A deep learning-based adaptive fuzzing method and system

Abstract

This invention relates to the field of software testing technology, specifically to an adaptive fuzz testing method and system based on deep learning, comprising the following steps: injecting software analysis instrumentation probes into the binary conditional jump instruction locations of the target test program; loading an initial test case set to perform branch execution operations of the program logic; generating instrumentation execution trajectory data; and inputting the instrumentation execution trajectory data into a multivariate fitting calculation structure. In this invention, a high-priority scheduling mechanism triggered by sparsity is used to dynamically adjust the execution order of the test sequence, ensuring that computing resources are concentrated on test cases located at the exploration boundary or uncovered logic regions. This mechanism breaks the traditional testing's tendency to fall into local optima, guides the testing direction from the novelty dimension of data distribution, enhances the ability to mine deep program paths, and improves the coverage and overall efficiency of vulnerability detection.

Description

Technical Field

[0001] This invention relates to the field of software testing technology, and in particular to an adaptive fuzz testing method and system based on deep learning. Background Technology

[0002] Software testing technology is a technique used throughout the software development lifecycle to verify and validate program code, functional modules, and the system as a whole. It uses systematic methods to discover logical defects, runtime errors, and potential security vulnerabilities in the software design and implementation process.

[0003] Existing technologies often rely on random mutation or symbolic execution to generate test inputs in practical applications, which frequently encounters efficiency bottlenecks and scalability issues. Random mutation strategies lack awareness of the program's internal logic, relying solely on probability to randomly flip or concatenate input data. When encountering magic number matching, checksum checks, or deeply nested conditions, it's difficult to generate valid samples that satisfy specific constraints, resulting in time wasted on repeatedly executing invalid paths and slow code coverage growth. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing an adaptive fuzz testing method and system based on deep learning.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: an adaptive fuzz testing method based on deep learning, comprising the following steps:

[0006] The software analysis instrumentation probe is injected into the binary conditional jump instruction position of the target test program, the initial test case set is loaded to perform branch execution operations of the program logic, and instrumentation execution trajectory data is generated. The instrumentation execution trajectory data is input into the multivariate fitting calculation structure to establish a nonlinear mapping relationship between the input byte variables and the branch distance variables, and a branch constraint differentiable function structure is generated.

[0007] Based on the branch constraint differentiable function structure, calculate the path coverage loss value, solve the partial derivative gradient vector of the input byte vector for the path coverage loss value, and subtract the product of the partial derivative gradient vector and the preset step size coefficient from the original input byte vector to generate gradient optimization candidate seeds.

[0008] The gradient optimization candidate seed is input into the feature dimensionality reduction mapping structure to generate a low-dimensional potential feature vector. The coordinate vector matrix of the existing seeds in the repository is called to calculate the seed space sparsity value between the low-dimensional potential feature vector and the K nearest neighbor vectors in the matrix.

[0009] The seed space sparsity value is compared with a preset novelty determination threshold constant. When the seed space sparsity value is greater than the novelty determination threshold constant, the current sample is determined to be located in a low-density blank area of ​​the feature space, a sparse region trigger signal is generated, and in response to the sparse region trigger signal, a seed enqueue operation is performed. The sample that generates the signal is marked as a high-priority scheduling object and added to the test sequence, and an updated fuzzy test queue is generated.

[0010] Preferably, the step of obtaining the branch-constrained differentiable function structure is as follows:

[0011] Locate the opcode sequence of conditional jump instructions in the binary instruction stream of the target test program, record the offset address and target address of each conditional jump instruction and write them into the software analysis instrumentation probe, load the driver logic of the initial test case set for branch execution, capture the input byte stream and compare the path identifier sequence of the current branch execution path and the uncovered target path item by item, count the order difference count, depth difference count and hit count, and generate instrumentation execution trajectory data.

[0012] The staking execution trajectory data is input into a multivariate fitting calculation structure. The input byte stream field and branch distance value field in the staking execution trajectory data are parsed. The input byte variable index and branch distance variable index are configured as independent channels and an output identifier is set. A nonlinear mapping relationship between the input byte variable and the branch distance variable is established based on the field correspondence and index correspondence.

[0013] Based on the nonlinear mapping relationship between the input byte variable and the branch distance variable, the internal weight parameter set and internal bias parameter set of the multivariate fitting calculation structure are locked, the external update entry of the multivariate fitting calculation structure is closed, and the mapping output scale and output domain range are fixed to form a branch-constrained differentiable function structure.

[0014] Preferably, the step of obtaining the path coverage loss value is as follows:

[0015] The input byte vector is fed into the branch constraint differentiable function structure in byte order. The output value of each branch node in the function structure is read. The logical value of the target uncovered path is recorded and the mapping relationship between the branch node and the logical value is established. The difference between the output value and the logical value of the target uncovered path is calculated in turn. The positive and negative direction information and magnitude value of the difference are retained to generate the output deviation vector.

[0016] The path coverage loss value is calculated based on the output deviation vector.

[0017] Preferably, the step of obtaining the gradient optimization candidate seed is as follows:

[0018] Based on the path coverage loss value, the input byte vector is subjected to inverse differentiation to solve for the partial derivative gradient vector of the input byte vector. The branch constraint differentiable function structure parameters are kept unchanged. The product of the partial derivative gradient vectors is subtracted from the input byte vector item by item according to the preset step size coefficient to generate gradient optimization candidate seeds.

