First batch! Yun Qi’s boundless code fuzzy test system passed the fuzzy test capability evaluation of China Institute of Information and Communication.

Recently, Yun Qi Infinite Code Fuzzy Testing System participated in the standard evaluation of "Fuzzy Testing Architecture Capability Requirements" of China ICT Institute. In order to verify the safety capability of fuzzy test products in a more standard form, the "Capability Requirements of Fuzzy Test Architecture" standardizes the platform capability and engine capability of black-box and gray-box fuzzy tests, including 4 capability domains, 28 capability items and 246 capability indicators, and provides the overall guidance for the capability construction of fuzzy test platforms. According to the comprehensive performance of fuzzy test platform in different capability domains, it is divided into three capability levels: basic level, enhanced level and advanced level.

After the inspection by China Institute of Information and Communication Technology, the Infinite Code Fuzzy Testing System passed the index test of "Fuzzy Testing Architecture Capability Requirements" with the highest score, and its gray box platform capability domain and gray box engine capability domain both reached the "advanced level" requirement of fuzzy testing technology grading capability evaluation, and the product capability was highly recognized.

Software is the soul of a new generation of information technology, the foundation of the development of digital economy, and the key support for the construction of manufacturing power, network power and digital China. At present, the scale benefit of China’s software and information technology service industry is growing rapidly, and the innovation system of software and information technology service industry is basically established, which promotes the rapid development of new technologies, new products, new models and new formats, and accelerates the changes in lifestyle, production methods and social governance. However, with the increase of the total number of software, software quality accidents are still emerging.

As the leader of a new generation of intelligent fuzzy testing, Yun Qi Infinite has been focusing on the research and innovation of fuzzy testing technology since its establishment, and taking this as the core, it has built a series of products and services based on fuzzy testing, and is committed to helping enterprises solve the problem of security vulnerability mining in various scenarios, bringing more perfect and safer product service experience to enterprises.

1. Technological innovation: AIGC enables intelligent fuzzy testing.

The rapid development of GPT model has had a subversive impact on the production paradigm of various industries. As the leader of a new generation of intelligent fuzzy testing, Yun Qi Infinite takes the lead in integrating AIGC mode into products and empowering the software development stage, which has achieved remarkable results in the automatic generation of test cases and the automatic repair of vulnerabilities.

Security vulnerability detection: After AIGC is integrated into intelligent fuzzy testing, the generation process of test samples can be further optimized for specific input types and unknown defects, which greatly improves the quality and generation efficiency of test samples. Moreover, based on coverage guidance and other technologies, applications can be targeted for detection, code boundaries can be deeply explored, and known and unknown threats can be effectively detected.

Security vulnerability repair: Intelligent code fuzzy testing can accurately locate the defective code fragments and reproduce the causes of vulnerabilities. By using AIGC mode, the repaired code can be automatically generated by taking the detection results such as error code fragments as the input of the defect repair model. This method greatly improves the efficiency of defect repair and lowers the technical threshold of defect repair.

Generally speaking, through the deep integration of fuzzy testing and AIGC, Yun Qi Infinite Intelligent Fuzzy Testing Solution has greatly improved its capabilities in automation, testing depth, testing efficiency and defect repair, and opened a new chapter in intelligent security testing.

2. Yun Qi Infinite Product Service Matrix

Infinite code fuzzy test system

Based on intelligent fuzzy testing technology, Yun Qi Infinitus integrates GPT model, and develops and designs the infinite code fuzzy testing system on the basis of mutation algorithm, genetic algorithm, coverage guidance and many other technologies. Infinite code fuzzy testing system can be applied to development, testing, integration and other links, and it can detect the security of source code/binary files. Compared with the automatic security detection method of traditional detection tools, it can not only efficiently mine and detect and analyze "known and unknown" vulnerabilities, but also integrate AIGC mode, which can automatically generate repair schemes and revised security code fragments, greatly reducing the defect repair time and manual repair cost.

At present, independent test mode and CI/CD integration mode are supported.

Compared with traditional security detection tools, the boundless code fuzzy testing system has four advantages:

1) Detection of zero false positives and reproducible vulnerabilities

The testing method based on dynamic execution ensures that all detected defects are locatable, reproducible and verifiable, and the false positive rate approaches zero.

2) The test granularity is finer and the coverage of the scene is more complete.

Intelligent fuzzy testing based on AIGC, relying on AI genetic mutation algorithm and coverage guidance technology in the sample generation stage, can automatically generate massive (billion-level) high-quality test cases, the overall granularity will be finer, there will be more test points, and the location will be more accurate, which significantly improves the test effect and coverage. This scheme can not only be applied to Web application detection, but also be used in detection scenarios with higher test granularity requirements such as protocols, operating systems and databases.

3) Accurate detection of unknown vulnerabilities

By using AIGC to generate various types of distortion test data, the diversity and complexity of Fuzzing test can be increased, and more types of defects and unknown 0-0day vulnerabilities can be found. For example, by generating a string containing special characters or embedded commands, you can test the fault tolerance and security of the program for different input data.

4) Greatly reduce the cost of bug repair.

By combining AIGC with fuzzy testing, we can generate vulnerability repair suggestions faster and further improve the efficiency of vulnerability repair. Moreover, fuzzy testing with AIGC can realize the closed loop of the whole process of automatic vulnerability mining and repair, greatly improve the work efficiency of testers, and thus save the repair cost.

Infinite Protocol Fuzzy Test System

Infinite protocol fuzzy test system is a black-box protocol fuzzy test system independently developed by Yun Qi Infinite. By providing unexpected input to the target and monitoring abnormal results, it can automatically detect system defects and verify the protocol function, and help enterprises realize automatic security detection from the source, thus improving the security and robustness of protocol application.

