CollabFuzz: A Framework for Collaborative Fuzzing

Sebastian Österlund; Elia Geretto; Andrea Jemmett; Emre Güler; Philipp Görz; Thorsten Holz; Cristiano Giuffrida; Herbert Bos

doi:10.1145/3447852.3458720

CollabFuzz: A Framework for Collaborative Fuzzing

Sebastian Österlund, Elia Geretto, Andrea Jemmett, Emre Güler, Philipp Görz, Thorsten Holz, Cristiano Giuffrida, Herbert Bos

Research output: Chapter in Book / Report / Conference proceeding › Conference contribution › Academic › peer-review

Abstract

In the recent past, there has been lots of work on improving fuzz testing. In prior work, EnFuzz showed that by sharing progress among different fuzzers, they can perform better than the sum of their parts. In this paper, we continue this line of work and present CollabFuzz, a collaborative fuzzing framework allowing multiple different fuzzers to collaborate under an informed scheduling policy based on a number of central analyses. More specifically, CollabFuzz is a generic framework that allows a user to express different test case scheduling policies, such as the collaborative approach presented by EnFuzz. CollabFuzz can control which tests cases are handed out to what fuzzer and allows the orchestration of different fuzzers across the network. Furthermore, it allows the centralized analysis of the test cases generated by the various fuzzers under its control, allowing to implement scheduling policies based on the results of arbitrary program (e.g., data-flow) analysis.

Original language	English
Title of host publication	EuroSec 2021
Subtitle of host publication	Proceedings of the 14th European Workshop on Systems
Publisher	Association for Computing Machinery, Inc
Pages	1-7
Number of pages	7
ISBN (Electronic)	9781450383370
DOIs	https://doi.org/10.1145/3447852.3458720
Publication status	Published - Apr 2021
Event	14th European Workshop on Systems, EuroSec 2021 - Virtual, Online, United Kingdom Duration: 26 Apr 2021 → …

Conference

Conference	14th European Workshop on Systems, EuroSec 2021
Country/Territory	United Kingdom
City	Virtual, Online
Period	26/04/21 → …

Bibliographical note

Publisher Copyright:
© 2021 Owner/Author.

Copyright:
Copyright 2021 Elsevier B.V., All rights reserved.

Funding

We would like to thank the anonynous reviewers for their constructive feedback. This work was supported by Cisco Systems, Inc. through grant #1138109 and the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany’s Excellence Strategy – EXC-2092 CaSa – 390781972. In addition, this project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 786669 (ReAct). This paper reflects only the authors’ view. The funding agencies are not responsible for any use that may be made of the information it contains.

Funders	Funder number
Cisco Systems	1138109
Horizon 2020 Framework Programme	786669
Deutsche Forschungsgemeinschaft	EXC-2092 CaSa – 390781972

Keywords

automated bug finding
collaborative fuzzing
ensemble fuzzing
fuzzing
parallel fuzzing

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

Access to Document

10.1145/3447852.3458720

Persistent URL (handle)

Persistent link

Cite this

@inproceedings{ada60f274bdf49e79eb2e8fe1f7b79b0,

title = "CollabFuzz: A Framework for Collaborative Fuzzing",

abstract = "In the recent past, there has been lots of work on improving fuzz testing. In prior work, EnFuzz showed that by sharing progress among different fuzzers, they can perform better than the sum of their parts. In this paper, we continue this line of work and present CollabFuzz, a collaborative fuzzing framework allowing multiple different fuzzers to collaborate under an informed scheduling policy based on a number of central analyses. More specifically, CollabFuzz is a generic framework that allows a user to express different test case scheduling policies, such as the collaborative approach presented by EnFuzz. CollabFuzz can control which tests cases are handed out to what fuzzer and allows the orchestration of different fuzzers across the network. Furthermore, it allows the centralized analysis of the test cases generated by the various fuzzers under its control, allowing to implement scheduling policies based on the results of arbitrary program (e.g., data-flow) analysis. ",

keywords = "automated bug finding, collaborative fuzzing, ensemble fuzzing, fuzzing, parallel fuzzing",

