Efficient Evolutionary Fuzzing for Android Application Installation Process
Efficient Evolutionary Fuzzing for Android Application Installation Process
复制标题
DOI：
10.1109/qrs.2019.00021
复制
发表时间：
2019-07
期刊：
影响因子：
--
通讯作者：
Veysel Hataş;Sevil Şen;John A. Clark
中科院分区：
文献类型：
--
作者：
Veysel Hataş;Sevil Şen;John A. Clark
用于自动化软件测试的源代码分析技术不足以发现程序中的安全缺陷。因此，安全研究人员一直在使用模糊技术来发现目标程序中的错误和漏洞。随着移动设备的普及，研究人员开始探索在移动平台上使用模糊测试。虽然这些研究大多是基于gui并在应用程序级别实现的，但由于影响到更广泛的Android用户，在较低级别检测漏洞非常关键。因此，本研究提出了一种新的方法对Android应用程序安装过程进行模糊测试。研究了利用搜索启发式遗传算法对Dalvik可执行文件进行高效模糊测试的方法。与最近提出的类似方法相比，这个被称为GFuzz的黑盒模糊测试工具被证明能够在更短的时间内在Android上产生更多独特的崩溃，并检测新的和现有的漏洞。
Source code analysis techniques used for automated software testing are insufficient to find security flaws in programs. Therefore, security researchers have been employing also fuzzing techniques for finding bugs and vulnerabilities in target programs. With the proliferation of mobile devices, researchers have started to explore the use of fuzz tests on mobile platforms. While most of these studies are GUI-based and implemented at the application level, the detection of vulnerabilities in lower levels is very critical due to affecting a broader range of Android users. Therefore, in this study, a new approach is proposed to fuzz testing for Android application installation process. The use of a search heuristic namely genetic algorithms is investigated for efficient fuzz testing on DEX (Dalvik EXecutable) files. The proposed black box fuzzing tool called GFuzz is shown to be able to produce more unique crashes in Android in a shorter time than recently proposed similar approaches and to detect new and existing bugs.