一句话：提出 Minerva，用动态 mod-ref 分析揭示浏览器 API 间关系以缩小模糊测试搜索空间。
现代 Web 浏览器暴露大量复杂 API，显著扩大攻击面。模糊测试通过生成大量随机 API 调用检测漏洞，但任意 API 组合构成巨大搜索空间：随机选取的调用往往互不干扰（如仅在部分共享数据上计算），导致少量有趣的 API 交互被探索。Minerva 针对这一难题，引入动态 mod-ref 分析来揭示 API 之间的修改与引用关系，并据此指导测试用例生成，从而缩减搜索空间、提高浏览器 API 模糊测试发现漏洞的效率。摘要未给出具体实验评估与量化结果。
Browser APIs are essential to the modern web experience. Due to their large number and complexity, they vastly expand the attack surface of browsers. To detect vulnerabilities in these APIs, fuzzers generate test cases with a large amount of random API invocations. However, the massive search space formed by arbitrary API combinations hinders their effectiveness: since randomly-picked API invocations unlikely interfere with each other (i.e., compute on partially shared data), few interesting API interactions are explored. Consequently, reducing the search space by revealing inter-API relations is a major challenge in browser fuzzing.
@inproceedings{paperbot7051,
title = {Minerva: browser API fuzzing with dynamic mod-ref analysis},
author = {Chijin Zhou and Quan Zhang and Mingzhe Wang and Lihua Guo and Jie Liang and Zhe Liu and Mathias Payer and Yu Jiang},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3549107}
}