NEUZZ：基于神经程序平滑的高效模糊算法
NEUZZ: Efficient Fuzzing with Neural Program Smoothing
摘要：
Fuzzing已经成为查找软件漏洞的事实上的标准技术。然而，即使是最先进的模糊器在发现难以触发的软件错误方面也不是很有效。大多数流行的模糊器使用进化指导来生成可以触发不同错误的输入。这样的进化算法，虽然快速和简单的实现，往往陷入徒劳的随机突变序列。服从引导的优化提出了一个有前途的替代进化的指导。在解决诸如机器学习等领域的高维结构化优化问题时，通过有效地利用底层函数的梯度或高阶导数，被动引导技术已被证明显著优于进化算法。然而，梯度引导的方法并不直接适用于模糊，因为现实世界的程序行为包含许多不连续性，高原和脊，基于梯度的方法往往卡住。我们观察到，这个问题可以通过创建一个光滑的代理函数近似的离散分支行为的目标程序来解决。在本文中，我们提出了一种新的程序平滑技术，使用代理神经网络模型，可以逐步学习光滑的近似一个复杂的，现实世界的程序的分支行为。我们进一步证明，这种神经网络模型可以与梯度引导的输入生成方案一起使用，以显着提高模糊效率。我们广泛的评估表明，NEUZZ显着优于10个国家的最先进的灰盒模糊10个真实世界的程序，无论是在寻找新的错误，并实现更高的边缘覆盖率。NEUZZ在10个真实世界的程序中发现了其他模糊器未能发现的31个未知错误，并在24小时运行中实现了比所有测试的灰盒模糊器多3倍的边缘覆盖率。
英文摘要：
Fuzzing has become the de facto standard technique for finding software vulnerabilities. However, even state-of-the-art fuzzers are not very efficient at finding hard-to-trigger software bugs. Most popular fuzzers use evolutionary guidance to generate inputs that can trigger different bugs. Such evolutionary algorithms, while fast and simple to implement, often get stuck in fruitless sequences of random mutations. Gradient-guided optimization presents a promising alternative to evolutionary guidance. Gradient-guided techniques have been shown to significantly outperform evolutionary algorithms at solving high-dimensional structured optimization problems in domains like machine learning by efficiently utilizing gradients or higher-order derivatives of the underlying function. However, gradient-guided approaches are not directly applicable to fuzzing as real-world program behaviors contain many discontinuities, plateaus, and ridges where the gradient-based methods often get stuck. We observe that this problem can be addressed by creating a smooth surrogate function approximating the discrete branching behavior of target program. In this paper, we propose a novel program smoothing technique using surrogate neural network models that can incrementally learn smooth approximations of a complex, real-world program's branching behaviors. We further demonstrate that such neural network models can be used together with gradient-guided input generation schemes to significantly improve the fuzzing efficiency. Our extensive evaluations demonstrate that NEUZZ significantly outperforms 10 state-of-the-art graybox fuzzers on 10 real-world programs both at finding new bugs and achieving higher edge coverage. NEUZZ found 31 unknown bugs that other fuzzers failed to find in 10 real world programs and achieved 3X more edge coverage than all of the tested graybox fuzzers for 24 hours running.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
