Directional fuzzy test framework development and vulnerability mining method and device for open source operating system

Abstract

The invention discloses a directional fuzzy test framework development and vulnerability mining method and device for an open source operating system. According to the method, vulnerability modes are summarized in existing massive kernel vulnerability reports, and comparison vulnerability mining is carried out through kernel division and the vulnerability modes. According to the method, text sequence feature analysis, multi-modal feature fusion and a high-dimensional vector clustering technology are combined, and multi-aspect vulnerability features are extracted and clustered from vulnerability report information with different dimension features. By utilizing AST tree semantic node extraction, kernel module division based on api calling and a kernel module similarity comparison technology based on a grammatical structure, a directional fuzzy test entry of a function level is obtained in combination with a vulnerability division data set. Based on an AFLGo and AFL + + directional fuzzy testing tool, an input entry is automatically constructed, and efficient instrumentation and testing of a single kernel file and a specific function are achieved. The invention provides a more effective and more targeted vulnerability mining mechanism, and is suitable for kernel potential vulnerability mining under an open source operating system.

Description

Technical Field

[0001] This invention relates to the field of operating system security detection and automated vulnerability discovery, and in particular to a method and apparatus for developing a targeted fuzz testing framework and discovering vulnerabilities in an open-source operating system. Background Technology

[0002] As the core of the open-source operating system, the Linux kernel's security is paramount. In recent years, the number of kernel vulnerabilities has continued to grow, with a significant proportion being high-risk vulnerabilities. Automated fuzzing platforms such as Syzbot continuously test the kernel, generating a massive number of crash reports. Extracting knowledge from these reports and efficiently uncovering new potential vulnerabilities is a major challenge in the field of system security.

[0003] Regarding the most similar existing implementations in vulnerability classification, such as vulnerability categorization methods, the current approach primarily relies on clustering based on crash report stack hashes (e.g., ClusterFuzz). The construction method is as follows: extract several keyframes from the top of the call stack and generate a hash value as a unique identifier for the report. Reports with the same hash are grouped into the same category. This vulnerability classification method has several drawbacks: ① Coarse granularity: It is highly sensitive to function inlining, compiler optimizations, and slight changes in call order, easily leading to similar but not identical vulnerabilities being classified into different categories, or different vulnerabilities being merged due to hash collisions; ② Lack of semantic information: Pure hash comparison cannot capture the semantic similarity between function names (e.g., the correlation between lock_acquire and lock_release); ③ Single dimension: It only relies on the call stack, ignoring important information such as vulnerability type and location of occurrence.

[0004] In terms of existing implementations most similar to vulnerability discovery, such as fuzzing methods, the main approach is coverage-based gray-box fuzzing (e.g., AFL, Syzkaller). The construction method is as follows: Genetic algorithms are used to generate inputs that improve code coverage, blindly exploring the program's state space to trigger crashes. This vulnerability discovery method has some drawbacks: ① Blindness: For large codebases (such as the Linux kernel), the probability of reaching deeply hidden vulnerability paths is extremely low, resulting in low efficiency; ② Lack of targeting: It cannot focus testing on specific code areas suspected of containing vulnerabilities.

[0005] Building upon coverage-based fuzzing methods, targeted gray-box fuzzing methods (such as AFLGo) have emerged. The construction method is as follows: based on AFL, static analysis is used to calculate the distance from the current execution point to the target code point, guiding the fuzzer to generate input in the direction that reduces the distance. While this vulnerability discovery method has a targeted approach, it still has some drawbacks: ① Kernel application barriers: AFLGo was originally designed for user-space programs. Applying it directly to the kernel faces significant challenges: 1) It requires compiling and instrumenting the entire kernel, a massive undertaking; 2) Kernel startup and state reset are complex; 3) It is difficult to construct effective user-space entry points to trigger deep kernel functions. ② Strong target dependency: Its efficiency is highly dependent on the accuracy of the pre-set target point. If the target point is set incorrectly, the entire test is invalid.

[0006] In summary, existing technologies either fail to effectively categorize vulnerabilities to guide testing, cannot overcome the technical barriers to targeted testing within the kernel, or lack the ability to learn from historical vulnerabilities and predict new ones. These problems can be summarized in four aspects: ① Massive and redundant vulnerability reports: Automated fuzzing (such as syzbot) generates a large number of duplicate or similar crash reports. Relying on manual deduplication and classification by experts is inefficient and makes it difficult to identify vulnerability patterns from a macro perspective; ② Coarse-grained vulnerability classification: Existing classifications largely rely on the output tags of Sanitizer tools (such as KASAN), lacking fine-grained analysis of deep vulnerability characteristics (such as call context and code location), and failing to effectively distinguish different variants of the same error type; ③ Low efficiency of targeted fuzzing: Traditional targeted fuzzing (such as AFLGo) faces challenges such as complex compilation instrumentation, inaccurate target localization, and test space explosion when dealing with ultra-large-scale, tightly coupled systems like the Linux kernel, making it difficult to effectively focus on high-risk areas; ④ Weak potential vulnerability prediction capability: There is a lack of a method that can automatically identify and locate potential high-risk vulnerabilities based on historical vulnerabilities and code structure similarity. This invention was proposed against this technical background. Summary of the Invention

[0007] This invention aims to overcome the shortcomings of existing technologies by providing a targeted fuzzing framework development and vulnerability discovery method and apparatus for open-source operating systems. The goal is to: perform automated, fine-grained, multi-dimensional clustering analysis on massive kernel vulnerability reports to reveal deeper vulnerability patterns; accurately predict and locate potentially high-risk vulnerability functions in the kernel that may exist but have not yet been discovered, based on clustering results and code structure similarity; construct an automated targeted fuzzing framework for Linux kernel function-level vulnerabilities to achieve efficient verification of predicted targets; and ultimately improve the automation, accuracy, and efficiency of open-source operating system kernel vulnerability discovery. This invention utilizes the idea of ​​vulnerability detection based on code similarity. By comparing code similarity, it infers that if kernel module A has a type 1 vulnerability in an existing, relatively complete vulnerability dataset, but a similar module B does not, then module B is also very likely to have a similar vulnerability, which has not yet been discovered in the open-source community. This requires specific methods such as operating system kernel partitioning, vulnerability data partitioning, code matching, and fuzzing construction.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: The development of a targeted fuzzing framework and vulnerability discovery method for open-source operating systems includes the following steps: 1) Obtain and process crash reports and fix submissions from the fuzzing platform to construct and obtain a multi-dimensional vulnerability sample set; 2) Extract multi-dimensional features from the multi-dimensional vulnerability sample set, including three major categories of feature information: vulnerability type, call stack, and file path, and vectorize them to obtain the multi-dimensional feature vector of the vulnerability dataset; 3) From the multidimensional feature vectors of the vulnerability dataset, the features are fused according to the weight relationship between the features, and then clustered by an improved density clustering algorithm to obtain vulnerability clusters; 4) Identify and obtain potentially high-risk code regions from vulnerability clusters by matching and comparing nodes in the abstract syntax tree; 5) Perform code instrumentation, path analysis, and AFLGo targeted fuzz testing in potentially high-risk code areas to ultimately achieve automated verification and detection of potential vulnerabilities.

