Abstract: A method for the automated performance of software tests for a program to be tested in an embedded system. The method includes: ascertaining, using an emulation-based fuzzer, a program behavior of the program to be tested, wherein at least one emulation-based result is derived on this basis; ascertaining, using a hardware-based fuzzer, the program behavior of the program to be tested, wherein at least one hardware-based result is derived on this basis; providing, using a monitoring component, the derived results, wherein the emulation-based result is provided to the hardware-based fuzzer, and/or the hardware-based result is provided to the emulation-based fuzzer.

Abstract: A method for testing a computer program. The method includes: executing the computer program until a memory allocation command is activated for allocating a memory region; expanding the memory region by a protection zone having at least one memory location; allocating the expanded memory region; setting a watchpoint on each of one or more memory locations of the protection zone; continuing the execution of the computer program; and displaying, for each set watchpoint, that the computer program has a bug if the set watchpoint is triggered.

Abstract: The disclosure relates to a method for analyzing target software with respect to potential vulnerabilities, using a machine learning model, in particular a large language model, including: providing first instruction information for the machine learning model, including: an instruction, based on information about the target software and information about the vulnerability, specifying how the vulnerability can be exploited; determining, based on the first instruction information, a first set of possibilities for how the vulnerability can be exploited; determining, based on reference information, for each of the first set of possibilities, a respective probability that the respective possibility is used; providing second instruction information, including: an instruction specifying how the first selected possibility can be implemented; determining, based on the second instruction information, a second set of possibilities for how the first selected possibility can be implemented; determining, based on one or mo

Abstract: A method for testing a computer program. The method includes executing the computer program until a subprogram is called, ascertaining a memory location of the call stack in which the return address or the stack base pointer of the called subprogram is stored, setting a watchpoint on the ascertained memory location, setting breakpoints on return instructions of the called subprogram, continuing the execution of the computer program and indicating that the computer program has an error if the set watchpoint has been triggered before one of the set breakpoints due to a write to the memory location.

Abstract: A computer-implemented method for obtaining an access notification as part of a taint analysis when testing a software program. The software program is executed on a hardware target. The hardware target has a memory. During execution of the software program, the software program stores data at least in part of the memory. The method includes: generating input data for the software program by means of a test module; transmitting the generated input data to the software program by means of the test module; monitoring at least one address of the memory by means of a debugger while the software program at least partially processes the transmitted input data; transmitting an access notification to the test module if at least one access is detected at the at least one address of the monitored memory.

Abstract: A method for generating training data for use in training a machine learning model used to detect malware, in particular in operating software for a technical system. The method includes: providing malware data, which include a plurality of decompositions, wherein each decomposition comprises function blocks that are or have been obtained by decomposing an attack vector; providing good software data, which comprise a plurality of decompositions, wherein each decomposition comprises function blocks that are or have been obtained by decomposing a good software sample; generating the training data, on the basis of the malware data and the good software data, wherein the training data comprise adapted good software samples, which are each based on function blocks of a corresponding good software sample that are supplemented with one or more function blocks of the malware data; and providing the training data for use in training the machine learning model.

Abstract: A method for detecting attacks on a computer system. The method includes ascertaining an input grammar, according to which a program running on the computer system processes inputs, by observing how the program processes a set of inputs; receiving one or more further inputs to the program; checking whether the ascertained input grammar can generate the one or more further inputs; and triggering a security measure depending on whether the ascertained input grammar can generate the one or more further inputs.

Abstract: A method for learning a state machine for a program including executing, via a host computer system, a state machine learning algorithm, wherein the host computer system controls an embedded system via a debugging interface by means of a debugger such that it executes the program several times. The host computer system detects for each execution of the program whether a program section has been reached which has not yet been reached during the previous executions of the program; and, when it detects this, an input to the program which was not supplied to the program by the host computer system and which caused the program to reach the program section, by using the debugger to determine a memory area of the embedded system into which the input was written, reading it out, and adding the determined input to an alphabet.

Abstract: A method for determining correctness and/or for generating an assessment of the risk of cyber attacks on a particular system. The method includes receiving a request to carry out cyber attack(s) on the system and invoking a machine learning agent. The machine learning agent accesses a generative machine learning model. The method further includes carrying out one or more cyber attacks on the system using the machine learning agent in response to the request, evaluating the results of the one or more carried out cyber attacks and determining, based on a finding of the step of evaluating the result, whether a predetermined assessment of the risk of cyber attacks on the particular system is correct or generating, based on a finding of the step of evaluating the result, an assessment of the risk of cyber attacks on the particular system.

Abstract: A method for detecting attacks on a computer system. The method includes, for each of one or more security vulnerabilities, extracting at least one exploit string assigned to the security vulnerability from code of a program that exploits the security vulnerability, wherein each of the extracted exploit strings is a string sent by the particular program to exploit the security vulnerability to which the exploit string is assigned, receiving messages by a computer system, searching for the extracted exploit strings in payload data of the received messages, and in response to one of the extracted exploit strings being found in one of the received messages, issuing an alarm indicating that an attack to exploit the security vulnerability to which the found exploit string is assigned has occurred, and alarm information indicating the message and the security vulnerability.

