| With the rapid development of the Internet,the types and quantities of software have shown explosive growth,and software security analysis has gradually received more attention.For binary programs,usually because the source code cannot be accessed,fuzz testing has undoubtedly become the most efficient means of vulnerability mining,and Effective coverage is one of its most important indicators.The preferred way to improve effective coverage is symbolic execution,but symbolic execution is easily affected by path explosion.Therefore,if a high-quality initial test case can be provided,this situation can be greatly alleviated.On the one hand,neural network can be used to optimize the generation strategy of this initial test case;on the other hand,the introduction of deobfuscation strategy and intermediate language conversion can realize the vulnerability mining of non-source code and cross-architecture binary programs.This thesis conducts in-depth research on the scheme of using symbolic execution to improve the effective coverage of fuzz testing,and introduces neural network and program de-obfuscation into the direct impact factor of effective coverage-the generation strategy of initial test cases.For the control flow confusion defense method of binary programs,the idea based on symbolic execution is used to restore the real control flow of the program.For the key code blocks,the recursive method is used to completely extract the key code blocks,and then the verification function is inserted,further split and simplify the control flow.In this thesis,the basic block embedding vector generation is divided into two parts:instruction embedding and semantic embedding.Then two neural networks are used to extract the basic block control flow information and semantic information respectively.On this basis,the attention mechanism is used to the above information is fused to generate the hidden features of the basic block embedding vectors.For the generation of initial test cases,the neural network is used to compare the similarity between the function features in the program and the vulnerability function features,so as to determine the dangerous function,and then combine the symbolic execution to solve the dangerous function,and finally convert the solution into the initial test case.Through the above strategies,this thesis implements a seed generation tool for generating high-coverage test cases for potentially dangerous functions in binary programs:simnet-seed.Based on various vulnerability mining tools,this thesis compares the efficiency of the test cases generated by the simnet-seed tool for vulnerability mining with the efficiency of other test cases using the tool itself for vulnerability mining.The experimental results show that using the simnet-seed seed when the mining efficiency can be increased by 30%-60%,the number of covered paths can be increased by 50%-90%,which significantly improves the effective coverage of various vulnerability mining tools and fully proves the effectiveness of the technology proposed in this thesis. |
