一种基于Q-learning强化学习的导向性处理器安全性模糊测试方案  

A guided processor security fuzz testing scheme based on Q-learning reinforcement learning

作　　者：崔云凯 张伟[1,2,3] CUI Yunkai;ZHANG Wei(Computer School,Beijing Information Science&Technology University,Beijing 102206,China;Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing,Beijing 102206,China;Beijing Laboratory of National Economic Security Early-warning Engineering,Beijing 102206,China)

机构地区：[1]北京信息科技大学计算机学院,北京102206 [2]北京市未来区块链与隐私计算高精尖创新中心,北京102206 [3]国家经济安全预警工程北京实验室,北京102206

出　　处：《北京信息科技大学学报（自然科学版）》2024年第4期81-87,95,共8页Journal of Beijing Information Science and Technology University

基　　金：国家重点研发计划项目(2022YFC3320900);北京市教委科研计划科技一般项目(KM202311232005);网络与交换技术国家重点实验室开放课题(SKLNST-2023-1-01)。

摘　　要：针对处理器安全性模糊测试在进行细粒度变异时遗传算法存在一定的盲目性,易使生成的测试用例触发相同类型漏洞的问题,提出了一种基于Q-learning强化学习的导向性处理器安全性模糊测试方案。通过测试用例的状态值和所触发的漏洞类型对应的权值构造奖励函数,使用强化学习指导生成具有针对性和导向性的测试用例,快速地触发不同类型的漏洞。在Hikey970平台上的实验验证了基于ARMv8的测试用例生成框架的有效性,并且相较于传统使用遗传算法作为反馈的策略,本文方案在相同时间内生成有效测试用例的的数量多19.15%,发现漏洞类型的数量多80.00%。A guided processor security fuzz testing scheme based on Q-learning reinforcement learning was proposed to address the issue of blindness in genetic algorithms during fine-grained mutations for processor security fuzz testing,which often leads to test cases triggering the same type of vulnerability.By constructing a reward function using the state values of test cases and the weights corresponding to the types of triggered vulnerabilities,reinforcement learning was adopted to guide the generation of targeted and directional test cases,quickly triggering a variety of vulnerabilities.Experiments on the Hikey970 platform verified the effectiveness of the ARMv8-based test case generation framework.Compared with the traditional strategy using genetic algorithms as feedback,this scheme generates 19.15%more effective test cases and identifies 80.00%more types of vulnerabilities within the same time frame.

关 键 词：处理器漏洞检测 模糊测试 Q-learning强化学习 ARMv8 分支预测类漏洞 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]