Angora：基于原则搜索的有效模糊搜索
Angora: Efficient Fuzzing by Principled Search
摘要：
Fuzzing是一种用于查找软件bug的流行技术。然而，最先进的模糊器的性能还有很多需要改进的地方。基于符号执行的模糊器产生高质量的输入，但运行缓慢，而基于随机突变的模糊器运行快，但难以产生高质量的输入。我们提出了安哥拉，一个新的基于变异的模糊，优于国家的最先进的模糊的一个很大的保证金。Angora的主要目标是通过解决路径约束而无需符号执行来增加分支覆盖率。为了有效地解决路径约束，我们引入了几个关键技术：可扩展的字节级污点跟踪，上下文相关的分支计数，搜索基于梯度下降，和输入长度探索。在LAVA-M数据集上，Angora发现了几乎所有注入的错误，发现的错误比我们与之相比的任何其他模糊器都多，并且发现的错误是程序中第二好的模糊器的八倍。Angora还发现了103个LAVA作者注入但无法触发的bug。我们还在8个流行的成熟开放源程序上测试了Angora。Angora在file、jhead、nm、objdump和size中分别发现了6、52、29、40和48个新bug。我们测量了安哥拉的覆盖率，并评估了其关键技术如何为其令人印象深刻的性能做出贡献。
英文摘要：
Fuzzing is a popular technique for finding software bugs. However, the performance of the state-of-the-art fuzzers leaves a lot to be desired. Fuzzers based on symbolic execution produce quality inputs but run slow, while fuzzers based on random mutation run fast but have difficulty producing quality inputs. We propose Angora, a new mutation-based fuzzer that outperforms the state-of-the-art fuzzers by a wide margin. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution. To solve path constraints efficiently, we introduce several key techniques: scalable byte-level taint tracking, context-sensitive branch count, search based on gradient descent, and input length exploration. On the LAVA-M data set, Angora found almost all the injected bugs, found more bugs than any other fuzzer that we compared with, and found eight times as many bugs as the second-best fuzzer in the program who. Angora also found 103 bugs that the LAVA authors injected but could not trigger. We also tested Angora on eight popular, mature open source programs. Angora found 6, 52, 29, 40 and 48 new bugs in file, jhead, nm, objdump and size, respectively. We measured the coverage of Angora and evaluated how its key techniques contribute to its impressive performance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
