并行模糊测试综述

Overview of parallel fuzzing

软件脆弱性已成为互联网安全的主要威胁来源,软件脆弱性分析技术的重要性日益突出。模糊测试是脆弱性分析的热点技术之一,通过持续生成测试用例、动态监控目标代码执行和反馈调节变异策略的方法尝试触发程序异常,具有部署便捷、适用性广和效果直观的优点。随着测试目标的复杂性增加,从业人员对模糊测试的效率提出了更高的要求。并行模糊测试通过并行执行、任务分解和共享信息等方法提高脆弱性分析的效率。首先,分析了基于覆盖反馈的模糊测试面临的主要挑战;之后,探讨了并行模糊测试的解决思路和方案,从系统结构、任务划分、语料库共享和崩溃去重等方面对并行模糊测试进行了综述;最后,总结了现有并行模糊测试的优缺点,并对未来发展方向进行了展望。

Software vulnerability has become the main threat of Internet security,so software vulnerability analysis technology has become increasingly prominent.As one of the hotspot technologies in vulnerability analysis,fuzzing triggers program exceptions by continuously generating test cases,dynamically monitoring the execution of target code,and implementing feedback adjusting variation strategies.Fuzzing has the advantages of convenient deployment,wide applicability and intuitive effect.However,the dynamic execution,variation and feedback mechanism of fuzzing is time-consuming,which affects the efficiency of vulnerability analysis.However,parallel fuzzing improves the efficiency of vulnerability detection with the help of parallel execution,task decomposition and information sharing.Firstly,the main challenges of fuzzing based on coverage feedback are analyzed.Besides,the ideas and solutions of parallel fuzzing are discussed.In addition,the system structure,task division,corpus sharing,crash de-duplication and other aspects of parallel fuzzing are summarized.Finally,the advantages and disadvantages of existing parallel fuzzing are summarized,and the future development direction is prospected.