Black-Box Fuzzing with Execution-Path Feedback for Code Coverage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing black-box fuzzing tests suffer from redundant testcases, lack code coverage, and do not support generation of new testcases, leading to low testing efficiency.
Innovation Solution
A method and apparatus for black-box fuzzing testing that generates testcases, determines execution paths, records code coverage, and mutates testcases to generate new paths, using a path library and testcase relationship table to optimize test coverage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If random testcase generation is used in black-box fuzzing, then testcase diversity is improved, but testing efficiency deteriorates due to large number of redundant testcases
Solution Approach 1:
The patent implements feedback mechanisms by recording execution paths in a path library and using them to guide subsequent testcase generation. The system monitors execution results and adjusts testcase generation strategies based on whether new execution paths are discovered, creating a closed-loop system that improves efficiency while maintaining diversity.
Solution Approach 2:
The patent performs preliminary actions by pre-recording execution paths from initial random testcases and storing them in a path library before formal testing begins. This preliminary data structure enables subsequent testcases to be evaluated against known paths, avoiding redundant testing while preserving exploration of uncharted execution paths.
2Ease of operation
If black-box fuzzing is performed without code coverage analysis, then testing simplicity is improved, but test quality deteriorates due to lack of code coverage
Solution Approach 1:
The patent introduces execution paths as an intermediary concept that bridges the gap between simple black-box testing and detailed code coverage analysis. By tracking execution paths through the program without requiring internal architecture knowledge, the system achieves code coverage measurement while maintaining the simplicity of black-box testing approaches.
3Ease of operation
If no testcase mutation is performed, then testing process simplicity is improved, but testing effectiveness deteriorates due to inability to generate new testcases
Solution Approach 1:
The patent implements dynamic testcase generation by mutating existing testcases based on execution path information. The mutation process is adaptive, modifying testcases to target unexplored execution paths while maintaining the simplicity of the overall testing process through automated, rule-based mutation strategies.
Data Source
AI summary
A black-box fuzzing testing method includes: generating a plurality of testcases; executing a target program based on each of the generated testcases to obtain a plurality of execution results; determining a plurality of execution paths of the target program using the execution results; and determining a code coverage of the target program from the execution paths.