An official website of the United States government
Coverage-guided fuzzing's aggressive, high-volume testing has helped reveal tens of thousands of software security flaws. While executing billions of test cases mandates fast code coverage tracing, the nature of binary-only targets leads to reduced tracing performance. A recent advancement in binary fuzzing performance is Coverage-guided Tracing (CGT), which brings orders-of-magnitude gains in throughput by restricting the expense of coverage tracing to only when new coverage is guaranteed. Unfortunately, CGT suits only a basic block coverage granularity---yet most fuzzers require finer-grain coverage metrics: edge coverage and hit counts. It is this limitation which prohibits nearly all of today's state-of-the-art fuzzers from attaining the performance benefits of CGT.This paper tackles the challenges of adapting CGT to fuzzing's most ubiquitous coverage metrics. We introduce and implement a suite of enhancements that expand CGT's introspection to fuzzing's most common code coverage metrics, while maintaining its orders-of-magnitude speedup over conventional always-on coverage tracing. We evaluate their trade-offs with respect to fuzzing performance and effectiveness across 12 diverse real-world binaries (8 open- and 4 closed-source). On average, our coverage-preserving CGT attains near-identical speed to the present block-coverage-only CGT, UnTracer; and outperforms leading binary- and source-level coverage tracers QEMU, Dyninst, RetroWrite, and AFL-Clang by 2--24x, finding more bugs in less time.
more »
« less
Optimal coverage control of stationary and moving agents under effective coverage constraints
- PAR ID:
- 10472370
- Publisher / Repository:
- Elsevier
- Date Published:
- Journal Name:
- Automatica
- Volume:
- 157
- Issue:
- C
- ISSN:
- 0005-1098
- Page Range / eLocation ID:
- 111236
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Several metrics have been proposed in the past to quantify the effectiveness of a test suite; they are usually based on some measure of coverage because it is sensible to quantify the effectiveness of a test suite by the extent to which it exercises (covers) various syntactic features of the program under test. Though no coverage metric has emerged as the gold standard of test suite effectiveness, mutation coverage is widely perceived as a reliable measure of test suite effectiveness because the ability of a test suite to detect program mutations can be used as an indication of its ability to detect actual faults. In this paper we aim to challenge the superiority of mutation coverage, by showing that the same test suite may have vastly different values of mutation coverage depending on the mutation operators that are used in the estimation.more » « less
-
To reduce the cost of mutation testing, researchers have sought to find minimal mutant sets. As an optimization problem, mutant set minimization is defined by two parameters: the objective function that we must optimize; and the constraint under which the optimization is carried out. Whereas the objective function of this optimization problem is clear (minimizing the cardinality of the mutant set), the constraint under which this optimization is attempted has not been clearly articulated in the literature. In this paper, we propose a formal definition of this constraint and discuss in what sense, and to what extent, published algorithms of mutant set minimization comply with this constraint.more » « less
-
Natural hazard news coverage research has examined frames, sources, and journalistic roles. An examination of place in such coverage is missing. Using the hierarchy of influences model, this study analyzes the coverage of place during Hurricane Maria in three major newspapers in Puerto Rico in the pre-crisis and crisis stages of the event. The study examined the roles of routines, organizational factors, and social systems factors in the coverage of Puerto Rican municipalities and the topics covered. Results show a primary focus on highly populated areas, reliance on governmental sources, and differences across the three newspapers studied. Implications for disaster coverage as well as theoretical arguments about the hierarchy of influences are discussed.more » « less
-
This study proposes a multi-period facility location formulation to maximize coverage while meeting a coverage reliability constraint. The coverage reliability constraint is a chance constraint limiting the probability of failure to maintain the desired service standard, commonly followed by emergency medical services and fire departments. Further, uncertainties in the failure probabilities are incorporated by utilizing robust optimization using polyhedral uncertainty sets, which results in a compact mixed-integer linear program. A case study in the Portland, OR metropolitan area is analyzed for employing unmanned aerial vehicles (UAVs) or drones to deliver defibrillators in the region to combat out-of-hospital cardiac arrests. In the context of this study, multiple periods represent periods with different wind speed and direction distributions. The results show that extending to a multi-period formulation, rather than using average information in a single period, is particularly beneficial when either response time is short or uncertainty in failure probabilities is not accounted for. Accounting for uncertainty in decision-making improves coverage significantly while also reducing variability in simulated coverage, especially when response times are longer. Going from a single-period deterministic formulation to a multi-period robust formulation boosts the simulated coverage values by 57%, on average. The effect of considering a distance-based equity metric in decision-making is also explored.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Journal Article:
- https://doi.org/10.1016/j.automatica.2023.111236
