arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2607.03396cs.CRcs.SE
收藏

执行差异图：从执行跟踪中有效发现控制流作为模糊测试反馈

Execution Divergence Graphs:Effective Discovery of Control-Flows from Execution Traces as Fuzzing Feedback

CISPA Helmholtz Center for Information Security（CISPA 赫尔姆霍兹信息安全中心）

Yu-De Lin, Nils Ole Tippenhauer

阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

探讨利用运行时执行构建的类控制流图结构反馈来指导模糊测试器的方法，先介绍简单差异检测法，后提出基于执行差异图的改进方法，实现并证明其优于基线盲目模糊测试器。

摘要：

模糊测试是专有软件安全测试的常用方法。高效测试策略依赖执行反馈指导输入生成，然而在黑盒设备原位模糊测试和混淆编译二进制文件模糊测试等场景中无法收集此类反馈。本文讨论利用从运行时执行构建的类控制流图（CFG-like）结构的反馈来指导模糊测试器的方法。首先概述一种识别唯一执行跟踪的简单差异检测方法，然后提出基于执行差异图（EDG）的改进方法。我们实现了这两种方法，并证明它们优于基线盲目模糊测试器。此外，我们讨论了一些特殊挑战，例如循环中的重复代码执行，并表明基于EDG的方法能够有效地处理这些挑战。然后，我们证明了我们的方法能够对许多混淆目标进行有效的模糊测试，并比较了其在无法进行静态检测的场景中的性能。虽然我们专注于攻击者可以直接观察完整指令跟踪的场景，但我们的方案也可以应用于具有其他反馈渠道（如功耗）的场景。

英文摘要：

Fuzz testing is a popular approach to the security testing of proprietary software. Efficient testing strategies rely on execution feedback to guide the input generation process, particularly when the basic blocks in the binary can be directly observed and instrumented. Unfortunately, collecting such feedback is impossible in scenarios such as in-situ fuzzing of black-box devices and the fuzzing of obfuscated compiled binaries. In this work, we discuss approaches to guide the fuzzer using feedback derived from a control-flow-graph-like (CFG-like) structure constructed from runtime execution. We start by outlining a simple divergence-detection approach that identifies unique execution traces, and then present an improved approach based on an Execution Divergence Graph (EDG). We implement both approaches and demonstrate that they outperform a baseline blind fuzzer. In addition, we discuss particular challenges, such as repeated code execution in loops, and show that the EDG-based approach handles them effectively. We then demonstrate that our approach enables effective fuzzing of a number of obfuscated targets, and compare its performance in scenarios where static instrumentation is impossible. While we focus on a scenario in which full instruction traces are directly observable by the attacker, our scheme can also be applied in scenarios with other feedback channels, such as power consumption.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