一句话：提出首个能区分执行信息组合的灰盒模糊测试器 Ankou，显著提升缺陷发现效率。
现有灰盒模糊测试的适应度函数仅考虑覆盖数据的并集，而非其组合，因而无法区分覆盖相同的不同执行，导致搜索常陷入局部最优。本文提出 Ankou，首个能够识别执行信息不同组合的灰盒模糊测试器，并讨论了设计与实现中遇到的可扩展性挑战。实验结果表明，Ankou 在发现缺陷方面分别比 AFL 和 Angora 有效 1.94 倍和 8.0 倍。
Grey-box fuzzing is an evolutionary process, which maintains and evolves a population of test cases with the help of a fitness function. Fitness functions used by current grey-box fuzzers are not informative in that they cannot distinguish different program executions as long as those executions achieve the same coverage. The problem is that current fitness functions only consider a union of data, but not their combination. As such, fuzzers often get stuck in a local optimum during their search. In this paper, we introduce Ankou, the first grey-box fuzzer that recognizes different combinations of execution information, and present several scalability challenges encountered while designing and implementing Ankou. Our experimental results show that Ankou is 1.94× and 8.0× more effective in finding bugs than AFL and Angora, respectively.
DOI 原文 ·
@inproceedings{paperbot5592,
title = {Ankou},
author = {Valentin J. M. Manès and Soomin Kim and Sang Kil Cha},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380421}
}