Fuzzy test method and device, equipment, medium and model training method

Abstract

The invention relates to a fuzzy testing method and device, equipment, a medium and a model training method. The method comprises the steps that a seed file is obtained based on a trained seed generation model, fuzzy testing is conducted on a target application through the seed file to obtain a testing result of the target application, and the seed generation model is obtained by training an initial generation model through a target loss function based on a judgment result; the judgment result is a result obtained by calling an initial generation model to process the random noise file to obtain a simulation seed file and calling a target judgment model to judge the simulation seed file, and the target judgment model is used for judging the probability that the input seed file belongs to a real seed file of the target application. By adopting the method, the seed generation model can learn the complex data distribution and the internal grammar structure of the real seed file of the target application through the antagonism training of the seed generation model and the target discrimination model, so that the test efficiency and the vulnerability discovery capability are enhanced.

Description

Technical Field

[0001] This application relates to the field of fuzzy testing technology, and in particular to a fuzzy testing method, apparatus, equipment, medium, and model training method. Background Technology

[0002] Fuzzing is an automated software testing technique designed to trigger potential program defects or security vulnerabilities by feeding unexpected, malformed, or randomly generated data into a target application. Seed generation is a core component of the fuzzing process, aiming to build or select high-quality seed files to enhance vulnerability discovery capabilities.

[0003] Current seed generation techniques primarily generate new test cases by randomly flipping, inserting, and deleting bytes in an initial seed file. However, due to their inherent randomness, these methods are inefficient when handling complex software inputs, and the quality of the generated seed sets varies greatly, making it difficult to meet the needs of large-scale, in-depth testing and thus hindering the effective triggering of deep vulnerabilities in target applications. Summary of the Invention

[0004] Therefore, it is necessary to provide a fuzzing method, apparatus, equipment, medium, and model training method that can improve testing efficiency and vulnerability discovery capabilities to address the aforementioned technical problems.

[0005] Firstly, this application provides a fuzz testing method, including:

[0006] Seed files are obtained based on the trained seed generation model;

[0007] The target application is fuzz-tested using the seed file to obtain the test results of the target application;

[0008] The seed generation model is obtained by training an initial generation model using a target loss function based on the discrimination result; the discrimination result is obtained by processing a random noise file with the initial generation model to obtain a simulated seed file, and then using the target discrimination model to discriminate the simulated seed file; the target discrimination model is used to determine the probability that the input seed file belongs to the real seed file corresponding to the target application.

[0009] In one embodiment, the training process of the seed generation model includes:

[0010] Obtain the sample seed file corresponding to the target application;

[0011] The initial discrimination model is trained using the sample seed file and the random noise file to obtain the target discrimination model;

[0012] The initial generation model is invoked to process the random noise file, resulting in a simulation seed file;

[0013] The target discrimination model is invoked to discriminate the simulated seed file, and the discrimination result of the simulated seed file is obtained;

[0014] Based on the discrimination result, the initial generation model is trained using the objective loss function to obtain the trained seed generation model.

[0015] In one embodiment, obtaining the sample seed file corresponding to the target application includes:

[0016] Obtain the original seed file set corresponding to the target application;

[0017] The target application is fuzz-tested using each original seed file in the original seed file set to obtain the test results for each original seed file.

[0018] Based on the test results, the original seed file that triggers the target application and / or the new crash path is determined from the original seed file set, thus obtaining the sample seed file.

[0019] In one embodiment, training an initial discrimination model using the sample seed file and random noise file to obtain the target discrimination model includes:

[0020] The sample seed file is converted to a different format to obtain sample matrix data;

[0021] The random noise file is converted to a different format to obtain noise matrix data;

[0022] The initial discrimination model is trained using the sample matrix data and the noise matrix data to obtain the target discrimination model.

[0023] In one embodiment, the process of converting the format of the sample seed file to obtain sample matrix data includes:

[0024] The sample seed file is read in binary format to obtain sample binary data;

[0025] The sample binary data is subjected to character encoding to obtain sample character data;

[0026] After mapping the sample character data to sample numerical data, the sample numerical data is aggregated and normalized to obtain the sample matrix data.

[0027] In one embodiment, obtaining the seed file based on the trained seed generation model includes:

[0028] Generate seed matrix data based on the trained seed generation model;

[0029] The seed matrix data is subjected to inverse normalization and decomposition to obtain seed numerical data;

[0030] After the seed numerical data is reverse mapped to seed character data, the seed character data is decoded to obtain the seed file.