[0019] Preferably, the step of obtaining the low-dimensional latent feature vector is as follows:

[0020] The gradient optimization candidate seed is input into the feature dimensionality reduction mapping structure, each input component is extracted and linearly normalized, the linear normalization result is linearly combined according to the mapping channel weight and the dimensionality reduction coordinate sequence is output, and the dimensionality reduction coordinate sequence is arranged in order to generate a low-dimensional potential feature vector.

[0021] Preferably, the step of obtaining the seed spatial sparsity value is as follows:

[0022] Call the coordinate vector matrix of the existing seeds in the repository, calculate the Euclidean distance between the low-dimensional latent feature vector and each coordinate vector, sort the Euclidean distance values ​​in ascending order and select the K vectors with the smallest distance, and extract the corresponding Euclidean distance value sequence as the Euclidean distance set of the K nearest neighbors.

[0023] The sparsity value of the seed space is calculated based on the set of Euclidean distances.

[0024] Preferably, the step of obtaining the sparse region trigger signal is as follows:

[0025] Read the numerical field of the sparsity value of the seed space, read the field of the novelty judgment threshold constant, and when the comparison relationship satisfies the condition, record the sample position as a low-density blank area in the feature space and register the sample identifier and timestamp to generate a sparse region trigger signal.

[0026] Preferably, the step of obtaining the updated fuzzy testing queue is as follows:

[0027] Based on the sparse region trigger signal, extract the sample identifier, timestamp, and low-dimensional latent feature vector index, set a high-priority scheduling label and enqueue identifier, calculate the insertion position number in the sequence to be tested according to the priority insertion rule and lock the position, perform seed enqueue operation and write it into the enqueue record to form the sequence to be tested.

[0028] Based on the sequence to be tested, read the priority field and execution time field of the test task scheduling list, clear the scheduling items with the status of completion and keep the incomplete scheduling items, rearrange the sequence to be tested and the test task scheduling list according to the high priority scheduling label, merge adjacent scheduling items with the same target program and update the execution time field, write the rearrangement result, and generate the updated fuzzy test queue.

[0029] The present invention also provides a system comprising:

[0030] The instrumentation analysis module is used to inject software analysis instrumentation probes into the binary conditional jump instruction position of the target test program, load the initial test case set to perform branch execution operations of the program logic, generate instrumentation execution trajectory data, input the instrumentation execution trajectory data into the multivariate fitting calculation structure, establish a nonlinear mapping relationship between the input byte variables and the branch distance variables, and generate a branch constraint differentiable function structure.

[0031] The gradient optimization module is used to calculate the path coverage loss value based on the branch constraint differentiable function structure, solve the partial derivative gradient vector of the input byte vector with respect to the path coverage loss value, and subtract the product of the partial derivative gradient vector and the preset step size coefficient from the original input byte vector to generate gradient optimization candidate seeds.

[0032] The feature mapping module is used to input the gradient optimization candidate seed into the feature dimensionality reduction mapping structure, generate a low-dimensional potential feature vector, call the coordinate vector matrix of the existing seeds in the repository, and calculate the seed space sparsity value between the low-dimensional potential feature vector and the K nearest neighbor vectors in the matrix.

[0033] The novelty determination and queue scheduling module is used to compare the sparsity value of the seed space with a preset novelty determination threshold constant. When the sparsity value of the seed space is greater than the novelty determination threshold constant, it is determined that the current sample is located in a low-density blank area of ​​the feature space, a sparse region trigger signal is generated, and in response to the sparse region trigger signal, a seed enqueue operation is performed, the sample that generates the signal is marked as a high-priority scheduling object and added to the test sequence, and an updated fuzzy test queue is generated.

[0034] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0035] This invention, by injecting software analysis instrumentation probes into the conditional jump positions of the target program and capturing the byte stream, constructs a nonlinear mapping relationship between input variables and branch distances, thereby transforming discrete program logic into a continuously differentiable function structure. Based on this structure, path coverage loss is calculated and inverse differentiation is performed to solve the partial derivative gradient of the input vector. This gradient information guides the iterative update of input bytes. This targeted optimization strategy overcomes the blindness of random mutations in the face of complex constraints, increasing the probability of generating effective test cases. Combining feature dimensionality reduction and nearest neighbor search techniques to calculate seed space sparsity quantifies the distribution density of samples in the feature space, identifying potentially high-value samples in low-density blank areas. A high-priority scheduling mechanism is triggered based on sparsity, dynamically adjusting the execution order of the test sequence to ensure that computing resources are concentrated on test cases located at the exploration boundary or uncovered logic regions. This mechanism breaks the traditional testing's tendency to get trapped in local optima. By guiding the testing direction from the novelty dimension of data distribution, it enhances the ability to mine deep program paths, improving vulnerability detection coverage and overall efficiency. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0038] Please see Figure 1 This invention provides a technical solution, an adaptive fuzz testing method based on deep learning, comprising the following steps:

[0039] The software analysis instrumentation probe is injected into the binary conditional jump instruction position of the target test program, the initial test case set is loaded to perform branch execution operations of the program logic, the instrumentation execution trajectory data is generated, the instrumentation execution trajectory data is input into the multivariate fitting calculation structure, a nonlinear mapping relationship between the input byte variables and the branch distance variables is established, and a branch constraint differentiable function structure is generated.

[0040] Based on the branch-constrained differentiable function structure, calculate the path coverage loss value. For the path coverage loss value, solve the partial derivative gradient vector of the input byte vector. Subtract the product of the partial derivative gradient vector and the preset step size coefficient from the original input byte vector to generate gradient optimization candidate seeds.

[0041] The gradient optimization candidate seed is input into the feature dimensionality reduction mapping structure to generate a low-dimensional potential feature vector. The coordinate vector matrix of the existing seeds in the repository is called to calculate the seed space sparsity value between the low-dimensional potential feature vector and the K nearest neighbor vectors in the matrix.

[0042] The sparsity value of the seed space is compared with the preset novelty judgment threshold constant. When the sparsity value of the seed space is greater than the novelty judgment threshold constant, it is determined that the current sample is located in a low-density blank area of ​​the feature space, a sparse region trigger signal is generated, and in response to the sparse region trigger signal, the seed enqueue operation is performed. The sample that generates the signal is marked as a high-priority scheduling object and added to the test sequence, and an updated fuzzy test queue is generated.

[0043] The steps to obtain the structure of a branch-constrained differentiable function are as follows:

[0044] Locate the opcode sequence of conditional jump instructions in the binary instruction stream of the target test program, record the offset address and target address of each conditional jump instruction and write them into the software analysis instrumentation probe, load the driver logic of the initial test case set for branch execution, capture the input byte stream and compare the path identifier sequence of the current branch execution path and the uncovered target path item by item, count the order difference count, depth difference count and hit count, and generate instrumentation execution trajectory data.

[0045] Input the staking execution trajectory data into the multivariate fitting calculation structure, parse the input byte stream field and branch distance value field in the staking execution trajectory data, configure the input byte variable index and branch distance variable index as independent channels and set the output identifier, and establish a non-linear mapping relationship between the input byte variable and the branch distance variable based on the field correspondence and index correspondence.

[0046] Based on the nonlinear mapping relationship between the input byte variables and the branch distance variables, the internal weight parameter set and internal bias parameter set of the multivariate fitting calculation structure are locked, the external update entry of the multivariate fitting calculation structure is closed, and the mapping output scale and output domain range are fixed to form a branch-constrained differentiable function structure.

[0047] Specifically, the opcode sequence of conditional jump instructions is located in the binary instruction stream of the target test program. A disassembler engine is used to traverse the code segment of the program under test, identifying machine code features corresponding to conditional jump instructions such as JZ, JNZ, and JE. For example, data segments starting with hexadecimal signatures 0x74 or 0x0F are matched. The offset address of each conditional jump instruction in the virtual memory space and the relative offset of the jump target address are recorded. At these addresses, software analysis instrumentation probes are inserted using dynamic binary rewriting technology. This probe, implemented through assembly code, saves the current register state and instruction pointer to a pre-allocated shared memory area, loads the initial test case set driver logic for branch execution, reads binary input content from a pre-set seed library, maps it to the target program's standard input stream or a specified memory buffer, starts the program, and monitors the process state in a sandbox environment. Whenever the program execution flow touches an instrumentation point, the probe automatically triggers and records the current basic block. The system captures the input byte stream and compares the path identifier sequence of the current branch execution path with the path identifier sequence of the uncovered target path item by item. It retrieves control flow graph data, extracts the path node sequence where the target uncovered edge is located as the baseline sequence, and uses the actual executed path node sequence as the comparison sequence. The longest common subsequence algorithm is used to calculate the matching degree between the two, and counts the sequence difference count, depth difference count, and hit count. The sequence difference count is obtained by calculating the edit distance between the baseline sequence and the comparison sequence, i.e., how many insertion, deletion, or replacement operations are required to make them consistent. The depth difference count is for loop structures, and counts the difference between the number of times the loop body is executed and the expected number of times. If the difference is less than a preset ignore threshold of 5 times, it is not counted. If it is greater than 5 times, it is recorded according to the actual difference. This threshold is set according to the conventional optimization depth of loop expansion. The hit count is directly accumulated by the frequency of the branch instruction being executed. All the above metrics are summarized, arranged by timestamp index, and instrumentation execution trajectory data is generated.

[0048] The instrumentation trajectory data is input into a multivariate fitting computation structure, which is a fully connected deep neural network containing an input layer, three hidden layers, and an output layer. The hidden layers contain 1024, 512, and 256 neurons respectively. The ReLU activation function is used to introduce non-linear features. The input byte stream field and branch distance numerical field in the instrumentation trajectory data are parsed. The input byte stream is converted into a numerical vector; for example, the byte 0xFF is converted to the floating-point number 255.0, and normalized to distribute it between 0 and 1. Simultaneously, the branch distance numerical value is extracted as the regression target. The input byte variable index and branch distance variable index are configured as independent channels, and output identifiers are set. A unique channel ID is assigned to each input byte position; for example, if the input length is N, an index from 0 to N-1 is assigned. The corresponding branch distance is used as the unique output channel. A non-linear mapping relationship between the input byte variable and the branch distance variable is established based on the field correspondence and index correspondence. The network weight parameters are initialized using the Xavier initialization method, and the calculation formula is as follows: ,in For weight parameters, To ensure uniform distribution, This represents the number of input units in the current layer. Set the training hyperparameters to the number of output units in the current layer, with a learning rate of 0.001 and a batch size of 64. Iteratively train the network using the stochastic gradient descent algorithm, inputting a normalized byte vector. Calculate the predicted branch distance using forward propagation, and calculate the mean squared error loss between the predicted and actual branch distances. Update the network weights using backpropagation until the loss value converges to below a preset error threshold of 0.01. This threshold is determined by analyzing the convergence curves of historical training data and selecting the inflection point where the loss decreases gradually. This completes the fitting process and establishes a nonlinear mapping relationship between the input byte variable and the branch distance variable.

[0049] Based on the nonlinear mapping relationship between the input byte variables and the branch distance variables, the neural network model state after the previous training stage is switched to inference mode. Each layer connection in the network is traversed, and the weight matrix and bias vector after training convergence are extracted. These parameters are marked as untrainable, i.e., the gradient backpropagation path for these parameters is cut off in the computational graph to prevent changes to the model's inherent characteristics during subsequent optimization of the input. The internal weight parameter set and internal bias parameter set of the multivariate fitting computational structure are locked. Specifically, the parameter attribute `grad_req` in the deep learning framework is set to null or false, the external update entry of the multivariate fitting computational structure is closed, and the mapping output scale and output domain range are fixed. The optimizer's stepping operation is stopped, and the target value normalization parameters recorded during the training stage, including the maximum value, are read. and minimum value Construct an inverse normalization layer to ensure that the model output can be restored to the true physical branch distance. The calculation formula is as follows: ,in To restore the true branch distance, The normalized output value of the model. The maximum value of the branch distance samples in the training set. To find the minimum value of the branch distance samples in the training set, and to limit the input domain to the normalized interval corresponding to the effective byte values ​​0 to 255, a mathematical model is constructed with the input byte as the independent variable and the branch distance as the dependent variable. This model supports automatic differentiation of the input variables, forming a branch-constrained differentiable function structure.

[0050] The steps to obtain the path coverage loss value are as follows:

[0051] The input byte vector is fed into the branch constraint differentiable function structure in byte order. The output value of each branch node in the function structure is read. The logic value of the target uncovered path is recorded and the mapping relationship between the branch node and the logic value is established. The difference between the output value and the logic value of the target uncovered path is calculated in turn. The positive and negative direction information and magnitude value of the difference are retained to generate the output deviation vector.

[0052] Based on the output deviation vector, the path coverage loss value is calculated using the following formula:

[0053] ;

[0054] Where E is the path coverage loss value, and r is the number of components in the output bias vector. Let be the value of the a-th output bias vector component. Let be the normalized path distance of the a-th branch from the uncovered path to the target in the control flow graph. As a key adjustment factor, it controls the sensitivity of the weights to changes in distance. The weighted terms are in the form of a hyperbolic tangent function. For Huber's loss function, when hour ,when hour , This is the deviation threshold, used to distinguish the inflection point between squared loss and linear loss.

[0055] Specifically, the input byte vector is fed into the branch-constrained differentiable function structure in byte order. First, the deep learning inference engine is invoked to load the preprocessed input byte data into a memory tensor. This input data has been mapped to the floating-point range of 0 to 1 through max-min normalization. The forward propagation process of the computation graph is then initiated, and the data flows through the linear weighting and ReLU activation functions of multiple layers of neurons. Finally, a prediction result vector is generated in the output layer. Each dimension of this result vector represents the predicted logarithmic distance of the corresponding program branch, meaning that the model fits the natural logarithmic form of the actual branch distance. To compress the dynamic range of values, the system reads the output value of each branch node in the function structure, iterates through the output tensor to extract each floating-point value, and loads the identification information of the current target basic block according to the test task configuration. It also records the logical values ​​of the uncovered paths of the target and establishes a mapping relationship between branch nodes and logical values, setting the ideal distance of the target branch to 0 (i.e., ...). This means that the target path is completely hit at the branch point. For non-target branches, they are ignored or set as background values. The difference between the output value and the logical value of the target uncovered path is calculated in turn. Vector subtraction is performed. The logarithmic distance predicted by the model is subtracted from the ideal value of 0 to obtain the prediction bias of each branch. The positive and negative direction information and magnitude of the difference are retained. The absolute value is not calculated. The signed floating-point sequence is directly stored in the memory buffer as the basis for subsequent loss calculation and the output bias vector is generated.

[0056] In the formula for calculating the path coverage loss, the weights of branches at different distances are adaptively adjusted using the hyperbolic tangent function, so that the model can remain sensitive to small changes in the critical path while focusing on global path coverage.

[0057] parameter The number of components in the output bias vector is obtained by parsing the binary control flow graph of the target program and counting the number of all conditional jump instructions contained therein. For example, when analyzing a specific encryption algorithm function, if 16 key decision nodes are identified, then this parameter is set... This corresponds to the 16 channels of the neural network output layer;

[0058] parameter For the first The value of each output bias vector component is derived from the logarithmic distance bias calculated in the previous step, which is the difference between the logarithmic branch distance predicted by the neural network and the ideal zero distance. It is obtained by reading the inference results in real time. Due to the use of logarithmic transformation, its value range is usually between -5.0 and +10.0, avoiding gradient explosion caused by the original distance value being too large.

[0059] parameter For the first The normalized path distance of each branch to the uncovered path of the target in the control flow graph is obtained by performing a breadth-first search (BFS) on the control flow graph to calculate the shortest topological path length (number of hops) from the current branch node to the target basic block, denoted as . At the same time, the maximum diameter of the entire control flow graph is calculated. (For example, the distance between the two farthest points in the diagram is 50 jumps), using the formula Calculated to ensure A dimensionless value between 0 and 1;

[0060] parameter As a key regulating factor, it controls the sensitivity of the weights to changes in distance. This parameter was determined based on hyperparameter sensitivity analysis experiments, and different parameters were tested on a standard test set. The effect of values ​​(from 0.1 to 5.0) on the convergence speed was observed when... At that time, weight function This setting is most effective at establishing differentiation between close branches (high weight) and distant branches (low weight). ;

[0061] parameter The bias threshold is used to distinguish between squared loss and linear loss. This parameter is set based on the error distribution during the statistical model pre-training phase. Output bias data from the first 1000 iterations is collected, and the interquartile range (IQR) of its distribution is calculated. The IQR value is 1.5 times, for example, statistically obtained. This ensures that the vast majority of normal prediction errors fall within the squared loss range, while extremely erroneous predictions fall within the linear loss range.

