摘要
为了提高漏洞挖掘效率,在软件体系结构的基础上,结合符号执行、污点分析和模糊测试中的优点,设计并实现了基于软件体系结构分析的漏洞挖掘系统Fast Fuzzing。该系统主要由体系结构分析、指令追踪、符号执行、污点分析和动态测试五个模块组成,为提高系统效率,系统针对传统技术方法进行了优化处理。实验结果表明Fast Fuzzing系统能够有效发现IE8和IE10中的安全问题,成功触发了IE8和IE10中的多个漏洞,适用于常用软件的安全测试。
To improve the efficiency of vulnerability mining,the vulnerability mining system Fast Fuzzing based on software architecture analysis was designed and implemented in combination with the advantages of symbolic execution,stain analysis and fuzzing test. This system is composed of architecture analysis,instruction tracing,symbolic execution,stain analysis and dynamic testing. To improve the system efficiency,the traditional technology method was optimized. The experimental results show that the Fast Fuzzing system can effectively detect the security problems in IE8 and IE10,successfully trigger multiple vulnerabilities in IE8 and IE10,which is suitable for the safety testing of common software.
出处
《现代电子技术》
北大核心
2016年第9期99-102,共4页
Modern Electronics Technique
关键词
模糊测试
体系结构分析
漏洞挖掘
安全漏洞
fuzzing test
architecture analysis
vulnerability mining
security vulnerability
