Research On Vulnerability Detection Techniques For Deep-learning Frameworks

With the rapid development of artificial intelligence technology,artificial intelligence products have penetrated into every aspect of daily life.In order to guarantee the usability and security of AI products,vulnerability detection of deep learning frameworks is necessary.However,the current research work still suffers from two shortcomings: low test comprehensiveness and poor test case quality.Therefore,with the goal of improving the comprehensiveness of testing and the quality of test cases,this thesis designs and implements a vulnerability detection system for deep learning frameworks-DLAPITester based on fuzzing testing technology,which can perform comprehensive and efficient vulnerability detection on deep learning frameworks at the API level.The core work of this thesis is as follows:(1)This thesis analyzes the existing research deficiencies and summarizes the challenges to improve the comprehensiveness of testing and the quality of test cases.This thesis models the vulnerability detection technique for deep learning frameworks and analyzes the existing solutions based on this model,concluding that the challenges it faces are how to handle the huge input space of API sequences and how to effectively reduce the redundancy of test cases respectively.(2)In order to improve the comprehensiveness of testing,a specification-based API sequence generation technique is designed.This technique can extract API constraints using API specification and generate single-and multi-layer API sequence executables based on the constraints,so as to efficiently explore the huge input space of API sequences,more effectively verify the framework API functionality and cooperativeness,and improve the test comprehensiveness.(3)To improve the quality of test cases,a feedback guidance strategy based on multidimensional information is designed.This technique can collect and use the overall coverage information and coverage growth information during execution to control the timing of switching between single-layer sequence generation mode and multi-layer sequence generation mode and the probability of API and API sequences being selected under the above modes,so as to guide API sequences to be generated rapidly in the direction of diversification,reduce test case redundancy and improve test case quality.(4)Based on the above technologies,a vulnerability detection system for deep learning framework-DLAPITester is implemented,and corresponding verification experiments are designed to verify the correctness of the system’s functions and performance.The experimental results show that DLAPITester can effectively generate single-layer and multi-layer API sequence execution files that meet the requirements according to the feedback guidance strategy; Within the same time frame,compared to LEMON,its API types and API sequence edge coverage have increased by an average of 30 times; The average number of errors discovered increased by 33.3%; Compared to Doc Ter,its API sequence coverage achieves a leap from scratch; The average number of errors discovered has increased by 6%,effectively improving the comprehensiveness of testing and the quality of test cases,thereby improving the overall efficiency of vulnerability detection for deep learning frameworks.