结合路径标签和数据变异的模糊测试关键数据定位方法

Aiming at the problem of high resource consumption and false positive rate in current key data location methods for binary program fuzz testing, a new key data location method for fuzz testing based on path label and data mutation was proposed. First, a static analysis was used to locate the dangerous operations in the binary program. Then dynamic instrumentation was used to track the execution of program and obtain the path labels and parameters of dangerous operation. Finally, the position of key data was located by analyzing the tracking data before and after input data mutation. Experimental results show that this method can locate key data of input effectively under low resource consumption, the false positive rate is less than 0.3%, the recall is greater than 70%, and the precision is greater than 60%. This method can be used to improve the vulnerability detection ability of fuzz testing, possessing a strong practical value.