Information processing device

Abstract

An information processing device (10) has an acquisition unit (142b) and an update unit (143b). The acquisition unit (142b) acquires location information for identifying the location of a source code that is the source of a program and on which operation has been performed via an editor. The update unit (143b) updates, on the basis of the location information, the priority corresponding to each of the input candidates, which are candidates for values inputted to the program during fuzzing.

Description

Information processing device

[0001] The present invention relates to an information processing device.

[0002] Fuzzing is a software testing method that involves randomly mutating test inputs and running a program. Unlike conventional testing, which runs a set of predefined test cases and then terminates, fuzzing is endless, as random test inputs are generated and tested endlessly. Therefore, the capabilities and results of fuzzing depend on finite resources, making efficiency important.

[0003] In fuzzing, multiple input candidates called seeds are stored, and the next input to be mutated or executed is selected from the input candidates. The efficiency of seed selection and the addition of new seeds is improved by prioritizing inputs that are determined to be important based on specific indicators. For example, there are indicators that prioritize inputs that improve code coverage and inputs that have passed (or have not passed) through specified program sections (see, for example, Non-Patent Document 1).

[0004] In general, fuzzing can be made much more efficient with human intervention (human-in-the-loop fuzzing). For example, if special conditions that are difficult to generate through automatic mutation by fuzzing are required as input, fuzzing can be accelerated by humans identifying and adding them as input (see, for example, Non-Patent Document 2).

[0005] Andrea Fioraldi, Dominik Maier, Heiko Eissfeldt, Marc Heuse, "AFL++: Combining Incremental Steps of Fuzzing Research," USENIX WOOT 2020Cornelius Aschermann, Sergej Schumilo, Ali Abbasi, and Thorsten Holz, "IJON: Exploring Deep State Spaces via Fuzzing," IEEE S&P 2020

[0006] However, conventional techniques may not be able to perform fuzzing efficiently.

[0007] To perform fuzzing more efficiently, it is necessary to use not only general-purpose indicators such as coverage but also indicators that are specific to the characteristics of the target program itself. However, with the technology in Non-Patent Document 1, for example, it is difficult to automatically obtain information based on such indicators.

[0008] Furthermore, to make fuzzing more efficient, human intervention is required to optimize programs and fuzzing, as described in Non-Patent Document 2. However, this is cumbersome and takes time to be reflected in fuzzing.

[0009] The present invention has been made in view of the above, and has an object to efficiently perform fuzzing.

[0010] In order to solve the above-mentioned problems and achieve the objectives, the information processing device of the present invention is characterized by having an acquisition unit that acquires location information that identifies the location of the source code that is the source code of a program and that has been operated on via an editor, and an update unit that updates the priority corresponding to each of the input candidates, which are candidates for values ​​to be input to the program during fuzzing, based on the location information.

[0011] According to the present invention, it is possible to carry out fuzzing efficiently.

[0012] FIG. 1 is a diagram illustrating an example of the configuration of an information processing apparatus according to a first embodiment. FIG. 2 is a diagram illustrating an example of input candidate information. FIG. 3 is a flowchart illustrating a processing flow of the information processing apparatus according to the first embodiment. FIG. 4 is a diagram illustrating an example of source code. FIG. 5 is a diagram illustrating an example of source code. FIG. 6 is a diagram illustrating an example of a computer that executes an information processing program.

[0013] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0014] [First embodiment] [Configuration of information processing device] Fig. 1 is a diagram showing an example of the configuration of an information processing device according to the first embodiment. The information processing device 10 shown in Fig. 1 can support fuzzing.

[0015] The information processing device 10 receives input of source code of a program to be fuzzed. The information processing device 10 then outputs the priority of each input candidate for program fuzzing based on the source code. The information processing device 10 also functions as an editor program for editing the source code.

[0016] The editor program may be a development environment, a text editor, etc. In the following description, the editor program may be simply called an editor.

