期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

基于控制流序位比对的智能Fuzzing测试方法 被引量：6

Smart Fuzzing method based on comparison algorithm of control flow sequences
下载PDF
导出
摘要 在国际前沿技术EFS(evolutionary fuzzing system)的研究基础上,提出基于控制流序位比对算法的智能Fuzzing测试方法。根据遗传算法的内在属性演算得到基于序列比对的适应度函数,并有效地计算出需要搜索的程序逻辑空间。最后给出了该方法与2种传统Fuzzing方法的测试性能的实验结果比对,证明了该方法能够充分利用遗传算法属性中并行性进行智能地程序逻辑学习,具有逻辑覆盖面广、搜索导向性强的优点,能够提高漏洞挖掘能力。 Flowing the way introduced in the research of evolutionary fuzzing system （EFS）, a smart fuzzing method was proposed based on the node comparison algorithm among the control flow sequences. Through mapping program execu- tion flow sequences onto the control flow sequences, the isomorphism relationship between dada search space and pro- gram logic space was established. The analyzed results prove that the method is capable of mining a mass of information from group data effectively, and is able to fully utilize the parallelism of genetic algorithm to guide the fuzzing test.
作者 王颖 杨义先 钮心忻 谷利泽
机构地区 北京邮电大学信息安全中心
出处 《通信学报》 EI CSCD 北大核心 2013年第4期114-121,共8页 Journal on Communications
基金 国家自然科学基金资助项目(61121061)~~
关键词 智能Fuzzing 控制流 遗传算法 漏洞 smart Fuzzing control flow gene algorithm vulnerability
分类号 TP393.08 [自动化与计算机技术—计算机应用技术]
  • 相关文献

参考文献12

  • 1CHOI Y H, KIM H C, LEE D H. Tag-aware text file testing for security of a software system[A]. Procedings of International Conference on Convergence Information Technology[C]. IEEE Press, 2007.2254-2259.
  • 2LIU Q X, ZHANG Y Q. TFTP vulnerability finding technique based on fuzzing[J]. Computer Communications. Elsevier, 2008. 31(14): 3420-3426.
  • 3姚洪波,尹亮,文伟平.基于FUZZING测试技术的Windows内核安全漏洞挖掘方法研究及应用[J].信息网络安全,2011(12):9-16. 被引量：4
  • 4GODEFROID P, KLARLUND N, SEN K. DART: directed automated random testing[A]. Proce of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation[C]. 2005.40-6.
  • 5FROID P G- EVIN L M Y D, et al. Automated whitebox fuzz test- ing[A]. Procof Network and Distributed Systems Security(NDSS)[C]. 2008. 151-166.
  • 6WANG T L, WEI T, GU G E et al. TaintScope: a Checksum-aware directed fuzzing tool for automatic software vulnerability detection[A] The 31st IEEE Symposium on Security and Privacy[C]. Berkeley, California, USA, 2010.
  • 7DEMOTT J, ENBODY R, PUNCH B. Revolutionizing the field of grey-box attack surface testing with evolutionary Fuzzing[EB/OL]. http://www.b mott, 2012. usa-07/bh-usa-07-speakers.html#De.
  • 8COELLO C A, LAMONT G B, VELDHUIZEN A V. Evolutionary Algorithms for Solving Multi-Objective Problems[M]. New York: Springer-Verlag, 2007.
  • 9SPARKS S, EMBLETON S, et al. Automated vulnerability analysis: leveraging control flow for evolutionary input crafting[A]. Proc of Computer Security Applications Conference[C]. 2007.477-486.
  • 10DALLMEIER V, KNOPP N, MALLON C, et al. Automatically generating test cases for specification mining[J]. IEEE Transactions on Software Engineering, 2012.38(2):243-257.

二级参考文献3

  • 1Ben Nagy. Generic Anti Exploitation Technology for Windows[EB/ OL]. http://download.csdn.net/detail/TO_YGY/334441, 2008 01 14/2011-11-11.
  • 2Haroon Meer. The Complete History of Memory Corruption Attacks[C]. BlackHat Confidence USA, 2010.
  • 3David Litchfield. Buffer Underruns, DEP, ASLR and improving the Exploita6on Prevention Mechanisms (XPMs) on the Windows platfonn[EB/ ol]..http://wenku.baidu.com/view/eb293e4d2b160b4e767fcf72.html, 2005-09-30/2011-11-11.

共引文献3

同被引文献80

  • 1张宝峰,张翀斌,许源.基于模糊测试的网络协议漏洞挖掘[J].清华大学学报（自然科学版）,2009(S2):2113-2118. 被引量：14
  • 2中国信息安全测评中心. 中国国家信息安全漏洞库[EB/OL]. http:// www.cnnvd.org.cn/, 2014-05-10.
  • 3Cadar C, Godeffoid P, et al. Symbolic execution for software testing in practice: preliminary assessment [ A ]. Proceedings of the 2011 33rd International Conference on Software Engineer- ing[C] .New York:ACM,2011. 1066 - 1071.
  • 4Jim Chow, Ben Pfaff, et al. Understanding data lifetime via whole system simulation[ A ]. Proceedings of the 13th confer- ence on USENIX Security Symposium [ C ]. California: USENIX Association Berkeley, 2004.22 - 22.
  • 5James Clause, Wanchun Li, Alessandro Orso. Dytan: a generic dynamic taint analysis framework[ A]. Proceedings of the 2007 international symposium on Software testing and analysis[ C ]. New York:ACM,2007. 196 - 206.
  • 6Patrice Godefroid, Michael Levin, and David Molnar. Automat- ed whitebox fuzz tesling[ A]. Proceedings of the Network and Distributed System Security Symposium[ C]. California: Intemet Society,2008.151 - 166.
  • 7Papadakis M, Malevris N. Automatic mutation test case genera- tion via dynamic symbolic execution [ A ]. Proceedings of the 21st International Symposium on Software Reliability Engineer- ing[ C]. Washington: 1EEE Computer Society,2010.121 - 130.
  • 8Rawat S, Mounier L. Offset-aware mutation based fuzzing for buffer overflow vulnerabilities: few preliminary results [ A ]. Proceeedings of the Fourth International Conference on Soft- ware Testing, Verification and Validation Workshops [ C ]. Washington: IEEE Computer Society,2011.531 - 533.
  • 9Ganesh V, Leek T, Rinard M. Taint-based directed whitebox fuzzing[ A]. Proceedings of the IEEE 31st International Con- ference on Software Engineering[ C ]. Washington: IEEE Com- puter Society,2009.474 - 484.
  • 10Tielei Wang, Tao Wei, Guofei Gu, Wei Zou. Checksum-aware fuzzing combined with dynamic taint analysis and symbolic ex- ecution[J] .ACM Transactions on Information and System Se- curity,2011,14(2) ; 1 - 28.

引证文献6

二级引证文献39

通信学报
2013年 第4期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部