一句话：提出上下文感知自适应模糊测试器 Cerebro，通过多目标种子排序与输入潜力调度，发现更多漏洞并提升覆盖率。
现有灰盒模糊测试主要以程序覆盖率为目标来引导测试过程，但为最大化产出，需要合理评估种子质量，即决定下一步优先模糊哪个种子（种子优先级排序）以及对当前种子投入多少模糊努力（功率调度）。本文提出模糊测试器 Cerebro 来应对这两个挑战。针对种子优先级排序，作者提出一种在线多目标算法，在代码复杂度、覆盖率、执行时间等多个指标之间进行权衡；针对功率调度，引入输入潜力（input potential）概念来度量未覆盖代码的复杂度，并提出一种低成本算法动态更新该潜力。与仅依据已覆盖执行轨迹评估输入的传统方法不同，Cerebro 能通过自适应评估输入潜力来预见模糊该输入的收益。作者在 8 个真实程序上对 Cerebro 进行了充分评估，实验表明其相比 AFL、AFLFast 等最先进模糊测试器能发现更多漏洞并获得更好的覆盖率。
Existing greybox fuzzers mainly utilize program coverage as the goal to guide the fuzzing process. To maximize their outputs, coverage-based greybox fuzzers need to evaluate the quality of seeds properly, which involves making two decisions: 1) which is the most promising seed to fuzz next (seed prioritization), and 2) how many efforts should be made to the current seed (power scheduling). In this paper, we present our fuzzer, Cerebro, to address the above challenges. For the seed prioritization problem, we propose an online multi-objective based algorithm to balance various metrics such as code complexity, coverage, execution time, etc. To address the power scheduling problem, we introduce the concept of input potential to measure the complexity of uncovered code and propose a cost-effective algorithm to update it dynamically. Unlike previous approaches where the fuzzer evaluates an input solely based on the execution traces that it has covered, Cerebro is able to foresee the benefits of fuzzing the input by adaptively evaluating its input potential. We perform a thorough evaluation for Cerebro on 8 different real-world programs. The experiments show that Cerebro can find more vulnerabilities and achieve better coverage than state-of-the-art fuzzers such as AFL and AFLFast.
@inproceedings{paperbot5135,
title = {Cerebro: context-aware adaptive fuzzing for effective vulnerability detection},
author = {Yuekang Li and Yinxing Xue and Hongxu Chen and Xiuheng Wu and Cen Zhang and Xiaofei Xie and Haijun Wang and Yang Liu},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3338975}
}