检索结果-内蒙古大学图书馆

Testing Error Handling Code With Software Fault Injection and Error-coverage-guided fuzzing

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2024年第4期21卷 1724-1739页

作者： Bai, Jia-Ju Fu, Zi-Xuan Xie, Kai-Tao Jiang, Zu-Ming Beihang Univ Sch Cyber Sci & Technol Beijing 100191 Peoples R China Beihang Univ Beijing 100191 Peoples R China Tsinghua Univ Beijing 100190 Peoples R China Alibaba Grp Hangzhou 311121 Peoples R China Swiss Fed Inst Technol CH-8092 Zurich Switzerland

Real-world programs require error handling code to handle various kinds of possible errors. However, these errors just infrequently occur due to special conditions, so error handling code is difficult to test. coverage-guided fuzzing and software fault injection (SFI) are two common techniques that can test error handling code, but they still have major limitations. Specifically, existing fuzzing approaches generate program inputs guided by code coverage, but many occasional errors (such as insufficient memory) are unrelated to inputs, and code coverage cannot effectively reflect the execution contexts of these errors;existing SFI approaches often inject single or random faults, without exploring fault space or using program feedback. In this paper, we propose a new fuzzing framework named EH-Fuzz, to effectively test error handling code. EH-Fuzz uses a context-sensitive SFI-based fuzzing approach to explore fault space and perform fault injection, guided by a new metric named error coverage. We evaluate EH-Fuzz on 9 user-level programs and 6 kernel-level modules, and find 45 new real bugs, 31 of which have been confirmed and fixed. We compare EH-Fuzz to existing fuzzing approaches (including AFL, AFL++, Syzkaller, FIZZER and FIFUZZ), and EH-Fuzz finds many real bugs missed by these approaches with higher testing coverage.

关键词： Codes fuzzing Computer bugs Testing Space exploration Runtime Software Bug detection coverage-guided fuzzing error coverage error handling software fault injection

来源：评论

学校读者我要写书评

暂无评论

NDFuzz:a non-intrusive coverage-guided fuzzing framework for virtualized network devices

引用

Cybersecurity 2023年第1期6卷 54-74页

作者： Yu Zhang Nanyu Zhong Wei You Yanyan Zou Kunpeng Jian Jiahuan Xu Jian Sun Baoxu Liu Wei Huo Institute of Information Engineering Chinese Academy of SciencesBejingChina School of Cyber Security University of Chinese Academy of SciencesBejingChina Key Laboratory of Network Assessment Technology Chinese Academy of SciencesBeijingChina Beijing Key Laboratory of Network Security and Protection Technology BeijingChina Renmin University of China BeijingChina

Network function virtualization provides programmable in-network middlewares by leveraging virtualization tech-nologies and commodity hardware and has gained popularity among all mainstream network device *** it is challenging to apply coverage-guided fuzzing,one of the state-of-the-art vulnerability discovery approaches,to those virtualized network devices,due to inevitable integrity protection adopted by those *** this paper,we propose a coverage-guided fuzzing framework NDFuzz for virtualized network devices with a novel integrity protec-tion bypassing method,which is able to distinguish processes of virtualized network devices from hypervisors with a carefully designed non-intrusive page global directory inference *** implement NDFuzz atop of two black-box fuzzers and evaluate NDFuzz with three representative network protocols,SNMP,DHCP and NTP,on nine popular virtualized network *** obtains an average 36%coverage improvement in comparison with its black-box *** discovers 2 O-Day vulnerabilities and 11-Day vulnerability with coverage guidance while the black-box fuzzer can find only one of *** discovered vulnerabilities are confirmed by corresponding vendors.

