PyFuzzer:自动化高效内存模糊测试方法  

PyFuzzer:automatic in-memory fuzz testing method

作　　者：李伟明[1] 于俊清[1] 艾少波 

机构地区：[1]华中科技大学网络与计算中心,湖北武汉430074

出　　处：《通信学报》2013年第S2期64-68,共5页Journal on Communications

基　　金：国家自然科学基金资助项目(61370230)~~

摘　　要：针对传统模糊测试(fuzz testing)耗时、无法绕过有效性验证等缺陷,提出了基于快速内存模糊测试,综合运用静态分析和动态跟踪技术的测试工具—PyFuzzer。整个过程高度自动化,通过WarFTPD、Serv-U等程序进行测试,并和4n FTP Fuzzer进行对比,结果表明PyFuzzer能有效地发掘二进制程序中的各种漏洞,极大地提高了模糊测试的效率。Fuzz Testing is an effective method to mine all kinds of vulnerabilities. But the main drawbacks to current fuzz testing tools are: firstly, it produces high volume testing data and it's extraordinary time consumption; secondly, if the accessing needs authentication, the greatest part of test data will be abandoned. PyFuzzer, a novel automatic in-memory fuzz testing tool combining static analysis, dynamic analysis and in-memory fuzz testing, was presented. The tool is highly automatic and effective. Compared with 4n FTP Fuzzer in testing WarFTPD and Serv-U, PyFuzzer can discover all vulnerabilities and improve test efficiency greatly.

关 键 词：模糊测试 静态分析 动态跟踪 漏洞挖掘 

分 类 号：TP311.53[自动化与计算机技术—计算机软件与理论] TP309[自动化与计算机技术—计算机科学与技术]