Fuzzy test method and system for virtual equipment of cloud computing system

Abstract

The invention relates to a fuzzy test method and system for virtual equipment of a cloud computing system. The method comprises the following steps: sensing a code of target virtual equipment, and automatically generating a test case; instrumenting a Qtest execution engine of the QEMU of the target virtual device, obtaining an initialization sequence of the PCI busso as to achieve effective and rapid initialization of the device state under the condition that an operating system or a system snapshot is not started; constructing a fuzzy test execution engine, directly reading the test data, realizing automatic replay of the test case, and improving the efficiency of the fuzzy test; and monitoring the QEMU process, if an exception occurs, reducing the test case through the test case minimization process, and automatically generating a POC program code to verify the found exception. According to the invention, security vulnerability detection can be effectively carried out on the cloud platform developed on the basis of KVM / QEMU, so that a service provider is helped to defend or eliminate potential threats in time, and unnecessary loss is avoided or reduced.

Description

technical field [0001] The invention relates to the field of computer system security, and is used for detecting security loopholes in virtual devices of cloud computing systems, more specifically, a fuzzy testing method and system for virtual devices of cloud computing systems. Background technique [0002] With the continuous growth of the global cloud computing market share, as the basis of cloud computing, virtualization technology has been widely used. At the same time, it inevitably brings many security problems, and malicious behaviors using virtualization platform vulnerabilities to attack emerge in endlessly. As an important part of the virtualization platform, the virtual device is one of the main sources of security threats to the virtualization platform. Utilizing the vulnerabilities of virtual devices can launch escape attacks or denial-of-service attacks in the target cloud computing system, thereby affecting the normal and safe operation of the cloud computing...

AI Technical Summary

Problems solved by technology

[0006] In order to solve the above problems, the present invention provides a fuzzy testing method and system for cloud computing system virtual equipment, which solves the deficiencies of the existing testing methods in terms of equipment initialization, equipment test case generation, and test case playback. An effective, large-scale, target-aware fuzz testing solution can greatly improve the efficiency of testing and alleviate the current problems of high threshold and low testing efficiency in penetration testing for cloud platforms

Images