커맨드 라인 옵션을 변이 및 선택하여 테스팅 효과를 높이는 퍼징 기법

초록

Command line option determines how Command Line Interface (CLI) program executes. Therefore, selecting and using proper command line options determines the performance and effectiveness of testing in terms of coverage and bug detection power. In this paper, we propose PAW (Program option-AWare fuzzer) which automatically selects useful command line options to improve the effectiveness of fuzz testing. In the first 10% of fuzzing time, PAW generates diverse command line options by mutating existing options, and it decides which options are useful ones using branch coverage. For the remaining 90% of the time, PAW focuses on executing the selected, useful options for effective testing. We implemented PAW on top of AFL++ which is the state-of-the-art fuzzer, and we evaluated PAW on ten real-world C programs by comparing coverage with AFL++ and Angora. PAW showed higher branch coverage results and crash detection power on the ten C programs.

키워드