Abstract:

Directed grey box fuzzing (DGF) is a novel technology in the field of vulnerability mining whose biggest advantage is high efficiency. DGF has been widely used in many fields such as patch testing, information flow detection, and crash reproduction. However, there are two problems with existing DGF technologies. First, traditional DGF does not consider that long-path seeds can also trigger vulnerabilities, and does not consider the priority of seeds. Second, strong random mutation wastes a lot of resources, thereby reducing the efficiency of directed fuzzing. This paper proposed a directed grey-box fuzzing method based on dynamic time slicing and efficient mutation. Firstly, this paper proposed a dynamic time slicing strategy, which divided time into three stages, including indiscriminate exploration stage, short-path priority stage and long-path priority stage, and also applied a simulated annealing algorithm based on the execution frequency of seed paths for energy distribution. Secondly, the ε-greedy algorithm was also used to guide the havoc stage of the mutation process to improve the mutation efficiency. Based on these three strategies, this paper implements a system called DyFuzz and compares it with AFLGo on 8 real datasets, which can effectively improve the probability and speed of triggering vulnerabilities, cover more edges and trigger more crashes.

Key words: vulnerability mining, directed fuzzing, dynamic time slicing, havoc mutation