基于SEH的漏洞自动检测与测试用例生成  

Automatic Vulnerability Detection and Test Cases Generation Method for Vulnerabilities Caused by SEH

作　　者：黄钊 黄曙光 邓兆琨 黄晖 HUANG Zhao;HUANG Shu-guang;DENG Zhao-kun;HUANG Hui(National University of Defense Technology,Hefei 230037,China)

机构地区：[1]国防科技大学

出　　处：《计算机科学》2019年第7期133-138,共6页Computer Science

基　　金：国家重点研发计划“网络空间安全”重点专项(2017YFB0802905)资助

摘　　要：SEH即结构化异常处理,是Windows操作系统提供给程序设计者处理程序错误或异常的途径。然而SEH的链式处理方式使得程序中可能存在相应漏洞。针对该问题,为提升程序安全性,提出一种基于SEH的漏洞自动测试用例生成方法。首先判断程序是否存在基于SEH被攻击的漏洞风险性,若存在则构建和调整测试用例约束,并自动求解生成相应测试用例。该方法一方面扩展了当前的自动测试用例生成模式,另一方面可在GS保护开启时仍能生成有效测试用例。最后通过实验验证了该方法的有效性。Structured Exception Handling(SEH),which offered by Windows operating system,is a way to handle program errors or exceptions.However,while SEH handles exception based on link,there may be corresponding vulnerabi-lities.To solve this problem,in order to improve program security,a method was proposed to generate test cases base on SEH.First,the method judge whether the program has the risk of being attacked based on the SEH.If there is a risk,the test case constraints are constructed and adjusted.Then by solve these constraints,the corresponding test cases are generated automatically.On the one hand,this method extends the current automatic test case generation pattern.And on the other hand,it can generate effective test cases even when GS protection is turned on.Finally,the effectiveness of the method is verified by experiments.

关 键 词：结构化异常处理 符号执行 自动测试用例生成 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]