Rare Path Guided Fuzzing
Rare Path Guided Fuzzing
复制标题
DOI：
10.1145/3597926.3598136
复制
发表时间：
2023-07
期刊：
影响因子：
--
通讯作者：
Seemanta Saha;Laboni Sarker;Md Shafiuzzaman;Chaofan Shou;Albert Li;Ganesh Sankaran;T. Bultan
中科院分区：
文献类型：
--
作者：
Seemanta Saha;Laboni Sarker;Md Shafiuzzaman;Chaofan Shou;Albert Li;Ganesh Sankaran;T. Bultan
从一个随机的初始种子开始，fuzzers搜索触发bug或漏洞的输入。然而，模糊器经常不能为受限制性分支条件保护的程序路径生成输入。在本文中，我们表明，通过首先识别程序中的稀有路径（即，具有随机输入生成不太可能满足的路径约束的程序路径），然后，生成触发稀有路径的输入/种子，可以提高模糊工具的覆盖率。特别地，我们提出了1)使用定量符号分析识别稀有路径的技术，以及2)使用路径引导的结肠执行生成可以探索这些稀有路径的输入。我们将这些输入作为初始种子集提供给三个最先进的模糊器。我们对一组程序的实验评估表明，与随机初始种子相比，模糊器使用基于稀有路径的种子集获得了更好的覆盖。
Starting with a random initial seed, fuzzers search for inputs that trigger bugs or vulnerabilities. However, fuzzers often fail to generate inputs for program paths guarded by restrictive branch conditions. In this paper, we show that by first identifying rare-paths in programs (i.e., program paths with path constraints that are unlikely to be satisfied by random input generation), and then, generating inputs/seeds that trigger rare-paths, one can improve the coverage of fuzzing tools. In particular, we present techniques 1) that identify rare paths using quantitative symbolic analysis, and 2) generate inputs that can explore these rare paths using path-guided concolic execution. We provide these inputs as initial seed sets to three state of the art fuzzers. Our experimental evaluation on a set of programs shows that the fuzzers achieve better coverage with the rare-path based seed set compared to a random initial seed.