Starting with a random initial seed, fuzzers search for inputs that trigger bugs or vulnerabilities. However, fuzzers often fail to generate inputs for program paths guarded by restrictive branch conditions. In this paper, we show that by first identifying rare-paths in programs (i.e., program paths with path constraints that are unlikely to be satisfied by random input generation), and then, generating inputs/seeds that trigger rare-paths, one can improve the coverage of fuzzing tools. In particular, we present techniques 1) that identify rare paths using quantitative symbolic analysis, and 2) generate inputs that can explore these rare paths using path-guided concolic execution. We provide these inputs as initial seed sets to three state of the art fuzzers. Our experimental evaluation on a set of programs shows that the fuzzers achieve better coverage with the rare-path based seed set compared to a random initial seed.
Wed 19 JulDisplayed time zone: Pacific Time (US & Canada) change
13:30 - 15:00 | ISSTA 8: Fuzzing 2Technical Papers at Habib Classroom (Gates G01) Chair(s): Marcel Böhme MPI-SP; Monash University | ||
13:30 15mTalk | Guiding Greybox Fuzzing with Mutation TestingACM SIGSOFT Distinguished Paper Technical Papers Vasudev Vikram Carnegie Mellon University, Isabella Laybourn Carnegie Mellon University, Ao Li Carnegie Mellon University, Nicole Nair Swarthmore College, Kelton OBrien University of Minnesota, Rafaello Sanna University of Rochester, Rohan Padhye Carnegie Mellon University DOI Pre-print Media Attached | ||
13:45 15mTalk | Rare Path Guided Fuzzing Technical Papers Seemanta Saha University of California at Santa Barbara, Laboni Sarker University of California at Santa Barbara, Md Shafiuzzaman University of California at Santa Barbara, Chaofan Shou University of California at Santa Barbara, Albert Li University of California at Santa Barbara, Ganesh Sankaran University of California at Santa Barbara, Tevfik Bultan University of California at Santa Barbara DOI | ||
14:00 15mTalk | Finding Short Slow Inputs Faster with Grammar-Based Search Technical Papers DOI | ||
14:15 15mTalk | Fuzzing Embedded Systems using Debug Interfaces Technical Papers Max Eisele Robert Bosch; Saarland University, Daniel Ebert Robert Bosch, Christopher Huth Robert Bosch, Andreas Zeller CISPA Helmholtz Center for Information Security DOI Pre-print | ||
14:30 15mTalk | GrayC: Greybox Fuzzing of Compilers and Analysers for CACM SIGSOFT Distinguished Paper Technical Papers Karine Even-Mendoza King’s College London, Arindam Sharma Imperial College London, Alastair F. Donaldson Imperial College London, Cristian Cadar Imperial College London DOI | ||
14:45 15mTalk | Fuzzing Deep Learning Compilers with HirGen Technical Papers Haoyang Ma Hong Kong University of Science and Technology, Qingchao Shen Tianjin University, Yongqiang Tian University of Waterloo, Junjie Chen Tianjin University, Shing-Chi Cheung Hong Kong University of Science and Technology DOI | ||