PSOFuzzer: A Target-Oriented Software Vulnerability Detection Technology Based on Particle Swarm Optimization
Source abstract
Abstract
Coverage-oriented and target-oriented fuzzing are widely used in vulnerability detection. Compared with coverage-oriented fuzzing, target-oriented fuzzing concentrates more computing resources on suspected vulnerable points to improve the testing efficiency. However, the sample generation algorithm used in target-oriented vulnerability detection technology has some problems, such as weak guidance, weak sample penetration, and difficult sample generation. This paper proposes a new target-oriented fuzzer, PSOFuzzer, that uses particle swarm optimization to generate samples. PSOFuzzer can quickly learn high-quality features in historical samples and implant them into new samples that can be led to execute the suspected vulnerable point. The experimental results show that PSOFuzzer can generate more samples in the test process to reach the target point and can trigger vulnerabilities with 79% and 423% higher probability than AFLGo and Sidewinder, respectively, on tested software programs.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Software Testing and Debugging Techniques · Software Reliability and Analysis Research
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China
School of Information and Navigation, Air Force Engineering University, Xi’an 710077, China
References (49)
Show source-provided references
1. An Empirical Study of the Reliability of Unix Utilities10.1145/96267.96279 ↗
2. (2020, February 09). Zzuf Fuzzer. Available online: https://github.com/samhocevar/zzuf.
3. (2020, February 09). Peach Fuzzer. Available online: http://www.peachfuzzer.com/products/peach-platform.
4. (2019, August 28). Spike Fuzzer Platform. Available online: http://resources.infosecinstitute.com/fuzzer-automation-with-spike/.
5. Röning, J., Laakso, M., Takanen, A., and Kaksonen, R. (2002, January 17). PROTOS-Systematic Approach to Eliminate Software Vulnerabilities. Proceedings of the Invited Presentation at Microsoft Research, Seattle, WA, USA.
6. Analysis of HTTP Protocol Implementation in Smart Card Embedded Web Server
7. Alimi, V., Vernois, S., and Rosenberger, C. (2014, January 21–25). Analysis of Embedded Applications by Evolutionary Fuzzing. Proceedings of the International Conference on High Performance Computing & Simulation (HPCS), Bologna, Italy.10.1109/HPCSim.2014.6903734 ↗
8. Van, F., Hond, B., and Torres, A.C. (2014, January 26–28). Security Testing of GSM Implementations. Proceedings of the International Symposium on Engineering Secure Software and Systems, Munich, Germany.
9. (2020, February 09). American Fuzzy Lop. Available online: https://github.com/mirrorer/afl.
10. Coverage-based greybox fuzzing as markov chain
11. Gan, S., Zhang, C., Qin, X., Tu, X., Li, K., Pei, Z., and Chen, Z. (2018, January 21–23). Collafl: Path sensitive fuzzing. Proceedings of the 2018 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP.2018.00040 ↗
12. She, D., Pei, K., Epstein, D., Yang, J., Ray, B., and Jana, S. (2019, January 19–23). NEUZZ: Efficient fuzzing with neural program smoothing. Proceedings of the IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP.2019.00052 ↗
13. Lyu, C., Ji, S., Zhang, C., Li, Y., Lee, W.H., Song, Y., and Beyah, R. (2019, January 14–16). MOPT: Optimized Mutation Scheduling for Fuzzers. Proceedings of the 28th USENIX Security Symposium, Santa Clara, CA, USA.
14. Cadar, C., Dunbar, D., and Engler, D.R. (2008, January 8–10). KLEE: Unassisted and Automatic Generation of High-coverage Tests for Complex Systems Programs. Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI), San Diego, CA, USA.
15. S2E: A platform for in-vivo multi-path analysis of software systems10.1145/1961296.1950396 ↗
16. Cha, S.K., Avgerinos, T., Rebert, A., and Brumley, D. (2012, January 21–23). Unleashing Mayhem on Binary Code. Proceedings of the IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA.10.1109/SP.2012.31 ↗
17. Godefroid, P., Levin, M.Y., and Molnar, D.A. (2008, January 10–13). Automated Whitebox Fuzz Testing. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.
18. Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R., Corbetta, J., Shoshitaishvil, Y., Kruegel, C., and Vigna, G. (2016, January 21–24). Driller: Augmenting Fuzzing through Selective Symbolic Execution. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.10.14722/ndss.2016.23368 ↗
19. Yun, I., Lee, S., Xu, M., Jang, Y., and Kim, T. (2018, January 15–17). QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. Proceedings of the USENIX Security Symposium, Baltimore, MD, USA.
