用遗传算法自适应生成测试用例,显著提升漏洞检测覆盖率。
Enhancing Software Vulnerability Detection Through Adaptive Test Input Generation Using Genetic Algorithm
- 结合交叉算子与自适应反馈,动态优化测试输入生成
- 在9个JSON库上平均提升166%分支覆盖率
- 适合需要深度代码覆盖的软件安全测试场景
软件漏洞持续威胁现代系统的可靠性与安全性,尤其当软件复杂度超过传统检测方法能力时。本文提出一种基于遗传算法的测试输入生成方法,创新性地融合遗传算子与自适应学习机制。关键贡献在于引入交叉算子,扩大测试输入搜索空间;同时通过自适应反馈机制,持续学习系统执行行为,动态引导输入生成向有潜力区域聚焦。相比固定或随机输入,该方法通过反馈驱动选择,演化出结构合法的测试用例群体,实现探索与利用的协同优化。在9个开源JSON处理库上的评估显示,相比基准进化模糊测试方法,本方法平均提升39.8%类覆盖率、62.4%方法覆盖率、105.0%行覆盖率、114.0%指令覆盖率和166.0%分支覆盖率。结果表明该方法能有效发现更深层、更复杂的漏洞,为软件安全测试提供可扩展、自适应的解决方案。
原文摘要 · Abstract (English)
Software vulnerabilities continue to undermine the reliability and security of modern systems, particularly as software complexity outpaces the capabilities of traditional detection methods. This study introduces a genetic algorithm-based method for test input generation that innovatively integrates genetic operators and adaptive learning to enhance software vulnerability detection. A key contribution is the application of the crossover operator, which facilitates exploration by searching across a broader space of potential test inputs. Complementing this, an adaptive feedback mechanism continuously learns from the system's execution behavior and dynamically guides input generation toward promising areas of the input space. Rather than relying on fixed or randomly selected inputs, the approach evolves a population of structurally valid test cases using feedback-driven selection, enabling deeper and more effective code traversal. This strategic integration of exploration and exploitation ensures that both diverse and targeted test inputs are developed over time. Evaluation was conducted across nine open-source JSON-processing libraries. The proposed method achieved substantial improvements in coverage compared to a benchmark evolutionary fuzzing method, with average gains of 39.8% in class coverage, 62.4% in method coverage, 105.0% in line coverage, 114.0% in instruction coverage, and 166.0% in branch coverage. These results highlight the method's capacity to detect deeper and more complex vulnerabilities, offering a scalable and adaptive solution to software security testing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。