SaTC: CORE: Small: Concolic-Execution-Centric Fuzzing

在软件安全方面，必须发现软件中的漏洞，并在攻击者利用它们之前对其进行修补。模糊是一种有效的漏洞发现技术，它测试具有突变输入的目标程序。白盒模糊(也称为Concolic Execution)收集详细的运行时信息，如路径约束，以准确确定要更改哪些输入字节以及如何更改它们。遗憾的是，Concolic Execution由于效率低、可扩展性差、可用性差而没有得到广泛的应用。该项目旨在通过显著提高并发执行的效率、可伸缩性和可用性，并设计一个以并发执行为中心组件的模糊化系统，将漏洞发现能力提升到一个新的水平。这项拟议的研究如果成功，将把漏洞发现研究推向另一个层次：比以前更快地找到漏洞，并找到使用现有技术无法找到的漏洞。因此，在攻击者发现并利用更多漏洞之前，可以修补更多漏洞，从而提高软件系统的安全性和质量。本项目的目标是：(1)开发一个快速的二进制代码并列执行引擎，通过在具体模式和符号模式之间的自动切换，显著提高二进制代码并列执行的效率；(2)双重并列执行，将源代码并列执行和二进制代码并列执行相结合，同时达到最佳的效率和可用性；以及(3)新的混合模糊框架，在是否翻转分支、下一步选择哪个测试用例以及哪些测试用例被丢弃或与其他模糊测试同步方面，联合执行发挥了核心作用。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

In software security, it is imperative to discover vulnerabilities in software and patch them before attackers exploit them. Fuzzing, which tests a target program with mutated inputs, is an effective technique for vulnerability discovery. Whitebox fuzzing (also known as concolic execution) collects detailed runtime information such as path constraints to precisely determine which input bytes to change and how to change them. Unfortunately, concolic execution has not been widely used, because of its low efficiency, lack of scalability, and unsatisfactory usability. This project aims to bring vulnerability discovery capability to the next level by significantly improving the efficiency, scalability, and usability of concolic execution, and designing a fuzzing system with concolic execution being the central component. The proposed research, if successful, can push vulnerability-discovery research to another level: finding vulnerabilities much faster than before, and finding vulnerabilities that are otherwise impossible to find using the existing techniques. As a result, more vulnerabilities can be patched before attackers find and exploit them, improving the security and quality of software systems. This project aims to develop: (1) a fast binary-code concolic execution engine, which significantly improves the efficiency of concolic execution for binary code by automatically switching between concrete mode and symbolic mode; (2) dual concolic execution, which combines source-code concolic execution and binary-code concolic execution to achieve best efficiency and usability simultaneously; and (3) a new hybrid fuzzing framework, in which concolic execution plays a central role, in terms of whether or not to flip a branch, which testcase to select next, and which testcases are discarded or synchronized with the other fuzzers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.