像（多臂）老虎机一样成功：利用 T-Scheduler 提高模糊测试种子调度的胜算
Make out like a (Multi-Armed) Bandit: Improving the Odds of Fuzzer Seed Scheduling with T-Scheduler
AI总结：
针对模糊测试种子选择难题，提出基于多臂老虎机、无需超参数调优的 T-Scheduler；经 35 CPU-年实验证明其漏洞发现与覆盖率扩展优于 11 种现有调度器。
摘要：
模糊测试是一种高度可扩展的软件测试技术，通过使用变异输入执行目标程序来发现其中的漏洞。在整个模糊测试活动期间，模糊器会积累能够引发新的、有趣目标行为的输入，并从这些输入中选取对象进行进一步变异。这很快导致可供选择的输入数量庞大，使得快速而准确地选择“最有前景”的输入进行变异变得具有挑战性。强化学习（RL）为这一“种子调度”问题提供了一种自然的解决方案：模糊器通过从过去的结果中学习，动态调整其选择策略。然而，现有的 RL 方法存在以下问题：（a）计算开销大（降低模糊测试吞吐量），和/或（b）需要超参数调优（降低跨目标和输入类型的通用性）。为此，我们提出 T-Scheduler，这是一种基于多臂老虎机理论构建的种子调度器，无需任何超参数调优即可自动适应目标。我们在总计 35 CPU-年的模糊测试上评估 T-Scheduler，并将其与 11 种最先进的调度器进行比较。结果表明，T-Scheduler 在漏洞发现和覆盖率扩展能力两方面均优于这 11 种调度器。
英文摘要：
Fuzzing is a highly-scalable software testing technique that uncovers bugs in a target program by executing it with mutated inputs. Over the life of a fuzzing campaign, the fuzzer accumulates inputs inducing new and interesting target behaviors, drawing from these inputs for further mutation. This rapidly results in a large number of inputs to select from, making it challenging to quickly and accurately select the "most promising" input for mutation. Reinforcement learning (RL) provides a natural solution to this "seed scheduling" problem: the fuzzer dynamically adapts its selection strategy by learning from past results. However, existing RL approaches are (a) computationally expensive (reducing fuzzer throughput) and/or (b) require hyperparameter tuning (reducing generality across targets and input types). To this end, we propose T-Scheduler, a seed scheduler built on multi-armed bandit theory that automatically adapts to the target without any hyperparameter tuning. We evaluate T-Scheduler over 35 CPU-yr of fuzzing, comparing it to 11 state-of-the-art schedulers. Our results show that T-Scheduler improves on these 11 schedulers on both bug-finding and coverage-expansion abilities.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
