{"title":"Improving Fuzzing Using Input Data Offsets Comparison Information","authors":"S. Sargsyan","doi":"10.1134/s0361768823100092","DOIUrl":null,"url":null,"abstract":"<h3 data-test=\"abstract-sub-heading\">Abstract</h3><p>There is a wide range of fuzzing techniques for security assurance. Communication protocols and programs accepting complex structured data, including compilers, can be efficiently tested with a corresponding fuzzing approach. The main advantage of the fuzzing is actual data, which demonstrates the defects of the target software. The performance of fuzzing primarily depends on the quality of generated data. Existing fuzzing tools provide a fixed set of data generation algorithms, which doesn’t consider the specifics of the target program. There are several scenarios when the performance of the fuzzing may suffer. The target may execute different parts of the code based on a comparison of the offsets of the input data with some constant value. For such cases, random mutations will invalidate input data and lead to lower code coverage.</p><p>In this paper, we present a new approach for effective input data generation. We use static analysis to extract information regarding the input data offsets’ comparisons with constant values. Then we use this information during input data generation. Experimental evaluation of the developed method on several projects proves the efficiency of the developed method. Our approach allowed up to 91% increase in the number of executed paths for the same execution count.</p>","PeriodicalId":54555,"journal":{"name":"Programming and Computer Software","volume":"4 1","pages":""},"PeriodicalIF":0.7000,"publicationDate":"2024-03-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Programming and Computer Software","FirstCategoryId":"94","ListUrlMain":"https://doi.org/10.1134/s0361768823100092","RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q4","JCRName":"COMPUTER SCIENCE, SOFTWARE ENGINEERING","Score":null,"Total":0}
引用次数: 0
Abstract
There is a wide range of fuzzing techniques for security assurance. Communication protocols and programs accepting complex structured data, including compilers, can be efficiently tested with a corresponding fuzzing approach. The main advantage of the fuzzing is actual data, which demonstrates the defects of the target software. The performance of fuzzing primarily depends on the quality of generated data. Existing fuzzing tools provide a fixed set of data generation algorithms, which doesn’t consider the specifics of the target program. There are several scenarios when the performance of the fuzzing may suffer. The target may execute different parts of the code based on a comparison of the offsets of the input data with some constant value. For such cases, random mutations will invalidate input data and lead to lower code coverage.
In this paper, we present a new approach for effective input data generation. We use static analysis to extract information regarding the input data offsets’ comparisons with constant values. Then we use this information during input data generation. Experimental evaluation of the developed method on several projects proves the efficiency of the developed method. Our approach allowed up to 91% increase in the number of executed paths for the same execution count.
期刊介绍：
Programming and Computer Software is a peer reviewed journal devoted to problems in all areas of computer science: operating systems, compiler technology, software engineering, artificial intelligence, etc.
求助内容：
应助结果提醒方式：
京公网安备 11010802042870号
