Bit-level clone-based program instruction vulnerability assessment method

Abstract

The application provides a program instruction vulnerability evaluation method based on bit-level cloning, comprising the following steps: loading a target program to be evaluated as an input into an evaluation system; the evaluation system analyzes dynamic instruction groups of the program, determines clonable bit positions of each dynamic instruction group, including clonable SDC bit positions and clonable non-SDC bit positions; performing fine-grained bit-level cloning and fault injection on the clonable bit positions and other bit positions respectively to determine SDC vulnerability of each dynamic instruction. The application has the beneficial effects that: through the combination of bit-level cloning and fault injection, repeated operations are reduced, cost is lowered, bit-level accurate analysis is realized, differentiated evaluation of complex programs is supported, and quantitative basis is provided for high-reliability software design.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and in particular relates to a method for assessing the vulnerability of program instructions based on bit-level cloning. Background Technology

[0002] In recent years, the semiconductor industry has propelled integrated circuit manufacturing processes into the nanometer era. While nanoscale processes have improved chip performance by reducing transistor size and supply voltage, they have also significantly increased the sensitivity of integrated circuits to radiation. When high-energy particles enter sensitive areas of a circuit, they can alter the logic state of the device, causing single-event upsets in memory or execution units, inducing soft errors, and consequently affecting the reliability of the software system.

[0003] Soft errors cause transient damage to circuits and can be eliminated by powering on again. However, when faulty hardware is involved in program execution, it can lead to instruction errors and affect program operation. The impact of soft errors is categorized into crashes, suspensions, masking errors, and silent data corruption (SDC). Among these, SDC, which outputs incorrect results without issuing warnings, is the most insidious and severe type. Research indicates that SDC errors are primarily caused by data errors in a few program instructions; therefore, it is necessary to identify the SDC vulnerability of instructions in order to deploy detectors at highly vulnerable instructions.

[0004] Loop structures in a program can cause a single static instruction to generate multiple dynamic instructions. These dynamic instructions, due to their similar execution contexts, possess similar SDC (Simplified Characteristic Distress Capability) vulnerabilities. Existing methods identify SDC vulnerabilities based on program structure features, which is a coarse-grained analysis. It can only determine whether an instruction might lead to SDC, but cannot quantify the magnitude of the vulnerability. Therefore, developing a fine-grained, low-cost, and highly accurate method for assessing program instruction SDC vulnerabilities is of great significance. Summary of the Invention

[0005] In view of this, the present invention aims to propose a program instruction vulnerability assessment method based on bit-level cloning, so as to solve the problem that existing methods can only determine whether an instruction may cause SDC, but cannot quantify the magnitude of vulnerability.

[0006] To achieve the above objectives, the technical solution of the present invention is implemented as follows: In a first aspect, the present invention provides a method for evaluating program instruction vulnerability based on bit-level cloning, comprising the following steps: S1. Load the target program; S2. Analyze the dynamic instruction set of the target program to obtain the dynamic instruction set of loop code and the dynamic instruction set of non-loop code; S3. Select sample instructions based on dynamic instruction groups of loop codes; S4. Based on the sample instructions, perform fault injection, identify cloneable bits, and obtain cloneable SDC bits, cloneable non-SDC bits, and non-clonable bits. S5. Perform fault injection to determine the result type of each bit in the non-cyclic code dynamic instruction set; S6. Based on the cloneable SDC bits and cloneable non-SDC bits, perform fine-grained bit-level cloning to determine the result type of each bit in the loop code dynamic instruction group; S7. Perform fault injection to determine the result type of the non-cloned bit; S8. Calculate the SDC vulnerability based on the result type of each bit.

[0007] Furthermore, in step S2, the dynamic instruction set of the target program is analyzed to obtain the dynamic instruction set of loop code and the dynamic instruction set of non-loop code, including: Through compilation, disassembly, and runtime analysis, program instructions are divided into a dynamic instruction set for loop code and a dynamic instruction set for non-loop code.

