一句话：SAND 将 sanitizer 检查移出 fuzzing 循环，仅对有趣输入运行 sanitizer 程序，降低开销且发现更多漏洞。
Sanitizer 为多种漏洞提供可靠的测试预言，但需要大量运行时插桩，导致启用 sanitizer 的程序开销远高于普通构建，而现有 fuzzing 通常在 sanitizer 程序上运行。SAND 将 sanitization 与 fuzzing 循环解耦：在普通构建程序上执行绝大多数模糊测试，只有当输入被判定为“有趣”时才调用 sanitizer 版本进行验证。为实际识别有趣输入，论文提出 execution pattern。作者在 AFL++ 上实现 SAND，并在 20 个真实程序上评估。24 小时实验表明，与所有基线 fuzzer 相比，SAND 显著发现更多 bug，同时没有漏掉任何基线发现的 bug。
Sanitizers provide robust test oracles for various vulnerabilities. Fuzzing on sanitizer-enabled programs has been the best practice to find software bugs. Since sanitizers require heavy program instrumentation to insert run-time checks, sanitizerenabled programs have much higher overhead compared to normally built programs. In this paper, we present SAND, a new fuzzing framework that decouples sanitization from the fuzzing loop. SAND performs fuzzing on a normally built program and only invokes the sanitizerenabled program when input is shown to be interesting. Since most of the generated inputs are not interesting, i.e., not bugtriggering, SAND allows most of the fuzzing time to be spent on the normally built program. We further introduce execution pattern to practically and effectively identify interesting inputs. We implement SAND on top of AFL++ and evaluate it on 20 real-world programs. Our extensive evaluation highlights its effectiveness: in 24 hours, compared to all the baseline fuzzers, SAND significantly discovers more bugs while not missing any.
DOI 原文 ·
@inproceedings{paperbot8810,
title = {Sand: Decoupling Sanitization from Fuzzing for Low Overhead},
author = {Ziqiao Kong and Shaohua Li and Heqing Huang and Zhendong Su},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00187}
}