Cargando…
RLTG: Multi-targets directed greybox fuzzing
Directed greybox fuzzing guides fuzzers to explore specific objective code areas and has achieved good performance in some scenarios such as patch testing. However, if there are multiple objective code to explore, existing directed greybox fuzzers, such as AFLGo and Hawkeye, often neglect some targe...
Autores principales: | , |
---|---|
Formato: | Online Artículo Texto |
Lenguaje: | English |
Publicado: |
Public Library of Science
2023
|
Materias: | |
Acceso en línea: | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10096230/ https://www.ncbi.nlm.nih.gov/pubmed/37043427 http://dx.doi.org/10.1371/journal.pone.0278138 |
_version_ | 1785024283699838976 |
---|---|
author | He, Yubo Zhu, Yuefei |
author_facet | He, Yubo Zhu, Yuefei |
author_sort | He, Yubo |
collection | PubMed |
description | Directed greybox fuzzing guides fuzzers to explore specific objective code areas and has achieved good performance in some scenarios such as patch testing. However, if there are multiple objective code to explore, existing directed greybox fuzzers, such as AFLGo and Hawkeye, often neglect some targets because they use harmonic means of distance and prefers to test those targets with shorter reachable path. Besides, existing directed greybox fuzzers cannot calculate the accurate distance due to indirect calls in the program. In addition, existing directed greybox fuzzers fail to address the exploration and exploitation problem and have poor efficiency in seed scheduling. To address these problems, we propose a dynamic seed distance calculation scheme, it increase the seed distance dynamically when the reachable path encounter indirect call. Besides, the seed distance calculation can deal with the bias problem in multi-targets scenarios. With the seed distance calculation method, we propose a new seed scheduling algorithm based on the upper confidence bound algorithm to deal with the exploration and exploitation problem in drected greybox fuzzing. We implemented a prototype RLTG and evaluate it on real-world programs. Evaluation of our prototype shows that our approach outperforms a state-of-the-art directed fuzzer AFLGo. On the multi-targets benchmark Magma, RLTG reproduces bugs with 6.9x speedup and finds 66.7% more bugs than AFLGo. |
format | Online Article Text |
id | pubmed-10096230 |
institution | National Center for Biotechnology Information |
language | English |
publishDate | 2023 |
publisher | Public Library of Science |
record_format | MEDLINE/PubMed |
spelling | pubmed-100962302023-04-13 RLTG: Multi-targets directed greybox fuzzing He, Yubo Zhu, Yuefei PLoS One Research Article Directed greybox fuzzing guides fuzzers to explore specific objective code areas and has achieved good performance in some scenarios such as patch testing. However, if there are multiple objective code to explore, existing directed greybox fuzzers, such as AFLGo and Hawkeye, often neglect some targets because they use harmonic means of distance and prefers to test those targets with shorter reachable path. Besides, existing directed greybox fuzzers cannot calculate the accurate distance due to indirect calls in the program. In addition, existing directed greybox fuzzers fail to address the exploration and exploitation problem and have poor efficiency in seed scheduling. To address these problems, we propose a dynamic seed distance calculation scheme, it increase the seed distance dynamically when the reachable path encounter indirect call. Besides, the seed distance calculation can deal with the bias problem in multi-targets scenarios. With the seed distance calculation method, we propose a new seed scheduling algorithm based on the upper confidence bound algorithm to deal with the exploration and exploitation problem in drected greybox fuzzing. We implemented a prototype RLTG and evaluate it on real-world programs. Evaluation of our prototype shows that our approach outperforms a state-of-the-art directed fuzzer AFLGo. On the multi-targets benchmark Magma, RLTG reproduces bugs with 6.9x speedup and finds 66.7% more bugs than AFLGo. Public Library of Science 2023-04-12 /pmc/articles/PMC10096230/ /pubmed/37043427 http://dx.doi.org/10.1371/journal.pone.0278138 Text en © 2023 He, Zhu https://creativecommons.org/licenses/by/4.0/This is an open access article distributed under the terms of the Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0/) , which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited. |
spellingShingle | Research Article He, Yubo Zhu, Yuefei RLTG: Multi-targets directed greybox fuzzing |
title | RLTG: Multi-targets directed greybox fuzzing |
title_full | RLTG: Multi-targets directed greybox fuzzing |
title_fullStr | RLTG: Multi-targets directed greybox fuzzing |
title_full_unstemmed | RLTG: Multi-targets directed greybox fuzzing |
title_short | RLTG: Multi-targets directed greybox fuzzing |
title_sort | rltg: multi-targets directed greybox fuzzing |
topic | Research Article |
url | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10096230/ https://www.ncbi.nlm.nih.gov/pubmed/37043427 http://dx.doi.org/10.1371/journal.pone.0278138 |
work_keys_str_mv | AT heyubo rltgmultitargetsdirectedgreyboxfuzzing AT zhuyuefei rltgmultitargetsdirectedgreyboxfuzzing |