一句话：提出 Shepherd，用高精度字符串匹配与上下文分析推断黑盒模糊测试的覆盖率，显著提升估计准确率。
模糊测试是早期漏洞检测的重要手段。基于覆盖率的灰盒模糊测试借助内部覆盖率信息获得较高探索效率，但在固件、智能手机应用等无法插桩的受限环境中难以使用。黑盒模糊测试无需运行时信息，适用面更广，却因无法测量覆盖率而效率偏低，因此需要在黑盒环境下近似推断覆盖率以优化测试。已有研究尝试依据程序响应与二进制中嵌入字符串之间的关系估计覆盖率，但存在匹配算法歧义，以及同一字符串被多个基本块共享时产生的非唯一性问题，导致频繁误估。本文提出新的覆盖率推断方法 Shepherd，将高精度字符串匹配与上下文分析相结合以解决上述问题。实验结果表明，与已有方法相比，Shepherd 显著提高了覆盖率估计的准确性。
In recent years, fuzzing has gained attention as a primary means for the early detection of vulnerabilities. Although coverage-based greybox fuzzing utilizes internal coverage information to achieve high exploration efficiency, it remains difficult to employ the fuzzing framework in some restricted environments where we cannot instrument the program, such as firmware or smartphone applications. In contrast, blackbox fuzzing does not require runtime information and is thus more widely applicable, but suffers from lower efficiency because coverage cannot be measured. To address this issue, there is a growing demand for methods that can approximate coverage in blackbox environments to optimize fuzzing. One existing study proposes estimating coverage based on the relationship between program responses and strings embedded in its binary. However, this approach faces challenges with ambiguous matching algorithms and the non-uniqueness that occurs when a single string is shared by multiple basic blocks, leading to frequent misestimations. In this research, we propose a new coverage inference method, Shepherd, which combines high-precision string matching with context analysis to resolve these problems. Experimental results show that Shepherd significantly improves estimation accuracy compared to the existing approach.
@inproceedings{paperbot9583,
title = {Shepherd: High-Precision Coverage Inference for Response-guided Blackbox Fuzzing (Registered Report)},
author = {Takuya Shimizu and Ryuichi Yoshizawa and Kaoru Otsuka and Yudai Fujiwara and Yuichi Sugiyama},
booktitle = {ISSTA},
year = {2025},
doi = {10.1145/3713081.3731719}
}