有状态协议模糊测试的种子调度算法  

Seed scheduling algorithm for fuzzing stateful protocols

作　　者：谢宇豪 徐向华[1] Xie Yuhao;Xu Xianghua(School of Computer Science,Hangzhou Dianzi University,Hangzhou 310018,China)

机构地区：[1]杭州电子科技大学计算机学院,杭州310018

出　　处：《计算机应用研究》2024年第10期3119-3123,共5页Application Research of Computers

摘　　要：为了探索有状态协议的程序漏洞,AFL-NET提出了有状态协议模糊测试。在有状态协议模糊测试中,种子的选择对路径的探索有着重大的贡献。然而,目前的有状态协议模糊测试往往重复执行几个相同的种子,导致不能很好地探索更多的路径。为了缓解该问题,从种子的收益入手,提出了一种有效的基于有状态协议的种子动态调度算法。利用种子的潜在收益和实际收益以及成本作为收益,利用收益来进行动态的种子调度,并分配种子的执行次数。实验表明,该方法在漏洞发现数量上有显著提升,在提高覆盖率方面也有一定的提升,说明此收益定义以及种子调度算法能有效选择种子,探索更多的路径以及漏洞。In order to investigate vulnerabilities in stateful protocols,AFL-NET has put forward stateful protocol fuzz testing.In such fuzz testing,the selection of seeds makes a major contribution to the exploration of paths.However,current stateful protocol fuzz testers often repeatedly execute the same several seeds,resulting in an inability to effectively explore more paths.To alleviate this problem,starting from the gain of seeds,this paper proposed an effective seed dynamic scheduling algorithm based on stateful protocols.The algorithm utilized the potential gain,actual gain,and cost of seeds as the gain,using this gain to dynamically schedule seeds and allocate the number of times seeds.Experiments show that this method significantly improves the number of vulnerabilities found and also has a certain degree of improvement in increasing coverage,indicating that the definition of this gain and the seed scheduling algorithm can effectively select seeds and explore more paths and vulnerabilities.

关 键 词：模糊测试 灰盒 协议测试 漏洞挖掘 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]