Angora: Efficient Fuzzing by Principled Search

By Peng Chen, Hao Chen. IEEE Symposium on Security and Privacy, 2018

634 citations recorded by the source corpus.

Fuzzing is a popular technique for finding software bugs. However, the performance of the state-of-the-art fuzzers leaves a lot to be desired. Fuzzers based on symbolic execution produce quality inputs but run slow, while fuzzers based on random mutation run fast but have difficulty producing quality inputs. We propose Angora, a new mutation-based fuzzer that outperforms the state-of-the-art fuzzers by a wide margin. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution. To solve path constraints efficiently, we introduce several key techniques: scalable byte-level taint tracking, context-sensitive branch count, search based on gradient descent, and input length exploration. On the LAVA-M data set, Angora found almost all the injected bugs, found more bugs than any other fuzzer that we compared with, and found eight times as many bugs as the second-best fuzzer in the program who. Angora also found 103 bugs that the LAVA authors injected but could not trigger. We also tested Angora on eight popular, mature open source programs. Angora found 6, 52, 29, 40 and 48 new bugs in file, jhead, nm, objdump and size, respectively. We measured the coverage of Angora and evaluated how its key techniques contribute to its impressive performance.

Subfields: Information Systems, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/cc5cc6557af031ee405875ee6a91663e1c129610

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

In Signal Processing

Citations in the corpus

Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, methodology): “Mutation-based fuzzers [15, 39, 45, 48, 59, 63, 68] mutate initial seeds to craft new inputs that may expose vulnerabilities.”
FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, neutral): “some other recently proposed fuzzing techniques [15, 37, 42, 46].”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “Angora [56] and RedQueen [23] decrease the cost of their analysis by ﬁrst running for each seed with a costly instrumentation and using this information for generating inputs which are run with a lighter instrumentation.”
Hawkeye: Towards a Desired Directed Grey-box Fuzzer (2018, methodology): “Specificaly, AFL [48] and its derivations [6, 7, 12, 15, 24, 43] receive plenty of attentions.”
LEMNA: Explaining Deep Learning based Security Applications (2018, methodology): “The analogy is the software fuzzing techniques [13, 73]: while fuzzing tools can be used by hackers to seek vulnerabilities to exploit, the fuzzing techniques have significantly benefited the software industry by facilitating software testing to find and fix vulnerabilities before the software relea”
Superion: Grammar-Aware Greybox Fuzzing (2018, positive): “BuzzFuzz [24], Vuzzer [55] and Angora [15] leverage taint analysis to identify those interesting bytes for mutation.”
Fuzzing: A Survey for Roadmap (2022, methodology): “Moreover, fuzzing can utilize a gradient descent algorithm to mutate related bytes and gradually solve path constraints [37, 38].”
Evaluating Fuzz Testing (2018, methodology): “Steelix [33] and Angora [10] instrument the program so that ner grained information about progress towards satisfying a condition is exposed through observation.”
NAUTILUS: Fishing for Deep Bugs with Grammars (2019, background): “More advanced techniques are either taint-based [24], [27], [29], [43], [50], symbolic [26], or concolic [31], [32], [46] (a portmanteau of concrete and symbolic).”
QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, methodology): “Angora [39] adopts taint tracking, shape and type inference, and a gradient-descent-based search strategy to solve path constraints efficiently.”
AFL++ : Combining Incremental Steps of Fuzzing Research (2020, methodology): “This solution was ﬁrstly explored in [12] and seems effective in terms of code coverage, with the penalty to have more collisions and less speed.”
REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, methodology): “Many fuzzers such as AFL, LAF-INTEL and ANGORA need source code access to add the necessary instrumentation and patches.”