[0017] In this embodiment, the following situation is assumed as an example: That is, while fuzzing is being performed on a program, a user (e.g., a developer or an analyst) simultaneously edits the source code of the program. This situation is common, for example, when continuous fuzzing is performed by continuous integration (CI) during software development.

[0018] For example, the information processing device 10 is a general-purpose computer such as a PC, etc. As shown in FIG.

[0019] The communication unit 11 performs data communication with other devices via a network. For example, the communication unit 11 is a network interface card (NIC). The input / output unit 12 is an interface connected to input devices such as a mouse and a keyboard, and output devices such as a display.

[0020] The storage unit 13 is a storage device such as a hard disk drive (HDD), a solid state drive (SSD), an optical disk, etc. Note that the storage unit 13 may also be a data-rewritable semiconductor memory such as a random access memory (RAM), a flash memory, or a non-volatile static random access memory (NVSRAM). The storage unit 13 stores an operating system (OS) and various programs executed by the information processing device 10.

[0021] The storage unit 13 stores input candidate information 131, which is information about input candidates. For example, the input candidates are candidates for values ​​of variables, etc., to be input to a program. The input candidates may be generated randomly or according to a predetermined rule.

[0022] FIG. 2 is a diagram showing an example of input candidate information. As shown in FIG. 2, the input candidate information 131 is a table having items such as "number," "input candidate," and "priority." The value of the item "number" is information for identifying an input candidate. The value of the item "input candidate" is the specific content of the input candidate. The value of the item "priority" is a priority set for each input candidate. Note that the input candidate may be a seed for generating a value.

[0023] In the example of FIG. 2, the value of a variable "x" is listed as an input candidate. The input candidate "x=1" has a priority of 3, which is higher than the priority of the input candidate "x=-10," which is 1. Therefore, a user performing fuzzing or a system (fuzzer) that automatically performs fuzzing will prioritize a test that inputs "x=1" over "x=-10." Note that prioritizing a test may mean making the test mandatory, conducting the test earlier, conducting the test more frequently, etc.

[0024] The control unit 14 controls the entire information processing device 10. The control unit 14 is, for example, an electronic circuit such as a central processing unit (CPU), a micro processing unit (MPU), or a graphics processing unit (GPU), or an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0025] The control unit 14 also has an internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory. The control unit 14 also functions as various processing units when various programs are run. For example, the control unit 14 has an editor execution unit 141, an editor extension unit 142, and a fuzzing extension unit 143.

[0026] The editor execution unit 141 executes an editor. The editor execution unit 141 may execute an existing text editor or development environment.

[0027] The editor extension unit 142 acquires information about the editor. The editor extension unit 142 may be implemented as an add-on function for the editor. The editor extension unit 142 includes a receiving unit 142a and an acquiring unit 142b.

[0028] The fuzzing extension unit 143 performs fuzzing. The fuzzing extension unit 143 also performs processing related to fuzzing based on information acquired by the editor extension unit 142. For example, the fuzzing extension unit 143 determines the priority of input candidates. The fuzzing extension unit 143 includes a determination unit 143a and an update unit 143b.

[0029] The flow of processing by the information processing device 10 will be described with reference to Fig. 3. Fig. 3 is a flowchart showing the flow of processing by the information processing device according to the first embodiment.

[0030] First, the editor execution unit 141 starts the editor (step S101). The reception unit 142a receives a user operation on the editor (step S102). If the received operation is not an operation on source code (step S103; No), the reception unit 142a waits for reception of an operation.

[0031] If the accepted operation is an operation on the source code (Step S103; Yes), the acquiring unit 142b acquires location information of the source code where the operation was performed (Step S104).

[0032] In this way, the acquiring unit 142b acquires location information that identifies the location in the source code that is the basis of the program and where an operation was performed via the editor.

[0033] For example, the source code location information is information (for example, a file name or a file path) and a line number that identify the file of the source code being edited or viewed via an editor.

