基于Fuzzing的软件漏洞发掘技术  

Excavation Technology of Software Vulnerabilities Based on Fuzzing

作　　者：李彤[1] 黄轩[1] 刘海燕[1] 黄睿[1] 

机构地区：[1]装甲兵工程学院信息工程系,北京100072

出　　处：《价值工程》2014年第3期197-199,共3页Value Engineering

摘　　要：随着社会信息化的不断发展,软件的安全问题也越来越突出了。目前,绝大多数的软件都或多或少的存在着一些安全漏洞,而这些漏洞一旦被那些不怀好意的黑客利用,将会给软件公司和使用这些软件的人造成巨大的损失。所以,对软件的漏洞发掘工作就显得十分有必要,本文在总结Fuzzing技术的一些缺陷后,在测试数据生成、异常定位和自动分析方面对其进行了改进,设计了基于Fuzzing的漏洞发掘框架,并对一些核心模块加以实现,达到了预期目的。With the continuous development of society informatization, the security problems of software are more and more highlighted. At present, the vast majority of software has security vulnerabilities more or less.Once these vulnerabilitiesare exploited by malicioushackers, huge losses will be caused for software companies and people who usingthe software.Therefore, theexcavations ofsecurity vulnerabilitiesare very necessary. This paper improves the aspects of test datageneratiou,abnonnal positioning and automated analysis after summarized somedefects of Fuzzing techniques,designsa vulnerabilityexcavation model based on Fuzzing and realizes some core modules to achieve thedesired purpose.

关 键 词：安全漏洞 漏洞发掘 FUZZING Fuzzer 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]