Fuzz testing visual display method and device, computer device, readable storage medium and program product

Abstract

This application relates to a fuzz testing visualization method, apparatus, computer device, computer-readable storage medium, and computer program product. The method includes: acquiring program information of a target test program; the target test program includes at least one function; the program information indicates the number of basic blocks contained in each function and the number of transition paths between basic blocks; generating an overall program graph corresponding to the target test program based on the program information; wherein the overall program graph includes graphical elements representing each function; each graphical element includes graphical sub-elements representing basic blocks in the corresponding function; acquiring a fuzz test log corresponding to the target test program, recording the coverage of basic blocks by the fuzz test seed during fuzz testing of the target test program; color-coding the graphical sub-elements in the overall program graph based on the fuzz test log to generate a program state graph. This method can improve fuzz testing efficiency.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a fuzzy testing visualization display method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] Fuzz testing (or fuzzing) is an automated software testing technique that observes a target program's behavior to uncover potential vulnerabilities or defects by inputting random or anomalous data. Its core objective is to test a program's stability and security when handling unexpected input.

[0003] In current feedback fuzzing, various engineering techniques are constantly improving the speed of seed discovery and allocating resources to more promising seeds, effectively enhancing fuzzing efficiency. The core of feedback fuzzing in related technologies is based on genetic algorithms. These algorithms, with their high degree of randomness, are limited by the search space size and tend to get stuck in local optima after running for a period, making it difficult to explore the program further. Currently, there is a lack of intuitive methods to display the fuzzing state, resulting in the inability to terminate fuzzing promptly even after the seed exploration is complete, thus wasting computational resources and reducing fuzzing efficiency. Summary of the Invention

[0004] Therefore, it is necessary to provide a fuzzing visualization display method, device, computer equipment, computer-readable storage medium, and computer program product that can improve the efficiency of fuzzing testing in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for visualizing fuzz testing, including:

[0006] Obtain program information of the target test program; the target test program includes at least one function; the program information is used to indicate the number of basic blocks contained in each function and the number of transition paths between the basic blocks;

[0007] Based on the program information, a program overall diagram corresponding to the target test program is generated; wherein, the program overall diagram includes graphical elements for representing each function; each graphical element includes graphical sub-elements for representing the basic blocks in the corresponding function;

[0008] Obtain the fuzz test log corresponding to the target test program; the fuzz test log is used to record the coverage of the basic block by the fuzz test seed during the fuzz test of the target test program;

[0009] The graphic sub-elements in the overall program graph are color-coded according to the fuzz test log to generate a program state graph; the brightness of the colors of the graphic sub-elements in the program state graph represents the coverage of the corresponding basic blocks; the program state graph is used to indicate the target fuzz test state corresponding to the target test program.

[0010] In one embodiment, generating the overall program diagram corresponding to the target test program based on the program information includes:

[0011] The graphic elements are arranged according to a preset arrangement rule to obtain an initial overall image; the number of sub-elements of the graphic elements in the central region of the initial overall image is greater than the number of sub-elements of the graphic elements in the non-central region; the number of sub-elements is the number of graphic sub-elements contained in the graphic element.

[0012] Based on the program information, the initial overall diagram is scaled to generate the overall program diagram.

[0013] In one embodiment, scaling the initial overall diagram based on the program information to generate the overall program diagram includes:

[0014] The height scaling factor is determined based on the number of basic blocks, and the width scaling factor is determined based on the number of transfer paths;

[0015] The height and width of the initial overall diagram are scaled according to the height scaling factor and the width scaling factor to obtain the overall program diagram.

[0016] In one embodiment, the program state diagram includes a first program state diagram corresponding to the current time and a second program state diagram corresponding to historical time; the method further includes:

[0017] Based on the first program state diagram and the second program state diagram, the target fuzz test state corresponding to the target test program is output; the target fuzz test state is used to indicate whether to continue performing fuzz testing on the target test program.

[0018] In one embodiment, the step of outputting the target fuzz test state corresponding to the target test program based on the first program state diagram and the second program state diagram includes:

[0019] According to the first program state diagram, a first fuzz test state is obtained; the first fuzz test state is determined based on the color brightness and graphic size of each graphic sub-element in the first program state diagram; the graphic size matches the binary size of the corresponding basic block; the first fuzz test state is used to indicate the extent to which the fuzz test seed has explored the target test program;

[0020] Based on the difference between the first program state diagram and the second program state diagram, a second fuzz test state is obtained; the second fuzz test state is used to indicate the effectiveness of the fuzz test seed in exploring the target test program;

[0021] The target fuzz test state is determined based on the first fuzz test state and the second fuzz test state.

[0022] In one embodiment, obtaining the first fuzz test state based on the first program state diagram includes:

[0023] The first program state diagram is input into a pre-trained neural network, which outputs the first fuzz test state; the pre-trained neural network is trained based on the sample program state diagram and the corresponding fuzz test state label.

[0024] In one embodiment, obtaining the second fuzz test state based on the difference between the first program state diagram and the second program state diagram includes:

[0025] If the difference meets a preset difference threshold, the second fuzzing state is determined to be that the fuzzing seed is effective in exploring the target test program within the current time period; the current time period is the time period between the current moment and the historical moment.

[0026] If the difference does not meet the preset difference threshold, the second fuzz test state is determined to be that the fuzz test seed is invalid for exploring the target test program within the current time period.

[0027] Secondly, this application also provides a fuzz test visualization display device, comprising:

[0028] An information acquisition module is used to acquire program information of a target test program; the target test program includes at least one function; the program information is used to indicate the number of basic blocks contained in each function and the number of transition paths between the basic blocks;

[0029] The generation module is used to generate an overall program diagram corresponding to the target test program based on the program information; wherein, the overall program diagram includes graphical elements for representing each function; each graphical element includes graphical sub-elements for representing the basic blocks in the corresponding function;

[0030] The log acquisition module is used to acquire the fuzz test log corresponding to the target test program; the fuzz test log is used to record the coverage of the basic block by the fuzz test seed during the fuzz test of the target test program;

[0031] The marking module is used to color-mark the graphic sub-elements in the overall program graph according to the fuzz test log, and generate a program state graph; the brightness of the colors of the graphic sub-elements in the program state graph represents the coverage of the corresponding basic blocks; the program state graph is used to indicate the target fuzz test state corresponding to the target test program.

