基於程式平滑法之目標導向式模糊測試

Directed Greybox Fuzzing based on Program Smoothing

張軒齊(Hsuan-Chi Chang)

指導教授 ： 黃世昆

國立交通大學/資訊學院/網路工程研究所/碩士(2020年)

摘要

在資訊安全領域中，模糊測試為重要的動態分析技術，用來挖掘軟體漏洞，提升程式安全性。因為相關技術的發展，模糊測試的效能大幅提升
，例如基於程式平滑建立深度學習的類神經模型，可提升模糊測試資料變異的效能。但在操控程式平滑的模型時，選擇的組合數量龐大，包括可供變異的測資、可接近或遠離的基本區塊，以隨機方式進行，效率不佳，導致一些程式目標區塊難以到達。我們提出改進方法，透過目標導向式模糊測試的想法，排除大量不合理與多餘的選擇，並依據與目標的距離，賦予每個選擇不同的優先權，使測試過程中，優先嘗試選擇較可能到達目標程式區塊，改善針對測試程式目標區塊涵蓋率的不足。我們提出針對相同基本區塊，同時接近與遠離、刪減不必要的選擇。我們以 binutils 中代碼量前五多的程式作為目標程式進行評估，生成測資到達特定的程式目標區塊，與基於程式平滑的系統 Neuzz 比較，速度增加兩倍，與目標導向式模糊測試 AFLGo 比較，速度增加四倍。

關鍵字

模糊測試

並列摘要

In the field of information security, Fuzzing is an important dynamic analysis technique used to mine software vulnerabilities and improve program security. Due to the development of related technologies, the performance of Fuzzing has been greatly improved. For example, the establishment of deep learning-like neural models based on program smoothing can improve the performance of Fuzzing data mutation. However, when manipulating the smooth model of the program, a large number of combinations are selected, including variable measurement and basic blocks that can be approached or far away. The random method is inefficient, which makes it difficult to reach some program target blocks. We propose an improvement method. Through the idea of goal-oriented fuzzing, we eliminate a large number of unreasonable and redundant choices, and give each choice a different priority based on the distance from the goal, so that during the testing process, the first choice is more likely to arrive. Target program blocks to improve the coverage of target blocks for test programs. We propose to approach and stay away from the same basic block at the same time, and eliminate unnecessary choices. We evaluate the top five programs in binutils as the target program, and generate test data to reach a specific program target block. Compared with the program-based smoothing system Neuzz, the speed is increased by 227%. Compared with Directed Fuzzer:AFLGo, the speed is Increased 443%.

並列關鍵字

Fuzzing

參考文獻

[1] M. Böhme, V.-T. Pham, and A. Roychoudhury, "Coverage-based greybox Fuzzing as markov chain," IEEE Transactions on Software Engineering, vol. 45, no. 5, pp. 489-506, 2017.

[2] I. Yun, S. Lee, M. Xu, Y. Jang, and T. Kim, "{QSYM}: A practical concolic execution engine tailored for hybrid fuzzing," in 27th {USENIX} Security Symposium ({USENIX} Security 18), 2018, pp. 745-761.

[3] W. You, X. Liu, S. Ma, D. Perry, X. Zhang, and B. Liang, "SLF: Fuzzing without valid seed inputs," in 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), 2019: IEEE, pp. 712-723.

[4] C. Aschermann, S. Schumilo, T. Blazytko, R. Gawlik, and T. Holz, "REDQUEEN: Fuzzing with Input-to-State Correspondence," in NDSS, 2019, vol. 19, pp. 1-15.

[5] Y. Wang, Z. Wu, Q. Wei, and Q. Wang, "Neufuzz: Efficient Fuzzing with deep neural network," IEEE Access, vol. 7, pp. 36340-36352, 2019.