Crash clustering technique based on core behavior extraction of program crash states

Crash report analysis is a necessary step for software maintainers before fixing software bugs. Fuzzing and symbolic execution tools are often used to automate the generation of crash reports, but there are a large number of duplicate crash reports. Although it uses heuristics such as stack hashing, crash points, etc. to reduce duplicate crash reports, the false alarm rate is high and still requires manual analysis to identify them, which requires considerable effort. In this paper, we propose a crash clustering method based on program crash state extraction, which mainly uses fuzzing techniques to explore the program state space, selectively performs path reduction to generate the core behavior of the crashed program runtime, collects the path information for core behavior and generates feature vectors. Then discriminates whether different crash samples are caused by the same root cause through similarity comparison. We evaluated our tool Diccriminate in real software with real vulnerabilities, and the experimental results show that it can perform crash clustering with 94.31% accuracy, which is more than 20% improvement over existing advanced crash clustering techniques, validating the feasibility and practicality of the method in this paper.