Concurrency Vulnerability Detection via Greybox Fuzzing and Priority Test Cases

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Concurrency vulnerabilities in concurrent programs are difficult to detect and reproduce due to their dependence on scheduling policies and external environments, with existing fuzzing techniques like coverage-guided greybox fuzzing having limited impact on discovering such bugs.

Innovation Solution

Instrumenting read and write access to shared memory and using a greybox fuzzer to identify priority test cases, which are then analyzed for racing pairs, and sent to a concurrency verification module for testing with various scheduling policies to identify concurrency vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If coverage-guided greybox fuzzing is used to test concurrent programs, then general bug detection capability is improved, but effectiveness in discovering concurrency bugs remains limited

Engineering Contradiction:

Improveconcurrency vulnerability detection effectivenessVSAvoidnumber of test cases needed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent introduces a concurrency verification module as an intermediary between the greybox fuzzer and the testing process. This module receives test cases from the fuzzer, analyzes them for racing pairs, and selectively forwards priority test cases to the concurrency testing engine, thereby improving detection effectiveness while reducing the overall number of test cases that need full concurrency verification

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the traditional mechanical approach of exhaustive concurrency testing with a smarter analysis mechanism. The concurrency verification module uses static analysis to identify racing pairs and determine test case priorities, substituting brute-force testing with intelligent pre-screening that maintains reliability while improving productivity

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If all test cases are sent to concurrency verification module for exhaustive testing, then detection thoroughness is improved, but testing time and resources increase significantly

Engineering Contradiction:

Improveconcurrency bug detection thoroughnessVSAvoidconcurrency verification time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies partial action by not sending all test cases to the concurrency verification module. Instead, it performs partial verification through racing pair analysis and sends only the necessary subset of priority test cases, achieving sufficient detection thoroughness without the excessive time cost of testing every single test case exhaustively

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The concurrency verification module performs preliminary analysis of test cases to identify racing pairs and determine priorities before full concurrency verification. This preliminary action filters out low-priority test cases early, preventing unnecessary time consumption in the main verification process while maintaining detection thoroughness for critical cases

Inventive Principle:

Principle #10Preliminary action

3Ease of manufacture

If random fuzzing is used without prioritization, then test case generation is simple, but effectiveness in finding concurrency bugs is reduced

Engineering Contradiction:

Improvetest case generation simplicityVSAvoidconcurrency bug discovery effectiveness

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The patent implements feedback mechanisms where the concurrency verification module analyzes test case outcomes and racing pair information, then feeds this information back to prioritize future test case generation. This feedback loop maintains the simplicity of random fuzzing while systematically improving effectiveness by directing attention to high-priority areas based on accumulated knowledge

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10628281B2Concurrency vulnerability detection

Publication Date: 2020.04.21 FUJITSU LTD

AI summary

A method of detecting concurrency vulnerabilities is provided. A method may include instrumenting read and write access for a program to a shared memory. The method may also include identifying, via a greybox fuzzer, a test case for the program. Further, the method may include analyzing, via the greybox fuzzer and based on the test case, two or more branches of the program that include sets of racing pairs to determine if the test case is a priority test case. In response to the test case being a priority test case, the method may include providing the test case from the greybox fuzzer to a concurrency verification module. The method may also include testing, via the concurrency verification module, the test case with one or more scheduling policies to identify one or more concurrency vulnerabilities.