[0032] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the steps of the method described above.

[0033] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the above-described method.

[0034] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the above-described method.

[0035] The aforementioned fuzzing visualization method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire program information of a target test program; the target test program includes at least one function; the program information indicates the number of basic blocks contained in each function and the number of transition paths between basic blocks; based on the program information, a program overall graph corresponding to the target test program is generated; wherein, the program overall graph includes graphical elements used to represent each function; each graphical element includes graphical sub-elements used to represent the basic blocks in the corresponding function; a fuzzing log corresponding to the target test program is acquired; the fuzzing log is used to record the coverage of basic blocks by the fuzzing seed during the fuzzing process against the target test program; based on the fuzzing log, the graphical sub-elements in the program overall graph are color-coded to generate a program state graph; the brightness of the colors of the graphical sub-elements in the program state graph represents the coverage of the corresponding basic blocks; the program state graph is used to indicate the target fuzzing state corresponding to the target test program.

[0036] Thus, by generating an overall program graph corresponding to the target test program based on the number of basic blocks and the number of transition paths between them, the overall program graph includes graphical elements representing each function. Each graphical element includes graphical sub-elements representing the basic blocks in the corresponding function. This allows the overall program status of the target test program to be displayed on a single graph. Furthermore, by utilizing the coverage of basic blocks by the fuzzing seed during fuzzing of the target test program, and marking the coverage of each basic block with bright colors, the execution information of each function and basic block during fuzzing is visualized and presented. This intuitive method of displaying the fuzzing status helps users to promptly end fuzzing after exploring the modular test seed, reducing the waste of computational resources and improving fuzzing efficiency. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart illustrating a fuzz test visualization method in one embodiment;

[0039] Figure 2 This is a flowchart illustrating the steps involved in generating the overall program diagram corresponding to the target test program in one embodiment.

[0040] Figure 3 This is a schematic diagram of a program state diagram in one embodiment;

[0041] Figure 4 This is a flowchart illustrating the steps for outputting the target fuzz test state corresponding to the target test program in one embodiment.

[0042] Figure 5 This is a flowchart illustrating a fuzz test visualization method in another embodiment;

[0043] Figure 6 This is a structural block diagram of a fuzz test visualization display device in one embodiment;

[0044] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0046] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0047] In one embodiment, such as Figure 1 As shown, a fuzz test visualization method is provided. This embodiment illustrates the method by applying it to a computer device. It is understood that the computer device may be a terminal, a server, or a system including both a terminal and a server. In this embodiment, the method includes steps S110 to S140:

[0048] Step S110: Obtain the program information of the target test program.

[0049] The target test program is the program that needs to undergo fuzz testing, and there is at least one target test program. This application uses one of the target test programs as an example for illustration.

[0050] The target test program includes at least one function, and each function includes at least one basic block.

[0051] The program information is used to indicate the number of basic blocks contained in each function and the number of transfer paths between basic blocks.

[0052] In practical applications, the number of transition paths is the same as the number of edges. Each edge corresponds to a jump relationship between two basic blocks, and the number of transition paths is the total number of such jump relationships.

[0053] In practical applications, the number of basic blocks can be represented by nbbs, and the number of transition paths, i.e., the number of edges, can be represented by nedges.

[0054] In a specific implementation, the computer device can obtain the program information of the target test program. In some embodiments, the source code of the target test program can be analyzed by a compiler or static analysis tool to generate a control flow graph (CFG) outputting basic block information, thereby determining the number of basic blocks contained in each function of the target test program and the number of transition paths between basic blocks.

[0055] Step S120: Generate the overall program diagram corresponding to the target test program based on the program information.

[0056] The overall program graph includes graphical elements used to represent each function.

[0057] Each graphical element includes graphical sub-elements that represent the basic blocks in the corresponding function.

[0058] In practical implementation, to visualize the fuzzy testing status of the target test program, functions in the target test program can be represented using graphical elements. Each function corresponds to a graphical element, and each graphical element can be composed of graphical sub-elements. These sub-elements represent the basic blocks within the function. The number of basic blocks contained in each function in the program information determines how many sub-elements each graphical element should contain. By arranging these graphical elements representing each function according to preset rules in the visible area of ​​the canvas, an overall program diagram corresponding to the target test program is generated, allowing the overall program status of the target test program to be displayed on a single diagram.

[0059] The canvas can be understood as the basic page for drawing graphics, on which developers or users can add, edit, and delete various graphic elements.

[0060] Among them, graphic elements and graphic sub-elements can be elements used for drawing graphics, such as points, lines, surfaces, circles, rings, or rectangles.

[0061] It is understandable that when drawing the overall program diagram, the graphic elements and graphic sub-elements should be of the same type. For example, rectangles can be used as the graphic elements and graphic sub-elements of this application.

[0062] In the specific implementation, when generating the overall program diagram, taking rectangles as graphic elements and graphic sub-elements as an example, the length and width of the rectangle are determined by the number of basic blocks (nbbs) and the number of edges (nedges) of the function, respectively. Therefore, the overall program diagram corresponding to the target test program can be generated through the program information of the target test program.

[0063] Step S130: Obtain the fuzz test log corresponding to the target test program.

[0064] The fuzzing log is used to record the coverage of basic blocks by the fuzzing seed during the fuzzing process against the target test program.

[0065] In practice, the computer device can obtain the fuzzing log corresponding to the target test program. The fuzzing log records the fuzzing seeds retained during the fuzzing process, as well as the number of times the bitmap corresponding to each fuzzing seed is triggered.

