A method and system for fuzzing testing of virtual devices in cloud computing systems

Abstract

The invention relates to a fuzzy testing method and system for virtual equipment of a cloud computing system. The method includes: sensing the code of the target virtual device, and automatically generating a test case; inserting the Qtest execution engine of QEMU of the target virtual device, obtaining the initialization sequence of the PCI bus, and realizing that the operating system or system snapshot is not started, Effectively and quickly realize the initialization of the device state; construct the fuzz test execution engine, directly read the test data, realize the automatic replay of the test case, and improve the efficiency of the fuzz test; monitor the QEMU process, and minimize the process reduction through the test case if an exception occurs Test cases, and automatically generate POC program code to verify the abnormalities found. The invention can effectively detect the security loopholes of the cloud platform developed based on KVM / QEMU, thereby helping service providers to timely defend or eliminate potential threats and avoid or reduce unnecessary losses.

Description

technical field [0001] The invention relates to the field of computer system security, and is used for detecting security loopholes in virtual devices of cloud computing systems, more specifically, a fuzzy testing method and system for virtual devices of cloud computing systems. Background technique [0002] With the continuous growth of the global cloud computing market share, as the basis of cloud computing, virtualization technology has been widely used. At the same time, it inevitably brings many security problems, and malicious behaviors using virtualization platform vulnerabilities to attack emerge in endlessly. As an important part of the virtualization platform, the virtual device is one of the main sources of security threats to the virtualization platform. Utilizing the vulnerabilities of virtual devices can launch escape attacks or denial-of-service attacks in the target cloud computing system, thereby affecting the normal and safe operation of the cloud computing...

AI Technical Summary

Problems solved by technology

[0006] In order to solve the above problems, the present invention provides a fuzzy testing method and system for cloud computing system virtual equipment, which solves the deficiencies of the existing testing methods in terms of equipment initialization, equipment test case generation, and test case playback. An effective, large-scale, target-aware fuzz testing solution can greatly improve the efficiency of testing and alleviate the current problems of high threshold and low testing efficiency in penetration testing for cloud platforms

Images