Adaptive seed variation method and system based on multi-arm game algorithm model

Abstract

The invention discloses a self-adaptive seed variation method and system based on a multi-arm game algorithm model. The method comprises the following steps: initializing a double-layer multi-arm game algorithm model for a current seed to construct an upper-layer byte arm and a lower-layer operator arm; obtaining a selection probability of a byte corresponding to each byte arm to select a mutation operation byte; obtaining a selection probability of a basic mutation operator corresponding to each operator arm to select a mutation operator; randomly distributing a stacking frequency for the mutation operator, and applying the mutation operator to the mutation operation bytes according to the stacking frequency to obtain a mutation seed; and generating a test case for the variation seeds and executing the test case. The method aims at solving the problems that in current directional grey box fuzzy testing, distribution of testing resources among seeds is extensive, dynamic and fine-grained scheduling is lacked, input data semantic feature perception is insufficient, critical path constraint conditions are prone to being damaged, the variation strategy self-adaptive capacity is insufficient, and the testing efficiency is high. And intelligent adjustment is difficult according to the test process and the seed context.

Description

Technical Field

[0001] This invention relates to the field of software security technology, specifically to an adaptive seed mutation method and system based on a multi-armed game algorithm model. Background Technology

[0002] In the modern information technology ecosystem, software systems play a pivotal role, and their security directly impacts the stable operation of critical information infrastructure and public safety. Faced with the continuous growth in software volume and increasing internal logical complexity, traditional methods relying on manual code auditing are no longer sufficient to meet the requirements of efficient and comprehensive security assurance. In this context, automated vulnerability discovery technologies, especially fuzzing methods, have become an irreplaceable key technology in building software security systems due to their efficient test execution capabilities and excellent scalability. As an important branch of fuzzing technology, Directed Grey-box Fuzzing (DGF) guides testing activities to target specific code regions by pre-setting target code locations and combining program structure characteristics with coverage feedback information during execution. Unlike traditional grey-box testing methods that aim to improve overall code coverage, this type of testing focuses on quickly and accurately reaching critical code segments in the program (including known vulnerability locations, patched code segments, or high-risk function entry points), thereby improving the detection efficiency of specific security threats. This technology typically establishes a program call relationship graph through static analysis, constructs a distance-based metric system, and dynamically optimizes seed selection priority and mutation strategy during testing. This allows testing resources to be concentrated on target area detection, achieving significant results in scenarios such as vulnerability reproduction verification and patch effectiveness evaluation.

[0003] Currently widely used directional gray-box fuzzing tools mostly follow a fixed, pre-defined pattern in their mutation strategy implementation. This involves randomly selecting mutation operators during the testing phase and applying them to arbitrary byte positions in the input data. This random mutation method, lacking intelligent guidance, has the following significant drawbacks: First, seed management strategies are relatively simple, and test resource allocation lacks systematic optimization. Existing solutions generally adopt a uniform processing mode for various seeds, resulting in a large amount of computational resources being consumed in testing seeds with highly overlapping execution paths, making it difficult to fully explore the program's behavioral space. Second, there is insufficient awareness of the semantic features of the input data, which can easily damage critical path constraints. The control effect of each byte in the program input on the execution path varies significantly. Important bytes, such as numerical fields determining the number of loops, special markers identifying file types (MagicNumber), or judgment variables affecting branch direction, play a decisive role in maintaining the effectiveness of the current execution path and satisfying complex constraints. Randomly performing mutation operations on these key bytes can easily disrupt established path constraints, causing the program execution flow to deviate from the expected goal and return to an irrelevant initial state. This situation not only leads to a large number of invalid test samples, but more seriously, it causes unnecessary waste of test resources and may even damage unstable execution environments that are already close to the target state. Thirdly, the lack of quantitative analysis of the effectiveness of mutation operators makes it difficult to establish an adaptive optimization mechanism. Different mutation operations have significantly different effects in different application scenarios. For example, arithmetic operations on ASCII character data are usually more effective than bit-flipping operations, while random insertion of checksum fields generally fails to produce the expected results. Current random selection strategies cannot adaptively select the mutation operators most likely to promote the testing process based on contextual factors such as test progress, seed feature parameters, and target location information, resulting in a massive number of invalid test cases and significantly extending the time to discover target vulnerabilities. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide an adaptive seed mutation method and system based on a multi-armed game algorithm model, addressing the aforementioned problems in existing technologies. This invention aims to solve the problems in current directional gray-box fuzzy testing, such as the extensive allocation of test resources among seeds, lack of dynamic and fine-grained scheduling, insufficient perception of semantic features of input data, easy damage to critical path constraints, insufficient adaptive capability of mutation strategies, and difficulty in intelligently adjusting according to the test process and seed context.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: An adaptive seed mutation method based on a multi-armed game algorithm model includes the following steps: S101, Initialize the two-layer multi-armed game algorithm model for the current seed used for directional gray-box fuzzy testing of the target software, including constructing the upper-layer byte arm for each byte of the current seed and constructing the lower-layer operator arm for the given basic mutation operator. S102, obtain the selection probability of the byte corresponding to each byte arm, and take the byte corresponding to the byte arm with the highest selection probability as the mutation operation byte; S103, obtain the selection probability of the basic mutation operator corresponding to each operator arm, and take the basic mutation operator corresponding to the operator arm with the highest selection probability as the mutation operation operator. S104, randomly assign stacking times to the mutation operator, apply the mutation operator to the mutation byte according to the stacking times, and obtain the mutation seed; S105 generates a test case for the mutated seed and executes it, completing one mutation of the current seed.

