用编译期分析和机器学习筛选漏洞高发代码段，提速模糊测试。
FuzzDistill: Intelligent Fuzzing Target Selection using Compile-Time Analysis and Machine Learning
- 基于函数调用图、循环和内存操作等编译信息识别高危区域。
- 在真实软件上实验，测试时间显著减少。
- 适合需要高效漏洞挖掘的开发与安全团队。
模糊测试是发现软件漏洞的基础技术，但面对大型代码库时耗时且资源消耗大。本文提出FuzzDistill，通过分析编译期信息（如函数调用图特征、循环结构、内存操作）结合机器学习，精准识别更可能含漏洞的代码区域，从而优化模糊测试目标。在真实软件上的实验表明，该方法可大幅缩短测试时间。
原文摘要 · Abstract (English)
Fuzz testing is a fundamental technique employed to identify vulnerabilities within software systems. However, the process can be protracted and resource-intensive, especially when confronted with extensive codebases. In this work, I present FuzzDistill, an approach that harnesses compile-time data and machine learning to refine fuzzing targets. By analyzing compile-time information, such as function call graphs' features, loop information, and memory operations, FuzzDistill identifies high-priority areas of the codebase that are more probable to contain vulnerabilities. I demonstrate the efficacy of my approach through experiments conducted on real-world software, demonstrating substantial reductions in testing time.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。