《计算机应用研究》|Application Research of Computers

动态资源感知的并行化模糊测试框架

Dynamic resource awareness framework for parallel fuzzing

免费全文下载 (已被下载 次)  
获取PDF全文
作者 廉美,邹燕燕,霍玮,邹维
机构 1.中国科学院信息工程研究所 网络安全防护技术北京市重点实验室,北京 100093;2.中国科学院大学,北京 100049
统计 摘要被查看 次,已被下载
文章编号 1001-3695(2017)01-0052-06
DOI 10.3969/j.issn.1001-3695.2017.01.010
摘要 针对现有的并行模糊测试在测试效率、资源利用率以及异常处理上的局限性,围绕测试资源的生成、使用及容错三个方面提出了一种动态资源感知的系统化解决方案。针对测试环境在大规模和多场景两个维度快速搭建的需求,提出一种基于云平台的动态构建方法,加快测试环境部署,提高有效fuzz时间;针对并行模糊测试中资源利用率低的问题,提出一种多层次并行度动态调整的资源配置策略,优化整体测试资源配置并提高单机负载;针对大规模并行测试中节点易发生故障的问题,提出基于优先级调度的容错处理方法。最后,设计并实现了一个基于四级流水线并行处理结构的通用模糊测试框架。实验证明,该框架能够有效提高并行模糊测试的测试效率和资源利用率,实现系统的有效容错。
关键词 漏洞挖掘;并行模糊测试;资源感知;测试框架;云平台
基金项目 国家“863”计划资助项目(2015AA017202)
本文URL http://www.arocmag.com/article/01-2017-01-010.html
英文标题 Dynamic resource awareness framework for parallel fuzzing
作者英文名 Lian Mei, Zou Yanyan, Huo Wei, Zou Wei
机构英文名 1.BeijingKeyLaboratoryofNetworkSecurity&ProctectionTechnology,InstituteofInformationEngineering,ChineseAcademyofSciences,Beijing100093,China;2.UniversityofChineseAcademyofSciences,Beijing100049,China
英文摘要 It is not trivial to apply current parallel fuzzing techniques on large scale cluster directly, due to its limitation on testing efficiency, resource usage and system fault tolerance.This paper proposed a dynamic resource-aware approach, which could systematically tackle the problem from the generation, the usage and the fault tolerance of testing resources.To building the large scale testing cluster quickly, it described a cloud-based dynamic building approach to reduce the generation time.For the low utilization problem of testing resources, it proposed a multi-level dynamic scheduling police to improve the overall recourse usage and the single node workload.In order to make test continually, it proposed a priority-based fault tolerant method.Finally, it finished a general parallel fuzzing framework, which based on a four-stage pipeline structure.The experiment shows that the framework is very effective in respect to the parallel efficiency, resource usage, and fault tolerance.
英文关键词 vulnerability; parallel fuzzing test; resource awareness; testing framework; cloud infrastructure
参考文献 查看稿件参考文献
  [1] Sutton M, Greene A. Fuzzing:brute force vulnerability discovery[M] . [S. l. ] :Addison-Wesley Educational Publishers, 2007.
[2] 吴志勇, 王红川, 孙乐昌, 等. Fuzzing技术综述[J] . 计算机应用研究, 2010, 27(3):829-832.
[3] 吴世忠, 郭涛, 张普含, 等. 基于路径簇规约的并行符号执行方法:中国, 201210542210[P] . 2013-04-17.
[4] Wu Bo, Li Mengjun, Zhang Bin, et al. Distributed symbolic execution for binary software testing[C] //Proc of IEEE Workshop on Electronics, Computer and Applications. [S. l. ] :IEEE Press, 2014:618-621.
[5] 余啸. 基于动态符号执行的并行化测试数据自动生成[D] . 上海:华东师范大学, 2011.
[6] 曹琰. 面向软件脆弱性分析的并行符号执行技术研究[D] . 郑州:解放军信息工程大学, 2013.
[7] Boyapati C, Khurshid S, Marinov D. Korat:automated testing based on Java predicates[C] //Proo of ACM International Symposium on Software Testing and Analysis. 2002:123-133.