[0006] Optionally, step S101 also includes providing each operator arm with... Maintain a Beta distribution ,in and Record the operator arms separately The number of successful and failed mutations; for each byte arm Maintain a Beta distribution ,in and Record byte arms separately The number of successful and failed mutations is initially set to 0; step S102 obtains the selection probability of the byte corresponding to each byte arm, including from each byte arm. Beta distribution Sample a byte arm sample value The temperature-controlled Softmax selection algorithm is used to select the sampled values. Convert to Byte Arm The selection probability; in step S103, obtaining the selection probability of the basic mutation operator corresponding to each operator arm refers to including the selection probability from each operator arm. Beta distribution Sample a value from an operator arm As operator arm The selection probability; after obtaining the mutation seed in step S104, the method also includes determining the change in distance from the seed to the preset target code region before and after mutation. Determine the reward after seed mutation Update the selected byte arm Beta distribution and the selected operator arm Beta distribution : ; in, express or , express or .

[0007] Optionally, the determination of the reward after seed mutation This includes: firstly, calculating the change in distance from the seed to the preset target code region before and after mutation. If the distance changes If the value is less than 0, then the reward after seed mutation will be... The value is set to a preset positive number; otherwise, the reward after seed mutation will be used. The value is set to 0; then, based on the selected byte arm... Byte type of the corresponding bytes To determine the corresponding reward weight coefficient, the reward after seed mutation... Multiply by the reward weighting coefficient to obtain the final reward after seed mutation. .

[0008] Optionally, the selection probability of the byte corresponding to each byte arm in step S102 includes: determining whether the current seed mutation is the first mutation; if it is the first mutation, then obtaining the selection probability of each byte arm. Byte type of the corresponding bytes The byte type of the byte This includes both critical and non-critical constraint bytes. If perturbing a byte in the seed causes a decrease in code coverage of the target program exceeding a preset threshold, that byte is considered a critical constraint byte; otherwise, it is considered a non-critical constraint byte, and the classification is based on the byte type. Obtain the corresponding initial selection probabilities, with the initial selection probability of critical constraint bytes being greater than that of non-critical constraint bytes; if it is not the first mutation, then from each byte arm... Beta distribution Sample a byte arm sample value The temperature-controlled Softmax selection algorithm is used to select the sampled values. Convert to Byte Arm Selection probability: ; in, For Byte Arm The probability of choosing, For temperature coefficient, For Byte Arm The sampled values, The total number of bytes in the current seed; step S102 also includes automatic adjustment of the temperature coefficient. And automatically adjust the temperature coefficient The function expression is: ; in, This represents the maximum temperature coefficient. This represents the test energy consumed by the current seed. For the total test energy budget of the current seed, The temperature decay rate is the sum of the test energy consumed by the current seed and the test energy allocated to the mutated seeds that have been executed by the current seed.

[0009] Optionally, in step S103, from each operator arm Beta distribution Sample a value from an operator arm As operator arm When selecting the probability, it also includes adjusting the operator arm sample value based on the type characteristics of the mutation operation byte. : ; in, These are the adjusted operator arm sample values. To match the weight function, used to obtain the preset operator arm. Basic mutation operator Byte type of the mutated byte Fit weight, byte type It includes critical constraint bytes and non-critical constraint bytes. If the code coverage of the target program decreases by more than a preset threshold after perturbation of the bytes in the seed, then the byte is a critical constraint byte; otherwise, it is a non-critical constraint byte.

[0010] Optionally, after generating test cases for the mutant seed and executing step S105, the process may further include: S201, based on the execution results of the test cases, calculate the historical contribution of the current seed to represent its value in exploring new code paths and approaching the preset target position; the calculation function expression for the historical contribution is: ; in, As a contribution to history, and These are the weighting coefficients. To characterize the value of exploratory contributions in exploring new code paths, To characterize the directional contribution of value in approximating a pre-defined target position; to explore contributions. To determine the preset exploration reward coefficient for mutants corresponding to unprecedented branches or basic blocks globally after executing the target program on test cases of the current seed's mutant seeds. The cumulative value; targeted contribution To determine the predefined targeted reward coefficient corresponding to the mutant that guides the test process towards the predefined target code region after executing the target program on the test cases of the mutant seed, this is the goal of the test cases. The accumulated value; S202, determine whether the test cases of the mutant seed under the current seed have completed one round of execution. If they have completed one round of execution, use the decay mechanism to decay the historical contribution of the current seed: ; in, As a contribution to history, The historical contribution before the decay, The global scheduling period T is the preset number of seed executions, which is used as the decay factor. S203, allocate energy to the current seed based on its historical contribution; ; in, For the current seed Distributed energy, For total energy, For the current seed Historical contributions The historical contribution of all seeds in the seed queue; and the current seed in step S101 is a high-energy seed selected from the seed queue as the given current seed. The high-energy seed refers to the seed whose allocated energy exceeds a preset threshold, the seed with the highest allocated energy, or the seed with the highest allocated energy.

[0011] Optionally, in step S201, the preset targeted reward coefficient The expression for the computation function is: ; in, This is the targeted reward coefficient. To perform the maximum value operation, and These represent the distances from the seed variant to the preset target code region before and after executing the target program.

[0012] The present invention also provides an adaptive seed mutation system based on a multi-armed game algorithm model, comprising a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the adaptive seed mutation method based on the multi-armed game algorithm model.

[0013] The present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the adaptive seed mutation method based on the multi-armed game algorithm model by a processor.

[0014] The present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the adaptive seed mutation method based on the multi-armed game algorithm model via a processor.

[0015] Compared with existing technologies, the present invention mainly achieves the following beneficial effects: The method of the present invention includes initializing a two-layer multi-armed game algorithm model for the current seed used for targeted gray-box fuzzy testing of target software. This includes constructing an upper-layer byte arm for each byte of the current seed and constructing a lower-layer operator arm for a given basic mutation operator. Through the two-layer multi-armed game model composed of byte arms and operator arms, the present invention can solve the problems existing in the current targeted gray-box fuzzy testing, such as the coarse allocation of test resources among seeds, lack of dynamic and fine-grained scheduling, insufficient perception of semantic features of input data, easy damage to critical path constraints, insufficient adaptive ability of mutation strategy, and difficulty in intelligent adjustment according to the test process and seed context. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of the module structure and working principle of the method in an embodiment of the present invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.

