Search

Fuzz testing has been successful in finding defects of various software packages. These defects include file parsing, image processing, Internet browsers, and network protocols. However, the quality of the initial seed test cases greatly influences the coverage and defect detection capability of fuzz testing. To address this issue, we propose CSEFuzz, a fuzz testing approach based on symbolic execution for defect detection. First, CSEFuzz generates candidate test cases by symbolic execution and collects coverage information of the test cases. Then, CSEFuzz extracts the test-case templates of the test cases and selects a set of test-case templates according to specific coverage criteria. Finally, CSEFuzz selects test cases according to the selected test-case templates, and the selected test cases are used as initial seed test cases for fuzz testing. Experiments are conducted on 11 open-source programs. The results show that in comparison with afl-cmin, which is the test-case selection command of Kelinci, CSEFuzz with a path coverage criterion reduces the time costs of the initial seed test selection and verification by 94.26%. In addition, compared with afl-cmin, 32 more paths are covered and 16 more defects are detected by CSEFuzz.

The number of software vulnerabilities is increasing year by year. In the era of big data, data-processing software with many users is more concerned by hackers. It is essential to improve the efficiency of discovering vulnerabilities in data-processing software. We noticed that in the process of discovering vulnerabilities, some problems of existing technology such as fuzzing, symbolic execution, and taint analysis have more or fewer relationships with data-processing functions. In fuzzing, there are two types of sanity checks toward the target program: NCC (Non-critical check) and CC (critical check). It is usually challenging to bypass such a sanity check, which leads to low code coverage during fuzzing. In symbolic execution, the constraint solver still has the problem of trying to deal with the constraints of complex algorithms. In taint analysis, the problem of over-taint and under-taint is always the key to affect the accuracy of the results. Therefore, to solve the above problems, it is necessary to identify the data-processing function. Based on identifying data-processing functions, we could identify those sanity checks, ease the solution of complex constraints, and understand the way of taints propagation to assist in software vulnerability discovery and analysis. This paper proposed a method called DPFI(data-processing function identification) for identifying data-processing functions with deep neural networks. We collected 37000 functions from GitHub and implemented the method on the data set with several neural networks, among which the performance of CNN achieved best and $F_{1}$ -score was 0.90. We then applied the trained model on CGC(cyber grand challenge) data and real softwares for testing. For CGC, we got 448 functions in 20 programs, in which 35 were identified as data-processing functions. For real softwares, such as FFmpeg, 7zip, jpeg, the precision rate all reached 0.90 and $F_{1}$ -score was above 0.87.

Dynamic taint analysis techniques are a popular dynamic software analysis method. Marking a key segment of program function by dynamic taint analysis is an important part of software vulnerability research. Key segment marking usually related to the control flow taint analysis, however, several specific program structure may cause failure in key segment marking due to the control flow dependence, and overtainting and undertainting problem. In this paper, we proposed a novel method to mark a key segment accurately and efficiently with deep learning technology. Firstly, we fit the program function execution into a continuous function by the convoluntional network, and then mark the key segment roughly through derivative information of fitted nerual network. Finally, we mark the key segment of specific program function completely and accurately by filtering and diffusion algorithm. We developed the key segment marking tool NeuralTaint on this principle. We design an experiment to select the specific neural network structure of NeuralTaint. Our extensive evaluations demonstrate that NeuralTaint significantly outperforms the two state-of-the-art traditional dynamic taint analysis tool on seven popular real-world programs.

Program slicing, as a technique of program decomposition, is widely used in the field of program testing, model checking, software verification, symbolic execution, and other fields. However, the traditional approaches of program slicing tend to produce too large slices and the static program analyses are hard to be precise enough. Scenario-oriented program slicing, which considers the actual usage of software, gives a more precise perspective of program slicing. In this paper, we propose an approach of scenario-oriented program slicing, which combines constraint logic programming and program transformation. According to the observation that the output of a program transformation is a semantically equivalent program where the properties of interest are preserved, we can apply a sequence of transformations, more powerful than those needed for program specialization, refining the slicing to the desired degree of precision. And constraint logic programming has been shown to be a powerful, flexible formalism to reason about the correctness of programs. The novel contributions of this paper are as follows: 1) converting the problem of program slicing into program transformation and retrieval; 2) presenting a set of constraint handling rules for scenario-oriented program slicing in constraint logical programming programs; and 3) deriving a scenario-oriented program slicing algorithm. The method of scenario-oriented program slicing has been implemented and we have demonstrated its effectiveness and efficiency on three open source software projects in GitHub.

As the Android application increases in number, it is a challenge for researchers to test Android applications automatically. Acteve based on dynamic symbolic execution proposes a new method and achieves higher coverage. But it cannot achieve the ideal test coverage due to incomplete events input and some missing activities. In this paper, we propose an improvement scheme, making Acteve can produce broadcast events as test inputs, and has the capability to find more activities. Based on these improved schemes, we design Android applications automatic tester, Acteve ++. We experimented and analyzed existing representative Android automated testing tools: Monkey , Dynodroid , GUIRipper , Acteve , and Acteve ++ on an open test set. The experiments show that Acteve ++ achieves high average test coverage in an acceptable time.