[0031] Secondly, this application provides a model training method, which includes:

[0032] The initial generation model is called to process the random noise file to obtain the simulation seed file;

[0033] The target discrimination model is invoked to discriminate the simulated seed file, and the discrimination result of the simulated seed file is obtained;

[0034] Based on the discrimination results, the initial generation model is trained using the target loss function to obtain the seed generation model.

[0035] Thirdly, this application also provides a fuzz testing apparatus, comprising:

[0036] The generation module is used to obtain seed files based on the trained seed generation model.

[0037] The testing module is used to perform fuzz testing on the target application using the seed file;

[0038] The seed generation model is obtained by processing a random noise file using an initial generation model to obtain a simulated seed file, then using a target discrimination model to discriminate the simulated seed file to obtain a discrimination result. Based on the discrimination result, the initial generation model is trained using a target loss function. The target discrimination model is used to determine the probability that the input seed file belongs to the real seed file corresponding to the target application.

[0039] Fourthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the fuzz testing method provided in the first aspect of this application or the model training method provided in the second aspect of this application.

[0040] Fifthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the fuzz testing method provided in the first aspect of this application or the model training method provided in the second aspect of this application.

[0041] Sixthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the fuzz testing method provided in the first aspect of this application or the model training method provided in the second aspect of this application.

[0042] The aforementioned fuzzing method, apparatus, device, medium, and model training method obtain seed files based on a trained seed generation model. These seed files are then used to perform fuzzing on a target application to obtain test results. The seed generation model is trained using a target loss function based on the discrimination results. The discrimination results refer to the results obtained by processing random noise files using the initial generation model to obtain simulated seed files, and then using a target discrimination model to judge these simulated seed files. The target discrimination model can be used to determine the probability that an input seed file belongs to the real seed file corresponding to the target application. This application, through adversarial training of the seed generation model and the target discrimination model, enables the seed generation model to learn the complex data distribution and inherent syntactic structure of the real seed files of the target application. During training, the objective function of the seed generation model is optimized based on the discrimination results of the target discrimination model, ensuring the structural fidelity and authenticity of the generated simulated seed files. This improves the input quality and code coverage of fuzzing, thereby enhancing testing efficiency and vulnerability discovery capabilities. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a diagram illustrating the application environment of a fuzz testing method in one embodiment.

[0045] Figure 2 This is a flowchart illustrating a fuzz testing method in one embodiment;

[0046] Figure 3 This is a schematic diagram of the process of obtaining the seed generation model in one embodiment;

[0047] Figure 4This is a schematic diagram of the process for obtaining a sample seed file in one embodiment;

[0048] Figure 5 This is a flowchart illustrating the process of obtaining the target discrimination model in one embodiment;

[0049] Figure 6 This is a schematic diagram of the process for obtaining sample matrix data in one embodiment;

[0050] Figure 7 This is a schematic diagram of the process for obtaining a seed file in one embodiment;

[0051] Figure 8 This is a schematic diagram of the process for obtaining the seed generation model in another embodiment;

[0052] Figure 9 This is a structural block diagram of a fuzzy testing device in one embodiment;

[0053] Figure 10 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0056] The fuzz testing method provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located on a cloud or other network server. The data storage system can be used to store the data required by server 104 when executing fuzzing methods. Terminal 102 or server 104 can pre-train different seed generation models for different target applications. When fuzzing a target application, a seed file is obtained based on the pre-trained seed generation model corresponding to that target application. The seed file is then used to perform fuzzing on the target application to obtain the test results.

[0057] Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, and projection equipment. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted displays. Head-mounted displays can be virtual reality (VR) devices, augmented reality (AR) devices, and smart glasses. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0058] In one exemplary embodiment, such as Figure 2 As shown, a fuzz testing method is provided, which can be applied to... Figure 1 Taking the server in the example, the explanation includes the following steps 202 and 204. Wherein:

[0059] Step 202: Obtain the seed file based on the trained seed generation model.

[0060] The seed file is the basic data that drives the fuzzing process. When fuzzing a target application, the seed file for that target application is usually a valid file or data package that conforms to the input specifications of that target application.

[0061] The seed generation model in this application embodiment can adopt a machine model based on deep learning. After training, the seed generation model can learn the complex structure and inherent grammatical rules of the input files (such as PDFs, images, network protocol packets, etc.) required by the target application.

[0062] During the training phase, the seed generation model is trained on the initial generation model using the target loss function based on the discrimination result. The discrimination result refers to the result obtained by processing the random noise file using the initial generation model to obtain a simulated seed file, and then using the target discrimination model to discriminate the simulated seed file.

