Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

A program path sensitive grey box testing method and device

A program path and testing method technology, which is applied in the field of program path-sensitive gray box testing methods and devices, can solve the problems of not paying attention to the distribution of bug codes, reducing the efficiency of vulnerability discovery, and not taking into account, so as to improve the efficiency of vulnerability discovery, Strong applicability and the effect of increasing the probability of vulnerability triggering

Active Publication Date: 2019-06-18
PLA STRATEGIC SUPPORT FORCE INFORMATION ENG UNIV PLA SSF IEU
View PDF5 Cites 14 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

However, these methods generally focus on the coverage of the program, and do not pay attention to the distribution of bug codes, that is, they care about covering as many paths as possible, rather than which paths are more likely to have vulnerabilities
In fact, studies have shown that 80% of the bugs in the program are located in 20% of the code. This method of treating all inputs equally and sequentially selecting inputs from the seed queue for mutation does not take into account the triggering of different seed inputs. The probability of loopholes in the path is different, resulting in a waste of a lot of resources to test some meaningless paths and insufficient testing of vulnerable paths or codes, thereby reducing the efficiency of vulnerability discovery

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • A program path sensitive grey box testing method and device
  • A program path sensitive grey box testing method and device
  • A program path sensitive grey box testing method and device

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0033] In order to make the purpose, technical solution and advantages of the present invention more clear and understandable, the present invention will be further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0034] In view of the current fuzz testing process, the seed files cannot be effectively distinguished, resulting in wasting a lot of resources to test some meaningless program paths or codes, reducing the efficiency of fuzz testing, etc., in the embodiments of the present invention, see figure 1 As shown, a program path-sensitive gray-box testing method is provided, including the following content:

[0035] S101. In the offline training phase, the deep neural network is used to learn the vulnerability pattern of the sample data set to obtain a classifier of the program execution path, wherein the sample data set package includes sample data of vulnerable program paths and sample data of non-vulnerable program paths; ...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention belongs to the technical field of software testing. The invention particularly relates to a program path sensitive grey box testing method and device. The method comprises the steps thatin the offline training stage, vulnerability mode learning is conducted on a sample data set through a deep neural network, a classifier of a program execution path is obtained, and a sample data setpackage comprises vulnerability program path sample data and vulnerability-free program path sample data; and in an online test stage, the classifier is integrated into a fuzzy test tool to guide a seed file to perform a selection test, seed input triggering a vulnerability path is preferentially selected to perform the test, endowing the test with a plurality of variation energies to execute corresponding variation times, and performing cyclic execution until interruption. The method fills up the blank of vulnerability path sample influence analysis, does not depend on a complex dynamic analysis technology, does not bring about a large overhead problem, can be effectively combined with other grey box test technologies, improves vulnerability discovery efficiency, can be directly suitablefor a binary program, does not depend on a source code, and is high in applicability.

Description

technical field [0001] The invention belongs to the technical field of software testing, and in particular relates to a program path-sensitive gray box testing method and device. Background technique [0002] Fuzzing is an automated software testing technology, a testing method that provides maliciously constructed data as input to the test program and monitors whether the program is abnormal. Because of its simplicity and high efficiency, it has been applied to software development and testing by major software manufacturers to ensure the quality of their key products and a large number of security holes have been found. Coverage-based gray-box testing has become one of the most popular and effective fuzzing techniques due to its fast and expansive advantages. It uses the idea of ​​genetic algorithm to track the path coverage information of the program during the testing process. If the seed input triggers a new path branch, it will be added to the seed queue to participat...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): G06F11/36
Inventor 王允超宋晓斌李锡星张文镔魏强武泽慧
Owner PLA STRATEGIC SUPPORT FORCE INFORMATION ENG UNIV PLA SSF IEU
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products