Static analysis assisted vulnerability-oriented evolutionary fuzzing
Gang Yang, Chao Yi Feng, Chaojing Tang · AIP conference proceedings · 2017
The blindness of fuzzing test is the main reason for its inefficiency in practical vulnerability discovery. In this paper, we proposed a static analysis assisted and vulnerability-oriented fuzzing testing technology. Through the static analysis, the suspect vulnerable code areas can be located roughly. And combined with dynamics update based on the fuzzing feedback, the vulnerable code areas can be further accurately located. By applying the distances to the located vulnerable code areas as one of metrics of the evolutionary fuzzing test, the vulnerability-oriented test cases are generated. The results in the experiment showed that the method proposed in this paper could effectually improve the vulnerability discovering efficiency of fuzzing test.