自动化白盒模糊测试技术研究

计算机科学 ›› 2014, Vol. 41 ›› Issue (2): 7-10.

自动化白盒模糊测试技术研究

张亚军,李舟军,廖湘科,蒋瑞成,李海峰

北京航空航天大学计算机学院北京100191;北京航空航天大学计算机学院北京100191;国防科学技术大学计算机学院长沙410073;95934部队河北061036;95934部队河北061036

出版日期:2018-11-14 发布日期:2018-11-14
基金资助:
本文受国家自然科学基金(61170189,5,90718017),教育部博士点基金(20111102130003)资助

Survey of Automated Whitebox Fuzz Testing

ZHANG Ya-jun,LI Zhou-jun,LIAO Xiang-ke,JIANG Rui-cheng and LI Hai-feng

Online:2018-11-14 Published:2018-11-14

摘要/Abstract

摘要： 软件的安全性分析和漏洞检测是软件工程和信息安全领域的一个研究热点和难点问题。采用程序分析的方法对软件进行安全性测试,日益受到广泛的关注和重视。首先概述了有关软件安全性测试的基本概念；随后,详细介绍了3种基于程序分析的安全性测试方法:模糊测试、符号执行和自动化白盒模糊测试,并比较了这3种方法的优缺点；最后,给出了自动化白盒模糊测试的分布式模型。

关键词: 模糊测试,符号执行,自动化白盒模糊测试,自动化白盒模糊测试分布式模型中图法分类号TP301文献标识码A

Abstract: Software security analysis and vulnerability testing are one of the researching focus and difficulty in the software engineering．People think highly of the software security testing using program analysis．This paper began with an overview of the concepts of the software security testing,then detailed the popular methods of program analysis in softwared security testing:fuzz testing,symbolic execution and automated whitebox fuzz test and compared them to each other,finally gave an overview of the automated whitebox fuzz testing distributed system.

Key words: Fuzz testing,Symbolic execution,Automated whitebox fuzz test,Automated whitebox fuzz testing distributed system

张亚军,李舟军,廖湘科,蒋瑞成,李海峰. 自动化白盒模糊测试技术研究[J]. 计算机科学, 2014, 41(2): 7-10. https://doi.org/

ZHANG Ya-jun,LI Zhou-jun,LIAO Xiang-ke,JIANG Rui-cheng and LI Hai-feng. Survey of Automated Whitebox Fuzz Testing[J]. Computer Science, 2014, 41(2): 7-10. https://doi.org/

参考文献

[1] The economic impacts of inadequate infrastructure for software testing[R]．National Institute of Standards and Technology,Planning Report 02-3．May 2002
[2] Takanen A,DeMott J,Miller C．Fuzzing for Softwair SecurityTesting and Quality Assurance[M].USA:Aatech House Inc.,2008:22-32
[3] Duran J,Ntafos S．An Evaluation of Random Testing[J]．IEEETransactions on Software Engineering,1984,SE-10(4):438-444
[4] Peach．http://peachfuzzer.com/
[5] King J C．Symbolic Execution and Program Testing[J].Journalof the ACM,1976,19(7):385-394
[6] Boyer R S,Elspas B,Levitt K N．SELECT-A formal system for testing and debugging programs by symbolic execution[C]∥Proc．1975Int．Conf．Reliable Software．IEEE Computer Society,Long Beach,CA,1975:234-245
[7] Howedn W E．Symbolic Testing and the DISSECT Symbolic Evaluation Systerm[J]．IEEE Transactions on Software Engineering,1977,7(4):266-278
[8] Howedn W E．DISSECT-A Symbolic Evaluation and ProgramTesting System[J]．IEEE Transactions on Software Enginee-ring,1978,1(4):70-73
[9] Cadar C,Dunbar D,Engler D．KLEE:Unassisted and automatic generation of high-coverage tests for complex systems programs[C]∥OSDI’08．Dec.2008
[10] Cadar C,Ganesh V,Pawlowski P,et al.EXE:Automaticallygenerating inputs of death[C]∥Proceedings of the 13th ACM Conference on Computer and Communications Security (CCS 2006)．2006
[11] Bush W R,Pincus J D,Sielaff D J．A static analyzer for finding dynamic programming errors[J]．Software-Practice and Experience,2000,30(7):775-802
[12] Wang T,Wei T,Zou W．IntScope:Automatically Detecting Integer Overflow Vulnerability in X86Binary Using Symbolic Execution [C]∥Network and Distributed System Security Symposium．USA:Internet Society,2009
[13] Godefroid P,Levin M,Molnar D．Automated whitebox fuzz testing[C]∥NDSS．2008
[14] Hamadi Y．Disolver:A Distributed Constraint Solver[R]．Technical Report MSR-TR-2003-91．Microsoft Research,December 2003
[15] Ganesh V,Dill D．A Decision Procedure for Bit-vectors and Arrays [M]．Computer Aided Verification．Berlin:Springer-verlag,2007:524-536
[16] Moura L,Bjorer N．Z3:An Efficient SMT solver．Tools and Algorithms for the Construction and Analysis of Systems[M]．Berlin:Springer-Verlag,2008:337-340
[17] Godefroid P,Klarlund N,Sen K．DART:Directed AutomatedRandom Testing[C]∥Proceedings of PLDI'2005(ACM SIGPLAN 2005Conference on Programming Language Design and Implementation)．Chicago,June 2005:213-223
[18] Sen K,Marinov D,Agha G．CUTE:A Concolic Unit Testing Engine for C[C]∥European Software Engineering Conference and ACM Symposium on the Foundations of Software Engineering．USA:ACM Press,2005:263-272
[19] Godefroid P．Compositional Dynamic Test Generation[C]∥Proceedings of POPL’2007(34th ACM Symposium on Principles of Programming Languages)． Nice,January 2007:47-54
[20] Molnar D,Wagner D．Catchconv:Symbolic Execution and Run-time Type Inference for Integer Conversion Errors[R]．USA:Unversity of California Berkeley,2007
[21] Fuzzgrind．http://esec-lab.sogeti.com/pages/Fuzzgrind

Metrics

Viewed

Full text

Abstract

Cited

Shared

Discussed