IEEE Trans Cybern. 2022 May;52(5):3745-3756. doi: 10.1109/TCYB.2020.3013675. Epub 2022 May 19.
Fuzzing is a technique of finding bugs by executing a target program recurrently with a large number of abnormal inputs. Most of the coverage-based fuzzers consider all parts of a program equally and pay too much attention to how to improve the code coverage. It is inefficient as the vulnerable code only takes a tiny fraction of the entire code. In this article, we design and implement an evolutionary fuzzing framework called V-Fuzz, which aims to find bugs efficiently and quickly in limited time for binary programs. V-Fuzz consists of two main components: 1) a vulnerability prediction model and 2) a vulnerability-oriented evolutionary fuzzer. Given a binary program to V-Fuzz, the vulnerability prediction model will give a prior estimation on which parts of a program are more likely to be vulnerable. Then, the fuzzer leverages an evolutionary algorithm to generate inputs which are more likely to arrive at the vulnerable locations, guided by the vulnerability prediction result. The experimental results demonstrate that V-Fuzz can find bugs efficiently with the assistance of vulnerability prediction. Moreover, V-Fuzz has discovered ten common vulnerabilities and exposures (CVEs), and three of them are newly discovered.
模糊测试是一种通过用大量异常输入反复执行目标程序来发现错误的技术。大多数基于覆盖的模糊测试器平等地考虑程序的所有部分，并过于关注如何提高代码覆盖率。这是低效的，因为易受攻击的代码只占整个代码的一小部分。在本文中，我们设计并实现了一种称为 V-Fuzz 的进化模糊测试框架，旨在在有限的时间内为二进制程序有效地快速发现错误。V-Fuzz 由两个主要组件组成：1）漏洞预测模型和 2）面向漏洞的进化模糊测试器。给定一个二进制程序到 V-Fuzz，漏洞预测模型将对程序的哪些部分更有可能易受攻击进行先验估计。然后，模糊测试器利用进化算法生成更有可能到达易受攻击位置的输入，由漏洞预测结果指导。实验结果表明，V-Fuzz 在漏洞预测的帮助下可以有效地发现错误。此外，V-Fuzz 发现了十个常见漏洞和暴露（CVE），其中三个是新发现的。