20. Huang, H., Yao, P., Wu, R., Shi, Q., and Zhang, C. (2020, January 18–21). PANGOLIN: Incremental Hybrid Fuzzing with Polyhedral Path Abstraction. Proceedings of the Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP40000.2020.00063 ↗
21. Kim, K., Jeong, D.R., Kim, C.H., Jang, Y., Shin, I., and Lee, B. (2020, January 23–26). HFL: Hybrid Fuzzing on the Linux Kernel. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.10.14722/ndss.2020.24018 ↗
22. A systematic review of fuzzing techniques10.1016/j.cose.2018.02.002 ↗
23. Rawat, S., Jain, V., Kumar, A., Cojocar, L., Giuffrida, C., and Bos, H. (March, January 26). VUzzer: Application-aware Evolutionary Fuzzing. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.
24. Ispoglou, K., Austin, D., and Mohan, V. (2020, January 12–14). FuzzGen: Automatic Fuzzer Generation. Proceedings of the 29th USENIX Security Symposium, Boston, MA, USA.
25. Yue, T., Wang, P., Tang, Y., Wang, E., Yu, B., Lu, K., and Zhou, X. (2020, January 12–14). EcoFuzz: Adaptive Energy-Saving Greybox Fuzzing as a Variant of the Adversarial Multi-Armed Bandit. Proceedings of the 29th USENIX Security Symposium, Boston, MA, USA.
26. Chen, H., Guo, S., Xue, Y., Sui, Y., Zhang, C., Li, Y., Wang, H., and Liu, Y. (2020, January 12–14). MUZZ: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs. Proceedings of the 29th USENIX Security Symposium, Boston, MA, USA.
27. Aschermann, C., Schumilo, S., Abbasi, A., and Holz, T. (2020, January 18–21). Ijon: Exploring Deep State Spaces via Fuzzing. Proceedings of the IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, USA.10.1109/SP40000.2020.00117 ↗
28. Fioraldi, A., Maier, D., Eifeldt, H., and Heuse, M. (2021, January 25). AFL++: Combining Incremental Steps of Fuzzing Research. Available online: https://www.usenix.org/conference/woot20/presentation/fioraldi.
29. Haller, I., Slowinska, A., Neugschwandtner, M., and Bos, H. (2013, January 14–16). Dowsing for Overflows: A Guided Fuzzer to Find Buffer Boundary Violations. Proceedings of the USENIX Security Symposium, Washington, DC, USA.
30. Neugschwandtner, M., Milani Comparetti, P., Haller, I., and Bos, H. (2015, January 2–4). The BORG: Nanoprobing Binaries for Buffer Overreads. Proceedings of the 5th ACM Conference on Data and Application Security and Privacy, San Antonio, TX, USA.10.1145/2699026.2699098 ↗
31. Böhme, M., Pham, V.T., Nguyen, M.D., and Roychoudhury, A. (2017, January 30). Directed Greybox Fuzzing. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.10.1145/3133956.3134020 ↗
32. Embleton, S., Sparks, S., and Cunningham, R. (2020, February 09). Sidewinder: An Evolutionary Guidance System for Malicious Input Crafting. Available online: http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Embleton.pdf.
33. Kennedy, J., and Eberhart, R. (1995, January 27). Particle swarm optimization. Proceedings of the IEEE ICNN’95-International Conference on Neural Networks, Perth, Australia.
34. Shaukat, K., Luo, S., Varadharajan, V., Hameed, I.A., Chen, S., Liu, D., and Li, J. (2020). Performance Comparison and Current Challenges of Using Machine Learning Techniques in Cybersecurity. Energies, 13.10.3390/en13102509 ↗
35. A Survey on Machine Learning Techniques for Cyber Security in the Last Decade10.1109/ACCESS.2020.3041951 ↗
36. Pailoor, S., Aday, A., and Jana, S. (2018, January 15–17). MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation. Proceedings of the 27th USENIX Security Symposium (Security), Baltimore, MD, USA.
37. (2020, September 20). Syzkaller. Available online: https://github.com/google/syzkaller.
38. (2020, September 20). Gzip. Available online: http://mirror.keystealth.org/gnu/gzip/.
39. (2020, September 20). Goahead. Available online: http://mirror.keystealth.org/gnu/tar/.
40. (2020, September 20). Pdfresurrect. Available online: https://github.com/enferex/pdfresurrect/.
41. (2020, September 20). Miniftp. Available online: https://github.com/skyqinsc/MiniFtp/.
42. (2020, September 20). Binutils. Available online: http://mirror.keystealth.org/gnu/binutils/.
43. (2020, September 20). Libming. Available online: https://github.com/libming/libming.
44. (2020, September 20). Libjpeg. Available online: http://www.ijg.org/.
45. (2020, September 20). Pngquant. Available online: https://github.com/kornelski/pngquant.
46. (2020, September 20). Ffjpeg. Available online: https://github.com/rockcarry/ffjpeg.
47. (2020, September 20). Zziplib. Available online: https://enterprise.dejacode.com/packages/public/d9018a4f-2e88-498d-8cb9-d52680be48f5/.
48. (2020, September 20). Exiv2. Available online: https://www.exiv2.org/archive.html.
49. (2020, September 20). Ngiflib. Available online: https://github.com/miniupnp/ngiflib.