云边端内核竞态漏洞大模型分析方法研究

doi:10.3969/j.issn.1671-1122.2025.07.001

信息网络安全 ›› 2025, Vol. 25 ›› Issue (7): 1007-1020.doi: 10.3969/j.issn.1671-1122.2025.07.001

云边端内核竞态漏洞大模型分析方法研究

陈平¹, 骆明宇²()

1.复旦大学大数据研究院，上海 200433
2.复旦大学计算机科学技术学院，上海 200433

收稿日期:2025-05-10 出版日期:2025-07-10 发布日期:2025-08-07
通讯作者: 骆明宇 E-mail:luomingyu2002@126.com
作者简介:陈平（1985—），男，江苏，研究员，博士，主要研究方向为软件和系统安全|骆明宇（2003—），男，安徽，博士研究生，主要研究方向为人工智能赋能传统安全
基金资助:
国家重点研发计划(2022YFB3104300)

Research on Large Model Analysis Methods for Kernel Race Vulnerabilities in Cloud-Edge-Device Scenarios

CHEN Ping¹, LUO Mingyu²()

1. Institute of Big Data, Fudan University, Shanghai 200433, China
2. School of Computer Science, Fudan University, Shanghai 200433, China

Received:2025-05-10 Online:2025-07-10 Published:2025-08-07
Contact: LUO Mingyu E-mail:luomingyu2002@126.com

摘要/Abstract

摘要：

随着云边端场景的广泛应用，操作系统内核竞态条件检测面临新的挑战，其复杂性日益提升。针对这一问题，文章提出一种基于大语言模型的内核竞态条件分析方法LogFuzz。该方法通过知识注入机制，实现对系统调用依赖关系的动态学习与精准分析，有效缓解云边端环境下内核漏洞分析的难题。研究首先利用崩溃日志进行系统调用模式提取与分析，解决传统方法在复杂依赖关系建模中的局限性。在此基础上，引入大语言模型的领域知识，通过参数高效微调框架深度挖掘系统调用的语义与语法特征，指导模糊测试。实验结果表明，在Linux内核测试中，文章所提方法在18 h后的分支覆盖率较传统方法提升3.31%，并成功触发7个系统崩溃。该方法有助于提升系统安全，为云边端内核竞态条件检测提供一种技术路径。

关键词: 内核竞态条件, 系统调用序列, 模糊测试, 大语言模型, 云边端安全

Abstract:

With the widespread application of cloud-edge-device scenarios, kernel race condition detection in operating systems faces new challenges, and its complexity is increasing. To address this issue, this paper proposed a kernel race condition analysis method called LogFuzz based on large language model. This method achieved dynamic learning and precise analysis of system call dependencies through a knowledge injection mechanism, effectively alleviating the difficulties in kernel vulnerability analysis in cloud-edge-device environments. The research first utilized crash logs for system call pattern extraction and analysis, addressing the limitations of traditional methods in modeling complex dependencies. On this basis, domain knowledge from large language models was introduced, and system call semantics and syntactic features are deeply mined through a parameter-efficient fine-tuning framework to guide fuzz testing. Experimental results show that the proposed method, in Linux kernel testing, improved branch coverage by 3.31% compared to traditional methods after 18 hours and successfully triggered 7 system crashes. The method proposed in this paper provides a new technical path for kernel race condition detection in cloud-edge-device scenarios and is of great significance for enhancing system security.

Key words: kernel race conditions, system call sequences, fuzz testing, large language model, cloud-edge-device security

中图分类号:

TP309

陈平, 骆明宇. 云边端内核竞态漏洞大模型分析方法研究[J]. 信息网络安全, 2025, 25(7): 1007-1020.

CHEN Ping, LUO Mingyu. Research on Large Model Analysis Methods for Kernel Race Vulnerabilities in Cloud-Edge-Device Scenarios[J]. Netinfo Security, 2025, 25(7): 1007-1020.

