Discover deeper bugs with dynamic symbolic execution and coverage-based fuzz testing

作者：Zhang, Bin; Feng, Chao^*; Herrera, Adrian; Chipounov, Vitaly; Candea, George; Tang, Chaojing

来源：IET Software, 2018, 12(6): 507-519.

DOI：10.1049/iet-sen.2017.0200

• program testing
• security of data
• program debugging
• fuzzy set theory
• symbolic loop bucket optimisation
• seed selection method
• execution paths
• vanilla fuzz testing
• popular program testing techniques
• dynamic symbolic execution
• hybrid testing methods
• lazy symbolic pointer concretisation method
• deeper bugs
• coverage-based fuzz testing
• modern software complexity
• program structures
• seed files
• off-the-shelf vulnerability detection tools

Coverage-based fuzz testing and dynamic symbolic execution are both popular program testing techniques. However, on their own, both techniques suffer from scalability problems when considering the complexity of modern software. Hybrid testing methods attempt to mitigate these problems by leveraging dynamic symbolic execution to assist fuzz testing. Unfortunately, the efficiency of such methods is still limited by specific program structures and the schedule of seed files. In this study, the authors introduce a novel lazy symbolic pointer concretisation method and a symbolic loop bucket optimisation to mitigate path explosion caused by dynamic symbolic execution in hybrid testing. They also propose a distance-based seed selection method to rearrange the seed queue of the fuzzer engine in order to achieve higher coverage. They implemented a prototype and evaluate its ability to find vulnerabilities in software and cover new execution paths. They show on different benchmarks that it can find more crashes than other off-the-shelf vulnerability detection tools. They also show that the proposed method can discover 43% more unique paths than vanilla fuzz testing.

• 出版日期2018-12
• 单位中国人民解放军国防科学技术大学