Adaptive Grey-Box Fuzz-Testing with Thompson Sampling

Abstract

Fuzz testing, or "fuzzing, " refers to a widely deployed class of techniques for testing programs by generating a set of inputs for the express purpose of finding bugs and identifying security flaws. Grey-box fuzzing, the most popular fuzzing strategy, combines light program instrumentation with a data driven process to generate new program inputs. In this work, we present a machine learning approach that builds on AFL, the preeminent grey-box fuzzer, by adaptively learning a probability distribution over its mutation operators on a program-specific basis. These operators, which are selected uniformly at random in AFL and mutational fuzzers in general, dictate how new inputs are generated, a core part of the fuzzer's efficacy. Our main contributions are two-fold: First, we show that a sampling distribution over mutation operators estimated from training programs can significantly improve performance of AFL. Second, we introduce a Thompson Sampling, bandit-based optimization approach that fine-tunes the mutator distribution adaptively, during the course of fuzzing an individual program. A set of experiments across complex programs demonstrates that tuning the mutational operator distribution generates sets of inputs that yield significantly higher code coverage and finds more crashes faster and more reliably than both baseline versions of AFL as well as other AFL-based learning approaches.

A socio-economic multi-objective optimization approach toward enhancing public–private partnerships’ concession agreements in infrastructure development

“…In the GA, the selection of the Pareto fronts is made using an elitist GA, in which GA favors some individuals than others due to better results from the evaluated result from the GA. On the other hand, with the TS optimization algorithm, the best Pareto search is obtained by choosing some set of data points that gave the largest hypervolume indicator (the performance measure that is assigned a single value to the solutions obtained from the data points; (Trovo et al, 2020). The advantage of a GA over the TS algorithm is that it enhances faster optimization results; however, the TS algorithm obtained better results than the GA, which coincides with the findings of Karamcheti et al (2018).…”

SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing

“…Karamcheti et al integrated Thompson sampling into a random mutation in AFL, called havoc, and confirmed its effectiveness [35]. Although they modified only AFL, their mutation scheme is generally applicable to other fuzzers.…”

“…To meet this demand, online optimization algorithms, particularly bandit algorithms, have gained attention in recent years as a means of accelerating the efficiency of mutation-based fuzzing [35,43,[62][63][64][65][66][67]. They are expected to work with a minimum amount of information that can be retrieved in any environment as long as feedback-driven fuzzing can be used.…”

“…We experimentally show that a fuzzer achieves similar code coverage regardless of whether it follows the conventional scheme or our bandit-friendly scheme, which allows the modification of existing fuzzers so that they follow the bandit-friendly scheme. This mutation scheme resolves the dependency of existing methods on heuristics that were introduced to harness online optimization without changing the mutation scheme [35,40,64]. Although these heuristics work well in practice, it is also beneficial to adhere to vanilla optimization algorithms by changing the scheme itself; this enables us to take advantage of the theoretical guarantees and advancements in the well-researched field of optimization algorithms.…”

A systematic review of fuzzing based on machine learning techniques

“…The advantages of reinforcement learning and fuzzing are combined to achieve more in-depth coverage across multiple benchmarks by integrating OpenAI Gym with libFuzzer, and realize the learning of the mutation-selection strategy directly from input data. Karamcheti et al (Karamcheti et al 2018a) proposed a Thompson Sampling optimization method based on robbers, which can adaptively adjust the mutator distribution in the process of fuzzing a single program. It is determined which mutation operator should be selected by learning the impact of each mutation operator on code coverage.…”