2 research outputs found
SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing
Mutation-based fuzzing has become one of the most common vulnerability
discovery solutions over the last decade. Fuzzing can be optimized when
targeting specific programs, and given that, some studies have employed online
optimization methods to do it automatically, i.e., tuning fuzzers for any given
program in a program-agnostic manner. However, previous studies have neither
fully explored mutation schemes suitable for online optimization methods, nor
online optimization methods suitable for mutation schemes. In this study, we
propose an optimization framework called SLOPT that encompasses both a
bandit-friendly mutation scheme and mutation-scheme-friendly bandit algorithms.
The advantage of SLOPT is that it can generally be incorporated into existing
fuzzers, such as AFL and Honggfuzz. As a proof of concept, we implemented
SLOPT-AFL++ by integrating SLOPT into AFL++ and showed that the
program-agnostic optimization delivered by SLOPT enabled SLOPT-AFL++ to achieve
higher code coverage than AFL++ in all of ten real-world FuzzBench programs.
Moreover, we ran SLOPT-AFL++ against several real-world programs from OSS-Fuzz
and successfully identified three previously unknown vulnerabilities, even
though these programs have been fuzzed by AFL++ for a considerable number of
CPU days on OSS-Fuzz.Comment: To appear in Proceedings of the 2022 Annual Computer Security
Applications Conference (ACSAC '22
RCABench: Open Benchmarking Platform for Root Cause Analysis
Fuzzing has contributed to automatically identifying bugs and vulnerabilities
in the software testing field. Although it can efficiently generate crashing
inputs, these inputs are usually analyzed manually. Several root cause analysis
(RCA) techniques have been proposed to automatically analyze the root causes of
crashes to mitigate this cost. However, outstanding challenges for realizing
more elaborate RCA techniques remain unknown owing to the lack of extensive
evaluation methods over existing techniques. With this problem in mind, we
developed an end-to-end benchmarking platform, RCABench, that can evaluate RCA
techniques for various targeted programs in a detailed and comprehensive
manner. Our experiments with RCABench indicated that the evaluations in
previous studies were not enough to fully support their claims. Moreover, this
platform can be leveraged to evaluate emerging RCA techniques by comparing them
with existing techniques.Comment: Accepted by NDSS 2023 Workshop on Binary Analysis Research (BAR);
Best Paper Awar