SHAPFUZZ：通过Shapley引导的字节选择实现高效模糊测试
SHAPFUZZ: Efficient Fuzzing via Shapley-Guided Byte Selection
AI总结：
提出ShapFuzz，一种基于Shapley值和上下文多臂老虎机的模糊测试方法，通过低开销量化字节重要性来指导选择与变异，相比现有先进模糊测试器能发现更多边、暴露更多漏洞并发现新CVE漏洞。
摘要：
基于变异的模糊测试在发现未见代码和暴露漏洞方面既流行又有效。然而，只有少数研究集中于量化输入字节的重要性，即一个字节对发现新代码的贡献程度。这些研究通常关注获取输入字节与路径约束之间的关系，而忽略了并非所有与约束相关的字节都能发现新代码这一事实。在本文中，我们进行Shapley分析以理解字节位置对模糊测试性能的影响，并发现某些字节位置比其他位置更重要。这种属性通常在不同的种子间保持一致。基于这一观察，我们提出了一种新颖的模糊测试解决方案ShapFuzz，以指导字节选择和变异。具体而言，ShapFuzz在模糊测试过程中以低开销更新每个输入被测试时字节的Shapley值（重要性），并利用上下文多臂老虎机来权衡对高Shapley值字节和低频选择字节的变异。我们基于AFL++实现了该解决方案的原型，即ShapFuzz。我们将ShapFuzz与十个最先进的模糊测试器进行评估，包括五个字节调度增强型模糊测试器和五个常用模糊测试器。与字节调度增强型模糊测试器相比，ShapFuzz在三组初始种子集上发现了更多边并暴露了更多漏洞。与常用模糊测试器相比，ShapFuzz多暴露了20个漏洞，而表现最佳的模糊测试器在MAGMA基准上发现了6个CVE漏洞。此外，ShapFuzz在程序的最新版本中发现了11个新漏洞，其中3个已被供应商确认
英文摘要：
Mutation-based fuzzing is popular and effective in discovering unseen code and exposing bugs. However, only a few studies have concentrated on quantifying the importance of input bytes, which refers to the degree to which a byte contributes to the discovery of new code. They often focus on obtaining the relationship between input bytes and path constraints, ignoring the fact that not all constraint-related bytes can discover new code. In this paper, we conduct Shapely analysis to understand the effect of byte positions on fuzzing performance, and find that some byte positions contribute more than others and this property often holds across seeds. Based on this observation, we propose a novel fuzzing solution, ShapFuzz, to guide byte selection and mutation. Specifically, ShapFuzz updates Shapley values (importance) of bytes when each input is tested during fuzzing with a low overhead, and utilizes contextual multi-armed bandit to trade off between mutating high Shapley value bytes and low-frequently chosen bytes. We implement a prototype of this solution based on AFL++, i.e., ShapFuzz. We evaluate ShapFuzz against ten state-of-the-art fuzzers, including five byte schedule-reinforced fuzzers and five commonly used fuzzers. Compared with byte schedule-reinforced fuzzers, ShapFuzz discovers more edges and exposes more bugs than the best baseline on three different sets of initial seeds. Compared with commonly used fuzzers, ShapFuzz exposes 20 more bugs than the best comparison fuzzer, and discovers 6 more CVEs than the best baseline on MAGMA. Furthermore, ShapFuzz discovers 11 new bugs on the latest versions of programs, and 3 of them are confirmed by vendors.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
