Publication Type

Conference Proceeding Article

Version

publishedVersion

Publication Date

2-2019

Abstract

Hybrid fuzzing which combines fuzzing and concolic execution has become an advanced technique for software vulnerability detection. Based on the observation that fuzzing and concolic execution are complementary in nature, the state-of-the-art hybrid fuzzing systems deploy ``demand launch'' and ``optimal switch'' strategies. Although these ideas sound intriguing, we point out several fundamental limitations in them, due to oversimplified assumptions. We then propose a novel ``discriminative dispatch'' strategy to better utilize the capability of concolic execution. We design a novel Monte Carlo based probabilistic path prioritization model to quantify each path's difficulty and prioritize them for concolic execution. This model treats fuzzing as a random sampling process. It calculates each path's probability based on the sampling information. Finally, our model prioritizes and assigns the most difficult paths to concolic execution. We implement a prototype system DigFuzz and evaluate our system with two representative datasets. Results show that the concolic execution in DigFuzz outperforms than that in a state-of-the-art hybrid fuzzing system Driller in every major aspect. In particular, the concolic execution in DigFuzz contributes to discovering more vulnerabilities (12 vs. 5) and producing more code coverage (18.9% vs. 3.8%) on the CQE dataset than the concolic execution in Driller.

Discipline

Databases and Information Systems | Theory and Algorithms

Publication

Proceedings of the 26th Network and Distributed System Security Symposium, San Diego, California USA, Feb 24-27

ISBN

189156255X

Identifier

10.14722/ndss.2019.23504

Publisher

Network and Distributed System Security Symposium (NDSS)

City or Country

San Diego, California USA

Copyright Owner and License

Authors

Download

Share

COinS