Prospector: Boosting Directed Greybox Fuzzing for Large-scale Target Sets with Iterative Prioritization
This program is tentative and subject to change.
Directed grey-box fuzzing (DGF) is an advanced technique in security testing, specifically designed to guide fuzzing tools toward predefined target sites within a software program. To improve its scalability on multiple targets, recent DGFs prioritize seeds that close to targets based on a more precise distance metric, and dynamically discard well-explored targets, thus steering toward all targets simultaneously. However, not all targets hold equal importance, particularly when facing large-scale target sets. Therefore, current works that blindly tracking all targets diverts computing resources from critical targets, thereby reducing the overall efficiency of triggering targets.
In this paper, we present Prospector, a novel DGF approach that can handle large-scale target sets scenarios. Prospector employs an iterative process to focus on a select group of \textit{focused targets}. To dynamically maintain these targets, Prospector present a more fine-grained strategy that considers the vulnerable patterns and test adequacy of targets. Subsequently, Prospector further sharpens its fuzzing approach toward \textit{focused targets} by refining strategies in explore-exploit scheduling, seed selection, and byte scheduling. We evaluate Prospector on 24 programs by setting all sanitizer labels as targets. The experimental results show that Prospector outperforms AFL++, WindRanger, ParmeSan and FishFuzz by finding bugs 176.3x, 1882.3x, 2846x and 1.5x faster, respectively. Among 64 unique bugs in the program group with largest target sets, Prospector reproduces 33 (51.56%) existing bugs faster than other fuzzers. Prospector also discovered 6 new bugs in 4 real-world programs with 2 CVE IDs assigned.
This program is tentative and subject to change.
Fri 20 SepDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
10:30 - 11:50 | |||
10:30 20mTalk | Prospector: Boosting Directed Greybox Fuzzing for Large-scale Target Sets with Iterative Prioritization Technical Papers Zhijie Zhang Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences, Liwei Chen Institute of Information Engineering, Chinese Academy of Sciences, Haolai Wei Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences, Gang Shi Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences, Dan Meng Institute of Information Engineering, Chinese Academy of Sciences | ||
10:50 20mTalk | FRIES: Fuzzing Rust Library Interactions via Efficient Ecosystem-Guided Target Generation Technical Papers Xizhe Yin Nanjing University, Yang Feng Nanjing University, Qingkai Shi Nanjing University, Zixi Liu Nanjing University, Hongwang Liu Nanjing University, Baowen Xu Nanjing University | ||
11:10 20mTalk | DDGF: Dynamic Directed Greybox Fuzzing with Path Profiling Technical Papers Haoran Fang Shanghai Jiao Tong University, Kaikai Zhang Shanghai Jiao Tong University, Donghui Yu Shanghai Jiao Tong University, Yuanyuan Zhang Shanghai Jiao Tong University | ||
11:30 20mTalk | Logos: Log Guided Fuzzing for Protocol Implementations Technical Papers Feifan Wu Tsinghua University, Zhengxiong Luo Tsinghua University, Yanyang Zhao Tsinghua University, Qingpeng Du Beijing University of Posts and Telecommunications, Junze Yu Tsinghua University, Ruikang Peng Central South University, Heyuan Shi Central South University, Yu Jiang Tsinghua University |