基于Thompson采样的自适应灰盒模糊测试
Adaptive Grey-Box Fuzz-Testing with Thompson Sampling
摘要：
模糊测试或“模糊”是指广泛部署的一类技术，用于通过生成一组输入来测试程序，以明确地找到错误和识别安全缺陷。灰盒模糊是最流行的模糊检测策略，它结合了轻量级程序插装和数据驱动过程来生成新的程序输入。在这项工作中，我们提出了一个机器学习的方法，建立在AFL，卓越的灰箱模糊，通过自适应学习概率分布在其变异算子的程序特定的基础上。这些操作员，这是随机选择均匀的AFL和突变模糊一般，决定如何产生新的输入，模糊的功效的核心部分。我们的主要贡献是两方面的：首先，我们表明，从训练计划中估计的突变算子的采样分布可以显着提高AFL的性能。其次，我们介绍了一个汤普森采样，基于带宽的优化方法，微调的mutator分布自适应，在模糊的过程中，一个单独的程序。一组跨复杂程序的实验表明，调整突变运算符分布生成的输入集产生显着更高的代码覆盖率，并发现更多的崩溃更快，更可靠的AFL的基线版本以及其他基于AFL的学习方法。
英文摘要：
Fuzz testing, or "fuzzing," refers to a widely deployed class of techniques for testing programs by generating a set of inputs for the express purpose of finding bugs and identifying security flaws. Grey-box fuzzing, the most popular fuzzing strategy, combines light program instrumentation with a data driven process to generate new program inputs. In this work, we present a machine learning approach that builds on AFL, the preeminent grey-box fuzzer, by adaptively learning a probability distribution over its mutation operators on a program-specific basis. These operators, which are selected uniformly at random in AFL and mutational fuzzers in general, dictate how new inputs are generated, a core part of the fuzzer's efficacy. Our main contributions are two-fold: First, we show that a sampling distribution over mutation operators estimated from training programs can significantly improve performance of AFL. Second, we introduce a Thompson Sampling, bandit-based optimization approach that fine-tunes the mutator distribution adaptively, during the course of fuzzing an individual program. A set of experiments across complex programs demonstrates that tuning the mutational operator distribution generates sets of inputs that yield significantly higher code coverage and finds more crashes faster and more reliably than both baseline versions of AFL as well as other AFL-based learning approaches.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