图/表 10

图1

图2

图3

图4

图5

图6

图7

图8

表1

图9

参考文献 18

[1]	UPADHYAY A, LAXMI V, NAVAL S. Navigating the Concurrency Landscape: A Survey of Race Condition Vulnerability Detectors[EB/OL]. (2023-12-22) [2025-04-30]. https://arxiv.org/abs/2312.14479.
[2]	DRYSDALE D. Coverage-Guided Kernel Fuzzing with Syzkaller[EB/OL]. [2025-04-30]. https://lwn.net/Articles/677764/.
[3]	SUN Hao, SHEN Yuheng, LIU Jianzhong, et al. KSG: Augmenting Kernel Fuzzing with System Call Specification Generation[C]// USENIX. 2022 USENIX Annual Technical Conference (USENIX ATC 22). Berkeley: USENIX, 2022: 351-366.
[4]	CHEN M, TWOREK J, JUN H, et al. Evaluating Large Language Models Trained on Code[EB/OL]. (2021-07-07) [2025-04-30]. https://arxiv.org/abs/2107.03374.
[5]	BROWN T, MANN B, RYDER N, et al. Language Models are Few-Shot Learners[J]. Advances in Neural Information Processing Systems, 2020, 33: 1877-1901.
[6]	YAO Dongyu, ZHANG Jianshu, HARRIS I G, et al. FuzzLLM: A Novel and Universal Fuzzing Framework for Proactively Discovering Jailbreak Vulnerabilities in Large Language Models[C]// IEEE. ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). New York: IEEE, 2024: 4485-4489.
[7]	YANG Chenyuan, ZHAO Zijie, ZHANG Lingming. KernelGPT: Enhanced Kernel Fuzzing via Large Language Models[EB/OL]. (2024-01-02) [2025-04-30]. https://arxiv.org/abs/2401.00563.
[8]	DENG Yinlin, XIA C S, PENG Haoran, et al. Large Language Models are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models[C]// ACM. The 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis. New York: ACM, 2023: 423-435.
[9]	XIA C S, PALTENGHI M, LE T J, et al. Fuzz4all: Universal Fuzzing with Large Language Models[C]// ACM. The 46th International Conference on Software Engineering. New York: ACM, 2024: 1-13.
[10]	ZHANG Cen, ZHENG Yaowen, BAI Mingqiang, et al. How Effective are They? Exploring Large Language Model Based Fuzz Driver Generation[C]// ACM. The 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis. New York: ACM, 2024: 1223-1235.
[11]	ENGLER D, ASHCRAFT K. RacerX: Effective, Static Detection of Race Conditions and Deadlocks[J]. ACM SIGOPS Operating Systems Review, 2003, 37(5): 237-252.
[12]	MANÈS V J M, HAN H S, HAN C, et al. The Art, Science, and Engineering of Fuzzing: A Survey[J]. IEEE Transactions on Software Engineering, 2019, 47(11): 2312-2331.
[13]	LIANG Hongliang, PEI Xiaoxiao, JIA Xiaodong, et al. Fuzzing: State of the Art[J]. IEEE Transactions on Reliability, 2018, 67(3): 1199-1218.
[14]	SCHUMILO S, ASCHERMANN C, GAWLIK R, et al. kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels[C]// USENIX. The 26th USENIX Security Symposium (USENIX Security 17). Berkeley: USENIX, 2017: 167-182.
[15]	JEONG D R, KIM K, SHIVAKUMAR B, et al. Razzer: Finding Kernel Race Bugs through Fuzzing[C]// IEEE. 2019 IEEE Symposium on Security and Privacy (SP). New York: IEEE, 2019: 754-768.
[16]	XU Meng, KASHYAP S, ZHAO Hanqing, et al. Krace: Data Race Fuzzing for Kernel File Systems[C]// IEEE. 2020 IEEE Symposium on Security and Privacy (SP). New York: IEEE, 2020: 1643-1660.
[17]	PAILOOR S, ADAY A, JANA S. MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation[C]// USENIX. 27th USENIX Security Symposium (USENIX Security 18). Berkeley: USENIX, 2018: 729-743.
[18]	ODENA A, OLSSON C, ANDERSEN D, et al. Tensorfuzz: Debugging Neural Networks with Coverage-Guided Fuzzing[C]// PMLR. International Conference on Machine Learning. New York: PMLR, 2019: 4901-4911.

