一句话：提出 PerfFuzz，通过多维反馈的变异模糊测试自动生成触发程序病态性能的输入。
软件在遇到最坏情况输入时会出现意外性能问题，但现有工作多依赖统计剖析诊断，如何自动找到这类输入仍具挑战。PerfFuzz 无需领域知识，基于反馈引导的变异模糊测试生成病态输入。与只最大化总执行路径长度等标量指标的方法不同，它采用多维反馈，独立最大化所有程序位置的执行次数，从而发现覆盖不同热点的多样输入，并绕过局部极大值获得更长总执行路径。作者在流行覆盖引导模糊测试工具 AFL 上实现 PerfFuzz，并在四个常用真实 C 程序上评估。结果表明，其生成的输入使最常命中的程序分支执行次数比先前工作高 5 到 69 倍，总执行路径长 1.9 到 24.7 倍，并能有效揭示算法复杂度漏洞。
Performance problems in software can arise unexpectedly when programs are provided with inputs that exhibit worst-case behavior. A large body of work has focused on diagnosing such problems via statistical profiling techniques. But how does one find these inputs in the first place? We present PerfFuzz, a method to automatically generate inputs that exercise pathological behavior across program locations, without any domain knowledge. PerfFuzz generates inputs via feedback-directed mutational fuzzing. Unlike previous approaches that attempt to maximize only a scalar characteristic such as the total execution path length, PerfFuzz uses multi-dimensional feedback and independently maximizes execution counts for all program locations. This enables PerfFuzz to (1) find a variety of inputs that exercise distinct hot spots in a program and (2) generate inputs with higher total execution path length than previous approaches by escaping local maxima. PerfFuzz is also effective at generating inputs that demonstrate algorithmic complexity vulnerabilities. We implement PerfFuzz on top of AFL, a popular coverage-guided fuzzing tool, and evaluate PerfFuzz on four real-world C programs typically used in the fuzzing literature. We find that PerfFuzz outperforms prior work by generating inputs that exercise the most-hit program branch 5x to 69x times more, and result in 1.9x to 24.7x longer total execution paths.
DOI 原文 ·
@inproceedings{paperbot4812,
title = {PerfFuzz: automatically generating pathological inputs},
author = {Caroline Lemieux and Rohan Padhye and Koushik Sen and Dawn Song},
booktitle = {ISSTA},
year = {2018},
doi = {10.1145/3213846.3213874}
}