[0009] A further improvement of this invention is that: 1) it acquires and processes crash reports and fix submission information from a fuzzing platform, constructs and obtains a multi-dimensional vulnerability sample set, including: Data source: Vulnerability reports marked "Fixed" and their corresponding remediation submissions were obtained from the syzbot platform; a maximum of 5 crash reports were randomly selected for each vulnerability, totaling 6025 data entries to ensure data diversity; Data cleaning: Call stack: Extracted using regular expressions; remove redundant information such as line numbers, offsets, and memory addresses; manually define a mask list to filter out functions unrelated to the cause of the crash; Vulnerability type: Extracted from the report text, removing the Sanitizer name and specific location information, retaining the essence of the error; File path: Extracted from the patch commits, the modified file path is used as an authoritative identifier of the vulnerability location.

[0010] A further improvement of this invention is that: 2) multi-dimensional features are extracted from the multi-dimensional vulnerability sample set, including three major categories of feature information: vulnerability type, call stack, and file path, and then vectorized to obtain a multi-dimensional feature vector of the vulnerability dataset, including: 201) Feature extraction: Feature Dimensions: Three core features are extracted from each vulnerability sample: vulnerability type, file path, and call stack. Feature extraction methods are as follows: Vulnerability type / file path: TF-IDF is used to vectorize them, and then a cosine similarity matrix is ​​calculated; Jaccard similarity is additionally used for comparison of file paths; Call stack: Intra-sequence weighting: Weights are distributed exponentially from top to bottom on the stack sequence, emphasizing the importance of functions near the top of the stack; Inter-function similarity: The similarity between function names is calculated using both Jaccard distance and TF-IDF-based cosine distance methods; Sequence distance: Combining the two weights, DTW and Levenshtein algorithms are used to calculate the final distance between stack sequences; Normalization: A Gaussian kernel function is used to convert the distance matrix into a similarity matrix. 202) Feature fusion: Four strategies were used to fuse the 12 similarity matrices: dimensionality reduction after kernel matrix concatenation, dimensionality reduction followed by vector concatenation, dimensionality reduction after weighted summation of similarity matrices, and dimensionality reduction after weighted summation of kernel matrices. The optimal weights for each dimension are determined by grid search; dimensionality reduction is performed using kernel PCA, resulting in a unified 25-dimensional feature vector for clustering.

[0011] A further improvement of this invention is that, 3) from the multidimensional feature vectors of the vulnerability dataset, features are fused according to the weight relationships between them, and then clustered using an improved density clustering algorithm to obtain vulnerability clusters, including: First clustering: Objective: To ensure that the clustering results are dominated by vulnerability type; Method: First, HDBSCAN clustering was performed on 216 original vulnerability type texts, which were then merged into 50 highly cohesive, noise-free macro-level vulnerability categories / clusters; This label will guide the second clustering; Second clustering: Input: 50 highly cohesive, noise-free macroscopic vulnerability clusters obtained from the first clustering, and the multidimensional feature vector of the vulnerability dataset obtained in step 2); Method: For samples within each cluster G_k of the first cluster, perform clustering again using HDBSCAN; Adaptive threshold: Size threshold: If |G_k|<10, do not subdivide and retain the original cluster; Quality threshold: Calculate the average silhouette coefficient S of the sub-clusters after subdivision. _k; if S If _k ≥ 0.35, then accept the subdivision result; otherwise, reject the subdivision and retain the original cluster G_k; Output: Finally, 95 high-purity, fine-grained vulnerability clusters are obtained, with an average profile coefficient of 0.709.

[0012] A further improvement of this invention is that, 4) potential high-risk code regions are identified and obtained from vulnerability clusters through abstract syntax tree node matching and comparison, including: Module community partitioning: Based on the control flow / data flow dependencies of the Linux kernel code, a graph partitioning algorithm was used to divide 2542 kernel modules into 2320 communities; Abstract Syntax Tree Extraction: The tree_sitter parser is used to parse the kernel C source file, extract key syntax nodes of function definitions, and ignore nodes that are irrelevant to the simple variable types; Node similarity matching: For each pair of similar modules and module vulnerability function pairs, calculate the TF-IDF cosine similarity between all function nodes in the similar modules and the AST nodes of the original module vulnerability function, and find the function node in the similar modules that is most similar to the original module vulnerability function. Output: The final result is a list of 34 high-risk vulnerable function nodes.

[0013] A further improvement of this invention is that, 5) code instrumentation, path analysis, and AFLGo targeted fuzzing are performed from potentially high-risk code areas to ultimately achieve automated verification and detection of potential vulnerabilities, including: Compilation command acquisition: Use the bear tool to compile the entire kernel and generate a compile_commands.json database, which records the complete compilation parameters for each source file; Target location: Use ctags to determine the line number of the target function in the file and write it to BBtargets.txt; Compilation option adaptation: Extract the compilation parameters of the target file from compile_commands.json, replace gcc with the AFLGo compiler, and remove incompatible options; Stub function generation: When compiling object files, errors may occur due to missing dependencies. An automated script parses these undefined symbols and generates a stubs.c file containing an empty implementation. Test entry point generation: Automatically generates main.c, which calls the target function, and the corresponding test input.txt; Instrumentation and linking: Compile the object files .c, main.c, and stubs.c separately using the AFLGo compiler, and then link them into an executable file; Distance calculation and testing: Run the AFLGo script gen_distance_fast.py to generate the distance configuration file distance.cfg.txt; finally, perform directional fuzz testing.

