基于规范生成的文件模糊测试  

File fuzzy test based on format generation

作　　者：沈亚楠[1,2] 赵荣彩[1] 王小芹[2] 任华[2] 张新宇[2] 鲁海军[2] 李鹏飞[3] 

机构地区：[1]解放军信息工程大学信息工程学院,河南郑州450001 [2]北京北方计算中心,北京100091 [3]中国科学院软件研究所,北京100090

出　　处：《计算机工程与设计》2010年第16期3591-3594,共4页Computer Engineering and Design

基　　金：国家自然科学基金项目(60603017)

摘　　要：为了解决传统文件模糊测试效率不高与功能遗漏的缺点,提出一种新的文件模糊测试算法。基于文件的规范,抽象地描述了文件推导规则,定义了文件模糊测试模板,设计了文件模糊变异模型。在规范描述下生成不同类型文件,然后对每类文件进行变异模糊测试,有效地减少了大量无效测试。实际测试中,已经验证3个已公开漏洞并发现两个未公开漏洞,表明了该算法的有效性。To solve the problem of low effectiveness and function missing in traditional file fuzzy test,a new kind of file fuzzy test algorithm is put forward.Based on file format,file deduced rule is abstractly described and file fuzzy test template is defined and file fuzzy mutated model is designed.Kinds of different files are generated and fuzzy test is performed on all of them under format description and thus lots of redundancy examples are decreased.Three known vulnerabilities are validated and two unreleased vulnerabilities is discovered in actual test and the validity of this file is proved.

关 键 词：模糊测试 文件规范描述 文件推导规则 文件模糊测试 脆弱性发掘 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]