NEUZZ: Efficient Fuzzing with Neural Program Smoothing

Abstract

Fuzzing has become the de facto standard technique for finding software vulnerabilities. However, even state-of-the-art fuzzers are not very efficient at finding hard-to-trigger software bugs. Most popular fuzzers use evolutionary guidance to generate inputs that can trigger different bugs. Such evolutionary algorithms, while fast and simple to implement, often get stuck in fruitless sequences of random mutations. Gradient-guided optimization presents a promising alternative to evolutionary guidance. Gradient-guided techniques have been shown to significantly outperform evolutionary algorithms at solving high-dimensional structured optimization problems in domains like machine learning by efficiently utilizing gradients or higher-order derivatives of the underlying function. However, gradient-guided approaches are not directly applicable to fuzzing as real-world program behaviors contain many discontinuities, plateaus, and ridges where the gradient-based methods often get stuck. We observe that this problem can be addressed by creating a smooth surrogate function approximating the discrete branching behavior of target program. In this paper, we propose a novel program smoothing technique using surrogate neural network models that can incrementally learn smooth approximations of a complex, real-world program's branching behaviors. We further demonstrate that such neural network models can be used together with gradient-guided input generation schemes to significantly improve the fuzzing efficiency. Our extensive evaluations demonstrate that NEUZZ significantly outperforms 10 state-of-the-art graybox fuzzers on 10 real-world programs both at finding new bugs and achieving higher edge coverage. NEUZZ found 31 unknown bugs that other fuzzers failed to find in 10 real world programs and achieved 3X more edge coverage than all of the tested graybox fuzzers for 24 hours running.

arXiv commentTo appear in the 40th IEEE Symposium on Security and Privacy, May 20--22, 2019, San Francisco, CA, USA

References in corpus (9)

• Overcoming catastrophic forgetting in neural networks
• Understanding Neural Networks Through Deep Visualization
• PathNet: Evolution Channels Gradient Descent in Super Neural Networks
• Neural Programmer-Interpreters
• SlowFuzz: Automated Domain-Independent Detection of Algorithmic Complexity Vulnerabilities
• Neurogenesis Deep Learning
• Not all bytes are equal: Neural byte sieve for fuzzing
• Faster Fuzzing: Reinitialization with Deep Neural Models
• Neuro-Symbolic Execution: The Feasibility of an Inductive Approach to Symbolic Execution

Cited by in corpus (3)

• A Review of Machine Learning Applications in Fuzzing
• Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities
• A Generative Neural Network Framework for Automated Software Testing