A New Fuzzing Technique Using Niche Genetic Algorithm

Abstract:

Current advanced Fuzzing technique can only implement vulnerability mining on a single vulnerable statement each time, and this paper proposes a new multi-dimension Fuzzing technique, which uses niche genetic algorithm to generate test cases and can concurrently approach double vulnerable targets with the minimum cost on the two vulnerable statements each time. For that purpose, a corresponding mathematical model and the minimum cost theorem are presented. The results of the experiment show that the efficiency of the new proposed Fuzzing technique is much better than current advanced Fuzzing techniques.

• Periodical: Advanced Materials Research (Volumes 756-759)
• Pages: 4050-4058
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.756-759.4050
• Online since: September 2013
• Authors: Xue Yong Zhu, Zhi Yong Wu
• Keywords: Multi-Dimension Fuzzing, Niche Genetic Algorithm, Statements Combination, Vulnerability Mining

References

[1] Zhi-yong Wu, J. William Atwood, Xue-yong Zhu. A new Fuzzing technique for software vulnerability mining[A]. In Proceedings of IEEE CONSEG'09[C]. pp.59-66, December (2009).

[2] Xueyong Zhu, Zhiyong Wu, and J. William Atwood, A New Fuzzing Method Using Multi Data Samples Combination, Journal of Computers, Volume 6, Number 5, p.881—888, ISSN 1796-203X, © 2011 ACADEMY PUBLISHER, May (2011).

DOI: 10.4304/jcp.6.5.881-888

[3] Vijay Ganesh, Tim Leek, Martin Rinard. Taint-based Directed Whitebox Fuzzing[A] In Proceedings of IEEE ICSE'09[C], 978-1-4244-3452-7/09, May, (2009).

DOI: 10.1109/icse.2009.5070546

[4] Berndt D, Fisher J, Johnson L, Pinglikar J, Watkins A. Breeding software test cases with genetic algorithms[A]. In Proceedings of the Hawai international conference on system sciences[C]. p.338–48, (2003).

DOI: 10.1109/hicss.2003.1174917

[5] Sherri Sparks, Ryan Cunningham, Shawn Embleton, Cliff C. Zou. Automated Vulnerability Analysis: Leveraging Control Flow for Evolutionary Input Crafting[A], in 23rd Annual Computer Security Applications Conference (ACSAC)[C], pp.477-486, Dec (2007).

DOI: 10.1109/acsac.2007.27

[6] LIU Guang-Hong, WU Gang, ZHENG Tao, SHUAI Jian-Mei, TANG Zhuo-Chun, Vulnerability analysis for x86 executables using genetic algorithm and fuzzing[A]. In Proceedings of International Conference on Convergence Hybird Information Technique (ICCIT)[C], 2008. 9.

DOI: 10.1109/iccit.2008.9

[7] Del Grosso C, Di Penta M, Antoniol G, Merlo E, Galinier P. Improving network applications security: a new heuristic to generate stress testing data[A]. In: Proceedings of the genetic and evolutionary computation conference[C], pp.1037-1043, (2005).

DOI: 10.1145/1068009.1068185

[8] Del Grosso C, Di Penta M, Antoniol G, Merlo E, Galinier P. Detecting buffer overflow via automatic test input data generation[J]. Computers and Operations Research, v. 35 n. 10, pp.3125-3143, October (2008).

DOI: 10.1016/j.cor.2007.01.013

[9] Ren Hua, Detecting Buffer Overflow in Binary Code by Analyzing Unsafe Functions [D]. Master thesis of PLA Information Engineering University, (2007).

[10] Li, X. D. Adaptively Choosing Neighbourhood Bests Using Species in a Particle Swarm Optimizer for Multimodal Functions Optimization[A]. In Proceedings of Genetic and Evolutionary Comptiation [C], Springer Berlin/Heidelberg, (2004).

DOI: 10.1007/978-3-540-24854-5_10

[11] Li, J. P., M. E. Balazs, G. Parks, and P.J. Clarkson, A Species Conserving Genetic Algorithm for Multimodal Function Optimization[J]. Evolutionary Computation, 10(3), pp.207-234, (2002).

DOI: 10.1162/106365602760234081

[12] De Jong, K. A., An Analysis of the Behavior of a Class of Genetic Adaptive Systems[R], in Department of Computer Science, University of Michigan: Ann Arbor, Michigan, USA, (1975).