Grammar-aware test case trimming for efficient hybrid fuzzing
In recent years, hybrid fuzzing has garnered significant attention by combining the benefits of both fuzzing and concolic execution. However, existing hybrid fuzzing techniques face problems such as the performance overhead of concolic execution and low code coverage in real-world programs. In this...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2024-01-01
|
| Series: | Journal of King Saud University: Computer and Information Sciences |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S1319157824000090 |
| _version_ | 1797322439334559744 |
|---|---|
| author | Yiru Zhao Long Gao Qihan Wan Lei Zhao |
| author_facet | Yiru Zhao Long Gao Qihan Wan Lei Zhao |
| author_sort | Yiru Zhao |
| collection | DOAJ |
| description | In recent years, hybrid fuzzing has garnered significant attention by combining the benefits of both fuzzing and concolic execution. However, existing hybrid fuzzing techniques face problems such as the performance overhead of concolic execution and low code coverage in real-world programs. In this study, we observed that concolic execution often falls into repetitive loop structures when analyzing inputs generated by fuzzing, leading to the construction of redundant constraint expressions, which severely impacts its efficiency. Based on this observation, we design a test case trimming approach to remove input fields related to repetitive loop structures. We propose a lightweight taint analysis technique to infer input’s grammatical structure and construct a hierarchical grammar tree. Then, through delta debugging, we identify nodes that do not affect the code coverage and remove the corresponding input fields. We implement a prototype ScissorFuzz. Experimental results show that our approach brings an average of 8.2% improvement in code coverage and triggers 115 more crashes compared to the state-of-the-art hybrid fuzzing technique QSYM. By eliminating redundant fields, our approach reduces the resource and time overhead associated with concolic execution during input processing, thereby enhancing the efficiency of hybrid fuzzing. |
| first_indexed | 2024-03-08T05:14:22Z |
| format | Article |
| id | doaj.art-9fa261aaef214cc9af974f4283dcc287 |
| institution | Directory Open Access Journal |
| issn | 1319-1578 |
| language | English |
| last_indexed | 2024-03-08T05:14:22Z |
| publishDate | 2024-01-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Journal of King Saud University: Computer and Information Sciences |
| spelling | doaj.art-9fa261aaef214cc9af974f4283dcc2872024-02-07T04:43:40ZengElsevierJournal of King Saud University: Computer and Information Sciences1319-15782024-01-01361101920Grammar-aware test case trimming for efficient hybrid fuzzingYiru Zhao0Long Gao1Qihan Wan2Lei Zhao3Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan, Hubei, 430072, ChinaKey Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan, Hubei, 430072, ChinaKey Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan, Hubei, 430072, ChinaKey Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan, Hubei, 430072, ChinaIn recent years, hybrid fuzzing has garnered significant attention by combining the benefits of both fuzzing and concolic execution. However, existing hybrid fuzzing techniques face problems such as the performance overhead of concolic execution and low code coverage in real-world programs. In this study, we observed that concolic execution often falls into repetitive loop structures when analyzing inputs generated by fuzzing, leading to the construction of redundant constraint expressions, which severely impacts its efficiency. Based on this observation, we design a test case trimming approach to remove input fields related to repetitive loop structures. We propose a lightweight taint analysis technique to infer input’s grammatical structure and construct a hierarchical grammar tree. Then, through delta debugging, we identify nodes that do not affect the code coverage and remove the corresponding input fields. We implement a prototype ScissorFuzz. Experimental results show that our approach brings an average of 8.2% improvement in code coverage and triggers 115 more crashes compared to the state-of-the-art hybrid fuzzing technique QSYM. By eliminating redundant fields, our approach reduces the resource and time overhead associated with concolic execution during input processing, thereby enhancing the efficiency of hybrid fuzzing.http://www.sciencedirect.com/science/article/pii/S1319157824000090Hybrid fuzzingFuzzingConcolic executionDelta debugging |
| spellingShingle | Yiru Zhao Long Gao Qihan Wan Lei Zhao Grammar-aware test case trimming for efficient hybrid fuzzing Journal of King Saud University: Computer and Information Sciences Hybrid fuzzing Fuzzing Concolic execution Delta debugging |
| title | Grammar-aware test case trimming for efficient hybrid fuzzing |
| title_full | Grammar-aware test case trimming for efficient hybrid fuzzing |
| title_fullStr | Grammar-aware test case trimming for efficient hybrid fuzzing |
| title_full_unstemmed | Grammar-aware test case trimming for efficient hybrid fuzzing |
| title_short | Grammar-aware test case trimming for efficient hybrid fuzzing |
| title_sort | grammar aware test case trimming for efficient hybrid fuzzing |
| topic | Hybrid fuzzing Fuzzing Concolic execution Delta debugging |
| url | http://www.sciencedirect.com/science/article/pii/S1319157824000090 |
| work_keys_str_mv | AT yiruzhao grammarawaretestcasetrimmingforefficienthybridfuzzing AT longgao grammarawaretestcasetrimmingforefficienthybridfuzzing AT qihanwan grammarawaretestcasetrimmingforefficienthybridfuzzing AT leizhao grammarawaretestcasetrimmingforefficienthybridfuzzing |