【摘要】 针对工控系统中C语言程序因缺乏统一异常处理机制导致的异常处理漏洞检测难题,文章提出一种面向工控系统的C语言异常处理路径定向模糊测试方法。该方法通过异常测试条件建模与异常处理漏洞检测两个阶段协同工作,提升异常处理相关漏洞的检测能力。在异常测试条件建模阶段,设计软件异常事件导入算法,采用动静结合的间接调用关系分析与异常注入技术,生成异常状态可控的待测试程序；在异常处理漏洞检测阶段,构建多目标定向模糊测试框架MEFuzz,通过运行前多目标规划与运行时多目标早停算法,动态调节测试资源分配,提高多上下文异常处理路径的探索效率。基于UniBench数据集的实验结果表明,该方法在静态检测准确率（22.22%）与模糊测试漏洞触发总数（294个）上均优于现有工具,改善因子达1.26,能有效提升工控系统C语言程序异常处理路径相关漏洞的检测效果。更多还原

【Abstract】 Aiming at the difficulty in detecting exception handling vulnerabilities in C language programs of industrial control systems due to the lack of a unified exception handling mechanism, this paper proposed a directed fuzz testing method for C language exception handling paths in industrial control systems. The method improved the detection capability of exception handling-related vulnerabilities through the collaborative work of two stages: exception test condition modeling and exception handling vulnerability detection. In the exception test condition modeling stage, a software exception event import algorithm was designed, which combined dynamic-static indirect call relationship analysis and exception injection technology to generate test programs with controllable exception states. In the exception handling vulnerability detection stage, a multi-objective directed fuzz testing framework MEFuzz was constructed, which dynamically adjusted test resource allocation through pre-run multi-objective planning and runtime multi-objective early stopping algorithms to improve the exploration efficiency of multi-context exception handling paths. Experiments based on the UniBench dataset show that this method outperforms existing tools in static detection accuracy(22.22%) and the total number of fuzz testing vulnerability triggers(294), with an improvement factor of 1.26, effectively enhancing the detection effect of vulnerabilities related to exception handling paths in C language programs of industrial control systems.更多还原