一句话:提出 StorFuzz,用数据多样性度量替代仅靠代码覆盖率来判断模糊测试进展,以突破长期平台期。
模糊测试广泛用于发现软件缺陷与漏洞,但真实世界中长时间运行的模糊测试活动常陷入平台期,无法继续推进,留下未测试的代码区域。当前先进模糊器依赖代码覆盖率来度量进展并到达新区域,然而不同程序行为可能具有相同覆盖率,因此覆盖率不足以捕捉全部程序行为,既阻碍进一步探索,也可能掩盖缺陷。StorFuzz 提出利用数据多样性(data diversity)作为进展信号,以克服模糊测试平台期,从而在覆盖率停滞时仍能区分并探索新的程序行为。摘要未报告具体实验评估与结果。
Fuzzing is widely used to discover software bugs and vulnerabilities. Unfortunately, real-world long-running fuzzing campaigns often plateau and no progress can be made anymore, leaving code areas untested. State-of-the-art fuzzers leverage code coverage to measure progress and reach new areas, but this is insufficient to capture all program behavior, as code coverage may be the same for different behaviors, thus preventing progress and masking bugs.