Skyfire: Data-Driven Seed Generation for Fuzzing

By Junjie Wang, Bihuan Chen, Lei Wei, Yang Liu. IEEE Symposium on Security and Privacy, 2017

394 citations recorded by the source corpus.

Subfields: Information Systems, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/fef524c90ba47e5b3a062727fd6342240063fda7

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

1. Petar Tsankov
2. Seyit Ahmet Camtepe
3. Yang Liu
4. Thorsten Holz
5. Michael W. Hicks
6. Mathias Payer
7. Bihuan Chen
8. Sheng Wen

In Software

1. Yan Shoshitaishvili
2. Mathias Payer
3. Hui Peng
4. Petar Tsankov
5. Yang Liu
6. Thorsten Holz
7. Bihuan Chen
8. Michael W. Hicks

In Signal Processing

1. Mathias Payer
2. Yan Shoshitaishvili
3. Hui Peng
4. Sang Kil Cha
5. Seyit Ahmet Camtepe
6. Thorsten Holz
7. Bihuan Chen
8. Michael W. Hicks

Citations in the corpus

• The Art, Science, and Engineering of Fuzzing: A Survey (2018, methodology): “Given a set of seeds and a grammar, Skyfire [217] uses a data-driven approach to infer a probabilitistic context-sensitive grammar, and then uses it to generate a new set of seeds.”
• Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, background): “Generation-based fuzzers create inputs based on input specifications which can be defined with a grammar [21, 30, 38, 66], or learned from a given corpus [10, 23, 31, 64].”
• Hawkeye: Towards a Desired Directed Grey-box Fuzzer (2018, background): “This is used when the target program is knowntoprocesssemanticrelevantinputfilessuchasjavascript, xml,css,etc. Indetail,thisfollowsSkyfire[43],whichincludes threemetamutations,insertinganothersubtreeintoarandom ASTposition,deletingagivenAST,andreplacingthegiven positionwithanotherAST.”
• T-Fuzz: Fuzzing by Program Transformation (2018, methodology): “Learning based approaches has been shown to be effective in generating well structured inputs (e.g., XML files) for fuzzers in Skyfire [44] and Learn&Fuzz [45].”
• NAUTILUS: Fishing for Deep Bugs with Grammars (2019, methodology): “Getting such a high-quality corpus is not trivial: if the language accepted by the target application is widely used, one approach is to crawl publicly available examples from the Web [49] or from public code repositories.”
• Fuzzing: A Survey for Roadmap (2022, background): “Therefore, fuzzers recombine syntactically compatible fragments based on random selection [80, 120, 199], genetic algorithm [180], or machine learning [185].”
• Steelix: program-state based binary fuzzing (2017, background): “Skyfire [47] leverages the knowledge in existing samples to generate well-distributed seed inputs for fuzzing programs that process highly-structured inputs.”
• Superion: Grammar-Aware Greybox Fuzzing (2018, positive): “Skyfire [64] and TreeFuzz [50] learn a probabilistic model from the grammar and a corpus of test inputs to generate test inputs.”
• CollAFL: Path Sensitive Fuzzing (2018, background): “Skyfire [41] learns a probabilistic context sensitive grammar from abundant inputs to guide testcase generation.”
• Evaluating Fuzz Testing (2018, background): “A popular view is that a seed should be well-formed (“valid”) and small—such seeds may drive the program to execute more of its intended logic quickly, rather than cause it to terminate at its parsing/well-formedness tests [31, 44, 45, 53].”