HarnessAgent：利用工具增强的LLM流水线实现自动模糊测试Harness构建的扩展
Understanding Gaps in LLM Pipelines Towards Scalable Fuzzing Harness Generation: An Empirical Study and Enhancement
AI总结：
HarnessAgent通过工具增强的LLM流水线实现全自动、可扩展的模糊测试Harness构建，提升生成成功率和代码检索效率。
摘要：
基于大型语言模型（LLM）的技术在生成程序模糊测试Harness方面取得了显著进展。然而，将其应用于任意函数（尤其是内部函数）大规模上仍面临挑战，因为需要复杂的上下文信息，如规范、依赖关系和使用示例。最先进的方法严重依赖静态或不完整的上下文提供，导致生成功能Harness失败。此外，LLM倾向于利用Harness验证指标，生成看似合理但逻辑上无用的代码。因此，跨大型和多样化的项目进行可靠的编译、稳健的代码检索和全面的验证仍然面临挑战。为了解决这些挑战，我们提出了HarnessAgent，一个工具增强的代理框架，实现了对数百个OSS-Fuzz目标的全自动、可扩展的Harness构建。HarnessAgent引入了三个关键创新：1）基于规则的策略来识别和最小化各种编译错误；2）混合工具池用于精确且稳健的符号源代码检索；3）增强的Harness验证流水线，用于检测假定义。我们评估HarnessAgent在OSS-Fuzz项目中的243个目标函数（65个C项目和178个C++项目）。与最先进的技术相比，它将三shot成功率提高了约20%，达到C项目87%和C++项目81%。我们一小时的模糊测试结果表明，HarnessAgent生成的Harness中有超过75%增加了目标函数的覆盖，超过基线10%以上。此外，HarnessAgent的混合工具池系统实现了超过90%的源代码检索响应率，比Fuzz Introspector高出30%以上。
英文摘要：
Large language model (LLM)-based techniques have achieved notable progress in fuzz harness generation. However, applying them to arbitrary functions \textit{at scale} remains difficult---generated harnesses often fail to compile or, worse, compile but remain logically ineffective. What factors drive success and what limitations hinder current methods remain unclear. To answer these questions, we conduct an empirical study on state-of-the-art LLM-based harness generation frameworks across 29 OSS-Fuzz projects. Our study establishes two pillars of success: contextual information to guide generation and pre-structured pipelines that ensure workflow stability. However, significant gaps remain: (1) existing context retrieval methods lack the robustness to reliably obtain necessary information across diverse projects; (2) current validation mechanisms fail to detect logically ineffective harnesses, such as those containing fabricated definitions; and (3) compilation workflows are brittle, unable to distinguish harness-level errors from build-configuration issues. We demonstrate the utility of these findings by enhancing existing techniques with a hybrid tool pool for robust context retrieval, an enhanced validation pipeline, and a compilation-error triage strategy. Evaluated on 243 OSS-Fuzz projects (65 C and 178 C++), the enhanced approach improves the three-shot success rate by approximately 20\% over state-of-the-art techniques, reaching 87\% for C and 81\% for C++. Our one-hour fuzzing results show that more than 75\% of the generated harnesses increase target-function coverage, surpassing baselines by over 10\%. In addition, the enhanced approach identified 15 new vulnerabilities across 11 real-world projects.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
