| 引用本文： |
-
江川,洪征,张国敏,李昱萱,申晴.基于组件数据依赖图的固件模糊测试方法[J].信息安全学报,已采用 [点击复制]
- JiangChuan,HongZheng,ZhangGuomin,LiYuxuan,ShenQing.Firmware Fuzzing Method Based on Component Data Dependency Graph[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 现有的固件模糊测试方法存在漏洞触发路径涉及多组件协同难以覆盖全面、随机变异策略难以满足复杂路径约束、候选测试路径缺乏有效的优先级排序机制等问题。本文提出了一种基于组件数据依赖图的固件模糊测试方法CDDGuzz。该方法将固件二进制代码转换为静态单赋值（Static single assignment，SSA）形式的中间表示，基于数据传播规则构建组件内部数据依赖图，并将文件、Socket、环境变量等异构通信机制统一表示为通道模型，通过匹配共享通道上的读写操作建立跨组件依赖边，形成组件数据依赖图（CDDG，Component Data Dependency Graph）。在CDDG的基础上针对污点源与污点汇聚点，通过前向可达性分析识别候选漏洞路径，提取控制流约束、数据依赖约束与语义约束，将路径可达性问题转化为约束满足问题，结合约束求解与受控变异机制，在保持目标路径可达性的同时生成具有输入多样性的测试用例。最后，综合路径长度、约束复杂度和执行反馈对候选路径进行优先级评分，并采用分层调度与ε-贪心探索策略，在高价值路径利用和未知路径探索之间取得平衡，实现测试资源的高效分配。测试实验表明，CDDGuzz相比于FIRM-AFL、Snipuzz等典型模糊测试系统，CDDGuzz在漏洞挖掘数量和洞触发效率方面都有明显优势。 |
| 关键词: 固件安全 模糊测试 污点分析 漏洞挖掘 |
| DOI： |
| 投稿时间：2026-05-13修订日期：2026-09-22 |
| 基金项目:国家自然科学基金项目（面上项目，重点项目，重大项目） |
|
| Firmware Fuzzing Method Based on Component Data Dependency Graph |
|
JiangChuan, HongZheng, ZhangGuomin, LiYuxuan, ShenQing
|
| (Command and Control Engineering College, Army Engineering University of PLA) |
| Abstract: |
| Existing firmware fuzzing methods face several challenges, including difficulty in comprehensively covering vulnerability-triggering paths that involve multi-component collaboration, the inability of random mutation strategies to satisfy complex path constraints, and the lack of an effective priority-ranking mechanism for candidate test paths. To address these issues, this paper proposes CDDGuzz, a firmware fuzzing method based on a Component Data Dependency Graph (CDDG).CDDGuzz first converts firmware binary code into an intermediate representation in Static Single Assignment (SSA) form. It then constructs intra-component data dependency graphs based on data propagation rules. Heterogeneous communication mechanisms such as files, sockets, and environment variables are uniformly represented as a channel model, and cross-component dependency edges are established by matching read and write operations on shared channels, thereby forming the Component Data Dependency Graph.Based on the CDDG, CDDGuzz performs forward reachability analysis between taint sources and sinks to identify candidate vulnerability paths. It extracts control-flow constraints, data-dependency constraints, and semantic constraints, transforming the path reachability problem into a constraint satisfaction problem. By combining constraint solving with a controlled mutation mechanism, CDDGuzz generates test cases with input diversity while preserving the reachability of target paths.Finally, CDDGuzz assigns priority scores to candidate paths by comprehensively considering path length, constraint complexity, and execution feedback. It further employs hierarchical scheduling and an ε-greedy exploration strategy to balance the exploitation of high-value paths with the exploration of unknown paths, enabling efficient allocation of testing resources.Experimental results show that, compared with representative fuzzing systems such as FIRM-AFL and Snipuzz, CDDGuzz achieves clear advantages in both the number of vulnerabilities discovered and vulnerability-triggering efficiency. |
| Key words: Firmware security Fuzzing Taint analysis Vulnerability discovery |