[0014] The development of a targeted fuzzing framework and vulnerability discovery device for open-source operating systems includes: The multi-dimensional vulnerability sample set construction unit acquires and processes crash reports and fix submission information from the fuzzing platform to construct and obtain a multi-dimensional vulnerability sample set. The multidimensional feature extraction and vectorization unit extracts multidimensional features from the multidimensional vulnerability sample set, including three major categories of feature information: vulnerability type, call stack, and file path, and vectorizes them to obtain the multidimensional feature vector of the vulnerability dataset. Density clustering algorithm clustering units are obtained by fusing multidimensional feature vectors from vulnerability datasets according to the weight relationship between features, and then clustering them using an improved density clustering algorithm to obtain vulnerability clusters; The potential high-risk code region identification unit identifies and obtains potential high-risk code regions from vulnerability clusters through abstract syntax tree node matching and comparison; The automated verification and detection unit performs code instrumentation, path analysis, and AFLGo targeted fuzz testing in potentially high-risk code areas, ultimately achieving automated verification and detection of potential vulnerabilities.

[0015] A further improvement of this invention lies in that, in the multi-dimensional vulnerability sample set construction unit, crash reports and fix submission information from the fuzzing platform are acquired and processed to construct and obtain a multi-dimensional vulnerability sample set, including: Data source: Vulnerability reports marked "Fixed" and their corresponding remediation submissions were obtained from the syzbot platform; a maximum of 5 crash reports were randomly selected for each vulnerability, totaling 6025 data entries to ensure data diversity; Data cleaning: Call stack: Extracted using regular expressions; remove redundant information such as line numbers, offsets, and memory addresses; manually define a mask list to filter out functions unrelated to the cause of the crash; Vulnerability type: Extracted from the report text, removing the Sanitizer name and specific location information, retaining the essence of the error; File path: Extracted from the patch commits, the modified file path is used as an authoritative identifier of the vulnerability location.

[0016] A further improvement of this invention lies in that, in the multidimensional feature extraction and vectorization unit, multidimensional features are extracted from the multidimensional vulnerability sample set, including three major categories of feature information: vulnerability type, call stack, and file path, and then vectorized to obtain a multidimensional feature vector of the vulnerability dataset, including: 201) Feature extraction: Feature Dimensions: Three core features are extracted from each vulnerability sample: vulnerability type, file path, and call stack. Feature extraction methods are as follows: Vulnerability type / file path: TF-IDF is used to vectorize them, and then a cosine similarity matrix is ​​calculated; Jaccard similarity is additionally used for comparison of file paths; Call stack: Intra-sequence weighting: Weights are distributed exponentially from top to bottom on the stack sequence, emphasizing the importance of functions near the top of the stack; Inter-function similarity: The similarity between function names is calculated using both Jaccard distance and TF-IDF-based cosine distance methods; Sequence distance: Combining the two weights, DTW and Levenshtein algorithms are used to calculate the final distance between stack sequences; Normalization: A Gaussian kernel function is used to convert the distance matrix into a similarity matrix. 202) Feature fusion: Four strategies were used to fuse the 12 similarity matrices: dimensionality reduction after kernel matrix concatenation, dimensionality reduction followed by vector concatenation, dimensionality reduction after weighted summation of similarity matrices, and dimensionality reduction after weighted summation of kernel matrices. The optimal weights for each dimension are determined by grid search; dimensionality reduction is performed using kernel PCA, resulting in a unified 25-dimensional feature vector for clustering.

[0017] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method for developing a targeted fuzz testing framework and discovering vulnerabilities in an open-source operating system.

[0018] Compared with the prior art, the present invention has at least the following beneficial technical effects: Multi-dimensional fine-grained clustering: Innovatively integrating three major features—vulnerability type, file path, and call stack—and designing an improved sequence distance metric (Jaccard-Levenshtein weighted DTW) and feature fusion strategy (Gaussian kernel + kernel PCA), it achieves more refined and accurate vulnerability clustering (95 high-purity clusters, silhouette coefficient 0.709) than traditional single-dimensional (e.g., stack hash only) or simple label classification. Vulnerability-driven targeted detection: No longer blind full-kernel fuzzing, but based on vulnerability patterns discovered through cluster analysis and high-risk module community segmentation, it intelligently predicts the specific function nodes most likely to contain vulnerabilities. Experiments identified 34, making the testing targets extremely clear. Breakthrough in the practicality of kernel function-level targeted fuzzing: An innovative Linux kernel minimal compilation instrumentation process was designed, overcoming the technical obstacles of directly applying targeted fuzzers like AFLGo to the entire kernel, achieving efficient instrumentation and testing of individual kernel files and specific functions. Automation and effectiveness: The entire process, from data processing, feature extraction, cluster analysis, risk identification to compilation and testing, is implemented through automated scripts, demonstrating the effectiveness and practicality of the method.

[0019] In summary, this invention utilizes web crawling technology to obtain crash reports and fix submission information from fuzzing platforms; constructs a multi-dimensional vulnerability sample set using regular expression matching and sequence LCS similarity comparison; obtains a distance matrix by using algorithms such as Jaccard, Levenshtein, and DTW for sequence distance measurement, and vectorizes the distance matrix using Gaussian kernel + kernel PCA to obtain multi-dimensional feature vectors of the vulnerability dataset; generates vulnerability clusters through an improved density clustering algorithm based on HDBSCAN; identifies potentially high-risk code regions by analyzing syntax nodes and performing similarity comparisons using the AST method; and performs code instrumentation, path analysis, and targeted fuzzing on high-risk code regions using AFLGo to achieve automated verification and detection. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 A flowchart illustrating the development of a targeted fuzzing framework and vulnerability discovery methods for open-source operating systems; Figure 2 This is a flowchart of the implementation method of step 1 of the present invention; Figure 3This is a flowchart of the method for implementing step 2 of the present invention; Figure 4 This is a flowchart of the implementation method of step 3 of the present invention; Figure 5 This is a flowchart of the implementation method of step 4 of the present invention; Figure 6 This is a flowchart illustrating the preparatory work for the automated vulnerability detection section of this invention. Figure 7 This is a flowchart illustrating the fuzzing process in the automated vulnerability detection section of this invention. Figure 8 A structural diagram of a targeted fuzzing framework and vulnerability discovery device for open-source operating systems. Detailed Implementation

[0022] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0023] In the description of this invention, it should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0024] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0025] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0026] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0027] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0028] Example 1 like Figure 1 As shown, the open-source operating system targeted fuzzing framework development and vulnerability discovery method provided by this invention includes the following steps: 1) Obtain and process crash reports and fix submissions from the fuzzing platform to construct and obtain a multi-dimensional vulnerability sample set; 2) Extract multi-dimensional features from the multi-dimensional vulnerability sample set, including three major categories of feature information: vulnerability type, call stack, and file path, and vectorize them to obtain the multi-dimensional feature vector of the vulnerability dataset; 3) From the multidimensional feature vectors of the vulnerability dataset, the features are fused according to the weight relationship between the features, and then clustered by an improved density clustering algorithm to obtain vulnerability clusters; 4) Identify and obtain potentially high-risk code regions from vulnerability clusters by matching and comparing nodes in the abstract syntax tree; 5) Perform code instrumentation, path analysis, and AFLGo targeted fuzz testing in potentially high-risk code areas to ultimately achieve automated verification and detection of potential vulnerabilities.

