data execution path and the data execution result.

[0139] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0140] Step 1: Obtain the corresponding communication data packets sent by the fuzz tester to the intelligent unmanned system through the target test program; the target test program is the intelligent unmanned system controller program;

[0141] Step 2: Using a blocking communication method, the target test program synchronously runs the test driver thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets; the test driver thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0142] Step 3: Through the target test program, the corresponding communication data packets of the intelligent unmanned system are received based on the target data packet receiving thread, and the corresponding communication data packets of the intelligent unmanned system are analyzed to determine the execution data;

[0143] Step 4: Run the synchronous sending and receiving programs in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and run the execution data based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program; the vulnerability discovery results of the intelligent unmanned system controller program include the data execution path and the data execution result.

[0144] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0145] Step 1: Obtain the corresponding communication data packets sent by the fuzz tester to the intelligent unmanned system through the target test program; the target test program is the intelligent unmanned system controller program;

[0146] Step 2: Using a blocking communication method, the target test program synchronously runs the test driver thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets; the test driver thread is used to construct the data packet interface corresponding to the target data packet receiving thread.

[0147] Step 3: Through the target test program, the corresponding communication data packets of the intelligent unmanned system are received based on the target data packet receiving thread, and the corresponding communication data packets of the intelligent unmanned system are analyzed to determine the execution data;

[0148] Step 4: Run the synchronous sending and receiving programs in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and run the execution data based on the target execution thread to obtain the vulnerability discovery results of the intelligent unmanned system controller program; the vulnerability discovery results of the intelligent unmanned system controller program include the data execution path and the data execution result.

[0149] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0150] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0151] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0152] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for vulnerability discovery in a controller program of an intelligent unmanned system, characterized in that, The vulnerability discovery method for the intelligent unmanned system controller program is executed by a computer, and the method includes: The target test program is used to obtain the communication data packets corresponding to the intelligent unmanned system sent by the fuzz tester; the target test program is the intelligent unmanned system controller program. The target test program uses a blocking communication method to synchronously run a test-driven thread and a target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets; the test-driven thread is used to construct the data packet interface corresponding to the target data packet receiving thread. The target test program receives the corresponding communication data packets of the intelligent unmanned system based on the target data packet receiving thread, and analyzes the corresponding communication data packets of the intelligent unmanned system to determine the execution data. Run the synchronous sending and receiving programs in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and run the execution data based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program; the vulnerability mining results of the intelligent unmanned system controller program include the data execution path and the data execution result.

2. The method according to claim 1, characterized in that, After obtaining the vulnerability discovery results of the intelligent unmanned system controller program by running the execution data based on the target execution thread, the process further includes: The vulnerability discovery results of the intelligent unmanned system controller program are sent to the fuzz tester through the target testing program; Obtain the updated communication data packet sent by the fuzz tester; the updated communication data packet is determined by the fuzz tester adjusting the data in the corresponding communication data packet of the intelligent unmanned system based on the vulnerability discovery results of the intelligent unmanned system controller program; The target test program determines the update test result based on the update communication data packet.

3. The method according to claim 1, characterized in that, After synchronously running the test drive thread and the target data packet receiving thread corresponding to the intelligent unmanned system's communication data packets based on the blocking communication method, the method further includes: In the target test program, shut down all protocol communication data packet receiving threads except the target data packet receiving thread to isolate interference information generated by the running of other protocol communication data packet receiving threads; The fuzzy test-related code corresponding to the communication data packet of the intelligent unmanned system is determined from the target test program, and the fuzzy test-related code is selectively instrumented to shield the interference information generated by the sensor signal.

4. The method according to claim 1, characterized in that, Before obtaining the corresponding communication data packet for the intelligent unmanned system through the target testing program and sending it via the fuzz tester, the process also includes: A test-driven thread is constructed in the source program of the intelligent unmanned system to be tested, and a blocking communication program is added to the source program to be tested; In the source code of the intelligent unmanned system to be tested after constructing the test-driven thread and adding the blocking communication program, a synchronous sending program and a synchronous receiving program are constructed to determine the target test program; the synchronous sending program and the synchronous receiving program are used to synchronize the target data packet receiving thread and the target execution thread in the source code of the intelligent unmanned system to be tested after constructing the test-driven thread and adding the blocking communication program.

5. The method according to claim 4, characterized in that, The process involves constructing a synchronous sending program and a synchronous receiving program in the source code of the intelligent unmanned system to be tested after building a test-driven thread and adding a blocking communication program, and determining the target test program, including: In the source code of the intelligent unmanned system to be tested, after building the test-driven thread and adding the blocking communication program, build the synchronous sending program and the synchronous receiving program; Based on the time constant set by the fuzz tester, the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous sending program and synchronous receiving program and adding the blocking communication program is adjusted, and the adjusted test source program is used as the target test program.

6. The method according to claim 5, characterized in that, Also includes: Boolean variables are added to the message structure of the intelligent unmanned system, and identification codes are added to the target test program. After the target test program receives the corresponding communication data packets of the intelligent unmanned system based on the target data packet receiving thread, the variable identifier of the Boolean variable is updated to the target identifier, and message filtering is performed based on the identification code to identify the Boolean variable identifier.

7. The method according to claim 6, characterized in that, The adjustment of the time variable function in the test source program of the intelligent unmanned system after constructing the synchronous sending and receiving programs and adding the blocking communication program, based on the time constant set by the fuzz tester, and the use of the adjusted test source program as the target test program, includes: The time variable function in the test source program of the intelligent unmanned system after the synchronous sending and receiving programs are adjusted based on the time constant set by the fuzz tester. Record functions or files that affect the stability of fuzz testing in a blacklist, and record functions or files corresponding to the target execution thread and the target data packet receiving thread in a whitelist; By optimizing the instrumentation compiler, and based on the blacklist and whitelist, selective instrumentation is performed on the source code of the intelligent unmanned system to be tested, which consists of a synchronous sending program and a synchronous receiving program after adjusting the time variable function, a test driving thread after adding a blocking communication program, and a message filtering program constructed using Boolean variables, to determine the target test program.

8. A vulnerability discovery device for an intelligent unmanned system controller program, characterized in that, The vulnerability discovery device for the intelligent unmanned system controller program is applied to a computer, and the device includes: The data packet acquisition module is used to acquire the corresponding communication data packets sent by the fuzz tester to the intelligent unmanned system through the target test program; the target test program is the intelligent unmanned system controller program. The driving thread execution module is used to synchronously run the test driving thread and the target data packet receiving thread of the intelligent unmanned system based on the target test program using a blocking communication method; the test driving thread is used to construct the data packet interface corresponding to the target data packet receiving thread. The execution data determination module is used to receive the corresponding communication data packet of the intelligent unmanned system through the target test program based on the target data packet receiving thread, and to analyze the corresponding communication data packet of the intelligent unmanned system to determine the execution data. The test result determination module is used to run the synchronous sending program and synchronous receiving program in the target test program, so that the target execution thread in the target test program runs synchronously with the target data packet receiving thread, and executes the execution data based on the target execution thread to obtain the vulnerability mining results of the intelligent unmanned system controller program; the vulnerability mining results of the intelligent unmanned system controller program include the data execution path and the data execution result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images