[8] Misailovic S, Milicevic A, Petrovic N, et al. Parallel test generation and execution with Korat[C] //Proc of the 6th Joint Meeting of the European Software Engineering Conference and ACM SIGSOFT Symposium on the Foundations of Software Engineering. New York:ACM Press, 2007:135-144.
[9] Siddiqui J H, Khurshid S. PKorat. parallel generation of structurally complex test inputs[C] //Proc of International Conference on Software Testing Verification and Validation. [S. l. ] :IEEE Press, 2009:250-259.
[10] 梁洪亮, 阳晓宇, 董钰, 等. 并行化智能模糊测试[J] . 清华大学学报:自然科学版, 2014, 21(3):14-19.
[11] 王连赢. 文件触发类二进制程序漏洞挖掘技术研究[D] . 北京:北京邮电大学, 2015.
[12] Godefroid P, Levin M, Molnar D. SAGE:whitebox fuzzing for security testing[J] . Communications of the ACM, 2012, 55(3):40-44.
[13] Bounimova E, Godefoid P, Molnar D. Billions and billions of constraints:whitebox fuzz testing in production[C] //Proc of International Conference on Software Engineering. [S. l. ] :IEEE Press, 2013:122-131.
[14] Bucur S, Ureche V, Zamfir C, et al. Parallel symbolic execution for automated real-world software testing[C] // Proc of the 6th conference on Computer Systems. New York:ACM Press, 2011:183-198.
[15] Ciortea L, Zamfir C, Bucur S, et al. Cloud9:a software testing service[C] //Proc of ACM SIGOPS Operating Systems Review. New York:ACM Press, 2010:5-10.
[16] Sulley:pure python fully automated and unattended fuzzing framework[EB/OL] . (2014-03-16)[2015-11-28] . http://code. google. com/p/sulley/.
[17] Peach[EB/OL] . ( 2014-02-23)[2015-11-28] . http://community. peachfuzzer. com/.
[18] Fuzzing for Security[EB/OL] . (2012-04-26)[2015-11-28] . http://blog. chromium. org/2012/04/fuzzing-for-security. html.
[19] Defensics 3. 0[EB/OL] . (2015-05-20)[2015-11-28] . http://www. codenomicon. com/products/defensics/.
[20] Peach fuzzer for enterprise[EB/OL] . (2014-05-23)[2015-11-28] . http://www. dejavusecurity. com. s3-website-us-east-1. amazonaws. com/files/Peach%20Enterpise%20Fuzzer%20-%20Deja%20Vu Security. pdf.
[21] Xie Yan. Using grid computing for large scale fuzzing[D] . Lisbon:Universidade Nova de Lisboa, 2010.
[22] King J C. A new approach to program testing[C] //Proc of International Conference on Reliable Software. New York:ACM Press, 1975:228-233.
[23] Chipounov V, Kuznetsov V, Candea G. The S2E platform:design, implementation, and applications[J] . ACM Trans on Computer Systems, 2012, 30(1):1-49.
[24] KVM[EB/OL] . (2014-01-22)[2015-11-28] . http://www. linux-kvm. org/page/Main_Page.
[25] Qcow2[EB/OL] . (2013-10-09)[2015-11-28] . http://www. linux-kvm. org/page/Qcow2.
[26] FIFO and LIFO accounting[EB/OL] . (2011-09-25)[2015-11-28] . http://en. wikipedia. org/wiki/FIFO_and_LIFO_accounting.
[27] Hash function[EB/OL] . (2015-02-12)[2015-11-28] . https://en. wikipedia. org/wiki/Hash_function.
收稿日期 2015/12/9
修回日期 2016/2/19
页码 52-57
中图分类号 TP302.7
文献标志码 A