Learn&Fuzz：用于输入模糊化的机器学习
Learn&Fuzz: Machine Learning for Input Fuzzing
摘要：
Fuzzing包括使用修改的或模糊的输入反复测试应用程序，目的是找到输入解析代码中的安全漏洞。在本文中，我们将展示如何自动生成一个输入语法适合使用样本输入和基于神经网络的统计机器学习技术的输入模糊。我们提出了一个详细的案例研究与复杂的输入格式，即PDF，和一个大型复杂的安全关键的解析器，这种格式，即嵌入在微软的新边缘浏览器的PDF解析器。我们讨论（和测量）冲突的学习和模糊目标之间的紧张关系：学习想要捕获格式良好的输入的结构，而模糊想要打破这种结构，以覆盖意外的代码路径和发现错误。我们还提出了一种新的算法，这种学习和模糊的挑战，它使用一个学习的输入概率分布，智能地指导在哪里模糊输入。
英文摘要：
Fuzzing consists of repeatedly testing an application with modified, or fuzzed, inputs with the goal of finding security vulnerabilities in input-parsing code. In this paper, we show how to automate the generation of an input grammar suitable for input fuzzing using sample inputs and neural-network-based statistical machine-learning techniques. We present a detailed case study with a complex input format, namely PDF, and a large complex security-critical parser for this format, namely, the PDF parser embedded in Microsoft's new Edge browser. We discuss (and measure) the tension between conflicting learning and fuzzing goals: learning wants to capture the structure of well-formed inputs, while fuzzing wants to break that structure in order to cover unexpected code paths and find bugs. We also present a new algorithm for this learn&fuzz challenge which uses a learnt input probability distribution to intelligently guide where to fuzz inputs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