[0008] Furthermore, in step S4, based on the sample instruction, fault injection is performed to identify cloneable bits, resulting in cloneable SDC bits, cloneable non-SDC bits, and non-clonable bits, including: Mark the high 8 bits of the sample instruction as non-SDC; Inject faults into the remaining bits of the sample instruction, count the result types, and if the result types of a certain bit of the sample instruction are completely consistent, all of them are SDC or all of them are non-SDC, then that bit is a cloneable SDC bit or a cloneable non-SDC bit; otherwise, it is a non-cloning bit.

[0009] Furthermore, in step S5, fault injection is performed to determine the result type of each bit in the non-cyclic code dynamic instruction set, including: Mark the high 8 bits of each instruction as non-SDC; Perform fault injection to determine the result type of the remaining bits for each instruction.

[0010] Furthermore, in step S6, fine-grained bit-level cloning is performed based on the clonable SDC bits and the clonable non-SDC bits to determine the result type of each bit in the loop code dynamic instruction group, including: For cloneable SDC bits, mark the result type of the corresponding bits of other instructions in the same group as SDC; For non-SDC bits that can be cloned, mark the result type of the corresponding bits of other instructions in the same group as non-SDC.

[0011] Furthermore, in step S8, based on the result type of each bit, the SDC vulnerability is calculated, including: The percentage of SDC bits in an instruction is used as the SDC vulnerability of that instruction.

[0012] Secondly, based on the same concept, the present invention also provides an electronic device, including a processor and a memory communicatively connected to the processor and used to store executable instructions of the processor, wherein the processor is used to execute the bit-level cloning-based program instruction vulnerability assessment method.

[0013] Thirdly, based on the same concept, the present invention also provides a server, including at least one processor and a memory communicatively connected to the processor, the memory storing instructions executable by the at least one processor, the instructions being executed by the processor to cause the at least one processor to perform the bit-level clone-based program instruction vulnerability assessment method described above.

[0014] Fourthly, based on the same concept, the present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the bit-level cloning-based program instruction vulnerability assessment method described above.

[0015] Fifthly, based on the same concept, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a computer-readable storage medium, the computer program comprising program instructions, which, when executed by a computer, cause the computer to execute the bit-level cloning-based program instruction vulnerability assessment method.

[0016] Compared with existing technologies, the bit-level cloning-based program instruction vulnerability assessment method of the present invention has the following advantages: (1) Using dynamic instruction groups as the basic unit, the cloneable SDC bits and cloneable non-SDC bits are identified through fault injection experiments on some sample instructions within the group. Bit-level cloning technology is used for cloneable bits to directly infer the result type of the corresponding bits of other instructions within the group, which greatly reduces repeated fault injection operations and reduces computational costs while ensuring evaluation accuracy.

[0017] (2) For non-clonable bits, fault injection verification is still retained. Through layered processing (the high 8 bits are preset to non-SDC type, and the low 24 bits are differentiated for evaluation), the bit-level accurate vulnerability analysis is achieved.

[0018] (3) It supports dynamic instruction differentiation evaluation of loop code and non-loop code, and implements instruction grouping through compilation analysis, static address mapping and other technologies. It is suitable for vulnerability evaluation scenarios of complex programs and provides quantitative basis for high reliability software design. Attached Figure Description

[0019] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a schematic diagram of the overall steps described in an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the specific process described in an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0021] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0022] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0023] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] like Figures 1 to 2As shown, a program instruction vulnerability assessment method based on bit-level cloning includes the following steps: S1. Load the target program; S2. Analyze the dynamic instruction set of the target program to obtain the dynamic instruction set of loop code and the dynamic instruction set of non-loop code; S3. Select sample instructions based on dynamic instruction groups of loop codes; S4. Based on the sample instructions, perform fault injection, identify cloneable bits, and obtain cloneable SDC bits, cloneable non-SDC bits, and non-clonable bits. S5. Perform fault injection to determine the result type of each bit in the non-cyclic code dynamic instruction set; S6. Based on the cloneable SDC bits and cloneable non-SDC bits, perform fine-grained bit-level cloning to determine the result type of each bit in the loop code dynamic instruction group; S7. Perform fault injection to determine the result type of the non-cloned bit; S8. Calculate the SDC vulnerability based on the result type of each bit.

