一句话：通过提取目标程序特征向量并匹配模糊测试算法相似度，为不同程序推荐更合适的模糊测试方法。
模糊测试能通过非预期输入发现漏洞，但现有方法各有优劣，难以适应所有目标程序，因此为特定程序挑选合适的模糊测试方法十分关键。本文首先对目标程序进行分析，提取语法、上下文等特征向量，刻画程序信息；进而构建匹配模型，计算目标程序与候选模糊测试算法的相似度，从而选出匹配度更高的算法。评估表明，该推荐方式能提升检测效率、精确率、召回率与 F-measure 等统计指标。
Fuzzing is a technique that aims to detect vulnerabilities or exceptions through unexpected input and has found tremendous recent interest in both academia and industry. Although these fuzzing methods have great advantages in the field of vulnerability detection, they also have their own disadvantages in the face of different target programs. It is obviously impractical for a fuzzing test method to adapt to all the target programs. Therefore, we study how to select the appropriate fuzzing methods for different target programs. Specifically, we first analyze the program, and then extract the feature vectors of the target program to get the information of the program, such as syntax, context and so on. Next, we build a matching model to match the similarity of target program and the fuzzing algorithm to select the fuzzing algorithm with higher matching degree. Through our matching model, we get a more suitable fuzzing algorithm to improve the detection efficiency, precision, recall, F-measure, and other statistical measures.
DOI 原文 ·
@inproceedings{paperbot6569,
title = {Fuzzing Methods Recommendation Based on Feature Vectors},
author = {Chi Zhang and Jinfu Chen},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678630}
}