[0062] Calculations based on parameters:

[0063] The current focus is on only the two main branch channels, i.e. ;

[0064] Branch 1 Status: Prediction Log Bias Normalized path distance (Very close to the target);

[0065] Branch 2 State: Prediction Log Bias (Prediction error is relatively large), normalized path distance (Far from the target);

[0066] Set adjustment factor Deviation threshold ;

[0067] Calculate the distance weight for branch 1:

[0068] ;

[0069] Calculated ;

[0070] ;

[0071] Calculate the distance weight for branch 2:

[0072] ;

[0073] Calculated

[0074] ;

[0075] Calculate the Huber loss for branch 1 (due to...) (using squared loss)

[0076] ;

[0077] Calculate the Huber loss for branch 2 (due to...) (using linear loss)

[0078] ;

[0079] Calculate the numerator (weighted total loss):

[0080] ;

[0081] ;

[0082] Calculate the denominator (total weight):

[0083] ;

[0084] Calculate the final path coverage loss value :

[0085] ;

[0086] The results indicate that the program path triggered by the current input differs significantly from the target path. The total loss of 1.465 is mainly contributed by branch 2, which is farther away and has a larger prediction error. This loss value needs to be used to calculate the gradient to correct the input bytes.

[0087] The steps for obtaining candidate seeds for gradient optimization are as follows:

[0088] Based on the path coverage loss value, the input byte vector is subjected to inverse differentiation to solve for the partial derivative gradient vector of the input byte vector. While keeping the branch constraint differentiable function structure parameters locked, the product of the partial derivative gradient vectors is subtracted from the input byte vector item by item according to the preset step size coefficient to generate gradient optimization candidate seeds.

[0089] Specifically, based on the path coverage loss value, the input byte vector is subjected to inverse differentiation to solve for the partial derivative gradient vector of the input byte vector. Then, using the automatic differentiation mechanism provided by deep learning frameworks (such as PyTorch or TensorFlow), the gradient is derived from the calculated scalar loss value. The backpropagation algorithm is executed, and the system calculates the partial derivatives of the loss function with respect to each byte variable in the input layer, following the chain rule. This process generates a gradient vector with the same dimension as the input vector, indicating how each byte should change to reduce path coverage loss. It maintains the branch constraints, differentiable function structure parameters, and locks them in place. During backpropagation, the weight matrices and bias vectors of all fully connected layers in the neural network are explicitly frozen, and their `requires_grad` attribute is set to `False` to ensure that the gradient flow is only propagated back to the input without updating the model parameters. The step size of gradient descent is set by subtracting the product of the partial derivative gradient vectors from each item in the input byte vector by a preset step size factor. The coefficient is set based on the scale characteristics of the logarithmic distance gradient, which aims to amplify the small gradient signal to a magnitude sufficient to change the integer input byte. An update operation is performed, and for each updated component, boundary constraint processing is performed, which truncates it between 0 and 255 and rounds it to an integer type to generate gradient optimization candidate seeds.

[0090] The steps for obtaining low-dimensional latent feature vectors are as follows:

[0091] The gradient optimization candidate seed is input into the feature dimensionality reduction mapping structure. Each input component is extracted and linearly normalized. The linear normalization result is linearly combined according to the mapping channel weights and the dimensionality reduction coordinate sequence is output. The dimensionality reduction coordinate sequence is arranged in order to generate a low-dimensional potential feature vector.

[0092] Specifically, the gradient optimization candidate seeds are input into the feature dimensionality reduction mapping structure. First, the binary data of the input candidate seeds is formatted and parsed, converted into a floating-point tensor format, and then element-wise linear normalization is performed. Using preset numerical range boundary values, the integer value of each byte is divided by 255 to map it to the normalized interval of 0 to 1, preventing weight imbalance due to differences in numerical magnitudes in subsequent calculations. The internal parameter matrix of the feature dimensionality reduction mapping structure is then invoked. The mapping channel weights of this matrix are trained using Principal Component Analysis (PCA) on a benchmark dataset containing 50,000 historical valid seeds, preserving the data that can explain 95% of the data. The first 16 principal feature components of the variance are extracted, and each input component is linearly normalized. Matrix multiplication is then initiated in the computation engine, and the normalized high-dimensional input vector is multiplied by the weight matrix. Each input component is multiplied by its corresponding mapping channel weight and accumulated. This process achieves data compression and feature extraction. The linear normalization results are linearly combined according to the mapping channel weights to output a dimensionality-reduced coordinate sequence. The generated coordinate sequence is then trimmed to retain six decimal places to reduce storage overhead. Finally, the calculated sequence containing 16 floating-point values ​​is encapsulated, and the dimensionality-reduced coordinate sequence is arranged in order to generate a low-dimensional latent feature vector.

[0093] The steps to obtain the seed space sparsity value are as follows:

[0094] Call the coordinate vector matrix of the existing seeds in the repository, calculate the Euclidean distance between the low-dimensional latent feature vector and each coordinate vector, sort the Euclidean distance values ​​in ascending order and select the K vectors with the smallest distance, and extract the corresponding Euclidean distance value sequence as the Euclidean distance set of the K nearest neighbors.

