基于黑盒遗传算法的Android驱动漏洞挖掘

发布时间：2019-06-10 23:39

【摘要】：驱动漏洞在Android手机的安全研究中非常重要,因为驱动运行在内核空间,不仅影响用户的使用满意度,还关系到系统的稳定与安全,但驱动的漏洞挖掘一直都相对较困难,传统模糊测试技术对目标程序缺乏理解、测试随机且盲目的缺点无法适应Android驱动漏洞挖掘的需求.通过改进现有模糊测试技术,提出了基于黑盒测试的遗传算法,利用测试的执行结果指导遗传算法,由遗传算法决定测试用例的参数需要遗传还是变异.从而将有效参数遗传到下一代测试用例,无效参数根据执行结果采用不同的策略进行变异,使模糊测试用例可以较快地收敛到有效的范围.为加快漏洞挖掘速度,引入并扩展了参数优化技术,将由遗传算法得到的有效参数进一步修改为特殊数据或使用者预设的数据,更快地达到测试目的.最后基于该算法设计并实现了Android驱动的模糊测试系统Add-fuzz(Android device driver fuzz),利用该系统在多个不同版本的Android手机进行了系统测试,挖掘出了9个Android设备驱动程序的未知安全漏洞.与其它相关测试方法对比,实验结果表明该算法的有效性和适用性表现更优.
[Abstract]:Driver vulnerability is very important in the security research of Android mobile phone, because the driver running in kernel space not only affects the satisfaction of users, but also related to the stability and security of the system, but the vulnerability mining of driver has always been relatively difficult. The traditional fuzzy testing technology lacks understanding of the target program, and the random and blind shortcomings of the test can not meet the needs of Android driver vulnerability mining. By improving the existing fuzzy test technology, a genetic algorithm based on black box test is proposed. The genetic algorithm is guided by the execution results of the test. The genetic algorithm determines whether the parameters of the test case need heredity or variation. Thus, the effective parameters are passed on to the next generation of test cases, and the invalid parameters are mutated according to the execution results, so that the fuzzy test cases can converge to the effective range quickly. In order to speed up vulnerability mining, parameter optimization technology is introduced and extended, and the effective parameters obtained by genetic algorithm are further modified to special data or user preset data, so as to achieve the purpose of testing more quickly. Finally, based on the algorithm, a Android driven fuzzy test system Add-fuzz (Android device driver fuzz), is designed and implemented, which uses the system to test the system in several different versions of Android mobile phones. Nine unknown security vulnerabilities of Android device driver have been excavated. Compared with other related test methods, the experimental results show that the algorithm is more effective and applicable.
【作者单位】：中国科学院大学国家计算机网络入侵防范中心;大理大学数学与计算机学院;中国科学院信息工程研究所物联网信息安全技术北京市重点实验室;
【基金】：国家自然科学基金(61572460,61272481) 物联网信息安全技术北京市重点实验室开放课题资助~~
【分类号】：TP18;TP309

【相似文献】