Spectral Fuzzing: Evaluation & Feedback - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Rapport (Rapport De Recherche) Année : 2010

Spectral Fuzzing: Evaluation & Feedback

Résumé

This paper presents an instrumentation framework for assessing and improving fuzzing, a powerful technique to rapidly detect software vulnerabilities. We address the major current limitation of fuzzing techniques, namely the absence of evaluation metrics and the absence of automated quality assessment techniques for fuzzing approaches. We treat the fuzzing process as a signal and show how derived measures like power and entropy can give an insightful perspective on a fuzzing process. We demonstrate how this perspective can be used to compare the efficiency of several fuzzers, derive stopping conditions for a fuzzing process, or help to identify good candidates for input data. We show through the Linux implementation of our instrumentation framework how the approach was successfully used to assess two different fuzzers on real applications. Our instrumentation framework leverages a tainted data approach and uses data lifetime tracing with an underlying tainted data graph structure.
Fichier principal
Vignette du fichier
RR-7193.pdf (372.52 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

inria-00452015 , version 1 (02-02-2011)

Identifiants

  • HAL Id : inria-00452015 , version 1

Citer

Humberto Abdelnur, Radu State, Obes Jorge Lucangeli, Olivier Festor. Spectral Fuzzing: Evaluation & Feedback. [Research Report] RR-7193, INRIA. 2010, pp.40. ⟨inria-00452015⟩
305 Consultations
781 Téléchargements

Partager

Gmail Facebook X LinkedIn More