Abstract:Fuzzing is one of the prevailing methods for vulnerability detection. However, even state-of-the-art fuzzing methods become ineffective after some period of time, i.e., the coverage hardly improves as existing methods are ineffective to focus the attention of fuzzing on covering the hard-to-trigger program paths. In other words, they cannot generate inputs that can break the bottleneck due to the fundamental difficulty in capturing the complex relations between the test inputs and program coverage. In particular, existing fuzzers suffer from the following main limitations: 1) lacking an overall analysis of the program to identify the most “rewarding” seeds, and 2) lacking an effective mutation strategy which could continuously select and mutates the more relevant “bytes” of the seeds. In this work, we propose an approach called ATT UZZ to address these two issues systematically. First, we propose a lightweight dynamic analysis technique that estimates the “reward” of covering each basic block and selects the most rewarding seeds accordingly. Second, we mutate the selected seeds according to a neural network model which predicts whether a certain “rewarding” block will be covered given certain mutations on certain bytes of a seed. The model is a deep learning model equipped with an attention mechanism which is learned and updated periodically whilst fuzzing. Our evaluation shows that ATT UZZ significantly outperforms 5 state-of-the-art grey-box fuzzers on 6 popular real-world programs and MAGMA data sets at achieving higher edge coverage and finding new bugs. In particular, ATT UZZ achieved 1.2X edge coverage and 1.8X bugs detected than AFL ++ over 24-hour runs. In addition, ATT UZZ also finds 4 new bugs in the latest version of some popular software including p7zip and openUSD.

Real Time Idle State Decection Method in Fuzzing Test in GUI Program

Vulnerability Analysis for X86 Executables Using Genetic Algorithm and Fuzzing

VisFuzz: understanding and intervening fuzzing with interactive visualization

SHFuzz: A Hybrid Fuzzing Method Assisted by Static Analysis for Binary Programs

Fuzzing with Optimized Grammar-Aware Mutation Strategies

Fuzzing with Quantitative and Adaptive Hot-Bytes Identification

Fuzzing Based on Function Importance byAttributed Call Graph

StateFuzz: System Call-Based State-Aware Linux Driver Fuzzing

Effective Fuzzing Based on Dynamic Taint Analysis

UniFuzz: Optimizing Distributed Fuzzing via Dynamic Centralized Task Scheduling.

Software Vulnerability Detection Using Genetic Algorithm And Dynamic Taint Analysis

Research of Heuristic Fuzzing Data Generation Method in Program Frangibility

DeltaFuzz: Historical Version Information Guided Fuzz Testing

Better Pay Attention Whilst Fuzzing.

WhirlingFuzzwork: a taint-analysis-based API in-memory fuzzing framework

State Selection Algorithms and Their Impact on The Performance of Stateful Network Protocol Fuzzing

Grammar-aware test case trimming for efficient hybrid fuzzing

Improved Fuzzy Analysis Methods

Stateful protocol fuzzing with statemap-based reverse state selection

Directed Fuzzing Based on Dynamic Taint Analysis for Binary Software

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph