软件安全是计算机系统的重要问题，影响日常生活并可能引发严重社会问题。传统漏洞发现方法如静态分析和符号执行效率不高，而模糊测试以其高效便捷成为寻找软件和系统漏洞的主流工具。现有的许多模糊测试方法存在很大局限性，包括：（1）缺乏对漏洞本身的针对性，在模糊测试过程中过于依赖边覆盖率指标而忽略了对漏洞本身信息的充分利用；（2）缺乏对程序的针对性，忽视了在程序中漏洞分布较为分散的特点导致浪费太多能量在相对不重要的代码区域上。发现程序中的漏洞是模糊测试的最终目的，因此本文希望围绕程序和漏洞，通过结合程序和漏洞本身两方面的特点，包括漏洞类型、漏洞特征和漏洞分布等，更加针对性地对软件程序进行模糊测试。本文根据漏洞本身的特点和目标程序中漏洞的分布特征分别提出了BAZZAFL和ZoneFuzz方法，通过对软件进行插桩动态获取软件运行时的程序状态和程序行为信息，并据此在模糊测试中核心环节进行优化，进一步提高了目前模糊测试工具的漏洞挖掘效率。本文的主要工作和贡献如下： （1）提出了基于种子组的多目标模糊测试技术BAZZAFL。该技术针对常见漏洞类型提出了多种针对性的插桩策略，从而在模糊测试过程中能够动态获取与漏洞相关的特征指标；通过一种全新的以漏洞为导向的种子组结构来管理种子队列；通过可松弛的多级队列调度并结合帕累托前沿算法进行种子调度；基于信息熵计算种子的信息发现能力来进行能量分配；通过基于关键字节推断来优化种子变异以增大漏洞相关指标。该模糊测试技术对常见的24种程序进行测试，比其它模糊测试方法多发现了至少62个漏洞，并且其中包含多种漏洞类型的CVE。 （2）提出了以漏洞为导向的区域模糊测试技术ZoneFuzz。该技术通过结合每个种子多项漏洞相关指标综合计算得到种子的漏洞挖掘能力评分；通过新提出的SNMS算法来筛选掉执行路径过于相似且漏洞挖掘能力较差的种子来进行种子选择。ZoneFuzz在8个大型软件程序上进行了实验，对比现有模糊测试工具，使用该技术能够通过更少的种子达到相近的代码覆盖率，同时发现漏洞的效率也要更高。
Software security is an important issue in computer systems, as it affects daily life and can cause serious social problems. Traditional vulnerability discovery methods such as static analysis and symbolic execution are not efficient, while fuzzing has become the mainstream tool for finding software and system vulnerabilities due to its efficiency and convenience. However, current fuzzing methods have significant limitations, including: (1) lack of targeting toward the vulnerabilities themselves, relying too heavily on coverage metrics and ignoring the full utilization of vulnerability information during the fuzzing process; (2) lack of targeting towards the program, disregarding the fact that vulnerabilities are often distributed in relatively scattered areas of the program, resulting in wasted energy on relatively unimportant code regions.Discovering vulnerabilities in programs is the ultimate goal of fuzzing. Therefore, this thesis aims to conduct fuzzing on software programs in a more targeted manner by considering both the characteristics of programs and vulnerabilities, including vulnerability types, characteristics, and distributions. Based on common types and characteristics of software vulnerabilities, this thesis designs a targeted instrumentation method for fuzzing and proposes BAZZAFL and ZoneFuzz methods based on the characteristics of vulnerabilities and target programs, respectively. By dynamically obtaining the program state and behavior information during runtime through instrumentation, the core steps of fuzzing are optimized, thereby further improving the vulnerability discovery efficiency of current fuzzing tools. The main work and contributions of this thesis are as follows: (1) BAZZAFL, a multi-objective fuzzing technique based on seed groups. This technique proposes various targeted instrumentation strategies for common vulnerability types, enabling dynamic acquisition of vulnerability-related metrics during the fuzzing process. It manages seed queues using a novel vulnerability-oriented seed group structure, employs a relaxed multi-level queue scheduling combined with Pareto front algorithm for seed scheduling, allocates energy based on the information discovery capability of seeds calculated using information entropy, and optimizes seed mutation based on inferred critical bytes to increase vulnerability-related metrics. This fuzzing technique is tested on 24 common programs, discovering at least 62 vulnerabilities compared to other fuzzing methods, including various CVEs. (2) ZoneFuzz, a vulnerability-oriented region fuzzing technique. This technique calculates a comprehensive vulnerability exploration score for each seed by computing multiple vulnerability-related metrics and uses the newly proposed SNMS algorithm to select seeds with similar execution paths and poor vulnerability exploration capabilities for seed selection. ZoneFuzz has been tested on eight large-scale software programs, and compared with existing fuzzing tools, it achieves similar code coverage with fewer seeds, while also achieving higher efficiency in discovering vulnerabilities.
