一句话：提出利用代码复杂度优化AFL/AFLFAST功率调度，使输入更偏向高复杂度代码，以提升崩溃触发与覆盖率发现。
覆盖率引导的灰盒模糊测试旨在尽可能扩大代码覆盖率，常通过给发现新边且执行时间短的种子分配更多能量来优化功率调度。然而，仅考虑新边可能效果有限，因为复杂代码中常存在难以发现的分支；代码复杂度是衡量代码安全性的关键指标，高复杂度程序更可能隐藏分支并引发安全问题。本文提出一种利用代码复杂度优化AFL与AFLFAST功率调度过程的新型模糊测试方法，目标是生成更多偏向被测程序高复杂度代码的输入。作者在三个广泛使用的真实程序上开展初步实证研究，结果表明该方法能触发更多崩溃并提升覆盖率发现。
Coverage-guided Greybox fuzzing is regarded as a practical approach to detect software vulnerabilities, which targets to expand code coverage as much as possible. A common implementation is to assign more energy to such seeds which find new edges with less execution time. However, solely considering new edges may be less effective because some hard-to-find branches often exist in the complex code of program. Code complexity is one of the key indicators to measure the code security. Compared to the code with simple structure, the program with higher code complexity is more likely to find more branches and cause security problems. In this paper, we propose a novel fuzzing method which further uses code complexity to optimize power schedule process in AFL (American Fuzzy Lop) and AFLFAST (American Fuzzy Lop Fast). The goal of our method is to generate inputs which are more biased toward the code with higher complexity of the program under test. In addition, we conduct a preliminary empirical study under three widely used real-world programs, and the experimental results show that the proposed approach can trigger more crashes as well as improve the coverage discovery.
@inproceedings{paperbot7265,
title = {A Novel Coverage-guided Greybox Fuzzing based on Power Schedule Optimization with Time Complexity},
author = {Jinfu Chen and Shengran Wang and Saihua Cai and Chi Zhang and Haibo Chen and Jingyi Chen and Jianming Zhang},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3559550}
}