[0066] The bitmap is used to record the coverage information (such as the execution status of basic blocks) triggered by the fuzzing seed during execution. A bitmap is a sequence of binary bits, each bit corresponding to a coverable unit in the program (usually a basic block or control flow edge; this application uses a basic block as an example). For example, if the target test program has 1000 basic blocks, the bitmap will contain at least 1000 bits, with each bit corresponding to one basic block. When the fuzzing seed triggers a basic block, it means that the basic block has been executed by the test case (or variant test case) corresponding to the fuzzing seed, and is considered a covered basic block; the trigger count of that basic block is then incremented by one. Thus, the coverage (execution status) of basic blocks by the fuzzing seed during fuzzing the target test program can be determined through the fuzzing log.

[0067] In practical applications, theoretically speaking, human perception of numerical changes in images generally falls into three categories: color brightness, length, and area size. The state of fuzz testing primarily refers to the execution status of each fuzz test seed case, the specific coverage of each function in the program, the number of times the covered basic blocks are executed, and the execution status of the control flow and data flow. Fuzz testers and researchers use these conditions to determine the current fuzz test state and decide on the next action. Currently, it is impossible to represent all the aforementioned situations simultaneously with a single diagram, especially since some states are inherently difficult to represent with a single diagram. For example, due to indirect calls between functions, edge coverage can only be displayed at the function level. Furthermore, tree diagrams like data flow graphs and control flow graphs, due to their diverse tree arrangements and varying complexity across different programs, make it difficult to intuitively visualize this information. Therefore, certain trade-offs need to be made in the information displayed. Considering overall presentation and intuitiveness, this application chooses to display the coverage of each basic block within the program during the fuzz testing process. The reason for this choice is that although the method in this application is not as information-rich as the edge, the basic blocks are physically continuous and there is no branch structure, which can be displayed intuitively in a unified one-dimensional image.

[0068] In summary, to intuitively demonstrate the state of fuzz testing, it is best to use numerical values ​​to represent the state, while also displaying the overall program status on a single graph. Based on this principle, this application chooses to display the entire program as a graph, with the coverage of each basic block indicated by color brightness as the fuzz testing state. Users can determine the fuzz testing state by judging the brightness of the graphic sub-elements representing the basic blocks and their coverage of the overall program in the overall program graph.

[0069] Step S140: Color-code the graphic sub-elements in the overall program diagram according to the fuzzy test log to generate the program state diagram.

[0070] In the program state diagram, the brightness of the color of the graphic sub-elements represents the coverage of the corresponding basic blocks.

[0071] The program state diagram is used to indicate the target fuzz test state corresponding to the target test program.

[0072] In practice, the corresponding graphical sub-elements in the overall program graph can be color-coded based on the coverage of basic blocks recorded in the fuzzing log, thus generating a program state graph. In this way, only basic blocks that have been covered (executed) will be color-coded, and the brightness of the color indicates the degree of coverage of the basic block. That is, the brightness of the color is positively correlated with the number of times the basic block is covered; the more times a basic block is covered, the brighter the corresponding graphical sub-elements will be.

[0073] Thus, by observing the brightness of the colors of the graphical sub-elements presented in the program state diagram and the overall coverage of the program (the number of covered basic blocks), the target fuzzing state of the target test program can be determined. This target fuzzing state indicates whether fuzzing should continue to be performed on the target test program. A corresponding program state diagram can be generated for each target test program.

[0074] In the above-described fuzzing visualization method, the following steps are taken: First, program information of the target test program is obtained. The target test program includes at least one function. The program information indicates the number of basic blocks contained in each function and the number of transition paths between basic blocks. Based on the program information, a program overall graph corresponding to the target test program is generated. The program overall graph includes graphical elements representing each function. Each graphical element includes graphical sub-elements representing the basic blocks in the corresponding function. Second, a fuzzing log corresponding to the target test program is obtained. The fuzzing log records the coverage of basic blocks by the fuzzing seed during fuzzing of the target test program. Third, the graphical sub-elements in the program overall graph are color-coded according to the fuzzing log to generate a program state graph. The brightness of the colors of the graphical sub-elements in the program state graph represents the coverage of the corresponding basic blocks. The program state graph indicates the target fuzzing state corresponding to the target test program.

[0075] Thus, by generating an overall program graph corresponding to the target test program based on the number of basic blocks and the number of transition paths between them, the overall program graph includes graphical elements representing each function. Each graphical element includes graphical sub-elements representing the basic blocks in the corresponding function. This allows the overall program status of the target test program to be displayed on a single graph. Furthermore, by utilizing the coverage of basic blocks by the fuzzing seed during fuzzing of the target test program, and marking the coverage of each basic block with bright colors, the execution information of each function and basic block during fuzzing is visualized and presented. This intuitive method of displaying the fuzzing status helps users to promptly end fuzzing after exploring the modular test seed, reducing the waste of computational resources and improving fuzzing efficiency.

[0076] In some embodiments, such as Figure 2 As shown, step S120 involves generating an overall program diagram corresponding to the target test program based on the program information, including steps S210 to S220:

[0077] Step S210: Arrange the graphic elements according to the preset arrangement rules to obtain the initial overall image.

[0078] In the initial overall diagram, the number of child elements in the central region of the graphic element is greater than the number of child elements in the non-central region of the graphic element.

[0079] The number of child elements refers to the number of graphic child elements contained in a graphic element.

[0080] In practice, during the process of generating the overall program diagram corresponding to the target test program based on the program information, the graphical elements representing each function can be arranged according to the preset arrangement rules to obtain the initial overall diagram.

[0081] In general programming, the more basic blocks and edges a function contains, the more development effort is required, and more resources should be allocated during vulnerability discovery. Therefore, these functions should be allocated more area in the image display. Furthermore, since people's eyes generally focus on the center of an image, functions with a large number of basic blocks should be placed in the center. Thus, in the initial overall graph, the number of child elements in the central region is greater than the number of child elements in the non-central regions.

[0082] Step S220: Based on the program information, scale the initial overall diagram to generate the overall program diagram.

[0083] In practice, since different programs contain different numbers of functions and basic blocks, in order to improve the universality of the fuzzy test state determination of this scheme, it is necessary to make the overall program graphs corresponding to different programs have similar outlines. Specifically, this can be achieved by scaling the initial overall graph obtained by arranging the graphic elements so that the overall program graphs corresponding to different programs have similar outlines.

