一句话：通过定量符号分析识别稀有路径，并用路径引导的 concolic execution 生成初始种子，提升模糊测试覆盖率。
模糊测试通常从随机初始种子出发，但面对受严格分支条件保护的路径时，往往难以生成能通过约束的输入。本文提出先识别程序中的稀有路径，即路径约束很难被随机输入生成所满足的路径，再为其生成可触发的输入作为种子。具体技术包括：1）利用定量符号分析识别稀有路径；2）通过路径引导的 concolic execution 生成能探索这些稀有路径的输入。作者将这些输入作为初始种子集提供给三种当前最优的模糊测试工具，并在多个程序上开展实验。结果表明，与随机初始种子相比，基于稀有路径的种子集能让模糊测试工具获得更高的覆盖率。
Starting with a random initial seed, fuzzers search for inputs that trigger bugs or vulnerabilities. However, fuzzers often fail to generate inputs for program paths guarded by restrictive branch conditions. In this paper, we show that by first identifying rare-paths in programs (i.e., program paths with path constraints that are unlikely to be satisfied by random input generation), and then, generating inputs/seeds that trigger rare-paths, one can improve the coverage of fuzzing tools. In particular, we present techniques 1) that identify rare paths using quantitative symbolic analysis, and 2) generate inputs that can explore these rare paths using path-guided concolic execution. We provide these inputs as initial seed sets to three state of the art fuzzers. Our experimental evaluation on a set of programs shows that the fuzzers achieve better coverage with the rare-path based seed set compared to a random initial seed.
@inproceedings{SahaSSSLSB23,
title = {Rare Path Guided Fuzzing},
author = {Seemanta Saha and Laboni Sarker and Md Shafiuzzaman and Chaofan Shou and Albert Li and Ganesh Sankaran and Tevfik Bultan},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598136}
}