Speeding-up fuzzing through directional seeds

Journal Article · Fri Feb 14 00:00:00 EST 2025 · International journal of information security

DOI:https://doi.org/10.1007/s10207-024-00953-6· OSTI ID:2516767

Koffi, Koffi Anderson ^[1]; Kampourakis, Vyron ^[2]; Kolias, Constantinos ^[1]; Song, Jia ^[1]; Ivans, Robert C. ^[3]

---

1. Univ. of Idaho, Idaho Falls, ID (United States)
2. Norwegian Univ. of Science and Technology, Gjøvik (Norway)
3. Idaho National Laboratory (INL), Idaho Falls, ID (United States)

Fuzzing is an automated process for discovering inputs in a program that may trigger unexpected behavior. Today, fuzzing has become a standard practice for the discovery of bugs and security vulnerabilities. However, the main issue with such practices is that the exploration of the input space of programs can often be prohibitively expensive. Therefore, several alternative fuzzing strategies have been introduced during the last few years. Some fuzzing techniques rely on human expertise to provide a plausible set of initial input examples, namely, seeds. However, the process of handcrafting seeds for fuzzing purposes often becomes strenuous for humans as it requires a deeper understanding of the Program-Under-Test (PUT). Also, the use of known inputs to programs often does not trigger vulnerable program behavior or may not reach potentially vulnerable code locations. To address those issues, we propose a seed generation framework that enables Human-In-The-Loop (HITL) directed fuzzing where the human assumes a more active role in the creation of seeds that can penetrate and assess desired locations of the PUT. Our proposed framework uses Symbolic Execution (SE) to generate seeds that exercise paths to target program locations. Moreover, our framework enables the visualization of the explored execution paths in the binary of the PUT for the generated seeds. We evaluated our approach on a set of 12 carefully designed C programs with diverse characteristics that mimic real-world programs. The experimental results show the effectiveness of the proposed approach in improving the performance of standard fuzzing tools such as the American Fuzzy Lop (AFL). Specifically, our solution can generate seeds that substantially enhance the performance of the fuzzer, achieving speedups ranging from 1.46 X to 68.53 X for branch conditions, 1.39 X to 254.62 X for branch depths, 14,879.59 X to 30,295.88 X for branch widths over traditional seeds. Additionally, the speedup increases with the number of target function ranging from 12, 260 X to 22, 856.07 X over traditional seeds while only requiring less than 15 seconds on average for the seed generation step.

• Research Organization: Idaho National Laboratory (INL), Idaho Falls, ID (United States)
• Sponsoring Organization: USDOE; USDOE Laboratory Directed Research and Development (LDRD) Program; USDOE Office of Nuclear Energy (NE)
• Grant/Contract Number: AC07-05ID14517
• OSTI ID: 2516767
• Alternate ID(s): OSTI ID: 2572865
• Report Number(s): INL/JOU--25-85896
• Journal Information: International journal of information security, Journal Name: International journal of information security Journal Issue: 2 Vol. 24; ISSN 1615-5262; ISSN 1615-5270
• Publisher: Springer Nature
• Country of Publication: United States
• Language: English

Related Subjects

97 MATHEMATICS AND COMPUTING
AFL
Bug discovery
Directed fuzzing
Fuzzing
Human-in-the-loop