[0063] The random noise file refers to the random vector or data block input to the initial generative model, typically sampled from a predefined latent space (e.g., uniform or Gaussian distribution). The simulated seed file is the output file synthesized by the initial generative model using the random noise file as input. The simulated seed file aims to mimic the format and structure of the target application's real seed file, but may contain grammatical errors or non-standard malformed data in the early stages of training; it is an intermediate product generated by the generative model during the learning process. The discrimination result of the simulated seed file can be used to characterize the similarity or authenticity between the simulated seed file and the target application's real seed file. The target loss function can be used to quantify the difference between the discrimination result of the simulated seed file and the expected result. The server can obtain the target loss function value based on the discrimination result of the simulated seed file and adjust the parameters of the initial generative model accordingly, so that the simulated seed file generated by the initial generative model tends to be consistent with the real seed file under the discrimination of the target discrimination model.

[0064] In this embodiment, the target discrimination model can be used to determine the probability that an input seed file belongs to the real seed file corresponding to the target application. The real seed file corresponding to the target application can be a valid sample file collected from the actual operating environment of the target application or a pre-set valid sample file that conforms to the strict input format specifications of the target application.

[0065] For example, the server initializes an initial generation model using a deep learning machine learning architecture for the target application. The server inputs a random noise file into the initial generation model, and through an internal mapping mechanism, obtains a simulated seed file. The server then inputs the simulated seed file into a target discriminant model to obtain a discrimination result quantifying its realism. Based on this discrimination result, the loss gradient of the initial generation model is calculated using a preset target loss function. The true probability of the simulated seed file indicated by the discrimination result is inversely proportional to the target loss function value; that is, if the target discriminant model determines a simulated seed file has a low true probability, the loss function value of the initial generation model will increase. The server uses backpropagation and optimization algorithms to adjust the weight parameters of the initial generation model, and through an adversarial training loop, gradually converges the initial generation model to obtain a seed generation model capable of generating seed files with high realism and high coverage.

[0066] Step 204: Use the seed file to perform fuzz testing on the target application to obtain the test results of the target application.

[0067] The test results can refer to the performance and security-related data obtained by monitoring and collecting the runtime behavior of the target application during the fuzz test. These data can include code coverage data, execution path information, crash information, and abnormal termination information of the target application.

[0068] For example, the server imports a seed file into the corpus of a pre-defined fuzzing tool. This fuzzing tool can be a coverage-guided gray-box fuzzing tool. The fuzzing tool performs program instrumentation on the target application, selects a seed file from the corpus, and uses its mutation engine to perform structure-aware or random mutation operations on the seed file to generate a new test sample. This test sample is then input into the target application and executed, with the program status monitored in real time to determine whether the sample triggers a new execution path or causes abnormal events such as program crashes, thus obtaining the test results for the target application.

[0069] In the aforementioned fuzzing method, a seed file is obtained based on a trained seed generation model. This seed file is then used to perform fuzzing on the target application to obtain the test results. The seed generation model is trained on an initial generation model using a target loss function based on the discrimination results. The discrimination results refer to the results obtained by processing a random noise file using the initial generation model to obtain a simulated seed file, and then using a target discrimination model to judge the simulated seed file. The target discrimination model can be used to determine the probability that the input seed file belongs to the real seed file corresponding to the target application. This embodiment of the application, through adversarial training of the seed generation model and the target discrimination model, enables the seed generation model to learn the complex data distribution and inherent syntactic structure of the real seed file of the target application. During training, the objective function of the seed generation model is optimized based on the discrimination results of the target discrimination model, ensuring that the generated simulated seed file possesses structural fidelity and authenticity. This improves the input quality and code coverage of fuzzing, thereby enhancing testing efficiency and vulnerability discovery capabilities.

[0070] The following section will use the Wasserstein Generative Adversarial Network (WGAN) structure for both the seed generation model and the target discrimination model as an example to further illustrate this application.

[0071] In one exemplary embodiment, such as Figure 3 As shown, the training process of the seed generation model includes steps 302 to 310. Wherein:

[0072] Step 302: Obtain the sample seed file corresponding to the target application.

[0073] The sample seed file can refer to an input file that fully conforms to its format specifications and syntax rules, collected from the actual operating environment of the target or from a pre-prepared set of valid inputs.

[0074] For example, for a target application PDF reader, the server can extract sample seed files for the target application from publicly available test datasets, real-world application logs, or through a pre-constructed corpus. These sample seed files are used as input to train the target discrimination model (i.e., the discriminator or critic in WGAN) and to guide the initial generative model's learning, thus establishing the real seed files or positive samples required for fuzz testing of the target application.

