CAREER: Context-Sensitive Fuzzing for Networked Systems

面向internet的安全关键型网络协议很容易被寻求破坏整体安全性的远程攻击者利用。这些攻击者使用精心设计的输入来利用协议实现中未公开或未修补的安全漏洞（bug）。尽管有bug识别和修补的通用策略，但在协议实现中发现难以捉摸的bug仍然具有挑战性，因为它需要通过严格的输入验证来发现潜伏在代码深处的bug。模糊测试得到了美国国家标准与技术研究所（NIST）的认可，它通过向程序传递异常输入来自动进行安全测试，从而发现漏洞。虽然模糊测试已经有效地发现了许多现实世界系统中的错误，但除了初始输入验证之外，它仍然难以生成语义正确的测试输入。该项目通过开发一种创新的自动化解决方案，有效地增强了协议实现的测试，弥合了传统模糊测试中的这一差距。这个项目的核心目标是开发一种自动化的、上下文敏感的模糊测试方法，有效地发现安全关键协议实现中的错误。该项目通过三个互补的研究重点来实现其目标。第一个重点是设计一种领域特定语言来编码上下文敏感的输入层次结构，并开发算法来有效地生成语义正确的输入。第二个推力设计了几种突变技术，这对模糊化至关重要，将保持输入的上下文敏感性。第三个重点是开发忠实地维护有状态协议的内部状态的机制，以便可以在协议的适当状态下测试每个模糊输入。该项目有可能显著增强协议实现的鲁棒性，造福社会。该项目的教育部分包括组织夺旗（CTF）比赛，改进网络安全课程，以及举办K-12研讨会以提高网络安全意识。将招收来自历史上被边缘化社区的本科生和研究生，以增加他们对研究和教育活动的参与。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Internet-facing security-critical network protocols are susceptible to exploitation by remote adversaries seeking to compromise overall security. These adversaries employ crafted inputs to exploit undisclosed or unpatched security flaws (bugs) in protocol implementations. Despite the common strategy of bug identification and patching, unearthing elusive bugs in protocol implementations remains challenging as it requires navigating stringent input validation to discover bugs that lurk deep in the code. Fuzzing, endorsed by the National Institute of Standards and Technology (NIST), automates security testing by passing abnormal inputs to programs in order to discover bugs. While fuzzing has effectively uncovered bugs in many real-world systems, it still struggles to generate semantically correct inputs essential for testing beyond initial input validation. This project bridges this gap in traditional fuzzing by developing an innovative automated solution that effectively enhances the testing of protocol implementations. The core objective of this project is to develop an automated, context-sensitive fuzzing approach that effectively uncovers bugs in security-critical protocol implementations. This project realizes its objective through activities across three complementary research thrusts. The first thrust designs a domain specific language to encode context-sensitive hierarchical structures of inputs and develops algorithms to efficiently generate semantically correct inputs. The second thrust devises several mutation techniques, essential for fuzzing, that will maintain the context-sensitivity of the input. The third thrust develops mechanisms to faithfully maintain the internal state of a stateful protocol so that each fuzz input can be tested in a suitable state of the protocol.This project has the potential to significantly enhance the robustness of protocol implementations, benefiting society. This project's education component includes organizing capture-the-flag (CTF) competitions, improving cybersecurity courses, and conducting K-12 workshops to raise cybersecurity awareness. Undergraduate and graduate students from historically marginalized communities will be recruited to increase their participation in research and educational activities.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.