[0019] like Figure 1 As shown, the adaptive seed mutation method based on the multi-armed game algorithm model in this embodiment includes the following steps: S101, Initialize the two-layer multi-armed game algorithm model for the current seed used for directional gray-box fuzzy testing of the target software, including constructing the upper-layer byte arm for each byte of the current seed and constructing the lower-layer operator arm for the given basic mutation operator. S102, obtain the selection probability of the byte corresponding to each byte arm, and take the byte corresponding to the byte arm with the highest selection probability as the mutation operation byte; S103, obtain the selection probability of the basic mutation operator corresponding to each operator arm, and take the basic mutation operator corresponding to the operator arm with the highest selection probability as the mutation operation operator. S104, randomly assign stacking times to the mutation operator, apply the mutation operator to the mutation byte according to the stacking times, and obtain the mutation seed; S105 generates a test case for the mutated seed and executes it, completing one mutation of the current seed.

[0020] Step S101 in this embodiment also includes configuring each operator arm Maintain a Beta distribution ,in and Record the operator arms separately The number of successful and failed mutations; for each byte arm Maintain a Beta distribution ,in and Record byte arms separately The number of successful and failed mutations is initially set to 0; step S102 obtains the selection probability of the byte corresponding to each byte arm, including from each byte arm. Beta distribution Sample a byte arm sample value The temperature-controlled Softmax selection algorithm is used to select the sampled values. Convert to Byte Arm The selection probability; in step S103, obtaining the selection probability of the basic mutation operator corresponding to each operator arm refers to including the selection probability from each operator arm. Beta distribution Sample a value from an operator arm As operator arm The selection probability; after obtaining the mutation seed in step S104, the method also includes determining the change in distance from the seed to the preset target code region before and after mutation. Determine the reward after seed mutation Update the selected byte arm Beta distribution and the selected operator arm Beta distribution : ; in, express or , express or .

[0021] In this embodiment, the reward after seed mutation is determined. This includes: firstly, calculating the change in distance from the seed to the preset target code region before and after mutation. If the distance changes If the value is less than 0, then the reward after seed mutation will be... The value is set to a preset positive number; otherwise, the reward after seed mutation will be used. The value is set to 0; then, based on the selected byte arm... Byte type of the corresponding bytes To determine the corresponding reward weight coefficient, the reward after seed mutation... Multiply by the reward weighting coefficient to obtain the final reward after seed mutation. .

[0022] In this embodiment, step S102, obtaining the selection probability of the byte corresponding to each byte arm, includes: determining whether the current seed mutation is the first mutation; if it is the first mutation, then obtaining each byte arm. Byte type of the corresponding bytes The byte type of the byte This includes both critical and non-critical constraint bytes. If perturbing a byte in the seed causes a decrease in code coverage of the target program exceeding a preset threshold, that byte is considered a critical constraint byte; otherwise, it is considered a non-critical constraint byte, and the classification is based on the byte type. Obtain the corresponding initial selection probabilities, with the initial selection probability of critical constraint bytes being greater than that of non-critical constraint bytes; if it is not the first mutation, then from each byte arm... Beta distribution Sample a byte arm sample value The temperature-controlled Softmax selection algorithm is used to select the sampled values. Convert to Byte Arm Selection probability: ; in, For Byte Arm The probability of choosing, For temperature coefficient, For Byte Arm The sampled values, The total number of bytes in the current seed; step S102 also includes automatic adjustment of the temperature coefficient. And automatically adjust the temperature coefficient The function expression is: ; in, This represents the maximum temperature coefficient. This represents the test energy consumed by the current seed. For the total test energy budget of the current seed, The temperature decay rate is the sum of the test energy consumed by the current seed and the test energy allocated to the mutated seeds that have been executed by the current seed.

[0023] As an optional implementation, in step S103 of this embodiment, from each operator arm Beta distribution Sample a value from an operator arm As operator arm When selecting the probability, it also includes adjusting the operator arm sample value based on the type characteristics of the mutation operation byte. : ; in, These are the adjusted operator arm sample values. To match the weight function, used to obtain the preset operator arm. Basic mutation operator Byte type of the mutated byte Fit weight, byte type This includes both critical and non-critical constraint bytes. A byte is considered a critical constraint byte if, after perturbation of a byte in the seed, the code coverage of the target program decreases by more than a preset threshold; otherwise, it is considered a non-critical constraint byte. Operator arm Basic mutation operator Byte type of the mutated byte The fit weights can be set according to actual needs. For example, for key bytes, fine-grained operators (arithmetic increment / decrement, bit flip, etc.) receive positive weights (+0.3), while exploratory operators receive zero or negative weights; for non-key bytes, exploratory operators (block insertion, random generation, etc.) receive positive weights (+0.3), while fine-grained operators receive lower weights. This design ensures intelligent matching between the mutation strategy and byte importance, protecting critical constraints from being violated while fully utilizing the exploration potential of non-critical regions. Finally, the adjusted operator arm sampling values ​​are selected. The operator with the highest value is used as the mutation operation.