Abstract: A method for generating fuzz drivers for a fuzz setup. The method includes: inputting documentation of a fuzz target into a language understanding Artificial Intelligence (AI); generating, by the language understanding AI, Application Programming Interface (API) calls and their arguments from the documentation; generating at least one fuzz driver from the API calls and their arguments.

Abstract: An apparatus and computer-implemented method for allocating computing resources in a method for protecting a computer-aided development environment in a distributed development process from damage and threats. In the method for protecting, multiple methods for identifying damage and/or a threat in the computer-aided development environment are carried out, wherein a metric which quantifies a quality and/or informative value of the method is determined for each method, wherein a respective offer for allocating computing resources for the execution of the respective method is determined for the methods depending on said metric, wherein the computing resources are allocated to the methods depending on the respective offer.

Abstract: A method for obtaining coverage-guided fuzzing of software on a hardware target. The hardware target includes a breakpoint register, and is designed to stop an execution of the software prior to execution of an instruction of the software if the instruction is reached during the execution of the software; a memory address of the instruction is set in the breakpoint register. The method includes setting a first breakpoint prior to a first instruction of the software; executing or continuing a fuzzing iteration of the software; first checking whether the first breakpoint is reached while executing or continuing the fuzzing iteration; storing a piece of log information that includes that the first instruction in the fuzzing iteration has been reached, and optionally deleting the first breakpoint if the first check is positive. The coverage-guided fuzzing of the software includes the piece of log information.

Abstract: A method for testing a computer program. The method includes training a machine learning model to predict, for each test input supplied thereto, a coverage of the computer program that is achieved when the computer program is executed with the test inputs as inputs, testing the computer program in a plurality of iterations, wherein in each iteration a test input is generated, the trained machine learning model is used to predict a coverage of the computer program that is achieved when the computer program is executed with the generated test input as input, it is ascertained whether the predicted coverage increases an overall coverage previously achieved by testing the computer program, and, in response to ascertaining that the predicted coverage increases the overall coverage previously achieved by testing the computer program, the computer program is executed with the generated test input.

Abstract: A method for testing a computer program. The method includes setting one or more breakpoints on one or more string output instructions in the computer program; executing the computer program; when one of the set breakpoints is triggered, ascertaining whether the string provided, for outputting, to a string output function called by the particular string output instruction contains one or more format specifications for the computer program for more values than provided as arguments to the particular string output function; and, in response to ascertaining that the string provided to the string output function for outputting contains one or more format specifications for the computer program for more values than provided as arguments to the particular string output function, triggering a display that the computer program has an error.

Abstract: A method for testing a computer program. The method includes setting one or more breakpoints on one or more arithmetic or bit-shifting operations in the computer program; executing the computer program; when one of the set breakpoints is triggered, ascertaining whether an overflow flag is set by executing the respective arithmetic or bit-shifting operation; and triggering a display that the computer program has an error, in response to ascertaining that the overflow flag is set as a result of the respective arithmetic or bit-shifting operation.

Abstract: A method for testing a computer program. The method includes setting breakpoints on one or more memory access instructions in the computer program; executing the computer program; when one of the set breakpoints is triggered, ascertaining whether the memory access instruction is for accessing a data element that has a size that requires an alignment to the memory address to which it is written or from which it is read, and ascertaining the required alignment; if the memory access instruction is for accessing a data element that has a size that requires an alignment to the memory address to which it is written or from which it is read, ascertaining whether the memory address which the memory access instruction accesses meets the required alignment; in response to ascertaining that the memory address does not meet the required alignment, triggering a display that the computer program has an error.

Abstract: A method for testing a computer program. The method includes setting one or more breakpoints on one or more memory deallocation instructions in the computer program; executing the computer program; and, when one of the set breakpoints is triggered, setting a pointer that the memory deallocation instruction obtains as a specification of the memory area to be deallocated, to a value that triggers an exception when the pointer is subsequently used in the computer program.

Abstract: A method for testing a computer program. The method includes executing the computer program until a memory share command for a memory area previously allocated by a memory allocation command of the computer program is called; setting, for each one or more memory locations of the memory area shared by the memory share command, a respective watchpoint for the memory location of the memory area and executing the memory share command; displaying, for each set watchpoint, that the computer program has an error, if the set watchpoint is triggered, and removing the watchpoint for each of the set watchpoints if the memory location for which it is set is reallocated by a further memory allocation command in the computer program.

Abstract: A method for testing a computer program. The method includes executing the computer program until a memory enable command is called for a memory region previously allocated by a memory allocation command of the computer program; skipping the memory enable command, and setting, for each of one or more memory locations of the memory region that is to be enabled by the memory enable command, a relevant watchpoint to the memory location of the memory region; and displaying, for each set watchpoint, that the computer program has a bug if the set watchpoint is triggered.