Android application-oriented intelligent fuzzy test method

Abstract

The invention discloses an Android application-oriented intelligent fuzzy test method. The method comprises application reverse symbol execution and Android application fuzzy testing. Android vulnerability characteristics are used for performing modeling analysis on an Android application to obtain an Android application entry function, a sensitive operation point, control flow and function call information; the reverse symbol execution is performed by taking the sensitive operation point as an entry to obtain path constraint information; the path constraint information is subjected to constraint solving to obtain a path test case triggering a vulnerability; the generated path test case is used for performing fuzzy testing on the Android application to monitor a program running state; andthe program running information is analyzed to generate a related vulnerability report. The test case triggering the vulnerability can be generated, so that the path explosion is avoided and the fuzzytesting under the guidance of the method is more targeted. Compared with a conventional fuzzy testing method, the method solves the problem of fuzzy testing blindness and improves the fuzzy testing efficiency.

Description

technical field [0001] The invention relates to a method for testing the security of Android application software, in particular to a method for guiding fuzz testing based on reverse symbol execution, which combines the advantages of reverse symbol execution and fuzz testing to analyze the security of software. Background technique [0002] With the widespread popularization of the mobile Internet and the widespread use of Android smartphones, the Android mobile application software industry has developed rapidly and has begun to affect all aspects of people's work and life, such as: mobile office software, mobile game software, mobile social software , mobile positioning software and mobile payment software, etc. A large number of Android applications are downloaded and installed on users' mobile phones through application stores or third-party markets. However, most of the applications come from third-party developers, and these applications can be put on the market witho...

AI Technical Summary

Problems solved by technology

[0010] Although the above-mentioned fuzz testing method has a relatively high detection rate for application vulnerabilities, it has obvious defects: the test data generation method is too random and simple, and the blindness of the test leads to low test efficiency, and it is difficult to determine the coverage rate, resulting in the failure of fuzz testing. The results are evaluated; sufficient code coverage cannot be guaranteed, resulting in a high false negative rate; test data is independent of each other, making it difficult to find complex vulnerabilities, etc.

Images