https://arxiv.org/abs/2302.12879

close this message
arXiv smileybones icon

Global Survey

In just 3 minutes help us understand how you see arXiv.

TAKE SURVEY
Skip to main content
Cornell University
We gratefully acknowledge support from
the Simons Foundation and member institutions.
 
arxiv logo > cs > arXiv:2302.12879
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv logo
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Cryptography and Security

arXiv:2302.12879 (cs)
[Submitted on 24 Feb 2023]

Title:autofz: Automated Fuzzer Composition at Runtime

Authors:Yu-Fu Fu, Jaehyuk Lee, Taesoo Kim
Download PDF

    Abstract: Fuzzing has gained in popularity for software
    vulnerability detection by virtue of the tremendous effort to
    develop a diverse set of fuzzers. Thanks to various fuzzing
    techniques, most of the fuzzers have been able to demonstrate
    great performance on their selected targets. However,
    paradoxically, this diversity in fuzzers also made it difficult
    to select fuzzers that are best suitable for complex real-world
    programs, which we call selection burden. Communities attempted
    to address this problem by creating a set of standard benchmarks
    to compare and contrast the performance of fuzzers for a wide
    range of applications, but the result was always a suboptimal
    decision - the best-performing fuzzer on average does not
    guarantee the best outcome for the target of a user's interest.
    To overcome this problem, we propose an automated, yet
    non-intrusive meta-fuzzer, called autofz, to maximize the
    benefits of existing state-of-the-art fuzzers via dynamic
    composition. To an end user, this means that, instead of spending
    time on selecting which fuzzer to adopt, one can simply put all
    of the available fuzzers to autofz, and achieve the best, optimal
    result. The key idea is to monitor the runtime progress of the
    fuzzers, called trends (similar in concept to gradient descent),
    and make a fine-grained adjustment of resource allocation. This
    is a stark contrast to existing approaches - autofz deduces a
    suitable set of fuzzers of the active workload in a fine-grained
    manner at runtime. Our evaluation shows that autofz outperforms
    any best-performing individual fuzzers in 11 out of 12 available
    benchmarks and beats the best, collaborative fuzzing approaches
    in 19 out of 20 benchmarks. Moreover, on average, autofz found
    152% more bugs than individual fuzzers, and 415% more bugs than
    collaborative fuzzing.

Comments: 22 pages. Extended version of USENIX Security'23 paper
Subjects: Cryptography and Security (cs.CR); Software Engineering
          (cs.SE)
Cite as:  arXiv:2302.12879 [cs.CR]
          (or arXiv:2302.12879v1 [cs.CR] for this version)
          https://doi.org/10.48550/arXiv.2302.12879
          Focus to learn more
          arXiv-issued DOI via DataCite

Submission history

From: Yu-Fu Fu [view email]
[v1] Fri, 24 Feb 2023 20:29:49 UTC (2,870 KB)
Full-text links:

Download:

  * PDF
  * Other formats

(license)
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2302
Change to browse by:
cs
cs.SE

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

a export bibtex citation Loading...

Bibtex formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Mendeley logo Reddit logo ScienceWISE logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
[ ] scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
( ) Code, Data, Media

Code, Data and Media Associated with this Article

[ ] Links to Code Toggle
Papers with Code (What is Papers with Code?)
[ ] ScienceCast Toggle
ScienceCast (What is ScienceCast?)
( ) Demos

Demos

[ ] Replicate Toggle
Replicate (What is Replicate?)
[ ] Spaces Toggle
Hugging Face Spaces (What is Spaces?)
( ) Related Papers

Recommenders and Search Tools

[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)
( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs and how to get involved.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack