Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSN › Conference contribution/Paper › peer-review
Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSN › Conference contribution/Paper › peer-review
}
TY - GEN
T1 - MemFuzz
T2 - Using memory accesses to guide fuzzing
AU - Coppik, N.
AU - Schwahn, O.
AU - Suri, Neeraj
PY - 2019/4/24
Y1 - 2019/4/24
N2 - Fuzzing is a form of random testing that is widely used for finding bugs and vulnerabilities. State of the art approaches commonly leverage information about the control flow of prior executions of the program under test to decide which inputs to mutate further. By relying solely on control flow information to characterize executions, such approaches may miss relevant differences. We propose augmenting evolutionary fuzzing by additionally leveraging information about memory accesses performed by the target program. The resulting approach can leverage more sophisticated information about the execution of the target program, enhancing the effectiveness of the evolutionary fuzzing. We implement our approach as a modification of the widely used AFL fuzzer and evaluate our implementation on three widely used target applications. We find distinct crashes from those detected by AFL for all three targets in our evaluation.
AB - Fuzzing is a form of random testing that is widely used for finding bugs and vulnerabilities. State of the art approaches commonly leverage information about the control flow of prior executions of the program under test to decide which inputs to mutate further. By relying solely on control flow information to characterize executions, such approaches may miss relevant differences. We propose augmenting evolutionary fuzzing by additionally leveraging information about memory accesses performed by the target program. The resulting approach can leverage more sophisticated information about the execution of the target program, enhancing the effectiveness of the evolutionary fuzzing. We implement our approach as a modification of the widely used AFL fuzzer and evaluate our implementation on three widely used target applications. We find distinct crashes from those detected by AFL for all three targets in our evaluation.
KW - Fuzzing
KW - Software Testing
KW - Verification
KW - Control flows
KW - Memory access
KW - Random testing
KW - State-of-the-art approach
KW - Target application
KW - Software testing
U2 - 10.1109/ICST.2019.00015
DO - 10.1109/ICST.2019.00015
M3 - Conference contribution/Paper
SP - 48
EP - 58
BT - 2019 12th IEEE Conference on Software Testing, Validation and Verification (ICST)
PB - IEEE
ER -