Faster Fuzzing: Reinitialization with Deep Neural Models

Abstract

We improve the performance of the American Fuzzy Lop (AFL) fuzz testing framework by using Generative Adversarial Network (GAN) models to reinitialize the system with novel seed files. We assess performance based on the temporal rate at which we produce novel and unseen code paths. We compare this approach to seed file generation from a random draw of bytes observed in the training seed files. The code path lengths and variations were not sufficiently diverse to fully replace AFL input generation. However, augmenting native AFL with these additional code paths demonstrated improvements over AFL alone. Specifically, experiments showed the GAN was faster and more effective than the LSTM and out-performed a random augmentation strategy, as measured by the number of unique code paths discovered. GAN helps AFL discover 14.23% more code paths than the random strategy in the same amount of CPU time, finds 6.16% more unique code paths, and finds paths that are on average 13.84% longer. Using GAN shows promise as a reinitialization strategy for AFL to help the fuzzer exercise deep paths in software.

References in corpus (3)

• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Playing Atari with Deep Reinforcement Learning
• Learn&Fuzz: Machine Learning for Input Fuzzing

Cited by in corpus (7)

• A systematic review of fuzzing based on machine learning techniques
• SmartSeed: Smart Seed Generation for Efficient Fuzzing
• V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing
• DARWIN: Survival of the Fittest Fuzzing Mutators
• Neutaint: Efficient Dynamic Taint Analysis with Neural Networks
• Qualitative Analysis for Validating IEC 62443-4-2 Requirements in DevSecOps
• NEUZZ: Efficient Fuzzing with Neural Program Smoothing