一句话：提出基于属性图与图划分的宏任务动态分配方法，工具 AFLTeam 提升并行模糊测试覆盖率并发现零日漏洞。
并行覆盖引导灰盒模糊测试是大规模漏洞挖掘的常用配置，但其任务分配策略研究不足；现有方法多在种子输入级管理微任务，划分算法临时或静态。本文提出宏任务级系统化动态任务分配方案：先构建属性图，同时刻画程序结构（如调用图）与模糊测试信息（分支命中计数、漏洞发现概率）；再用图划分将全局搜索空间分成子搜索空间，并用搜索算法优先探索这些任务以最大化覆盖率与漏洞数；结果反馈更新图，驱动迭代划分与探索。原型 AFLTeam 在成熟基准上相对 AFL 默认并行模式最高提升 16.4% 分支覆盖率，并在 FFmpeg 和 JasPer 中发现 2 个零日漏洞。
Parallel coverage-guided greybox fuzzing is the most common setup for vulnerability discovery at scale. However, so far it has received little attention from the research community compared to single-mode fuzzing, leaving open several problems particularly in its task allocation strategies. Current approaches focus on managing micro tasks, at the seed input level, and their task division algorithms are either ad-hoc or static. In this paper, we leverage research on graph partitioning and search algorithms to propose a systematic and dynamic task allocation solution that works at the macro-task level. First, we design an attributed graph to capture both the program structures (e.g., program call graph) and fuzzing information (e.g., branch hit counts, bug discovery probability). Second, our graph partitioning algorithm divides the global program search space into sub-search-spaces. Finally our search algorithm prioritizes these sub-search-spaces (i.e., tasks) and explores them to maximize code coverage and number of bugs found. The results are collected to update the graph and guide further iterations of partitioning and exploration. We implemented a prototype tool called AFLTeam. In our preliminary experiments on well-tested benchmarks, AFLTeam achieved higher code coverage (up to 16.4% branch coverage improvement) compared to the default parallel mode of AFL and discovered 2 zero-day bugs in FFmpeg and JasPer toolkits.
DOI 原文 ·
@inproceedings{paperbot6612,
title = {Towards Systematic and Dynamic Task Allocation for Collaborative Parallel Fuzzing},
author = {Van-Thuan Pham and Manh-Dung Nguyen and Quang-Trung Ta and Toby Murray and Benjamin I.P. Rubinstein},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678810}
}