[0025] Specifically as follows: Step 1: Load the target program. Input and load the target program to be evaluated into the evaluation system.

[0026] Step 2: Analyze dynamic instruction sets and identify cloneable bits. The evaluation system parses the program's dynamic instruction sets and identifies bits with similar vulnerability characteristics in each dynamic instruction set, specifically categorizing them into cloneable SDC (Silent Data Corruption) bits and cloneable non-SDC bits.

[0027] Step 3: Perform bit-level cloning and fault injection. Fine-grained bit-level cloning is performed on the identified clonable bits, and fault injection is directly performed on the non-clonable bits. The SDC vulnerability of each dynamic instruction is calculated by combining the two methods.

[0028] The core rationale for introducing cloning bit analysis is that dynamic instructions related to loop blocks share similar execution contexts, leading to a high degree of consistency in their SDC (Single Code Capability) vulnerabilities. Therefore, when assessing the vulnerability of dynamic instructions, a bit-level cloning mechanism can be employed: when the result type of a bit in a dynamic instruction group is determined, only the corresponding bit in a subset of dynamic instructions needs to be fault-injected, and the result is then generalized to the corresponding bits in other dynamic instructions within the group. This method significantly reduces the number of fault injections and lowers assessment costs while ensuring assessment accuracy.

[0029] Through compilation, disassembly, program runtime monitoring, and static address analysis, the dynamic instructions in the target program's loop code are divided into multiple dynamic instruction groups. The set of dynamic instruction groups is denoted as […]. , represented as ,in, express The size; extract the dynamic instruction set related to the non-loop code of the target program, denoted as... ,in, express The size. For Each bit of the internal instruction is used to determine its result type through fault injection, thus obtaining their SDC vulnerability. Based on existing research (the probability of SDC in the high 8 bits of an instruction is extremely low), the result type of the high 8 bits (bits 24-31) is directly marked as non-SDC, without the need for fault injection. Next, each dynamic instruction group is processed sequentially until all dynamic instruction groups have been processed. (The last sentence appears to be a separate, unrelated statement.) Taking this as an example, we will introduce the processing procedure of dynamic instruction groups, in which... , express Size.

[0030] from A set proportion of dynamic commands are randomly selected and placed into the collection as a sample set. China. (General) Represented as ,in, , express Size. Process in sequence. The instructions in the text.

[0031] Will The high 8 bits (bits 24-31) are set to non-SDC as the result type by default. The lower 24 bits (bits 0-23) are used to determine the result type through fault injection experiments, denoted as... ,in, If the first If the result type of the bits is SDC, then ,otherwise The result type of each bit of the statistical sample instruction: If the fault injection result of all samples at a certain bit is SDC, then the bit is defined as a cloneable SDC bit; if the result of all samples at a certain bit is not SDC, then it is defined as a cloneable non-SDC bit.

[0032] The specific implementation process of step three is as follows: for For the remaining instructions that were not selected, their bit result type is determined as follows: If and ,show The first of all instructions When a bit error occurs, the program result type will be SDC. In this case, the result type of that bit will be cloned to... The corresponding bits of other instructions, i.e. Similarly, if and Then the first The non-SDC result type of a bit is cloned to the corresponding bit in another instruction, i.e. .like and Then for The first of other instructions Fault injection is performed directly on the bits to determine the result type. Simultaneously, the high 8 bits of all unselected instructions are uniformly set to non-SDC. Finally, by statistically analyzing the result type of each bit, the SDC vulnerability of the remaining instructions is calculated.

[0033] This method significantly reduces the computational cost of full-scale fault injection while maintaining evaluation accuracy through bit-level cloning technology. Experimental verification on the Siemens test set (replace, print_tokens, print_tokens2, etc.) and Mibench benchmark programs (tot_info, dijkstra, etc.) shows that the Spearman rank correlation coefficient between the instruction SDC vulnerability evaluation results and the full-scale fault injection method reaches 0.93, and the average number of fault injections is reduced by 74%.

