High-performance directional fuzzing scheme based on deep reinforcement learning

Tian XIAO; Zhihao JIANG; Peng TANG; Zheng HUANG; Jie GUO; Weidong QIU

doi:10.11959/j.issn.2096-109x.2023027

您当前的位置：

首页 >

文章列表页 >

High-performance directional fuzzing scheme based on deep reinforcement learning

Papers | 更新时间：2024-06-03

- High-performance directional fuzzing scheme based on deep reinforcement learning
- Chinese Journal of Network and Information Security Vol. 9, Issue 2, Pages: 132-142(2023)
- 作者机构：
  
  1. 上海交通大学网络空间安全学院，上海 200240
  2. 哥伦比亚大学，美国纽约 10027
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023027
  CLC： TP393
- Online First：2023-04，
  
  Published：25 April 2023
- 稿件说明：
移动端阅览
Tian XIAO, Zhihao JIANG, Peng TANG, et al. High-performance directional fuzzing scheme based on deep reinforcement learning[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 132-142.
DOI：

Tian XIAO, Zhihao JIANG, Peng TANG, et al. High-performance directional fuzzing scheme based on deep reinforcement learning[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 132-142. DOI： 10.11959/j.issn.2096-109x.2023027.

摘要

随着移动互联网与信息技术的快速发展，越来越多的应用程序融入人们的生活，但这些应用程序中存在的漏洞严重威胁着用户隐私和信息安全。近年来，模糊测试作为流行的漏洞挖掘技术之一，因其漏洞易复现且误报率低的特点而被广泛地使用。它能随机生成测试用例并执行程序，通过覆盖率或样本生成方面的优化以检测更深的程序路径。但是模糊测试中的变异操作存在一定的盲目性，易使生成的测试样本执行相同程序路径。因此传统模糊测试普遍存在挖掘效率低、输入构造的随机性强、算法对程序结构针对性有限等问题。针对上述问题，提出了基于深度强化学习的高性能导向性模糊测试方案，通过程序插桩等方法获取程序运行时的信息，使用深度强化学习网络指导模糊测试选择测试样本，生成有针对性和导向性的测试样本以快速逼近并检验可能存在漏洞的程序路径，从而提高模糊测试的效率。实验表明，在LAVA-M测试集与真实应用程序LibPNG和Binutils上，所提方案比流行模糊测试工具AFL与AFLGO在漏洞检测与复现等方面有着更好的表现，因此该方案可为今后的漏洞挖掘和安全研究提供支撑。

Abstract

With the continuous growth and advancement of the Internet and information technology

continuous growth and advancement of the Internet and information technology.Nevertheless

these applications’ vulnerabilities pose a severe threat to information security and users’ privacy.Fuzzing was widely used as one of the main tools for automatic vulnerability detection due to its ease of vulnerability recurrence and low false positive errors.It generates test cases randomly and executes the application by optimization in terms of coverage or sample generation to detect deeper program paths.However

the mutation operation in fuzzing is blind and tends to make the generated test cases execute the same program path.Consequently

traditional fuzzing tests have problems such as low efficiency

high randomness of inputs generation and limited pertinence of the program structure.To address these problems

a directional fuzzing based on deep reinforcement learning was proposed

which used deep reinforcement learning networks with information obtained by staking program to guide the selection of the inputs.Besides

it enabled fast approximation and inspection of the program paths that may exist vulnerabilities.The experimental results showed that the proposed approach had better performance than the popular fuzzing tools such as AFL and AFLGO in terms of vulnerability detection and recurrence on the LAVA-M dataset and real applications like LibPNG and Binutils.Therefore

the approach can provide support for further vulnerability mining and security research.

关键词

Keywords

references

Cybersecurity ＆ Infrastructure Security Agency . known exploited vulnerabilities catalog [R ] . 2023 .

REDSCAN . 2021 has officially been a record-breaking year for vulnerabilities [R ] . 2021 .

张雄 , 李舟军 . 模糊测试技术研究综述 [J ] . 计算机科学 , 2016 , 43 ( 5 ): 1 - 8 , 26 .

ZHANG X , LI Z J . Survey of fuzz testing technology [J ] . Computer Science , 2016 , 43 ( 5 ): 1 - 8 , 26 .

邹燕燕 , 邹维 , 尹嘉伟 , 等 . 变异策略感知的并行模糊测试研究 [J ] . 信息安全学报 , 2020 , 5 ( 5 ): 1 - 16 .

ZOU Y Y , ZOU W , YIN J W , et al . Research on mutator strategy-aware parallel fuzzing [J ] . Journal of Cyber Security , 2020 , 5 ( 5 ): 1 - 16 .

FIORALDI A , MAIER D , EIßFELDT H , et al . AFL++ combining incremental steps of fuzzing research [C ] // Proceedings of the 14th USENIX Conference on Offensive Technologies . 2020 :10.

GAN S T , ZHANG C , QIN X J , et al . CollAFL:path sensitive fuzzing [C ] // Proceedings of 2018 IEEE Symposium on Security and Privacy (SP) . 2018 : 679 - 696 .

