Efficient file fuzz testing using automated analysis of binary file format
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Kim, Hyoung Chun | - |
dc.contributor.author | Choi, Young Han | - |
dc.contributor.author | Lee, Dong Hoon | - |
dc.date.accessioned | 2021-09-07T14:38:14Z | - |
dc.date.available | 2021-09-07T14:38:14Z | - |
dc.date.created | 2021-06-14 | - |
dc.date.issued | 2011-03 | - |
dc.identifier.issn | 1383-7621 | - |
dc.identifier.uri | https://scholar.korea.ac.kr/handle/2021.sw.korea/112965 | - |
dc.description.abstract | Fuzz testing is regarded as the most useful technique in finding serious security holes in a software system. It inserts unexpected data into the input of the software system and finds the system's bugs or errors. However, one of the disadvantages that fuzz testing executed using binary files has is that it requires a large number of fault-inserted files to cover every test case, which could be up to 2(8xFILESIZE) files. In order to overcome this drawback, we propose a novel algorithm that efficiently reduces the number of fault-inserted files, yet still maintain the maximum test case coverage. The proposed approach enables the automatic analysis of fields of binary files by tracking and analyzing stack frames, assembly codes, and registers as the software system parses the files. We evaluate the efficacy of the new method by implementing a practical tool, the Binary File Analyzer and Fault Injector (BFAFI), which traces the program execution and analyzes the fields in binary file format Our experiments demonstrate that the BFAFI reduced the total number of fault-inserted files with maximum test case coverage as well as detected approximately 14 times more exceptions than did the general fuzzer. Also, the BFAFI found 11 causes of exceptions; five of them were found only by BFAFI. Ten of the 11 causes of exceptions that we found were generated by a graphic rendering engine (GDI32.d11): the other was generated by the system library (kerne132.d11.) in Windows XP SP2. (C) 2010 Elsevier B.V. All rights reserved. | - |
dc.language | English | - |
dc.language.iso | en | - |
dc.publisher | ELSEVIER | - |
dc.title | Efficient file fuzz testing using automated analysis of binary file format | - |
dc.type | Article | - |
dc.contributor.affiliatedAuthor | Lee, Dong Hoon | - |
dc.identifier.doi | 10.1016/j.sysarc.2010.03.002 | - |
dc.identifier.scopusid | 2-s2.0-79952575071 | - |
dc.identifier.wosid | 000289705000004 | - |
dc.identifier.bibliographicCitation | JOURNAL OF SYSTEMS ARCHITECTURE, v.57, no.3, pp.259 - 268 | - |
dc.relation.isPartOf | JOURNAL OF SYSTEMS ARCHITECTURE | - |
dc.citation.title | JOURNAL OF SYSTEMS ARCHITECTURE | - |
dc.citation.volume | 57 | - |
dc.citation.number | 3 | - |
dc.citation.startPage | 259 | - |
dc.citation.endPage | 268 | - |
dc.type.rims | ART | - |
dc.type.docType | Article | - |
dc.description.journalClass | 1 | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Hardware & Architecture | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Software Engineering | - |
dc.subject.keywordAuthor | Software testing | - |
dc.subject.keywordAuthor | Fuzzing | - |
dc.subject.keywordAuthor | Security testing | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(02841) 서울특별시 성북구 안암로 14502-3290-1114
COPYRIGHT © 2021 Korea University. All Rights Reserved.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.