See, stats, and : https : / / www . researchgate . net / publication / 311886374 VUzzer : Application - aware Conference DOI : 10 . 14722 / ndss . 2017 . 23404 CITATIONS 0 READS 17 6 , including : Some : Systems Sanjay Vrije , Amsterdam , Netherlands 38 SEE Ashish International 1 SEE Cristiano VU 51 SEE Herbert VU 163 , 836 SEE All . The . All - text and , letting . Abstract—Fuzzing is an effective software testing technique to find bugs . Given the size and complexity of real - world applications , modern fuzzers tend to be either scalable , but not effective in exploring bugs that lie deeper in the execution , or capable of penetrating deeper in the application , but not scalable . In this paper , we present an application - aware evolutionary fuzzing strategy that does not require any prior knowledge of the application or input format . In order to maximize coverage and explore deeper paths , we leverage control - and data - flow features based on static and dynamic analysis to infer fundamental prop - erties of the application . This enables much faster generation of interesting inputs compared to an application - agnostic approach . We implement our fuzzing strategy in VUzzer and evaluate it on three different datasets : DARPA Grand Challenge binaries (CGC) , a set of real - world applications (binary input parsers) , and the recently released LAVA dataset . On all of these datasets , VUzzer yields significantly better results than state - of - the - art fuzzers , by quickly finding several existing and new bugs .

VUzzer: Application-aware Evolutionary Fuzzing.

Coverage-based Greybox Fuzzing (CGF) is a random testing approach that requires no program analysis. A new test is generated by slightly mutating a seed input. If the test exercises a new and interesting path, it is added to the set of seeds; otherwise, it is discarded. We observe that most tests exercise the same few "high-frequency" paths and develop strategies to explore significantly more paths with the same number of tests by gravitating towards low-frequency paths. We explain the challenges and opportunities of CGF using a Markov chain model which specifies the probability that fuzzing the seed that exercises path i generates an input that exercises path j. Each state (i.e., seed) has an energy that specifies the number of inputs to be generated from that seed. We show that CGF is considerably more efficient if energy is inversely proportional to the density of the stationary distribution and increases monotonically every time that seed is chosen. Energy is controlled with a power schedule. We implemented the exponential schedule by extending AFL. In 24 hours, AFLFAST exposes 3 previously unreported CVEs that are not exposed by AFL and exposes 6 previously unreported CVEs 7x faster than AFL. AFLFAST produces at least an order of magnitude more unique crashes than AFL.

Coverage-based Greybox Fuzzing as Markov Chain

Existing Greybox Fuzzers (GF) cannot be effectively directed, for instance, towards problematic changes or patches, towards critical system calls or dangerous locations, or towards functions in the stack-trace of a reported vulnerability that we wish to reproduce. In this paper, we introduce Directed Greybox Fuzzing (DGF) which generates inputs with the objective of reaching a given set of target program locations efficiently. We develop and evaluate a simulated annealing-based power schedule that gradually assigns more energy to seeds that are closer to the target locations while reducing energy for seeds that are further away. Experiments with our implementation AFLGo demonstrate that DGF outperforms both directed symbolic-execution-based whitebox fuzzing and undirected greybox fuzzing. We show applications of DGF to patch testing and crash reproduction, and discuss the integration of AFLGo into Google's continuous fuzzing platform OSS-Fuzz. Due to its directedness, AFLGo could find 39 bugs in several well-fuzzed, security-critical projects like LibXML2. 17 CVEs were assigned.

Directed Greybox Fuzzing

The vast majority of security breaches encountered today are a direct result of insecure code. Consequently, the protection of computer systems critically depends on the rigorous identification of vulnerabilities in software, a tedious and error-prone process requiring significant expertise. Unfortunately, a single flaw suffices to undermine the security of a system and thus the sheer amount of code to audit plays into the attacker's cards. In this paper, we present a method to effectively mine large amounts of source code for vulnerabilities. To this end, we introduce a novel representation of source code called a code property graph that merges concepts of classic program analysis, namely abstract syntax trees, control flow graphs and program dependence graphs, into a joint data structure. This comprehensive representation enables us to elegantly model templates for common vulnerabilities with graph traversals that, for instance, can identify buffer overflows, integer overflows, format string vulnerabilities, or memory disclosures. We implement our approach using a popular graph database and demonstrate its efficacy by identifying 18 previously unknown vulnerabilities in the source code of the Linux kernel.

/pdf/modeling-and-discovering-vulnerabilities-with-code-property-41nz24gijg.pdf

Modeling and Discovering Vulnerabilities with Code Property Graphs

Botnets: A survey

Because "botnets" can be used for illicit financial gain, they have become quite popular in recent Internet attacks. "Honeypots" have been successfully deployed in many defense systems. Thus, attackers constructing and maintaining botnets will be forced to find ways to avoid honeypot traps. In this paper, we present a hardware and software independent honeypot detection methodology based on the following assumption: security professionals deploying honeypots have liability constraints such that they cannot allow their honeypots to participate in real (or too many real) attacks. Based on this assumption, attackers can detect honeypots in their botnet by checking whether the compromised machines in the botnet can successfully send out unmodified malicious traffic to attackers sensors or whether the bot controller in their botnet can successfully relay potential attack commands. In addition, we present a novel "two-stage reconnaissance" worm that can automatically construct a peer-to-peer structured botnet and detect and remove infected honeypots during its propagation stage. Finally, we discuss some guidelines for defending against the general honeypot-aware attacks.

