一句话：针对定向灰盒模糊测试，指出现有种子距离计算忽略基本块重要性与偏差基本块的问题。
定向灰盒模糊测试（DGF）通过优先选择执行轨迹更接近目标点的种子，引导模糊测试器到达预设目标，因此种子距离评估至关重要。已有代表性工作 AFLGo 在静态分析阶段计算基本块级距离，并累加执行轨迹上各基本块的距离；后续多数先进 DGF 方法也沿用这一思路，即使用执行轨迹上的所有基本块且仅利用控制流信息。该摘要指出现有做法的局限：并非所有基本块同等重要，并且执行轨迹中存在开始偏离目标点的“偏差基本块”（deviation basic blocks）。论文标题 WindRanger 表明其为一个 DGF 系统/工具，但所给摘要未提供具体方法细节与实验结果。
Directed grey-box fuzzing (DGF) is a security testing technique that aims to steer the fuzzer towards predefined target sites in the program. To gain directedness, DGF prioritizes the seeds whose execution traces are closer to the target sites. Therefore, evaluating the distance between the execution trace of a seed and the target sites (aka, the seed distance) is important for DGF. The first directed grey-box fuzzer, AFLGo, uses an approach of calculating the basic block level distances during static analysis and accumulating the distances of the executed basic blocks to compute the seed distance. Following AFLGo, most of the existing state-of-the-art DGF techniques use all the basic blocks on the execution trace and only the control flow information for seed distance calculation. However, not every basic block is equally important and there are certain basic blocks where the execution trace starts to deviate from the target sites (aka, deviation basic blocks).
DOI 原文 ·
@inproceedings{paperbot6904,
title = {WindRanger},
author = {Zhengjie Du and Yuekang Li and Yang Liu and Bing Mao},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510197}
}