[0024] This embodiment proposes a lightweight analysis method based on byte perturbation and covered branch statistics to dynamically evaluate the influence of each byte in the seed input on the target code path solving, and establish a differentiated mutation probability allocation mechanism accordingly. This design is based on an important observation of the structural characteristics of program input: in structured input, different bytes have significantly different effects on the program execution path. Certain specific bytes, such as magic words that determine the file type, counters that control the number of loops, or checksum fields, play a decisive role in satisfying path conditions, and even small changes to them can lead to significant deviations in the execution path; while other bytes are relatively tolerant of mutation and are more suitable as a breakthrough point for exploring new paths. The core idea of ​​this method is to use coverage changes as a measure of byte importance: when a byte is perturbed, if the code coverage of the program execution decreases significantly (manifested as a significant reduction in the number of covered branches), then the byte is determined to be a critical constraint byte. Such bytes play a crucial role in maintaining the effectiveness of the current path, so their probability of being modified should be reduced in subsequent mutation processes to avoid breaking the already satisfied path constraints. Conversely, if the coverage does not change significantly or only fluctuates slightly after perturbation, the byte is classified as a non-critical constraint byte and given a higher initial mutation probability, making it a priority in subsequent exploration processes, thereby improving the efficiency of discovering new paths. This method provides a clear byte priority decision basis for mutation decisions in multi-armed games by quantifying the sensitivity of bytes to path constraints. While effectively protecting key bytes, it significantly improves the targeting of mutation operations and the overall resource utilization efficiency. It mainly includes the following four core stages: ① Loading the seed queue: Selecting the seed to be analyzed from the group with the highest current energy budget as the initial data source for dynamic byte analysis. Then, it enters an iterative loop, continuously taking seeds from the queue for processing, and gradually improving the labeling of byte attributes. Each time a seed is processed, a path hash comparison is used to filter out worthless samples, such as inputs with the same coverage path that have already been recorded, to reduce unnecessary computational overhead. Only seeds with potential path exploration value are retained for subsequent analysis. ② Dynamically locate key constraint bytes: Initialize four core data structures, including a key constraint byte set, seed length, block queue, and probability array. The key constraint byte set stores the low-probability mutated bytes to be marked, the seed length determines the byte analysis range, the block queue is used for recursive splitting of byte blocks, and the probability array temporarily stores the initial mutation probability of each byte. Then, the byte blocks in the block queue are processed cyclically: if the current byte block size is a single byte, the byte is directly randomly perturbed to generate mutated input. The coverage branch counts of the original seed and the mutated input are counted separately. If the number of branches of the mutated input is not higher than 70% of the number of branches of the original seed, i.e., the coverage shrinkage is significant, the byte is marked as a low-probability mutated byte and stored in the set.If a byte block is larger than a single byte, it is split into two equal-length sub-blocks using a binary search method. All bytes within each sub-block are then perturbed in batches. By comparing the change in the number of branches before and after the perturbation, it is determined whether a critical constraint byte is contained. If a sub-block shows significant coverage contraction after perturbation, it indicates the presence of a critical constraint byte. This sub-block is then re-added to the block queue for recursive splitting until all byte blocks are split into single bytes, thus accurately locating all critical constraint bytes. ③ Initial Probability Allocation: After locating the critical constraint bytes, all bytes in the seed are traversed and initial probability values ​​are assigned. A 0.3 initial mutation probability is assigned to critical constraint bytes to protect their corresponding path constraints through low-frequency mutation. A 0.7 initial mutation probability is assigned to non-critical constraint bytes to prioritize them in subsequent mutations, thereby improving the efficiency of exploring uncovered code regions. ④ Integrating and Outputting Byte Attributes: The binary data of the current seed is associated with and stored with its corresponding byte mutation probability array, forming a seed-byte attribute mapping table. This table serves as the core output of the algorithm and is used for subsequent multi-armed game mutation decisions. Simultaneously, it checks whether the current seed has triggered new program coverage, i.e., whether it has covered previously unrecorded branches. If new coverage exists, the seed is added back to the seed queue for dynamic byte analysis in subsequent iterations. By continuously annotating the attributes of newly covered seeds, the coverage of the byte attribute library is gradually expanded, further improving the completeness and accuracy of the marking results.

[0025] Traditional methods often employ a uniform processing mode or a simple polling strategy for all seeds, failing to distinguish the actual value differences of different seeds during the testing process. This results in a significant waste of computational resources on testing seeds with highly overlapping execution paths or low value, hindering the full exploration of the program's behavioral space. To overcome the shortcomings of traditional seed management strategies, such as rigid resource allocation and singular value assessment, this embodiment proposes a seed scheduling method based on a dynamic contribution profile. In step S101, the current seed is selected from the seed queue as a high-energy seed. The high-energy seed refers to the seed with allocated energy exceeding a preset threshold, the highest allocated energy, or one of the top-ranked allocated energy seeds. By establishing a complete seed value assessment and resource allocation system, and maintaining an independent, dynamically updated contribution profile for each seed, refined and adaptive allocation of testing energy is achieved. This method can accurately identify and prioritize seeds that show potential in exploring new paths and approaching goals, thereby significantly improving the utilization efficiency of testing resources.

[0026] The quantification model of historical contribution is the core of seed value assessment. This model accurately quantifies the seed's value from two key dimensions: code coverage exploration and goal-oriented approximation, ensuring that the assessment results comprehensively reflect the seed's actual contribution during testing. The quantification model of historical contribution includes the following contributions: Exploring Contributions ( This dimension rewards seeds that expand test coverage. When a variant of seed 's' is executed, code coverage monitoring shows that if it covers a previously unexplored branch or basic block, the seed is considered to have made an exploration contribution. Its value is updated according to the following rules: ; Where R new To explore the reward coefficient, a value of 1 is used. This fixed reward mechanism is based on the following considerations: any new code coverage discovery is of significant value, and its meaning does not change regardless of the code region. This design provides a strong incentive for breakthrough discoveries, effectively driving the testing process to overcome coverage bottlenecks.

[0027] Targeted contribution ( This dimension specifically rewards seeds that guide the testing process towards a predetermined target code region (such as known vulnerability points, patched code segments, or high-risk function entry points). When a variant of seed s is executed, the distance d from it to the target location is calculated through program analysis. If the distance d is shorter than that of the original seed, the seed is considered to have made a targeted contribution. Its value is updated according to the following rules: ; Where λ is the targeted reward coefficient with a value of 1, the max function ensures that a positive reward is given only when the distance is actually shortened. This design makes the reward value proportional to the relative shortening of the distance, giving sufficient attention to even small distance shortenings when approaching the target, thereby guiding the tester to perform a fine search around the target and effectively improving the testing density of critical code regions. To form a unified scheduling basis and introduce dynamic adaptability into the system, this embodiment of the method designs a scientific contribution synthesis and decay mechanism. The total contribution of the seed is the weighted sum of its contributions in two dimensions: ; in, and These are the weighting coefficients for exploratory and targeted contributions, respectively. This synthesis formula maintains both computational simplicity and the flexibility to adjust preferences according to different testing scenarios.