关键词： coverage-guided fuzzing Network devices Network function virtualization

来源：评论

学校读者我要写书评

暂无评论

coverage-guided fuzzing for deep reinforcement learning systems

引用

JOURNAL OF SYSTEMS AND SOFTWARE 2024年 210卷

作者： Wan, Xiaohui Li, Tiancheng Lin, Weibin Cai, Yi Zheng, Zheng Beihang Univ Sch Automat Sci & Elect Engn Beijing 100191 Peoples R China

While the past decade has witnessed a growing demand for employing deep reinforcement learning (DRL) in various domains to solve real -world problems, the reliability of DRL systems has become more of a concern. In particular, DRL agents are often trained on data from a potentially biased distribution over environmental settings, causing the trained agents to fail in certain cases despite high average -case performance. Hence, it is necessary and urgent to adequately test DRL agents to ensure the reliability of practical DRL systems. However, due to the fundamental difference in the programming paradigm and the development process, traditional software testing methodology cannot be applied directly to DRL systems. Given that, we introduce a novel testing framework for DRL systems, aiming to generate diverse test cases that can drive a DRL system to fail. Specifically, we design, implement and evaluate DRLFuzz, which is a coverage -guided fuzzing (CGF) framework for systematically testing DRL systems. Experimental results demonstrate that DRLFuzz can efficiently discover diverse failures in different DRL systems for various benchmark tasks. Compared with a random search baseline, DRLFuzz can generate 60% more failed cases in general. Additionally, the diversity of failed cases generated by DRLFuzz is increased by 4.6% similar to 14.1% in terms of mean pairwise distance (MPD). Furthermore, our experiments also indicate that the failed cases generated by DRLFuzz can be utilized to fine-tune the DRL agent to eliminate the failures resulting from inadequate exploration during training and thus improve the reliability of DRL systems.

关键词： Deep reinforcement learning system Deep reinforcement learning testing Fuzz testing coverage-guided fuzzing

来源：评论

学校读者我要写书评

暂无评论

FOX: coverage-guided fuzzing as Online Stochastic Control 24

FOX: Coverage-guided Fuzzing as Online Stochastic Control

引用

31st Conference on Computer and Communications Security

作者： She, Dongdong Storek, Adam Xie, Yuchong Kweon, Seoyoung Srivastava, Prashast Jana, Suman Hong Kong Univ Sci & Technol Hong Kong Peoples R China Columbia Univ New York NY USA

ISBN: (纸本)9798400706363

fuzzing is an effective technique for discovering software vulnerabilities by generating random test inputs and executing them against the target program. However, fuzzing large and complex programs remains challenging due to difficulties in uncovering deeply hidden vulnerabilities. This paper addresses the limitations of existing coverage-guided fuzzers, focusing on the scheduler and mutator components. Existing schedulers suffer from information sparsity and the inability to handle fine-grained feedback metrics. The mutators are agnostic of target program branches, leading to wasted computation and slower coverage exploration. To overcome these issues, we propose an end-to-end online stochastic control formulation for coverage-guided fuzzing. Our approach incorporates a novel scheduler and custom mutator that can adapt to branch logic, maximizing aggregate edge coverage achieved over multiple stages. The scheduler utilizes fine-grained branch distance measures to identify frontier branches, where new coverage is likely to be achieved. The mutator leverages branch distance information to perform efficient and targeted seed mutations, leading to robust progress with minimal overhead. We present FOX, a proof-of-concept implementation of our control-theoretic approach, and compare it to industry-standard coverage-guided fuzzers. 6 CPU-years of extensive evaluations on the FuzzBench dataset and complex real-world programs (a total of 38 test programs) demonstrate that FOX outperforms existing state-of-the-art fuzzers, achieving average coverage improvements up to 26.45% in real-world standalone programs and 6.59% in FuzzBench programs over the state-of-the-art AFL++. In addition, it uncovers 20 unique bugs in popular real-world applications, including eight that are previously unknown, showcasing real-world security impact.

