.png){kind=icon}
返回
VPGFuzz: Vulnerable Path-Guided Greybox Fuzzing
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2025.3607249.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Fuzzing is a prevalent technology for identifying software vulnerabilities. Existing fuzzing techniques predominantly focus on maximizing code coverage to unearth potential security issues. However, the mere expansion of explored code does not necessarily correlate with an increased discovery of vulnerabilities. Additionally, existing fuzzers often neglect comprehensive execution path information in code exploration. Consequently, potential vulnerabilities may be delayed or overlooked in the fuzzing process. To address this, we propose VPGFuzz, a vulnerable path-guided fuzzer that can not only explore new code but also exploit known vulnerability path knowledge for vulnerability discovery. It employs a vulnerable path recognition model to identify test cases with potentially vulnerable paths. This model is trained with various execution paths derived from real-world vulnerability PoCs (Proof of Concepts). Based on this model, VPGFuzz applies an explore-exploit seed selection strategy to effectively choose test cases for testing. Unlike traditional seed selection methods that maintain a single queue for exploring new code, this strategy includes a separate queue for retaining test cases identified as potentially vulnerable, allowing for more thorough testing. Experimental results demonstrate that VPGFuzz discovers 24 previously unknown vulnerabilities, with 18 receiving vulnerability identifiers from third-party organizations such as CVE. Our evaluation also shows VPGFuzz's superior efficiency by uncovering the first vulnerability approximately 1.2 to 70 times faster than popular fuzzers in most programs.
Keyword:
Greybox fuzzing
vulnerable path
recognition model
explore-exploit seed selection
Greybox fuzzing
vulnerable path
recognition model
explore-exploit seed selection
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
.png){kind=icon}
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts学习从应用程序的符号执行到智能合约的模糊
PREAI
分享收藏Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input Prioritization
OAAI
OAAI分享收藏分享收藏
查看更多内容