动态资源感知的并行化模糊测试框架  

Dynamic resource awareness framework for parallel fuzzing

作　　者：廉美 邹燕燕[1] 霍玮[1] 邹维[1] 

机构地区：[1]中国科学院信息工程研究所网络安全防护技术北京市重点实验室,北京100093 [2]中国科学院大学,北京100049

出　　处：《计算机应用研究》2017年第1期52-57,共6页Application Research of Computers

基　　金：国家"863"计划资助项目(2015AA017202)

摘　　要：针对现有的并行模糊测试在测试效率、资源利用率以及异常处理上的局限性,围绕测试资源的生成、使用及容错三个方面提出了一种动态资源感知的系统化解决方案。针对测试环境在大规模和多场景两个维度快速搭建的需求,提出一种基于云平台的动态构建方法,加快测试环境部署,提高有效fuzz时间;针对并行模糊测试中资源利用率低的问题,提出一种多层次并行度动态调整的资源配置策略,优化整体测试资源配置并提高单机负载;针对大规模并行测试中节点易发生故障的问题,提出基于优先级调度的容错处理方法。最后,设计并实现了一个基于四级流水线并行处理结构的通用模糊测试框架。实验证明,该框架能够有效提高并行模糊测试的测试效率和资源利用率,实现系统的有效容错。It is not trivial to apply current parallel fuzzing techniques on large scale cluster directly, due to its limitation on testing efficiency, resource usage and system fault tolerance. This paper proposed a dynamic resource-aware approach, which could systematically tackle the problem from the generation, the usage and the fault tolerance of testing resources. To building the large scale testing cluster quickly, it described a cloud-based dynamic building approach to reduce the generation time. For the low utilization problem of testing resources, it proposed a multi-level dynamic scheduling police to improve the overall recourse usage and the single node workload. In order to make test continually, it proposed a priority-based fauh tolerant method. Finally, it finished a general parallel fuzzing framework ,which based on a four-stage pipeline structure. The experiment shows that the framework is very effective in respect to the parallel efficiency, resource usage, and fault tolerance.

关 键 词：漏洞挖掘 并行模糊测试 资源感知 测试框架 云平台 

分 类 号：TP302.7[自动化与计算机技术—计算机系统结构]