Hawkeye: Towards a desired directed grey-box fuzzer

Hongxu Chen, Bihuan Chen, Yinxing Xue, Xiaofei Xie, Yang Liu, Yuekang Li, Xiuheng Wu

研究成果: Chapter in Book/Report/Conference proceedingConference contribution

58 被引用数 (Scopus)

抄録

Grey-box fuzzing is a practically effective approach to test real-world programs. However, most existing grey-box fuzzers lack directedness, i.e. the capability of executing towards user-specified target sites in the program. To emphasize existing challenges in directed fuzzing, we propose Hawkeye to feature four desired properties of directed grey-box fuzzers. Owing to a novel static analysis on the program under test and the target sites, Hawkeye precisely collects the information such as the call graph, function and basic block level distances to the targets. During fuzzing, Hawkeye evaluates exercised seeds based on both static information and the execution traces to generate the dynamic metrics, which are then used for seed prioritization, power scheduling and adaptive mutating. These strategies help Hawkeye to achieve better directedness and gravitate towards the target sites. We implemented Hawkeye as a fuzzing framework and evaluated it on various real-world programs under different scenarios. The experimental results showed that Hawkeye can reach the target sites and reproduce the crashes much faster than state-of-the-art grey-box fuzzers such as AFL and AFLGo. Specially, Hawkeye can reduce the time to exposure for certain vulnerabilities from about 3.5 hours to 0.5 hour. By now, Hawkeye has detected more than 41 previously unknown crashes in projects such as Oniguruma, MJS with the target sites provided by vulnerability prediction tools; all these crashes are confirmed and 15 of them have been assigned CVE IDs.

本文言語英語
ホスト出版物のタイトルCCS 2018 - Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
出版社Association for Computing Machinery
ページ2095-2108
ページ数14
ISBN(電子版)9781450356930
DOI
出版ステータス出版済み - 10 15 2018
外部発表はい
イベント25th ACM Conference on Computer and Communications Security, CCS 2018 - Toronto, カナダ
継続期間: 10 15 2018 → …

出版物シリーズ

名前Proceedings of the ACM Conference on Computer and Communications Security
ISSN(印刷版)1543-7221

会議

会議25th ACM Conference on Computer and Communications Security, CCS 2018
国/地域カナダ
CityToronto
Period10/15/18 → …

All Science Journal Classification (ASJC) codes

  • ソフトウェア
  • コンピュータ ネットワークおよび通信

フィンガープリント

「Hawkeye: Towards a desired directed grey-box fuzzer」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル