퍼즈 테스팅을 통한 소프트웨어 회귀 버그 탐색 기법의 동향과 전망
The Status Quo and Future of Software Regression Bug Discovery via Fuzz Testing
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
소프트웨어 패치가 빈번하게 이루어지는 최근의 추세에 따라, 소프트웨어 버그 역시 패치로 인해 유도되는 버그인 회귀 버그의 비중이 점차 증가하는 추세이다. 이에 산업계와 학계에서는 최근 자동 버그 탐지 방법으로 주목받고 있는 퍼즈 테스팅을 도입 및 개량하여 회귀 버그를 사전에 탐지하고자 하는 시도가 점차 활발해지고 있다. 이 논문에서는 회귀 버그 탐지를 위한 퍼즈 테스팅 연구의 현황에 대하여 살펴보고, 현재 기법들에 존재하는 한계를 참고삼아 향후 관련 연구의 방향에 대한 전망을 제시한다.
Abstract
As software gets an increasing amount of patches, lots of software bugs are increasingly caused by such software patches, collectively known as regression bugs. To proactively detect the regressions bugs, both industry and academia are actively searching for a way to augment fuzz testing, one of the most popular automatic bug detection techniques. In this paper, we investigate the status quo of the studies on augmenting fuzz testing for regression bug detection and, based on the limitations of current proposals, provide an outlook of the relevant research.
참고문헌 (16)
- "Commit 1 million: the history of the Linux kernel" (2020)[URL]
- Xiaogang Zhu, "Regression greybox fuzzing", Proceedings of the 28th ACM Conference on Computer and Communications Security (2021)
- "American Fuzzy Lop" (2021)[URL]
- "The LLVM Compiler Infrastructure" (2021)[URL]
- Barton P. Miller, "An empirical study of the reliability of UNIX utilities", Commun. ACM, 33(12), pp.32~44 (1990)
- "ClusterFuzz" (2021)[URL]
- "OSS-Fuzz" (2021)[URL]
- "Syzbot" (2021)[URL]
- "Open-source security: This is why bugs in open-source software have hit a record high" (2020)[URL]
- Marcel Böhme, "Directed greybox fuzzing", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.2329~2344 (2017)
- Hongxu Chen, "Hawkeye:towards a desired directed grey-box fuzzer", Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp.2095~2108 (2018)
- Gwangmu Lee, "Constraint-guided directed greybox fuzzing", Proceedings of the 30th USENIX Conference on Security Symposium, pp.3559~3576 (2021)
- Yuting Chen, "Deep differential testing of JVM implementations", Proceedings of the 41st International Conference on Software Engineering, pp.1257~1268 (2019)
- Theofilos Petsios, "NEZHA: efficient domain-independent differential testing", 2017 IEEE Symposium on Security and Privacy, pp.615~632 (2017)
- Yannic Noller, "HyDiff: hybrid differential software analysis", Proceedings of the ACM, 2020, 1273~1285
- Hristina Palikareva, "Shadow of a doubt: testing for divergences between software versions", Proceedings of the 38th International Conference on Software Engineering, pp.1181~1192 (2016)