Write a Blog >>
ASE 2021
Sun 14 - Sat 20 November 2021 Australia
Wed 17 Nov 2021 11:40 - 11:50 at Kangaroo - Finding Defects Chair(s): Xiao Liu

Parallel coverage-guided greybox fuzzing is the most common setup for vulnerability discovery at scale. However, so far it has received little attention from the research community compared to single-mode fuzzing, leaving open several problems particularly in its task allocation strategies. Current approaches focus on managing micro tasks, at the seed input level, and their task division algorithms are either ad-hoc or static. In this paper, we leverage research on graph partitioning and search algorithms to propose a systematic and dynamic task allocation solution that works at the macro-task level. First, we design an attributed graph to capture both the program structures (e.g., program call graph) and fuzzing information (e.g., branch hit counts, bug discovery probability). Second, our graph partitioning algorithm divides the global program search space into sub-search-spaces. Finally our search algorithm prioritizes these sub-search-spaces (i.e., tasks) and explores them to maximize code coverage and number of bugs found. We implemented a prototype tool called AFLTeam. In our preliminary experiments on well-tested benchmarks, AFLTeam achieved higher code coverage (up to 16.4% branch coverage improvement) compared to the default parallel mode of AFL and discovered 2 zero-day bugs in FFmpeg and JasPer toolkits.

Wed 17 Nov

Displayed time zone: Hobart change

11:00 - 12:00
Finding DefectsResearch Papers / NIER track / Journal-first Papers at Kangaroo
Chair(s): Xiao Liu School of Information Technology, Deakin University
Graph-based Incident Aggregation for Large-Scale Online Service Systems
Research Papers
Zhuangbin Chen Chinese University of Hong Kong, China, Yuxin Su The Chinese University of Hong Kong, Jinyang Liu , Hongyu Zhang University of Newcastle, Xuemin Wen Huawei Technologies, Xiao Ling Huawei Technologies, Yongqiang Yang Huawei Technologies, Michael Lyu The Chinese University of Hong Kong
PyExplainer: Explaining the Predictions of Just-In-Time Defect ModelsACM Distinguished Paper
Research Papers
Chanathip Pornprasit Monash University, Kla Tantithamthavorn Monash University, Jirayus Jiarpakdee Monash University, Australia, Michael Fu Monash University, Patanamon Thongtanunam University of Melbourne
Towards Systematic and Dynamic Task Allocation for Collaborative Parallel Fuzzing
NIER track
Thuan Pham The University of Melbourne, Manh-Dung Nguyen Montimage R&D, France, Quang-Trung Ta National University of Singapore, Toby Murray University of Melbourne, Benjamin I.P. Rubinstein University of Melbourne
An Extensive Study on Smell-Aware Bug Localization
Journal-first Papers
Aoi Takahashi Tokyo Institute of Technology, Natthawute Sae-Lim Tokyo Institute of Technology, Shinpei Hayashi Tokyo Institute of Technology, Motoshi Saeki Nanzan University
Link to publication DOI