一种基于fuzzing技术的漏洞发掘新思路*

目前检测软件缓冲区溢出漏洞仅局限于手工分析、二进制补丁比较及fuzzing技术等，这些技术要么对人工分析依赖程度高，要么盲目性太大，致使漏洞发掘效率极为低下。结合fuzzing技术、数据流动态分析技术以及异常自动分析技术等，提出一种新的缓冲区溢出漏洞发掘思路。新思路克服了已有缓冲区溢出漏洞发掘技术的缺点，能有效发掘网络服务器软件中潜在的未知安全漏洞（0day），提高了缓冲区溢出漏洞发掘效率和自动化程度。

New method of software vulnerability detection based on fuzzing

The techniques of buffer overflow vulnerabilities detection was single and limited to manual analysis, binary-patch comparison, fuzzing and so on. These techniques of vulnerabilities detection were either too dependent on manual analysis or too blind, leading up to the low efficiency of vulnerabilities detection. Introduced a new method of buffer overflow vulnerabilities detection, which was based on fuzzing, data-flow dynamic analysis and automated exception analysis. Overcame the disadvantages of old techniques, this new method effectively improves the detection of potential unknown security vulnerabilities (0day) in software. Besides, this method is more automated and performs better in finding new security vulnerabilities.