期刊
ELECTRONICS
卷 10, 期 1, 页码 -出版社
MDPI
DOI: 10.3390/electronics10010011
关键词
fuzzing; optimization; gradient descent; test automation
资金
- Institute for Information and Communications Technology Promotion (IITP) - Korea government (MSIT) [2017-0-00545]
In this paper, a new type of gradient-based fuzzer called MaxAFL is proposed to overcome the limitations of existing fuzzers. MaxAFL utilizes an objective function constructed through static analysis and a gradient-based optimization algorithm. It outperforms other fuzzers in terms of code coverage and bug discovery, showcasing its effectiveness in improving fuzzing techniques.
Evolutionary fuzzers generally work well with typical software programs because of their simple algorithm. However, there is a limitation that some paths with complex constraints cannot be tested even after long execution. Fuzzers based on concolic execution have emerged to address this issue. The concolic execution fuzzers also have limitations in scalability. Recently, the gradient-based fuzzers that use a gradient to mutate inputs have been introduced. Gradient-based fuzzers can be applied to real-world programs and achieve high code coverage. However, there is a problem that the existing gradient-based fuzzers require heavyweight analysis or sufficient learning time. In this paper, we propose a new type of gradient-based fuzzer, MaxAFL, to overcome the limitations of existing gradient-based fuzzers. Our approach constructs an objective function through fine-grained static analysis. After constructing a well-made objective function, we can apply the gradient-based optimization algorithm. We use a modified gradient-descent algorithm to minimize our objective function and propose some probabilistic techniques to escape local optimum. We introduce an adaptive objective function which aims to explore various paths in the program. We implemented MaxAFL based on the original AFL. MaxAFL achieved increase of code coverage per time compared with three other fuzzers in six open-source Linux binaries. We also measured cumulative code coverage per total execution, and MaxAFL outperformed the other fuzzers in this metric. Finally, MaxAFL can also find more bugs than the other fuzzers.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据