一句话：提出 DDGF，利用路径剖析实现动态内省与动态定向，让用户实时引导模糊测试聚焦选定路径。
覆盖引导模糊测试（CGF）是当前最流行的漏洞检测方法，但通常以自动化“黑盒”方式运行。测试一段时间后，CGF 逐渐难以发现新覆盖，用户既难以解释停滞原因，也无法判断现有覆盖是否充分，更无法交互式引导测试过程。本文设计动态定向灰盒模糊测试（DDGF），促进用户与模糊测试器之间的协作。基于 Ball-Larus 路径剖析算法，作者提出动态内省与动态定向两项新技术：动态内省通过编码与解码揭示路径频率分布的显著不平衡，基于该洞察，用户可实时引导模糊测试器聚焦于选定路径。作者在 AFL++ 上实现了 DDGF，并在 Magma 基准上评估。实验表明，DDGF 能帮助模糊测试器更快复现漏洞，最高加速 100 倍，性能开销仅 13%，展示了 human-in-the-loop 模糊测试的巨大潜力。
Coverage-Guided Fuzzing (CGF) has become the most popular and effective method for vulnerability detection. It is usually designed as an automated “black-box” tool. Security auditors start it and then just wait for the results. However, after a period of testing, CGF struggles to find new coverage gradually, thus making it inefficient. It is difficult for users to explain reasons that prevent fuzzing from making further progress and to determine whether the existing coverage is sufficient. In addition, there is no way to interact and direct the fuzzing process. In this paper, we design the dynamic directed greybox fuzzing (DDGF) to facilitate collaboration between the user and fuzzer. By leveraging Ball-Larus path profiling algorithm, we propose two new techniques: dynamic introspection and dynamic direction. Dynamic introspection reveals the significant imbalance in the distribution of path frequency through encoding and decoding. Based on the insight from introspection, users can dynamically direct the fuzzer to focus testing on the selected paths in real time. We implement DDGF based on AFL++. Experiments on Magma show that DDGF is effective in helping the fuzzer to reproduce vulnerabilities faster, with up to 100x speedup and only 13% performance overhead. DDGF shows the great potential of human-in-the-loop for fuzzing.
DOI 原文 ·
@inproceedings{paperbot8466,
title = {DDGF: Dynamic Directed Greybox Fuzzing with Path Profiling},
author = {Haoran Fang and Kaikai Zhang and Donghui Yu and Yuanyuan Zhang},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680324}
}