Valkyrie: Improving Fuzzing Performance Through Deterministic Techniques
Valkyrie: Improving Fuzzing Performance Through Deterministic Techniques
复制标题
DOI：
10.1109/qrs57517.2022.00069
复制
发表时间：
2022-12
期刊：
影响因子：
--
通讯作者：
Yuyang Rong;Chibin Zhang;Jianzhong Liu;Hao Chen
中科院分区：
文献类型：
--
作者：
Yuyang Rong;Chibin Zhang;Jianzhong Liu;Hao Chen
由于在许多程序中发现虫子的成功，灰箱的绒毛受到了开发人员的关注，最先进的模糊剂在很大程度上依靠随机方法来达到新的覆盖范围。他们解决分支机构的能力并迫使他们成为最后的度假胜地。我们相信确定性的技术可提供一致的，可预测的，可再现的结果具有上下文灵敏度的分支覆盖范围，以保持准确性，同时引入仪器删除算法以减少开销。方法，补偿步骤，允许使用求解器的fuzzer适应现实世界中的fuzz脚，而无需使用随机性。内存错误，分别比AFL ++和Angora多10.5％和50％。与AFL ++和Angora相比，触发一半的错误在现实世界中达到了8.2％和12.4％的分支机构。 ，这表明确定性技术以一致性，可预测性，可重复性和性能为特朗普随机技术。
Greybox fuzzing has received much attention from developers and researchers due to its success in discovering bugs within many programs. However, randomized algorithms have limited fuzzers’ effectiveness. First, branch coverage feedback that is based on random edge ID can lead to branch collision. Besides, state-of-the-art fuzzers heavily rely on randomized methods to reach new coverage. Even fuzzers with a solver rely on incorrect assumptions, limiting their ability to solve branches and forcing them to turn to randomness as a last resort.We believe deterministic techniques deliver consistent, predictable, reproducible results. We propose Valkyrie, a greybox fuzzer whose performance is boosted primarily by deterministic techniques. Valkyrie combines collision-free branch coverage with context sensitivity to maintain accuracy while introducing an instrumentation removal algorithm to reduce overhead. It also pioneers a new mutation method, compensated step, allowing fuzzers that use solvers to adapt to real-world fuzzing scenarios without using randomness. We implement and evaluate Valkyrie’s effectiveness on the standard benchmark Magma, and a wide variety of real-world programs. Valkyrie triggered 21 unique integer and memory errors, 10.5% and 50% more than AFL++ and Angora, respectively. Valkyrie shows little to no variance across ten trials and is the fastest to trigger half of the bugs. Valkyrie reached 8.2% and 12.4% more branches in real-world programs, compared with AFL++ and Angora, respectively. We also verify that our branch counting and mutation method is better than the state-of-the-art, which shows that deterministic techniques trump random techniques in consistency, predictability, reproducibility, and performance.