[0095] The sparsity value of the seed space is calculated based on the Euclidean distance set, using the following formula:

[0096] ;

[0097] Where S is the sparsity value of the seed space. Let be the average of the Euclidean distances of the K nearest neighbors. , Let $k$ be the $i$-th Euclidean distance value, $i$ be the summation index, and $K$ be the number of nearest neighbor vectors. It is the minimum value among the K Euclidean distance values. , It is a very small positive constant used to prevent the denominator from being zero.

[0098] Specifically, the system calls the coordinate vector matrix of existing seeds in the repository. This matrix stores the low-dimensional feature representations of all seeds enqueued during fuzzing. The system first requests a read lock to ensure data consistency. Using linear scanning or KD-Tree index traversal, it reads each row of vectors in the matrix, calculates the Euclidean distance between the low-dimensional latent feature vector and each coordinate vector, and for each pair of vectors, calculates the square of the difference in each dimension. The squared differences of all dimensions are summed, and the sum is then divided by the square root to obtain the Euclidean distance representing the similarity between the two in the feature space. Each calculation result is temporarily stored in a distance buffer list. The results are sorted in ascending order of Euclidean distance values, and the K vectors with the smallest distances are selected. A max-heap structure with a capacity of K is maintained to filter the nearest neighbors. The value of K is set with reference to the stability principle of local density estimation. In the parameter sensitivity test conducted in the early stage, the clustering effect of K values ​​in the range of 5 to 50 was tested. It was found that when K is set to 10, it can most accurately reflect the local density around the sample. Therefore, K is fixed at 10, and the corresponding Euclidean distance value sequence is extracted as the Euclidean distance set of the K nearest neighbors.

[0099] In the seed space sparsity calculation formula, the average distance is weighted and corrected by combining the ratio of the average distance of the local neighborhood to the nearest neighbor distance. When the nearest neighbor distance is much smaller than the average distance (i.e. there are extremely close explored points), the exponential term generates a decay penalty, thereby reducing the sparsity score. This prioritizes the selection of "truly sparse" seeds that are not only sparse around them but also maintain a safe distance from the nearest known point, thus avoiding repeated exploration of the edges of known paths.

[0100] parameter The parameter represents the number of nearest neighbor vectors. The steps to obtain this parameter are as follows: During system initialization, based on the dimension of the feature space (e.g., 16 dimensions) and the expected capacity of the seed database (e.g., 100,000), a comparative experiment on the coverage growth rate was conducted on a standard test set to test the... Of the three configurations, the one with the fastest coverage growth and the lowest computational latency was ultimately selected. As a fixed parameter;

[0101] parameter For the first The Kth Euclidean distance value is derived from the set of K nearest neighbors calculated and sorted in the previous step, representing the distance between the current candidate seed and the Kth nearest neighbor in the feature space. The straight-line distance between the nearest existing seeds has a numerical unit consistent with the normalized scale of the feature vector;

[0102] parameter This is the average of the Euclidean distances to the K nearest neighbors. The steps to obtain this parameter are: traverse the arrays extracted in the previous steps... The set of distances for each floating-point number is summed, and then divided by the number of distances. This is used to reflect the overall dispersion of the current sample within its local neighborhood.

[0103] parameter The minimum value among K Euclidean distance values ​​can be obtained by either directly reading the first value in the distance set or finding the minimum value through comparison operations. This parameter represents the shortest distance between the current sample and the "known knowledge boundary", and is a key constraint for determining whether a sample is repeated.

[0104] parameter This is a very small positive constant used to prevent the denominator from being zero. This parameter is set according to the lower limit of the computer's floating-point precision, and its value is [value missing]. ;

[0105] Calculations based on parameters:

[0106] For example, the current setting The five nearest neighbor Euclidean distances extracted from the distance set are as follows: ;

[0107] Calculate the minimum value :

[0108] ;

[0109] Calculate the average value :

[0110] ;

[0111] set up ;

[0112] Calculate the ratio term:

[0113] ;

[0114] Calculate the internal term of the exponent:

[0115] ;

[0116] Calculate the value of the exponential function:

[0117] ;

[0118] Calculate the final sparsity value :

[0119] ;

[0120] The results show that although the average neighborhood distance of the sample is 0.7, its sparsity score is suppressed by a correction coefficient of 0.6703 due to the existence of a nearest neighbor with a distance of only 0.5, resulting in a final score of 0.4692. This reflects that its novelty is limited by the nearest neighbor, and the system will determine whether to add it to the test queue based on this score.

[0121] The steps for obtaining the trigger signal in the sparse region are as follows:

[0122] Read the numerical field of the sparsity value of the seed space, read the field of the novelty judgment threshold constant, and when the comparison relationship satisfies the condition, record the sample position as a low-density blank area in the feature space and register the sample identifier and timestamp, and generate a sparse region trigger signal.

[0123] Specifically, the numerical field of the seed space sparsity value is read, which stores the floating-point sparsity score calculated in the previous steps. Read the field of the novelty threshold constant, which is the threshold value. The setting is based on statistical analysis of historical fuzzy testing processes. It collects the sparsity data of all seeds that effectively triggered new branches in the past ten successful test tasks, calculates their lower quartiles (Q1), and then... Set it to 80% of the Q1 value, for example, based on statistical results. ,but This ensures that novel samples with sufficient discriminative power are selected. When the comparison relationship satisfies a condition greater than a certain threshold, the sample location is recorded as a low-density blank region in the feature space. When the current seed is located on the edge or in the blind zone of the known sample distribution, it has high exploration value. The metadata registration process is initiated, the current system time is obtained as the timestamp, and a unique sample identifier (ID) is generated. For example, a UUID generation algorithm is used. This information is written into the high-priority sample table along with the sparsity score, and the sample identifier and timestamp are registered to generate a sparse region trigger signal.

