Improved Fuzz Testing Approach Based on Coverage Frequency
CSTR:
Author:
Affiliation:

Clc Number:

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    In recent years, fuzz testing has become one of the most popular and efficient methods to detect program bugs and vulnerabilities. By mutating seed files, fuzzing tools generate a large volume of test inputs, and feed them to the program under test in order to expose security weakness. Current researches mostly focus on improving the mutation algorithm to make newly generated files cover more target program codes. However, little attention had been paid to elaborately optimizing the policies to sort seed files to be fuzzed, which prioritizes the seed files with higher probability to cover new program spaces in the fuzzing process, and consequently improves the efficiency of fuzzing. Therefore, we proposed a coverage frequency based selection approach to guide the fuzzer to execute promising seed files first. To do so, we first kept tracking how many times each edge between two basic blocks has been executed by the target program in the fuzz testing. Based on the number that each edge has been executed, we then categorized them into high-frequency edges and low-frequency edges. Only seeds containing more low-frequency edges, as well as being executed very fast by the target program, were assigned with high priority. We implemented our method on American Fuzzy Lop (AFL), one of the most popular fuzzers and applied the modified AFL version to 5 real world programs. The result shows that our approach can improve both the efficiency of AFL and the code coverage explored in the target program.

    Reference
    Related
    Cited by
Get Citation

傅玉,石东辉,张阳,程亮.基于覆盖频率的模糊测试改进方法.计算机系统应用,2019,28(1):17-24

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:June 20,2018
  • Revised:July 12,2018
  • Adopted:
  • Online: December 07,2018
  • Published:
Article QR Code
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-3
Address:4# South Fourth Street, Zhongguancun,Haidian, Beijing,Postal Code:100190
Phone:010-62661041 Fax: Email:csa (a) iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063