VUzzer: Application-aware Evolutionary Fuzzing

By Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cojocar, Cristiano Giuffrida, Herbert Bos. Network and Distributed System Security Symposium, 2017

711 citations recorded by the source corpus.

Subfields: Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/da9d818f916a50001464e77bf34b953baa6a6ec9

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

1. Koushik Sen
2. Bihuan Chen
3. Caroline Lemieux
4. Yang Liu
5. Thorsten Holz
6. Yang Xiang
7. Sheng Wen
8. Seyit Ahmet Camtepe

In Signal Processing

1. Koushik Sen
2. Caroline Lemieux
3. Thorsten Holz
4. Yang Liu
5. Bihuan Chen
6. Angelos Dennis Keromytis
7. Mathias Payer
8. Cornelius Aschermann

Citations in the corpus

• CollAFL: Path Sensitive Fuzzing (2018, methodology): “3https://github.com/mirrorer/afl/blob/master/docs/parallel_fuzzing.txt VUzzer utilizes the tool PIN [24] to perform dynamic binary instrumentation.”
• The Art, Science, and Engineering of Fuzzing: A Survey (2018, methodology): “Specifically, VUzzer first uses a built-in program analysis to classify basic blocks as either normal or error handling (EH).”
• AFL++ : Combining Incremental Steps of Fuzzing Research (2020, neutral): “Recently, REDQUEEN [5], based on KAFL [36], explored the possibility to bypass hard comparisons and checksum checks, like other previous works in literature [35] [12] [33] [44], but without the use of expensive techniques like taint tracking [46] or symbolic execution [6, 37].”
• NEZHA: Efficient Domain-Independent Differential Testing (2017, background): “These tools leverage a diverse set of statistical techniques to drive input generation [23], [31], [47], or leverage static and dynamic analysis to prioritize deeper paths [55].”
• kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels (2017, background): “Tools like TaintScope [39], BuzzFuzz [21] and Vuzzer [35] utilize taint tracing and similar dynamic analysis techniques to uncover new paths.”
• FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, background): “VUzzer’s [35] approach is reminiscent of these, using both static and dynamic analysis to get immediate values used in comparisons (likely to be magic numbers), positions in the input likely to be magic numbers are offset, and information about which basic blocks are hard to get to.”
• T-Fuzz: Fuzzing by Program Transformation (2018, methodology): “The dataset was also used in VUzzer [14] and Steelix [13] as part of their evaluation.”
• Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, background): “Random fuzzers often get stuck with ineffective inputs that fail to exercise deep program paths and may thus miss bugs [22, 45, 48, 53].”
• QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, methodology): “A QSYM-based hybrid fuzzer outperformed state-of-the-art automatic bug finding tools (e.g., Driller and VUzzer) in the DARPA CGC and LAVA test sets.”
• REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, methodology): “performed their experiments with VUZZER [35] using a 5-hour run on an unspecified machine with 4 GB of RAM on a single core.”
• Evaluating Fuzz Testing (2018, methodology): “ned used AFL as a baseline in their evaluation. We targeted three binutils programs (nm, objdump, and cxxfilt) and two image processing programs (gif2png and FFmpeg) used in prior fuzzing evaluations [9, 44, 45, 55, 58]. We found that experiments that deviate from the above recipe could easily lead ”
• NAUTILUS: Fishing for Deep Bugs with Grammars (2019, methodology): “More advanced techniques are either taint-based [24], [27], [29], [43], [50], symbolic [26], or concolic [31], [32], [46] (a portmanteau of concrete and symbolic).”
• Directed Greybox Fuzzing (2017, methodology): “Coverage-directed greybox fuzzers [6, 31, 36, 43, 53] use lightweight instrumentation to collect coverage-information during runtime.”
• Steelix: program-state based binary fuzzing (2017, methodology): “However, though powerful and precise, taint analysis is not suitable for fast program execution [40].”
• Angora: Efficient Fuzzing by Principled Search (2018, methodology): “VUzzer [25] used control-flow features to model a path to prioritize the input whose path is hard-to-reach.”
• Fuzzing: A Survey for Roadmap (2022, methodology): “After obtaining the byte-constraint relation, a naive mutation scheme is to mutate the related bytes randomly [67, 157, 187].”
• Superion: Grammar-Aware Greybox Fuzzing (2018, neutral): “BuzzFuzz [24], Vuzzer [55] and Angora [15] leverage taint analysis to identify those interesting bytes for mutation.”