一句话：首个灰盒模糊测试辅助探索策略的系统实证研究，发现字典策略最优，并提出CDFUZZ为每个种子生成定制字典。
许多辅助探索策略被提出，用于帮助灰盒模糊器探索由相等约束等紧致复杂分支条件守护的程序状态，但其评估协议不统一，且缺乏对这些策略所探索程序状态细节的研究，影响后续应用与开发。本文首次对灰盒模糊器的辅助探索策略进行系统性研究：收集9个代表主流辅助探索策略的近期模糊器和21个真实项目构成基准套件，统一评估其有效性、通用性与局限性。结果意外发现字典策略最具前景，不仅探索程序状态的表现与其他策略相当甚至略优，而且更易于增强。基于此，作者在基线模糊器AFL上提出CDFUZZ，为每个种子生成定制字典以改进原字典策略。评估表明，CDFUZZ相比研究中表现最好的AFL++字典策略，在所有基准项目上平均提升16.1%的边覆盖率，并成功发现37个此前未知的缺陷，其中9个被确认、7个由开发者修复。
Many assisting exploration strategies have been proposed to assist grey-box fuzzers in exploring program states guarded by tight and complex branch conditions such as equality constraints. Although they have shown promising results in their original papers, their evaluations seldom follow equivalent protocols, e.g., they are rarely evaluated on identical benchmarks. Moreover, there is a lack of sufficient investigations on the specifics of the program states explored by these strategies which can obfuscate the future application and development of such strategies. Consequently, there is a pressing need for a comprehensive study of assisting exploration strategies on their effectiveness, versatility, and limitations to enlighten their future development. To this end, we perform the first comprehensive study about the assisting exploration strategies for grey-box fuzzers. Specifically, we first collect nine recent fuzzers representing the mainstream assisting exploration strategies as our studied subjects and 21 real-world projects to form our benchmark suite. After evaluating the subjects on the benchmark suite, we then surprisingly find that the dictionary strategy is most promising since it not only achieves similar or even slightly better performance over the other studied assisting exploration strategies in terms of exploring program states but also is more practical to be enhanced. Accordingly, we propose CDFUZZ, which generates a customized dictionary for each seed upon the baseline fuzzer AFL to improve over the original dictionary strategy. The evaluation results demonstrate that CDFUZZ increases the edge coverage by 16.1% on average for all benchmark projects over the best performer in our study (i.e., AFL++ with the dictionary strategy). CDFUZZ also successfully exposed 37 previously unknown bugs, with nine confirmed and seven fixed by the corresponding developers.
DOI 原文 ·
@inproceedings{paperbot8738,
title = {Tumbling Down the Rabbit Hole: How do Assisting Exploration Strategies Facilitate Grey-Box Fuzzing?},
author = {Mingyuan Wu and Jiahong Xiang and Kunqiu Chen and Peng Di and Shin Hwei Tan and Heming Cui and Yuqun Zhang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00044}
}