Optimizing Seed Selection for Fuzzing
Optimizing Seed Selection for Fuzzing
复制标题
DOI：
--
复制
发表时间：
2014-08
期刊：
影响因子：
--
通讯作者：
Alexandre Rebert;S. Cha;Thanassis Avgerinos;Jonathan Foote;D. Warren;Gustavo Grieco;David Brumley
中科院分区：
文献类型：
--
作者：
Alexandre Rebert;S. Cha;Thanassis Avgerinos;Jonathan Foote;D. Warren;Gustavo Grieco;David Brumley
随机突变格式良好的程序输入或简单地进行模糊处理，是一种高效且广泛使用的软件缺陷查找策略。除了展示毛茸茸寻找臭虫之外，几乎没有系统性的努力来理解如何正确地毛茸茸的科学。在这篇文章中，我们专注于如何数学地表达和推理模糊中的一个关键方面：如何最好地挑选种子文件，以最大限度地增加在模糊活动中发现的错误总数。我们在Amazon Elastic Compute Cloud(EC2)上使用超过650天的CPU时间设计并评估了六种不同的算法，以提供基本事实数据。总体而言，我们在8个应用程序中发现了240个错误，并表明算法的选择可以大大增加发现的错误数量。我们还表明，目前在桃树上发现的种子选择策略可能并不比随机采摘种子更好。我们公开我们的数据集和代码。
Randomly mutating well-formed program inputs or simply fuzzing, is a highly effective and widely used strategy to find bugs in software. Other than showing fuzzers find bugs, there has been little systematic effort in understanding the science of how to fuzz properly. In this paper, we focus on how to mathematically formulate and reason about one critical aspect in fuzzing: how best to pick seed files to maximize the total number of bugs found during a fuzz campaign. We design and evaluate six different algorithms using over 650 CPU days on Amazon Elastic Compute Cloud (EC2) to provide ground truth data. Overall, we find 240 bugs in 8 applications and show that the choice of algorithm can greatly increase the number of bugs found. We also show that current seed selection strategies as found in Peach may fare no better than picking seeds at random. We make our data set and code publicly available.