[0028] To address the issue of test resources potentially being monopolized by early-performing seeds, this embodiment introduces a time decay factor γ. At the end of each global scheduling cycle T (e.g., after 1000 test case executions), the system consistently decays the contribution of all seeds: ; This mechanism constitutes the system's self-renewal function, ensuring that the scheduler continuously seeks out and funds seeds that can generate new contributions. Seeds that cease to produce value will naturally diminish in influence over time, thus freeing up resources for new potential seeds and ensuring that the testing process maintains its continuous exploratory vitality and evolutionary capacity.

[0029] Based on the dynamic evaluation system, this embodiment executes the final test energy allocation decision, which is the direct manifestation and ultimate focus of the scheduling mechanism. In this embodiment, the test energy for the next scheduling cycle (i.e., the number of times a seed is allowed to be selected and mutated) is allocated proportionally according to the contribution of each seed after synthesis and decay processing: ; in, This represents the total energy. This allocation formula ensures that high-value seeds receive testing opportunities commensurate with their contributions, thereby driving the entire testing process towards efficiency. Compared to traditional equalization or simple priority scheduling, this dynamic scheduling strategy has significant advantages. It breaks the rigid pattern of resource allocation, allowing each seed to dynamically compete for resources based on its sustained performance. A newly added seed may see its contribution rapidly increase due to its breakthrough performance, immediately receiving corresponding resource allocation; conversely, a previously high-contributing seed whose subsequent performance falters will have its resource share automatically reclaimed by the system.

[0030] Specifically, in this embodiment, after generating and executing a test case for the mutant seed, step S105 further includes: S201, based on the execution results of the test cases, calculate the historical contribution of the current seed to represent its value in exploring new code paths and approaching the preset target position; the calculation function expression for the historical contribution is: ; in, As a contribution to history, and These are the weighting coefficients. To characterize the value of exploratory contributions in exploring new code paths, To characterize the directional contribution of value in approximating a pre-defined target position; to explore contributions. To determine the preset exploration reward coefficient for mutants corresponding to unprecedented branches or basic blocks globally after executing the target program on test cases of the current seed's mutant seeds. The cumulative value; targeted contribution To determine the predefined targeted reward coefficient corresponding to the mutant that guides the test process towards the predefined target code region after executing the target program on the test cases of the mutant seed, this is the goal of the test cases. The accumulated value; S202, determine whether the test cases of the mutant seed under the current seed have completed one round of execution. If they have completed one round of execution, use the decay mechanism to decay the historical contribution of the current seed: ; in, As a contribution to history, The historical contribution before the decay, The global scheduling period T is the preset number of seed executions, which is used as the decay factor. S203, allocate energy to the current seed based on its historical contribution; ; in, For the current seed Distributed energy, For total energy, For the current seed Historical contributions The historical contribution of all seeds in the seed queue.

[0031] In step S201 of this embodiment, the preset targeted reward coefficient The expression for the computation function is: ; in, This is the targeted reward coefficient. To perform the maximum value operation, and These represent the distances from the seed variant to the preset target code region before and after executing the target program.

[0032] In summary, this embodiment, based on the traditional two-layer multi-armed game model, introduces an adaptive temperature coefficient and a hierarchical collaborative reward mechanism, significantly improving the model's adaptability, collaborative efficiency, and overall performance. Traditional multi-armed game models have significant limitations in fuzzy testing applications: their exploration-exploitation strategies are often fixed and cannot adapt to the characteristics of different stages in the testing process; simultaneously, the collaborative mechanism between the upper and lower layers of the game is relatively simple, making it difficult to fully leverage the advantages of hierarchical decision-making. This embodiment effectively solves these problems through systematic improvements. The process of this embodiment mainly includes the following five stages: ① Initialization phase: First, construct the operator arm set A, which contains 15 basic mutation operators. op The total reward (total_sum) and the number of times selected (count_select) for each operator arm are initialized to 0, and a Beta distribution is used for each operator arm. Maintain a prior distribution with parameters The initial value is set to (1,1), representing a uniform prior; then, each byte position of the seed is traversed, and each byte arm is... Similarly, maintain a Beta prior distribution. Finally, the byte arm set A is constructed. byte In this embodiment, the adaptive temperature coefficient is initialized as follows: Initialize the attenuation coefficient: Initialize energy count: These three parameters will serve as key variables controlling the overall exploration intensity. Recording the global test energy usage status will provide a basis for dynamic adjustment of the temperature coefficient.

[0033] ② Temperature adaptive scheduling: The system automatically adjusts the temperature coefficient according to the test progress. ; in The initial exploration intensity is controlled by the maximum temperature coefficient, and is set to 1.0. This represents the consumed test energy, recording the number of test cases currently executed. This is the total test energy budget, setting the total resource limit for the test process. γ is the temperature decay rate, an adjustment parameter controlling the rate of temperature decrease, with a value of 0.5. A smooth temperature transition is achieved through exponential decay, avoiding performance fluctuations caused by abrupt policy changes. When... At a relatively low level (in the early stages of testing), the temperature coefficient remains high, supporting extensive exploration; as the test progresses... As the temperature coefficient increases, it gradually decreases, guiding the system from exploration to utilization.

[0034] ② Upper-level Byte Arm Selection Stage: This stage uses the Softmax-Thompson hybrid sampling algorithm to establish a probabilistic selection model for each byte arm. Each byte arm... Corresponding to a Beta distribution , where parameters Record the number of times the byte arm mutation was successful. Record the number of failures. During the selection process, the system selects from each byte arm. Sample a value from the Beta distribution : ; After obtaining the sampled values ​​of all byte arms, the system applies a temperature-controlled Softmax selection algorithm to convert the sampled values ​​into operator arm b. j Choice probability distribution: ; n is the total number of bytes in the current seed, which determines the range of probability normalization calculation. P(b j ) is byte arm bj The final probability of selection is the sum of the probabilities of all byte arms, which is 1. When the value of τ is large, the selection probabilities of all byte arms tend to be equal, and the system explores thoroughly; when the value of τ is small, only the byte arm with the largest sample value receives a selection probability close to 1, and the system makes maximum use of it. By designing the decay law of τ, the system can extensively explore various possibilities in the early stage of testing and focus on exploring the proven effective regions in the later stage of testing.