/pdf/honeypot-aware-advanced-botnet-construction-and-maintenance-f8w5zp43q6.pdf

Honeypot-Aware Advanced Botnet Construction and Maintenance

Recent research at the University of Central Florida involving crashes on I-4 in Orlando, Florida, has led to the creation of new statistical models capable of determining the crash risk on the freeway in real time. The potential benefits of variable speed limit (VSL) implementation for reducing the crash risk along the freeway at different loading scenarios was studied. VSL strategies were used in a networkwide attempt to reduce rear-end and lane-change crash risks where speed differences between upstream and downstream vehicles were high. The idea of homogeneous speed zones also was introduced in this study to determine the distance over which variable speed limits should be implemented from a station of interest. This idea is unique because it is the first time a dynamic distance has been considered for VSL implementation. This study shows that VSL is an effective crash prevention strategy when the freeway is operating in uncongested conditions. Specifically, in free-flow conditions and conditions appr...

Dynamic Variable Speed Limit Strategies for Real-Time Crash Risk Reduction on Freeways

We present an extension of traditional "black box" fuzz testing using a genetic algorithm based upon a dynamic Markov model fitness heuristic. This heuristic allows us to "intelligently" guide input selection based upon feedback concerning the "success" of past inputs that have been tried. Unlike many software testing tools, our implementation is strictly based upon binary code and does not require that source code be available. Our evaluation on a Windows server program shows that this approach is superior to random black box fuzzing for increasing code coverage and depth of penetration into program control flow logic. As a result, the technique may be beneficial to the development of future automated vulnerability analysis tools.

/pdf/automated-vulnerability-analysis-leveraging-control-flow-for-4qpjyge911.pdf

Automated Vulnerability Analysis: Leveraging Control Flow for Evolutionary Input Crafting

Botnets have become one of the major attacks in the internet today due to their illicit profitable financial gain. Meanwhile, honeypots have been successfully deployed in many computer security defence systems. Since honeypots set up by security defenders can attract botnet compromises and become spies in exposing botnet membership and botnet attacker behaviours, they are widely used by security defenders in botnet defence. Therefore, attackers constructing and maintaining botnets will be forced to find ways to avoid honeypot traps. In this paper, we present a hardware and software independent honeypot detection methodology based on the following assumption: security professionals deploying honeypots have a liability constraint such that they cannot allow their honeypots to participate in real attacks that could cause damage to others, while attackers do not need to follow this constraint. Attackers could detect honeypots in their botnets by checking whether compromised machines in a botnet can successfully send out unmodified malicious traffic. Based on this basic detection principle, we present honeypot detection techniques to be used in both centralised botnets and Peer-to-Peer (P2P) structured botnets. Experiments show that current standard honeypots and honeynet programs are vulnerable to the proposed honeypot detection techniques. At the end, we discuss some guidelines for defending against general honeypot-aware attacks.

/pdf/honeypot-detection-in-advanced-botnet-attacks-4w8gddd3ur.pdf

Honeypot detection in advanced botnet attacks

Relevance of reactive traffic management strategies such as freeway incident detection has been diminishing with advancements in mobile phone usage and video surveillance technology. On the other hand, capacity to collect, store, and analyze traffic data from underground loop detectors has witnessed enormous growth in the recent past. These two facts together provide us with motivation as well as the means to shift the focus of freeway traffic management toward proactive strategies that would involve anticipating incidents such as crashes. This report provides details of the research effort for developing a proactive traffic management system for a 36.25-mile instrumented corridor of Interstate-4 in Orlando metropolitan area. Complete research effort is documented in two separate volumes. This volume (Volume I) documents the work to develop real-time crash risk assessment models. Among available historical crashes used in the analysis; the rear-end crashes are analyzed first. They are the single most frequent type of crash on the freeway. It was found that rear-end crashes may be separated into two groups based on the speeds prevailing at surrounding stations 5-10 minutes before the crash. The authors have developed separate models for the rear-end crashes that occur during congested speed regime and those which occur under moderate to high speed regime. A classification tree model for regime identification is followed up with neural network models for each of the two groups of rear-end crashes. It was found that the proposed approach for real-time identification of crash prone conditions can ‘predict’ 3/4 of the rear-end crashes with reasonable false alarm rate. The analysis is then followed up by artificial intelligence based neural network models for lane-change related crashes. However, the authors did not find any groupings in these crashes analogous to the rear-end crashes belonging to two distinct regimes. These models for rear-end and lane-change related crashes are then put together in the form of a framework for real-time crash risk assessment.

R. Cunningham

Papers

Honeypot-Aware Advanced Botnet Construction and Maintenance

Dynamic Variable Speed Limit Strategies for Real-Time Crash Risk Reduction on Freeways

Automated Vulnerability Analysis: Leveraging Control Flow for Evolutionary Input Crafting

Honeypot detection in advanced botnet attacks

Linking Crash Patterns to ITS-Related Archived Data: Phase IIVolume I: Real-time Crash Risk Assessment Models