[0084] Therefore, in this embodiment, the initial overall diagram corresponding to the target test program needs to be scaled according to a certain scaling factor to complete the outline drawing of the target test program. Specifically, the scaling factor of the initial overall diagram corresponding to the target test program can be determined based on the program information corresponding to the target test program, and the initial overall diagram can be scaled according to the scaling factor to generate the overall program diagram.

[0085] In some embodiments, scaling the initial overall diagram according to program information to generate a program overall diagram includes: determining a height scaling factor based on the number of basic blocks, determining a width scaling factor based on the number of transfer paths; scaling the height and width of the initial overall diagram according to the height scaling factor and the width scaling factor to obtain the program overall diagram.

[0086] In practice, to ensure that the overall program diagrams corresponding to different programs are similar in outline, it is necessary to ensure the width of the central graphic element in the overall program diagrams corresponding to different programs ( ) and the height of the edge graphic elements ( (This is consistent with the previous point.) After determining the desired width and height, the height scaling factor can be determined based on the number of basic blocks and the desired height. The number of basic blocks used to determine the height scaling factor can refer to the number of basic blocks in the function containing the most basic blocks and the number of basic blocks in the function containing the fewest basic blocks. Simultaneously, the width scaling factor can be determined based on the desired width and the number of transition paths corresponding to each function.

[0087] In this way, the height and width of the initial overall diagram can be scaled according to the height scaling factor and the width scaling factor to obtain the overall diagram of the program corresponding to the target test degree. This makes the outlines of the overall diagrams of the programs corresponding to different target test programs similar, thereby making the fuzzy test state analysis method of this application adaptable to programs with different conditions and improving the accuracy and universality of fuzzy test analysis.

[0088] For ease of understanding by those skilled in the art, a rectangle is used as an example to represent both the graphic element and its sub-elements. Figure 3 A program state diagram corresponding to a specific target test program is provided. As shown in Figure 3, the program state diagram is a symmetrical figure along the x-axis, composed of rectangles (graphical elements). Each rectangle contains several blocks of different brightness (graphical sub-elements). The long rectangles represent functions in the target test program, and the various colored blocks within the rectangles represent the basic blocks contained in the functions. These functions are arranged according to a preset arrangement rule. The overall outline of the program state diagram corresponding to the target test program is black, and only the colored blocks corresponding to the basic blocks that have been executed are colored.

[0089] The length and width of the rectangle are determined by the number of basic blocks (nbbs) and the number of edges (nedges) of the function, respectively. The starting position of the color block inside is determined by the offset of the basic block relative to the function header, the size is determined by the binary size of the basic block, and the color is calculated by the execution status (coverage status) of the basic block.

[0090] All images drawn in this application are plotted strictly according to coordinates. Assuming that for the target test program... It contains a set of functions Each function The number of basic blocks contained is The number of edges contained is The function itself contains 10 bytes. Therefore, the set of the number of basic function blocks within the target test program is: The set of edge counts is .

[0091] Contour algorithms are essentially equivalent to drawing a "global map" of the entire program. As mentioned earlier, the purpose of contour algorithms is to make different programs appear similar overall. The main idea of ​​this application is to first arrange the rectangles corresponding to each function according to certain rules, and then scale them according to a certain proportional coefficient to complete the contour drawing and generate an overall program diagram.

[0092] This application adopts As the basis for the length of the function rectangle This serves as the basis for determining the width of the function rectangle. However, to ensure similarity in the outlines across different programs, it is necessary to... and We need to do some initial processing.

[0093] Given a fixed canvas size, the values ​​on the coordinate axes will not affect the size of the function rectangle in the graph. Figure 3 The actual sizes of the rectangles for each function are calculated proportionally. The length of the entire horizontal axis and the length of the longest rectangle remain constant. However, the width of the center rectangle and the height of the edge rectangles are calculated based on the overall values ​​and will vary depending on the program. To ensure similarity in outline across different programs, the width of the center rectangle in the overall program diagram for each program needs to be consistent (…). ) and the height of the edge rectangle ( Consistent.

[0094] Because of the width of the central rectangle ( ) and the height of the edge rectangle ( The value is independent of the actual length and width of the rectangle, but related to the proportion. Therefore, this application uses an exponential function to calculate the value of the rectangle. and Take a specific power to ensure the width of the central rectangle of the overall program diagram for different programs. ) and the height of the edge rectangle ( Consistent with the target test program. , containing The set of edge counts is The set of basic block counts is To achieve overall contour similarity, it is possible to calculate... The power coefficient is and power coefficient .

[0095] Based on actual observation, assuming the highest height of the canvas is 1 and the overall width is 1, then this application can select... That is, the expected width is The expected height is The selection and setting of these two numbers are not specifically configured; they only need to appear visually appealing. Once the numbers are selected, the overall graph in the subsequent program will have a similar outline. The settings of these two constants may affect the appearance of the outline, but they will not affect the subsequent machine learning process. Function rectangle height coefficient (height scaling factor) The selection is based on The ratio of the highest to the lowest is obtained by working backwards, because... The height on the image remains constant, so as long as it is selected... This ensures that the image contains The height will also be fixed; however, the width coefficient (width scaling factor) of the function rectangle will remain constant. Although its overall horizontal length is also fixed, this length is... The sum is difficult to derive directly from the formula by reverse derivation. Therefore, the algorithm employs a search method, using a small initial step size to search step by step to find the minimum condition that is satisfied. Then, based on the basic block coordinate algorithm and the coloring algorithm, a program state diagram is generated.

[0096] In some embodiments, the program state diagram includes a first program state diagram corresponding to the current moment and a second program state diagram corresponding to a historical moment; the method further includes: outputting a target fuzz test state corresponding to the target test program based on the first program state diagram and the second program state diagram; the target fuzz test state is used to indicate whether to continue performing fuzz testing on the target test program.

