Nowadays automated dynamic analysis frameworks for continuous testing are in high demand to ensure software safety and satisfy the security development lifecycle (SDL) requirements. The security bug hunting efficiency of cutting-edge hybrid fuzzing techniques outperforms widely utilized coverage-guided fuzzing. We propose an enhanced dynamic analysis pipeline to leverage productivity of automated bug detection based on hybrid fuzzing. We implement the proposed pipeline in the continuous fuzzing toolset Sydr-Fuzz which is powered by hybrid fuzzing orchestrator, integrating our DSE tool Sydr with libFuzzer and AFL++. Sydr-Fuzz also incorporates security predicate checkers, crash triaging tool Casr, and utilities for corpus minimization and coverage gathering. The benchmarking of our hybrid fuzzer against alternative state-of-the-art solutions demonstrates its superiority over coverage-guided fuzzers while remaining on the same level with advanced hybrid fuzzers. Furthermore, we approve the relevance of our approach by discovering 85 new real-world software flaws within the OSS-Sydr-Fuzz project. Finally, we open Casr source code to the community to facilitate examination of the existing crashes.

翻译：如今，为确保软件安全并满足安全开发生命周期（SDL）要求，用于持续测试的自动化动态分析框架需求旺盛。前沿混合模糊测试技术的安全缺陷挖掘效率优于广泛使用的覆盖引导型模糊测试。我们提出了一种增强型动态分析流水线，以提升基于混合模糊测试的自动化缺陷检测效能。该流水线通过持续模糊测试工具集Sydr-Fuzz实现，其核心是集成我们的符号执行工具Sydr与libFuzzer及AFL++的混合模糊测试编排器。此外，Sydr-Fuzz还集成了安全谓词检查器、崩溃分类工具Casr，以及语料库精简和覆盖率收集工具。通过与当前其他先进方案的基准对比，我们的混合模糊测试器在性能上优于覆盖引导型模糊测试器，并与高级混合模糊测试工具保持同等水平。此外，我们在OSS-Sydr-Fuzz项目中发现了85个真实世界软件漏洞，验证了本方法的实效性。最后，我们向社区开源Casr代码，以促进现有崩溃问题的分析研究。