테스트 프레임워크를 활용한 라이브러리 퍼징 환경 구축 자동화
Automated Building Fuzzing Environment using Test Framework
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
라이브러리는 독립적으로 실행되지 않고 많은 응용 프로그램에서 사용되므로, 라이브러리의 취약점을 사전에 탐지하는 것은 중요하다. 라이브러리 취약점을 탐지하기 위해 동적 분석 방법인 퍼징이 사용되고 있다. 퍼징 기술은 코드 커버리지 및 크래시 발생 횟수 측면에서 개선된 결과를 보여주지만, 그 효과를 라이브러리 퍼징에 적용하기는 쉽지 않다. 특히, 라이브러리의 다양한 상태를 재현하려면 특정 함수 시퀀스를 호출하고 퍼저의 입력을 전달하여 라이브러리 코드를 실행하는 퍼징 대상 파일과 시드 코퍼스가 필요하다. 그러나 퍼징 환경(시드 코퍼스, 퍼징 대상 파일)을 준비하는 것은 라이브러리에 대한 이해와 퍼징에 대한 이해가 동시에 필요한 어려운 일이다. 이에, 본 논문에서는 테스트 프레임워크를 활용하여 라이브러리 퍼징의 용이성을 확보하고, 코드 커버리지와 크래시 탐지 성능을 향상하기 위한 개선 방법을 제안한다. 본 논문에서 제안한 시스템은 9개의 오픈 소스 라이브러리에 적용하여 기존 연구들과 비교를 통한 개선 효과를 검증하였다. 실험 결과 코드 커버리지 31.2%, 크래시 탐지 기준 58.7%의 개선 효과를 확인하였고, 3개의 알려지지 않는 취약점을 탐지하였다.
Abstract
Because the library cannot be run independently and used by many applications, it is important to detect vulnerabilities in the library. Fuzzing, which is a dynamic analysis, is used to discover vulnerabilities for the library. Although this fuzzing technique shows excellent results in terms of code coverage and unique crash counts, it is difficult to apply its effects to library fuzzing. In particular, a fuzzing executable and a seed corpus are needed that execute the library code by calling a specific function sequence and passing the input of the fuzzer to reproduce the various states of the library. Generating the fuzzing environment such as fuzzing executable and a seed corpus is challenging because it requires both understanding about the library and fuzzing knowledge. We propose a novel method to improve the ease of library fuzzing and enhance code coverage and crash detection performance by using a test framework. The systems’s performance in this paper was applied to nine open-source libraries and was verified through comparison with previous studies.
참고문헌 (34)
- B.P. Miller, "An empirical study of the reliability of unix utilities", Communications of the ACM, 33(12), pp.32~44 (1990)
- V.J.M. Manès, "The art, science, and engineering of fuzzing: A survey", IEEE Transactions on Software Engineering (2019)
- "american fuzzy lop"[URL]
- M. Böhme, "Coverage-based greybox fuzzing as markov chain", IEEE Transactions on Software Engineering, 45(5), pp.489~506 (2017)
- M. Böhme, "Directed greybox fuzzing", Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp.2329~2344 (2017)
- S. Gan, "Collafl: Path sensitive fuzzing", 2018 IEEE Symposium on Security and Privacy (SP), pp.679~696 (2018), IEEE
- N. Stephens, "Driller : Augmenting fuzzing through selective symbolic execution", NDSS, 16, pp.1~16 (2016)
- S. Rawat, "Vuzzer: Application-aware evolutionary fuzzing", NDSS, 17, pp.1~14 (2017)
- H. Peng, "T-fuzz: fuzzing by program transformation", 2018 IEEE Symposium on Security and Privacy (SP), pp.697~710 (2018), IEEE
- I. Yun, "{QSYM}: A practical concolic execution engine tailored for hybrid fuzzing", 27th {USENIX} Security Symposium({USENIX} Security 18), pp.745~761 (2018)
- P. Chen, "Angora:Efficient fuzzing by principled search", 2018 IEEE Symposium on Security and Privacy (SP), pp.711~725 (2018), IEEE
- D. Babić, "Fudge: fuzz driver generation at scale", Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp.975~985 (2019)
- K. Ispoglou, "Fuzzgen : Automatic fuzzer generation", 29th {USENIX}Security Symposium({USENIX} Security 20), pp.2271~2287 (2020)
- J. Jang, "Fuzzbuilder:automated building greybox fuzzing environment for c", c++ library, 2019, 627~637
- C. Lemieux, "Fairfuzz: A targeted mutation strategy for increasing greybox fuzz testing coverage", Proceedings of the 33rd ACM, 2018, 475~485
- Y. Li, "Steelix: program-state based binary fuzzing", Proceedings of the 2017 11th Joint Meeting on Foundationsof Software Engineering, pp.627~637 (2017)
- J. Choi, "Grey-box concolic testing on binary code", 2019 IEEE, 2019, 736~747[DOI]
- V. Jain, "Tiff : using input type inference to improve fuzzing", Proceedings of the 34th Annual Computer Security Applications Conference, pp.505~517 (2018)
- N. Coppik, "Memfuzz: Using memory accesses to guide fuzzing", 2019 12th IEEE Conference on Software Testing, Validation and Verification(ICST), pp.48~58 (2019), IEEE
- H. Zhong, "MAPO: Mining and Recommending API Usage Patterns", European Conference on Object-Oriented Programming, pp.318~343 (2009)
- M.A. Saied, "Mining multi-level api usage patterns", 2015 IEEE 22nd international conference on software analysis, evolution, and reengineering (SANER), pp.23~32 (2015), IEEE
- J. Fowkes, "Parameterfree probabilistic api mining across github", Proceedings of the 2016 24th ACM SIGSOFT international symposium on foundations of software engineering, pp.254~265 (2016)
- J. E. Montandon, "Documenting apis with examples: Lessons learned with the api miner platform", 2013 20th working conference on reverse engineering (WCRE), pp.401~408 (2013), IEEE
- L. Moreno, "How can i use this method?", 2015 IEEE, 2015, pp.1, 880~890[DOI]
- N. Katirtzis, "Summarizing software api usage examples using clustering techniques.", pp.189~206 (2018), FASE
- C. Pacheco, "Feedback-directed random test generation", 29th International Conference on Software Engineering(ICSE’07), pp.75~84 (2007), IEEE
- W. Zheng, "Random unit-test generation with mut-aware sequence recommendation", Proceedings of the IEEE, 2010, 293~296
- S. Zhang, "Combined static and dynamic automated test generation", Proceedings of the 2011 International Symposium on Software Testing and Analysis, pp.353~363 (2011)
- M. Pradel, "Leveraging test generation and specification mining for automated bug detection without false positives", 2012 34th International Conference on Software Engineering (ICSE), pp.288~298 (2012), IEEE
- J. Wang, "Skyfire: Data-driven seed generation for fuzzing", 2017 IEEE Symposium on Security and Privacy (SP), pp.579~594 (2017), IEEE
- C. Lyu, "Smartseed : Smart seed generation for efficient fuzzing", arXiv preprint arXiv : 1807. 02606, ~ (2018)
- I.J. Goodfellow, "Generative adversarial networks", arXiv preprint arXiv : 1406. 2661, ~ (2014)
- K. Sen, "Concolic testing", Proceedings of the Twenty-Second IEEE, 2007, 571~572
- "FuzzBuilderEx"[URL]