[0029] In this embodiment, 1) crash reports and fix submission information from the fuzzing platform are acquired and processed to construct and obtain a multi-dimensional vulnerability sample set, including: Data source: Vulnerability reports marked "Fixed" and their corresponding remediation submissions were obtained from the syzbot platform; a maximum of 5 crash reports were randomly selected for each vulnerability, totaling 6025 data entries to ensure data diversity; Data cleaning: Call stack: Extracted using regular expressions; remove redundant information such as line numbers, offsets, and memory addresses; manually define a mask list to filter out functions unrelated to the cause of the crash; Vulnerability type: Extracted from the report text, removing the Sanitizer name and specific location information, retaining the essence of the error; File path: Extracted from the patch commits, the modified file path is used as an authoritative identifier of the vulnerability location.

[0030] In this embodiment, 2) multi-dimensional features are extracted from the multi-dimensional vulnerability sample set, including three main categories of feature information: vulnerability type, call stack, and file path, and then vectorized to obtain the multi-dimensional feature vector of the vulnerability dataset, including: 201) Feature extraction: Feature Dimensions: Three core features are extracted from each vulnerability sample: vulnerability type, file path, and call stack. Feature extraction methods are as follows: Vulnerability type / file path: TF-IDF is used to vectorize them, and then a cosine similarity matrix is ​​calculated; Jaccard similarity is additionally used for comparison of file paths; Call stack: Intra-sequence weighting: Weights are distributed exponentially from top to bottom on the stack sequence, emphasizing the importance of functions near the top of the stack; Inter-function similarity: The similarity between function names is calculated using both Jaccard distance and TF-IDF-based cosine distance methods; Sequence distance: Combining the two weights, DTW and Levenshtein algorithms are used to calculate the final distance between stack sequences; Normalization: A Gaussian kernel function is used to convert the distance matrix into a similarity matrix. 202) Feature fusion: Four strategies were used to fuse the 12 similarity matrices: dimensionality reduction after kernel matrix concatenation, dimensionality reduction followed by vector concatenation, dimensionality reduction after weighted summation of similarity matrices, and dimensionality reduction after weighted summation of kernel matrices. The optimal weights for each dimension are determined by grid search; dimensionality reduction is performed using kernel PCA, resulting in a unified 25-dimensional feature vector for clustering.

[0031] In this embodiment, 3) the multidimensional feature vectors of the vulnerability dataset are fused according to the weight relationship between features, and clustered using an improved density clustering algorithm to obtain vulnerability clusters, including: First clustering: Objective: To ensure that the clustering results are dominated by vulnerability type; Method: First, HDBSCAN clustering was performed on 216 original vulnerability type texts, which were then merged into 50 highly cohesive, noise-free macro-level vulnerability categories / clusters; This label will guide the second clustering; Second clustering: Input: 50 highly cohesive, noise-free macroscopic vulnerability clusters obtained from the first clustering, and the multidimensional feature vector of the vulnerability dataset obtained in step 2); Method: For samples within each cluster G_k of the first cluster, perform clustering again using HDBSCAN; Adaptive threshold: Size threshold: If |G_k|<10, do not subdivide and retain the original cluster; Quality threshold: Calculate the average silhouette coefficient S of the sub-clusters after subdivision. _k; if S If _k ≥ 0.35, then accept the subdivision result; otherwise, reject the subdivision and retain the original cluster G_k; Output: Finally, 95 high-purity, fine-grained vulnerability clusters are obtained, with an average profile coefficient of 0.709.

[0032] In this embodiment, 4) potential high-risk code regions are identified and obtained from the vulnerability clusters through abstract syntax tree node matching and comparison, including: Module community partitioning: Based on the control flow / data flow dependencies of the Linux kernel code, a graph partitioning algorithm was used to divide 2542 kernel modules into 2320 communities; Abstract Syntax Tree Extraction: The tree_sitter parser is used to parse the kernel C source file, extract key syntax nodes of function definitions, and ignore nodes that are irrelevant to the simple variable types; Node similarity matching: For each pair of similar modules and module vulnerability function pairs, calculate the TF-IDF cosine similarity between all function nodes in the similar modules and the AST nodes of the original module vulnerability function, and find the function node in the similar modules that is most similar to the original module vulnerability function. Output: The final result is a list of 34 high-risk vulnerable function nodes.

[0033] In this embodiment, 5) code instrumentation, path analysis, and AFLGo targeted fuzz testing are performed from potentially high-risk code areas to ultimately achieve automated verification and detection of potential vulnerabilities, including: Compilation command acquisition: Use the bear tool to compile the entire kernel and generate a compile_commands.json database, which records the complete compilation parameters for each source file; Target location: Use ctags to determine the line number of the target function in the file and write it to BBtargets.txt; Compilation option adaptation: Extract the compilation parameters of the target file from compile_commands.json, replace gcc with the AFLGo compiler, and remove incompatible options; Stub function generation: When compiling object files, errors may occur due to missing dependencies. An automated script parses these undefined symbols and generates a stubs.c file containing an empty implementation. Test entry point generation: Automatically generates main.c, which calls the target function, and the corresponding test input.txt; Instrumentation and linking: Compile the object files .c, main.c, and stubs.c separately using the AFLGo compiler, and then link them into an executable file; Distance calculation and testing: Run the AFLGo script gen_distance_fast.py to generate the distance configuration file distance.cfg.txt; finally, perform directional fuzz testing.

[0034] Example 2 like Figure 1 As shown, the open-source operating system targeted fuzzing framework development and vulnerability discovery method provided by this invention specifically includes the following aspects: 1. Dataset Construction Module: Used to acquire and process crash reports and fix submissions from the fuzzing platform to build a multi-dimensional vulnerability sample set.

[0035] 2. Feature Extraction Module: This module extracts three main categories of feature information from vulnerability reports: vulnerability type, call stack, and file path, and then vectorizes these features.