[0124] The updated steps for obtaining the fuzz test queue are as follows:

[0125] Based on the sparse region trigger signal, extract the sample identifier, timestamp, and low-dimensional latent feature vector index, set high-priority scheduling label and enqueue identifier, calculate the insertion position number in the sequence to be tested according to the priority insertion rule and lock the position, perform seed enqueue operation and write it into the enqueue record to form the sequence to be tested.

[0126] Based on the sequence to be tested, read the priority field and execution time field of the test task scheduling list, clear the scheduling items with the status of completed and keep the incomplete scheduling items, rearrange the sequence to be tested and the test task scheduling list according to the high priority scheduling label, merge adjacent scheduling items with the same target program and update the execution time field, write the rearrangement result, and generate the updated fuzzy test queue.

[0127] Specifically, based on the sparse region trigger signal, the key fields in the signal are captured through a listening mechanism, and the sample identifier, timestamp, and low-dimensional latent feature vector index are extracted. This metadata is packaged into a processing object, a high-priority scheduling label and enqueue identifier are set, and the scheduling priority field is set to "CRITICAL" or numerical level 1 (the highest level), which is different from the default level 3 of ordinary mutation seeds. The insertion position number in the test sequence is calculated according to the priority insertion rule and the position is locked. The head pointer and tail pointer of the current test sequence are read, and the priority attributes of the existing tasks in the sequence are traversed to find the position index of the first task with a priority lower than the current sample. For example, if the first 5 tasks in the current queue are all of the highest priority, the insertion position is locked as index 6. At the same time, the queue position is locked through a mutex lock mechanism to prevent concurrent write conflicts. The seed enqueue operation is performed and the enqueue record is written. The complete seed data structure (including the original binary content, metadata, and priority information) is written to the queue buffer, and the queue length counter is updated to form the test sequence.

[0128] Based on the sequence to be tested, the queue status is periodically scanned, the priority field and execution time field of the test task scheduling list are read, and the status flag of each scheduling item is checked. If the flag is COMPLETED or FAILED, it is considered completed. Scheduled items with a completed status are cleared and incomplete scheduled items are retained. The memory resources occupied by completed tasks are released. The sequence to be tested and the test task scheduling list are rearranged according to the high priority scheduling label. Merge sort is used, with the priority value as the first key (descending order) and the enqueue timestamp as the second key (ascending order) to ensure that high-priority tasks are executed first and tasks of the same level follow the first-in-first-out principle. Adjacent scheduling items with the same target program are merged and the execution time field is updated. The target_program_id of adjacent tasks after rearrangement is checked. If they are the same, they are merged into a batch execution task and their estimated execution time is accumulated to reduce the overhead of process switching and environment reset. The optimized scheduling scheme is written to the scheduling table, the corresponding pointer index is updated, and the updated fuzzy test queue is generated.

[0129] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A deep learning-based adaptive fuzzing method, characterized in that, Includes the following steps: The software analysis instrumentation probe is injected into the binary conditional jump instruction position of the target test program, the initial test case set is loaded to perform branch execution operations of the program logic, and instrumentation execution trajectory data is generated. The instrumentation execution trajectory data is input into the multivariate fitting calculation structure to establish a nonlinear mapping relationship between the input byte variables and the branch distance variables, and a branch constraint differentiable function structure is generated. Based on the branch constraint differentiable function structure, calculate the path coverage loss value, solve the partial derivative gradient vector of the input byte vector for the path coverage loss value, and subtract the product of the partial derivative gradient vector and the preset step size coefficient from the original input byte vector to generate gradient optimization candidate seeds. The gradient optimization candidate seed is input into the feature dimensionality reduction mapping structure to generate a low-dimensional potential feature vector. The coordinate vector matrix of the existing seeds in the repository is called to calculate the seed space sparsity value between the low-dimensional potential feature vector and the K nearest neighbor vectors in the matrix. The seed space sparsity value is compared with a preset novelty determination threshold constant. When the seed space sparsity value is greater than the novelty determination threshold constant, the current sample is determined to be located in a low-density blank area of ​​the feature space, a sparse region trigger signal is generated, and in response to the sparse region trigger signal, a seed enqueue operation is performed. The sample that generates the signal is marked as a high-priority scheduling object and added to the test sequence, and an updated fuzzy test queue is generated. The steps for obtaining the path coverage loss value are as follows: The input byte vector is fed into the branch constraint differentiable function structure in byte order. The output value of each branch node in the function structure is read. The logical value of the target uncovered path is recorded and the mapping relationship between the branch node and the logical value is established. The difference between the output value and the logical value of the target uncovered path is calculated in turn. The positive and negative direction information and magnitude value of the difference are retained to generate the output deviation vector. Based on the output deviation vector, the path coverage loss value is calculated using the following formula: ； Where E is the path coverage loss value, and r is the number of components in the output bias vector. Let be the value of the a-th output bias vector component. Let be the normalized path distance of the a-th branch from the uncovered path to the target in the control flow graph. As a key adjustment factor, it controls the sensitivity of the weights to changes in distance. The weighted terms are in the form of a hyperbolic tangent function. For Huber's loss function, when hour ,when hour , This is the deviation threshold, used to distinguish the inflection point between squared loss and linear loss; The steps for obtaining the gradient optimization candidate seeds are as follows: Based on the path coverage loss value, the input byte vector is subjected to inverse differentiation to solve for the partial derivative gradient vector of the input byte vector. The branch constraint differentiable function structure parameters are kept unchanged. The product of the partial derivative gradient vectors is subtracted from the input byte vector item by item according to the preset step size coefficient to generate gradient optimization candidate seeds.

