基于脆弱点特征导向的软件安全测试
Guided software safety testing based on vulnerability characteristics

为克服模糊测试方法具有盲目性和覆盖率不高的缺点，缓解当前符号执行方法所面临的空间爆炸问题，该文提出一种基于脆弱点特征导向的软件安全测试方法。该方法结合模糊测试和符号执行方法的特点，针对缓冲区溢出，精确分析了具备该脆弱点特征的代码，并以此为测试目标，力图提高测试针对性；通过域收敛路径遍历策略生成新测试数据进行测试。实验数据表明：该方法的缓冲区溢出可疑点识别率比现有的以经验为主的识别方法至少提高41%，与CUTE符号执行工具相比，较好地缓解了空间爆炸问题，并有效验证了OpenSSL等常用软件的脆弱点。
Abstract：Fuzzy testing software is random with low coverage while symbolic execution can result in the explosion of the variable space. This paper presents a guided software safety testing method based on vulnerability characteristics that combines fuzzy and symbolic execution. This study analyzed the codes associated with buffer overflow for use as targets to make testing more targeted. Then, new test data was generated using the path traversal patterns of domain convergence. Tests show that the identification rate for potentially vulnerable buffer overflows is at least 41% better than with fuzzy testing, the space size explosion with CUTE greatly reduced with vulnerabilities in common software products such as OpenSSL accurately identified.