Public component library automatic testing method and device based on guidance of push-down automaton

Abstract

The invention discloses a push-down automaton guided public component library automatic test method and device, and the method comprises the steps: carrying out the function tracking and information extraction through a dynamic binary instrumentation method for a binary public component library and a user program, obtaining the execution track and metadata of an API function, and screening an output parameter and a return value; according to the obtained function execution track, the output parameter and the return value, data dependency analysis and control dependency analysis are adopted to extract data dependency information and control dependency information; constructing a function path exploration model based on the push-down automaton model, the data dependency information and the control dependency information, and generating a function call sequence through the function path exploration model; and synthesizing the obtained metadata and the function call sequence into a driving program, and carrying out automatic testing. According to the method, dependence of source codes can be removed, the function call sequence synthesis drive program is effectively generated, and automatic testing is carried out.

Description

technical field [0001] The invention belongs to the technical field of software security testing, and in particular relates to an automatic testing method and device for a public component library guided by a push-down automaton. Background technique [0002] A common component library is a collection of functions with a well-defined interface, and various independent programs can use the functions of a common component library developed by other developers. The reuse of this feature has contributed to the field of computer science because of its low implementation time and cost and high production efficiency. However, vulnerabilities in the Common Component Library can be more severe than those in other software because they affect various programs that use the Common Component Library. Therefore, security testing of public component libraries, such as grey-box fuzzing, is required to prevent preemptive security breaches. However, since the public component library cannot...

AI Technical Summary

Problems solved by technology

[0004] The present invention aims at manual writing of the driver program, which usually requires security personnel to have a deep understanding of the source code of the program, and the process of writing the driver program is time-consuming and error-prone; and the problem that the existing automatic driver program generation technology lacks model guidance when generating function call sequences , a method and device for automated testing of public component libraries based on pushdown automaton guidance are proposed, which can remove source code dependencies, effectively generate function call sequence synthesis drivers, and perform automated testing

Images