关键词: 模糊测试, 自适应算法, 软件漏洞, 代码覆盖率, 变异

Abstract: Abstract: To solve the problem that there are a lot of invalid mutations, and the performance is wasted in Coverage-guided Fuzzing (CGF), an adaptive sensitive region mutation algorithm is proposed. Firstly, the mutation locations are divided into effective mutation location set and invalid mutation location set according to whether the mutated test case executed a new path. Then, the sensitive region is determined based on the effective mutation location, and the subsequent mutation is concentrated in the sensitive region. In the subsequent fuzzing process, the sensitive region of the corresponding seed is adjusted adaptively according to the execution result of the test case, so as to reduce the invalid mutations. In addition, a new seed selection strategy was designed to assistant the sensitive region mutation algorithm. The adaptive sensitive region mutation algorithm was integrated into the AFL and named Sensitive-region-based Mutation American Fuzzy Lop (SMAFL). SMAFL was evaluated on 12 popular applications and the results show that, on average, SMAFL found 39.3% more paths than AFL in the same amount of time, SMAFL fuzzed three to four times more than AFL, and SMAFL achieved higher code coverage across all 12 programs. In testing LAVA-M, SMAFL found more bugs and found them in less time.

Key words: fuzzing, adaptive algorithm, software vulnerability, code coverage, mutation