[0035] ③ Lower-level operator arm selection stage: After determining the byte position, the lower level uses the same Thompson Sampling mechanism to select the mutation operator. Each operator arm... Similarly, maintain a Beta distribution. The system samples from each distribution. : ; Based on the basic sampled values, the system applies a type-matching weighted strategy to adjust the operator selection preference according to the type characteristics of the selected byte: ; ; in, These are the adjusted operator arm sample values. To match the weight function, used to obtain the preset operator arm. Basic mutation operator Byte type of the mutated byte Fit weight, byte type It includes critical constraint bytes and non-critical constraint bytes. If the code coverage of the target program decreases by more than a preset threshold after perturbation of the bytes in the seed, then the byte is a critical constraint byte; otherwise, it is a non-critical constraint byte.

[0036] ④ Mutation Execution Phase: Randomly assign stacking counts to the selected operators in the lower layer, and apply the operators to the selected bytes in the upper layer according to the stacking counts: This design retains the exploration intensity achieved by multiple rounds of mutation in the destructive mutation phase of traditional fuzzing, and avoids the local optimum problem that may be caused by a fixed number of stacking counts by randomizing the stacking counts, effectively expanding the mutation space.

[0037] ⑤ Reward Calculation and Model Update Stage: Based on the latest feedback, subsequent decisions are dynamically adjusted, continuously reinforcing the selection bias towards combinations of high-value bytes and efficient operators. This is based on the change in the distance between the seed and the target after mutation. As a basis for reward determination, the system adopts a binary reward mechanism based on threshold judgment: if... If the distance is less than 0 (distance shortened), it is considered a valid mutation, and the reward is r=1; otherwise, r=0. To further improve the targeting of the mutation strategy, the system weights the reward according to the byte type: when the mutated byte is a non-critical constraint byte, the final reward is reward=r×1.0; when the mutated byte is a critical constraint byte, the final reward is reward=r×0.3. After the reward is allocated, the system updates the Beta distribution parameters of the selected byte arm and the selected operator arm. Bernoulli update rule is adopted: ; This update rule causes a successful (distance reduction) mutation operation to increase the parameters of the corresponding arm. This increases the probability of it being selected in the future; while a failed mutation operation increases the parameter. This reduces the tendency for the target to be selected. Through this probability sampling-based decision-making and Bayesian update mechanism, the system can continuously learn and dynamically adjust its mutation strategy, making testing resources more focused on byte and operator combinations that are more likely to shorten the target distance, thereby significantly improving the targeting and overall efficiency of directional gray-box fuzzing.

[0038] As an optional implementation method, such as Figure 2 As shown, the method in this embodiment mainly includes three core modules: a seed scheduling module based on historical contribution, a directional mutation guidance module based on byte importance, and a two-layer multi-armed game mutation decision and execution module based on temperature adaptive scheduling.

[0039] The seed scheduling module based on historical contribution is used to execute steps S201-S203 to select high-energy seeds from the seed queue as the given current seeds. Steps S201 and S202 are the "contribution synthesis and decay" steps, and step S203 is the "energy allocation" step. This module intelligently manages the initial seed queue, executing the target program for each seed, collecting runtime coverage information and target distance data, and dynamically calculating its historical contribution. Historical contribution comprehensively measures the seed's value in exploring new code paths and approaching the preset target location. Subsequently, a decay mechanism is introduced to periodically adjust the historical contribution, and a corresponding test energy budget is allocated to each seed based on the adjusted score, ensuring that test resources are prioritized and continuously invested in seeds that have proven to be high-value, thereby achieving global optimization of resource allocation. This module adopts a seed management mechanism based on dynamic contribution evaluation, establishing a fine-grained resource allocation system. By quantifying the exploration and targeted contributions of each seed, an individualized contribution profile is constructed. A time decay factor is then introduced to periodically adjust historical contributions, allocating more testing energy to seeds with higher contributions. This resource allocation strategy, guided by continuous value output, ensures at the system level that testing resources are prioritized for the most promising seeds, achieving dynamic optimization of resource allocation.

[0040] The byte-importance-based directed mutation guidance module determines byte importance by "dynamically locating critical constraint bytes." Specifically, it applies a perturbation to a byte in the seed and then determines the byte type based on whether the code coverage decreases during target program execution. If the decrease exceeds a preset threshold, the byte is considered a critical constraint byte; otherwise, it is a non-critical constraint byte. It further determines byte importance based on byte type through "initial probability allocation." The module obtains the initial selection probability and the attributes of all bytes in the seed through "integrated byte attributes." A byte-importance-based directed mutation guidance module selects samples from high-energy seeds for detailed analysis. This module accurately identifies key bytes in the seed input that have a decisive impact on path constraints through dynamic byte perturbation and coverage feedback analysis, and assigns a quantified initial mutation probability to each key byte. Through this process, the original undifferentiated input data is transformed into a structured seed object carrying mutation guidance information, providing an important basis for subsequent mutation decisions. This module adopts a lightweight method combining dynamic byte perturbation and coverage feedback analysis to establish a complete byte criticality evaluation system. Through recursive binary search of byte block perturbations and coverage monitoring, key bytes with a decisive impact on path constraints are accurately located. Based on the evaluation results, differentiated mutation probability weights are assigned to bytes with different sensitivities: key constraint bytes are assigned a low mutation probability of 0.3, while non-key constraint bytes receive a high mutation probability of 0.7. This priority allocation strategy based on quantitative perception provides precise guidance for subsequent mutation decisions, effectively avoiding the violation of critical path constraints and ensuring that mutation operations are concentrated in high-potential areas.

