Abstract-Fuzzing is an important technique for discovering vulnerabilities, unfortunately, it also offers fairly shallow coverage. To address these problems, this paper presents a region-sensitive fuzzing test based on multi-objective programming. Firstly, we perform region division on the test inputs through fine-grained taint analysis and offering mutated objects. Secondly, by combining the features of vulnerabilities, the attributes of functions and instructions were depicted for computing values of input regions' attributes. Finally, this paper uses a multi-objective programming model to compute and rank the risk levels of these attributes, and the optimal one will be chosen to perform mutation. Experimental results show that the proposed approach can assist fuzzing test in choosing a more effective input region to perform mutation, the average priority-ranking ratio of input regions that trigger vulnerabilities is up to 8.82%. In addition, invalid inputs are controlled within 12% and, and 74 vulnerabilities are found in real software.
IndexTerms-Software vulnerability, fuzzing, multi-objective programming, region-sensitive.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.