• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>2014 Communications security conference >PVDF: An automatic Patch-based Vulnerability Description and Fuzzing method
【24h】

PVDF: An automatic Patch-based Vulnerability Description and Fuzzing method

机译：PVDF：一种基于修补程序的自动漏洞描述和模糊处理方法

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Patch-based vulnerability analysis is a hot topic for security researchers and attackers, some important semantic can be used to discover new bugs or errors via information revealed from patch differences. However, automatic description for patched differences is always viewed as such a difficult task that similar work is usually achieve in manual method. In this paper, we present an automatic patch-based description for a type of privilege elevation vulnerability, and perform fuzzing test to excavate unknown bugs in further step. Focusing on feature in this type of vulnerability, we recognize vulnerability-related positions from patched differences, and divide them into multi-level attributes via normalized definitions. Furthermore, we present analysis procedure as relationship measurement among several attributes: binary difference, data structure of object, operation semantic and constraint formula. The root cause and exploitation method for vulnerability can be described on the leverage of gradual attribute deductions. At last, a CF-oriented fuzzing method is introduced based on verification of semantic and constraint formula. The effectiveness and performance of our prototype have been tested in evaluation, it proves that patch-related bugs all can be described in PVD (Patch-based Vulnerability Description) automatically, and some new bugs can be discovered in PVF (Patch-based Vulnerability Fuzzing). In addition, average time consumption of global running is less than systems or projects of related work.
机译：基于补丁的漏洞分析是安全研究人员和攻击者的热门话题，可以使用一些重要的语义通过补丁差异所揭示的信息来发现新的错误或错误。但是，自动描述已修补的差异始终被视为一项艰巨的任务，通常可以通过手动方法完成类似的工作。在本文中，我们为一种特权提升漏洞提供了一种基于补丁的自动描述，并进行了模糊测试以挖掘未知错误，这是下一步的工作。着眼于此类漏洞的功能，我们从已修补的差异中识别与漏洞相关的位置，并通过归一化定义将其划分为多级属性。此外，我们提出了分析程序作为关系度量的几个属性：二进制差异，对象的数据结构，操作语义和约束公式。漏洞的根本原因和利用方法可以通过逐步属性推论来描述。最后，基于语义和约束公式的验证，提出了一种基于CF的模糊测试方法。我们的原型的有效性和性能已经过评估测试，证明与补丁相关的错误都可以自动在PVD（基于补丁的漏洞描述）中描述，并且可以在PVF（基于补丁的漏洞Fuzzing）中发现一些新错误。 ）。另外，全球运行的平均时间消耗少于相关工作的系统或项目。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号