2. The deep learning-based adaptive fuzz testing method according to claim 1, characterized in that, The steps for obtaining the branch-constrained differentiable function structure are as follows: Locate the opcode sequence of conditional jump instructions in the binary instruction stream of the target test program, record the offset address and target address of each conditional jump instruction and write them into the software analysis instrumentation probe, load the driver logic of the initial test case set for branch execution, capture the input byte stream and compare the path identifier sequence of the current branch execution path and the uncovered target path item by item, count the order difference count, depth difference count and hit count, and generate instrumentation execution trajectory data. The staking execution trajectory data is input into a multivariate fitting calculation structure. The input byte stream field and branch distance value field in the staking execution trajectory data are parsed. The input byte variable index and branch distance variable index are configured as independent channels and an output identifier is set. A nonlinear mapping relationship between the input byte variable and the branch distance variable is established based on the field correspondence and index correspondence. Based on the nonlinear mapping relationship between the input byte variable and the branch distance variable, the internal weight parameter set and internal bias parameter set of the multivariate fitting calculation structure are locked, the external update entry of the multivariate fitting calculation structure is closed, and the mapping output scale and output domain range are fixed to form a branch-constrained differentiable function structure.

3. The deep learning-based adaptive fuzz testing method according to claim 1, characterized in that, The steps for obtaining the low-dimensional latent feature vector are as follows: The gradient optimization candidate seed is input into the feature dimensionality reduction mapping structure, each input component is extracted and linearly normalized, the linear normalization result is linearly combined according to the mapping channel weight and the dimensionality reduction coordinate sequence is output, and the dimensionality reduction coordinate sequence is arranged in order to generate a low-dimensional potential feature vector.

4. The deep learning-based adaptive fuzz testing method according to claim 1, characterized in that, The steps for obtaining the seed spatial sparsity value are as follows: Call the coordinate vector matrix of the existing seeds in the repository, calculate the Euclidean distance between the low-dimensional latent feature vector and each coordinate vector, sort the Euclidean distance values ​​in ascending order and select the K vectors with the smallest distance, and extract the corresponding Euclidean distance value sequence as the Euclidean distance set of the K nearest neighbors. The sparsity value of the seed space is calculated based on the set of Euclidean distances.

5. The deep learning-based adaptive fuzz testing method according to claim 1, characterized in that, The steps for obtaining the sparse region trigger signal are as follows: Read the numerical field of the sparsity value of the seed space, read the field of the novelty judgment threshold constant, and when the comparison relationship satisfies the condition, record the sample position as a low-density blank area in the feature space and register the sample identifier and timestamp to generate a sparse region trigger signal.

6. The deep learning-based adaptive fuzz testing method according to claim 1, characterized in that, The steps for obtaining the updated fuzz test queue are as follows: Based on the sparse region trigger signal, extract the sample identifier, timestamp, and low-dimensional latent feature vector index, set a high-priority scheduling label and enqueue identifier, calculate the insertion position number in the sequence to be tested according to the priority insertion rule and lock the position, perform seed enqueue operation and write it into the enqueue record to form the sequence to be tested. Based on the sequence to be tested, read the priority field and execution time field of the test task scheduling list, clear the scheduling items with the status of completion and keep the incomplete scheduling items, rearrange the sequence to be tested and the test task scheduling list according to the high priority scheduling label, merge adjacent scheduling items with the same target program and update the execution time field, write the rearrangement result, and generate the updated fuzzy test queue.

7. The system of the deep learning-based adaptive fuzz testing method according to any one of claims 1-6, characterized in that, include: The instrumentation analysis module is used to inject software analysis instrumentation probes into the binary conditional jump instruction position of the target test program, load the initial test case set to perform branch execution operations of the program logic, generate instrumentation execution trajectory data, input the instrumentation execution trajectory data into the multivariate fitting calculation structure, establish a nonlinear mapping relationship between the input byte variables and the branch distance variables, and generate a branch constraint differentiable function structure. The gradient optimization module is used to calculate the path coverage loss value based on the branch constraint differentiable function structure, solve the partial derivative gradient vector of the input byte vector with respect to the path coverage loss value, and subtract the product of the partial derivative gradient vector and the preset step size coefficient from the original input byte vector to generate gradient optimization candidate seeds. The feature mapping module is used to input the gradient optimization candidate seed into the feature dimensionality reduction mapping structure, generate a low-dimensional potential feature vector, call the coordinate vector matrix of the existing seeds in the repository, and calculate the seed space sparsity value between the low-dimensional potential feature vector and the K nearest neighbor vectors in the matrix. The novelty determination and queue scheduling module is used to compare the sparsity value of the seed space with a preset novelty determination threshold constant. When the sparsity value of the seed space is greater than the novelty determination threshold constant, it is determined that the current sample is located in a low-density blank area of ​​the feature space, a sparse region trigger signal is generated, and in response to the sparse region trigger signal, a seed enqueue operation is performed, the sample that generates the signal is marked as a high-priority scheduling object and added to the test sequence, and an updated fuzzy test queue is generated.

Images