关键词: 漏洞检测, 模糊测试, 符号执行, 污点分析

Abstract: To solve the problem of poor triggering ability of whitebox fuzzing vulnerability, a Whitebox Fuzzing Based on Taint Analysis（WFBTA） scheme is proposed. According to different vulnerabilities, the scheme identifies dangerous operations, obtains vulnerability-related constraints. Combining with route constraints, it is solved through a constraint solver to generate test cases with high coverage and good vulnerability triggering capabilities. The experimental results show that compared with the original whitebox fuzzy test method, the WFBTA scheme has stronger vulnerability discovery ability, lower false negative rate and false positive rate, and the average time overhead only increases by 1.31%.

Key words: vulnerability detection, fuzzing test, symbol execution, taint analysis