Loading [MathJax]/extensions/MathZoom.js
Fuzzing With Optimized Grammar-Aware Mutation Strategies | IEEE Journals & Magazine | IEEE Xplore

Fuzzing With Optimized Grammar-Aware Mutation Strategies


A novel mutation strategy for grammar-based fuzzing, which combines Subtree-pool-based Random Mutation and AST-node-level power schedule. The subtree pool provides an aff...

Abstract:

Fuzzing is a widely used technique to discover vulnerabilities in software. However, for programs requiring highly structured inputs, the byte-based mutation strategies i...Show More

Abstract:

Fuzzing is a widely used technique to discover vulnerabilities in software. However, for programs requiring highly structured inputs, the byte-based mutation strategies in existing fuzzers have difficulties in generating valid inputs. To resolve this challenge, Grammar-Based Fuzzing (GBF) utilizes existing grammar specifications to generate new inputs. Some GBFs perform mutation based on Abstract Syntax Trees (ASTs), which can generate inputs conforming to grammars. However, the existing GBFs neglect using feedback to optimize mutation strategies, and blindly generate inputs without considering the effectiveness of those inputs. In this paper, we use the power schedule and the subtree pool to optimize mutation strategies. Specifically, we first translate input files into ASTs, and extract subtrees from ASTs into a subtree pool. Then, we optimize the power schedule on AST nodes based on a probabilistic model. That is, we adaptively determine the time budget for mutating an AST node. Finally, we replace AST nodes along with their subtrees using the ones we select from the subtree pool. We implement a fuzzing tool to demonstrate our strategies. The experiment results show that our method outperforms the state-of-the-art methods in fuzzing efficiency.
A novel mutation strategy for grammar-based fuzzing, which combines Subtree-pool-based Random Mutation and AST-node-level power schedule. The subtree pool provides an aff...
Published in: IEEE Access ( Volume: 9)
Page(s): 95061 - 95071
Date of Publication: 01 July 2021
Electronic ISSN: 2169-3536

Funding Agency:


References

References is not available for this document.