通过梯度下降和布尔表达式覆盖实现灰盒模糊测试（技术报告）
Gray-Box Fuzzing via Gradient Descent and Boolean Expression Coverage (Technical Report)
AI总结：
本文提出监控数值转布尔指令并用梯度下降反转谓词结果的灰盒模糊测试算法，可间接提升分支覆盖，并在 Test-Comp 2023 上媲美结合模型检验等技术的领先工具。
摘要：
我们提出了一种新颖的灰盒模糊测试算法，用于监控将数值转换为布尔值的指令执行。这类指令中的一个重要类别会对谓词求值，例如 LLVM 中的 *cmp。仅凭这一点，我们就能在模糊测试过程中以合理的准确性即时推断输入依赖关系（参见污点分析），进而能够在这些指令上有效利用梯度下降（以反转其求值结果）。尽管该模糊测试试图最大化指令覆盖，但它与标准分支覆盖之间存在一种有趣的关联，我们能够间接实现这种覆盖。在 Test-Comp 2023 基准测试上的评估表明，尽管我们的方法是纯粹的灰盒模糊测试，却能够与竞赛中的领先工具竞争；这些工具将模糊测试与模型检验、符号执行或抽象解释等其他强大技术相结合。
英文摘要：
We present a novel gray-box fuzzing algorithm monitoring executions of instructions converting numerical values to Boolean ones. An important class of such instructions evaluate predicates, e.g., *cmp in LLVM. That alone allows us to infer the input dependency (c.f. the taint analysis) during the fuzzing on-the-fly with reasonable accuracy, which in turn enables an effective use of the gradient descent on these instructions (to invert the result of their evaluation). Although the fuzzing attempts to maximize the coverage of the instructions, there is an interesting correlation with the standard branch coverage, which we are able to achieve indirectly. The evaluation on Test-Comp 2023 benchmarks shows that our approach, despite being a pure gray-box fuzzing, is able to compete with the leading tools in the competition, which combine fuzzing with other powerful techniques like model checking, symbolic execution, or abstract interpretation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