关键词： fuzzing coverage-guided fuzzing online stochastic control software testing

来源：评论

学校读者我要写书评

暂无评论

A Seed Scheduling Method With a Reinforcement Learning for a coverage guided fuzzing

引用

IEEE ACCESS 2023年 11卷 2048-2057页

作者： Choi, Gyeongtaek Jeon, Seungho Cho, Jaeik Moon, Jongsub Korea Univ Sch Cybersecur Dept Informat Secur Seoul South Korea Lewis Univ Dept Engn Comp Sci Romeoville IL 60446 USA

Seed scheduling, which determines which seed is input to the fuzzer first and the number of mutated test cases that are generated for the input seed, significantly influences crash detection performance in fuzz testing. Even for the same fuzzer, the performance in terms of detecting crashes that cause program failure varies considerably depending on the seed-scheduling method used. Most existing coverage-guided fuzzers use a heuristic seed-scheduling method. These heuristic methods can't properly determine the seed with a high potential to cause the crash;thus, the fuzzer detects the crash inefficiently. Moreover, the fuzzer's crash detection performance is affected by the characteristics of target programs. To address this problem, we propose a general-purpose reinforced seed-scheduling method that not only improves the crash detection performance of fuzz testing but also remains unaffected by the characteristics of the target program. The fuzzer with the proposed method detected the most crashes in all but one of the target programs in which crashes were detected in the experimental results conducted on various programs, and showed better crash detection efficiency than the comparison targets overall.

关键词： Computer crashes fuzzing Reinforcement learning Scheduling Computer security Information security Codes Software testing Computer bugs coverage-guided fuzzing power schedule reinforcement learning seed scheduling seed selection

来源：评论

学校读者我要写书评

暂无评论

Industry Practice of coverage-guided Enterprise-Level DBMS fuzzing 43

Industry Practice of Coverage-Guided Enterprise-Level DBMS F...

引用

43rd IEEE/ACM International Conference on Software Engineering - Software Engineering in Practice (ICSE-SEIP) / 43rd ACM/IEEE International Conference on Software Engineering - New Ideas and Emerging Results (ICSE-NIER)

作者： Wang, Mingzhe Wu, Zhiyong Xu, Xinyi Liang, Jie Zhou, Chijin Zhang, Huafeng Jiang, Yu Tsinghua Univ Sch Software KLISS BNRist Beijing Peoples R China Huawei Technol Co Ltd Beijing Peoples R China

ISBN: (纸本)9780738146690

As an infrastructure for data persistence and analysis, Database Management Systems (DBMSs) are the cornerstones of modern enterprise software. To improve their correctness, the industry has been applying blackbox fuzzing for decades. Recently. the research community achieved impressive fuzzing gains using coverage guidance. However, due to the complexity and distributed nature of enterprise-level DBMSs, seldom are these researches applied to the industry. In this paper, we apply coverage-guided fuzzing to enterprise-level DBMSs from Huawei and Bloomberg LB. In our practice of testing GaussDB and Comdb2, we found major challenges in all three testing stages. The challenge-, are collecting precise coverage, optimizing fuzzing performance, and analyzing root causes. In search of a general method to overcome these challenges. we propose RATEL, a coverage-guided fuzzer for enterprise-level DBMSs. With its industry-oriented design, RATEL. improves the feedback precision, enhances the robustness of input generation. and performs an on-line investigation on the root cause of hugs. As a result. RATEL outperformed other fuzzers in terms of coverage and bugs. Compared to industrial black box fuzzers SQLsmith and SQLancer. as well as coverage-guided academic fuzzer Squirrel. R Mt-i. covered 38,3%. 106.14%, 583.05% more bask blocks than the best results of other three fuzzers in GaussDB, PostgreSQL, and Comdb2, respectively. More importantly. RATEL. has discovered 32, 32, and unknown bugs in GaussDB. Comdb2. and PostgreSQL.

关键词： DBMS testing coverage-guided fuzzing enterprise DBMS

来源：评论

学校读者我要写书评

暂无评论

Adaptive scheduling-based fine-grained greybox fuzzing for cloud-native applications

引用

JOURNAL OF CLOUD COMPUTING-ADVANCES SYSTEMS AND APPLICATIONS 2024年第1期13卷 1-22页

作者： Yang, Jiageng Liu, Chuanyi Fang, Binxing Harbin Inst Technol Sch Comp Sci & Technol Shenzhen 518055 Guangdong Peoples R China

coverage-guided fuzzing is one of the most popular approaches to detect bugs in programs. Existing work has shown that coverage metrics are a crucial factor in guiding fuzzing exploration of targets. A fine-grained coverage metric can help fuzzing to detect more bugs and trigger more execution states. Cloud-native applications that written by Golang play an important role in the modern computing paradigm. However, existing fuzzers for Golang still employ coarse-grained block coverage metrics, and there is no fuzzer specifically for cloud-native applications, which hinders the bug detection in cloud-native applications. Using fine-grained coverage metrics introduces more seeds and even leads to seed explosion, especially in large targets such as cloud-native ***, we employ an accurate edge coverage metric in fuzzer for Golang, which achieves finer test granularity and more accurate coverage information than block coverage metrics. To mitigate the seed explosion problem caused by fine-grained coverage metrics and large target sizes, we propose smart seed selection and adaptive task scheduling algorithms based on a variant of the classical adversarial multi-armed bandit (AMAB) algorithm. Extensive evaluation of our prototype on 16 targets in real-world cloud-native infrastructures shows that our approach detects 233% more bugs than go-fuzz, achieving an average coverage improvement of 100.7%. Our approach effectively mitigates seed explosion by reducing the number of seeds generated by 41% and introduces only 14% performance overhead.

关键词： coverage-guided fuzzing Cloud-native application Fine-grained coverage metric Scheduling algorithm Exploration-exploitation problem

来源：评论

学校读者我要写书评

暂无评论

LinFuzz: Program-Sensitive Seed Scheduling Greybox fuzzing Based on LinUCB Algorithm

引用

IEEE ACCESS 2024年 12卷 74843-74860页

作者： Su, Yinghao Xiong, Dapeng Wan, Ying Shi, Chenghao Zeng, Qingyao Space Engn Univ Inst Grad Beijing 101416 Peoples R China Space Engn Univ Inst Aerosp Informat Beijing 101416 Peoples R China

The mutation-based greybox fuzz testing technique is one of the widely used dynamic vulnerability detection techniques. It generates testcases for testing by mutating input seeds. In the process of fuzz testing, the seed scheduling strategy and energy scheduling strategy impact the test results and efficiency. Existing seed scheduling strategies, however, only consider a few specific seed attributes and ignore contextual information during seed execution. This oversight makes it challenging to prioritize the selection of suitable seeds based on historical fuzz test results. Meanwhile, current methods for calculating coverage lack evaluation of software paths, which makes it easy to waste time on testing high-frequency and low-risk paths. This article proposes a new greybox fuzzing scheme, LinFuzz, which transforms the seed scheduling problem into a contextual multi-armed bandit machine model. It utilizes the LinUCB algorithm to assess the value of seeds for scheduling by considering their historical execution information. At the same time, LinFuzz improves the calculation method for fuzz testing path rewards and the seed energy scheduling algorithm. It allocates more energy for testing low-frequency paths in the testing program, thereby enhancing the efficiency of exploration and the path coverage ability of the testing tool. This article evaluated the proposed LinFuzz on 12 real programs in comparison with other open-source tools such as AFL, AFLFast, FairFuzz, Neuzz, etc. The results show that under the same testing time budget, LinFuzz outperforms other tools in terms of vulnerability discovery quantity and code coverage ability. Compared with complex fuzz testing optimization algorithms, LinFuzz has lower memory consumption and time complexity.

关键词： fuzzing Testing Resource management Job shop scheduling Context modeling Software algorithms Scheduling algorithms Memory management coverage-guided fuzzing LinUCB algorithm seed scheduling

来源：评论

学校读者我要写书评

暂无评论

A lightweight and high-precision approach for bulky JavaScript engines fuzzing 22

A lightweight and high-precision approach for bulky JavaScri...

