一种基于遗传算法的Fuzzing测试用例生成新方法

刘渊, 杨永辉, 张春瑞, 王伟

电子学报 ›› 2017, Vol. 45 ›› Issue (3) : 552-556.

PDF(1528 KB)
PDF(1528 KB)
电子学报 ›› 2017, Vol. 45 ›› Issue (3) : 552-556. DOI: 10.3969/j.issn.0372-2112.2017.03.007
学术论文

一种基于遗传算法的Fuzzing测试用例生成新方法

  • 刘渊, 杨永辉, 张春瑞, 王伟
作者信息 +

A Novel Method for Fuzzing Test Cases Generating Based on Genetic Algorithm

  • LIU Yuan, YANG Yong-hui, ZHANG Chun-rui, WANG Wei
Author information +
文章历史 +

摘要

本文根据传统漏洞挖掘Fuzzing技术的特点,针对其存在的不能求解非线性解和只能有单个的输入的问题,提出了一种基于遗传算法的漏洞挖掘测试用例生成的新方法.该方法能够利用遗传算法的优势,同时可以应对多输入测试用例问题和非线性求解问题.从自测程序的结果看出,相比于传统随机生成Fuzzing测试用例的方法,本方案在效率和覆盖率方面具有明显的提高.

Abstract

Considering the features of the traditional Fuzzing technology,a method is proposed for Fuzzing test case generating in vulnerability exploiting,which is aimed at nonlinear solution and single input problem.This method takes advantage of the genetic algorithm and deals with those two problems mentioned above.The experiment results show that,the proposed solution has an obvious improvement compared with the early method which generates the test cases randomly.

关键词

遗传算法 / 非线性求解 / 多维Fuzzing技术

Key words

genetic algorithm / nonlinearity solution / multidimensional fuzzing technology

引用本文

导出引用
刘渊, 杨永辉, 张春瑞, 王伟. 一种基于遗传算法的Fuzzing测试用例生成新方法[J]. 电子学报, 2017, 45(3): 552-556. https://doi.org/10.3969/j.issn.0372-2112.2017.03.007
LIU Yuan, YANG Yong-hui, ZHANG Chun-rui, WANG Wei. A Novel Method for Fuzzing Test Cases Generating Based on Genetic Algorithm[J]. Acta Electronica Sinica, 2017, 45(3): 552-556. https://doi.org/10.3969/j.issn.0372-2112.2017.03.007
中图分类号: TN311.5   

参考文献

[1] Chen J M,Shu H,Xiong X B.Fuzzing test approach based on symbolic execution[J].Computer Engineering,2009,35(21):33-35.
[2] 万勇兵,徐中伟,梅萌.一种符号化执行的实时系统一致性测试生成方法[J].电子学报,2013,41(11):2276-2284. WAN Yong-bing,XU Zhong-wei,MEI Meng.A symbolic execution method for conformance test generation of real-time system[J].Acta Electronica Sinica,2013,41(11):2276-2284.(in Chinese)
[3] Biyani,Aabha,Sharma,Gantavya,Aghav,Jagannath,et al.Extension of SPIKE for encrypted protocol fuzzing[A].Multimedia Information Networking and Security (MINES),2011 Third International Conference on IEEE[C].Shanghai1:IEEE,2011.343-347.
[4] Bhansali S,Chen W K,Jong S D,et al.Framework for instruction-level tracing and analysis of program executions[A].Proceedings of International Conference on Virtual Execution Environments[C].New York:ACM,2006.154-163.
[5] Song D,Brumley D,Yin H,et al.BitBlaze:A new approach to computer security via binary analysis[A].Proceedings of the 4th International Conference on Information Systems Security2008[C].Berlin,Heidelberg:Springer-Verlag,2008.1-25.
[6] Wang T,Wei T,Gu G,et al.TaintScope:a checksum-aware directed fuzzing tool for automatic software vulnerability detection[A].Security and Privacy (SP),2010 IEEE Symposium on IEEE[C].Washington,DC,USA:IEEE Computer Society,2010.497-512.
[7] Cui B,Liang X,Wang J.The study on integer overflow vulnerability detection in binary executables based upon genetic algorithm[J].Advances in Intelligent & Soft Computing,2011,122:259-266.
[8] Memon A M,Pollack M E,Soffa M L.Hierarchical GUI test case generation using automated planning[J].IEEE Transactions on Software Engineering,2001,27(2):144-155.

基金

中国工程物理研究院科学技术发展基金 (No.2014A0403020); 中国工程物理研究院网络安全与可信软件重点实验室基金 (No.J-2014-KF-01)

PDF(1528 KB)

2311

Accesses

0

Citation

Detail

段落导航
相关文章

/