scholarly journals Research on Fuzz Testing Framework based on Concolic Execution

2018 ◽  
Author(s):  
Xiong Xie ◽  
Yuhang Chen
Keyword(s):  
Testing Framework ◽  
Fuzz Testing ◽  
Concolic Execution

CONFU

2012 ◽  
pp. 152-167
Author(s):  
Huning Dai ◽  
Christian Murphy ◽  
Gail E. Kaiser
Keyword(s):  
Case Studies ◽  
Software Security ◽  
Performance Evaluations ◽  
Testing Technique ◽  
Security Vulnerabilities ◽  
Testing Framework ◽  
Testing Methodology ◽  
Fuzz Testing ◽  
Runtime Environment ◽  
Semantic Validity

Many software security vulnerabilities only reveal themselves under certain conditions, that is, particular configurations and inputs together with a certain runtime environment. One approach to detecting these vulnerabilities is fuzz testing. However, typical fuzz testing makes no guarantees regarding the syntactic and semantic validity of the input, or of how much of the input space will be explored. To address these problems, the authors present a new testing methodology called Configuration Fuzzing. Configuration Fuzzing is a technique whereby the configuration of the running application is mutated at certain execution points to check for vulnerabilities that only arise in certain conditions. As the application runs in the deployment environment, this testing technique continuously fuzzes the configuration and checks “security invariants’’ that, if violated, indicate vulnerability. This paper discusses the approach and introduces a prototype framework called ConFu (CONfiguration FUzzing testing framework) for implementation. Additionally, the results of case studies that demonstrate the approach’s feasibility are presented along with performance evaluations.

The Research and Application of the Variant Fuzz Testing Framework for Log Based on the Structured Data

2014 ◽  
Vol 602-605 ◽  
pp. 1749-1752
Author(s):  
Li Yuan Sun ◽  
Yan Mei Zhang
Keyword(s):  
Computer Program ◽  
Software Testing ◽  
Structured Data ◽  
Class Structure ◽  
Random Data ◽  
Testing Technique ◽  
Testing Framework ◽  
Design And Implementation ◽  
Fuzz Testing ◽  
Function Modules

Fuzz testing is a software testing technique,which provides invalid, unexpected, or random data to the inputs of a computer program to test the robustness and security of procedures[1]. For structured data like logging, the variant fuzz testing framework adopts a configuration file, apply traverse and stream processing to complete the structured fuzzing. This article starts with the features of the structured data, then introduces the design and implementation of the variant fuzz testing framework, including function modules, class structure, and logic processing. As a conclusion, this framework is compared with zzuf tool, and the advanced nature of this framework is elaborated.

scholarly journals CONFU

2010 ◽  
Vol 1 (3) ◽  
pp. 41-55 ◽  
Author(s):  
Huning Dai ◽  
Christian Murphy ◽  
Gail Kaiser
Keyword(s):  
Case Studies ◽  
Software Security ◽  
Performance Evaluations ◽  
Testing Technique ◽  
Security Vulnerabilities ◽  
Testing Framework ◽  
Testing Methodology ◽  
Fuzz Testing ◽  
Runtime Environment ◽  
Semantic Validity

Many software security vulnerabilities only reveal themselves under certain conditions, that is, particular configurations and inputs together with a certain runtime environment. One approach to detecting these vulnerabilities is fuzz testing. However, typical fuzz testing makes no guarantees regarding the syntactic and semantic validity of the input, or of how much of the input space will be explored. To address these problems, the authors present a new testing methodology called Configuration Fuzzing. Configuration Fuzzing is a technique whereby the configuration of the running application is mutated at certain execution points to check for vulnerabilities that only arise in certain conditions. As the application runs in the deployment environment, this testing technique continuously fuzzes the configuration and checks “security invariants’’ that, if violated, indicate vulnerability. This paper discusses the approach and introduces a prototype framework called ConFu (CONfiguration FUzzing testing framework) for implementation. Additionally, the results of case studies that demonstrate the approach’s feasibility are presented along with performance evaluations.

scholarly journals COASTAL: Combining Concolic and Fuzzing for Java (Competition Contribution)

2020 ◽  
pp. 373-377 ◽  
Author(s):  
Willem Visser ◽  
Jaco Geldenhuys
Keyword(s):  
Program Analysis ◽  
Analysis Tool ◽  
Fuzz Testing ◽  
Concolic Execution ◽  
Java Programs

Abstract COASTAL is a program analysis tool for Java programs. It combines concolic execution and fuzz testing in a framework with built-in concurrency, allowing the two approaches to cooperate naturally.

scholarly journals DeepDiver: Diving into Abysmal Depth of the Binary for Hunting Deeply Hidden Software Vulnerabilities

2020 ◽  
Vol 12 (4) ◽  
pp. 74
Author(s):  
Fayozbek Rustamov ◽  
Juhwan Kim ◽  
JooBeom Yun
Keyword(s):  
Software Testing ◽  
Real World ◽  
High Performance ◽  
Automated Software Testing ◽  
Code Coverage ◽  
Software Vulnerabilities ◽  
Fuzz Testing ◽  
Concolic Execution ◽  
High Level ◽  
Automated Software

Fuzz testing is a simple automated software testing approach that discovers software vulnerabilities at a high level of performance by using randomly generated seeds. However, it is restrained by coverage and thus, there are chances of finding bugs entrenched in the deep execution paths of the program. To eliminate these limitations in mutational fuzzers, patching-based fuzzers and hybrid fuzzers have been proposed as groundbreaking advancements which combine two software testing approaches. Despite those methods having demonstrated high performance across different benchmarks such as DARPA CGC programs, they still present deficiencies in their ability to analyze deeper code branches and in bypassing the roadblocks checks (magic bytes, checksums) in real-world programs. In this research, we design DeepDiver, a novel transformational hybrid fuzzing tool that explores deeply hidden software vulnerabilities. Our approach tackles limitations exhibited by existing hybrid fuzzing frameworks, by negating roadblock checks (RC) in the program. By negating the RCs, the hybrid fuzzer can explore new execution paths to trigger bugs that are hidden in the abysmal depths of the binary. We combine AFL++ and concolic execution engine and leveraged the trace analyzer approach to construct the tree for each input to detect RCs. To demonstrate the efficiency of DeepDiver, we tested it with the LAVA-M dataset and eight large real-world programs. Overall, DeepDiver outperformed existing software testing tools, including the patching-based fuzzer and state-of-the-art hybrid fuzzing techniques. On average, DeepDiver discovered vulnerabilities 32.2% and 41.6% faster than QSYM and AFLFast respectively, and it accomplished in-depth code coverage.

Sign in / Sign up

Export Citation Format

Share Document