引用

IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) / BigDataSE Conference / CSE Conference / EUC Conference / ISCI Conference

作者： Zhou, Lianpei Xiao, Xi Hu, Guangwu Li, Hao Wu, Xiangbo Zhou, Tao Tsinghua Univ Int Grad Sch Shenzhen Peoples R China Shenzhen Inst Informat Technol Sch Comp Sci Shenzhen Guangdong Peoples R China Sci & Technol Commun Networks Lab Shijiazhuang Hebei Peoples R China Guangdong Prov Key Lab Cyber & Informat Secur Vul Guangzhou Peoples R China

ISBN: (纸本)9798350381993;9798350382006

Traditional coverage-based fuzzing gives equal attention to every part of a code. Despite much progress, we observe that existing schemes still not comprehensively use the coverage feedback mechanism when fuzzing bulky JavaScript engines because of severe path collisions. To improve the precision of coverage feedback and target the vulnerable JIT compiler of Javascript engines, we presented our fuzzer, called LF(Light Fuzzer), a lightweight and high-precision fuzzer for bulky JavaScript engines fuzzing. First, LF advocates a technique to confine instrumentation to the JIT-related "critical functions" to mitigate collisions. Additionally, LF utilizes static analysis to establish dominant relationships between critical functions. Lastly, LF incorporates seed scheduling with feedback information of control flow at the function level to dynamically target JIT. These combined strategies make LF a lightweight and high-precision fuzzer for fuzzing bulky JavaScript engines. In our evaluation, LF outperforms the state-of-art coverage-guided JavaScript fuzzer DIE in different coverage types, and LF is also more effective in triggering unique crashes compared to DIE.

关键词： coverage-guided fuzzing bulky JavaScript engines critical functions control flow information

来源：评论

学校读者我要写书评

暂无评论

Leveraging Binary coverage for Effective Generation Guidance in Kernel fuzzing 24

Leveraging Binary Coverage for Effective Generation Guidance...

引用

31st Conference on Computer and Communications Security

作者： Liu, Jianzhong Shen, Yuheng Xu, Yiru Jiang, Yu Tsinghua Univ Beijing Peoples R China

ISBN: (纸本)9798400706363

State-of-the-art kernel fuzzers use edge-based code coverage metrics for novel behavior detection. However, code coverage is not sufficient for operating system kernels, for they contain many untracked but interesting features, such as comparison operands, kernel state identifiers, flags, and executable code, within its data segments, that reflects different execution patterns, and can profoundly increase the granularity and scope of the coverage metrics. This paper proposes the use of Kernel Binary coverage Feedback, a comprehensive and effective execution feedback method that provides metrics reflecting the execution coverage status of the entire binary coverage to kernel fuzzers. Our approach abstracts program behavior as its memory access pattern during execution, and considers all such relevant behavior, including standard memory reads and writes, predicate comparisons, etc., to obtain a coverage metric on the whole kernel binary for input generation guidance. We implemented a prototype tool KBinCov and integrated it into a popular kernel fuzzer Syzkaller. We evaluated its effectiveness against vanilla Syzkaller, aswell as certain other approaches, including StateFuzz and IJON. Our results show that KBinCov achieves code and binary coverage increases of 7%, 7%, 9%, and 87%, 34%, 61%, compared to Syzkaller (using kcov), StateFuzz, and IJON, on recent versions of the Linux kernels, respectively, while only incurring a 1.74x overhead increase, less than StateFuzz and IJON's 2.5x and 2.2x figures. In addition, we found 21 previously unknown bugs using KBinCov with Syzkaller, more than Syzkaller (with kcov), StateFuzz, and IJON, which found 4, 4, and 2 bugs, respectively.

关键词： kernel fuzzing coverage-guided fuzzing operating systems security software testing

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：