一句话:指出灰盒模糊测试中种子/语料选择缺乏共识,呼吁系统研究其对漏洞发现的影响。
本文关注基于变异的灰盒模糊测试中的种子选择问题。作者指出,灰盒模糊测试依赖一组不会导致崩溃的种子输入(语料)来启动漏洞查找过程,但在构造语料时常见做法包括使用空文件、使用一个代表目标输入格式的种子,或从互联网等渠道收集大量种子。摘要强调,人们很少考虑这种种子选择会如何影响模糊测试过程,并且对于哪种方法最佳(甚至是否存在最佳方法)尚无共识。本文的贡献在于将种子/语料构造提升为需要系统审视的问题。由于所给摘要未展开具体方法与实验结果,无法进一步概述其技术方案和评估结论。
Mutation-based greybox fuzzing---unquestionably the most widely-used fuzzing technique---relies on a set of non-crashing seed inputs (a corpus) to bootstrap the bug-finding process. When evaluating a fuzzer, common approaches for constructing this corpus include: (i) using an empty file; (ii) using a single seed representative of the target's input format; or (iii) collecting a large number of seeds (e.g., by crawling the Internet). Little thought is given to how this seed choice affects the fuzzing process, and there is no consensus on which approach is best (or even if a best approach exists).
@inproceedings{paperbot6673,
title = {Seed selection for successful fuzzing},
author = {Adrian Herrera and Hendra Gunadi and Shane Magrath and Michael Norrish and Mathias Payer and Antony L. Hosking},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3464795}
}