Mining input grammars from dynamic taints

Knowing which part of a program processes which parts of an input can reveal the structure of the input as well as the structure of the program. In a URL http://www.example.com/path/, for instance, the protocol http, the host www.example.com, and the path path would be handled by different functions...

Full description

Saved in:
Bibliographic Details
Published in:Proceedings of the 31st IEEE/ACM International Conference on Automated Software Engineering pp. 720 - 725
Main Authors: Hoschele, Matthias, Zeller, Andreas
Format: Conference Proceeding
Language:English
Published: ACM 01.09.2016
Subjects:
context-free grammars
dynamic tainting
fuzzing
Grammar
Input formats
Instruments
Java
Ports (Computers)
Protocols
Software
Uniform resource locators
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Knowing which part of a program processes which parts of an input can reveal the structure of the input as well as the structure of the program. In a URL http://www.example.com/path/, for instance, the protocol http, the host www.example.com, and the path path would be handled by different functions and stored in different variables. Given a set of sample inputs, we use dynamic tainting to trace the data flow of each input character, and aggregate those input fragments that would be handled by the same function into lexical and syntactical entities. The result is a context-free grammar that reflects valid input structure. In its evaluation, our AUTOGRAM prototype automatically produced readable and structurally accurate grammars for inputs like URLs, spreadsheets or configuration files. The resulting grammars not only allow simple reverse engineering of input formats, but can also directly serve as input for test generators.
DOI:10.1145/2970276.2970321