RLTG: Multi-targets directed greybox fuzzing

Directed greybox fuzzing guides fuzzers to explore specific objective code areas and has achieved good performance in some scenarios such as patch testing. However, if there are multiple objective code to explore, existing directed greybox fuzzers, such as AFLGo and Hawkeye, often neglect some targe...

Full description

Saved in:
Bibliographic Details
Published in:PloS one 2023-04, Vol.18 (4), p.e0278138-e0278138
Main Authors: He, Yubo, Zhu, Yuefei
Format: Article
Language:English
Subjects:
Algorithms
Allergy
Biology and Life Sciences
Computer and Information Sciences
Earth Sciences
Engineering and Technology
Evaluation
Exploitation
Fuzzy algorithms
Fuzzy logic
Fuzzy systems
Magma
Mathematical analysis
Physical Sciences
Prototypes
Research and Analysis Methods
Scheduling
Science Policy
Seeds
Testing
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Directed greybox fuzzing guides fuzzers to explore specific objective code areas and has achieved good performance in some scenarios such as patch testing. However, if there are multiple objective code to explore, existing directed greybox fuzzers, such as AFLGo and Hawkeye, often neglect some targets because they use harmonic means of distance and prefers to test those targets with shorter reachable path. Besides, existing directed greybox fuzzers cannot calculate the accurate distance due to indirect calls in the program. In addition, existing directed greybox fuzzers fail to address the exploration and exploitation problem and have poor efficiency in seed scheduling. To address these problems, we propose a dynamic seed distance calculation scheme, it increase the seed distance dynamically when the reachable path encounter indirect call. Besides, the seed distance calculation can deal with the bias problem in multi-targets scenarios. With the seed distance calculation method, we propose a new seed scheduling algorithm based on the upper confidence bound algorithm to deal with the exploration and exploitation problem in drected greybox fuzzing. We implemented a prototype RLTG and evaluate it on real-world programs. Evaluation of our prototype shows that our approach outperforms a state-of-the-art directed fuzzer AFLGo. On the multi-targets benchmark Magma, RLTG reproduces bugs with 6.9x speedup and finds 66.7% more bugs than AFLGo.
ISSN:1932-6203
1932-6203
DOI:10.1371/journal.pone.0278138