Platform for Automatic Fuzzing of OS Components
https://doi.org/10.15514/ISPRAS-2024-36(3)-12
Abstract
Automation of security analysis processes plays an important role in software development, because it allows vulnerabilities to be detected and fixed at an early stage. This article presents the development outcomes of an automated fuzz-testing platform, as well as its integration with a platform for processing and storing the results of various security analysis tools. The developed platform integrates security analysis tools into a single testing system embedded in the continuous integration process. The proposed platform not only simplifies and speeds up the testing and analysis processes, but also increases the accuracy of vulnerability detection through results aggregation and the application of machine learning algorithms for marking and prioritizing detected errors. This approach allows developers to identify and correct vulnerabilities in a timely manner, contributing to the creation of more reliable and secure products.
About the Authors
Egor Petrovich SURAEV
PJSC Astra Group
Russian Federation
Russian Federation
Student at the Institute of Cybersecurity and Digital Technologies in RTU MIREA, Information Security Specialist of Dynamic Analysis Unit. Field of Interest: fuzzing, dynamic analysis, machine learning, vulnerability research.
Victoriia Vyacheslavovna EGOROVA
PJSC Astra Group
Russian Federation
Russian Federation
Deputy Head of Security Analysis Department, postgraduate student at the Faculty of Computational Mathematics and Cybernetics of Lomonosov Moscow State University. Field of Interest: program analysis, dynamic analysis, fuzzing.
Alexey Sergeevich PANOV
PJSC Astra Group
Russian Federation
Russian Federation
Head of Dynamic Analysis Unit, postgraduate student at the ISP RAS. Field of Interest: vulnerability research, penetration testing.
References
1. Проект OSS-Fuzz / OSS-Fuzz project. Available at: https://github.com/google/oss-fuzz/, acсessed 12.04.2024.
2. Проект OSS-Sydr-Fuzz / OSS-Sydr-Fuzz project. Available at: https://github.com/ispras/oss-sydr-fuzz, acсessed 12.04.2024.
3. Инструментальное средство фаззинг-тестирования AFLplusplus / AFLplusplus. Available at: https://github.com/AFLplusplus/AFLplusplus, acсessed 12.04.2024.
4. Инструментальное средство фаззинг-тестирования libFuzzer / libFuzzer. Available at: https:// llvm.org/docs/LibFuzzer.html, acсessed 12.04.2024.
5. A. Vishnyakov et al., “Sydr-Fuzz: Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle,” in 2022 Ivannikov ISPRAS Open Conference (ISPRAS), 2022, pp. 111–123. doi: 10.1109/ISPRAS57371.2022.10076861.
6. Расширяемая инфраструктура для фаззинга ClusterFuzz / ClusterFuzz. Available at: https://google.github.io/clusterfuzz, acсessed 12.04.2024.
7. Инструментальное средство фаззинг-тестирования CIFuzz / CIFuzz. Available at: https://www.code-intelligence.com/product-ci-fuzz, acсessed 12.04.2024.
8. T. Klooster, F. Turkmen, G. Broenink, R. ten Hove, and M. Böhme, Effectiveness and Scalability of Fuzzing Techniques in CI/CD Pipelines. 2022.
9. Проект Fuzz Introspector / Fuzz Introspector. Available at: https://github.com/ossf/fuzz-introspector, acсessed 12.04.2024.
10. Инструментальное средство фаззинг-тестирования Jazzer / Jazzer. Available at: https://github.com/CodeIntelligenceTesting/jazzer, acсessed 12.04.2024.
11. Инструментальное средство фаззинг-тестирования Jazzer.js / Jazzer.js. Available at: https://github.com/CodeIntelligenceTesting/jazzer.js, aсcessed 12.04.2024.
12. Инструментальное средство CI Spark / CI Spark. Available at: https://www.code-intelligence.com/product-ci-spark, aсcessed 12.04.2024.
13. Платформа управления и автоматизиации фаззинга CI Sense / CI Sense. Available at: https://www.code-intelligence.com/product-ci-sense, aсcessed 12.04.2024.
14. Инструментальное средство FuzzIt / FuzzIt. Available at: https://github.com/fuzzitdev, acсessed 12.04.2024.
15. Платформа Gitlab Security / GitLab Security. Available at: https://about.gitlab.com/solutions/security-compliance/, aсcessed 12.04.2024.
16. Инструмент фаззинг-тестирования Javafuzz / Javafuzz. Available at: https://gitlab.com/gitlab-org/security-products/analyzers/fuzzers/javafuzz, acсessed 12.04.2024.
