Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis
Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis
复制标题
Arvin：使用近似动态 CFG 分析进行灰盒模糊测试
DOI：
10.1145/3579856.3582813
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Ricci, Robert
中科院分区：
文献类型：
--
作者：
Shahini, Sirus;Zhang, Mu;Payer, Mathias;Ricci, Robert
模糊已经成为发现漏洞的最广泛使用的测试技术。有效的模糊者依赖于覆盖率来确定执行新计划领域的投入的优先顺序。被测程序的基于边缘的代码覆盖(PUT)是当今最常用的覆盖。它的收集成本很低-每个基本块边缘一个简单的计数器就足够了。遗憾的是，边覆盖缺乏上下文信息：它只记录每条边被执行的次数，但缺乏跟踪实际执行路径所需的信息。我们的新Fuzzer Arvin收集PUT执行的概率完整轨迹来构建动态控制流图(DCFG)。这些DCFG观察一组更丰富的程序行为，例如执行的“深度”、到达相同基本块的不同路径，以及针对特定功能和路径。根据这些行为对最有希望的输入进行优先排序，通过增加探索的基本块的多样性来提高模糊效率。设计支持DCFG的模糊器提出了一个关键挑战：收集所需的信息需要复杂的仪器，这会导致性能开销。我们的原型接近于DCFG，并使模糊过程之间能够轻量级、异步地协调，使得基于DCFG的模糊成为现实。通过逼近DCFG，ARvin是快速的，导致模糊速度至少提高了8倍。因为它使用深度比较和定向排除等方法有效地确定输入的优先顺序，而其他模糊器无法使用这些方法，因此它可以找到其他模糊器遗漏的错误。我们比较了它使用各种Linux程序查找错误的能力，发现了50个错误，其中23个是Arvin唯一发现的。
Fuzzing has emerged as the most broadly used testing technique to discover bugs. Effective fuzzers rely on coverage to prioritize inputs that exercise new program areas. Edge-based code coverage of the Program Under Test (PUT) is the most commonly used coverage today. It is cheap to collect—a simple counter per basic block edge suffices. Unfortunately, edge coverage lacks context information: it exclusively records how many times each edge was executed but lacks the information necessary to trace actual paths of execution.Our new fuzzer Arvin gathers probabilistic full traces of PUT executions to construct Dynamic Control Flow Graphs (DCFGs). These DCFGs observe a richer set of program behaviors, such as the "depth" of execution, different paths to reach the same basic block, and targeting specific functions and paths. Prioritizing the most promising inputs based on these behaviors improves fuzzing effectiveness by increasing the diversity of explored basic blocks.Designing a DCFG-aware fuzzer raises a key challenge: collecting the required information needs complex instrumentation which results in performance overheads. Our prototype approximates DCFG and enables lightweight, asynchronous coordination between fuzzing processes, making DCFG-based fuzzing practical.By approximating DCFGs, Arvin is fast, resulting in at least an eight-fold increase in fuzzing speed. Because it effectively prioritizes inputs using methods like depth comparison and directed exclusion, which are unavailable to other fuzzers, it finds bugs missed by others. We compare its ability to find bugs using various Linux programs and discover 50 bugs, 23 of which are uniquely found by Arvin.
DOI：
--
发表时间：
2019-07
期刊：
--
影响因子：
--
作者：
Dmitry Duplyakin;R. Ricci;Aleksander Maricq;Gary Wong;Jonathon Duerig;E. Eide;L. Stoller;Mike Hibler;David Johnson;Kirk Webb;Aditya Akella;Kuang-Ching Wang;Glenn Ricart;L. Landweber;C. Elliott;M. Zink;E. Cecchet;Snigdhaswin Kar;Prabodh Mishra
通讯作者：
Dmitry Duplyakin;R. Ricci;Aleksander Maricq;Gary Wong;Jonathon Duerig;E. Eide;L. Stoller;Mike Hibler;David Johnson;Kirk Webb;Aditya Akella;Kuang-Ching Wang;Glenn Ricart;L. Landweber;C. Elliott;M. Zink;E. Cecchet;Snigdhaswin Kar;Prabodh Mishra
DOI：
10.1145/3510003.3510174
发表时间：
2022-05
期刊：
2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE)
影响因子：
--
作者：
Mingyuan Wu;Ling Jiang;Jiahong Xiang;Yanwei Huang;Heming Cui;Lingming Zhang;Yuqun Zhang
通讯作者：
Mingyuan Wu;Ling Jiang;Jiahong Xiang;Yanwei Huang;Heming Cui;Lingming Zhang;Yuqun Zhang
空对空 미사일 SIDEWINDER
DOI：
--
发表时间：
1980
期刊：
影响因子：
--
作者：
Horold J. Roop;南淳錫
通讯作者：
南淳錫