By Topic

Call-Flow Aware API Fuzz Testing for Security of Windows Systems

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

4 Author(s)
YoungHan Choi ; Electron. & Telecommun. Res. Inst.(ETRI), Daejeon ; HyoungChun Kim ; HyungGeun Oh ; DoHoon Lee

API fuzz testing is to insert unexpected data into parameters of functions and to monitor exceptions or errors of a software system in order to test security of it. API fuzz testing without considering the dependency between functions generates many errors, because required functions aren't called before the target function is called. Therefore, unexpected data cannot reach various codes in the target function. We define the dependency as relation of functions that must be called before the target function is called. In order to solve the problem of the dependency during performing API fuzz testing, we propose a novel Methodology that analyzes the dependency between functions automatically and that performs API fuzz testing with considering the dependency, and implement a practical tool for our methodology. We name the methodology the Call-Flow Aware API Fuzz Testing (CFAFT). Call-Flow is the order that functions with the dependency are called. By considering Call-Flow of functions, CFAFT can perform API fuzz testing without errors related to the dependency and insert invalid data into various codes in functions. We experimented on DLL files in the system folder of Windows XP SP2. Experimental result showed that CFAFT removed errors related to the dependency between functions.

Published in:

Computational Sciences and Its Applications, 2008. ICCSA '08. International Conference on

Date of Conference:

June 30 2008-July 3 2008