17. Инструмент фаззинг-тестирования jsfuzz / jsfuzz. Available at: https://gitlab.com/gitlab-org/security-products/analyzers/fuzzers/jsfuzz, acсessed 12.04.2024.
18. Инструмент фаззинг-тестирования pythonfuzz / pythonfuzz. Available at: https://gitlab.com/gitlab-org/security-products/analyzers/fuzzers/pythonfuzz, acсessed 12.04.2024.
19. Платформа для автоматизации процессов анализа безопасности Mayhem / Mayhem. Available at: https://www.mayhem.security/, acсessed 12.04.2024.
20. Инструмент фаззинг-тестирования hongfuzz / hongfuzz. Available at: https://github.com/google/honggfuzz, acсessed 12.04.2024.
21. Mayhem, the Machine That Finds Software Vulnerabilities, Then Patches Them. Available at: https://spectrum.ieee.org/mayhem-the-machine-that-finds-software-vulnerabilities-then-patches-them, acсessed 12.04.2024.
22. Фреймворк Vue.js / Vue.js. Available at: https://vuejs.org/, acсessed 12.04.2024.
23. Фреймворк Vuetify / Vuetify. Available at: https://vuetifyjs.com/en/, acсessed 12.04.2024.
24. Библиотека vue-router / vue-router. Available at: https://router.vuejs.org/, acсessed 12.04.2024.
25. Библиотека Anxious / Anxious. Available at: https://axios-http.com/, acсessed 12.04.2024.
26. Фреймворк Pinia / Pinia. Available at: https://pinia.vuejs.org/, acсessed 12.04.2024.
27. Django REST Framework. Available at: https://www.django-rest-framework.org/, acсessed 12.04.2024.
28. Инструмент для асинхронной обработки задач Celery / Celery. Available at: https://github.com/celery/celery/, acсessed 12.04.2024.
29. Система управления базами данных PostgreSQL / PostgreSQL. Available at: https://www.postgresql.org/, acсessed 12.04.2024.
30. Объектное хранилище MinIO / MinIO. Available at: https://min.io/, acсessed 12.04.2024.
31. Инструментальное средство Valgrind / Valgrind. Available at: https://valgrind.org/, aсcessed 12.04.2024.
32. CASR: инструмент формирования отчетов об ошибках / CASR. Available at: https://www.ispras.ru/technologies/casr/, acсessed 12.04.2024.
33. Инструмент фаззинг-тестирования Crusher / Crusher. Available at: https://www.ispras.ru/technologies/crusher/, aсcessed 12.04.2024.
34. Комплекс гибридного фаззинга и динамического анализа Sydr / Sydr. Available at: https://www.ispras.ru/technologies/sydr/, acсessed 12.04.2024.
35. Брокер сообщений RabbitMQ / RabbitMQ. Available at: https://www.rabbitmq.com/, acсessed 12.04.2024.
36. Егорова В.В., Панов А.С., Тележников В.Ю., Девянин П.Н. Подходы, направленные на повышение эффективности фаззинг-тестирования компонентов защищенной ОС. Труды Института системного программирования РАН, том 34, вып. 4, 2022г., стр. 21-34 / Egorova V.V., Panov A.S., Telezhnikov V.Y., Devyanin P.N. Approaches for improving the efficiency of protected OS components fuzzing. 2022;34(4):21-34. https://doi.org/10.15514/ISPRAS-2022-34(4)-2.
37. Инструмент фаззинг-тестирования syzkaller / syzkaller. Available at: https://github.com/google/syzkaller, acсessed 12.04.2024.
38. J. Wang, Z. Huang, H. Liu, N. Yang, and Y. Xiao, DefectHunter: A Novel LLM-Driven Boosted-Conformer-based Code Vulnerability Detection Mechanism. 2023.
39. Фреймворк OSS-Fuzz-Gen / OSS-Fuzz_gen. Available at: https://github.com/google/oss-fuzz-gen, acсessed 12.04.2024.
40. Инструмент Dr.Memory / Dr.Memory. Available at: https://drmemory.org/, acсessed 12.04.2024.
41. VulBERTa / VulBERTa. Available at: https://github.com/ICL-ml4csec/VulBERTa, acсessed 12.04.2024.
Review
For citations:
SURAEV E.P., EGOROVA V.V., PANOV A.S. Platform for Automatic Fuzzing of OS Components. Proceedings of the Institute for System Programming of the RAS (Proceedings of ISP RAS). 2024;36(3):167-188. (In Russ.) https://doi.org/10.15514/ISPRAS-2024-36(3)-12
Email this article 