一句话：从信息论出发，将模糊测试视为学习过程，用熵量化输入揭示的行为信息，并表明熵可度量 fuzzer 效率。
论文从信息论视角研究模糊测试的效率问题。作者把 fuzzing 视为一个学习过程：在测试前对程序 P 的行为一无所知，每执行一个测试输入，要么观察到已有行为，要么发现新行为，因此每次执行都揭示关于 P 行为的一定信息。为刻画这种信息量，作者采用 Shannon 熵，并在概率模型下分析熵与 fuzzer 效率之间的关系。其核心论点是，熵不仅可以量化每个生成测试输入让 fuzzer 学到多少程序行为，还能度量 fuzzer 发现新行为的一般速率。直观上，高效的 fuzzer 会最大化所获得的信息。该工作为理解、比较和提升 fuzzer 效率提供了信息论层面的理论基础，摘要未报告具体实验评估。
In this paper, we take the fundamental perspective of fuzzing as a learning process. Suppose before fuzzing, we know nothing about the behaviors of a program P: What does it do? Executing the first test input, we learn how P behaves for this input. Executing the next input, we either observe the same or discover a new behavior. As such, each execution reveals ”some amount” of information about P’s behaviors. A classic measure of information is Shannon’s entropy. Measuring entropy allows us to quantify how much is learned from each generated test input about the behaviors of the program. Within a probabilistic model of fuzzing, we show how entropy also measures fuzzer efficiency. Specifically, it measures the general rate at which the fuzzer discovers new behaviors. Intuitively, efficient fuzzers maximize information.
DOI 原文 ·
@inproceedings{paperbot5720,
title = {Boosting fuzzer efficiency: an information theoretic perspective},
author = {Marcel Böhme and Valentin J. M. Manès and Sang Kil Cha},
booktitle = {FSE},
year = {2020},
doi = {10.1145/3368089.3409748}
}