Abstract: Aiming at the problems of insufficient applicability of traditional vulnerability detection technology in Spectre V1 vulnerability detection, high false positive rate and false positive rate, a novel method TransFT integrating fuzz testing and taint analysis is proposed. First, program code is refactored to simulate the misprediction behavior of Spectre V1 vulnerabilities. Next, feedbackdriven fuzz testing is utilized to identify highrisk code segments and generate test cases capable of triggering vulnerabilities, thereby improving testing efficiency. Finally, static taint analysis is applied to validate potential vulnerabilities, effectively reducing FNR and FPR. Experimental results demonstrate that the proposed method significantly reduces FNR, FPR, and testing time compared to existing fuzzingbased approaches, showcasing superior detection capabilities.

Key words: Spectre vulnerability, transient execution attack, vulnerability detection, fuzzing testing, taint analysis

摘要： 针对传统漏洞检测技术在Spectre V1漏洞检测中适用性不足、漏报率和误报率较高等问题，提出了一种结合模糊测试与污点分析的Spectre V1漏洞检测方法TransFT.首先，通过对程序代码进行控制流重构，模拟Spectre V1漏洞的错误预测行为；其次，采用反馈驱动的模糊测试技术定位高风险代码片段，并保留和生成能够触发漏洞的测试用例，以提升测试效率；最后，基于静态污点分析对潜在漏洞进行验证，有效降低漏报率和误报率.实验结果表明，与传统方法相比，该方法在漏报率、误报率及测试时间方面均显著改善，展现出更优的漏洞检测能力.

关键词: 幽灵漏洞, 瞬态执行攻击, 漏洞检测, 模糊测试, 污点分析