论文标题
多个目标指示灰盒模糊
Multiple Targets Directed Greybox Fuzzing
论文作者
论文摘要
定向Greybox Fuzzing（DGF）可以通过寻求到达程序地点或按顺序探索某些位置来快速发现或复制程序中的错误。但是，由于它们的静态阶段分裂和粗粒度的能量调度，在面对多个目标位置时，先前的DGF工具（简称目标）。 在本文中，我们提出了多个目标的指示灰箱模糊，该目标旨在在模糊活动中访问多个程序位置。具体而言，我们提出了一种新颖的策略，以适应协调探索和剥削阶段，并通过考虑种子与目标位置之间的更多关系，一种新颖的能源调度策略。我们在一种名为Leofuzz的工具中实施了我们的方法，并在现实世界中的崩溃复制，真实的积极验证和脆弱性暴露中对其进行了评估。实验结果表明，在有效性和效率方面，LeoFuzz的表现优于六个最先进的绒毛，即Qysm，Aflgo，Lolly，Berry，Berry，Berry，Berery和Windranger。此外，Leofuzz在现实世界中检测到了23个新漏洞，其中11个已被分配给CVE ID。
Directed greybox fuzzing (DGF) can quickly discover or reproduce bugs in programs by seeking to reach a program location or explore some locations in order. However, due to their static stage division and coarse-grained energy scheduling, prior DGF tools perform poorly when facing multiple target locations (targets for short). In this paper, we present multiple targets directed greybox fuzzing which aims to reach multiple programs locations in a fuzzing campaign. Specifically, we propose a novel strategy to adaptively coordinate exploration and exploitation stages, and a novel energy scheduling strategy by considering more relations between seeds and target locations. We implement our approaches in a tool called LeoFuzz and evaluate it on crash reproduction, true positives verification, and vulnerability exposure in real-world programs. Experimental results show that LeoFuzz outperforms six state-of-the-art fuzzers, i.e., QYSM, AFLGo, Lolly, Berry, Beacon and WindRanger in terms of effectiveness and efficiency. Moreover, LeoFuzz has detected 23 new vulnerabilities in real-world programs, and 11 of them have been assigned CVE IDs.
