Write a Blog >>
ICSE 2022
Sun 8 - Fri 27 May 2022
Tue 10 May 2022 03:20 - 03:25 at ICSE room 4-odd hours - Software Testing 3 Chair(s): Christoph Reichenbach
Wed 11 May 2022 22:15 - 22:20 at ICSE room 3-even hours - Software Testing 8 Chair(s): Darko Marinov

Directed grey-box fuzzing (DGF) is a security testing technique that aims to steer the fuzzer towards predefined target sites in the program. To gain directness, DGF prioritizes the seeds whose execution traces are closer to the target sites. Therefore, evaluating the distance between the execution trace of a seed and the target sites (aka, the seed distance) is important for DGF. The first directed grey-box fuzzer, AFLGo, uses an approach of calculating the basic block level distances during static analysis and accumulating the distances of the executed basic blocks to compute the seed distance. Following AFLGo, most of the existing state-of-the-art DGF techniques use all the basic blocks on the execution trace and only the control flow information for seed distance calculation. However, not every basic block is equally important and there are certain basic blocks where the execution trace starts to deviate from the target sites (aka, deviation basic blocks).

In this paper, we propose a technique called WindRanger which leverages deviation basic blocks to facilitate DGF. To identify the deviation basic blocks, WindRanger applies both static reachability analysis and dynamic filtering. To conduct directed fuzzing, WindRanger uses the deviation basic blocks and their related data flow information for seed distance calculation, mutation, seed prioritization as well as explore-exploit scheduling. We evaluated WindRanger on 3 datasets consisting of 29 programs. The experiment results show that WindRanger outperforms AFLGo, AFL, and Fairfuzz by reaching the target sites 21%, 34%, and 37% faster and detecting the target crashes 44%, 66%, and 77% faster respectively. Moreover, we found a 0-day vulnerability with a CVE ID assigned in ffmpeg (a popular multimedia library extensively fuzzed by OSS-fuzz) with WindRanger by supplying manually identified suspect locations as the target sites.

Tue 10 May

Displayed time zone: Eastern Time (US & Canada) change

03:00 - 04:00
03:00
5m
Talk
The secret life of test smells - an empirical study on test smell evolution and maintenance
Journal-First Papers
Dong Jae Kim Concordia University, Tse-Hsun (Peter) Chen Concordia University, Jinqiu Yang Concordia University
Link to publication DOI Media Attached
03:05
5m
Talk
Statistical Reasoning About Programs
NIER - New Ideas and Emerging Results
Marcel Böhme MPI-SP, Germany and Monash University, Australia
DOI Pre-print Media Attached
03:10
5m
Talk
SymTuner: Maximizing the Power of Symbolic Execution by Adaptively Tuning External ParametersDistinguished Paper Award
Technical Track
Sooyoung Cha Sungkyunkwan University, Myungho Lee Korea University, Seokhyun Lee Korea University, South Korea, Hakjoo Oh Korea University
Pre-print Media Attached
03:15
5m
Talk
Path Transitions Tell More: Optimizing Fuzzing Schedules via Runtime Program States
Technical Track
Kunpeng Zhang Tsinghua Shenzhen International Graduate School, Tsinghua University, Xi Xiao Tsinghua Shenzhen International Graduate School, Tsinghua University, Xiaogang Zhu Swinburne University of Technology, Ruoxi Sun The University of Adelaide, Minhui (Jason) Xue University of Adelaide, Sheng Wen Swinburne University of Technology
DOI Pre-print Media Attached
03:20
5m
Talk
WindRanger: A Directed Greybox Fuzzer driven by DeviationBasic Blocks
Technical Track
Zhengjie Du Nanjing University, Yuekang Li Nanyang Technological University, Yang Liu Nanyang Technological University, Bing Mao Nanjing University
Pre-print Media Attached
03:25
5m
Talk
μAFL: Non-intrusive Feedback-driven Fuzzing for Microcontroller Firmware
Technical Track
DOI Pre-print Media Attached

Wed 11 May

Displayed time zone: Eastern Time (US & Canada) change

22:00 - 23:00
Software Testing 8Technical Track / Journal-First Papers at ICSE room 3-even hours
Chair(s): Darko Marinov University of Illinois at Urbana-Champaign
22:00
5m
Talk
The secret life of test smells - an empirical study on test smell evolution and maintenance
Journal-First Papers
Dong Jae Kim Concordia University, Tse-Hsun (Peter) Chen Concordia University, Jinqiu Yang Concordia University
Link to publication DOI Media Attached
22:05
5m
Talk
Prioritizing Mutants to Guide Mutation Testing
Technical Track
Samuel Kaufman University of Washington, Ryan Featherman University of Washington, Justin Alvin University of Massachusetts Amherst, Bob Kurtz George Mason University, USA, Paul Ammann George Mason University, USA, René Just University of Washington
DOI Pre-print Media Attached
22:10
5m
Talk
Automated Testing of Software that Uses Machine Learning APIs
Technical Track
Chengcheng Wan The University of Chicago, Shicheng Liu University of Chicago, Sophie Xie University of California, Berkeley, Yifan Liu University of Chicago, Henry Hoffmann University of Chicago, Michael Maire University of Chicago, Shan Lu University of Chicago
Pre-print Media Attached
22:15
5m
Talk
WindRanger: A Directed Greybox Fuzzer driven by DeviationBasic Blocks
Technical Track
Zhengjie Du Nanjing University, Yuekang Li Nanyang Technological University, Yang Liu Nanyang Technological University, Bing Mao Nanjing University
Pre-print Media Attached
22:20
5m
Talk
CONFETTI: Amplifying Concolic Guidance for Fuzzers
Technical Track
James Kukucka George Mason University, Luís Pina University of Illinois at Chicago, Paul Ammann George Mason University, USA, Jonathan Bell Northeastern University
Pre-print Media Attached
22:25
5m
Talk
μAFL: Non-intrusive Feedback-driven Fuzzing for Microcontroller Firmware
Technical Track
DOI Pre-print Media Attached

Information for Participants
Tue 10 May 2022 03:00 - 04:00 at ICSE room 4-odd hours - Software Testing 3 Chair(s): Christoph Reichenbach
Info for room ICSE room 4-odd hours:

Click here to go to the room on Midspace

Wed 11 May 2022 22:00 - 23:00 at ICSE room 3-even hours - Software Testing 8 Chair(s): Darko Marinov
Info for room ICSE room 3-even hours:

Click here to go to the room on Midspace