{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,2,21]],"date-time":"2025-02-21T14:43:49Z","timestamp":1740149029063,"version":"3.37.3"},"reference-count":35,"publisher":"Wiley","license":[{"start":{"date-parts":[[2021,9,18]],"date-time":"2021-09-18T00:00:00Z","timestamp":1631923200000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U20B2046","2019B010137004","2020KCXTD007","202032854","2019GDJC-M16"],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Guangdong Province Key Research and Development Plan","award":["U20B2046","2019B010137004","2020KCXTD007","202032854","2019GDJC-M16"]},{"name":"Guangdong Higher Education Innovation Group","award":["U20B2046","2019B010137004","2020KCXTD007","202032854","2019GDJC-M16"]},{"name":"Guangzhou Higher Education Innovation Group","award":["U20B2046","2019B010137004","2020KCXTD007","202032854","2019GDJC-M16"]},{"name":"Guangzhou University Graduate Student Innovation Ability Cultivation Funding Program","award":["U20B2046","2019B010137004","2020KCXTD007","202032854","2019GDJC-M16"]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Communication Networks"],"published-print":{"date-parts":[[2021,9,18]]},"abstract":"The root cause of the insecurity for smart devices is the potential vulnerabilities in smart devices. There are many approaches to find the potential bugs in smart devices. Fuzzing is the most effective vulnerability finding technique, especially the coverage-guided fuzzing. The coverage-guided fuzzing identifies the high-quality seeds according to the corresponding code coverage triggered by these seeds. Existing coverage-guided fuzzers consider that the higher the code coverage of seeds, the greater the probability of triggering potential bugs. However, in real-world applications running on smart devices or the operation system of the smart device, the logic of these programs is very complex. Basic blocks of these programs play a different role in the process of application exploration. This observation is ignored by existing seed selection strategies, which reduces the efficiency of bug discovery on smart devices. In this paper, we propose a contribution-aware coverage-guided fuzzing, which estimates the contributions of basic blocks for the process of smart device exploration. According to the control flow of the target on any smart device and the runtime information during the fuzzing process, we propose the static contribution of a basic block and the dynamic contribution built on the execution frequency of each block. The contribution-aware optimization approach does not require any prior knowledge of the target device, which ensures our optimization adapting gray-box fuzzing and white-box fuzzing. We designed and implemented a contribution-aware coverage-guided fuzzer for smart devices, called StFuzzer. We evaluated StFuzzer on four real-world applications that are often applied on smart devices to demonstrate the efficiency of our contribution-aware optimization. The result of our trials shows that the contribution-aware approach significantly improves the capability of bug discovery and obtains better execution speed than state-of-the-art fuzzers.<\/jats:p>","DOI":"10.1155\/2021\/1987844","type":"journal-article","created":{"date-parts":[[2021,9,20]],"date-time":"2021-09-20T18:22:27Z","timestamp":1632162147000},"page":"1-15","source":"Crossref","is-referenced-by-count":3,"title":["StFuzzer: Contribution-Aware Coverage-Guided Fuzzing for Smart Devices"],"prefix":"10.1155","volume":"2021","author":[{"given":"Jiageng","family":"Yang","sequence":"first","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}]},{"given":"Xinguo","family":"Zhang","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4120-7716","authenticated-orcid":true,"given":"Hui","family":"Lu","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}]},{"given":"Muhammad","family":"Shafiq","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9409-5359","authenticated-orcid":true,"given":"Zhihong","family":"Tian","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"}]}],"member":"311","reference":[{"article-title":"American fuzzy lop","year":"2013","author":"M. Zalewski","key":"1"},{"key":"2","first-page":"1","article-title":"VUzzer: application-aware evolutionary fuzzing","volume":"17","author":"S. Rawat","year":"2017","journal-title":"National Down Syndrome Society"},{"first-page":"861","article-title":"Optimizing seed selection for fuzzing","author":"A. Rebert","key":"3"},{"issue":"5","key":"4","doi-asserted-by":"crossref","first-page":"489","DOI":"10.1109\/TSE.2017.2785841","article-title":"Coverage-based greybox fuzzing as Markov chain","volume":"45","author":"M. B\u00f6hme","year":"2017","journal-title":"IEEE Transactions on Software Engineering"},{"article-title":"Github","year":"2018","author":"O. Aflpin","key":"5"},{"key":"6","first-page":"34","volume-title":"Peach Fuzzing Platform Whitepaper","author":"M. Eddington","year":"2011"},{"first-page":"2329","article-title":"Directed greybox fuzzing","author":"M. B\u00f6hme","key":"7"},{"first-page":"679","article-title":"Collafl: path sensitive fuzzing","author":"S. Gan","key":"8"},{"first-page":"2307","article-title":"Ecofuzz: adaptive energy-saving greybox fuzzing as a variant of the adversarial multi-armed bandit","author":"T. Yue","key":"9"},{"first-page":"711","article-title":"Angora: efficient fuzzing by principled search","author":"P. Chen","key":"10"},{"first-page":"2095","article-title":"Hawkeye: towards a desired directed grey-box fuzzer","author":"H. Chen","key":"11"},{"first-page":"523","article-title":"QTEP: quality-aware test case prioritization","author":"S. Wang","key":"12"},{"first-page":"769","article-title":"Profuzzer: on-the-fly input type probing for better zero-day vulnerability discovery","author":"W. You","key":"13"},{"first-page":"2577","article-title":"{GEYONE}: data flow sensitive fuzzing","author":"S. Gan","key":"14"},{"first-page":"2595","article-title":"Fuzzing error handling code using context-sensitive software fault injection","author":"Z. M. Jiang","key":"15"},{"first-page":"782","article-title":"Turning programs against each other: high coverage fuzz-testing using binary-code mutation and dynamic slicing","author":"U. Karg\u00e9n","key":"16"},{"first-page":"697","article-title":"T-Fuzz: Fuzzing by program transformation","author":"H. Peng","key":"17"},{"key":"18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23702-7_11"},{"key":"19","first-page":"1","article-title":"Driller: augmenting fuzzing through selective symbolic execution","volume":"16","author":"N. Stephens","year":"2016","journal-title":"National Down Syndrome Society"},{"first-page":"745","article-title":"{QSYM}: a practical concolic execution engine tailored for hybrid fuzzing","author":"I. Yun","key":"20"},{"key":"21","article-title":"Send hardest problems my way: probabilistic path prioritization for hybrid fuzzing","author":"L. Zhao","year":"2019","journal-title":"National Down Syndrome Society"},{"first-page":"605","article-title":"1dvul: discovering 1-day vulnerabilities through binary patches","author":"J. Peng","key":"22"},{"first-page":"1580","article-title":"Savior: towards bug-driven hybrid testing","author":"Y. Chen","key":"23"},{"author":"G. Lee","key":"24","article-title":"Constraint-guided directed greybox fuzzing"},{"article-title":"Honggfuzz","year":"2016","author":"R. Swiecki","key":"25"},{"first-page":"627","article-title":"Steelix: program-state based binary fuzzing","author":"Y. Li","key":"26"},{"first-page":"50","article-title":"Learn&fuzz: machine learning for input fuzzing","author":"P. Godefroid","key":"27"},{"first-page":"689","article-title":"Cab-fuzz: practical concolic testing techniques for {COTS} operating systems","author":"S. Y. Kim","key":"28"},{"first-page":"2345","article-title":"Imf: inferred model-based fuzzer","author":"H. S. Han","key":"29"},{"first-page":"2139","article-title":"Semfuzz: semantics-based automatic generation of proof-of-concept exploits","author":"W. You","key":"30"},{"key":"31","doi-asserted-by":"publisher","DOI":"10.1109\/tii.2019.2938778"},{"key":"32","doi-asserted-by":"publisher","DOI":"10.1109\/tii.2020.3038761"},{"key":"33","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3002255"},{"key":"34","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.02.017"},{"issue":"4","key":"35","doi-asserted-by":"crossref","first-page":"1632","DOI":"10.1109\/TDSC.2019.2922958","article-title":"Efficient and secure decision tree classification for cloud-assisted online diagnosis services","volume":"18","author":"J. Liang","year":"2021","journal-title":"IEEE Transactions on Dependable and Secure Computing"}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/1987844.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/1987844.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2021\/1987844.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,9,20]],"date-time":"2021-09-20T18:22:43Z","timestamp":1632162163000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/scn\/2021\/1987844\/"}},"subtitle":[],"editor":[{"given":"Muhammad","family":"Ahmad","sequence":"additional","affiliation":[]}],"short-title":[],"issued":{"date-parts":[[2021,9,18]]},"references-count":35,"alternative-id":["1987844","1987844"],"URL":"https:\/\/doi.org\/10.1155\/2021\/1987844","relation":{},"ISSN":["1939-0122","1939-0114"],"issn-type":[{"type":"electronic","value":"1939-0122"},{"type":"print","value":"1939-0114"}],"subject":[],"published":{"date-parts":[[2021,9,18]]}}}