关键词: 污点分析,符号化,漏洞检测,测试用例,数据跟踪

Abstract: The dynamic taint analysis (DTA for short) technique is usually applied to track information flow and detect security vulnerabilities.It detects the vulnerabilities of program triggered by some test cases dynamically.Though its false positive rate is very low,its false negative rate is very high.Concerning this issue,the dynamic symbolic taint ana-lysis (DSTA for short) is an enhancement to dynamic symbolic analysis,which symbolizes the taint analysis to reduce false negative rate.The technique collects taint information according to taint propagating based on instructs,and makes symbolic risk rule to find some potential vulnerabilities by detecting whether the taint information breaks some risk rules.The experimental results show that this method not only ensures the advantage of DTA’s low false positive rate,but also reduces the disadvantage of DTA’s high false negative rate.The information of vulnerabilities,risks and taint data can be applied to generate test cases,which improves the test efficiency and reduces the redundancy of test case.

Key words: Taint analysis,Symbolic,Vulnerability detecting,Test case,Data tracking