Abstract:Fuzzing has emerged as a powerful technique for finding security bugs in complicated real-world applications. American fuzzy lop (AFL), a leading fuzzing tool, has demonstrated its powerful bug finding ability through a vast number of reported CVEs. However, its random mutation strategy is unable to generate test inputs that satisfy complicated branching conditions (e.g., magic-byte comparisons, checksum tests, and nested if-statements), which are commonly used in image decoders/encoders, XML parsers, and checksum tools. Existing approaches (such as Steelix and Neuzz) on addressing this problem assume unrealistic assumptions such as we can satisfy the branch condition byte-to-byte or we can identify and focus on the important bytes in the input (called hot-bytes) once and for all. In this work, we propose an approach called \tool~which is designed based on the following principles. First, there is a complicated relation between inputs and branching conditions and thus we need not only an expressive model to capture such relationship but also an informative measure so that we can learn such relationship effectively. Second, different branching conditions demand different hot-bytes and we must adjust our fuzzing strategy adaptively depending on which branches are the current bottleneck. We implement our approach as an open source project and compare its efficiency with other state-of-the-art fuzzers. Our evaluation results on 10 real-world programs and LAVA-M dataset show that \tool~achieves sustained increases in branch coverage and discovers more bugs than other fuzzers.

Vulnerability Analysis for X86 Executables Using Genetic Algorithm and Fuzzing

Software Vulnerability Detection Using Genetic Algorithm And Dynamic Taint Analysis

Web Application Vulnerability Fuzzing Based on Improved Genetic Algorithm

V-Fuzz: Vulnerability Prediction-Assisted Evolutionary Fuzzing for Binary Programs

SHFuzz: A Hybrid Fuzzing Method Assisted by Static Analysis for Binary Programs

V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing

Effective Fuzzing Based on Dynamic Taint Analysis

Test Case Generation for Vulnerability Detection Using Genetic Algorithm

Vulnerability Detection Through an Adversarial Fuzzing Algorithm

Vulnerability-oriented Directed Fuzzing for Binary Programs.

The Study on Integer Overflow Vulnerability Detection in Binary Executables Based Upon Genetic Algorithm

EWFT:Execution-based Whitebox Fuzzing for Executables

Directed Fuzzing Based on Dynamic Taint Analysis for Binary Software

Fuzzing the ActionScript Virtual Machine

A Systematic Review of Fuzzing Techniques

Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities

A Novel Method for Fuzzing Test Cases Generating Based on Genetic Algorithm

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

Fuzzing with Quantitative and Adaptive Hot-Bytes Identification

ASVG: Automated Software Vulnerability Sample Generation Technology Based on Source Code

Integer overflow vulnerability detection based on an integer-valued genetic algorithm