一句话：FinFuzzer 将相关环境设置转换为系统输入并优先变异高优先级对象字段，提升金融科技系统模糊测试覆盖率。
金融科技系统风险高，全面测试对保障可靠性至关重要。本文基于蚂蚁集团金融服务的测试现状，观察到在自动化模糊测试中，正确转换外部环境设置与合理确定输入对象字段的变异优先级十分关键。据此提出 FinFuzzer：一个自动模糊测试框架，能够检测相关环境设置并将其转换为系统输入，对输入对象字段进行优先级排序，并同时在环境设置和高优先级对象字段上变异系统输入。作者在蚂蚁集团开发的四个金融科技系统上评估 FinFuzzer，结果表明相较于当前最先进方法，FinFuzzer 能在更短时间内取得更高的行覆盖率。
Comprehensive testing is of high importance to ensure the reliability of software systems, especially for systems with high stakes such as FinTech systems. In this paper, we share our observations of the Ant Group’s status quo in testing their financial services, specifically on the importance of properly transforming relevant external environment settings and prioritizing input object fields for mutation during automated fuzzing. Based on these observations, we propose FinFuzzer, an automated fuzz testing framework that detects and transforms relevant environmental settings into system inputs, prioritizes input object fields, and mutates system inputs on both environment settings and high-priority object fields. Our evaluation of FinFuzzer against four FinTech systems developed by the Ant Group shows that FinFuzzer can outperform a state-of-the-art approach in terms of line coverage in much shorter time.
DOI 原文 ·
@inproceedings{paperbot6640,
title = {FinFuzzer: One Step Further in Fuzzing Fintech Systems},
author = {Qingshun Wang and Lihua Xu and Jun Xiao and Qi Guo and Haotian Zhang and Liang Dou and Liang He and Tao Xie},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678675}
}