论文标题
SLOPT：基于突变模糊的强盗优化框架
SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing
论文作者
论文摘要
基于突变的模糊已成为过去十年中最常见的脆弱性发现解决方案之一。在针对特定程序时可以优化模糊，并且鉴于某些研究已采用在线优化方法自动执行此操作，即以程序 - 敏锐的方式为任何给定程序调整fuzzers。但是，以前的研究既没有完全探索适合在线优化方法的突变方案，也没有适合于突变方案的在线优化方法。在这项研究中，我们提出了一个称为SLOPT的优化框架，该框架既包含了强盗友好的突变方案和突变型式的匪徒的强盗算法。 SLOPT的优点是，它通常可以将其纳入现有的模糊器中，例如AFL和Honggfuzz。作为概念证明，我们通过将SLOPT集成到AFL ++中实现了SLOPT-AFL ++，并表明SLOPT启用SLOPT-AFL ++提供的程序不合时宜的优化在十个真实世界Fuzzbench程序中都比AFL ++获得了更高的代码覆盖率。此外，我们在OSS-Fuzz的几个现实世界中运行了SLOPT-AFL ++，并成功地确定了三个以前未知的漏洞，即使AFL ++在OSS-Fuzz上有相当数量的CPU天，即使这些程序已被AFL ++模糊。
Mutation-based fuzzing has become one of the most common vulnerability discovery solutions over the last decade. Fuzzing can be optimized when targeting specific programs, and given that, some studies have employed online optimization methods to do it automatically, i.e., tuning fuzzers for any given program in a program-agnostic manner. However, previous studies have neither fully explored mutation schemes suitable for online optimization methods, nor online optimization methods suitable for mutation schemes. In this study, we propose an optimization framework called SLOPT that encompasses both a bandit-friendly mutation scheme and mutation-scheme-friendly bandit algorithms. The advantage of SLOPT is that it can generally be incorporated into existing fuzzers, such as AFL and Honggfuzz. As a proof of concept, we implemented SLOPT-AFL++ by integrating SLOPT into AFL++ and showed that the program-agnostic optimization delivered by SLOPT enabled SLOPT-AFL++ to achieve higher code coverage than AFL++ in all of ten real-world FuzzBench programs. Moreover, we ran SLOPT-AFL++ against several real-world programs from OSS-Fuzz and successfully identified three previously unknown vulnerabilities, even though these programs have been fuzzed by AFL++ for a considerable number of CPU days on OSS-Fuzz.