[0036] 3. Feature Fusion and Clustering Module: This module is used to fuse features based on their weight relationships and generate vulnerability clusters using an improved density clustering algorithm.

[0037] 4. High-risk vulnerability identification module: Used to identify potentially high-risk code areas through abstract syntax tree node matching and module comparison.

[0038] 5. Automated Detection Module: Used to perform code instrumentation, path analysis, and AFLGo targeted fuzz testing on high-risk files to achieve automated verification and detection.

[0039] like Figure 2 As shown, step 1 includes an implementation method for the dataset construction module, detailed below: (a) Data Sources and Preprocessing The data in this embodiment comes from crash reports and corresponding fix submission records generated by the publicly available kernel fuzzing platform (Syzbot). The system obtains vulnerability data marked as "Fixed" through automatic crawling or API interface. Each vulnerability record contains up to 5 crash report samples and one fix submission message. After sampling and statistics, a total of 6025 valid vulnerability samples were obtained, covering multiple kernel versions and architectures.

[0040] During the data preprocessing stage, the system performs the following steps: ① Report merging: Match the longest common substring of multiple reports for the same vulnerability, extract the common parts, and delete duplicate fields; ② Noise Filtering: Removes irrelevant fields from the report, such as register status, memory dumps, and log timestamps. ③ Feature Extraction Preparation: Uses regular expressions to match key content, including error type fields, function stack segments, and repair file paths. ④ Redundancy Removal: For duplicate crash samples, records with the same commit hash, or similar descriptions, the system automatically removes duplicates to ensure data uniqueness.

[0041] (ii) Call stack extraction The call stack in the crash report is a crucial feature characterizing vulnerability behavior. The system uses regular expressions to extract stack segments and performs the following cleaning rules: ① Remove line numbers, offsets, inline markers, and non-functional entries; ② Eliminate system functions unrelated to the error, such as dump_stack, printk, and kasan_report; ③ Compare multiple sample stacks line by line, extract the longest common sequence, and retain critical call paths; ④ Based on the cleaned stack structure, the system generates a function sequence vector, laying the foundation for subsequent sequence distance calculations.

[0042] (III) Extraction of other information In addition to the call stack, the system also extracts: ① Error type field: locating the error description through keywords, such as "KASAN: use-after-free"; ② File path field: based on the source file path modified in the fix submission; ③ Subsystem label: identifying the module affiliation through the bug-label field in the report, such as mm, net, fs. All data is stored in a unified JSON format. like Figure 3 As shown, step 2 includes an implementation method for the feature extraction module, detailed below: The study primarily targets three types of features: vulnerability type, file path, and call stack sequence, using different algorithms to generate feature vectors or similarity matrices for each.

[0043] (a) Vulnerability type feature extraction Vulnerabilities are typically short texts, and the system uses the TF-IDF (Term Frequency-Inverse Document Frequency) algorithm for vectorization. TF reflects the frequency of a term in the current text, while IDF reflects the rarity of the term in the entire corpus. The resulting high-dimensional sparse matrix is ​​transformed by cosine similarity to form a vulnerability type similarity matrix, providing a quantitative indicator for subsequent clustering.

[0044] (ii) Extraction of call stack features The call stack is treated as a sequence of functions, and the system calculates the similarity between functions using an improved sequence distance algorithm. This mainly includes: ① Sub-element similarity calculation; using Jaccard distance to measure the lexical similarity of function names and TF-IDF + cosine similarity to measure the semantic similarity of function names; ② Intra-sequence weight allocation, using an exponential decay weight model based on stack depth; ③ Sequence distance measurement algorithm, employing a hybrid algorithm combining Levenshtein edit distance and DTW (Dynamic Time Warping) distance, correcting the sequence matching cost through the weight matrix to improve the accuracy of crash stack similarity assessment; ④ Gaussian kernel normalization, transforming the calculated distance matrix through a Gaussian kernel to map the distance to the [0,1] interval, resulting in the call stack similarity matrix.

[0045] (III) File path feature extraction File path features appear in a slash-separated structure. The system employs two methods: ① Jaccard distance matrix method: treating the path as a set of words and calculating the intersection-union ratio of the sets; ② TF-IDF + cosine similarity method: quantifying the similarity between files using path word frequency features. Finally, the two measurement results are fused by weighted averaging to generate a file path similarity matrix.

[0046] (iv) Multi-feature fusion This module performs weighted fusion of three types of features. Weights are assigned based on their importance: vulnerability type 0.5, call stack 0.3, and file path 0.2. The system uses the following fusion strategy: converting each similarity matrix into a Gaussian kernel matrix; reducing the kernel matrix to 25 dimensions using Kernel-PCA; weighted vertical concatenation of different feature vectors; and further dimensionality reduction to form a unified fused feature vector. This vector serves as the input for subsequent clustering, effectively preserving the non-linear relationships of multi-dimensional features.

[0047] like Figure 4 As shown, step 3 includes an implementation method for the feature clustering module, detailed below: (a) Preliminary clustering The system employs the HDBSCAN (Hierarchical Density Clustering) algorithm for unsupervised clustering. HDBSCAN eliminates the need for pre-setting the number of clusters and automatically identifies dense regions while removing noise points. The main process includes: ① calculating the core distance for each sample; ② constructing a reachability map; ③ generating a minimum spanning tree; ④ performing hierarchical segmentation based on a density threshold to form stable clusters. Experiments determined the optimal parameters (minimum cluster size = 10, minimum number of samples = 5), resulting in 95 effective clusters with a non-noise point ratio of 99.6% and an average silhouette coefficient of 0.71.

[0048] (ii) Double clustering mechanism To further improve clustering accuracy, this invention adopts a "double clustering" mechanism: ① First clustering: based on vulnerability type characteristics, vulnerabilities of the same type are clustered first; ② Second sub-clustering: within each cluster, secondary subdivision is performed based on call stack and file path characteristics.

[0049] If the sub-cluster profile coefficient is higher than the threshold (0.35), the subdivision result is retained; otherwise, the subdivision is canceled and the original cluster is maintained. This method achieves hierarchical analysis from "vulnerability type" to "call path behavior" while maintaining cluster stability.

[0050] (III) Evaluation of Clustering Results The clustering effect was evaluated using the following metrics: ① Silhouette Score: measures the density within clusters and the separation between clusters; ② Normalized Mutual Information (NMI): measures the similarity between the clustering results and known labels (such as syzbot type, module label). Calculations showed that the NMI for clustering results and vulnerability type classification in this invention was 0.9563, and for call stack classification it was 0.6102, both indicating high consistency.

[0051] like Figure 5 As shown, step 4 includes the implementation method of the high-risk vulnerability identification and detection module, detailed below: (a) Identification of high-risk files and functions The system identifies potentially high-risk nodes based on clustering results and Abstract Syntax Tree (AST) structure analysis. The main principles are as follows: ① If a specific syntax node in a module has a known vulnerability, while the corresponding node in another similar module does not, that node is identified as a high-risk node; ② If the structural similarity between the AST subtree of a function and the subtree of a vulnerable function exceeds a set threshold (e.g., 0.85), it is marked as a potentially risky function. The system extracts the AST structure of each function, with nodes containing information such as type, operators, and parameters. The tree edit distance algorithm is used to measure function structural similarity: a high-risk node database is generated, recording the function name, file path, and similarity score.

[0052] Table 1-1 Example – Module Division

[0053] Table 1-2 Example – Vulnerability Classification

[0054] Based on the following three situations: 1. A certain type of vulnerability appears in a certain module, but one or more similar modules do not have similar vulnerabilities (m1, m2, m3). 2. A certain type of vulnerability appears in a certain module, and all other similar modules have a similar vulnerability (m2, m4). 3. This type of vulnerability is not reflected in the community for this module (m6, m7). Vulnerability identification addresses the first scenario: a module m3 has a similar module m1; module m1 contains vulnerability bug0, which belongs to vulnerability cluster 1; however, no vulnerability in cluster 1 appears in module m3. This indicates that module m3 likely contains a similar vulnerability, and such a vulnerability is likely to appear in node3 of module m3, where node3 is the syntax tree node most similar to node1, the node where bug0 appears in module m1. High-risk potential vulnerabilities are identified using this principle.

[0055] (II) Minimal Kernel Compilation and Instrumentation For high-risk files, the system automatically generates a minimal build project, retaining only the target module and its dependencies. The automated script performs the following operations: ① Parses the Makefile dependency tree to extract the source files required for compilation; ② Automatically repairs undefined symbols and generates a temporary stubs.c file; ③ Compiles using LLVM to generate a .bc file for instrumentation analysis; ④ Executes AFLGo instrumentation commands. afl-clang-fast -c target.c -o target.o -fsanitize-coverage=trace-pc-guard Generate an executable file with distance markers.

[0056] (III) Distance Calculation and Fuzzy Testing AFLGo optimizes fuzz testing efficiency through target-oriented distance calculation. The system calculates the path distance from the source function to high-risk nodes; then it executes commands: afl-fuzz -i inputs -o outputs -z exp -c 45m -- . / target @@ AFLGo adaptively adjusts the direction of input mutations based on path distance, enabling centralized testing of high-risk code regions.

[0057] (iv) Automated testing process like Figure 6 As shown, this module achieves full-process automation: ① Input generation: Generate diverse inputs using a fuzzy testing corpus; ② Test execution: Execute instrumentation programs based on the objective function; ③ Crash detection: Capture anomalies such as SIGSEGV and SIGABRT in real time; ④ Result recording: Automatically archive crash inputs, stack logs, and generated minimum samples; ⑤ Remediation tracking: If the detection results match existing vulnerability clusters, update the risk assessment database.

[0058] like Figure 7As shown, this invention achieves a complete closed loop from vulnerability report analysis, feature extraction, cluster recognition to fuzzy testing verification.

[0059] Example 3 like Figure 8 As shown, the open-source operating system-oriented fuzzing framework development and vulnerability discovery device provided by this invention includes: The multi-dimensional vulnerability sample set construction unit acquires and processes crash reports and fix submission information from the fuzzing platform to construct and obtain a multi-dimensional vulnerability sample set. The multidimensional feature extraction and vectorization unit extracts multidimensional features from the multidimensional vulnerability sample set, including three major categories of feature information: vulnerability type, call stack, and file path, and vectorizes them to obtain the multidimensional feature vector of the vulnerability dataset. Density clustering algorithm clustering units are obtained by fusing multidimensional feature vectors from vulnerability datasets according to the weight relationship between features, and then clustering them using an improved density clustering algorithm to obtain vulnerability clusters; The potential high-risk code region identification unit identifies and obtains potential high-risk code regions from vulnerability clusters through abstract syntax tree node matching and comparison; The automated verification and detection unit performs code instrumentation, path analysis, and AFLGo targeted fuzz testing in potentially high-risk code areas, ultimately achieving automated verification and detection of potential vulnerabilities.

[0060] In the multi-dimensional vulnerability sample set construction unit of this embodiment, crash reports and fix submission information from the fuzzing platform are acquired and processed to construct and obtain a multi-dimensional vulnerability sample set, including: Data source: Vulnerability reports marked "Fixed" and their corresponding remediation submissions were obtained from the syzbot platform; a maximum of 5 crash reports were randomly selected for each vulnerability, totaling 6025 data entries to ensure data diversity; Data cleaning: Call stack: Extracted using regular expressions; remove redundant information such as line numbers, offsets, and memory addresses; manually define a mask list to filter out functions unrelated to the cause of the crash; Vulnerability type: Extracted from the report text, removing the Sanitizer name and specific location information, retaining the essence of the error; File path: Extracted from the patch commits, the modified file path is used as an authoritative identifier of the vulnerability location.

[0061] In the multidimensional feature extraction and vectorization unit of this embodiment, multidimensional features are extracted from the multidimensional vulnerability sample set, including three main categories of feature information: vulnerability type, call stack, and file path. These features are then vectorized to obtain a multidimensional feature vector of the vulnerability dataset, including: 201) Feature extraction: Feature Dimensions: Three core features are extracted from each vulnerability sample: vulnerability type, file path, and call stack. Feature extraction methods are as follows: Vulnerability type / file path: TF-IDF is used to vectorize them, and then a cosine similarity matrix is ​​calculated; Jaccard similarity is additionally used for comparison of file paths; Call stack: Intra-sequence weighting: Weights are distributed exponentially from top to bottom on the stack sequence, emphasizing the importance of functions near the top of the stack; Inter-function similarity: The similarity between function names is calculated using both Jaccard distance and TF-IDF-based cosine distance methods; Sequence distance: Combining the two weights, DTW and Levenshtein algorithms are used to calculate the final distance between stack sequences; Normalization: A Gaussian kernel function is used to convert the distance matrix into a similarity matrix. 202) Feature fusion: Four strategies were used to fuse the 12 similarity matrices: dimensionality reduction after kernel matrix concatenation, dimensionality reduction followed by vector concatenation, dimensionality reduction after weighted summation of similarity matrices, and dimensionality reduction after weighted summation of kernel matrices. The optimal weights for each dimension are determined by grid search; dimensionality reduction is performed using kernel PCA, resulting in a unified 25-dimensional feature vector for clustering.

[0062] Example 4 like Figure 8 As shown, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the open-source operating system's targeted fuzz testing framework development and vulnerability discovery method.

[0063] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0064] This application is described with reference to flowchart illustrations and / or block diagrams of methods, systems, and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0065] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0066] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0067] The key points and areas to be protected in this invention are as follows: 1. Key Points An improved call stack sequence distance metric: a weighted DTW / Levenshtein distance algorithm that combines intra-sequence exponential decay weights and function name Jaccard / TF-IDF similarity.

[0068] Vulnerability analysis models based on multi-dimensional feature fusion and binary clustering: especially the HDBSCAN secondary clustering process that is vulnerability type-driven and uses threshold adaptive control to fine-grained clustering.

[0069] A high-risk vulnerability reasoning mechanism based on community segmentation and AST node similarity: It associates vulnerability clusters with code module communities and locates specific suspicious functions through syntax tree similarity.

[0070] A Linux kernel-level fuzzing adaptation method includes building a minimal compilation environment, automatic adaptation of compilation parameters, and automatic generation of stub functions for undefined symbols.

[0071] 2. Points to be protected A vulnerability report clustering method based on multi-dimensional feature fusion is proposed. The method includes: extracting vulnerability type, file path, and call stack features from vulnerability reports; performing feature extraction using algorithms including TF-IDF, Jaccard similarity, cosine similarity, DTW, Levenshtein, and their improved versions; performing feature fusion using Gaussian kernel transformation, kernel PCA dimensionality reduction, and weighted vector concatenation; and performing fine-grained segmentation of vulnerability reports using a vulnerability type-driven double adaptive clustering algorithm.

[0072] As described in Protection Point 1, the improved algorithm for call stack features includes: assigning exponentially decaying intra-sequence weights to the call stack sequence; calculating Jaccard or TF-IDF-based cosine similarity between function names as inter-element weights; and combining the above two weights to calculate the sequence distance using the DTW or Levenshtein algorithm.

[0073] As described in Protection Point 1, the double adaptive clustering algorithm includes: first, clustering vulnerability types to obtain macro categories; then, performing secondary clustering on samples within each macro category based on fusion features; and setting cluster size and contour coefficient thresholds to adaptively determine whether to accept the results of secondary clustering.

[0074] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the scope of the invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0075] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can be appropriately combined to form other embodiments that can be understood by those skilled in the art. The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. An open source operating system oriented fuzzing test framework development and vulnerability mining method, characterized in that, Comprising the following steps: 1) Obtain and process crash reports and repair submission information from the fuzzing platform, build and obtain a multi-dimensional vulnerability sample set; 2) Extract multi-dimensional features from the multi-dimensional vulnerability sample set, including three categories of feature information: vulnerability type, call stack and file path, and vectorize them to obtain the multi-dimensional feature vector of the vulnerability data set; 3) From the multi-dimensional feature vector of the vulnerability data set, fuse according to the weight relationship between the features, and cluster through an improved density clustering algorithm to obtain vulnerability clusters; 4) From the vulnerability clusters, identify and obtain potential high-risk code regions through abstract syntax tree node matching and comparison; 5) From the potential high-risk code region, perform code instrumentation, path analysis and AFLGo directed fuzzing to finally realize the automated verification and detection of potential vulnerabilities.

2. The open source operating system directed fuzz testing framework development and vulnerability mining method of claim 1, wherein, 1) Obtain and process crash reports and repair submission information from the fuzzing platform, build and obtain a multi-dimensional vulnerability sample set, including: Data source: Obtain the vulnerability reports marked as "Fixed" and their corresponding repair submissions from the syzbot platform; randomly select up to 5 crash reports for each vulnerability, a total of 6025 data, to ensure data diversity; Data cleaning: Call stack: use regular expressions to extract; clean up line numbers, offsets and memory address redundant information; manually define a shielding list to filter out functions unrelated to the crash cause; vulnerability type: extract from the report text, remove the Sanitizer name and specific location information, and retain the error nature; file path: extract the modified file path from the repair submission as the authoritative identifier of the vulnerability location.

3. The open source operating system directed fuzz testing framework development and vulnerability mining method of claim 2, wherein, 2) Extract multi-dimensional features from the multi-dimensional vulnerability sample set, including three categories of feature information: vulnerability type, call stack and file path, and vectorize them to obtain the multi-dimensional feature vector of the vulnerability data set, including: 201) Feature extraction: Feature dimensions: extract three core features from each vulnerability sample: vulnerability type, file path, and call stack; feature extraction method: vulnerability type / file path: vectorize using TF-IDF, then calculate the cosine similarity matrix; file path additionally uses Jaccard similarity as a comparison; call stack: sequence weighting: assign weights to the stack sequence from top to bottom with exponential decay, emphasizing the importance of functions near the top of the stack; function similarity: calculate the similarity between function names; use Jaccard distance and cosine distance based on TF-IDF; sequence distance: combine the two weights and use DTW and Levenshtein algorithms to calculate the final distance between stack sequences; normalization: use a Gaussian kernel function to convert the distance matrix to a similarity matrix; 202) Feature fusion: Fuse the 12 similarity matrices using 4 strategies, including: kernel matrix concatenation followed by dimensionality reduction, dimensionality reduction followed by vector concatenation, similarity matrix weighted addition followed by dimensionality reduction, and kernel matrix weighted addition followed by dimensionality reduction; Determine the optimal weight of each dimension through grid search; use kernel PCA for dimensionality reduction to finally obtain a unified 25-dimensional feature vector for clustering.

