A case study of gray-box fuzzing with byte- and tree-level mutation strategies in XML-based applications for exposing security vulnerabilities.
Saved in:
| Title: | A case study of gray-box fuzzing with byte- and tree-level mutation strategies in XML-based applications for exposing security vulnerabilities. |
|---|---|
| Authors: | ŞENTÜRK, Şerafettin1 serafettin.senturk@ogr.sakarya.edu.tr, GAROUSI, Vahid2, YUMUŞAK, Nejat1 |
| Source: | Turkish Journal of Electrical Engineering & Computer Sciences. 2025, Vol. 33 Issue 2, p86-105. 20p. |
| Subjects: | Computer security vulnerabilities, Crash testing, Systems software, Seeds, Syntax (Grammar) |
| Abstract: | Fuzzing is an automated process used to detect crashes and vulnerabilities in software systems, and it is classified as either grammar-based or mutation-based in terms of input generation. While grammar-based fuzzing generates inputs from a specification and handles highly structured data, mutation-based fuzzing creates inputs by randomly modifying input files or abstract syntax trees. There are not many case studies comparing the crash detection capabilities in the scope of mutation-based fuzzing. To add to the body of empirical evidence in this area, this case study compares fuzzing with different mutation strategies to evaluate their effectiveness in three aspects: fault detection effectiveness, fault detection performance, and types of faults detected. Additionally, we evaluate the effects of seed generation techniques on fuzzing effectiveness. We perform the fuzzing on three XML parsers: libxml2, Apache Xerces, and Expat. To perform fuzzing, we use well-known mutation-based fuzzers that implement varying levels of mutation strategies. We conduct investigations to examine the effects of seed generation on fuzzing by utilizing publicly available seeds and probabilistic context-sensitive grammar (PCSG)-based seeds. In terms of fault detection effectiveness and performance, we evaluate the number of crashes and the number of test cases generated. With respect to mutation strategies, our results demonstrate that the bit/byte-level mutation strategy detects more crashes than the tree-level mutation strategy. According to the fuzzing results, PCSG-based seeds can help detect higher number of crashes than publicly available ones. In terms of generated test cases, fewer test cases are produced for PCSG-based seeds compared to publicly selected ones, while bit/byte-level mutations generate more test cases than tree-level mutations. Empirical results show that crash detection capabilities of fuzzing differ importantly based on the mutation strategy used. [ABSTRACT FROM AUTHOR] |
| Copyright of Turkish Journal of Electrical Engineering & Computer Sciences is the property of Scientific and Technical Research Council of Turkey and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Database: | Engineering Source |
| FullText | Links: – Type: pdflink Text: Availability: 0 |
|---|---|
| Header | DbId: egs DbLabel: Engineering Source An: 184284310 AccessLevel: 6 PubType: Academic Journal PubTypeId: academicJournal PreciseRelevancyScore: 0 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: A case study of gray-box fuzzing with byte- and tree-level mutation strategies in XML-based applications for exposing security vulnerabilities. – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22ŞENTÜRK%2C+Şerafettin%22">ŞENTÜRK, Şerafettin</searchLink><relatesTo>1</relatesTo><i> serafettin.senturk@ogr.sakarya.edu.tr</i><br /><searchLink fieldCode="AR" term="%22GAROUSI%2C+Vahid%22">GAROUSI, Vahid</searchLink><relatesTo>2</relatesTo><br /><searchLink fieldCode="AR" term="%22YUMUŞAK%2C+Nejat%22">YUMUŞAK, Nejat</searchLink><relatesTo>1</relatesTo> – Name: TitleSource Label: Source Group: Src Data: <searchLink fieldCode="JN" term="%22Turkish+Journal+of+Electrical+Engineering+%26+Computer+Sciences%22">Turkish Journal of Electrical Engineering & Computer Sciences</searchLink>. 2025, Vol. 33 Issue 2, p86-105. 20p. – Name: Subject Label: Subjects Group: Su Data: <searchLink fieldCode="DE" term="%22Computer+security+vulnerabilities%22">Computer security vulnerabilities</searchLink><br /><searchLink fieldCode="DE" term="%22Crash+testing%22">Crash testing</searchLink><br /><searchLink fieldCode="DE" term="%22Systems+software%22">Systems software</searchLink><br /><searchLink fieldCode="DE" term="%22Seeds%22">Seeds</searchLink><br /><searchLink fieldCode="DE" term="%22Syntax+%28Grammar%29%22">Syntax (Grammar)</searchLink> – Name: Abstract Label: Abstract Group: Ab Data: Fuzzing is an automated process used to detect crashes and vulnerabilities in software systems, and it is classified as either grammar-based or mutation-based in terms of input generation. While grammar-based fuzzing generates inputs from a specification and handles highly structured data, mutation-based fuzzing creates inputs by randomly modifying input files or abstract syntax trees. There are not many case studies comparing the crash detection capabilities in the scope of mutation-based fuzzing. To add to the body of empirical evidence in this area, this case study compares fuzzing with different mutation strategies to evaluate their effectiveness in three aspects: fault detection effectiveness, fault detection performance, and types of faults detected. Additionally, we evaluate the effects of seed generation techniques on fuzzing effectiveness. We perform the fuzzing on three XML parsers: libxml2, Apache Xerces, and Expat. To perform fuzzing, we use well-known mutation-based fuzzers that implement varying levels of mutation strategies. We conduct investigations to examine the effects of seed generation on fuzzing by utilizing publicly available seeds and probabilistic context-sensitive grammar (PCSG)-based seeds. In terms of fault detection effectiveness and performance, we evaluate the number of crashes and the number of test cases generated. With respect to mutation strategies, our results demonstrate that the bit/byte-level mutation strategy detects more crashes than the tree-level mutation strategy. According to the fuzzing results, PCSG-based seeds can help detect higher number of crashes than publicly available ones. In terms of generated test cases, fewer test cases are produced for PCSG-based seeds compared to publicly selected ones, while bit/byte-level mutations generate more test cases than tree-level mutations. Empirical results show that crash detection capabilities of fuzzing differ importantly based on the mutation strategy used. [ABSTRACT FROM AUTHOR] – Name: AbstractSuppliedCopyright Label: Group: Ab Data: <i>Copyright of Turkish Journal of Electrical Engineering & Computer Sciences is the property of Scientific and Technical Research Council of Turkey and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.) |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=egs&AN=184284310 |
| RecordInfo | BibRecord: BibEntity: Identifiers: – Type: doi Value: 10.55730/1300-0632.4116 Languages: – Code: eng Text: English PhysicalDescription: Pagination: PageCount: 20 StartPage: 86 Subjects: – SubjectFull: Computer security vulnerabilities Type: general – SubjectFull: Crash testing Type: general – SubjectFull: Systems software Type: general – SubjectFull: Seeds Type: general – SubjectFull: Syntax (Grammar) Type: general Titles: – TitleFull: A case study of gray-box fuzzing with byte- and tree-level mutation strategies in XML-based applications for exposing security vulnerabilities. Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: ŞENTÜRK, Şerafettin – PersonEntity: Name: NameFull: GAROUSI, Vahid – PersonEntity: Name: NameFull: YUMUŞAK, Nejat IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 03 Text: 2025 Type: published Y: 2025 Identifiers: – Type: issn-print Value: 13000632 Numbering: – Type: volume Value: 33 – Type: issue Value: 2 Titles: – TitleFull: Turkish Journal of Electrical Engineering & Computer Sciences Type: main |
| ResultId | 1 |
