基于模糊测试的虚拟机安全漏洞挖掘工具的设计与实现.doc

文档介绍：
基于模糊测试的虚拟机安全漏洞挖掘工具
的设计与实现
牛新立,双锴**
5
10
15
20
25
30
35
40
(北京邮电大学网络与交换技术国家重点实验室,北京 100876)
摘要:虚拟化技术可以使得一台物理计算机上同时运行多个操作系统,并且在多个操作系统
之间进行有效的资源隔离和数据隔离,能够充分利用硬件资源,节省 IT 成本,同时虚拟化
技术也是云计算的核心技术之一。随着虚拟化技术的广泛应用,虚拟化技术的安全问题也暴
露出来了。由于虚拟化技术的特殊性,虚拟化一旦出现安全问题,后果比传统的安全问题更
为严重。保证安全的一个重要措施就是及时安装软件厂商或开源社区提供的漏洞补丁。如何
抢在恶意攻击者前面发现虚拟化软件中存在的安全漏洞并且及时发布更新补丁是一个很重
要的问题。本文以此为出发点,设计一个基于模糊测试的虚拟化软件漏洞发掘工具,以便于
快速的发现虚拟化软件的漏洞并为厂商提供修补意见。
关键词:虚拟化;安全;模糊测试;漏洞挖掘
中图分类号:
Design and Implementation of Virtual Machine
Vulnerability Digging Tool based on Fuzz Test
NIU Xinli, SHUANG Kai
(State Key Laboratory working and Switching Technology, BUPT, Beijing 100876)
Abstract: Virtualization technology can make multiple operating systems run on the same
physical machine and offer effective resource isolation and data isolation, which makes more
efficient use of hardware and saves IT cost. Also, virtualization is one of the key technologies of
puting. With the rapid development and deployment of virtualization technology, its
security problems have emerged as an unavoidable issue. Due to the specificity of virtualization,
its security problem is more harmful than traditional security threats. One key to asure security is
to install updates timely after vulnerability is exposed. Finding vulnerabilities of virtualization
software ahead of malicious guys is very important. In this paper, we