基于深度强化学习的高性能导向性模糊测试方案

肖天; 江智昊; 唐鹏; 黄征; 郭捷; 邱卫东

doi:10.11959/j.issn.2096-109x.2023027

您当前的位置：

首页 >

文章列表页 >

基于深度强化学习的高性能导向性模糊测试方案

学术论文 | 更新时间：2024-06-03

- 基于深度强化学习的高性能导向性模糊测试方案
- High-performance directional fuzzing scheme based on deep reinforcement learning
- 网络与信息安全学报 2023年9卷第2期页码：132-142
- 作者机构：
  
  1. 上海交通大学网络空间安全学院，上海 200240
  2. 哥伦比亚大学，美国纽约 10027
- 作者简介：
  
  [ "肖天（1998- ），男，江苏常州人，上海交通大学硕士生，主要研究方向为漏洞挖掘、隐私保护" ]
  [ "江智昊（1998- ），男，上海人，主要研究方向为文件系统、漏洞挖掘、分布式系统" ]
  [ "唐鹏（1992- ），男，江西抚州人，上海交通大学博士生，主要研究方向为人工智能安全、隐私保护" ]
  [ "黄征（1975- ），男，四川南充人，博士，上海交通大学副教授，主要研究方向为隐私保护、计算机视觉、人工智能安全" ]
  [ "郭捷（1976- ），女，河南信阳人，博士，上海交通大学副研究员，主要研究方向为多媒体安全、模式识别、大数据分析" ]
  [ "邱卫东（1973- ），男，江西九江人，博士，上海交通大学教授、博士生导师，主要研究方向为密码分析/密码工程、人工智能安全、大数据隐私保护" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61972249)
- DOI：10.11959/j.issn.2096-109x.2023027
  中图分类号： TP393
- 网络首发：2023-04，
  
  纸质出版：2023-04-25
- 稿件说明：
移动端阅览
肖天, 江智昊, 唐鹏, 等. 基于深度强化学习的高性能导向性模糊测试方案[J]. 网络与信息安全学报, 2023,9(2):132-142.

Tian XIAO, Zhihao JIANG, Peng TANG, et al. High-performance directional fuzzing scheme based on deep reinforcement learning[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 132-142.
肖天, 江智昊, 唐鹏, 等. 基于深度强化学习的高性能导向性模糊测试方案[J]. 网络与信息安全学报, 2023,9(2):132-142. DOI： 10.11959/j.issn.2096-109x.2023027.

Tian XIAO, Zhihao JIANG, Peng TANG, et al. High-performance directional fuzzing scheme based on deep reinforcement learning[J]. Chinese Journal of Network and Information Security, 2023, 9(2): 132-142. DOI： 10.11959/j.issn.2096-109x.2023027.

摘要

随着移动互联网与信息技术的快速发展，越来越多的应用程序融入人们的生活，但这些应用程序中存在的漏洞严重威胁着用户隐私和信息安全。近年来，模糊测试作为流行的漏洞挖掘技术之一，因其漏洞易复现且误报率低的特点而被广泛地使用。它能随机生成测试用例并执行程序，通过覆盖率或样本生成方面的优化以检测更深的程序路径。但是模糊测试中的变异操作存在一定的盲目性，易使生成的测试样本执行相同程序路径。因此传统模糊测试普遍存在挖掘效率低、输入构造的随机性强、算法对程序结构针对性有限等问题。针对上述问题，提出了基于深度强化学习的高性能导向性模糊测试方案，通过程序插桩等方法获取程序运行时的信息，使用深度强化学习网络指导模糊测试选择测试样本，生成有针对性和导向性的测试样本以快速逼近并检验可能存在漏洞的程序路径，从而提高模糊测试的效率。实验表明，在LAVA-M测试集与真实应用程序LibPNG和Binutils上，所提方案比流行模糊测试工具AFL与AFLGO在漏洞检测与复现等方面有着更好的表现，因此该方案可为今后的漏洞挖掘和安全研究提供支撑。

Abstract

With the continuous growth and advancement of the Internet and information technology

continuous growth and advancement of the Internet and information technology.Nevertheless

these applications’ vulnerabilities pose a severe threat to information security and users’ privacy.Fuzzing was widely used as one of the main tools for automatic vulnerability detection due to its ease of vulnerability recurrence and low false positive errors.It generates test cases randomly and executes the application by optimization in terms of coverage or sample generation to detect deeper program paths.However

the mutation operation in fuzzing is blind and tends to make the generated test cases execute the same program path.Consequently

traditional fuzzing tests have problems such as low efficiency

high randomness of inputs generation and limited pertinence of the program structure.To address these problems

a directional fuzzing based on deep reinforcement learning was proposed

which used deep reinforcement learning networks with information obtained by staking program to guide the selection of the inputs.Besides

it enabled fast approximation and inspection of the program paths that may exist vulnerabilities.The experimental results showed that the proposed approach had better performance than the popular fuzzing tools such as AFL and AFLGO in terms of vulnerability detection and recurrence on the LAVA-M dataset and real applications like LibPNG and Binutils.Therefore

the approach can provide support for further vulnerability mining and security research.

关键词

Keywords

references

Cybersecurity ＆ Infrastructure Security Agency . known exploited vulnerabilities catalog [R ] . 2023 .

REDSCAN . 2021 has officially been a record-breaking year for vulnerabilities [R ] . 2021 .

张雄 , 李舟军 . 模糊测试技术研究综述 [J ] . 计算机科学 , 2016 , 43 ( 5 ): 1 - 8 , 26 .

