Gray-box Fuzzing for Java Web with Parse Tree
CSTR:
Author:
Affiliation:

Clc Number:

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    Due to the complexity of the Java Web application business scenario and the high requirement for the structural validity of the input data, the existing test methods and tools have the problems of low efficiency of test cases when testing Java Web. To solve the above problems, this study presents a gray-box fuzzing method for Java Web applications based on parse trees. First, the study models the syntax of the input packets of Java Web applications, creates a parse tree, distinguishes between delimiters and data blocks, and hooks up a seed pool for each leaf node in the parse tree. In addition, the study isolates the single data block of the test case and generates the input in line with the Java Web application business format by packet splicing, so as to improve the efficiency of test cases. In addition, in order to retain high-quality data blocks, each data block seed is assigned a separate weight during the test according to the execution feedback information of the test program. In order to break through the deep path, the seed features of data blocks are extracted based on conditional probability learning in the corresponding seed pool. This study implements a gray-box fuzzing test system for Java Web applications based on parse trees, namely PTreeFuzz, and the test results show that the system achieves better test accuracy compared with existing tools.

    Reference
    Related
    Cited by
Get Citation

王鹃,张志杰,杨鸿远.基于解析树的Java Web灰盒模糊测试.计算机系统应用,2023,32(9):67-76

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:February 21,2023
  • Revised:March 22,2023
  • Adopted:
  • Online: July 17,2023
  • Published:
Article QR Code
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-3
Address:4# South Fourth Street, Zhongguancun,Haidian, Beijing,Postal Code:100190
Phone:010-62661041 Fax: Email:csa (a) iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063