检索结果-南通市图书馆

PosFuzz:augmenting greybox fuzzing with effective position distribution

Cybersecurity 2023年第4期6卷 123-143页

作者： Yanyan Zou Wei Zou JiaCheng Zhao Nanyu Zhong Yu Zhang Ji Shi Wei Huo Institute of Information Engineering Chinese Academy of SciencesBeijingChina School of Cyber Security University of Chinese Academy of SciencesBeijingChina State Key Lab of Processors Institute of Computing TechnologyChinese Academy of SciencesBeijingChina Key Laboratory of Network Assessment Technology Chinese Academy of SciencesBeijingChina Beijing Key Laboratory of Network Security and Protection Technology BeijingChina Zhongguancun Laboratory BeijingChina

Mutation-based greybox fuzzing has been one of the most prevalent techniques for security vulnerability discovery and a great deal of research work has been proposed to improve both its efficiency and ***-based greybox fuzzing generates input cases by mutating the input seed,i.e.,applying a sequence of mutation operators to randomly selected mutation positions of the ***,existing fruitful research work focuses on scheduling mutation operators,leaving the schedule of mutation positions as an overlooked aspect of fuzzing *** paper proposes a novel greybox fuzzing method,PosFuzz,that statistically schedules mutation positions based on their historical *** makes use of a concept of effective position distribution to represent the semantics of the input and to guide the *** first utilizes Good-Turing frequency estimation to calculate an effective position distribution for each mutation *** then leverages two sampling methods in different mutating stages to select the positions from the *** have implemented PosFuzz on top of AFL,AFLFast and MOPT,called Pos-AFL,-AFLFast and-MOPT respectively,and evaluated them on the UNIFUZZ benchmark(20 widely used open source programs)and LAVA-M *** result shows that,under the same testing time budget,the Pos-AFL,-AFLFast and-MOPT outperform their counterparts in code coverage and vulnerability discovery *** with AFL,AFLFast,and MOPT,PosFuzz gets 21%more edge coverage and finds 133%more paths on *** also triggers 275%more unique bugs on average.

关键词： greybox fuzzing Mutation position Mutation operator Code coverage Vulnerability discovery

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Vulnerable Region-Aware greybox fuzzing

引用

Journal of Computer Science & Technology 2021年第5期36卷 1212-1228页

作者： Ling-Yun Situ Zhi-Qiang Zuo Le Guan Lin-Zhang Wang Xuan-Dong Li Jin Shi Peng Liu State Key Laboratory for Novel Software Technology Nanjing UniversityNanjing 210023China School of Information Management Nanjing UniversityNanjing 210023China Department of Computer Science University of GeorgiaAthensGA 30602U.S.A. College of Information Sciences and Technology Pennsylvania State UniversityState CollegePA 16802U.S.A

fuzzing is known to be one of the most effective techniques to uncover security vulnerabilities of large-scale software *** fuzzing,it is crucial to distribute the fuzzing resource appropriately so as to achieve the best fuzzing performance under a limited *** distribution strategies of American Fuzzy Lop(AFL)based greybox fuzzing focus on increasing coverage blindly without considering the metrics of code regions,thus lacking the insight regarding which region is more likely to be vulnerable and deserves more fuzzing *** tackle the above drawback by proposing a vulnerable region-aware greybox fuzzing ***,we distribute more fuzzing resources towards regions that are more likely to be vulnerable based on four kinds of code *** implemented the approach as an extension to AFL named ***-scale experimental evaluations validate the effectiveness and efficiency of RegionFuzz-11 new bugs including three new CVEs are successfully uncovered by RegionFuzz.

关键词： vulnerability detection greybox fuzzing code metrics resource distribution

来源：

维普期刊数据库评论

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

欢迎您,

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

请选择保存的检索档案：

请选择收藏分类：

通借通还

欢迎您,

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

在线全文

在线全文

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：