One Fuzzing Strategy to Rule Them All
One Fuzzing Strategy to Rule Them All
复制标题
DOI：
10.1145/3510003.3510174
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Mingyuan Wu;Ling Jiang;Jiahong Xiang;Yanwei Huang;Heming Cui;Lingming Zhang;Yuqun Zhang
中科院分区：
文献类型：
--
作者：
Mingyuan Wu;Ling Jiang;Jiahong Xiang;Yanwei Huang;Heming Cui;Lingming Zhang;Yuqun Zhang
覆盖率引导的模糊检测已经成为自动暴露程序漏洞的模糊检测的主流。最近，一组模糊器被提出采用随机搜索机制，即Havoc，显式或隐式，以增加他们的边缘探索。然而，他们只倾向于采用Havoc的默认设置作为实现选项，而没有人试图在不同的设置下探索其功能或检查其潜在改进的理由。针对这些问题，本文首先对大浩劫进行了实证研究，以加深对其特征的认识。具体来说，我们首先发现将Havoc的默认设置应用于模糊器可以显着提高其边缘覆盖性能。有趣的是，我们进一步观察到，即使只是简单地执行Havoc本身而不将其附加到任何模糊器，也可以导致强大的边缘覆盖性能，并且超过我们研究的大多数模糊器。此外，我们还延长了Havoc的执行时间，发现大多数模糊器不仅可以实现显著更高的边缘覆盖率，而且往往表现相似（即，他们的业绩差距在很大程度上得到弥补）。受这些发现的启发，我们进一步提出了HavocMAB，它将Havoc突变策略建模为一个多臂强盗问题，通过动态调整突变策略来解决。评估结果表明，HavocMAB可以显着增加边缘覆盖率平均为11.1%的所有基准项目相比，Havoc，甚至略优于最先进的QSYM，增加其计算资源，通过采用三个并行线程。我们进一步使用三个并行线程执行HavocMAB，并在所有基准测试项目中获得比QSYM高9%的平均边缘覆盖率。
Coverage-guided fuzzing has become mainstream in fuzzing to automatically expose program vulnerabilities. Recently, a group of fuzzers are proposed to adopt a random search mechanism namely Havoc, explicitly or implicitly, to augment their edge exploration. However, they only tend to adopt the default setup of Havoc as an implementation option while none of them attempts to explore its power under diverse setups or inspect its rationale for potential improvement. In this paper, to address such issues, we conduct the first empirical study on Havoc to enhance the understanding of its characteristics. Specifically, we first find that applying the default setup of Havoc to fuzzers can significantly improve their edge coverage performance. Interestingly, we further observe that even simply executing Havoc itself without appending it to any fuzzer can lead to strong edge coverage performance and outper-form most of our studied fuzzers. Moreover, we also extend the execution time of Havoc and find that most fuzzers can not only achieve significantly higher edge coverage, but also tend to perform similarly (i.e., their performance gaps get largely bridged). Inspired by the findings, we further propose HavocMAB, which models the Havoc mutation strategy as a multi-armed bandit problem to be solved by dynamically adjusting the mutation strategy. The evaluation result presents that HavocMAB can significantly increase the edge coverage by 11.1% on average for all the benchmark projects compared with Havoc and even slightly outperform state-of-the-art QSYM which augments its computing resource by adopting three parallel threads. We further execute HavocMAB with three parallel threads and result in 9% higher average edge coverage over QSYM upon all the benchmark projects.