YOU W , ZONG P Y , CHEN K , et al . SemFuzz:semantics-based automatic generation of proof-of-concept exploits [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2139 - 2154 .

ARULKUMARAN K , DEISENROTH M P , BRUNDAGE M , et al . Deep reinforcement learning:a brief survey [J ] . IEEE Signal Processing Magazine , 2017 , 34 ( 6 ): 26 - 38 .

BOEHME M , CADAR C , ROYCHOUDHURY A . Fuzzing:challenges and reflections [J ] . IEEE Software , 2020 , 38 ( 3 ): 79 - 86 .

HERRERA A , GUNADI H , HAYES L , et al . Corpus distillation for effective fuzzing:a comparative evaluation [J ] . arXiv preprint arXiv:1905.13055 , 2019 .

DONG H , DING Z H , ZHANG S H . Deep reinforcement learning:fundamentals,research and applications [M ] . Singapore : Springer Singapore , 2020 .

BÖHME M , PHAM V T , NGUYEN M D , et al . Directed greybox fuzzing [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2329 - 2344 .

MARINESCU P D , CADAR C . KATCH:high-coverage testing of software patches [C ] // Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering . 2013 : 235 - 245 .

JIN W , ORSO A . BugRedux:reproducing field failures for in-house debugging [C ] // Proceedings of 2012 34th International Conference on Software Engineering (ICSE) . 2012 : 474 - 484 .

CHEN H X , XUE Y X , LI Y K , et al . Hawkeye:towards a desired directed grey-box fuzzer [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . 2018 : 2095 - 2108 .

ZONG P Y , LYU T , WANG D W , et al . FuzzGuard:filtering out unreachable inputs in directed grey-box fuzzing through deep learning [C ] // Proceedings of the 29th USENIX Conference on Security Symposium . 2020 : 2255 - 2269 .

ZHU X , LIU S , LI X , et al . DeFuzz:deep learning guided directed fuzzing [J ] . arXiv Preprint arXiv:2010.12149 , 2020 .

SUTTON R S , BARTO A G . Reinforcement learning:an introduction [M ] . Cambridge,Mass : MIT Press , 1998 .

CHAUHAN N , CHOUDHARY N , GEORGE K . A comparison of reinforcement learning based approaches to appliance scheduling [C ] // Proceedings of 2016 2nd International Conference on Contemporary Computing and Informatics (IC3I) . 2017 : 253 - 258 .

ZHAO T T , KONG L , HAN Y J , et al . Review of model-based reinforcement learning [J ] . Journal of Frontiers of Computer Science and Technology , 2020 , 14 ( 6 ): 918 - 927 .

MNIH V , KAVUKCUOGLU K , SILVER D , et al . Playing atari with deep reinforcement learning. [C ] // Proceedings of Workshops at the 26th Neural Information Processing Systems 2013 . 2013 : 201 - 220 .

MNIH V , KAVUKCUOGLU K , SILVER D , et al . Human-level control through deep reinforcement learning [J ] . Nature , 2015 , 518 ( 7540 ): 529 - 533 .

SILVER D , HUANG A , MADDISON C J , et al . Mastering the game of Go with deep neural networks and tree search [J ] . Nature , 2016 , 529 ( 7587 ): 484 - 489 .

KRÖSE B J A . Learning from delayed rewards [J ] . Robotics and Autonomous Systems , 1995 , 15 ( 4 ): 233 - 235 .

LIN L J . Reinforcement learning for robots using neural networks [D ] . Pittsburgh,Carnegie Mellon University , 1992 .

LATTNER C , ADVE V . LLVM:a compilation framework for lifelong program analysis ＆ transformation [C ] // Proceedings of International Symposium on Code Generation and Optimization . 2004 : 75 - 86 .

PESCH R H , OSIER J M . The GNU binary utilities [J ] . Free Software Foundation , 1993 .

DOLAN-GAVITT B , HULIN P , KIRDA E , et al . LAVA:large-scale automated vulnerability addition [C ] // Proceedings of 2016 IEEE Symposium on Security and Privacy (SP) . 2016 : 110 - 121 .

METZMAN J , SZEKERES L , SIMON L , et al . Fuzzbench:an open fuzzer benchmarking platform and service [C ] // Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering . 2021 : 1393 - 1403 .

Views

538

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

VxFuzzer: Grey-Box fuzzing for VxWorks based on whole system simulation

Membership inference attack based on imitation learning for deep reinforcement learning

Self-adaptive fuzzing optimization method based on distribution divergence

Adversarial method for malicious ELF file detection based on deep reinforcement learning

Related Author

CAO Yan

PENG Jianshan

JIA Yan

MA Rongkuan

GENG Yangyang

LI Songtao

ZHENG Haibin

QU Kangyun

Related Institution

School of Cyber Science and Engineering, Zhengzhou University

Information Engineering University

College of Cryptology and Cyber Science, Nankai University

Key Laboratory of Cybersecurity, Ministry of Education of China

Institute of Cyberspace Security, Zhejiang University of Technology

⁰