一句话：提出 SBDT，首个面向证书解析器的基于搜索的差分测试方法，通过建模、搜索、更新与剪枝模型高效发现解析器缺陷。
证书解析器是 SSL/TLS 实现的关键组件，负责将难懂的证书解析为证书验证器与人类可理解的输入，其正确性直接影响安全决策。论文首次将证书解析器测试与证书验证器测试明确区分开来，并提出 SBDT——一种基于搜索的差分测试方法。SBDT 首先对证书结构、变异操作及其边界进行建模；随后在模型上搜索最有可能触发差异的模型节点与变异算子并据此生成证书，将其喂给多个证书解析器；在对解析器输出做归一化后搜索多类差异，并把发现的差异作为反馈来更新和剪枝模型，若节点与算子未达上界则从中继续下一轮迭代。作者实现了开源原型工具，实验结果表明 SBDT 在发现证书解析器的新缺陷与待改进点上兼具有效性与高效性。
Certificate parsers, which are critical components of Secure Sockets Layer or Transport Layer Security (SSL/TLS) implementations, parse incomprehensible certificates into comprehensible inputs to certificate validators and humans. Thus, certificate parsers profoundly affect decision-makings of validators and humans, which in turn affect security. To guarantee the correctness of certificate parsers, an approach for search-based differential testing of certificate parsers, namely SBDT, is put forward. SBDT begins with modeling certificate structures, mutation operations, and bounds. Based on the initial model, SBDT searches for the most promising model node and mutation operator that trigger discrepancies, and generates a certificate from the node and operator it finds. Then, SBDT feeds the certificate to certificate parsers, and searches for multiple types of discrepancies after normalizing the results output by parsers. Distinct discrepancies are employed as feedback to update and prune the model. SBDT starts the next iteration from the updated and pruned model, unless all nodes and mutation operators have been pruned due to reaching their upper bounds. Our work has the following contributions: (1) To the best of our knowledge, this is the first time that testing of certificate parsers has been clearly distinguished from testing of certificate validators, which will facilitate accurate testing of certificate parsers and validators; (2) SBDT is the first systematic and efficient approach for differential testing of certificate parsers by searching, updating, and pruning models; and (3) We have implemented an open-source prototype tool of SBDT, and experimental results show that SBDT is effective and efficient in finding new bugs and enhancements of certificate parsers.
@inproceedings{ChenRDTLY23,
title = {SBDT: Search-Based Differential Testing of Certificate Parsers in SSL/TLS Implementations},
author = {Chu Chen and Pinghong Ren and Zhenhua Duan and Cong Tian and Xu Lu and Bin Yu},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598110}
}