面向ROS的差分模糊测试方法  

Differential Fuzz Testing of Robot Operating System

作　　者：王颖 王冰青[1,2] 关永 李晓娟[1,2] 王瑞[1,2] WANG Ying;WANG Bing-Qing;GUAN Yong;LI Xiao-Juan;WANG Rui(College of Information Engineering,Capital Normal University,Beijing 100048,China;Beijing Key Laboratory of Light Industrial Robot and Safety Verification(Capital Normal University),Beijing 100048,China;National International Science and Technology Cooperation Demonstration Base of Interdisciplinary of Electronic System Reliability and Mathematics(Capital Normal University),Beijing 100048,China)

机构地区：[1]首都师范大学信息工程学院,北京100048 [2]轻型工业机器人与安全验证北京市重点实验室(首都师范大学),北京100048 [3]电子系统可靠性与数理交叉学科国家国际科技合作示范型基地(首都师范大学),北京100048

出　　处：《软件学报》2021年第6期1867-1881,共15页Journal of Software

基　　金：国家重点研发计划(2019YFB1309900);国家自然科学基金(61877040);首都师范大学交叉研究院项目(19530012005);上海控安开放课题。

摘　　要：机器人操作系统(robot operating system,简称ROS)是一种广泛应用于机器人开发的开源系统,它可以为开发者提供硬件抽象、设备驱动、库函数、可视化、消息传递和软件包管理等诸多功能,应用前景广阔.ROS集成了可以实现不同功能的功能包,例如定位绘图、行动规划、感知、模拟等等,但其中可能存在一些漏洞,破坏整个机器人系统的安全性和可靠性.提出了一种差分模糊测试方法对ROS不同版本的功能包进行测试,找出其中的漏洞.该方法包括测试用例生成和差分模糊测试执行两个模块:首先,对于输入文件进行加载、处理,并基于策略生成的方法生成测试用例文件;其次,节点间使用话题通信机制实现通信,使用上一模块生成的测试用例文件作为统一的模糊输入,对ROS不同版本的功能包进行差分模糊测试;接着,对测试结果中的不一致输出进行差异计算并评估,符合评估指标的种子将被保留并反馈给用例生成模块循环生成测试用例,有效提高了种子质量及代码覆盖率;最后分析不一致输出原因,找出漏洞.将该方法应用在机器人坐标转换的实验中,实现对不同参考系下坐标转换的功能包TF和TF2的测试.最终的实验结果表明:与TF2相比,TF在功能实现上更加准确.TF2实现坐标旋转变换的函数存在漏洞.Robot operating system(ROS)is an open source system widely used in Robot development.It can provide developers with hardware abstraction,device driver,library function,visualization,messaging,software package management,and other functions,which has an important and broad application prospect.ROS integrates various software packages that can realize different functions,such as positioning drawing,action planning,perception,simulation,etc.However,some vulnerabilities may damage the overall safety and reliability of robot system directly.In this study,an ROS oriented fuzzing method is proposed to test different versions of ROS packages and find out the vulnerabilities.The proposed approach includes two modules:Test cases generation and differential fuzz testing execution.Firstly,load and process the input file,and generate the test cases file based on the strategy’s generation.Secondly,communication among nodes is achieved using topic communication mechanism,and the test case files are used as the inputs to carry out differential fuzz testing on the ROS packages.Then,the inconsistent outputs in the test results are calculated and evaluated,and the seed meet the evaluation indicators are reserved and fed back to the test case generation module to generate test cases,it will improve seed quality and code coverage effectively.Finally,analyze the cause of inconsistent output and find out the vulnerability.This method is applied in the experiment of robot coordinate transformation,testing the packages TF and TF2 that realize coordinate transformation under different reference frames.Final experiment results show that TF is more accurate in function implementation compared with TF2,and there are vulnerabilities in the function of TF2 to realize coordinate rotation transformation.

关 键 词：差分模糊测试 机器人操作系统 功能包 漏洞检测 可靠性 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]