Adaptive Grey-Box Fuzz-Testing with Thompson Sampling

摘要: Fuzz testing, or "fuzzing," refers to a widely deployed class of techniques for testing programs by generating set inputs the express purpose finding bugs and identifying security flaws. Grey-box fuzzing, most popular fuzzing strategy, combines light program instrumentation with data driven process generate new inputs. In this work, we present machine learning approach that builds on AFL, preeminent grey-box fuzzer, adaptively probability distribution over its mutation operators program-specific basis. These operators, which are selected uniformly at random in AFL mutational fuzzers general, dictate how generated, core part fuzzer's efficacy. Our main contributions two-fold: First, show sampling estimated from training can significantly improve performance AFL. Second, introduce Thompson Sampling, bandit-based optimization fine-tunes mutator adaptively, during course an individual outperforms offline training. A experiments across complex demonstrates tuning operator generates sets yield higher code coverage finds more crashes faster reliably than both baseline versions as well other AFL-based approaches.