[0097] In the specific implementation, the program state diagram includes the first program state diagram corresponding to the current moment and the second program state diagram corresponding to the historical moment, and the time interval between the historical moment and the current moment meets the preset conditions.

[0098] The computer device can output the target fuzz test state corresponding to the target test program based on the first program state diagram and the second program state diagram; the target fuzz test state is used to indicate whether to continue fuzz testing on the target test program. The specific state determination method consists of two parts: a neural network determination algorithm and an image difference determination algorithm.

[0099] In this embodiment, the program state diagram includes a first program state diagram corresponding to the current moment and a second program state diagram corresponding to a historical moment. The target fuzz test state corresponding to the target test program is output through the first and second program state diagrams. The target fuzz test state is used to indicate whether to continue performing fuzz testing on the target test program. Thus, by combining the program state diagram at the current moment and the program state diagram at the historical moment, it is possible to more accurately determine whether it is necessary to continue performing fuzz testing on the target test program.

[0100] In one embodiment, such as Figure 4 As shown, based on the first program state diagram and the second program state diagram, the target fuzzy test state corresponding to the target test program is output, including steps S410 to S430:

[0101] Step S410: Obtain the first fuzz test state according to the first program state diagram.

[0102] The first fuzzy test state is determined based on the color brightness and graphic size of each graphic sub-element in the first program state diagram.

[0103] The size of the graphic is matched with the binary size of the corresponding basic block.

[0104] The first fuzz test state is used to indicate the extent to which the fuzz test seed has explored the target test procedure.

[0105] In practical implementation, the first fuzzy test state can be obtained based on the first program state diagram corresponding to the current moment. Furthermore, a neural network method can be used to determine the extent to which the fuzzy test seed has explored the target test program, thereby judging whether the fuzzy test state of the target test program has exploratory value.

[0106] Specifically, the first program state diagram can be input into a pre-trained neural network. The pre-trained neural network determines the first fuzz test state by the color brightness and graphic size of each graphic sub-element in the first program state diagram. The first fuzz test state is used to indicate the extent to which the fuzz test seed has explored the target test program.

[0107] The pre-trained neural network is trained based on the sample program state diagram and the corresponding fuzzy test state labels.

[0108] The sample program state diagram can include the program state diagram selected as a sample from the program state diagrams obtained in the real fuzz test, and its corresponding fuzz test state label is used to indicate whether the current fuzz test can end.

[0109] In practical applications, the neural network decision-making algorithm consists of three parts: 1. Construction of the neural network training dataset; 2. Construction and training of the neural network; 3. Fuzzy testing state determination algorithm. Among them:

[0110] 1. Construction of neural network training dataset

[0111] The fuzzer used in this application maintains a pending variable, which stores the fuzzing seeds that the fuzzer is interested in and sorts them according to a certain score. When the pending variable is 0, it means that the fuzzer believes that there are no more seeds of interest among the current candidates, that is, it randomly selects a fuzzing mode for the seeds, and at this time the fuzzer believes that the current fuzzing can end.

[0112] 2. Neural Network Construction and Training

[0113] The neural network constructs images as the data to be processed, and this application uses a convolutional neural network architecture. The native resolution of the BinMap (Binary Mapping Graph, in this application referring to the program state graph) is [missing information]. This exceeds the processing capabilities of typical convolutional neural networks, therefore the image needs to be compressed first. Size. Although images are distorted after compression, they can still convey fuzzy test state information. The information loss caused by lossy compression does not affect the judgment of the fuzzy test state. Furthermore, neural network-based image processing often converts high-resolution images into low-resolution images first, so image compression is a common and computationally efficient practice.

[0114] This application is based on the fuzz testing process The changes in variables are used to automatically score the state diagrams of the input sample programs and construct a dataset. Several sample test programs are selected for long-term fuzz testing, generating corresponding program state diagrams as the overall sample program diagram. The sample program state diagram when the variable is not zero is marked as 0, and the corresponding fuzzy test state label is obtained. When the variable is 0, the sample program state diagram is marked as 1, and the corresponding fuzz test state label is obtained. A dataset is constructed and fed into the neural network for training. A fuzz test state label of 1 indicates sufficient exploration, and the fuzz test can be terminated; a fuzz test state label of 0 indicates insufficient exploration, and the fuzz test should continue.

[0115] Judging the test saturation using the sample program state diagram mainly depends on the brightness (lightness) of the colors (graphical sub-elements) and the size of the graphics in the sample program state diagram. All the color blocks in the sample program state diagram are arranged in a square pattern. The convolution kernel is square in shape, and neural networks that process BinMap do not need to recognize shape information.

[0116] The compressed sample program state diagram goes through four layers. Convolutional layers, with each convolutional layer having a kernel size of the classic... This allows for the simultaneous capture of color block information surrounding each pixel. The convolutional kernel stride is 1 to prevent missing image-related information. The convolutional layer calculates a feature vector of coverage based on the brightness, size, and relative position of each color block in the image. A four-layer convolutional neural network was chosen instead of deeper layers because the Binmap image mainly consists of color blocks of various sizes, and the main features to be identified are shallow features such as block color and area; there are no deep features to recognize. After passing through the convolutional layers... Pooling layer, pooling layer size is Pooling layer adopts It can extract the brightest color in a region, thus effectively preserving and processing bright areas in the image. The feature vector obtained after processing by the convolutional neural network is flattened and then fed into three fully connected layers, and finally... The activation function outputs the relevant categories.

[0117] 3. Fuzzy testing state determination algorithm

[0118] The neural network-based fuzzy testing state judgment algorithm generates a fuzzy testing state BinMap (program state graph) at a certain moment based on the fuzzy testing log and related fuzzy testing seeds. Based on the output value of the program state graph (first fuzzy testing state) calculated by the trained neural network, the algorithm judges the exploration value of the fuzzy testing state.

[0119] The input to the state determination algorithm is the fuzzing seed preserved during the fuzzing process and the recorded fuzzing log. The fuzzing log records the number of times the bitmap corresponding to each fuzzing seed is triggered.

