Automatic Fault Localization for Fuzzing

Fuzzing has proved successful in finding security vulnerabilities in large binary programs. Traditionally, reversing engineering technologies are used to locate codes that may lead to exceptions in Fuzzing, and this may demand a great amount of human efforts and consequently gives rise to low efficiency. In this paper, an automatic fault localization method for Fuzzing is proposed together with an automatic vulnerability analysis system named Fuzz Loc. Fuzz Loc can filter key instructions that may directly cause exceptions. Starting from these key instructions, Fuzz Loc implements automatic fault localization by back tracing. With Fuzz Loc, a great deal of human efforts can be saved. Experiments show that Fuzz Loc can locate fault codes accurately with little human intervention and consequently improves efficiency of fault analysis and vulnerability mining.