black-box testing based on colorful taint analysis
文献类型：期刊论文
| 作者 | Chen Kai ; Feng DengGuo ; Su PuRui ; Zhang YingJun |
| 刊名 | SCIENCE CHINA-INFORMATION SCIENCES
 |
| 出版日期 | 2012 |
| 卷号 | 55期号:1页码:171-183 |
| 关键词 | software testing vulnerability detection dynamic testing black-box testing colorful taint analysis |
| ISSN号 | 1674-733X |
| 中文摘要 | Software vulnerability detection is one of the most important methods for guaranteeing software security. Two main classes of methods can detect vulnerabilities in binary files: white-box testing and black-box testing. The former needs to construct and solve path constraints to detect vulnerabilities. It has two main drawbacks: path exploding and complexity of constraints. The latter often aimlessly exhausts various inputs to test binary files. This paper combines both testing methods to detect vulnerabilities in binary files. By analyzing the input elements that affect check condition corresponding to a certain check point, we can generate one class of inputs that get to the check point to increase fuzzing efficiency. By analyzing the relationship between guard conditions and check condition, the redundant check points are removed. Colorful taint analysis method (CTAM) is proposed to compute guard conditions, which is more efficient than traditional taint analysis method (TTAM). We implemented a prototype and made several experiments on it. The results showed that our method could increase the efficiency of black-box testing. |
| 英文摘要 | Software vulnerability detection is one of the most important methods for guaranteeing software security. Two main classes of methods can detect vulnerabilities in binary files: white-box testing and black-box testing. The former needs to construct and solve path constraints to detect vulnerabilities. It has two main drawbacks: path exploding and complexity of constraints. The latter often aimlessly exhausts various inputs to test binary files. This paper combines both testing methods to detect vulnerabilities in binary files. By analyzing the input elements that affect check condition corresponding to a certain check point, we can generate one class of inputs that get to the check point to increase fuzzing efficiency. By analyzing the relationship between guard conditions and check condition, the redundant check points are removed. Colorful taint analysis method (CTAM) is proposed to compute guard conditions, which is more efficient than traditional taint analysis method (TTAM). We implemented a prototype and made several experiments on it. The results showed that our method could increase the efficiency of black-box testing. |
| 学科主题 | Computer Science |
| 收录类别 | SCI |
| 资助信息 | National Natural Science Foundation of China 60970028, 60703076, 61073179 |
| 语种 | 英语 |
| WOS记录号 | WOS:000298651900020 |
| 公开日期 | 2013-09-17 |
| 源URL | [http://ir.iscas.ac.cn/handle/311060/15095]  |
| 专题 | 软件研究所_软件所图书馆_期刊论文 |
| 推荐引用方式 GB/T 7714 | Chen Kai,Feng DengGuo,Su PuRui,et al. black-box testing based on colorful taint analysis[J]. SCIENCE CHINA-INFORMATION SCIENCES,2012,55(1):171-183. |
| APA | Chen Kai,Feng DengGuo,Su PuRui,&Zhang YingJun.(2012).black-box testing based on colorful taint analysis.SCIENCE CHINA-INFORMATION SCIENCES,55(1),171-183. |
| MLA | Chen Kai,et al."black-box testing based on colorful taint analysis".SCIENCE CHINA-INFORMATION SCIENCES 55.1(2012):171-183. |
入库方式： OAI收割
来源：软件研究所
浏览0
下载0
收藏0
其他版本
除非特别说明，本系统中所有内容都受版权保护，并保留所有权利。