[0041] The temperature-adaptive scheduling-based two-layer multi-armed game mutation decision and execution module is the core step of the adaptive seed mutation method based on the multi-armed game algorithm model in this embodiment. It is used to intelligently mutate the processed seed and automatically adjust the temperature coefficient through "adaptive temperature scheduling". Step S102 is executed via "byte arm selection operator arm selection", step S105 is executed via "mutation execution", and the reward after seed mutation is determined via "reward calculation and model update". And update the selected byte arm Beta distribution and the selected operator arm Beta distribution The upper-level decision-maker of this module comprehensively considers the initial mutation probability of each byte and its contribution to shortening the target distance in historical mutations. It employs a Softmax-Thompson Sampling algorithm with an adaptive temperature coefficient to select the most promising mutation byte position. This improved algorithm dynamically adjusts the trade-off between exploration and utilization through the temperature coefficient, conducting extensive exploration in the early stages of testing and focusing on utilizing historical experience in the later stages, thereby accelerating the identification of efficient mutation positions. After selecting the byte position, the lower-level decision-maker uses context-aware Thompson sampling to select the most matching mutation operator based on byte type (critical or non-critical) preference, forming a collaboratively optimized mutation strategy. Finally, the mutation operation is executed to generate new test cases, and the changes in the seed-to-target distance and whether new code coverage is triggered are monitored in real time. This change is used as a feedback signal to update the historical contribution of the seed and to synchronously update the parameters of the two-layer decision model through a hierarchical collaborative reward mechanism, forming a complete online learning and optimization closed loop. This cyclical process enables the system to continuously optimize its mutation strategy and continuously improve the efficiency of reaching the target code region. This module constructs the mutation decision-making system as a temperature-adaptive dual-loop collaborative game theory system, employing the Softmax-Thompson hybrid sampling algorithm for intelligent decision-making. The upper-level byte selection loop models the historical performance of each byte position using beta distribution and dynamically adjusts the exploration intensity based on a temperature coefficient. The lower-level operator selection loop introduces a context-aware mechanism, adaptively matching the optimal mutation operator based on byte type. The dual-loop decision model is jointly optimized through collaborative reward signals, using the "degree of reduction in the distance from seed to target" as the core reward indicator. Model parameters are dynamically adjusted using Bayesian update rules, driving the system to continuously converge towards an efficient mutation strategy. This temperature-modulated hierarchical collaborative architecture achieves intelligent matching of mutation positions and mutation operators, solving the dynamic balance problem between exploration and exploitation.

[0042] In summary, the advantages of the adaptive seed mutation method based on the multi-armed game algorithm model in this embodiment are as follows: (1) Through historical contribution archives and decay mechanism, dynamic optimization of test resources is realized. Traditional methods have a single seed value evaluation and cannot adapt to the dynamic changes in the test process. This embodiment realizes continuous evaluation of seed value and dynamic reallocation of resources through dual-dimensional contribution quantification and time decay mechanism, so that resources are prioritized for high-value seeds that continue to produce. This mechanism optimizes the long-term configuration efficiency of test resources at the system level and significantly improves the speed and stability of reaching the target code region. (2) Through temperature adaptive scheduling and context-aware decision-making, the environmental adaptability and convergence efficiency of the mutation strategy are improved. Compared with the fixed strategy multi-armed game method, the temperature decay mechanism introduced in this embodiment enables the system to intelligently adjust the exploration intensity according to the test process, extensively explore in the early stage and focus on utilization in the later stage. Combined with the context-aware operator matching strategy, the mutation operation is more in line with the current test context. This method enables the system to quickly adapt to changes in the test environment, achieve dynamic balance between the breadth of exploration and the depth of utilization, and accelerate the identification and convergence of efficient mutation strategies. (3) A complete intelligent test optimization closed loop was constructed through the deep collaboration of the three-layer modules of the multi-armed game algorithm model. The historical contribution scheduling module realizes the macro-optimization of resource allocation, the byte sensitivity analysis module provides micro-perception guidance for mutation, and the temperature adaptive game module executes accurate intelligent decisions. The three modules are progressive and cooperate with each other, which not only ensures the effectiveness of individual mutation operations, but also realizes the global optimization of test resources. While maintaining the lightweight nature of each module, the overall performance and practicality of the directed gray-box fuzzy test are significantly improved.

[0043] This embodiment also provides an adaptive seed mutation system based on a multi-armed game algorithm model, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the adaptive seed mutation method based on the multi-armed game algorithm model. This embodiment also provides a computer-readable storage medium storing a computer program or instructions programmed or configured to execute the adaptive seed mutation method based on the multi-armed game algorithm model via a processor. This embodiment also provides a computer program product, including a computer program or instructions programmed or configured to execute the adaptive seed mutation method based on the multi-armed game algorithm model via a processor.

[0044] Those skilled in the art will understand that the technical solutions provided by this invention may take the form of a method, system, or computer program product. Therefore, this invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this invention may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce an implementation of the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0045] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. An adaptive seed mutation method based on a multi-armed game algorithm model, characterized in that, Includes the following steps: S101, Initialize the two-layer multi-armed game algorithm model for the current seed used for directional gray-box fuzzy testing of the target software, including constructing the upper-layer byte arm for each byte of the current seed and constructing the lower-layer operator arm for the given basic mutation operator. S102, obtain the selection probability of the byte corresponding to each byte arm, and take the byte corresponding to the byte arm with the highest selection probability as the mutation operation byte; S103, obtain the selection probability of the basic mutation operator corresponding to each operator arm, and take the basic mutation operator corresponding to the operator arm with the highest selection probability as the mutation operation operator. S104, randomly assign stacking times to the mutation operator, apply the mutation operator to the mutation byte according to the stacking times, and obtain the mutation seed; S105 generates a test case for the mutated seed and executes it, completing one mutation of the current seed.