评估指标	分支覆盖	触发总崩溃数	竞态条件相关崩溃数	语义有效性验证通过率
Syzkaller-Base	148517个	5个	2个	—
LogFuzz-LLM	153435个	7个	4个	94.2%
提升/说明	+3.31%	+2	+2（发现能力更强）	—

云边端内核竞态漏洞大模型分析方法研究

Research on Large Model Analysis Methods for Kernel Race Vulnerabilities in Cloud-Edge-Device Scenarios

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 10

参考文献 18

相关文章 15

编辑推荐

Metrics

本文评价

[1]	酆薇, 肖文名, 田征, 梁中军, 姜滨. 基于大语言模型的气象数据语义智能识别算法研究[J]. 信息网络安全, 2025, 25(7): 1163-1171.
[2]	张学旺, 卢荟, 谢昊飞. 基于节点中心性和大模型的漏洞检测数据增强方法[J]. 信息网络安全, 2025, 25(4): 550-563.
[3]	韦超仁, 夏万煦, 屈刚, 白万荣, 杨立群. 面向智能系统开源模糊测试框架优化技术研究[J]. 信息网络安全, 2025, 25(4): 587-597.
[4]	顾欢欢, 李千目, 刘臻, 王方圆, 姜宇. 基于虚假演示的隐藏后门提示攻击方法研究[J]. 信息网络安全, 2025, 25(4): 619-629.
[5]	常振轩, 郑之涵, 梅傲寒, 谭毓安. 一种面向固件网络应用的高效灰盒模糊测试方法[J]. 信息网络安全, 2025, 25(4): 654-663.
[6]	金增旺, 江令洋, 丁俊怡, 张慧翔, 赵波, 方鹏飞. 工业控制系统安全研究综述[J]. 信息网络安全, 2025, 25(3): 341-363.
[7]	解梦飞, 傅建明, 姚人懿. 基于LLM的多媒体原生库模糊测试研究[J]. 信息网络安全, 2025, 25(3): 403-414.
[8]	秦中元, 王田田, 刘伟强, 张群芳. 大语言模型水印技术研究进展[J]. 信息网络安全, 2025, 25(2): 177-193.
[9]	王鹃, 张勃显, 张志杰, 谢海宁, 付金涛, 王洋. 基于模糊测试的Java反序列化漏洞挖掘[J]. 信息网络安全, 2025, 25(1): 1-12.
[10]	焦诗琴, 张贵杨, 李国旗. 一种聚焦于提示的大语言模型隐私评估和混淆方法[J]. 信息网络安全, 2024, 24(9): 1396-1408.
[11]	陈昊然, 刘宇, 陈平. 基于大语言模型的内生安全异构体生成方法[J]. 信息网络安全, 2024, 24(8): 1231-1240.
[12]	张立强, 路梦君, 严飞. 一种基于函数依赖的跨合约模糊测试方案[J]. 信息网络安全, 2024, 24(7): 1038-1049.
[13]	项慧, 薛鋆豪, 郝玲昕. 基于语言特征集成学习的大语言模型生成文本检测[J]. 信息网络安全, 2024, 24(7): 1098-1109.
[14]	郭祥鑫, 林璟锵, 贾世杰, 李光正. 针对大语言模型生成的密码应用代码安全性分析[J]. 信息网络安全, 2024, 24(6): 917-925.
[15]	张长琳, 仝鑫, 佟晖, 杨莹. 面向网络安全领域的大语言模型技术综述[J]. 信息网络安全, 2024, 24(5): 778-793.