{"id":4120,"date":"2019-10-05T09:33:55","date_gmt":"2019-10-05T00:48:55","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=4120"},"modified":"2020-07-26T09:34:31","modified_gmt":"2020-07-26T00:49:31","slug":"%e3%80%90inforsec%e5%a4%8d%e6%97%a6%e5%a4%a7%e5%ad%a6%e3%80%9110%e6%9c%8812%e6%97%a5%ef%bc%8c%e7%be%8e%e5%9b%bd%e5%8a%a0%e5%b7%9e%e5%a4%a7%e5%ad%a6%e6%88%b4%e7%bb%b4%e6%96%af%e5%88%86%e6%a0%a1","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=4120","title":{"rendered":"\u3010InForSec@\u590d\u65e6\u5927\u5b66\u301110\u670812\u65e5\uff0c\u7f8e\u56fd\u52a0\u5dde\u5927\u5b66\u6234\u7ef4\u65af\u5206\u6821\u8ba1\u7b97\u673a\u7cfb\u9648\u6d69\u6559\u6388\u4e0e\u60a8\u76f8\u7ea6\u590d\u65e6\uff01"},"content":{"rendered":"\n

\u65f6\u95f4\uff1a2019\u5e7410\u670812\u65e5\uff08\u5468\u516d\uff09\u4e0b\u534813:30-15:00<\/strong><\/p>\n\n\n\n

\u5730\u70b9\uff1a\u590d\u65e6\u5927\u5b66\u5f20\u6c5f\u6821\u533a\u8f6f\u4ef6\u697c326\u4f1a\u8bae\u5ba4 <\/strong><\/p>\n\n\n\n

\u6f14\u8bb2\u4eba\uff1aProf. Hao Chen, UC Davis <\/strong><\/p>\n\n\n\n

\u6f14\u8bb2\u9898\u76ee\uff1aPrincipled fuzzing driven by mathematics<\/strong><\/p>\n\n\n\n

\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

Fuzzing is a popular technique for finding software bugs. However, fuzzers based on random mutation have difficulty producing quality inputs. We propose a principled fuzzing framework driven by mathematics. Our goal is to increase branch coverage by solving path constraints without symbolic execution. To solve path constraints efficiently, we introduce several key techniques: scalable byte-level taint tracking, context-sensitive branch count, search based on gradient descent, and input length exploration. Path constraints that involve deeply nested conditional statements are particularly challenging. To overcome this difficulty, first we identify all the control flow-dependent conditional statements of the target conditional statement. Next, we select the taint flow-dependent conditional statements. Finally, we use three strategies to find an input that satisfies all conditional statements simultaneously. We compared our tool on 13 open source programs with other state-of-the-art fuzzers. Our fuzzer achieved significantly higher cumulative line and branch coverage than other fuzzers. We manually classified the crashes found by our fuzzer into 41 unique new bugs and obtained 12 CVEs.<\/p>\n\n\n\n

https:\/\/github.com\/AngoraFuzzer\/Angora<\/a><\/p>\n\n\n\n

https:\/\/arxiv.org\/abs\/1905.12228<\/a><\/p>\n\n\n\n

\u6f14\u8bb2\u4eba\u7b80\u4ecb<\/strong><\/p>\n\n\n\n

\u9648\u6d69 \u7f8e\u56fd\u52a0\u5dde\u5927\u5b66\u6234\u7ef4\u65af\u5206\u6821\u8ba1\u7b97\u673a\u7cfb\u6559\u6388<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Hao Chen is a Professor in the Department of Computer Science at the University of California, Davis. Currently he is on academic leave and is leading the security research group at ByteDance AI lab. His research focuses on a broad range of security problems, including machine learning security, software security, and mobile and wireless security. His work on fuzzing includes Angora (S&P ’18) and Matryoshka (CCS ’19). He received his PhD at the Computer Science Division at the University of California, Berkeley in 2004 advised by Professor David Wagner.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u65f6\u95f4\uff1a2019\u5e7410\u670812\u65e5\uff08\u5468\u516d\uff09\u4e0b\u534813:30-15:00 \u5730\u70b9\uff1a\u590d\u65e6\u5927\u5b66\u5f20\u6c5f\u6821\u533a\u8f6f\u4ef6\u697c326\u4f1a… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-4120","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4120","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4120"}],"version-history":[{"count":2,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4120\/revisions"}],"predecessor-version":[{"id":4122,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4120\/revisions\/4122"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4120"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}