[0034] Example 1: Step 1: Load the target program and extract the dynamic instruction set. After loading the program to be evaluated into the system, the dynamic instruction set of the loop code is obtained through compilation, disassembly, and program runtime monitoring. Dynamic instruction set for non-cyclic code .

[0035] Dynamic instruction set for non-loop code The following processing is performed: The high 8 bits (bits 24-31) of all instructions are preset to non-SDC (based on the research conclusion that the probability of SDC in the high 8 bits is extremely low), and fault injection is performed on the low 24 bits (bits 0-23). ​​By statistically analyzing the fault injection results for each bit, the following calculation is obtained: SDC vulnerability of all instructions.

[0036] Dynamic instruction set for loop code Each dynamic instruction group in the process executes the following second and third steps sequentially until all dynamic instruction groups have been processed.

[0037] Step 2: Determine the cloningable bits of the dynamic instruction set. Taking the loop control code of the `replace` program in the Siemens test suite as an example: line 431, "while((!done)&&(lin[i]!=ENDSTR))", corresponds to the assembly instruction "cmpBYTE PTR[ebp-0xa],0x0" (static address c0f). This instruction is executed 39 times during program execution, generating 39 dynamic instructions, denoted as (0, c0f) — (38, c0f), which together constitute the dynamic instruction set c0f. Randomly select 10% of the dynamic instructions (3 in total) from this set as the sample set. Suppose we select (1,c0f), (9,c0f), and (31,c0f), and process these three sample instructions.

[0038] For sample set The dynamic instructions in the dataset perform the following operations: the high 8 bits (bits 24-31) are preset to non-SDC, and fault injection is performed on the low 24 bits (bits 0-23). ​​Experimental results show that the fault injection results for bits 0-23 of the three sample instructions are all non-SDC. Therefore, it is determined that the cloneable non-SDC bits of this dynamic instruction set are bits 0-23 (lower 24 bits), and the cloneable SDC bits are an empty set. Simultaneously, the SDC vulnerability of all three instructions in the sample set is 0.

[0039] Step 3: Determine the SDC vulnerability of unselected dynamic instructions through bit-level cloning. There are 36 unselected dynamic instructions in this instruction group (out of a total of 39 minus 3 sample instructions), specifically (0,c0f), (2,c0f)-(8,c0f), (10,c0f)-(30,c0f), and (32,c0f)-(38,c0f). The processing flow is as follows: First, uniformly set the high 8 bits (bits 24-31) of these 36 instructions to non-SDC; second, based on the cloningable non-SDC bits (bits 0-23) determined in Step 2, clone all result types of the low 24 bits to non-SDC; since there are no cloningable SDC bits in this group, SDC bit cloning is not required. Finally, by statistically analyzing the result types of all bits, the SDC vulnerability of these 36 dynamic instructions is calculated to be 0.

[0040] Example 2: An electronic device includes a processor and a memory communicatively connected to the processor and used to store executable instructions of the processor, the processor being used to execute the bit-level cloning-based program instruction vulnerability assessment method.

[0041] Example 3: A server includes at least one processor and a memory communicatively connected to the processor, the memory storing instructions executable by the at least one processor, the instructions being executed by the processor to cause the at least one processor to perform the bit-level clone-based program instruction vulnerability assessment method.

[0042] Example 4: A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the bit-level cloning-based program instruction vulnerability assessment method.

[0043] Example 5: A computer program product includes a computer program stored on a computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the bit-level cloning-based program instruction vulnerability assessment method.

[0044] This invention achieves fine-grained instruction SDC vulnerability assessment by combining bit-level cloning technology with fault injection methods, with the following beneficial effects: (1) Using dynamic instruction groups as the basic unit, the cloneable SDC bits and cloneable non-SDC bits are identified through fault injection experiments on some sample instructions within the group. Bit-level cloning technology is used for cloneable bits to directly infer the result type of the corresponding bits of other instructions within the group, which greatly reduces repeated fault injection operations and reduces computational costs while ensuring evaluation accuracy.

[0045] (2) For non-clonable bits, fault injection verification is still retained. Through layered processing (the high 8 bits are preset to non-SDC type, and the low 24 bits are differentiated for evaluation), the bit-level accurate vulnerability analysis is achieved.