[0120] The neural network fuzzing state judgment algorithm collects all fuzzing seeds and fuzzing logs of the fuzzer at a certain moment, draws the corresponding BinMap (program state diagram) and feeds it into the trained neural network, calculates the network output, and determines whether the current fuzzing state is worth continuing to explore based on the algorithm.

[0121] Step S420: Obtain the second fuzzy test state based on the difference between the first program state diagram and the second program state diagram.

[0122] The second fuzz test state is used to indicate the effectiveness of the fuzz test seed in exploring the target test program.

[0123] In practice, the second fuzzy test state can be obtained based on the difference between the first program state diagram and the second program state diagram.

[0124] Specifically, if the difference meets the preset difference threshold, the second fuzz test state is determined to be that the fuzz test seed is valid for exploring the target test program within the current time period; the current time period is the time period between the current moment and the historical moment.

[0125] If the difference does not meet the preset difference threshold, the second fuzz test state is determined to be that the fuzz test seed's exploration of the target test program is invalid within the current time period.

[0126] Specifically, the image difference-based fuzz test state judgment algorithm determines the fuzz tester's exploration of the program within 4 hours by analyzing the difference between the BinMap at a certain moment (such as the current moment) and the BinMap at historical moments (such as 4 hours before the current moment, and the current time period is these 4 hours).

[0127] During the relevant time period of fuzzing, if a basic block that has not been fully explored is further explored, its color will darken; if a new edge (transition path) is explored, its color will brighten. A difference operation is performed on the two images (the first program state diagram and the second program state diagram). If the sum of the elements of the difference matrix is ​​larger than a preset difference threshold, it indicates that the target test program has been explored more fully and effectively during this period; conversely, it indicates that the fuzzer's exploration of the target test program has been less effective during this period. When the sum of the elements of the difference matrix is ​​less than the preset difference threshold, it indicates that the fuzzer has not effectively explored the target test program during this period, which may represent the end of the fuzzing test.

[0128] Step S430: Determine the target fuzz test state based on the first fuzz test state and the second fuzz test state.

[0129] In practice, the target fuzz test state can be determined by combining the first fuzz test state and the second fuzz test state.

[0130] In practical applications, the target fuzzing state can be represented by four state identifiers: State 1, State 2, State 3, and State 4. State 1 indicates that fuzzing can continue, while the other states indicate that fuzzing needs to be stopped. If two consecutive fuzzing state determinations are not in State 1, then fuzzing needs to be stopped and the fuzzer needs to be further checked based on the state.

[0131] This application uses a combination of two methods to determine the fuzzing state: a neural network method to assess the exploratory value of the fuzzing state, and an image differencing method to assess the effectiveness of the fuzzer over a given period. Based on the outputs of the two algorithms, a first fuzzing state is determined for the current fuzzing test. The neural network-based fuzzing state determination algorithm directly analyzes the BinMap (i.e., the first program state diagram) of the current fuzzing state, and determines the first fuzzing state based on the experience learned by the neural network. The image differencing-based algorithm analyzes the BinMap image of the current fuzzing state (i.e., the first program state diagram) and performs matrix difference analysis with the BinMap image of a previous historical moment (i.e., the second program state diagram) to analyze the fuzzer's exploration of the target test program within the current time period, and determines a second fuzzing state for the current fuzzing test. A defect dataset is established for typical applications and validated.

[0132] This application defines four fuzzing states for the target program: State 1, State 2, State 3, and State 4, representing 1) continuing the test, 2) just successfully completing the fuzzing test, 3) already successfully completing the fuzzing test, and 4) abnormally completing the fuzzing test, respectively. The first fuzzing state can be represented by either 1 or 0; the second fuzzing state can also be represented by either 1 or 0. A first fuzzing state of 1 indicates that the target program has been sufficiently explored and the fuzzing test can end; a first fuzzing state of 0 indicates that the target program has not been sufficiently explored and the fuzzing test continues. A second fuzzing state of 1 indicates that the exploration of the target program within the current time period is invalid; a second fuzzing state of 0 indicates that the exploration of the target program within the current time period is valid.

[0133] State 1: Continue fuzz testing: Neural network algorithm gives 0, difference algorithm gives 0.

[0134] State 2: Fuzz test completed normally (just exited): Neural network algorithm gives 1, difference algorithm gives 0.

[0135] State 3: Fuzz test completed normally: Neural network algorithm gives 1, difference algorithm gives 1.

[0136] State 4: Abnormal completion of fuzz test: Neural network algorithm gives 0, difference algorithm gives 1.

[0137] For state 1, the neural network considers the current fuzzing state to be one where there is still room for exploration, and the difference algorithm determines that the fuzzing state of the program has been explored sufficiently within a certain period of time, at which point it can be determined that fuzzing needs to continue.

[0138] For state 2, the neural network considers the current fuzz test state to be completed, but the difference algorithm determines that the fuzz test state of the program has been fully explored within a certain period of time. This situation means that the program has just completed the fuzz test. That is, after a period of exploration, the fuzz tester has just completed the exploration of the program, and this is the best time to end the fuzz test.

[0139] For state 3, whether the neural network judges the fuzz tester's performance based on the current state or the difference algorithm judges the performance over a period of time, it is considered that the fuzz test should be terminated. Therefore, the fuzz test should be terminated at this time.

[0140] For state 4, the neural network believes that there are still unexplored parts in the current fuzzing state. However, the differential algorithm finds that the fuzzer has not made meaningful explorations of the program for a considerable period of time, indicating that the fuzzer's exploration direction is problematic. This causes the fuzzer to keep exploring the target program in the wrong direction. At this point, it is necessary to stop the fuzzer, check the cause, and restart the fuzzing.

[0141] When encountering any situation other than state 1, it indicates that the current fuzz test needs to be stopped. At this time, wait for a preset time (such as 4 hours) as redundancy to prevent false alarms and also to prevent the fuzz tester from discovering a new transfer path in a short period of time, causing the fuzz test to stop.

