基于模型的Fuzzing测试脚本自动化生成  

Model Based Automatic Fuzzing Script Generation

作　　者：侯莹[1] 洪征[1] 潘璠[1] 吴礼发[1] 

机构地区：[1]解放军理工大学指挥自动化学院,南京210007

出　　处：《计算机科学》2013年第3期206-209,共4页Computer Science

基　　金：江苏省自然科学基金项目(BK2011115);军用网络技术实验室创新开放基金项目资助

摘　　要：针对基于知识的Fuzzing测试技术存在脚本编写工作量大的问题,提出一种基于模型的Fuzzing测试脚本自动生成方法。方法首先以高阶属性文法形式化地描述数据模型,获取统一的、与测试环境无关的数据格式描述;然后依据文法模型,将样本解析为带格式知识的文法分析树;最后建立文法分析树与测试逻辑的关联关系,实现自动化的测试脚本生成。实验结果表明,所提出的方法能够自动生成有效的测试脚本,并发现软件中潜在的安全漏洞。Knowledge based fuzzing techniques generally have some shortcomings of heavy workload in writing scripts. A model based automatic fuzzing script generation method was proposed. Firstly data format is represented by the higher order attribute grammars, and uniform data representation which is irrelevant to the test environments can be obtained. Secondly, the grammar model is used to parse the sample data and build the grammar parsing tree. Lastly, the relation- ship between the parsing tree and the test logic is built, which can be used to generate test script automatically. Experi- mental results indicate that the method can generate effective test scripts automatically to discover potential vulnerabili- ties in software.

关 键 词：高阶属性文法 模糊测试 文法分析树 漏洞挖掘 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]