HOPPER：面向库的解释性模糊测试
HOPPER: Interpretative Fuzzing for Libraries
AI总结：
提出HOPPER框架，通过将库模糊测试转化为解释器模糊测试，学习API内部和API间约束并感知语法变异生成输入，无需领域知识即可广泛探索API用法，在代码覆盖率和漏洞发现上显著优于现有方案。
摘要：
尽管最先进的模糊测试器能够高效生成输入，但现有的模糊测试驱动程序仍然无法充分覆盖库中的入口点。大多数模糊测试驱动程序由开发者手动编写，其质量依赖于开发者对代码的理解。现有研究尝试通过从代码和执行轨迹中学习API用法来自动生成模糊测试驱动程序。然而，生成的模糊测试驱动程序受限于被学习代码中的少数特定调用序列。为了应对这些挑战，我们提出了HOPPER，它能够在无需任何领域知识来编写模糊测试驱动程序的情况下对库进行模糊测试。它将库模糊测试问题转化为解释器模糊测试问题。与待测库链接的解释器能够解释描述任意API用法的输入。为了给解释器生成语义正确的输入，HOPPER学习库中的API内部和API间的约束，并在感知语法的前提下对程序进行变异。我们实现了HOPPER，并在11个真实世界的库上评估了其有效性，与手动编写的模糊测试器和其他自动解决方案进行了对比。结果表明，HOPPER在代码覆盖率和漏洞发现方面均大幅优于其他模糊测试器，发现了25个其他模糊测试器无法发现的先前未知漏洞。此外，我们证明了所提出的API内部和API间约束学习方法能够正确学习库所隐含的约束，从而显著提高模糊测试效率。实验结果表明，HOPPER能够开箱即用地为库模糊测试探索广泛的API用法。
英文摘要：
Despite the fact that the state-of-the-art fuzzers can generate inputs efficiently, existing fuzz drivers still cannot adequately cover entries in libraries. Most of these fuzz drivers are crafted manually by developers, and their quality depends on the developers' understanding of the code. Existing works have attempted to automate the generation of fuzz drivers by learning API usage from code and execution traces. However, the generated fuzz drivers are limited to a few specific call sequences by the code being learned. To address these challenges, we present HOPPER, which can fuzz libraries without requiring any domain knowledge to craft fuzz drivers. It transforms the problem of library fuzzing into the problem of interpreter fuzzing. The interpreters linked against libraries under test can interpret the inputs that describe arbitrary API usage. To generate semantically correct inputs for the interpreter, HOPPER learns the intra- and inter-API constraints in the libraries and mutates the program with grammar awareness. We implemented HOPPER and evaluated its effectiveness on 11 real-world libraries against manually crafted fuzzers and other automatic solutions. Our results show that HOPPER greatly outperformed the other fuzzers in both code coverage and bug finding, having uncovered 25 previously unknown bugs that other fuzzers couldn't. Moreover, we have demonstrated that the proposed intra- and inter-API constraint learning methods can correctly learn constraints implied by the library and, therefore, significantly improve the fuzzing efficiency. The experiment results indicate that HOPPER is able to explore a vast range of API usages for library fuzzing out of the box.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
