多维Fuzzing技术综述*

Fuzzing技术是一项有效的动态漏洞挖掘技术,但是当前对多维Fuzzing技术的研究还不多见。把多维Fuzzing技术面临的问题归纳为组合爆炸、覆盖脆弱语句和触发潜在漏洞三个问题,对存在的多种多维Fuzzing技术进行了研究和比较,并总结出多维Fuzzing技术的三个基本步骤：定位脆弱语句、查找影响脆弱语句的输入元素和多维Fuzzing测试挖掘脆弱语句中的漏洞。最后,给出了多维Fuzzing技术的进一步发展方向。     

基于多维Fuzzing的缓冲区溢出漏洞挖掘技术研究*

缓冲区溢出漏洞一直是计算机安全威胁中最为严重的漏洞之一,在黑客发现利用前检测出漏洞并及时修复极为重要;基于多维Fuzzing设计和实现了一种缓冲区溢出漏洞挖掘模型MFBOF,应用输入样本结构知识、结合静态二进制分析技术和动态输入/输出测试技术,运用自适应模拟退火遗传算法生成测试用例进行测试,并以挖掘Libpng的漏洞为实例说明了该模型的有效性;最后,提出了模型需要优化的地方和下一步研究方向。     

基于输入触发的漏洞挖掘模型

为了解决目前Fuzzing挖掘技术存在的挖掘算法移植性差、挖掘点不易修改和挖掘程度难以度量等不足,在分析当前程序输入数据特点和程序状态特点的基础上,总结出程序状态变化和程序处理输入数据的特点,设计了基于输入触发的漏洞挖掘模型.通过建立目标系统的程序状态、输入点和输入数据的模型来建立挖掘过程以及生成测试数据,实验结果表明,该模型能够解决上述Fuzzing技术的不足,还表明了基于输入触发的漏洞挖掘模型可行性和有效性.     

基于Fuzzing的PNG漏洞挖掘技术

Fuzzing是一种利用黑盒测试思想的自动化漏洞挖掘技术。文章基于Fuzzing的漏洞挖掘思想,设计并实现了一个针对PNG文件查看软件的fuzz工具-PNGFuzzer,可以实现对PNG文件的漏洞测试,最后给出了该工具测试的实例。     

基于改进模糊测试的Web应用漏洞挖掘方法

为解决Web模糊测试挖掘漏洞速度较慢、发现漏洞数较少的问题,提出一种改进的Web模糊测试向量生成方法。在通用的Web应用模糊测试结构（Web Fuzzing）基础上,分析现有测试向量生成方法,引入遗传算法来改进Web模糊测试向量生成方法。基于该方法实现XSS模糊测试工具,使用该工具对2个Web应用系统进行测试,将结果与现有模糊测试工具测试结果对比,验证了使用该方法挖掘Web漏洞速度快,发现漏洞数更多,提高了漏洞挖掘效率。     

基于局部序列比对的漏洞挖掘技术研究

针对网络协议漏洞挖掘系统在网络协议格式分析过程中使用全局序列比对技术效率不高的问题,结合网络漏洞挖掘背景,对序列比对技术进行深入分析,提出了一种更为有效的基于局部序列比对算法的Fuzzing漏洞挖掘新方法。在获取网络协议格式分析的过程中,提高漏洞挖掘效率。仿真结果表明,该方法较全局序列比对方法在执行效率上具有较为明显的优势。     

基于Fuzzing的蓝牙OBEX漏洞挖掘技术

Fuzzing是一种自动化的漏洞挖掘技术。该文在分析OBEX 协议的基础上,利用Fuzzing技术,设计并实现了蓝牙OBEX协议的Fuzzer工具——OBEX-Fuzzer,并且利用该工具对OBEX协议在Nokia N73和SMH-BT555蓝牙适配器上的实现进行了漏洞测试,发现存在多个安全漏洞,实践结果表明了研究思路的正确性以及利用OBEX-Fuzzer工具进行安全漏洞测试的高效性。     

工控网络协议Fuzzing测试技术研究综述

随着信息化和工业化的深度融合,控制系统在工业生产过程中得到了越来越广泛的应用,很多研究者开始针对工控系统,特别是具有控制功能的工控网络协议的安全性展开研究,漏洞分析则是其中较为活跃的领域之一.由于工控网络协议具有专用性和面向控制的特点,通常在封闭环境下运行,无法直接应用传统Fuzzing测试技术进行网络协议的漏洞挖掘.本文阐述了工控网络协议的特点以及Fuzzing测试的困难,讨论并比较了现有各种Fuzzing测试技术应用于工控网络协议的优缺点,提出工控网络协议的专用Fuzzing测试工具的设计准则,最后展望了工控网络协议Fuzzing测试技术的未来研究方向.     

基于Fuzzing的TFTP漏洞挖掘技术

Fuzzing是一种自动化的漏洞挖掘技术。该文介绍了一种基于Fuzzing的漏洞挖掘思路，并将这一漏洞挖掘思路应用在TFTP协议上。设计并实现了一个针对TFTP服务器的fuzzer工具——tftpServerFuzzer，并对现有的从互联网上搜集到的Windows平台下11种TFTP服务器进行了安全测试，发现了8种TFTP服务器的13个安全漏洞，其中未曾公布过的漏洞有7个。该实践结果表明了tftpServerFuzzer的有效性和先进性。     

一种基于污点分析的文件型软件漏洞发现方法

基于黑盒测试思想的Fuzzing是漏洞分析的主要方法,但效率较低且不能分析未知格式.基于污点分析,提出一种针对文件型软件的漏洞发现新方法.利用污点分析寻找输入中能导致执行流到达脆弱点的字节,再改变这些字节产生新输入;同时根据污点信息产生特征码.利用插桩工具实现了原型系统,对三个真实漏洞进行了测试.实验结果表明该方法能有效发现漏洞,生成的测试用例远小于Fuzzing,且不依赖输入格式;特征码的误报率漏报率均较低.     