The advantages of accurate, intelligent and non-invasive products are as follows:

1) Rich protocol support

Covers nearly 100 mainstream network protocols and supports the creation of custom protocol models;

2) Fully automatic safety inspection

Test cases are automatically generated, test strategies are automatically optimized, and detected vulnerabilities are automatically verified;

3) unknown problems, defense in advance

Massive variation test cases, support the detection of known vulnerabilities, and be good at discovering unknown vulnerabilities;

4) Rich test reports

Provide accurate reports, including key information such as fault classification, repair suggestions and vulnerability details;

5) Eliminate false alarm noise in detection.

Simulate the real running environment of the program to ensure that all detected defects can be reproduced and 0 false positives;

6) Non-invasive

Black-box detection method is adopted, which does not invade the system or engineering code and finds deep loopholes;

Flawless software defect analysis system

Innocent software defect analysis system is a self-developed static source code analysis tool. Combining deep software analysis method and deep learning method, it can detect a large number of deep security vulnerabilities that existing software security testing tools cannot detect, and effectively eliminate a large number of false positives.

1) The detection accuracy is "more accurate"

Intelligent learning automatically eliminates false positives, and the false positive rate is only 1/3 of other products.

2) The detection speed is "faster"

The program analysis engine with independent patent technology and a variety of innovative static analysis technologies shorten the detection time by 1/3.

3) The detection depth is "deeper"

Support cross-file, cross-class and cross-function defect/vulnerability detection of tens of millions of lines of code.

4) Detect vulnerabilities "more"

Can find more known/unknown deep security vulnerabilities.

Dust-free software component analysis system

An all-round intelligent software component analysis platform is built based on the concept of "security moving to the left" and DevSCAOps. The platform has four core component analysis engines: source code, component dependency, binary and container mirroring, which can quickly and accurately identify the third-party open source components used in the software, and then identify the potential security vulnerabilities and license information in the software through the correlation analysis technology, comprehensively judge the related risks, and give suggestions on how to repair the related risks, and rely on the SBOM account management ability to empower enterprises to make internal software.

The platform aims to empower enterprises with the ability of open source security and compliance governance, help enterprises achieve the knowability and controllability of software products in the practical sense, and escort enterprise network security.

Compared with the traditional SCA products, the clean software component analysis system can detect various types of targets, support file-level vulnerability homology analysis, support code autonomy analysis of Xinchuang software, and update data at high frequency, and provide standard SBOM list generation and management functions to effectively support users’ business needs.

1) Software component analysis, which supports source code, component dependency, binary file and container mirroring at the same time.

2) Vulnerability analysis, which supports component vulnerability correlation analysis and file-level vulnerability homology analysis.

3) License compliance analysis, while supporting component risk, conflict risk and tampering risk.

4) Support code copyright compliance analysis

5) Support code autonomy analysis

6)DevOps tool chain support

7) Data update frequency is daily update.

8) Software asset management, which supports the generation and management of SBOM list in international standard SPDX format.

Intelligent fuzzy test service

Relying on the service team’s accumulated experience in the security industry for more than ten years, Yun Qi Infinite has brought innovative intelligent fuzzy testing services to enterprises, including Internet of Things /IOT security testing services, vehicle equipment/vehicle networking security testing, service component security testing and directional vulnerability mining services, which help enterprises to build a more perfect security line and provide more comprehensive security solutions.

The advantages of fuzzy test service include the following:

1) Multi-field professional services: Yun Qi Infinite’s professional teams in the fields of network security, Internet of Things /IoT, cloud computing, big data and blockchain provide customers with high-quality technical services.

2) Rich expert experience: With rich practical experience, Yun Qi’s boundless expert team can quickly understand and locate customers’ core needs, reduce communication costs, and provide customized solutions for customers.

3) Advanced technical means: Yun Qi’s boundless security experts have won many awards in the top international information security competitions, and presented topics in world-renowned public meetings for many times, and their technical level is at the cutting edge in the industry.

4) Strict quality control: Yun Qi Infinite Security Service has established a perfect quality control system, with a complete quality control scheme from project start-up, demand analysis, development, delivery and maintenance, and the project manager will follow up all the way to ensure that every project of customers can be completed on time, with high quality and high standard.

As an advanced method of vulnerability mining and stability detection, the exploration of fuzzy testing technology continues. Next, Yun Qi Infinite will continue to deepen the fuzzy testing technology, build a more perfect product service matrix, and devote itself to the improvement of software development safety and software quality, provide customers with solutions that meet industry standards and use scenarios, and jointly promote the technical concept of system stability represented by fuzzy testing to fill the gap between technical theory and practice.

About the infinity of Yun Qi

Yun Qi Infinite is a new generation of AI-enabled software supply chain security practitioner, who is committed to promoting intelligent security detection and automatic defect repair of AI-enabled information systems. The team has gathered innovative talents in the security field from well-known universities such as Tsinghua and Beihou University, as well as head IT companies such as Huawei and Tencent. It has world-class automatic vulnerability detection and mining capabilities, and its products cover intelligent fuzzy testing, source code defect analysis, software component analysis, and intelligent security knowledge base.

Yun Qi Infinite has obtained dozens of software copyrights and patents, passed ISO 9001, ISO 20000, ISO 27001 and other certifications, participated in the formulation of more than 20 national and industrial standards, and served many industries such as energy, finance, communication and automobile. Since its establishment, the company has completed several rounds of tens of millions of financing.