The Community for Technology Leaders
Computer Security Applications Conference, Annual (2007)
Miami Beach, Florida, USA
Dec. 10, 2007 to Dec. 14, 2007
ISSN: 1063-9527
ISBN: 0-7695-3060-5
pp: 477-486
ABSTRACT
We present an extension of traditional "black box" fuzz testing using a genetic algorithm based upon a Dynamic Markov Model fitness heuristic. This heuristic allows us to "intelligently" guide input selection based upon feedback concerning the "success" of past inputs that have been tried. Unlike many software testing tools, our implementation is strictly based upon binary code and does not require that source code be available. Our evaluation on a Windows server program shows that this approach is superior to random black box fuzzing for increasing code coverage and depth of penetration into program control flow logic. As a result, the technique may be beneficial to the development of future automated vulnerability analysis tools.
INDEX TERMS
CITATION
Cliff Zou, Sherri Sparks, Shawn Embleton, Ryan Cunningham, "Automated Vulnerability Analysis: Leveraging Control Flow for Evolutionary Input Crafting", Computer Security Applications Conference, Annual, vol. 00, no. , pp. 477-486, 2007, doi:10.1109/ACSAC.2007.27
115 ms
(Ver )