一句话:提出结合模糊测试与符号执行的复杂度分析工具 Badger,发现最坏情况时间/空间复杂度异常脆弱点。
论文针对软件中平均情况与最坏情况复杂度差异所引发的潜在漏洞,提出 Badger——一种面向复杂度分析的混合测试方法。已有结合模糊测试与符号执行的混合测试在提升代码覆盖率、发现细微错误与漏洞方面表现良好,Badger 将这一思路扩展至时间/空间复杂度分析,旨在发现当最坏情况复杂度显著高于平均情况时才暴露的脆弱性。摘要主要介绍方法的动机与总体设计,未给出具体实现细节、实验设置或量化结果。
Hybrid testing approaches that involve fuzz testing and symbolic execution have shown promising results in achieving high code coverage, uncovering subtle errors and vulnerabilities in a variety of software applications. In this paper we describe Badger - a new hybrid approach for complexity analysis, with the goal of discovering vulnerabilities which occur when the worst-case time or space complexity of an application is significantly higher than the average case.