[TIPS]Fuzz Testing of Application Reliability(专题文章)
原始连接：[url]http://www.cs.wisc.edu/~bart/fuzz/[/url]信息来源：邪恶八进制信息安全团队（[url]www.eviloctal.com[/url]）
Fuzz testing a simple technique for feeding random input to applications. While random testing is a time-honored technique, our approach has three characteristics that, when taken together, makes it somewhat different from other approaches.
The input is random. We do not use any model of program behavior, application type, or system description. This is sometimes called black box testing. In the command-line studies (1990, 1995, and 2006), the random input was simply random ASCII character streams. For our X-Window study (1995), Windows NT study (2000), and Mac OS X study (2006), the random input included cases that had only valid keyboard and mouse events.
Our reliability criteria is simple: if the application crashes or hangs, it is considerd to fail the test, otherwise it passes. Note that the application does not have to respond in a sensible manner to the input, and it can even quietly exit.
As a result of the first two characteristics, fuzz testing can be automated to a high degree and results can be compared across applications, operating systems, and vendors.
We encourage your feedback and comments.
Below are links to the fuzz papers and the software:
2006 Mac OS X Fuzz Report ( [attach]4742[/attach] , [attach]4743[/attach] ).
B.P. Miller, G. Cooksey and F. Moore, "An Empirical Study of the Robustness of MacOS Applications Using Random Testing", First International Workshop on Random Testing, Portland, Maine, July 2006.
2000 Windows NT Fuzz Report ( [attach]4744[/attach] , [attach]4745[/attach] , [attach]4746[/attach] , [url=http://forum.eviloctal.com/read-htm-tid-23997-toread-1.html]HTML[/url]).
J.E. Forrester and B.P. Miller, "An Empirical Study of the Robustness of Windows NT Applications Using Random Testing", 4th USENIX Windows Systems Symposium, Seattle, August 2000. Appears (in German translation) as "Empirische Studie zur Stabilit鋞 von NT-Anwendungen", iX, September 2000.
1995 "Fuzz Revisited" Report ( [attach]4747[/attach] , [attach]4748[/attach] , [attach]4749[/attach] ).
B.P. Miller, D. Koski, C.P. Lee, V. Maganty, R. Murthy, A. Natarajan, and J. Steidl, "Fuzz Revisited: A Re-examination of the Reliability of UNIX Utilities and Services", Computer Sciences Technical Report #1268, University of Wisconsin-Madison, April 1995. Appears (in German translation) as "Empirische Studie zur Zuverlasskeit von UNIX-Utilities: Nichts dazu Gerlernt", iX, September 1995.
1990 Original Fuzz Report ( [attach]4750[/attach] , [attach]4751[/attach] , [attach]4752[/attach] ).
B.P. Miller, L. Fredriksen, and B. So, "An Empirical Study of the Reliability of UNIX Utilities", Communications of the ACM 33, 12 (December 1990). Also appears (in German translation) as "Fatale Fehlertractigkeit: Eine Empirische Studie zur Zuverlassigkeit von UNIX-Utilities", iX, March 1991.
[url=ftp://ftp.cs.wisc.edu/paradyn/fuzz/]The Fuzz Software FTP Site [/url]
Slides from Fuzz-Revisited (1995) Talk ( [attach]4753[/attach] , [attach]4754[/attach] ).
If you have reported on the use of the fuzz tools on testing other systems or more recent testing of the systems that we have tested, please send us email and we would be glad to provide a link to the report: [img]http://www.cs.wisc.edu/~bart/at.gif[/img]
页:
[1]