[0075] Step 304: Train the initial discrimination model using the sample seed file and random noise file to obtain the target discrimination model.

[0076] For example, the server initializes an initial generation model and an initial discrimination model, inputs a random noise file into the initial generation model, obtains the fake seed file output by the initial generation model, and then uses the sample seed file and its real seed label, the fake seed file and its fake seed label to train the initial discrimination model to obtain the target discrimination model.

[0077] For example, the server uses a multilayer perceptron (MLP) as the network structure for both the initial generator model and the initial discriminator model. The server inputs a random noise file into the initial generator model to obtain a fake seed file. The server inputs a sample seed file into the initial discriminator model to obtain a score for the sample seed file. The server inputs the fake seed file into the initial discriminator model to obtain a score for the fake seed file.

[0078] The server can obtain a first loss value based on the rating results of the sample seed file and the fake seed file. For example, it can calculate the difference between the rating of the seed file and the rating of the sample seed file. The server then performs random interpolation on the sample and fake seed files to obtain an interpolated seed file. This interpolated seed file is input into the initial discrimination model to obtain its rating. The server then calculates the gradient of the initial discrimination model's output rating at the interpolated seed file with respect to the interpolated seed file itself, and obtains the norm of this gradient. The server calculates the square of the difference between this norm and a preset ideal value, multiplies it by a penalty coefficient, and obtains the second loss value. The server combines the first and second loss values ​​to obtain the total loss value. By minimizing the total loss value, the server adjusts the parameters of the initial discrimination model to obtain the target discrimination model.

[0079] Step 306: Call the initial generation model to process the random noise file to obtain the simulation seed file.

[0080] The simulated seed file can refer to the output file generated by the network through mapping transformation after the current initial generation model receives random noise as input, and it can be used as a fake sample generated in the current training state.

[0081] Step 308: Call the target discrimination model to discriminate the simulated seed file and obtain the discrimination result of the simulated seed file.

[0082] The discrimination result of the simulated seed file can refer to the score result output by the target discrimination model after receiving the simulated seed file as input and performing forward computation through the network. This score result is used to characterize the realism of the simulated seed file and is negatively correlated with the Wasserstein distance between the simulated seed file and the real seed file corresponding to the target application.

[0083] Step 310: Based on the discrimination results, the initial generation model is trained using the target loss function to obtain the trained seed generation model.

[0084] The target loss function can refer to the loss function used in WGAN to train the initial generative model. It can be the negative average of the discrimination results of the simulated seed file, which aims to guide the generative model to minimize the Wasserstein distance.

[0085] For example, the server uses the negative value of the discrimination result as the target loss value of the initial generator model. To minimize this target loss value, the server performs backpropagation, calculating the gradient of the loss relative to all weights and biases of the initial generator model. The server then uses an optimizer to update the parameters of the initial generator model along the gradient direction, resulting in a seed generator model.

[0086] In this embodiment, a Wasserstein Generative Adversarial Network (WGAN) is used to learn the features of valuable files and generate corresponding seed files. WGAN has the ability to automatically learn features from the training set, eliminating the need for tedious feature selection and thus saving significant time. Secondly, WGAN can flexibly select appropriate machine learning models as its generation and discrimination models. Analysis of different model characteristics revealed that Multilayer Perceptrons (MLPs) focus more on processing each quantitative value in the data matrix, while Convolutional Neural Networks (CNNs) focus more on the global or local features of the data matrix. To construct the optimal-performing model, these two neural networks were tested. The results show that, in the current application scenario, choosing MLP as the generation and discrimination model for WGAN achieves better performance than CNN, and requires less training time. Therefore, MLP is chosen as the core model architecture, and a seed generation model for generating valuable seed files is trained based on the collected training data.

[0087] In order to enable the trained seed generation model to generate high-value seed files, this application embodiment can collect input files that trigger unique crashes or new paths as training data to ensure that the input files in the training set are valuable. If the quality of the training set is not high, the seed generation model may not be able to effectively learn the key features of valuable input files, thereby affecting its generation ability.

[0088] In one exemplary embodiment, such as Figure 4 As shown, step 302 includes steps 402 to 406. Wherein:

[0089] Step 402: Obtain the original seed file set corresponding to the target application.

[0090] The original seed file set can refer to the initial set of basic input files collected to initiate the fuzzing process.

[0091] For example, the server obtains or extracts input files that conform to the application's format specifications and syntax rules from the target application's public test set, standard input samples, or a pre-prepared valid corpus to obtain the original seed file set.

[0092] Step 404: Use each original seed file in the original seed file set to perform fuzz testing on the target application and obtain the test results for each original seed file.

