一句话：提出基于分组的语料调度策略并实现 glibFuzzer，提升并行模糊测试的任务划分与语料分配效率。
并行模糊测试依赖硬件资源保证吞吐与效率，但任务划分和语料分配常被忽视。本文提出基于分组的语料调度策略：先将全局语料划分为不同子集，再为其分配能量分数与差异分数；能量分数主要由种子大小和覆盖信息长度决定，差异分数描述不同种子子集所覆盖代码的差异程度。每轮关键局部语料构建时，主节点结合两种分数选择高质量种子，以提升测试效率并避免任务冲突。作者实现了并行模糊器 glibFuzzer，该策略已被 LLVM 社区接收。在真实程序与 FuzzBench 上的评估表明，经过 4×24 CPU 小时，glibFuzzer 在 18 个真实程序上比 libFuzzer 多覆盖 22.02% 分支、执行测试用例数多 19.42 倍，并相较 AFL、PAFL、UniFuzz 平均分支覆盖率分别提升 73.02%、55.02%、55.86%，还发现了 100 多个独特漏洞。
Parallel fuzzing relies on hardware resources to guarantee test throughput and efficiency. In industrial practice, it is well known that parallel fuzzing faces the challenge of task division, but most works neglect the important process of corpus allocation. In this paper, we proposed a group-based corpus scheduling strategy to address these two issues, which has been accepted by the LLVM community. And we implement a parallel fuzzer based on this strategy called glibFuzzer. glibFuzzer first groups the global corpus into different subsets and then assigns different energy scores and different scores to them. The energy scores were mainly determined by the seed size and the length of coverage information, and the difference score can describe the degree of difference in the code covered by different subsets of seeds. In each round of key local corpus construction, the master node selects high-quality seeds by combining the two scores to improve test efficiency and avoid task conflict. To prove the effectiveness of the strategy, we conducted an extensive evaluation on the real-world programs and FuzzBench. After 4×24 CPU-hours, glibFuzzer covered 22.02% more branches and executed 19.42 times more test cases than libFuzzer in 18 real-world programs. glibFuzzer showed an average branch coverage increase of 73.02%, 55.02%, 55.86% over AFL, PAFL, UniFuzz, respectively. More importantly, glibFuzzer found over 100 unique vulnerabilities.
DOI 原文 ·
@inproceedings{paperbot6981,
title = {Group-based corpus scheduling for parallel fuzzing},
author = {Taotao Gu and Xiang Li and Shuaibing Lu and Jianwen Tian and Yuanping Nie and Xiaohui Kuang and Zhechao Lin and Chenyifan Liu and Jie Liang and Yu Jiang},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3560885}
}