一句话：揭示灰盒 fuzzing 的自适应偏差会使现有估计量有偏，并提出偏差校正以实现残余风险、成本收益与有效性的无偏估计。
在决定是否继续一次 fuzzing 活动前，工程师需要知道程序正确性的残余风险、追加投入带来的置信度收益（成本-收益权衡），以及 fuzzer 最终能发现缺陷总数的极限（有效性）。已有的数据驱动方法可为白盒与黑盒 fuzzing 提供这类定量决策指导，但无法保证对灰盒 fuzzing——当前最流行的自动化软件漏洞发现技术——的上述三个量给出无偏估计。原因在于灰盒 fuzzer 会引入自适应偏差，使现有估计量出现系统性误差。本文针对该问题，研究如何在定量分析中校正这一自适应偏差，从而为灰盒 fuzzing 活动提供具有统计保证的残余风险、成本-收益与有效性估计，支撑可量化精度的工程决策。摘要未给出具体评估细节。
Before making important decisions about an ongoing fuzzing campaign, we believe an engineer may want to know: (i) the achieved level of confidence about the program’s correctness (residual risk), (ii) the expected increase in confidence about the program’s correctness if we invest more time for the current campaign (cost-benefit trade-off), and (iii) the total number of bugs that the fuzzer can find in the limit (effectiveness). The ability to accurately estimate the above quantities through observed data of the fuzzing campaign allows engineers to make required decisions with quantifiable accuracy. Currently, there are popular data-driven approaches to provide such quantitative guidance on decision making for white- and blackbox fuzzing campaigns. However, none of these prevailing techniques can guarantee unbiased estimation of residual risk, cost-benefit trade-off, or effectiveness for greybox fuzzing – the most popular automated software vulnerability discovery technique to date. Greybox fuzzers introduce an adaptive bias to existing estimators that needs to be corrected during the quantitative analysis to make accurate decisions about the campaign.
DOI 原文 ·
@inproceedings{paperbot6297,
title = {Security guarantees for automated software testing},
author = {Danushka Liyanage},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3473097}
}