Abstract:Context: Zero-day vulnerabilities are highly destructive and sudden. However, traditional static and dynamic testing methods cannot efficiently detect them. Objective: In this paper, a static fuzzy mutation method for program code is studied. This method can improve the efficiency of mutation sample generation according to the vulnerability evolution law, thus promoting the development of zero-day vulnerability detection methods based on deep learning techniques. Method: A static fuzzy mutation method based on the Abstract Syntax Tree (AST) is proposed. Under the guidance of software vulnerability evolution law, potential evolution paths that threaten program security are detected, and mutation samples containing vulnerabilities are generated at the syntax tree level based on the paths. To verify the effectiveness of static fuzzy mutation based on ASTs, this paper starts with Concurrent Use After Free (CUAF) homologous vulnerability. It uses multi-threaded programs to perform vulnerability feature statement insertion processing to infer the optimal mutation operator execution sequence corresponding to CUAF vulnerabilities triggered by data competition. The Linux kernel code is used to verify whether it can effectively reduce the number of invalid mutation samples. Results: In this paper, we filter the code fragments in the Linux kernel public code containing CUAF vulnerability fix commits and perform static fuzzy mutation on the fix versions of the vulnerabilities to reproduce the vulnerabilities of this type triggered by these code fragments on the timeline. We compare the process with the execution of the random mutation operator in traditional detection methods horizontally and improve the efficiency by 42.4% on average. Conclusion: The static fuzzy mutation based on the AST is effective in stages. When this method is explored in more vulnerability-type evolution laws, it is expected to promote the development of the zero-day vulnerability active detection technology framework.

Research on Mutation Strategy in Vulnerability Discovery based on Peach

FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing

An Abstract Syntax Tree based static fuzzing mutation for vulnerability evolution analysis

Facilitating Vulnerability Assessment Through PoC Migration.

Fuzzing with Optimized Grammar-Aware Mutation Strategies

Evolutionary Mutation-based Fuzzing as Monte Carlo Tree Search

ICS Protocol Fuzzing: Coverage Guided Packet Crack and Generation

Mopt: Optimized Mutation Scheduling For Fuzzers

EMS: History-Driven Mutation for Coverage-based Fuzzing.

V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing

Fuzzing for CPS Mutation Testing

Vulnerability Detection Through an Adversarial Fuzzing Algorithm

The research on the fuzzing

Investigating Coverage Guided Fuzzing with Mutation Testing

V-Fuzz: Vulnerability Prediction-Assisted Evolutionary Fuzzing for Binary Programs

Better Pay Attention Whilst Fuzzing.

ShapFuzz: Efficient Fuzzing Via Shapley-Guided Byte Selection

Fuzzing with Quantitative and Adaptive Hot-Bytes Identification

MuFuzz: Sequence-Aware Mutation and Seed Mask Guidance for Blockchain Smart Contract Fuzzing

Systematic Assessment of Fuzzers using Mutation Analysis

NCMFuzzer: Using non-critical field mutation and test case combination to improve the efficiency of ICS protocol fuzzing