[0093] For example, the server sequentially takes each original seed file in the original seed file set as input to run the target application and monitors and records the execution status of the target application in real time, including whether the program terminates abnormally (crashes) and the new execution path to which the program code is overwritten, thereby obtaining the test results corresponding to each original seed file.

[0094] Step 406: Based on the test results, determine the original seed file that triggers the unique crash path and / or new crash path of the target application from the original seed file set, and obtain the sample seed file.

[0095] A unique crash path refers to an input file that causes the target application to enter an abnormal termination state that has never occurred before. A new crash path refers to a file that causes the program to crash during testing, and the program execution path of the crash is not found in previous tests. Sample seed files refer to a high-value subset selected from the original seed file set, that is, those input files that have been proven to trigger unique or new program errors and execution paths.

[0096] For example, based on the program execution state and coverage information indicated by each test result, the server identifies the original seed file that caused the unique crash path of the target application, as well as the original seed files that can explore new crash paths. The server filters these identified high-value original seed files from the original seed file set and defines their set as the sample seed files required for subsequent training.

[0097] Understandably, for multiple applications that process the same input format (e.g., MP3 files), fuzzing can be performed on them simultaneously to simplify the construction of the training set and significantly increase the diversity of input files in the training set. Furthermore, because fuzzing programs can run in parallel, multiple valuable files can be quickly collected for a single input file format.

[0098] In this embodiment, by collecting and utilizing the original seed file set to perform fuzz testing on the target application, and selecting the original seed files that trigger a unique crash path and / or a new path as sample seed files based on the test results, it is possible to ensure that the input files in the training set have high value. This allows the trained seed generation model to effectively learn the key features of high-value files, ultimately generating high-value seed files. Traditional seed selection strategies struggle to quickly and effectively generate high-quality seed sets, resulting in mutated test cases failing to reach deeper paths and trigger more security vulnerabilities. Current vulnerability mining demands high input quality, requiring extensive manual construction or selection of high-quality seeds. However, traditional automated seed generation methods are too random, lack semantic understanding of the input, are inefficient, and produce inconsistent seed quality, making them unsuitable for complex software testing needs.

[0099] In other embodiments, the process of obtaining sample seed files and the fuzzing process can form a training closed loop. After the seed generation model is trained, the seed files it generates can be used as input to the fuzzing tool, helping the tool discover new crashes and new execution paths of the target application. Therefore, after obtaining seed files based on the trained seed generation model and performing fuzzing on the target application using the seed files, the server can also add seed files that trigger new unique crashes or cover previously undiscovered new execution paths, discovered by the fuzzing tool in a new round of testing, as new high-value files to the sample seed file set, thereby continuously optimizing and enhancing the training set, and using the optimized training set to optimize the discriminative and generative models.

[0100] To handle files with variable formats or sizes, embodiments of this application can convert sample seed files in the original training data into matrices of a uniform type, making the seed generation model easily scalable in practice.

[0101] In one exemplary embodiment, such as Figure 5 As shown, step 304 includes steps 502 to 506. Wherein:

[0102] Step 502: Convert the format of the sample seed file to obtain sample matrix data.

[0103] Among them, sample matrix data refers to data that is converted into a two-dimensional or multi-dimensional matrix form with fixed dimensions and uniform numerical representation after the contents of the original sample seed file (which may have different formats or sizes) are preprocessed and format unified.

[0104] For example, the server takes the sample seed file obtained in step 406 as input, reads and parses its file content, performs a series of transformation operations, including but not limited to padding or cropping to achieve a uniform file size, and converts the original byte data of the file content into a numerical representation such as ASCII values ​​or normalized values, and finally represents the processed data as sample matrix data with fixed rows and columns.

[0105] Step 504: Convert the format of the random noise file to obtain noise matrix data.

[0106] In this context, noise matrix data refers to the random noise file used as input to the generative model, which, after format conversion, forms a matrix with fixed dimensions and a uniform numerical representation. This matrix represents the latent space input of the model generation process, and its dimension is typically much smaller than that of the sample matrix data.

[0107] For example, the server samples random noise files from a predetermined random distribution (such as a Gaussian or uniform distribution), performs format conversion on them, and ensures that the final form is noise matrix data with a fixed dimension, which must match the number of neurons in the input layer of the initial generative model.

[0108] Step 506: Train the initial discrimination model using the sample matrix data and noise matrix data to obtain the target discrimination model.

