Embedded Software Fuzz Testing Using NUI Keyword Seeds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fuzz testing tools for embedded software applications, such as AFL/AFL++, face inefficiencies in generating high-quality test cases, leading to reduced vulnerability detection efficiency and increased computational costs, particularly when dealing with network user input.
Innovation Solution
The method focuses on identifying and utilizing network user input (NUI) keywords as seeds for fuzz testing, prioritizing their mutation to efficiently reach deep states in the software and identify critical vulnerabilities, while excluding non-NUI keywords to reduce computational costs and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If general fuzz testing techniques (AFL/AFL++) are used on embedded software applications, then the testing process can be executed, but the test case generation quality is low and vulnerability detection efficiency is reduced
Solution Approach 1:
The patent applies local quality by making the fuzzer adaptive to the specific characteristics of embedded software applications. The system dynamically adjusts the mutation strategy based on the program counter (PC) state, using targeted mutation when the PC is in critical regions and random mutation otherwise. This localized adaptation improves test case quality in critical areas without sacrificing overall testing efficiency.
Solution Approach 2:
The patent implements dynamics by making the fuzzing process adaptive rather than static. The mutation strategy changes dynamically based on the current PC state, the type of instruction being executed, and the criticality of the code region. This dynamic adjustment allows the system to optimize test case generation quality in real-time during the fuzzing process.
2Measurement precision
If traditional taint analysis is used to determine network input propagation, then precise analysis can be achieved, but computational costs increase and non-termination may occur due to complex control flow and loops
Solution Approach 1:
The patent extracts only the essential information needed for effective fuzzing by tracking the program counter (PC) state and critical comparison functions, rather than performing comprehensive taint analysis on all data flows. This extraction approach maintains sufficient precision for identifying injection vulnerabilities while significantly reducing computational costs and avoiding non-termination issues.
Solution Approach 2:
The patent applies partial action by selectively analyzing only the critical paths where network input may lead to injection vulnerabilities, rather than performing complete taint analysis on all possible execution paths. This partial analysis approach achieves adequate precision for security testing while avoiding the computational burden and potential non-termination of exhaustive analysis.
3Adaptability or versatility
If all keywords are used as seed for fuzz testing, then comprehensive testing can be performed, but computational costs increase and false positives/negatives increase
Solution Approach 1:
The patent applies local quality by prioritizing keywords that are relevant to injection vulnerabilities based on their association with critical comparison functions. Instead of treating all keywords equally, the system assigns different priorities based on local characteristics, reducing the effective search space while maintaining comprehensive coverage of critical areas.
Solution Approach 2:
The patent uses partial action by focusing the fuzzing effort on a subset of high-priority keywords most likely to reveal injection vulnerabilities. This selective approach reduces computational costs and false positives while maintaining adequate testing comprehensiveness for security-critical functions.
4Ease of operation
If non-prioritized mutation of seeds is used, then all seeds can be mutated uniformly, but network user input keywords are not inserted earlier into correct positions, slowing down the breakthrough of critical paths
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing the priorities of keywords based on their association with critical comparison functions before the fuzzing process begins. This preliminary classification allows the system to efficiently prioritize mutation during execution, inserting high-priority network input keywords earlier into correct positions without adding complexity to the mutation process itself.
Solution Approach 2:
The patent implements dynamics by making the mutation process adaptive based on keyword priorities. The system dynamically adjusts which seeds are mutated and in what order, prioritizing those containing high-priority network input keywords. This dynamic prioritization accelerates the breakthrough of critical paths while maintaining operational simplicity through pre-computed priority rankings.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Embodiments of the present disclosure relate to an apparatus, an embedded software application, a data carrier, a computer program, and a method for fuzz testing embedded software applications. The method comprises identifying, from a plurality of keywords, network user input (NUI) keywords related to network user inputs. Also, the method comprises providing the identified keywords as seed for fuzz testing an embedded software application and testing the software based on the seed.