Equivalent mutants (EM) issue is a key challenge in mutation testing. Many methods were applied for detecting and reducing the equivalent mutants. These methods are classified into four classes: equivalent mutant detection, avoiding the generation of equivalent mutants, higher-order equivalent mutants, and suggesting equivalent mutants. Higher-order mutation testing (HOMT) is considered the strongest employed technique in avoiding the generation of equivalent mutants and reduction of their number. In this paper, a combination of HOMT especially second-order mutation testing (SOMT) and dynamic symbolic execution (DSE) techniques are applied for the automatic detection and reduction of the equivalent second-order mutants. First, SOMT is used to reduce the number of equivalent mutants. Second, DSE technique is applied to classify the SOMs and detect EM. To assess the efficiency of the proposed technique, it is applied to some subject programs and the results of this technique are compared to the manual results and those of related works. The results showed that the proposed algorithm is more effective in detecting and reducing the number of EM. It detects 94% from the equivalent mutants that have manually analyzed. This percentage is a high percentage comparing with previous studies. Besides, the DEM-DSE technique detects 100% of equivalent mutants for 9 of the 14 subject programs.

Return Oriented Programming (ROP) chains attack has been widely used to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) protection. However, the generation technology for ROP chains is still in a state of manual coding. While, current techniques for automatically generating ROP chains are still insufficiently researched and have few successful applications. On the other hand, the existing methods are based on using Intermediate Language (IL) which is in order to translate the semantics of original instructions for symbolic execution, and then fill in a predefined gadget arrangement to automatically construct a gadget list. This kind of methods may bring following problems: (1) when converting semantics of original to IL, there is a large amount of overhead time, critical instructions may be discarded; (2) the process of populating a predetermined gadget arrangement is inflexible and may fail to construct ROP chains due to address mismatching. In this paper, we propose the Automatic ROP chains Generation (ARG) which is the first fully automatic ROP chains generation tool without using IL. Tested with data from 6 open-source international Capture The Flag (CTF) competitions and 3 Common Vulnerabilities & Exposures (CVE)s, this technology successfully generated ROP chains for all of them. According to the obtained results, our technique can automatically create ROP payloads and reduce up to 80% of ROP exploit payloads. It takes only 3-5 seconds to exploit successfully, compared to manual analysis for at least 60 minutes, as well as it can effectively bypass both Write XOR Execute (W⊕X) and ASLR.

The second generation of blockchain represented by smart contracts has been developing vigorously in recent years. However, frequent smart contract vulnerability incidents pose a serious risk to blockchain ecosystem security. Since current symbol execution tools often fall into path explosion and thus lead to inefficient detection, this paper expands Mythril's framework to optimize its performance. Firstly, it finds out potential vulnerable code regions using static analysis and identifies critical paths that may have security defects. Then, aiming at the problem that traditional search algorithms cannot actively locate and explore critical paths, this paper presents a multi-objective oriented path search (MOPS) strategy based on path priority. This strategy guides dynamic symbolic execution to cover critical paths quickly, avoiding blind traversal of program execution paths. Finally, it describes security rules and proposes corresponding detection logics for different vulnerability categories. This paper analyzes over 1000 smart contracts extracted from Etherscan. Compared with existing tools based on symbolic execution, the proposed method can reduce time consumption by around 35% while ensuring the accuracy of vulnerability detection. Moreover, existing tools often issue warnings that do not actually cause financial losses. But the proposed method only concentrates on code regions related to transfer of funds, so it can reduce the false alarm rate to some extent.

Key segment of a program input is the specific part of the input that has significant affect on the execution of target function. Marking key segment plays an important role in software security analysis. Traditional dynamic analysis methods can not mark the key segments correctly because of control flow dependency problem. The root cause of such problem is that implicit flow analysis method cannot cover all the behavior of the code fragment in a branch, especially when the code snippet contains unexpected jump behavior. The neural network can learn to fit the behavior of the program with proper training data. In this paper, we introduce the attention based neural network to mark the key segments of program input accurately and efficiently. We propose an attention based two-parts network structure and map program inputs into the target code execution by such network. Then we propose a two-step training method to train our network to calculate the importance of each input component on the execution of target function. Finally, we mark the key segments by statistical analysis method. We implement such method and develop a key segment marking tool $AttentionMark$ . Experiments on four real-world software show that $AttentionMark$ outperforms $NeuralTaint$ and traditional dynamic analysis tool in key segment marking.

During the lifecycle of a software system, software patches are committed to software repositories to fix discovered bugs or append new features. Unfortunately, the patches may bring new bugs or vulnerabilities, which could break the stability and security of the software system. A study shows that more than 15% of software patches are erroneous due to poor testing. In this paper, we present a novel approach for automatically determining whether a patch brings new vulnerabilities. Our approach combines symbolic execution with data flow analysis and static analysis, which allows a quick check of patch-related codes. We focus on typical memory-related vulnerabilities, including buffer overflows, memory leaks, uninitialized data, and dangling pointers. We have implemented our approach as a tool called KPSec, which we used to test a set of real-world software patches. Our experimental results show that our approach can effectively identify typical memory-related vulnerabilities introduced by the patches and improve the security of the updated software.

Heuristic search is an important part of modern dynamic symbolic execution (DSE) tools, as heuristic search can be used to effectively explore the large program input space. Searching task remains one of several research challenges due to the fact that the input space grows exponentially with the increase of program size, and different programs may have very different structures. The challenge is compounded in a cyber-physical system or cloud-based Internet of Things environment. In this paper, we propose a novel heuristic search algorithm, which analyzes the program execution history and uses the refined history information to inform the search. This paper is based on the observation that the branch and input history generated during dynamic symbolic execution can help memorize the explored input space, and infer the partial structure of the program. With a summarized branch history, the proposed heuristic search makes informed (and better) decisions about which input area to search next for better efficiency. To evaluate the search algorithm, we implement the core DSE engine, integrated with modules to perform execution history collection and analysis. To make our method practical, we incorporate taint analysis and constraint solving statistics to guide the search algorithm. Experimental results demonstrate that with the rich history information, the new search algorithm can explore the input space more effectively, thus resulting in detecting software defects faster.