一句话：综述基于语法的模糊测试局限，并首次将分布采样引入模糊测试以更全面探索输入空间。
模糊测试是发现漏洞的重要方法，但传统模糊测试难以处理需要复杂专用输入模式的系统。基于语法的模糊测试利用形式语法约束生成输入，可产生符合语法要求的复杂测试用例；然而现有方法偏向某些输入特征，导致解空间的大片区域未被充分探索甚至被忽略。本文回顾该领域最新方法，重点分析基于语法模糊测试的局限，并提出一种将分布采样融入模糊测试的初步方法。早期实验/案例得到令人鼓舞的初步结果，表明该方向有望推动基于语法模糊测试实现更全面的输入空间探索，进而提升被测系统的鲁棒性与可靠性。
Fuzzing is an essential method for finding vulnerabilities. Conventional fuzzing looks across a wide input space, but it cannot handle systems that need intricate and specialized input patterns. Grammar-based fuzzing uses formal grammars to shape the inputs the fuzzer generates. This method is crucial for directing fuzzers to generate complicated inputs that adhere to syntactical requirements. However, existing approaches are biased towards certain input features, leading to significant portions of the solution space being under-explored or ignored. In this paper, we review the state-of-the-art methods, emphasizing the limitations of grammar-based fuzzing, and we provide a first approach for incorporating distribution sampling into fuzzing, accompanied by encouraging first findings. This work can represent a significant step towards achieving comprehensive input space exploration in grammar-based fuzzing, with implications for enhancing the robustness and reliability of the fuzzing targets.
DOI 原文 ·
@inproceedings{paperbot8508,
title = {Shaping Test Inputs in Grammar-Based Fuzzing},
author = {José Antonio Zamudio Amaya},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3685553}
}