¹Network Information Center, University of Science and Technology of China, Hefei, Anhui, China
²Department of Computer Science and Software Engineering, Concordia University, Montreal, Quebec, Canada

---

Abstract—Knowledge-based Fuzzing technologies have been applied successfully in software vulnerability mining, however, its current methods mainly focus on Fuzzing target software using a single data sample with one or multi-dimension input mutation [1], and thus the vulnerability mining results are not stable, false negatives of vulnerability are high and the selection of data sample depends on human analysis. To solve these problems, this paper proposes a model named Fuzzing Test Suite Generation model using multi data sample combination (FTSGc), which can automatically select multi data samples combination from a large scale data sample set to fuzz target software and generate the test cases that can cover more codes of the software vulnerabilities. To solve Data Sample Coverage Problem (DSCP) in the proposed FTSGc, a method of covering maximum nodes’ semantic attributes with minimum running cost is put forward and a theorem named Maximum Coverage Theorem is given to select the data sample combination. We conclude that DSCP is actually the Set Covering Problem (SCP). Practical experimental results show that the proposed Fuzzing method works much better than the other current Fuzzing method on the Ability of Vulnerability Mining (AVM).

Index Terms&mdash, Fuzzing, Vulnerability mining, FTSGc, DSCP, AVM

[PDF]

Cite: Xueyong Zhu, Zhiyong Wu, J. William Atwood, "A New Fuzzing Method Using Multi Data Samples Combination," Journal of Computers vol. 6, no. 5, pp. 881-888, 2011.