面向ROS的差分模糊测试方法

机器人操作系统（Robot Operating System，简称ROS）是一种广泛应用于机器人开发的开源系统，它可以为开发者提供硬件抽象、设备驱动、库函数、可视化、消息传递和软件包管理等诸多功能，具有重要而广阔的应用前景.ROS集成了可以实现不同功能的功能包，例如定位绘图、行动规划、感知、模拟等等，但其中可能存在一些漏洞破坏整个机器人系统的安全性和可靠性；本文提出了一种差分模糊测试方法对ROS不同版本的功能包进行测试，找出其中的漏洞.我们的方法包括测试用例生成和差分模糊测试执行两个模块.首先，对于输入文件进行加载、处理并基于策略生成的方法生成测试用例文件；其次，节点间使用话题通讯机制实现通讯，使用上一模块生成的测试用例文件作为统一的模糊输入，对ROS不同版本的功能包进行差分模糊测试；接着，对测试结果中的不一致输出进行差异计算并评估，符合评估指标的种子将被保留并反馈给用例生成模块循环生成测试用例，有效提高种子质量及代码覆盖率；最后分析不一致输出原因，找出漏洞.我们将该方法应用在机器人坐标转换的实验中，实现对不同参考系下坐标转换的功能包TF和TF2的测试；最终实验表明，与TF2相比，TF在功能实现上更加准确.TF2实现坐标旋转变换的函数存在漏洞.

Differential Fuzz Testing of Robot Operating System

Robot Operating System (ROS) is an open source system widely used in Robot development. It can provide developers with hardware abstraction, device driver, library function, visualization, messaging, software package management and other functions, which has an important and broad application prospect. ROS integrates various software packages that can realize different functions, such as positioning drawing, action planning, perception, simulation, etc. However, some vulnerabilities may damage the overall safety and reliability of robot system directly. In this paper, a ROS oriented fuzzing method is proposed to test different versions of ROS packages and find out the vulnerabilities. Our approach includes two modules:test cases generation and differential fuzz testing execution. Firstly, load and process the input file, and generate the test cases file based on the strategies generation. Secondly, nodes use topic communication mechanism to communicate, and the test cases file as the inputs to carry out differential fuzz testing on the ROS packages. Then, the inconsistent outputs in the test results are calculated and evaluated, and the seed meet the evaluation indicators are reserved and feed back to the test case generation module to generate test cases, it will improve seed quality and code coverage effectively. Finally, analyze the cause of inconsistent output and find out the vulnerability. We apply this method in the experiment of robot coordinate transformation, testing the packages TF and TF2 that realize coordinate transformation under different reference frames. Finally, experiments show that TF is more accurate in function implementation compared with TF2,and there are vulnerabilities in the function of TF2 to realize coordinate rotation transformation.