[0034] 4 shows an example of source code. Here, it is assumed that line 102 of source code 210 is being edited in an editor. At this time, the acquiring unit 142b acquires the file path of the source code 210 and the line number (here, "102") being edited.

[0035] For example, the acquiring unit 142b acquires location information of the source code corresponding to the active window among the windows displayed on the display.

[0036] The acquisition unit 142b passes the acquired information to the fuzzing extension unit 143. Here, the determination unit 143a of the fuzzing extension unit 143 selects an unselected input candidate (step S105). For example, the determination unit 143a selects the input candidates in the input candidate information 131 in ascending order of numbers.

[0037] The determining unit 143a determines whether or not the program will pass through a location corresponding to the acquired location information when the program is executed based on the selected input candidate (step S106).

[0038] 4, line 102 of the source code 210 is part of the function "function_B" and is a part that is always passed through when the function is executed. Note that "passing through" means that the part (line) is executed.

[0039] The source code of a program to be subjected to fuzzing is shown in Figure 5. Figure 5 is a diagram showing an example of the source code.

[0040] 5, the source code 220 describes that different functions are executed depending on the value of the variable x. For example, in a program based on the source code 220, if "x<=1", the function "function_A" is executed. Also, in a program based on the source code 220, if "x>1 and x<5", the function "function_B" is executed.

[0041] As shown in FIG. 5, in order for the function "function_B" to be executed, "x>1 and x<5" must be true. Of the input candidates shown in FIG. 2, "x=-10," "x=1," and "x=10" do not satisfy the condition "x>1 and x<5." On the other hand, of the input candidates shown in FIG. 2, "x=3" satisfies the condition "x>1 and x<5." It is assumed that the functions "function_A," "function_B," and "function_C" cannot be called from any location other than those shown in FIG. 5.

[0042] Therefore, the determination unit 143a determines that the selected input candidate does not pass in step S107 if it is any of "x=-10," "x=1," and "x=10" (step S107; No), and determines that the selected input candidate passes in step S107 if it is "x=3" (step S107; Yes).

[0043] As shown in FIG. 5 , the value of variable x is output by the function "input." Therefore, depending on the processing content of the function "input," the value of variable x may not be directly input to the program. For example, if the function "input" is a function that simply receives and outputs a value directly input to the program, the value of variable x can be directly input to the program. On the other hand, if the function "input" is a function that outputs a predetermined calculated value based on the input value, the value of variable x cannot be directly input to the program. However, in the fuzzing of this embodiment, in either case, the specific values ​​of each input candidate in FIG. 2 are set to values ​​such that x takes the value listed in the "Input Candidate" column.

[0044] The update unit 143b increases the priority of the selected input candidate that is determined to be accepted (step S108). For example, the update unit 143b increases the priority of the input candidate information 131 by 1.

[0045] In this way, the updating unit 143b updates the priority corresponding to each input candidate, which is a candidate for a value to be input to a program during fuzzing, based on the location information. The updating unit 143b updates the priority of an input candidate that will cause a portion of the program corresponding to the location information to be executed when the corresponding value is input to the program.

[0046] If there is an unselected input candidate (step S109; Yes), the determination unit 143a returns to step S105 and selects an unselected input candidate (step S105). If there is no unselected input candidate (step S109; No) and the editor has been terminated (step S110; Yes), the editor extension unit 142 and the fuzzing extension unit 143 terminate the processing.

[0047] If the editor has not been terminated (Step S110; No), the editor extension unit 142 and the fuzzing extension unit 143 return to Step S102 and repeat the process. That is, the acquisition unit 142b repeatedly acquires location information while the editor is running.

[0048] For example, in fuzzing, which aims to perform detailed analysis of vulnerabilities, it is desirable for a large number of useful and diverse crashes to occur when a program is executed. Therefore, by increasing the priority of input candidates corresponding to edited parts, the occurrence of such crashes can be increased.