ZHANG X , LI Z J . Survey of fuzz testing technology [J ] . Computer Science , 2016 , 43 ( 5 ): 1 - 8 , 26 .

邹燕燕 , 邹维 , 尹嘉伟 , 等 . 变异策略感知的并行模糊测试研究 [J ] . 信息安全学报 , 2020 , 5 ( 5 ): 1 - 16 .

ZOU Y Y , ZOU W , YIN J W , et al . Research on mutator strategy-aware parallel fuzzing [J ] . Journal of Cyber Security , 2020 , 5 ( 5 ): 1 - 16 .

FIORALDI A , MAIER D , EIßFELDT H , et al . AFL++ combining incremental steps of fuzzing research [C ] // Proceedings of the 14th USENIX Conference on Offensive Technologies . 2020 :10.

GAN S T , ZHANG C , QIN X J , et al . CollAFL:path sensitive fuzzing [C ] // Proceedings of 2018 IEEE Symposium on Security and Privacy (SP) . 2018 : 679 - 696 .

YOU W , ZONG P Y , CHEN K , et al . SemFuzz:semantics-based automatic generation of proof-of-concept exploits [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2139 - 2154 .

ARULKUMARAN K , DEISENROTH M P , BRUNDAGE M , et al . Deep reinforcement learning:a brief survey [J ] . IEEE Signal Processing Magazine , 2017 , 34 ( 6 ): 26 - 38 .

BOEHME M , CADAR C , ROYCHOUDHURY A . Fuzzing:challenges and reflections [J ] . IEEE Software , 2020 , 38 ( 3 ): 79 - 86 .

HERRERA A , GUNADI H , HAYES L , et al . Corpus distillation for effective fuzzing:a comparative evaluation [J ] . arXiv preprint arXiv:1905.13055 , 2019 .

DONG H , DING Z H , ZHANG S H . Deep reinforcement learning:fundamentals,research and applications [M ] . Singapore : Springer Singapore , 2020 .

BÖHME M , PHAM V T , NGUYEN M D , et al . Directed greybox fuzzing [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . 2017 : 2329 - 2344 .

MARINESCU P D , CADAR C . KATCH:high-coverage testing of software patches [C ] // Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering . 2013 : 235 - 245 .

JIN W , ORSO A . BugRedux:reproducing field failures for in-house debugging [C ] // Proceedings of 2012 34th International Conference on Software Engineering (ICSE) . 2012 : 474 - 484 .

CHEN H X , XUE Y X , LI Y K , et al . Hawkeye:towards a desired directed grey-box fuzzer [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . 2018 : 2095 - 2108 .

ZONG P Y , LYU T , WANG D W , et al . FuzzGuard:filtering out unreachable inputs in directed grey-box fuzzing through deep learning [C ] // Proceedings of the 29th USENIX Conference on Security Symposium . 2020 : 2255 - 2269 .

ZHU X , LIU S , LI X , et al . DeFuzz:deep learning guided directed fuzzing [J ] . arXiv Preprint arXiv:2010.12149 , 2020 .

SUTTON R S , BARTO A G . Reinforcement learning:an introduction [M ] . Cambridge,Mass : MIT Press , 1998 .

CHAUHAN N , CHOUDHARY N , GEORGE K . A comparison of reinforcement learning based approaches to appliance scheduling [C ] // Proceedings of 2016 2nd International Conference on Contemporary Computing and Informatics (IC3I) . 2017 : 253 - 258 .

ZHAO T T , KONG L , HAN Y J , et al . Review of model-based reinforcement learning [J ] . Journal of Frontiers of Computer Science and Technology , 2020 , 14 ( 6 ): 918 - 927 .

MNIH V , KAVUKCUOGLU K , SILVER D , et al . Playing atari with deep reinforcement learning. [C ] // Proceedings of Workshops at the 26th Neural Information Processing Systems 2013 . 2013 : 201 - 220 .

MNIH V , KAVUKCUOGLU K , SILVER D , et al . Human-level control through deep reinforcement learning [J ] . Nature , 2015 , 518 ( 7540 ): 529 - 533 .

SILVER D , HUANG A , MADDISON C J , et al . Mastering the game of Go with deep neural networks and tree search [J ] . Nature , 2016 , 529 ( 7587 ): 484 - 489 .

KRÖSE B J A . Learning from delayed rewards [J ] . Robotics and Autonomous Systems , 1995 , 15 ( 4 ): 233 - 235 .

LIN L J . Reinforcement learning for robots using neural networks [D ] . Pittsburgh,Carnegie Mellon University , 1992 .

LATTNER C , ADVE V . LLVM:a compilation framework for lifelong program analysis ＆ transformation [C ] // Proceedings of International Symposium on Code Generation and Optimization . 2004 : 75 - 86 .

PESCH R H , OSIER J M . The GNU binary utilities [J ] . Free Software Foundation , 1993 .

DOLAN-GAVITT B , HULIN P , KIRDA E , et al . LAVA:large-scale automated vulnerability addition [C ] // Proceedings of 2016 IEEE Symposium on Security and Privacy (SP) . 2016 : 110 - 121 .

METZMAN J , SZEKERES L , SIMON L , et al . Fuzzbench:an open fuzzer benchmarking platform and service [C ] // Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering . 2021 : 1393 - 1403 .

浏览量

538

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

VxFuzzer：基于全系统模拟的VxWorks灰盒模糊测试器

基于模仿学习的深度强化学习训练数据推断攻击

基于分布散度的自适应模糊测试优化方法

基于深度强化学习的恶意ELF文件检测对抗方法