Protocol Fuzz Testing Based on Double Coverage Information Coordination
CSTR:
Author:
Affiliation:

Clc Number:

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    Fuzzing plays a significant role in discovering security vulnerabilities and improving security in protocol software. In recent years, the introduction of the state into server program fuzzing has received widespread attention. This study addresses the problem of low efficiency of fuzzing due to the insufficient utilization of information in the protocol fuzzing process and the inability to continuously focus on key states. The study also proposes a protocol fuzzing method based on the cooperation of double cover information. Firstly, the state selection algorithm proposed in this study sets weights for each state by mapping the state space to the program space and using heuristic calculation methods to guide the fuzzing to continuously focus on states that are more likely to have defects. Secondly, the study detects a seed position that will not affect the state but can change the program coverage and restricts the mutation position to adequately test the code area corresponding to the focus state. The study also verifies the effectiveness of the improved algorithm on the baseline tools AFLNet and SnapFuzz and integrates them into a protocol fuzzing tool, namely C2SFuzz. Experiments are carried out on the latest version of protocol server programs such as LightFTP and Live555, and five unknown vulnerabilities are detected.

    Reference
    Related
    Cited by
Get Citation

张颖君,周赓,程亮,孙晓山,张阳.基于双重覆盖信息协同的协议模糊测试.计算机系统应用,2023,32(9):32-42

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:February 17,2023
  • Revised:March 14,2023
  • Adopted:
  • Online: July 21,2023
  • Published:
Article QR Code
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-3
Address:4# South Fourth Street, Zhongguancun,Haidian, Beijing,Postal Code:100190
Phone:010-62661041 Fax: Email:csa (a) iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063