[0109] For example, the server inputs the noise matrix data into the current initial generative model to obtain pseudo matrix data. The server uses the sample matrix data as the real input and the pseudo matrix data as the generative input, and through the loss function of the discriminant model in WGAN, with the goal of minimizing the total loss, it iteratively updates the weights and biases of the initial discriminant model multiple times until the discriminant model can stably estimate the Wasserstein distance, thus obtaining the target discriminant model.

[0110] In this embodiment, by converting sample seed files and random noise files with variable formats or file sizes into fixed-dimensional sample matrix data and noise matrix data respectively, a unified training data format can be achieved, enabling machine learning models such as multilayer perceptrons (MLPs) to process unstructured or variable-length files, thereby improving the scalability and applicability of the seed generation model in practice.

[0111] In practical applications, to handle diverse input formats and seed files of varying sizes, embodiments of this application can establish a unified data reading and representation method to avoid the complexity of adjusting the reading mode individually for each file format. Since the training set may contain corrupted files, traditional parsing methods that rely on specific formats (such as reading BMP files as three-dimensional matrices) are unreliable in many application scenarios. Based on the principle that machine learning algorithms are better at handling quantitative values ​​rather than random values ​​in matrices, it is necessary to determine how to convert various file types into a unified matrix format.

[0112] The embodiments of this application express key information in the training file in binary form, such as file header identifiers (Magic Bytes) used to identify file type and format. These can be represented and input in their original binary numerical form, which can ensure that the machine learning model can more effectively capture and learn these key byte features that control the execution path of the program.

[0113] The following section will continue to describe the steps for data transformation of the sample seed files in the original training data.

[0114] In one exemplary embodiment, such as Figure 6 As shown, step 502 includes steps 602 to 606. Wherein:

[0115] Step 602: Read the sample seed file in binary format to obtain sample binary data.

[0116] Among them, sample binary data refers to the data sequence obtained by the server reading and storing the original sample seed file as a continuous raw byte stream without performing any format parsing or interpretation.

[0117] For example, the service reads the sample seed file in full in binary mode (i.e., without relying on a specific encoding or file format) to obtain the sample binary string.

[0118] Step 604: Perform character encoding on the sample binary data to obtain sample character data.

[0119] Among them, sample character data refers to the string sequence obtained by converting sample binary data (i.e., the original byte stream) through a preset character encoding scheme (such as Base64 or ASCII encoding).

[0120] For example, to address the difficulty in identifying end boundaries in binary data streams, the server can use Base64 encoding to encode the sample binary string, mapping the byte stream data of the sample binary string into a sequence of sample character data composed of a unified character set. The sample character data generated by Base64 encoding can include 64 standard characters and the "=" character used for padding.

[0121] Step 606: After mapping the sample character data to sample numerical data, the sample numerical data is aggregated and normalized to obtain sample matrix data.

[0122] Here, sample numerical data refers to the sequence of numbers obtained by converting the sample character data from the previous step through a preset numerical mapping table (e.g., mapping Base64 characters to integers from 0 to 64). Aggregation and normalization processing refers to the operations of structuring (such as padding or cropping) and scaling the numerical sequence to make it conform to the model input specifications.

[0123] For example, the server first converts each character in the sample character data into a corresponding number according to a preset mapping rule to obtain sample numerical data. The server performs an aggregation operation on the sample numerical data, that is, by padding (such as adding zeros at the end of the sequence) or pruning, it adjusts all sample numerical sequences to a uniform fixed length and reshapes them into a two-dimensional or multi-dimensional matrix. The server normalizes the values ​​in the matrix (e.g., scales them to the range of [−1,1] or [0,1]) to ensure the stability of the input values, thus finally obtaining the sample matrix data.

[0124] For example, to facilitate processing by machine learning models, these 65 different characters (i.e., the Base64 character set and "=") are numerically mapped and converted into integer values ​​in the range of 0 to 64, resulting in sample numerical data. To effectively reduce the total number of elements in the matrix (i.e., achieve data compression), every six adjacent digits in the sequence of sample numerical data can be converted into a new decimal number. To ensure the accuracy and efficiency of model training, the decimal numbers can be normalized, standardizing their value range to the range [0, 0.75418890624]. After completing the above conversion and normalization, if there are still empty elements (or insufficient length) in the generated matrix, the matrix is ​​uniformly filled with the value 0 at the end.

[0125] Considering that large numerical values ​​may be stored in scientific notation in computer systems, leading to a loss of precision, the number that each element in the matrix can store in the decimal system is limited to a maximum of six original digits (ranging from 0 to 64). However, in practical applications where the file size is small, fewer than six digits can be selected for conversion. It's important to note that merging fewer original digits into a larger value makes it easier for machine learning models to learn and capture the key features of the input file.