[0049] The reason why the updating unit 143b increases the priority is based on the idea that a part that is being actively edited is important. However, the method of updating the priority by the updating unit 143b is not limited to the one described here.

[0050] For example, the update unit 143b may decrease the priority instead of increasing it, so that a part that has been fixed after its vulnerability has been thoroughly analyzed is considered to have been thoroughly tested and is then avoided from fuzzing.

[0051] Furthermore, since there is no point in testing parts that are significantly edited during the development stage rather than for vulnerability analysis, the update unit 143b may reduce the priority of fuzzing to avoid performing unnecessary fuzzing.

[0052] As described above, the acquiring unit 142b acquires location information that identifies a location in the source code that is the source of the program and that has been manipulated via an editor. The updating unit 143b updates the priority corresponding to each of the input candidates, which are candidates for values ​​to be input to the program during fuzzing, based on the location information.

[0053] In this way, the information processing device 10 can automatically acquire and use information about the properties of the target program from the user's perspective by using the user's operation information on the editor as an indicator. Furthermore, because the information processing device 10 automatically collects user behavior through the editor, the user can contribute to improving the efficiency of fuzzing in real time without being aware of it. As a result, according to the embodiment, fuzzing can be performed efficiently.

[0054] The acquiring unit 142b also acquires the file name and line number of the source code where the operation was performed, thereby enabling the information processing device 10 to identify the location information in detail.

[0055] Furthermore, the update unit 143b updates the priority of the input candidate that will cause a part of the program corresponding to the location information to be executed when the corresponding value is input to the program, thereby enabling the information processing device 10 to update the priority of the input candidate so that the part corresponding to the location information will always be executed.

[0056] The acquiring unit 142b repeatedly acquires the location information while the editor is running, thereby enabling the information processing device 10 to appropriately update the priority of the input candidates every time source code is viewed or edited via the editor.

[0057] The editor extension unit 142 and the fuzzing extension unit 143 may be implemented as part of the functionality of the editor itself and the fuzzing system, respectively, or may be implemented as extensions of each.

[0058] Furthermore, the relationship between the fuzzing system in which the fuzzing extension unit 143 is implemented and the users of the editor does not need to be one-to-one, but may be multiple-to-multiple or one-to-multiple. For example, a fuzzing system may be provided for each of multiple virtual instances of one editor.

[0059] [Program] In one embodiment, the information processing device 10 can be implemented by installing an information processing program that executes the above-described processes as package software or online software on a desired computer. For example, by executing the above-described information processing program on the information processing device, the information processing device can function as the information processing device 10. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices include smartphones, tablet terminals, and the like.

[0060] 6 is a diagram showing an example of a computer that executes an information processing program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0061] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores, for example, a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0062] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define each process of the information processing device 10 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the information processing device 10 are stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced with an SSD.

[0063] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0064] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0065] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0066] REFERENCE SIGNS LIST 10 Information processing device 11 Communication unit 12 Input / output unit 13 Storage unit 14 Control unit 141 Editor execution unit 142 Editor extension unit 142a Reception unit 142b Acquisition unit 143 Fuzzing extension unit 143a Determination unit 143b Update unit 210, 220 Source code

Claims

1. An information processing device comprising: an acquisition unit that acquires location information that identifies the location of source code that is the source of a program and that has been manipulated via an editor; and an update unit that updates the priority corresponding to each input candidate, which is a candidate for a value to be input to the program during fuzzing, based on the location information.

2. The information processing device according to claim 1, wherein the acquisition unit acquires the file name and line number of the source code on which the operation was performed.

3. The information processing device according to claim 1, characterized in that the update unit updates the priority of an input candidate that, when a corresponding value is input into the program, executes a part of the program corresponding to the location information.

4. The information processing apparatus according to claim 1, wherein said acquisition unit repeatedly acquires said location information while said editor is being executed.

Images