[0142] The technical solution of this embodiment obtains a first fuzz test state based on a first program state diagram. The first fuzz test state is determined based on the color brightness and graphic size of each graphic sub-element in the first program state diagram. The graphic size matches the binary size of the corresponding basic block. The first fuzz test state is used to indicate the extent to which the fuzz test seed explores the target test program. A second fuzz test state is obtained based on the difference between the first program state diagram and the second program state diagram. The second fuzz test state is used to indicate the effectiveness of the fuzz test seed's exploration of the target test program. The target fuzz test state is determined based on the first fuzz test state and the second fuzz test state.

[0143] Thus, by combining neural network algorithms and differential algorithms to judge the target fuzz test state, using neural network methods to judge whether the fuzz test state has exploratory value, and using image differential methods to judge the effectiveness of the fuzz tester over a period of time, it is possible to more accurately determine whether to stop fuzz testing of the target test program.

[0144] In another embodiment, such as Figure 5 As shown, a fuzz test visualization method is provided. Taking the application of this method to a computer device as an example, the method includes the following steps:

[0145] Step S502: Obtain the program information of the target test program.

[0146] Step S504: Arrange the graphic elements according to the preset arrangement rules to obtain the initial overall image.

[0147] Step S506: Determine the height scaling factor based on the number of basic blocks, and determine the width scaling factor based on the number of transfer paths.

[0148] Step S508: Scale the height and width of the initial overall drawing according to the height scaling factor and the width scaling factor to obtain the overall program drawing.

[0149] Step S510: Obtain the fuzz test log corresponding to the target test program.

[0150] Step S512: Color-code the graphic sub-elements in the overall program diagram according to the fuzzy test log to generate the program state diagram.

[0151] Step S514: Input the first program state diagram into the pre-trained neural network and output the first fuzzy test state.

[0152] Step S516: Obtain the second fuzz test state based on the difference between the first program state diagram and the second program state diagram.

[0153] Step S518: Determine the target fuzz test state based on the first fuzz test state and the second fuzz test state.

[0154] It should be noted that the specific limitations of the above steps can be found in the specific limitations of a fuzz test visualization display method described above.

[0155] In summary, this application proposes a novel drawing method that, while balancing granularity, globality, and information display, creates a unified and intuitive fuzzy test state diagram. It then utilizes a neural network to achieve intelligent fuzzy test state judgment. First, based on the function size, the diagrams are scaled according to certain rules to ensure each target test program has a similar outline. The brightness of the colors represents the execution status of each basic block. This application replaces the traditional edge coverage with basic block coverage. Although this results in the loss of some edge order information, the positions between basic blocks are physically one-dimensional and linear, ensuring a unique display method. While the jump relationships between basic blocks are missing, the entire program can be displayed on a single diagram. Subsequent experimental results show that the lost order information does not affect the fuzzy test state judgment. This application also constructs a related neural network, collects program state diagrams (program state diagrams) from real fuzzy tests, labels them, and trains the neural network. Finally, on the trained neural network, it further implements fuzzy test state judgment and the selection of new fuzzy test seeds. Since this application draws the outlines of different programs to be roughly similar to each other when drawing, the trained neural network has universality. That is, the subsequent judgment of fuzz test state and the selection of new fuzz test seeds do not require a training process, which effectively improves the efficiency of fuzz testing.

[0156] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0157] Based on the same inventive concept, this application also provides a fuzzy testing visualization display device for implementing the fuzzy testing visualization display method described above. The solution provided by this device is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more embodiments of the fuzzy testing visualization display device provided below can be found in the limitations of the fuzzy testing visualization display method described above, and will not be repeated here.

[0158] In one exemplary embodiment, such as Figure 6 As shown, a fuzz testing visualization display device is provided, including: an information acquisition module 610, a generation module 620, a log acquisition module 630, and a tagging module 640, wherein:

[0159] The information acquisition module 610 is used to acquire program information of the target test program; the target test program includes at least one function; the program information is used to indicate the number of basic blocks contained in each function and the number of transfer paths between the basic blocks.

[0160] The generation module 620 is used to generate an overall program diagram corresponding to the target test program based on the program information; wherein, the overall program diagram includes graphical elements for representing each function; each graphical element includes graphical sub-elements for representing the basic blocks in the corresponding function.

[0161] The log acquisition module 630 is used to acquire the fuzz test log corresponding to the target test program; the fuzz test log is used to record the coverage of the basic block by the fuzz test seed during the fuzz test of the target test program.

[0162] The marking module 640 is used to color-mark the graphic sub-elements in the overall program graph according to the fuzz test log, and generate a program state graph; the brightness of the colors of the graphic sub-elements in the program state graph represents the coverage of the corresponding basic blocks; the program state graph is used to indicate the target fuzz test state corresponding to the target test program.

[0163] In one embodiment, the generation module 620 is specifically used to arrange the graphic elements according to a preset arrangement rule to obtain an initial overall image; the number of sub-elements of the graphic elements in the central region of the initial overall image is greater than the number of sub-elements of the graphic elements in the non-central region; the number of sub-elements is the number of graphic sub-elements contained in the graphic element; and the initial overall image is scaled according to the program information to generate the program overall image.

[0164] In one embodiment, the generation module 620 is specifically used to determine a height scaling factor based on the number of basic blocks, and a width scaling factor based on the number of transfer paths; and to scale the height and width of the initial overall diagram based on the height scaling factor and the width scaling factor to obtain the overall program diagram.

[0165] In one embodiment, the program state diagram includes a first program state diagram corresponding to the current moment and a second program state diagram corresponding to a historical moment; the device further includes: a state determination module, configured to output a target fuzz test state corresponding to the target test program based on the first program state diagram and the second program state diagram; the target fuzz test state is used to indicate whether to continue performing fuzz testing on the target test program.

[0166] In one embodiment, the state determination module is specifically configured to obtain a first fuzz test state based on the first program state diagram; the first fuzz test state is determined based on the color brightness and graphic size of each graphic sub-element in the first program state diagram; the graphic size matches the binary size of the corresponding basic block; the first fuzz test state is used to indicate the extent to which the fuzz test seed explores the target test program; a second fuzz test state is obtained based on the difference between the first program state diagram and the second program state diagram; the second fuzz test state is used to indicate the effectiveness of the fuzz test seed's exploration of the target test program; and the target fuzz test state is determined based on the first fuzz test state and the second fuzz test state.