author = "Sebastian {\"O}sterlund and Elia Geretto and Andrea Jemmett and Emre G{\"u}ler and Philipp G{\"o}rz and Thorsten Holz and Cristiano Giuffrida and Herbert Bos",

note = "Publisher Copyright: {\textcopyright} 2021 Owner/Author. Copyright: Copyright 2021 Elsevier B.V., All rights reserved.; 14th European Workshop on Systems, EuroSec 2021 ; Conference date: 26-04-2021",

year = "2021",

month = apr,

doi = "10.1145/3447852.3458720",

language = "English",

pages = "1--7",

booktitle = "EuroSec 2021",

publisher = "Association for Computing Machinery, Inc",

}

Österlund, S, Geretto, E, Jemmett, A, Güler, E, Görz, P, Holz, T, Giuffrida, C & Bos, H 2021, CollabFuzz: A Framework for Collaborative Fuzzing. in EuroSec 2021: Proceedings of the 14th European Workshop on Systems. Association for Computing Machinery, Inc, pp. 1-7, 14th European Workshop on Systems, EuroSec 2021, Virtual, Online, United Kingdom, 26/04/21. https://doi.org/10.1145/3447852.3458720

TY - GEN

T1 - CollabFuzz

T2 - 14th European Workshop on Systems, EuroSec 2021

AU - Österlund, Sebastian

AU - Geretto, Elia

AU - Jemmett, Andrea

AU - Güler, Emre

AU - Görz, Philipp

AU - Holz, Thorsten

AU - Giuffrida, Cristiano

AU - Bos, Herbert

PY - 2021/4

Y1 - 2021/4

N2 - In the recent past, there has been lots of work on improving fuzz testing. In prior work, EnFuzz showed that by sharing progress among different fuzzers, they can perform better than the sum of their parts. In this paper, we continue this line of work and present CollabFuzz, a collaborative fuzzing framework allowing multiple different fuzzers to collaborate under an informed scheduling policy based on a number of central analyses. More specifically, CollabFuzz is a generic framework that allows a user to express different test case scheduling policies, such as the collaborative approach presented by EnFuzz. CollabFuzz can control which tests cases are handed out to what fuzzer and allows the orchestration of different fuzzers across the network. Furthermore, it allows the centralized analysis of the test cases generated by the various fuzzers under its control, allowing to implement scheduling policies based on the results of arbitrary program (e.g., data-flow) analysis.

AB - In the recent past, there has been lots of work on improving fuzz testing. In prior work, EnFuzz showed that by sharing progress among different fuzzers, they can perform better than the sum of their parts. In this paper, we continue this line of work and present CollabFuzz, a collaborative fuzzing framework allowing multiple different fuzzers to collaborate under an informed scheduling policy based on a number of central analyses. More specifically, CollabFuzz is a generic framework that allows a user to express different test case scheduling policies, such as the collaborative approach presented by EnFuzz. CollabFuzz can control which tests cases are handed out to what fuzzer and allows the orchestration of different fuzzers across the network. Furthermore, it allows the centralized analysis of the test cases generated by the various fuzzers under its control, allowing to implement scheduling policies based on the results of arbitrary program (e.g., data-flow) analysis.

KW - automated bug finding

KW - collaborative fuzzing

KW - ensemble fuzzing

KW - fuzzing

KW - parallel fuzzing

UR - http://www.scopus.com/inward/record.url?scp=85106202565&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85106202565&partnerID=8YFLogxK

U2 - 10.1145/3447852.3458720

DO - 10.1145/3447852.3458720

M3 - Conference contribution

AN - SCOPUS:85106202565

SP - 1

EP - 7

BT - EuroSec 2021

PB - Association for Computing Machinery, Inc

Y2 - 26 April 2021

ER -

CollabFuzz: A Framework for Collaborative Fuzzing

Abstract

Conference

Bibliographical note

Funding

Keywords

UN SDGs

Access to Document

Persistent URL (handle)

Other files and links

Fingerprint

Cite this