基于Fuzzing的文件格式漏洞挖掘技术

软件漏洞挖掘已成为信息安全研究的一个热点，基于此，分析现有漏洞挖掘工具的不足，阐述基于Fuzzing的漏洞挖掘与分析的功能需求，根据文件格式结构化存储的特征，给出一种启发式的畸形数据的构造方法，设计并实现文件型漏洞智能挖掘与分析系统，给出软件结构、运行机制和关键技术。实例测试结果表明，该系统有效提高了文件漏洞挖掘的效率和智能化水平。

File Format Vulnerability Exploiting Technique Based on Fuzzing

The exploiting of the software vulnerabilities is a hotspot of information security research. The shortage of current vulnerability exploiting implements is analyzed. The function demands of vulnerability exploiting and analysis based on Fuzzing are emphasized. A heuristic construction of abnormality data based on structural storage characteristic is proposed. The file format vulnerability intelligent exploiting and analysis system are designed and developed. The system’s software structure and run mechanism and critical technology are given. Experimental result proves its effectiveness and intelligence.