[0167] In one embodiment, the state determination module is specifically used to input the first program state diagram into a pre-trained neural network and output the first fuzz test state; the pre-trained neural network is trained based on the sample program state diagram and the corresponding fuzz test state label.

[0168] In one embodiment, the state determination module is specifically used to determine, when the difference meets a preset difference threshold, that the second fuzz test state is that the fuzz test seed is effective in exploring the target test program within the current time period; the current time period is the time period between the current moment and the historical moment; and to determine, when the difference does not meet the preset difference threshold, that the second fuzz test state is that the fuzz test seed is invalid in exploring the target test program within the current time period.

[0169] The modules in the aforementioned fuzzy testing visualization device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0170] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements a fuzzy testing visualization display method. The display unit of the computer device is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0171] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0172] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0173] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0174] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0175] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0176] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0177] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0178] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for visualizing fuzz testing, characterized in that, The method includes: Obtain program information of the target test program; the target test program includes at least one function; the program information is used to indicate the number of basic blocks contained in each function and the number of transition paths between the basic blocks; Based on the program information, a program overall diagram corresponding to the target test program is generated; wherein, the program overall diagram includes graphical elements representing each function; each graphical element includes graphical sub-elements representing basic blocks in the corresponding function; including: arranging the graphical elements according to a preset arrangement rule to obtain an initial overall diagram; the number of sub-elements of the graphical elements in the central region of the initial overall diagram is greater than the number of sub-elements of the graphical elements in the non-central region; the number of sub-elements is the number of graphical sub-elements contained in the graphical element; determining a height scaling factor based on the number of basic blocks, and determining a width scaling factor based on the number of transfer paths; scaling the height and width of the initial overall diagram according to the height scaling factor and the width scaling factor to obtain the program overall diagram; Obtain the fuzz test log corresponding to the target test program; the fuzz test log is used to record the coverage of the basic block by the fuzz test seed during the fuzz test of the target test program; The graphic sub-elements in the overall program graph are color-coded according to the fuzz test log to generate a program state graph. The brightness of the colors of the graphic sub-elements in the program state graph represents the coverage of the corresponding basic blocks. The program state graph is used to indicate the target fuzz test state corresponding to the target test program. The brightness of the colors is positively correlated with the coverage count of the corresponding basic blocks. The program state graph includes a first program state graph corresponding to the current time and a second program state graph corresponding to historical time. Based on the first program state diagram and the second program state diagram, the target fuzz test state corresponding to the target test program is output; the target fuzz test state is used to indicate whether to continue performing fuzz testing on the target test program.

2. The method according to claim 1, characterized in that, The step of outputting the target fuzzy test state corresponding to the target test program based on the first program state diagram and the second program state diagram includes: According to the first program state diagram, a first fuzz test state is obtained; the first fuzz test state is determined based on the color brightness and graphic size of each graphic sub-element in the first program state diagram; the graphic size matches the binary size of the corresponding basic block; the first fuzz test state is used to indicate the extent to which the fuzz test seed has explored the target test program; Based on the difference between the first program state diagram and the second program state diagram, a second fuzz test state is obtained; the second fuzz test state is used to indicate the effectiveness of the fuzz test seed in exploring the target test program; The target fuzz test state is determined based on the first fuzz test state and the second fuzz test state.

3. The method according to claim 2, characterized in that, The step of obtaining the first fuzz test state based on the first program state diagram includes: The first program state diagram is input into a pre-trained neural network, which outputs the first fuzz test state; the pre-trained neural network is trained based on the sample program state diagram and the corresponding fuzz test state label.

4. The method according to claim 2, characterized in that, The step of obtaining the second fuzz test state based on the difference between the first program state diagram and the second program state diagram includes: If the difference meets a preset difference threshold, the second fuzzing state is determined to be that the fuzzing seed is effective in exploring the target test program within the current time period; the current time period is the time period between the current moment and the historical moment. If the difference does not meet the preset difference threshold, the second fuzz test state is determined to be that the fuzz test seed is invalid for exploring the target test program within the current time period.

5. A fuzzy testing visualization display device, characterized in that, The device includes: An information acquisition module is used to acquire program information of a target test program; the target test program includes at least one function; the program information is used to indicate the number of basic blocks contained in each function and the number of transition paths between the basic blocks; The generation module is used to generate an overall program diagram corresponding to the target test program based on the program information; wherein, the overall program diagram includes graphical elements for representing each function; each graphical element includes graphical sub-elements for representing the basic blocks in the corresponding function; The generation module is specifically used to arrange the graphic elements according to a preset arrangement rule to obtain an initial overall image; the number of sub-elements of the graphic elements in the central region of the initial overall image is greater than the number of sub-elements of the graphic elements in the non-central region; the number of sub-elements is the number of graphic sub-elements contained in the graphic element; a height scaling factor is determined based on the number of basic blocks, and a width scaling factor is determined based on the number of transfer paths; the height and width of the initial overall image are scaled according to the height scaling factor and the width scaling factor to obtain the overall program image; The log acquisition module is used to acquire the fuzz test log corresponding to the target test program; the fuzz test log is used to record the coverage of the basic block by the fuzz test seed during the fuzz test of the target test program; A marking module is used to color-mark the graphical sub-elements in the overall program graph according to the fuzz test log, generating a program state graph; the brightness of the colors of the graphical sub-elements in the program state graph represents the coverage of the corresponding basic blocks; the program state graph is used to indicate the target fuzz test state corresponding to the target test program; wherein, the brightness of the colors is positively correlated with the coverage count of the corresponding basic blocks; the program state graph includes a first program state graph corresponding to the current time and a second program state graph corresponding to historical time. The state determination module is used to output the target fuzz test state corresponding to the target test program based on the first program state diagram and the second program state diagram; the target fuzz test state is used to indicate whether to continue to perform fuzz testing on the target test program.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images