[0126] In this embodiment, by sequentially performing binary reading, Base64 character encoding, numerical mapping, and aggregation (padding / pruning) and numerical compression (six-digit to decimal) and normalization processing on the sample seed file with variable file size, it is possible to uniformly convert the original training data with variable format and size into sample matrix data with fixed dimension, stable values ​​and information compression, thereby meeting the input requirements of the generative and discriminative models of the MLP network structure, and ensuring that the model can efficiently and accurately learn the key features of the file header and other key sections.

[0127] To obtain an effective fuzzy testing input set using the seed generation model, embodiments of this application can restore the matrix data generated by the trained seed generation model into an executable binary file. Since the seed generation model learns based on a matrix-based training set, its output is also a normalized matrix. Therefore, embodiments of this application convert the generated matrix into a binary input file for fuzzy testing, and this process can employ the inverse transformation steps of the data transformation during the training phase.

[0128] In one exemplary embodiment, such as Figure 7 As shown, step 202 includes steps 702 to 706. Wherein:

[0129] Step 702: Generate seed matrix data based on the trained seed generation model.

[0130] The seed matrix data refers to the matrix data with fixed dimensions and normalized values ​​output by the server after inputting random noise into the trained seed generation model and performing forward computation. This matrix data is the unified matrix representation of the high-value seed files to be generated.

[0131] Step 704: Perform inverse normalization and decomposition on the seed matrix data to obtain seed numerical data.

[0132] In this context, inverse normalization refers to restoring the values ​​within the normalized range of the seed matrix data to their original decimal value range. Decomposition refers to breaking down the compressed decimal values, which are composed of multiple original numbers, back into the original, smaller number sequence. The seed value data is the original number sequence obtained after inverse processing.

[0133] Step 706: After remapping the seed numerical data to seed character data, decode the seed character data to obtain the seed file.

[0134] The seed character data refers to the sequence of numbers in the seed numerical data, which is remapped back to a string composed of corresponding Base64 characters and the padding character "=", using rules opposite to those used in the Base64 mapping table during training. The decoding operation refers to performing a reverse decoding operation on the Base64 encoded string to restore it to the original binary byte stream. The seed file is the final raw binary file that can be used for fuzz testing.

[0135] For example, the server performs denormalization on the elements in the generated seed matrix data (i.e., restores the original decimal values ​​from the range [0, 0.75418890624]), thereby restoring the compressed decimal value sequence during training. Each decimal value in the decimal value sequence is decomposed back into its six original digits (ranging from 0 to 64), forming a complete number sequence. Subsequently, these digits are converted into corresponding Base64 characters and the padding character "=" according to a preset mapping table, resulting in a Base64 encoded string. Finally, the Base64 string is reverse-decoded to restore it to the original binary byte stream, which is then stored in the local file system, thus obtaining the input file that can be used for fuzzing.

[0136] In this embodiment, by performing the inverse transformation step of data transformation, namely, performing inverse normalization, decomposition, character inverse mapping and Base64 decoding operations on the normalized seed matrix data output by the trained seed generation model, it is possible to accurately restore the fixed-dimensional matrix data generated by the model into the original binary seed file with high-value features that can be used for fuzz testing, thereby achieving the goal of deploying the generation model in practical applications.

[0137] Based on the same inventive concept, the second aspect of the embodiments of this application also provides a model training method. The solution to the problem provided by the model training method is similar to the solution described in the above-mentioned fuzzing method. Therefore, the specific limitations of one or more model training method embodiments provided below can be found in the limitations of the fuzzing method above, and will not be repeated here.

[0138] In one exemplary embodiment, such as Figure 8 As shown, the model training method includes steps 802 to 806. Wherein:

[0139] Step 802: Call the initial generation model to process the random noise file to obtain the simulation seed file.

[0140] Step 804: Call the target discrimination model to discriminate the simulated seed file and obtain the discrimination result of the simulated seed file.

[0141] Step 806: Based on the discrimination results, the initial generation model is trained using the target loss function to obtain the seed generation model.

[0142] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0143] Based on the same inventive concept, this application also provides a fuzzing apparatus for implementing the fuzzing method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more fuzzing apparatus embodiments provided below can be found in the limitations of the fuzzing method described above, and will not be repeated here.

[0144] In one exemplary embodiment, such as Figure 9 As shown, a fuzz testing apparatus is provided, comprising: a generation module 902 and a testing module 904, wherein:

[0145] The generation module 902 is used to obtain seed files based on the trained seed generation model.

[0146] Test module 904 is used to perform fuzz testing on the target application using the seed file.