4. The open source operating system directed fuzz testing framework development and vulnerability mining method of claim 1, wherein, 3) From the multi-dimensional feature vectors of the vulnerability dataset, fuse according to the weight relationship between features, and get vulnerability clusters through improved density clustering algorithm, including: First re-clustering: purpose: to ensure that the clustering result is dominated by vulnerability type; method: first, HDBSCAN clustering is performed on the 216 original vulnerability type texts, which are merged into 50 high-cohesion, noise-free macro vulnerability categories / clusters; this label will guide the second re-clustering; Second heavy clustering: input: 50 high-cohesion, noise-free macro vulnerability clusters obtained by the first heavy clustering, and the multi-dimensional feature vector of the vulnerability data set obtained in step 2); method: for the samples in each cluster G_k of the first heavy, clustering is performed again using HDBSCAN; adaptive threshold: size threshold: if |G_k| < 10, no subdivision is performed, and the original cluster is retained; quality threshold: the average silhouette coefficient S_k of the sub-clusters after subdivision is calculated; if S_k ≥ 0.35, the subdivision result is accepted; otherwise, the subdivision is rejected, and the original cluster G_k is retained; output: finally, 95 high-purity, fine-grained vulnerability clusters are obtained, and the average silhouette coefficient reaches 0.

709. _k; if S _k ≥ 0.35, the subdivision result is accepted; otherwise, the subdivision is rejected, and the original cluster G_k is retained; output: finally, 95 high-purity, fine-grained vulnerability clusters are obtained, and the average silhouette coefficient reaches 0.

709.

5. The open source operating system directed fuzz testing framework development and vulnerability mining method of claim 1, wherein, 4) From the vulnerability clusters, identify and get potential high-risk code regions through abstract syntax tree node matching and comparison, including: Module community division: based on the control flow / data flow dependency relationship of Linux kernel code, use graph partitioning algorithm to divide 2542 kernel modules into 2320 communities; Abstract syntax tree extraction: use the tree_sitter parser to parse the kernel C source file, extract function definition key syntax nodes, and ignore simple variable type independent nodes; Node similarity matching: for each pair of similar module pairs and module vulnerability function pairs, calculate the TF-IDF cosine similarity of all function nodes in the similar module with the AST nodes of the original module vulnerability function, and find the most similar function node in the similar module to the original module vulnerability function; Output: finally get 34 high-risk vulnerability function node lists.

6. The open source operating system directed fuzz testing framework development and vulnerability mining method of claim 1, wherein, 5) From the potential high-risk code region, perform code instrumentation, path analysis, and AFLGo directed fuzz testing to finally realize the automated verification and detection of potential vulnerabilities, including: Compilation command acquisition: use the bear tool to compile the entire kernel to generate the compile_commands.json database, which records the complete compilation parameters of each source file; Target positioning: use ctags to determine the line number of the target function in the file and write it into BBtargets.txt; Compilation option adaptation: extract the compilation parameters of the target file from compile_commands.json, replace gcc with the compiler of AFLGo, and remove incompatible options; Stubs function generation: when compiling the target file, it will report an error due to missing dependencies. The automation script parses these undefined symbols and generates a stubs.c file containing empty implementations; Test entry generation: automatically generate main.c and corresponding test input input.txt that call the target function; Instrumentation and linking: compile the target file.c, main.c, and stubs.c with the AFLGo compiler, then link them into an executable file; Distance calculation and testing: run the gen_distance_fast.py script of AFLGo to generate the distance configuration file distance.cfg.txt; finally, perform directed fuzz testing.

7. An apparatus for developing a targeted fuzzing framework and vulnerability mining of open source operating systems, characterized in that, Including: Multi-dimensional vulnerability sample set construction unit, obtain and process crash reports and repair submission information from the fuzz testing platform, construct and get multi-dimensional vulnerability sample set; A multi-dimensional feature extraction and vectorization unit extracts multi-dimensional features from the multi-dimensional vulnerability sample set, including three categories of feature information: vulnerability type, call stack, and file path, and vectorizes them to obtain the multi-dimensional feature vector of the vulnerability data set; A density clustering algorithm clustering unit fuses the features according to the weight relationship between the features, and clusters them through an improved density clustering algorithm to obtain vulnerability clusters; A potential high-risk code region identification unit identifies and obtains potential high-risk code regions through abstract syntax tree node matching and comparison from the vulnerability clusters; An automated verification and detection unit performs code insertion, path analysis, and AFLGo directed fuzz testing on the potential high-risk code regions to ultimately achieve automated verification and detection of potential vulnerabilities.

8. The open source operating system directed fuzz testing framework development and vulnerability mining apparatus of claim 7, wherein, In the multi-dimensional vulnerability sample set construction unit, the crash reports and repair submission information from the fuzz testing platform are obtained and processed to construct and obtain a multi-dimensional vulnerability sample set, including: Data source: Obtain vulnerability reports marked as "Fixed" and their corresponding repair submissions from the syzbot platform; randomly select up to 5 crash reports for each vulnerability, a total of 6025 data, to ensure data diversity; Data cleaning: Call stack: use regular expressions to extract; clean up line numbers, offsets, and memory address redundant information; manually define a shielding list to filter out functions unrelated to the crash cause; vulnerability type: extract from the report text, remove the Sanitizer name and specific location information, and retain the error essence; file path: extract the modified file path from the repair submission as the authoritative identifier of the vulnerability location.

9. The open source operating system directed fuzz testing framework development and vulnerability mining apparatus of claim 8, wherein, In the multi-dimensional feature extraction and vectorization unit, multi-dimensional features are extracted from the multi-dimensional vulnerability sample set, including three categories of feature information: vulnerability type, call stack, and file path, and they are vectorized to obtain the multi-dimensional feature vector of the vulnerability data set, including: 201) Feature extraction: Feature dimensions: Extract three core features from each vulnerability sample: vulnerability type, file path, and call stack; Feature extraction method: vulnerability type / file path: vectorize using TF-IDF, then calculate the cosine similarity matrix; file path additionally uses Jaccard similarity as a comparison; call stack: intra-sequence weighting: assign weights to the stack sequence from top to bottom with exponential decay, emphasizing the importance of functions near the top of the stack; inter-function similarity: calculate the similarity between function names; use Jaccard distance and cosine distance based on TF-IDF; sequence distance: combine the two weights and use DTW and Levenshtein algorithms to calculate the final distance between stack sequences; normalization: use a Gaussian kernel function to convert the distance matrix to a similarity matrix; 202) Feature fusion: Fuse the 12 similarity matrices using four strategies, including: kernel matrix concatenation and dimension reduction, dimension reduction and vector concatenation, similarity matrix weighted addition and dimension reduction, and kernel matrix weighted addition and dimension reduction; The optimal weight of each dimension is determined by grid search; and kernel PCA is used for dimension reduction, and finally a unified 25-dimensional feature vector is obtained for clustering.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program, when executed by the processor, implements the steps of the open source operating system oriented fuzz testing framework development and vulnerability mining method in any one of claims 1-6.

Images