【摘要】 为解决软件生产过程中存在的测试时间过长而导致成本急剧增长的问题,针对基于动静结合的Fuzzing方法中存在的缺陷,提出了基于控制依赖路径覆盖的Fuzzing模型。在该模型中,动态测试目标为静态分析提取的脆弱性语句。设计了一种基于两层相似度的适应度函数来指导遗传算法搜索覆盖控制依赖路径的测试用例,并在该测试用例基础上生成Fuzzing测试用例来验证脆弱性语句中的脆弱性,排除误报的脆弱性语句。该模型将有限的测试资源放在最可能出现漏洞的代码上,从而达到在增强Fuzzing方向性并保持高度自动化的同时提高测试效率的目的。更多还原

【Abstract】 To solve the problem that the cost increasing too fast due to the increase of testing time in software production,a fuz-zing model based on control dependence path coverage is proposed.In this model,vulnerable statements are extracted by using static analysis,and a fitness function based on two level similarity is designed to lead genetic algorithm to search test case which covers the control dependence path.For removing false positive vulnerable statement,Fuzzing test cases are generated based on the test case searched to validate the vulnerability in the vulnerable statement.By using the limited testing resources on the codes which most likely contain vulnerability,the model can avoid the blindness of Fuzzing and improve the efficiency of Fuzzing.更多还原