ASE 2024
Sun 27 October - Fri 1 November 2024 Sacramento, California, United States

This program is tentative and subject to change.

Tue 29 Oct 2024 17:06 - 17:18 at Camellia - Fuzzing 1

This paper presents the design and the constitution of BugOss, a real-world regression bug benchmark for empirical study of regression fuzzing techniques. To reproduce the actual project context where a regression bug was introduced, each bug case of BugOss pinpoints the exact bug-inducing commit and provides a specific test oracle considering the presence of other co-existing bugs. These bug cases are systematically extracted based on the information from the OSS-Fuzz issue tracker and the target project repositories while avoiding uncertainty and carefully managing potential threats of experiment validities. BugOss currently comprises 20 real-world bug cases from 20 open-source C/C++ projects, which had been reported by the OSS-Fuzz projects and confirmed by the project maintainers. The empirical investigation with two baseline fuzzers (libfuzzer and AFL++) and two regression fuzzing techniques (AFLChurn and Change-aware Seed Selection) show that, with the bug cases in BugOss, the regression fuzzing techniques perform differently depending on the given project context. In addition, the experiments imply that BugOss encompasses various cases of regression bugs in real-world, thus the bug cases would be useful for empirically investigating regression fuzzing techniques. We believe that BugOss offers researchers a useful basis of empirical investigation of regression fuzzing techniques. To the best of the authors’ knowledge, BugOss is the first benchmark with actual bug-inducing commits of real-world C/C++ projects under continuous fuzzing for empirical study of regression fuzzing techniques. All artifacts of the benchmark and the experiment results are publicly open for future research at the following URL: https://github.com/sdevlab/BugOss.

This program is tentative and subject to change.

Tue 29 Oct

Displayed time zone: Pacific Time (US & Canada) change

16:30 - 17:30
16:30
12m
Talk
Magneto: A Step-Wise Approach to Exploit Vulnerabilities in Dependent Libraries via LLM-Empowered Directed Fuzzing
Research Papers
Zhuotong Zhou Fudan University, China, Yongzhuo Yang Fudan University, Susheng Wu Fudan University, Yiheng Huang Fudan University, Bihuan Chen Fudan University, Xin Peng Fudan University
16:42
12m
Talk
Applying Fuzz Driver Generation to Native C/C++ Libraries of OEM Android Framework: Obstacles and Solutions
Industry Showcase
Shiyan Peng Fudan University, Yuan Zhang Fudan University, Jiarun Dai Fudan University, Yue Gu Fudan University, Zhuoxiang Shen Fudan University, Jingcheng Liu Fudan University, Lin Wang Fudan University, Yong Chen OPPO, Yu Qin OPPO, Lei Ai OPPO, Xianfeng Lu OPPO, Min Yang Fudan University
16:54
12m
Talk
Olympia: Fuzzer Benchmarking for Solidity
Tool Demonstrations
Jana Chadt TU Wien, Austria, Christoph Hochrainer TU Wien, Valentin Wüstholz ConsenSys, Maria Christakis TU Wien
17:06
12m
Talk
BUGOSS: A Benchmark of Real-world Regression Bugs for Empirical Investigation of Regression Fuzzing Techniques
Journal-first Papers
Jeewoong Kim Chungbuk National University, Shin Hong Chungbuk National University
17:18
12m
Talk
Learning Failure-Inducing Models for Testing Software-Defined Networks
Journal-first Papers
Raphaël Ollando University of Luxembourg, Seung Yeob Shin University of Luxembourg, Lionel Briand University of Ottawa, Canada; Lero centre, University of Limerick, Ireland