AdaRare：面向灰盒模糊测试的遥测引导联合剖面控制
AdaRare: Telemetry-Guided Joint Profile Control for Greybox Fuzzing
浏览论文内容
中文总结 AI 辅助
AdaRare是AFL++扩展，通过遥测引导的联合剖面控制优化灰盒模糊测试，在多组实验中提升了边覆盖率，还发现了5个内存漏洞。
中文摘要 AI 辅助
灰盒模糊测试结合了交互队列、变异、字典、能量和比较求解控制面，而现有的自适应系统通常优化其他决策对象或控制层。本文提出AdaRare，这是一个AFL++扩展，它将五个内部驱动机制协调为一个每5000毫秒更新一次的有界进程内剖面。完成窗口的、动作诱导的遥测数据输入到一个臂本地的近期加权线性评分器和一个剖面条件控制器目标中。该评分器借鉴了不相交LinUCB的代数结构，但作为闭环剖面排序机制，而非校准的上下文老虎机动作值估计器或统计置信区间。在三个连续的重复试验阶段，Main提供了广泛的集成系统证据：在所有8个目标上，AdaRare的中位边覆盖率高于普通AFL++，其中5个具有Holm显著性的比较结果。在最强的匹配结果中，在所有5个后续目标上，完整AdaRare的中位边覆盖率高于匹配CmpLog的AFL++，其中4个具有Holm显著性的比较结果。Batch A发现，在所有15个目标-控制比较中，遥测引导选择的中位值高于固定上下文、随机和轮询调度，其中13个具有Holm显著性的比较结果。实验未确立独立的No-A6与Shadow或稀缺束效应；A6证据依赖于目标，且在全批次校正下会减弱。在一个未匹配的固件案例研究中，AdaRare生成的输入暴露了5种不同的内存漏洞发现，每种都在单独的环境中重现，随后被分配了CVE标识符。对于5秒窗口，控制器边界计算的P99中位值低于6.5毫秒；包含同步日志的完整边界P99中位值低于14.7毫秒。这些测量表征了边界延迟，而非总系统开销。
英文摘要
Greybox fuzzers combine interacting queue, mutation, dictionary, energy, and comparison-solving control surfaces, while prior adaptive systems typically optimize other decision objects or control layers. We present AdaRare, an AFL++ extension that coordinates five internal actuation mechanisms as one bounded in-process profile updated every 5,000 ms. Completed-window, action-induced telemetry feeds an arm-local recency-weighted linear scorer and a profile-conditioned controller target. The scorer borrows the algebraic structure of disjoint LinUCB, but serves as a closed-loop profile-ranking mechanism rather than a calibrated contextual-bandit action-value estimator or statistical confidence bound. Across three sequential repeated-trial phases, Main provides broad integrated-system evidence: AdaRare has higher median edge coverage than vanilla AFL++ on all eight targets, with five Holm-significant comparisons. In the strongest matched result, Full AdaRare has higher median edge coverage than CmpLog-matched AFL++ on all five follow-up targets, with four Holm-significant comparisons. Batch A finds higher medians for telemetry-guided selection than fixed-context, random, and round-robin schedules in all 15 target-control comparisons, with 13 Holm-significant comparisons. The experiments do not establish independent No-A6-versus-Shadow or scarcity-bundle effects; A6 evidence is target-dependent and weakens under batch-wide correction. In an unmatched firmware case study, AdaRare-generated inputs exposed five distinct memory-corruption findings, each reproduced in a separate environment and later assigned a CVE identifier. Controller-boundary compute P99 medians are below 6.5 ms for a five-second window; complete-boundary P99 medians including synchronous logging are below 14.7 ms. These measurements characterize boundary latency, not total system overhead.