2. The adaptive seed mutation method based on a multi-armed game algorithm model according to claim 1, characterized in that, Step S101 also includes providing each operator arm Maintain a Beta distribution ,in and Record the operator arms separately The number of successful and failed mutations; for each byte arm Maintain a Beta distribution ,in and Record byte arms separately The number of successful and failed mutations is initially set to 0; step S102 obtains the selection probability of the byte corresponding to each byte arm, including from each byte arm. Beta distribution Sample a byte arm sample value The temperature-controlled Softmax selection algorithm is used to select the sampled values. Convert to Byte Arm The selection probability; in step S103, obtaining the selection probability of the basic mutation operator corresponding to each operator arm refers to including the selection probability from each operator arm. Beta distribution Sample a value from an operator arm As operator arm The selection probability; after obtaining the mutation seed in step S104, the method also includes determining the change in distance from the seed to the preset target code region before and after mutation. Determine the reward after seed mutation Update the selected byte arm Beta distribution and the selected operator arm Beta distribution : ； in, express or , express or .

3. The adaptive seed mutation method based on a multi-armed game algorithm model according to claim 2, characterized in that, The reward after determining the seed mutation This includes: firstly, calculating the change in distance from the seed to the preset target code region before and after mutation. If the distance changes If the value is less than 0, then the reward after seed mutation will be... The value is set to a preset positive number; otherwise, the reward after seed mutation will be used. The value is set to 0; then, based on the selected byte arm... Byte type of the corresponding bytes To determine the corresponding reward weight coefficient, the reward after seed mutation... Multiply by the reward weighting coefficient to obtain the final reward after seed mutation. .

4. The adaptive seed mutation method based on a multi-armed game algorithm model according to claim 2, characterized in that, Step S102, obtaining the selection probability of the byte corresponding to each byte arm, includes: determining whether the current seed mutation is the first mutation; if it is the first mutation, then obtaining each byte arm. Byte type of the corresponding bytes The byte type of the byte This includes both critical and non-critical constraint bytes. If perturbing a byte in the seed causes a decrease in code coverage of the target program exceeding a preset threshold, that byte is considered a critical constraint byte; otherwise, it is considered a non-critical constraint byte, and the classification is based on the byte type. Obtain the corresponding initial selection probabilities, with the initial selection probability of critical constraint bytes being greater than that of non-critical constraint bytes; if it is not the first mutation, then from each byte arm... Beta distribution Sample a byte arm sample value The temperature-controlled Softmax selection algorithm is used to select the sampled values. Convert to Byte Arm Selection probability: ； in, For Byte Arm The probability of choosing, For temperature coefficient, For Byte Arm The sampled values, The total number of bytes in the current seed; step S102 also includes automatic adjustment of the temperature coefficient. And automatically adjust the temperature coefficient The function expression is: ； in, This represents the maximum temperature coefficient. This represents the test energy consumed by the current seed. For the total test energy budget of the current seed, The temperature decay rate is the sum of the test energy consumed by the current seed and the test energy allocated to the mutated seeds that have been executed by the current seed.

5. The adaptive seed mutation method based on a multi-armed game algorithm model according to claim 2, characterized in that, In step S103, from each operator arm Beta distribution Sample a value from an operator arm As operator arm When selecting the probability, it also includes adjusting the operator arm sample value based on the type characteristics of the mutation operation byte. : ； in, These are the adjusted operator arm sample values. To match the weight function, used to obtain the preset operator arm. Basic mutation operator Byte type of the mutated byte Fit weight, byte type It includes critical constraint bytes and non-critical constraint bytes. If the code coverage of the target program decreases by more than a preset threshold after perturbation of the bytes in the seed, then the byte is a critical constraint byte; otherwise, it is a non-critical constraint byte.

6. The adaptive seed mutation method based on a multi-armed game algorithm model according to claim 1, characterized in that, After generating and executing test cases for the mutant seed in step S105, the following steps are also included: S201, based on the execution results of the test cases, calculate the historical contribution of the current seed to represent its value in exploring new code paths and approaching the preset target position; the calculation function expression for the historical contribution is: ； in, As a contribution to history, and These are the weighting coefficients. To characterize the value of exploratory contributions in exploring new code paths, To characterize the directional contribution of value in approximating a pre-defined target position; to explore contributions. To determine the preset exploration reward coefficient for mutants corresponding to unprecedented branches or basic blocks globally after executing the target program on test cases of the current seed's mutant seeds. The cumulative value; targeted contribution To determine the predefined targeted reward coefficient corresponding to the mutant that guides the test process towards the predefined target code region after executing the target program on the test cases of the mutant seed, this is the goal of the test cases. The accumulated value; S202, determine whether the test cases of the mutant seed under the current seed have completed one round of execution. If they have completed one round of execution, use the decay mechanism to decay the historical contribution of the current seed: ； in, As a contribution to history, The historical contribution before the decay, The global scheduling period T is the preset number of seed executions, which is used as the decay factor. S203, allocate energy to the current seed based on its historical contribution; ； in, For the current seed Distributed energy, For total energy, For the current seed Historical contributions The historical contribution of all seeds in the seed queue; and the current seed in step S101 is a high-energy seed selected from the seed queue as the given current seed. The high-energy seed refers to the seed whose allocated energy exceeds a preset threshold, the seed with the highest allocated energy, or the seed with the highest allocated energy.

7. The adaptive seed mutation method based on a multi-armed game algorithm model according to claim 6, characterized in that, In step S201, the preset targeted reward coefficient The expression for the computation function is: ； in, This is the targeted reward coefficient. To perform the maximum value operation, and These represent the distances from the seed variant to the preset target code region before and after executing the target program.

8. An adaptive seed mutation system based on a multi-armed game algorithm model, comprising interconnected microprocessors and a memory, characterized in that, The microprocessor is programmed or configured to execute the adaptive seed mutation method based on the multi-armed game algorithm model as described in any one of claims 1 to 7.

9. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the adaptive seed mutation method based on the multi-armed game algorithm model as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute, via a processor, the adaptive seed mutation method based on the multi-armed game algorithm model as described in any one of claims 1 to 7.

Images