kirancodes.me
To Proof Maintenance & Beyond!
ASE 2021

FinFuzzer: One Step Further in Fuzzing Fintech Systems

Qingshun Wang, Lihua Xu, Jun Xiao, Qi Guo, Haotian Zhang, Liang Dou, Liang He, Tao Xie

DOI 10.1109/ase51524.2021.9678675dblp

Abstract

Comprehensive testing is of high importance to ensure the reliability of software systems, especially for systems with high stakes such as FinTech systems. In this paper, we share our observations of the Ant Group’s status quo in testing their financial services, specifically on the importance of properly transforming relevant external environment settings and prioritizing input object fields for mutation during automated fuzzing. Based on these observations, we propose FinFuzzer, an automated fuzz testing framework that detects and transforms relevant environmental settings into system inputs, prioritizes input object fields, and mutates system inputs on both environment settings and high-priority object fields. Our evaluation of FinFuzzer against four FinTech systems developed by the Ant Group shows that FinFuzzer can outperform a state-of-the-art approach in terms of line coverage in much shorter time.

BibTeX
@inproceedings{Wang-al:ASE21,
  author    = {Qingshun Wang and
               Lihua Xu and
               Jun Xiao and
               Qi Guo and
               Haotian Zhang and
               Liang Dou and
               Liang He and
               Tao Xie},
  title     = {{FinFuzzer:} One Step Further in Fuzzing Fintech Systems},
  booktitle = {ASE},
  pages     = {1111--1115},
  publisher = {{IEEE}},
  year      = {2021},
}

Related papers