[0046] (3) It supports dynamic instruction differentiation evaluation of loop code and non-loop code, and implements instruction grouping through compilation analysis, static address mapping and other technologies. It is suitable for vulnerability evaluation scenarios of complex programs and provides quantitative basis for high reliability software design.

[0047] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for assessing program instruction vulnerability based on bit-level cloning, characterized in that: Includes the following steps: S1. Load the target program; S2. Analyze the dynamic instruction set of the target program to obtain the dynamic instruction set of loop code and the dynamic instruction set of non-loop code; S3. Select sample instructions based on dynamic instruction groups of loop codes; S4. Based on the sample instructions, perform fault injection, identify cloneable bits, and obtain cloneable SDC bits, cloneable non-SDC bits, and non-clonable bits. S5. Perform fault injection to determine the result type of each bit in the non-cyclic code dynamic instruction set; S6. Based on the cloneable SDC bits and cloneable non-SDC bits, perform fine-grained bit-level cloning to determine the result type of each bit in the loop code dynamic instruction group; S7. Perform fault injection to determine the result type of the non-cloned bit; S8. Calculate the SDC vulnerability based on the result type of each bit.

2. The program instruction vulnerability assessment method based on bit-level cloning according to claim 1, characterized in that: In step S2, the dynamic instruction set of the target program is analyzed to obtain the dynamic instruction set of loop code and the dynamic instruction set of non-loop code, including: Through compilation, disassembly, and runtime analysis, program instructions are divided into a dynamic instruction set for loop code and a dynamic instruction set for non-loop code.

3. The program instruction vulnerability assessment method based on bit-level cloning according to claim 1, characterized in that: In step S4, based on the sample instructions, fault injection is performed to identify cloneable bits, resulting in cloneable SDC bits, cloneable non-SDC bits, and non-clonable bits, including: Mark the high 8 bits of the sample instruction as non-SDC; Inject faults into the remaining bits of the sample instruction, count the result types, and if the result types of a certain bit of the sample instruction are completely consistent, all of them are SDC or all of them are non-SDC, then that bit is a cloneable SDC bit or a cloneable non-SDC bit; otherwise, it is a non-cloning bit.

4. The program instruction vulnerability assessment method based on bit-level cloning according to claim 1, characterized in that: In step S5, fault injection is performed to determine the result type of each bit in the non-cyclic code dynamic instruction set, including: Mark the high 8 bits of each instruction as non-SDC; Perform fault injection to determine the result type of the remaining bits for each instruction.

5. The program instruction vulnerability assessment method based on bit-level cloning according to claim 1, characterized in that: In step S6, fine-grained bit-level cloning is performed based on clonable SDC bits and clonable non-SDC bits to determine the result type of each bit in the loop code dynamic instruction group, including: For cloneable SDC bits, mark the result type of the corresponding bits of other instructions in the same group as SDC; For non-SDC bits that can be cloned, mark the result type of the corresponding bits of other instructions in the same group as non-SDC.

6. The program instruction vulnerability assessment method based on bit-level cloning according to claim 1, characterized in that: In step S8, based on the result type of each bit, the SDC vulnerability is calculated, including: The percentage of SDC bits in an instruction is used as the SDC vulnerability of that instruction.

7. An electronic device, characterized in that: The device includes a processor and a memory communicatively connected to the processor for storing executable instructions of the processor, wherein the processor is used to execute the bit-level cloning-based program instruction vulnerability assessment method according to any one of claims 1-6.

8. A server, characterized in that: The method includes at least one processor and a memory communicatively connected to the processor, the memory storing instructions executable by the at least one processor, the instructions being executed by the processor to cause the at least one processor to perform the bit-level clone-based program instruction vulnerability assessment method according to any one of claims 1-6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the bit-level cloning-based program instruction vulnerability assessment method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computing program stored on a non-transitory computer-readable storage medium, the computer program including program instructions that, when executed by a computer, cause the computer to perform the bit-level cloning-based program instruction vulnerability assessment method according to any one of claims 1-6.

Images