An Improved Directed Grey-box Fuzzer

Grey-box fuzzing is widely used to discover program vulnerabilities. However, most existing grey-box fuzzers cannot be directed towards sensitive points and dangerous locations in the programs. In this paper, in order to improve the performance of directed Grey-box fuzzing, we develop two strategies to improve the original directed Grey-box fuzzer, AFLGo, and implement a new directed Grey-box fuzzer, Guided-Fuzzer, to reach dangerous positions in the program faster. In the process of directed grey-box fuzzing, Guided-Fuzzer evaluates the seeds based on the control flow graph information and the execution path of the seed. And it prioritizes each seed based on the seed's distance from the target, seed's energy, and the number of times the seed are executed. Based on the priorities of seeds, Guided-Fuzzer puts seeds in the appropriate position of the input queue, and adopts an adaptive mutation strategy that combines coarse-grained mutant actions, medium-grained mutant actions and fine-grained mutant actions according to the distances between the seeds and the target location. Experimental results show that Guided-Fuzzer can reach the target location faster than the original directed Grey-box fuzzer AFLGo. In addition, on some tested programs, Guided-Fuzzer can reduce the time to discover certain vulnerabilities from about 3.2 hours to 1.2 hours, and effectively improves the efficiency of directed Grey-box fuzzing.