FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage
By Caroline Lemieux, Koushik Sen. International Conference on Automated Software Engineering, 2017
474 citations recorded by the source corpus.
In recent years, fuzz testing has proven itself to be one of the most effective techniques for finding correctness bugs and security vulnerabilities in practice. One particular fuzz testing tool, American Fuzzy Lop (AFL), has become popular thanks to its ease-of-use and bug-finding power. However, AFL remains limited in the bugs it can find since it simply does not cover large regions of code. If it does not cover parts of the code, it will not find bugs there. We propose a two-pronged approach to increase the coverage achieved by AFL. First, the approach automatically identifies branches exercised by few AFL-produced inputs (rare branches), which often guard code that is empirically hard to cover by naïvely mutating inputs. The second part of the approach is a novel mutation mask creation algorithm, which allows mutations to be biased towards producing inputs hitting a given rare branch. This mask is dynamically computed during fuzz testing and can be adapted to other testing targets. We implement this approach on top of AFL in a tool named FairFuzz. We conduct evaluation on real-world programs against state-of-the-art versions of AFL. We find that on these programs FairFuzz achieves high branch coverage at a faster rate that state-of-the-art versions of AFL. In addition, on programs with nested conditional structure, it achieves sustained increases in branch coverage after 24 hours (average 10.6% increase). In qualitative analysis, we find that FairFuzz has an increased capacity to automatically discover keywords.
Subfields: Software, Signal Processing
View Paper: https://www.semanticscholar.org/paper/fd093cb338822b1ba137bff903726f8b5a0ec5dc
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Software
- Chun Xia
- Lingming Zhang
- Yinlin Deng
- Haoran Peng
- Chenyuan Yang
- Yangruibo Ding
- Baishakhi Ray
- Andrea Fioraldi
In Signal Processing
- Sang Kil Cha
- Andrea Fioraldi
- Sheng Wen
- Chun Xia
- Seyit Ahmet Camtepe
- Marc Heuse
- Yangruibo Ding
- Xiaogang Zhu
Citations in the corpus
- Fuzzing: A Survey for Roadmap (2022, background): “Most fuzzers select bytes heuristically based on execution information [7, 37, 38, 67, 101, 103, 157, 160, 187] or randomly [22, 23, 118, 203, 206].”
- Large Language Models Are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models (2022, methodology): “We compare our default tness function against its variants, as well as random selection (Random) and a simplistic coverage guided [18, 35, 42, 50] (Coverage) baseline in Table 4.”
- Deep Learning Based Vulnerability Detection: Are We There Yet? (2020, background): “Traditional vulnerability detection systems fall into three major categories – static analysis [26], [65], dynamic analysis [66], [67], and symbolic analysis [68], [69].”
- The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “FairFuzz [141] H# ✓ ✓ ✓† H#† ✓ ✓ ✓ go-fuzz [225] H# ✓ ✓ ✓ ✓ ✓ ✓ H# ✓ Hawkeye [56] H# ✓ ✓ ✓ ✓ H# ✓ ✓ honggfuzz [213] H# ✓ ✓ ✓ kAFL [191] H# ✓ ✓ LibFuzzer [9] H# ✓ ✓ ✓ ✓ ✓ ✓ MagicFuzzer [50] H# ✓ ✓ ✓ Nautilus [25] H# ✓ ✓ ✓ H# ✓ ✓ RaceFuzzer [197] H# ✓ ✓ ✓ RedQueen [26] H# ✓ ✓ H# ✓”
- AFL++ : Combining Incremental Steps of Fuzzing Research (2020, background): “Rare ignores the runtime of the seed — unlike all other schedules — and additionally puts a focus on seeds with edges that are rarely covered by other seeds, an effective metric as shown in [24] [10].”