一句话：提出模块化灰盒模糊测试框架FOT，支持插件式集成新技术，并在真实项目中发现多个漏洞。
灰盒模糊测试是检测软件漏洞的有效方法，已有大量新技术被加入模糊器的不同组件。然而，社区缺少模块化框架来方便地插入新技术并支持技术的复用、集成与比较。为此，作者提出 Fuzzing Orchestration Toolkit（FOT），强调通用、可配置和可扩展，允许以插件方式组合不同模糊测试技术。通过 FOT 及其扩展，作者在 11 个项目中发现了 111 个新缺陷，其中 18 个被分配 CVE 编号，表明该框架能有效支撑漏洞发现并促进技术集成与比较。
Greybox fuzzing is one of the most effective approaches for detecting software vulnerabilities. Various new techniques have been continuously emerging to enhance the effectiveness and/or efficiency by incorporating novel ideas into different components of a greybox fuzzer. However, there lacks a modularized fuzzing framework that can easily plugin new techniques and hence facilitate the reuse, integration and comparison of different techniques. To address this problem, we propose a fuzzing framework, namely Fuzzing Orchestration Toolkit (FOT). FOT is designed to be versatile, configurable and extensible. With FOT and its extensions, we have found 111 new bugs from 11 projects. Among these bugs, 18 CVEs have been assigned. Video link: https://youtu.be/O6Qu7BJ8RP0.
DOI 原文 ·
@inproceedings{paperbot4631,
title = {FOT: a versatile, configurable, extensible fuzzing framework},
author = {Hongxu Chen and Yuekang Li and Bihuan Chen and Yinxing Xue and Yang Liu},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3264593}
}