并行化智能模糊测试  

Parallel smart fuzzing test

作　　者：梁洪亮[1] 阳晓宇[1] 董钰[1] 张普含[2] 刘书昌[1] 

机构地区：[1]北京邮电大学计算机学院,北京100876 [2]中国信息安全测评中心,北京100085

出　　处：《清华大学学报（自然科学版）》2014年第1期14-19,共6页Journal of Tsinghua University(Science and Technology)

基　　金：国家某部委基金(CNITSEC-KY-2012-001/1)

摘　　要：针对目前智能模糊测试技术中整体测试所需时间较长以及生成单个测试用例漏洞触发能力较弱的问题,该文提出了一种可用于并行化环境中的路径取反算法和一种加入随机数据的复合测试用例生成方式。该路径取反算法给每个测试用例赋予一个边界变量,利用该变量限定每个测试用例可进行取反操作的范围,同时在该范围中对多个条件进行取反。该复合测试用例生成方式借助传统模糊测试技术生成随机的漏洞触发数据,将该随机数据与混合符号执行生成用例相结合,从而生成复合化的测试用例。同时该文设计并实现了一个并行化智能模糊测试系统———谛听,并利用该系统对3个应用软件进行了测试,共生成测试用例203 602个,触发软件漏洞2个,其中一个为首次被发现的零日(0-Day)漏洞。理论分析与实验表明:该路径取反算法可有效应用于并行环境中,从而缩短整个测试所需时间并生成较多测试用例;同时该复合测试用例生成方式可有效提升测试用例漏洞触发能力。Present smart fuzzing techniques are time-consuming and do not effeedtively trigger vulnerabilities. A parallel execution path negate algorithm and a compound test case generation method are introduced in this paper with parallel program analyses and traditional fuzzing techniques. Each test case was given a variable to limit the range of the negate operation with many conditions negated in this range. The test case generation method generates the vulnerability trigger data using traditional fuzzing techniques which are added to the test case generated by Concolic execution. Diting was developed to verify and test these techniques. Tests of three applications using 203602 test cases identified two vulnerabilities.One of the vulnerabilities was a 0 Day vulnerability. Theoretical analyses and test results show that the negate algorithm can be applied in a parallel environment to reduce the testing time and the test case generation method improves the ability to trigger vulnerabilities in the test cases.

关 键 词：软件安全 漏洞挖掘 智能模糊测试 约束求解 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]