论文标题
豆腐：面向目标的绒毛
TOFU: Target-Oriented FUzzer
论文作者
论文摘要
程序模糊---向计算机程序提供随机构造的输入 - 已被证明是发现错误，查找安全漏洞并生成增加代码覆盖范围的测试输入的强大方法。但是，在许多应用程序中，一个人对以目标为导向的方法感兴趣 - 一个人希望找到一个输入，以使程序达到程序中的特定目标点。我们已经创建了豆腐（用于目标的fuzzer）来解决定向的模糊问题。豆腐的搜索是根据距离度量的偏差，该距离度量是根据输入的执行跟踪与目标位置得出的分数的距离度量。豆腐也是输入结构的意识（即，搜索使用程序允许输入的超集的规范）。 我们在XMLLINT上的实验表明，豆腐比AFLGO快28％，而目标的目标多45％。此外，距离引导的搜索和对输入结构的知识的开发都对豆腐的表现产生了重大贡献。
Program fuzzing---providing randomly constructed inputs to a computer program---has proved to be a powerful way to uncover bugs, find security vulnerabilities, and generate test inputs that increase code coverage. In many applications, however, one is interested in a target-oriented approach-one wants to find an input that causes the program to reach a specific target point in the program. We have created TOFU (for Target-Oriented FUzzer) to address the directed fuzzing problem. TOFU's search is biased according to a distance metric that scores each input according to how close the input's execution trace gets to the target locations. TOFU is also input-structure aware (i.e., the search makes use of a specification of a superset of the program's allowed inputs). Our experiments on xmllint show that TOFU is 28% faster than AFLGo, while reaching 45% more targets. Moreover, both distance-guided search and exploitation of knowledge of the input structure contribute significantly to TOFU's performance.
