Collaborative Research: SaTC: CORE: Small: Self-Driving Continuous Fuzzing

持续模糊测试是一种新兴的软件测试范式，近年来获得了显著的发展。在这个范例中，当一个软件正在开发/更新时，一个模糊器被24/7地应用于一个软件，希望模糊器能尽快找到软件的错误。它在查找大型复杂软件（如Linux内核）中的错误方面已被证明是有效的，例如，在过去几年中发现了数千个错误和漏洞。尽管取得了明显的成功，但这个项目发现了当今持续的模糊测试的一个重要限制：发现bug的明显延迟。这主要是由于缺乏内置功能来进行调整/改进，并随着时间的推移了解其性能。我们把这种能力称为“自我驱动”。我们认为这是一种关键能力，因为(1)设计上的持续模糊测试需要支持快速变化的模糊测试目标（正在开发中），(2)投入大量资源，并且应该有效地利用它们。该项目进一步发现(1)这种延迟的第一部分是因为连续模糊器最初无法找到一些bug，(2)这种延迟的第二部分是因为连续模糊器未能有效地使用其资源来找到它已经能够找到的bug。项目的成功完成将使持续的模糊测试能够更快地找到错误和漏洞。因此，该项目将有助于通过持续模糊测试提高软件系统的质量，这最终有利于社会和经济。这个项目调查了两个研究重点来解决上述限制。第一个推力的目标是提高连续模糊器发现以前无法发现的错误的能力。更具体地说，它开发了连续生成和细化软件接口描述的能力。它研究了结合各种分析技术的新方法，以克服分析大规模软件的挑战，提供自我校正的能力，更好的精度和可扩展性。第二个推力的目标是使连续模糊器能够更快地找到它能够找到的错误。这个推力研究连续模糊器的调度程序。调度器的目标是优化连续模糊器现有资源的使用，以充分模糊给定软件的所有接口。本文还探讨了连续模糊器的资源规划策略，以动态和自动地调整可用资源的数量，从而在bug查找延迟方面达到可接受的性能。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Continuous fuzzing is an emerging software testing paradigm that has gained significant traction in recent years. In this paradigm, a fuzzer is applied 24/7 to a piece of software as it is being developed/updated, hoping that the fuzzer can find the software bugs as soon as possible. It has been shown to be effective in finding bugs in large and complex pieces of software such as the Linux kernel, e.g., finding thousands of bugs and vulnerabilities in the past few years. Despite its perceived success, this project identifies an important limitation in today’s continuous fuzzing: a significant delay in finding a bug. This is fundamentally due to the lack of built-in features to make adjustments/improvements and be aware of its performance over time in general. We refer to this ability as “self-drive”. We argue that this is a critical ability because continuous fuzzing (1) by design needs to support the rapidly changing fuzzing target (under development) and (2) invests a large amount of resources and should use them effectively. The project further finds that (1) the first part of this delay is because the continuous fuzzer is initially incapable of finding some bugs, and (2) the second part of this delay is because the continuous fuzzer fails to use its resources effectively to find the bugs that it is already capable of finding. The successful completion of the project will enable continuous fuzzing to find bugs and vulnerabilities faster. Consequently, the project will help improve the quality of software systems tested with continuous fuzzing, which ultimately benefits society and the economy at large. This project investigates two research thrusts to address the aforementioned limitation. The goal of the first thrust is to improve the capability of the continuous fuzzer to find bugs that it could not find before. More specifically, it develops the capability of continuous generation and refinement of software interface descriptions. It investigates novel methods that combine various analysis techniques to overcome the challenge of analyzing a large-scale piece of software, providing the ability of self-correction and better precision and scalability. The goal of the second thrust is to enable the continuous fuzzer to find the bugs that it is capable of finding faster. This thrust investigates a scheduler for the continuous fuzzer. The goal of the scheduler is to optimize the use of existing resources of a continuous fuzzer to adequately fuzz all the interfaces of a given piece of software. It also explores a resource planning strategy for the continuous fuzzer to dynamically and automatically adjust the amount of resources available to it to achieve acceptable performance in terms of bug-finding delay.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.