FuzzerAid：基于故障特征的模糊崩溃检测
FuzzerAid: Grouping Fuzzed Crashes Based On Fault Signatures
摘要：
Fuzzing已经成为发现程序中错误和漏洞的重要方法。工业中部署的许多模糊器每天都在运行，可能会产生大量的崩溃。诊断这种崩溃可能非常具有挑战性和耗时。现有的模糊器通常采用诸如代码覆盖或调用堆栈散列之类的算法来消除错误的重复报告。虽然这些漏洞分析很便宜，但它们通常不精确，最终仍然报告了许多对应于同一个bug的“独特”崩溃。在本文中，我们提出了FuzzerAid，使用故障签名组崩溃报告的模糊。错误签名是一个小的可执行程序，由从原始程序中选择的可以重现错误的必要语句组成。在我们的方法中，我们首先使用给定的崩溃生成故障签名。然后，我们使用其他崩溃诱导输入执行故障签名。如果故障再现，我们将崩溃分类到标有故障特征的组中;如果没有，我们生成一个新的故障特征。在对所有导致崩溃的输入进行分类之后，我们进一步将相同根本原因的故障特征合并到一个组中。我们在一个名为FuzzerAid的工具中实现了我们的方法，并在15个真实世界的错误和4个大型开源项目中产生的3020个崩溃中对其进行了评估。我们的评估表明，我们能够正确地对99.1%的崩溃进行分组，并且仅报告了17个（+2）“独特”错误，优于最先进的模糊器。
英文摘要：
Fuzzing has been an important approach for finding bugs and vulnerabilities in programs. Many fuzzers deployed in industry run daily and can generate an overwhelming number of crashes. Diagnosing such crashes can be very challenging and time-consuming. Existing fuzzers typically employ heuristics such as code coverage or call stack hashes to weed out duplicate reporting of bugs. While these heuristics are cheap, they are often imprecise and end up still reporting many "unique" crashes corresponding to the same bug. In this paper, we present FuzzerAid that uses fault signatures to group crashes reported by the fuzzers. Fault signature is a small executable program and consists of a selection of necessary statements from the original program that can reproduce a bug. In our approach, we first generate a fault signature using a given crash. We then execute the fault signature with other crash inducing inputs. If the failure is reproduced, we classify the crashes into the group labeled with the fault signature; if not, we generate a new fault signature. After all the crash inducing inputs are classified, we further merge the fault signatures of the same root cause into a group. We implemented our approach in a tool called FuzzerAid and evaluated it on 3020 crashes generated from 15 real-world bugs and 4 large open source projects. Our evaluation shows that we are able to correctly group 99.1% of the crashes and reported only 17 (+2) "unique" bugs, outperforming the state-of-the-art fuzzers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
