Proj THUDBFuzz Paper Reading: Superion: Grammar-Aware Greybox Fuzzing

Abstract

目的: 生成语法语义有效的test case
工具: Superion, AFL的拓展
特色: grammar-aware; coverage-based; graybox
特别输入: 语法
方法:

1. grammar-aware trimming strategy: 在树的层次直接缩减test inputs
2. 两种mutation strategies
3. enhanced dictionary-based mutation
4. tree-based mutation: 替换子树
   实验:
   对象: libplist, 一个XML引擎；3个js引擎: WebKit; JerryScript; ChakraCore
   竞品: AFL, jsfunfuzz
   效果:
5. +16.7% line coverage; +8.8% function coverage
6. +21bugs， 16CVEs, 3.2k UDB bug bounty
   还设计实验证明了grammar-aware trimming & mutation的有效性