A large-scale system contains a huge configuration space because of its large number of configuration parameters. This leads to a combination explosion among configuration parameters when exploring the configuration space. Existing configuration testing techniques first use fuzzing to generate different configuration parameters, and then directly inject them into the program under test to find configuration-induced bugs. However, they do not fully consider the complexity of large-scale systems, resulting in low testing effectiveness. In this paper, we propose ECFuzz, an effective configuration fuzzer for large-scale systems. Our core approach consists of (i) Multi-dimensional configuration generation strategy. ECFuzz first designs different mutation strategies according to different dependencies and selects multiple configuration parameters from the candidate configuration parameters to effectively generate configuration parameters; (ii) Unit-testing-oriented configuration validation strategy. ECFuzz introduces unit testing into configuration testing techniques to filter out configuration parameters that are unlikely to yield errors before executing system testing, and effectively validate generated configuration parameters. We have conducted extensive experiments in real-world large-scale systems including HCommon, HDFS, HBase, ZooKeeper and Alluxio. Our evaluation shows that ECFuzz is effective in finding configuration-induced crash bugs. Compared with the state-of-the-art configuration testing tools including ConfTest, ConfErr and ConfDiagDetector, ECFuzz finds 60.3--67 more unexpected failures when the same 1000 testcases are injected into the system with an increase of 1.87x--2.63x. Moreover, ECFuzz has exposed 14 previously unknown bugs, and 5 of them have been confirmed.

The rapid development of deep learning (DL) technology has made deep learning libraries such as Tensor Flow widely used in practice. However, the complexity of DL libraries inevitably leads to multiple vulnerabilities. Recently, research on DL library testing generally designs a variety of mutation operators to generate new models from the perspective of model mutation. However, we find these research efforts do not consider that different mutation operators have different vulnerability mining efficiencies, thus treating all mutation operators equally can lead to inefficiency. Based on the above observation, we design a novel mutation operator scheduling strategy to improve the efficiency of vulnerability mining in the DL library, including the multi-staged mutation operator selection strategy and mutation operator energy allocation strategy. To evaluate the efficiency of our work, we implement a prototype called MMOS. The results show that MMOS finds six more crash bugs, two more NaN bugs and one more inconsistency bug in four widely used DL libraries including TensorFlow, Theano, CNTK and MXNet compared with the random strategy. Among them, MMOS finds 5 previously unknown vulnerabilities in MXNet and 1 in CNTK. Moreover, MMOS outperforms LEMON in vulnerability mining of DL libraries. In total, MMOS finds 13 more vulnerabilities than LEMON.

Greybox fuzzing has been widely used in stateless programs and has achieved great success. However, most stateof- the-art greybox fuzzers have slow speed and shallow state depth coverage in fuzzing stateful network protocol programs, which are able to remember and store the details of interactions. The existing greybox fuzzers for network protocol programs first send a series of well-defined prefix sequences of input messages and then send mutated messages to test the target state of a stateful network protocol. This process leads to a high time cost. In this paper, we propose SNPSFuzzer, a fast greybox fuzzer for stateful network protocols using snapshots. SNPSFuzzer dumps the context information when the network protocol program is in a specific state and restores it when the state needs to be fuzzed. Furthermore, we design a message chain analysis algorithm to explore more and deeper network protocol states. Our evaluation shows that compared with the state-of-the-art network protocol greybox fuzzer AFLNET, SNPSFuzzer improves the message processing speed of network protocol fuzzing by 70.7% and increases the path coverage by 20.9% on average within 24 hours. Moreover, SNPSFuzzer exposes a previously unreported vulnerability in the program Tinydtls.