We use cookies to improve your experience with our site.

DeltaFuzz:历史版本信息制导的模糊测试

DeltaFuzz: Historical Version Information Guided Fuzz Testing

  • 摘要: 1、研究背景(Context)
    随着敏捷开发等新型软件开发过程的被广泛应用,软件更新迭代得更为频繁。为保证软件质量,通常需要在新版本发布前进行回归测试。但是,人工设计有针对性的回归测试用例开销较大。模糊测试是一种自动生成测试用例的技术,它可以驱动被测程序执行测试用例,并监测被测程序运行情况。现有的模糊测试技术通常以高覆盖率为目标,而在回归测试过程中应重点关注新版本程序中被修改和影响到的位置,因此模糊测试技术难以直接应用于回归测试。
    2、目的(Objective)
    由于人工设计回归测试用例开销较大、覆盖率制导的模糊测试难以直接用于回归测试的原因,本文提出了历史版本信息制导的模糊测试方法。该方法通过历史版本差异比较和变更影响分析获取变更点与受影响的基本块,使模糊测试生成的测试用例更倾向于覆盖包含变更点的基本块,以将模糊测试技术应用于回归测试场景。
    3、方法(Method)
    首先,通过历史版本差异比较获取所有包含变更点的基本块;然后,进行变更影响分析,获得受变更点影响的基本块;最后,在测试过程中计算种子测试用例的适应度,适应度越高的测试用例会获得更多的测试资源,以产生更多的子代测试用例。此外,本文还通过覆盖包含变更点基本块数量、覆盖目标基本块时间、漏洞检测数量来评估所提出方法的有效性。
    4、结果(Result & Findings)
    我们实现了历史版本信息制导的模糊测试原型工具DeltaFuzz,并与AFLGo、AFLFast与AFL进行了对比实验。与AFLGo和AFLFast相比,DeltaFuzz覆盖包含变更点的基本块数量分别是它们的1.03与1.09倍,触发的缺陷数量分别是它们的1.07与1.20倍。与AFLGo,AFLFast和AFL相比,覆盖到目标基本块的总时间分别减少了20.59%,30.05%与32.61%。
    5、结论(Conclusions)
    本文中提出一种历史版本信息制导的模糊测试方法,并实现了原型工具DeltaFuzz。与其他目标制导的模糊测试工具相比,它无需获取已知漏洞所在的位置,可通过版本差异制导模糊测试,更适用于回归测试场景。在未来工作中,我们计划将符号执行与历史版本信息制导的模糊测试集成,以覆盖难以到达的变更点,并且将进一步优化适应度函数,以更合理地分配测试资源。

     

    Abstract: With the widespread use of agile software development methods, such as agile and scrum, software is iteratively updated more frequently. To ensure the quality of the software, regression testing is conducted before new versions are released. Moreover, to improve the efficiency of regression testing, testing efforts should be concentrated on the modified and impacted parts of a program. However, the costs of manually constructing new test cases for the modified and impacted parts are relatively expensive. Fuzz testing is an effective method for generating test data automatically, but it is usually devoted to achieving higher code coverage, which makes fuzz testing unsuitable for direct regression testing scenarios. For this reason, we propose a fuzz testing method based on the guidance of historical version information. First, the differences between the program being tested and the last version are analyzed, and the results of the analysis are used to locate change points. Second, change impact analysis is performed to find the corresponding impacted basic blocks. Finally, the fitness values of test cases are calculated according to the execution traces, and new test cases are generated iteratively by the genetic algorithm. Based on the proposed method, we implement a prototype tool DeltaFuzz and conduct experiments on six open-source projects. Compared with the fuzzing tool AFLGo, AFLFast and AFL, DeltaFuzz can reach the target faster, and the time taken by DeltaFuzz was reduced by 20.59%, 30.05% and 32.61%, respectively.

     

/

返回文章
返回