一句话：提出交互式可视化工具 VisFuzz，实时展示调用图、控制流图与约束上下文，帮助工程师定位阻塞约束并干预 fuzzing。
模糊测试广泛用于漏洞检测，但难以覆盖由魔数、嵌套条件等约束保护的代码；近期白盒方法虽部分缓解该问题，对数组排序、虚函数调用、树集合查询等高层约束仍力不从心。本文提出 VisFuzz，一个通过实时可视化帮助理解和干预 fuzzing 过程的交互式工具：它从源码提取调用图与控制流图，将每个函数与基本块映射到源码行，并在展示实时执行统计的同时给出详细的约束上下文。借助该工具，测试工程师可以先定位阻塞性约束，再理解其语义上下文，从而构造有针对性的输入或更新测试驱动。作者在 Google fuzzer-test-suite 的四个真实程序上开展初步评估：在额外花费 15 分钟理解并干预 fuzzing 状态后，干预后的 fuzzing 优于原始纯 AFL，在同等 12 小时 fuzzing 预算下路径覆盖率提升 10.84% 至 150.58%。
Fuzzing is widely used for vulnerability detection. One of the challenges for an efficient fuzzing is covering code guarded by constraints such as the magic number and nested conditions. Recently, academia has partially addressed the challenge via whitebox methods. However, high-level constraints such as array sorts, virtual function invocations, and tree set queries are yet to be handled. To meet this end, we present VisFuzz, an interactive tool for better understanding and intervening fuzzing process via real-time visualization. It extracts call graph and control flow graph from source code, maps each function and basic block to the line of source code and tracks real-time execution statistics with detail constraint contexts. With VisFuzz, test engineers first locate blocking constraints and then learn its semantic context, which helps to craft targeted inputs or update test drivers. Preliminary evaluations are conducted on four real-world programs in Google fuzzer-test-suite. Given additional 15 minutes to understand and intervene the state of fuzzing, the intervened fuzzing outperform the original pure AFL fuzzing, and the path coverage improvements range from 10.84% to 150.58%, equally fuzzed by for 12 hours.
DOI 原文 ·
@inproceedings{paperbot5229,
title = {VisFuzz: Understanding and Intervening Fuzzing with Interactive Visualization},
author = {Chijin Zhou and Mingzhe Wang and Jie Liang and Zhe Liu and Chengnian Sun and Yu Jiang},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00106}
}