[0147] The seed generation model is obtained by processing a random noise file using an initial generation model to obtain a simulated seed file, then using a target discrimination model to discriminate the simulated seed file to obtain a discrimination result. Based on the discrimination result, the initial generation model is trained using a target loss function. The target discrimination model is used to determine the probability that the input seed file belongs to the real seed file corresponding to the target application.

[0148] In one embodiment, the fuzz testing device further includes a training module, which is used to obtain a sample seed file corresponding to the target application; train an initial discrimination model using the sample seed file and the random noise file to obtain the target discrimination model; call the initial generation model to process the random noise file to obtain a simulated seed file; call the target discrimination model to discriminate the simulated seed file to obtain the discrimination result of the simulated seed file; and train the initial generation model using a target loss function based on the discrimination result to obtain the trained seed generation model.

[0149] Each module in the aforementioned fuzzy testing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0150] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 10As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a fuzz testing method or a model training method.

[0151] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0152] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the fuzz testing method or model training method provided in the embodiments of this application.

[0153] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the fuzz testing method or model training method provided in the embodiments of this application.

[0154] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the fuzz testing method or model training method provided in the embodiments of this application.

[0155] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0156] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0157] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0158] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A fuzz testing method, characterized in that, The method includes: Seed files are obtained based on the trained seed generation model; The target application is fuzz-tested using the seed file to obtain the test results of the target application; The seed generation model is obtained by training an initial generation model using a target loss function based on the discrimination result; the discrimination result is obtained by processing a random noise file with the initial generation model to obtain a simulated seed file, and then using the target discrimination model to discriminate the simulated seed file; the target discrimination model is used to determine the probability that the input seed file belongs to the real seed file corresponding to the target application.

2. The method according to claim 1, characterized in that, The training process of the seed generation model includes: Obtain the sample seed file corresponding to the target application; The initial discrimination model is trained using the sample seed file and the random noise file to obtain the target discrimination model; The initial generation model is invoked to process the random noise file, resulting in a simulation seed file; The target discrimination model is invoked to discriminate the simulated seed file, and the discrimination result of the simulated seed file is obtained; Based on the discrimination result, the initial generation model is trained using the objective loss function to obtain the trained seed generation model.

3. The method according to claim 2, characterized in that, The step of obtaining the sample seed file corresponding to the target application includes: Obtain the original seed file set corresponding to the target application; The target application is fuzz-tested using each original seed file in the original seed file set to obtain the test results for each original seed file. Based on the test results, the original seed file that triggers the target application and / or the new crash path is determined from the original seed file set, thus obtaining the sample seed file.

4. The method according to claim 2, characterized in that, The process of training an initial discrimination model using the sample seed file and random noise file to obtain the target discrimination model includes: The sample seed file is converted to a different format to obtain sample matrix data; The random noise file is converted to a different format to obtain noise matrix data; The initial discrimination model is trained using the sample matrix data and the noise matrix data to obtain the target discrimination model.

5. The method according to claim 4, characterized in that, The process of converting the format of the sample seed file to obtain sample matrix data includes: The sample seed file is read in binary format to obtain sample binary data; The sample binary data is subjected to character encoding to obtain sample character data; After mapping the sample character data to sample numerical data, the sample numerical data is aggregated and normalized to obtain the sample matrix data.

6. The method according to claim 5, characterized in that, The seed file obtained based on the trained seed generation model includes: Generate seed matrix data based on the trained seed generation model; The seed matrix data is subjected to inverse normalization and decomposition to obtain seed numerical data; After the seed numerical data is reverse mapped to seed character data, the seed character data is decoded to obtain the seed file.

7. A model training method, characterized in that, The method includes: The initial generation model is called to process the random noise file to obtain the simulation seed file; The target discrimination model is invoked to discriminate the simulated seed file, and the discrimination result of the simulated seed file is obtained; Based on the discrimination results, the initial generation model is trained using the target loss function to obtain the seed generation model.

8. A fuzzy testing device, characterized in that, The device includes: The generation module is used to obtain seed files based on the trained seed generation model. The testing module is used to perform fuzz testing on the target application using the seed file; The seed generation model is obtained by processing a random noise file using an initial generation model to obtain a simulated seed file, then using a target discrimination model to discriminate the simulated seed file to obtain a discrimination result. Based on the discrimination result, the initial generation model is trained using a target loss function. The target discrimination model is used to determine the probability that the input seed file belongs to the real seed file corresponding to the target application.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the fuzz testing method according to any one of claims 1 to 6 or the model training method according to claim 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the fuzz testing method according to any one of claims 1 to 6 or the model training method according to claim 7.

Images