Alessandro Mantovani's research while affiliated with EURECOM and other places

Publications (11)

Article
This report describes the artifacts of the “Dissecting American Fuzzy Lop – A FuzzBench Evaluation” paper. The artifacts are available online at https://github.com/eurecom-s3/dissecting_afl and archived at https://doi.org/10.6084/m9.figshare.21401280 and consists in the produced code, the setup to run the experiments in FuzzBench and the generated...
Article
AFL is one of the most used and extended fuzzer, adopted by industry and academic researchers alike. While the community agrees on AFL’s effectiveness at discovering new vulnerabilities and at its outstanding usability, many of its internal design choices remain untested to date. Security practitioners often clone the project “as-is” and use it as...
Preprint
Full-text available
AFL is one of the most used and extended fuzzer, adopted by industry and academic researchers alike. While the community agrees on AFL's effectiveness at discovering new vulnerabilities and at its outstanding usability, many of its internal design choices remain untested to date. Security practitioners often clone the project "as-is" and use it as...
Article
Full-text available
Recent advances in fuzz testing have introduced several forms of feedback mechanisms, motivated by the fact that for a large range of programs and libraries, edge-coverage alone is insufficient to reveal complicated bugs. Inspired by this line of research, we examined existing program representations looking for a match between expressiveness of th...
Preprint
Full-text available
AFL is one of the most used and extended fuzzing projects, adopted by industry and academic researchers alike. While the community agrees on AFL's effectiveness at discovering new vulnerabilities and at its outstanding usability, many of its internal design choices remain untested to date. Security practitioners often clone the project "as-is" and...
Conference Paper
Full-text available
An open research problem on malware analysis is how to statically distinguish between packed and non-packed executables. This has an impact on antivirus software and malware analysis systems, which may need to apply different heuristics or to resort to more costly code emulation solutions to deal with the presence of potential packing routines. It...

Citations

... That is, once a program element is saturated, there is little extra information available [31]. Many fuzzers [4,32,3], include intelligence to craft inputs (e.g., calling an API with invalid values) which, while important, is invisible if using coverage for fuzzer comparison. ...
... To avoid missing sensitive behaviors, we set a timer of 10 min for each execution. Although most samples exhibit evasive behaviors within the first 2 min [33], complex samples may perform more checks and behaviors. Additionally, it is worth noting that DBI and callbacks may incur overhead. ...
... Particularly, entropy features are based on the entropy computation of the file or some of its areas. Bearing in mind that benign files tend to have low entropy values, whereas obfuscated or packed files tend to have high entropy values [23]. ...