Only connect: teaching, technology and telesis

Abstract This paper describes an approach to the design of interactive multimedia materials being developed in a European Community project. The developmental process is seen as a dialogue between technologists and teachers. This dialogue is often problematic because of the differences in training, experience and culture between them. Conditions needed for fruitful dialogue are described and the generic model for learning design used in the project is explained.     

European Community policy and the market

Abstract This paper starts with some reflections on the policy considerations and priorities which are shaping European Commission (EC) research programmes. Then it attempts to position the current projects which seek to capitalise on information and communications technologies for learning in relation to these priorities and the apparent realities of the marketplace. It concludes that while there are grounds to be optimistic about the contribution EC programmes can make to the efficiency and standard of education and training, they are still too technology driven.     

一种自适应子融合集成多分类器方法

融合集成方法已经广泛应用在模式识别领域,然而一些基分类器实时性能稳定性较差,导致多分类器融合性能差,针对上述问题本文提出了一种新的基于多分类器的子融合集成分类器系统。该方法考虑在度量层融合层次之上通过对各类基多分类器进行动态选择,票数最多的类别作为融合系统中对特征向量识别的类别,构成一种新的自适应子融合集成分类器方法。实验表明,该方法比传统的分类器以及分类融合方法识别准确率明显更高,具有更好的鲁棒性。     

煤矿井下安全监控分站的设计及其仿真实现

为了设计一种具有低成本、低功耗、易操作、功能强且可靠性高的煤矿井下安全分站,针对煤矿安全生产实际,文章提出了采用MCS-51系列单片机为核心、具有CAN总线通信接口的煤矿井下安全监控分站的设计方案;首先给出煤矿井下安全监控分站的整体构架设计,然后着重阐述模拟量输入信号处理系统的设计过程,最后说明单片机最小系统及其键盘、显示、报警、通信等各个组成部分的设计;为验证设计方案的可行性与有效性,使用Proteus软件对设计内容进行仿真验证,设计的煤矿井下安全监控分站具有瓦斯、温度等模拟量参数超标报警功能和电机开停、风门开闭等开关量指示功能;仿真结果表明:设计的煤矿井下安全监控分站具有一定的实际应用价值.     

Avoiding semantic and temporal gaps in developing software intensive systems

Development of software intensive systems (systems) in practice involves a series of self-contained phases for the lifecycle of a system. Semantic and temporal gaps, which occur among phases and among developer disciplines within and across phases, hinder the ongoing development of a system because of the interdependencies among phases and among disciplines. Such gaps are magnified among systems that are developed at different times by different development teams, which may limit reuse of artifacts of systems development and interoperability among the systems. This article discusses such gaps and a systems development process for avoiding them.     

基于QTE的蒙古文显示机制研究与实现

蒙古语言是中国蒙古族使用的通用语言,由于蒙古文区别于其他文字的书写方式和其自身变形机制等特点,在很多通用的文字处理引擎中都不被支持。在嵌入式产品开发与应用领域中Linux加QTE已经成为流行方式。该文给出了一种在QTE环境上实现基于标准Unicode的蒙古文点阵显示和变形算法, 并自定义了支持蒙古文的QTE组件,扩展了QTE功能,为在Linux加QTE方式的嵌入式体系结构中处理蒙古文提供了一种解决方法。     

Designing economic np control charts: A programmed simulation approach

This paper presents control charts models and the necessary simulation software for the location of economic values of the control parameters. The simulation program is written in FORTRAN, requires only 10K of main storage, and can run on most mini and micro computers. Two models are presented - one describes the process when it is operating at full capacity and the other when the process is operating under capacity. The models allow the product quality to deteriorate to a further level before an existing out-of-control state is detected, and they can also be used in situations where no prior knowledge exists of the out-of-control causes and the resulting proportion defectives.     

基于AD9626的模拟信号采集存储卡设计

自然界的绝大部分信号都是以模拟的形式存在,因此模拟信号的采集转换存储在数字时代十分关键。文章讨论了在雷达信号处理领域基于AD9626的AD采集存储卡的设计原理、硬件结构和程序设计与芯片配置等问题,为今后相关领域的研究提供了可参考的方案。     

The development of robot art

Going through a few examples of robot artists who are recognized worldwide, we try to analyze the deepest meaning of what is called “robot art” and the related art field definition. We also try to highlight its well-marked borders, such as kinetic sculptures, kinetic art, cyber art, and cyberpunk. A brief excursion into the importance of the context, the message, and its semiotics is also provided, case by case, together with a few hints on the history of this discipline in the light of an artistic perspective. Therefore, the aim of this article is to try to summarize the main characteristics that might classify robot art as a unique and innovative discipline, and to track down some of the principles by which a robotic artifact can or cannot be considered an art piece in terms of social, cultural, and strictly artistic interest. This work was presented in part at the 13th International Symposium on Artificial Life and Robotics, Oita, Japan, January 31–February 2, 2008     

A human-computer interface for non-computer specialists

The COM teleconferencing system was designed to be easy to use for both beginners and people with much computer experience. A number of design choices in organizing the human-computer interface were considered very carefully. These design problems are not unique for teleconferencing applications, but will appear in many other developments of human-computer interfaces for non-computer specialists. This report discusses naming conventions, menu format, user commands, help facility and the treatment of ‘type ahead’ from the users.