Fuzz By Number

More documents

Recommendations

Info

Fake BugsPositivesLarge sample size - add as many bugs as you wantThe fuzzers still has to actually find the bugsNegativesBugs aren’t “real” - depend on the prejudices of theperson adding them
Code Coverage AnalysisInstrument the target application to measure theamount of code each fuzzer executesAbsolute numbers are meaningless, but relativenumbers can be usedLines not executed by a fuzzer indicate the fuzzer willnot find bugs in those lines (if they exist)Measure “opportunity” of finding bugs
Page 1 and 2: Fuzz By NumberMore Data About Fuzzi
Page 3 and 4: AgendaFuzzing, why we careHow do yo
Page 5 and 6: Generating Test CasesMutation-based
Page 7 and 8: Fuzzing LifecycleIdentifying interf
Page 9 and 10: Retrospective TestingTime period is
Page 11: Simulated VulnerabilityDiscoveryExp
Page 15 and 16: Our TestingThree network protocolsT
Page 17 and 18: Introducing The FuzzersGeneral Purp
Page 19 and 20: TaofOpen source, mutation basedGUI
Page 21 and 22: Mu-4000Commercial fuzzer from Mu Se
Page 23 and 24: eSTORMCommercial, generation based
Page 25 and 26: What’s Missing?What about SPIKE,
Page 27 and 28: The Bugs17 bugs added to each appli
Page 29 and 30: Results!
Page 31 and 32: FTP - Summary% bugs found % code co
Page 33 and 34: SNMP Summary% bugs found % code cov
Page 35 and 36: DNS Summary% Bugs found % Code cove
Page 37 and 38: FTP OdditiesBugs 9, 12, and 13 were
Page 39 and 40: FTP Bug 16MODRET core_eprt(cmd_rec
Page 41 and 42: FTP Bug 4char *dir_canonical_path(p
Page 43 and 44: SNMP Bug #4int snmp_pdu_parse(netsn
Page 45 and 46: GeneralConclusions
Page 47 and 48: Generation Based ApproachMost Effec
Page 49 and 50: Protocol Knowledge Is Good% SNMP bu
Page 51 and 52: More Code Coverage...
Page 53 and 54: Statistics Says “Yes”Dep Var: B
Page 55 and 56: A Real BugAll this fuzzing with dif
Page 57 and 58: Special Thanks To:Commercial fuzzer

Fuzz By Number

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?