Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Conferences, Workshops, Symposiums, and Seminars
  4. AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering
 
conference paper

AIFORE: Smart Fuzzing Based on Automatic Input Format Reverse Engineering

Shi, Ji
•
Wang, Zhun
•
Feng, Zhiyao  
Show more
January 1, 2023
Proceedings Of The 32Nd Usenix Security Symposium
32nd USENIX Security Symposium

Knowledge of a program's input format is essential for effective input generation in fuzzing. Automated input format reverse engineering represents an attractive but challenging approach to learning the format. In this paper, we address several challenges of automated input format reverse engineering, and present a smart fuzzing solution AIFORE which makes full use of the reversed format and benefits from it. The structures and semantics of input fields are determined by the basic blocks (BBs) that process them rather than the input specification. Therefore, we first utilize byte-level taint analysis to recognize the input bytes processed by each BB, then identify indivisible input fields that are always processed together with a minimum cluster algorithm, and learn their types with a neural network model that characterizes the behavior of BBs. Lastly, we design a new power scheduling algorithm based on the inferred format knowledge to guide smart fuzzing. We implement a prototype of AIFORE and evaluate both the accuracy of format inference and the performance of fuzzing against state-of-the-art (SOTA) format reversing solutions and fuzzers. AIFORE significantly outperforms SOTA baselines on the accuracy of field boundary and type recognition. With AIFORE, we uncovered 20 bugs in 15 programs that were missed by other fuzzers.

  • Details
  • Metrics
Type
conference paper
Web of Science ID

WOS:001066451505009

Author(s)
Shi, Ji
Wang, Zhun
Feng, Zhiyao  
Lan, Yang
Qin, Shisong
You, Wei
Zou, Wei
Payer, Mathias  
Zhang, Chao
Corporate authors
USENIX Association
Date Issued

2023-01-01

Publisher

Usenix Assoc

Publisher place

Berkeley

Published in
Proceedings Of The 32Nd Usenix Security Symposium
ISBN of the book

978-1-939133-37-3

Start page

4967

End page

4984

Subjects

Technology

Editorial or Peer reviewed

REVIEWED

Written at

EPFL

EPFL units
HEXHIVE  
Event nameEvent placeEvent date
32nd USENIX Security Symposium

Anaheim, CA

AUG 09-11, 2023

FunderGrant Number

National Key Research and Development Program of China

2021YFB2701000

National Natural Science Foundation of China

61972224

Beijing National Research Center for Information Science and Technology (BNRist)

BNR2022RC01006

Available on Infoscience
February 20, 2024
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/204635
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés