一句话：提出用轻量程序变换近似真实修复，将模糊测试崩溃输入精确归类到唯一缺陷。
大规模模糊测试会产生海量崩溃输入，现有基于栈哈希等启发式去重方法虽快但不精确，大量看似唯一的崩溃仍可能对应同一缺陷，需人工筛查。本文提出 Semantic Crash Bucketing，一种通用的崩溃分桶方法：通过程序变换引入语义 delta，将崩溃输入映射到唯一缺陷。其核心洞察是真实修复能精确识别同一缺陷的崩溃，因而用轻量近似修复逼近真实修复的精度。方法利用 patch templates 与程序语义反馈，自动生成并应用面向常见缺陷类别的近似修复。在三个先进 fuzzer 上的评估表明，近似修复的归类效果可与真实修复竞争，并显著优于内置去重技术。
Precise crash triage is important for automated dynamic testing tools, like fuzzers. At scale, fuzzers produce millions of crashing inputs. Fuzzers use heuristics, like stack hashes, to cut down on duplicate bug reports. These heuristics are fast, but often imprecise: even after deduplication, hundreds of uniquely reported crashes can still correspond to the same bug. Remaining crashes must be inspected manually, incurring considerable effort. In this paper we present Semantic Crash Bucketing, a generic method for precise crash bucketing using program transformation. Semantic Crash Bucketing maps crashing inputs to unique bugs as a function of changing a program (i.e., a semantic delta). We observe that a real bug fix precisely identifies crashes belonging to the same bug. Our insight is to approximate real bug fixes with lightweight program transformation to obtain the same level of precision. Our approach uses (a) patch templates and (b) semantic feedback from the program to automatically generate and apply approximate fixes for general bug classes. Our evaluation shows that approximate fixes are competitive with using true fixes for crash bucketing, and significantly outperforms built-in deduplication techniques for three state of the art fuzzers.
DOI 原文 ·
@inproceedings{paperbot4743,
title = {Semantic crash bucketing},
author = {Rijnard van Tonder and John Kotheimer and Claire Le Goues},
booktitle = {ASE},
year = {2018},
doi = {10.1145/3238147.3238200}
}