期刊
IEEE TRANSACTIONS ON SOFTWARE ENGINEERING
卷 47, 期 9, 页码 1980-1997出版社
IEEE COMPUTER SOC
DOI: 10.1109/TSE.2019.2941681
关键词
Fuzzing; Computer bugs; Libraries; Tools; Dictionaries; Open area test sites; Schedules; Vulnerability detection; smart fuzzing; automated testing; file format; grammar; input structure
资金
- National Research Foundation, Prime Ministers Office, Singapore under its National Cybersecurity R&D Program (TSUNAMi project) [NRF2014NCRNCR001-21]
- Australian Government through an Australian Research Council [DE190100046]
- Australian Research Council [DE190100046] Funding Source: Australian Research Council
Coverage-based greybox fuzzing is a successful method for automated vulnerability detection, but random bitflips may not generate valid files for complex file formats. The introduction of smart greybox fuzzing leverages a high-level structural representation of seed files, with innovative mutation operators that work on the virtual file structure to explore new input domains while maintaining file validity. This approach demonstrates effectiveness in discovering zero-day vulnerabilities and exposing more vulnerabilities in widely-used tools and libraries compared to traditional methods.
Coverage-based greybox fuzzing (CGF) is one of the most successful approaches for automated vulnerability detection. Given a seed file (as a sequence of bits), a CGF randomly flips, deletes or copies some bits to generate new files. CGF iteratively constructs (and fuzzes) a seed corpus by retaining those generated files which enhance coverage. However, random bitflips are unlikely to produce valid files (or valid chunks in files), for applications processing complex file formats. In this work, we introduce smart greybox fuzzing (SGF) which leverages a high-level structural representation of the seed file to generate new files. We define innovative mutation operators that work on the virtual file structure rather than on the bit level which allows SGF to explore completely new input domains while maintaining file validity. We introduce a novel validity-based power schedule that enables SGF to spend more time generating files that are more likely to pass the parsing stage of the program, which can expose vulnerabilities much deeper in the processing logic. Our evaluation demonstrates the effectiveness of SGF. On several libraries that parse complex chunk-based files, our tool AFLsmart achieves substantially more branch coverage (up to 87 percent improvement) and exposes more vulnerabilities than baseline AFL. Our tool AFLsmart discovered 42 zero-day vulnerabilities in widely-used, well-tested tools and libraries; 22 CVEs were assigned.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据