基于多维Fuzzing的缓冲区溢出漏洞挖掘技术研究

Research for buffer overflow vulnerabilities based on multi-dimensional Fuzzing technology

缓冲区溢出漏洞一直是计算机安全威胁中最为严重的漏洞之一,在黑客发现利用前检测出漏洞并及时修复极为重要;基于多维Fuzzing设计和实现了一种缓冲区溢出漏洞挖掘模型MFBOF,应用输入样本结构知识、结合静态二进制分析技术和动态输入/输出测试技术,运用自适应模拟退火遗传算法生成测试用例进行测试,并以挖掘Libpng的漏洞为实例说明了该模型的有效性;最后,提出了模型需要优化的地方和下一步研究方向。

Buffer overflow（BOF） is always one of the most dangerous vulnerabilities to computer security.This paper proposed multi-dimentional Fuzzing of buffer overflow（MFBOF）,which was based on multi-dimentional Fuzzing technology,combined the structure knowledge of target＇s input,static binary code analysis and dynamic I/O analysis technique,generated test cases using adaptive simulated annealing genetic algorithm.The results of testing Libpng validate that MFBOF is effective.At last,this paper gave its further improvement directions.