.png){kind=icon}
返回
DatAFLow: Toward a Data-Flow-Guided Fuzzer
.png){kind=icon}
OA
AI
DOI：10.1145/3587156.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Coverage-guided greybox fuzzers rely on control-flow coverage feedback to explore a target program and uncover bugs. Compared to control-flow coverage, data-flow coverage offers a more fine-grained approximation of program behavior. Data-flow coverage captures behaviors not visible as control flow and should intuitively discover more (or different) bugs. Despite this advantage, fuzzers guided by data-flow coverage have received relatively little attention, appearing mainly in combination with heavyweight program analyses (e.g., taint analysis, symbolic execution). Unfortunately, these more accurate analyses incur a high run-time penalty, impeding fuzzer throughput. Lightweight data-flow alternatives to control-flow fuzzing remain unexplored. We present datAFLow, a greybox fuzzer guided by lightweight data-flow profiling. We also establish a framework for reasoning about data-flow coverage, allowing the computational cost of exploration to be balanced with precision. Using this framework, we extensively evaluate datAFLow across different precisions, comparing it against state-of-the-art fuzzers guided by control flow, taint analysis, and data flow. Our results suggest that the ubiquity of control-flow-guided fuzzers is well-founded. The high run-time costs of data-flow-guided fuzzing (similar to 10xhigher than control-flow-guided fuzzing) significantly reduces fuzzer iteration rates, adversely affecting bug discovery and coverage expansion. Despite this, datAFLow uncovered bugs that state-of-the-art control-flow-guided fuzzers (notably, AFL++) failed to find. This was because dataflow coverage revealed states in the target not visible under control-flow coverage. Thus, we encourage the community to continue exploring lightweight data-flow profiling; specifically, to lower run-time costs and to combine this profiling with control-flow coverage to maximize bug-finding potential.
Keyword:
Fuzzing
data flow
coverage
期刊
A
IF:
6.2
论文数:
1.2K
被引数:
3.4K
机构
引用论文
Microscale forced combustion: Pyrolysis-combustion flow calorimetry (PCFC)微尺度强制燃烧: 热解-燃烧流量量热法 (PCFC)
PREAI
分享收藏A direct approach to fault-tolerance in measurement-based quantum computation via teleportation通过隐形传态在基于测量的量子计算中实现容错的直接方法
OAAI
OAAI分享收藏Applications of Supernumerary Robotic Limbs to Construction Works: Case Studies多余的机器人肢体在建筑工程中的应用: 案例研究OAAI
OAAI分享收藏分享收藏分享收藏Cysteine Dioxygenase 1 Is a Tumor Suppressor Gene Silenced by Promoter Methylation in Multiple Human Cancers半胱氨酸双加氧酶1是一种在多种人类癌症中被启动子甲基化沉默的抑癌基因.png)
PLoS ONEOAAI
PLoS ONEIF0
OAAI分享收藏
查看更多内容