用大模型自动生成测试代码，让闭源库也能高效漏洞检测。
LibLMFuzz: LLM-Augmented Fuzz Target Generation for Black-box Libraries
- 大模型驱动自动分析二进制文件并生成可运行测试程序。
- 对558个接口生成正确驱动，首次执行成功率75.52%。
- 无需人工干预，适合安全研究者快速测试闭源库。
网络安全与计算机科学中的核心问题是判断程序是否无缺陷。模糊测试是发现程序漏洞的常用方法，虽具优势但需投入大量初始设置与持续维护成本。尤其在仅提供二进制库（如闭源软件）时，该问题更复杂。为此，我们提出LibLMFuzz框架，通过将代理型大语言模型（LLM）与轻量级工具链（反汇编器/编译器/模糊测试器）结合，实现对无符号二进制文件的自主分析、策略规划、驱动生成及构建或运行错误的迭代自修复。在四个广泛使用的Linux库上测试，成功为全部558个可模糊测试的API函数生成语法正确的驱动，实现100%接口覆盖率，且无须人工干预。1601个合成驱动中，75.52%在首次执行时即正常工作。结果表明，大模型增强的中间件有望显著降低闭源组件模糊测试的成本，并为后续研究奠定基础。未来可探索分支覆盖率提升。
原文摘要 · Abstract (English)
A fundamental problem in cybersecurity and computer science is determining whether a program is free of bugs and vulnerabilities. Fuzzing, a popular approach to discovering vulnerabilities in programs, has several advantages over alternative strategies, although it has investment costs in the form of initial setup and continuous maintenance. The choice of fuzzing is further complicated when only a binary library is available, such as the case of closed-source and proprietary software. In response, we introduce LibLMFuzz, a framework that reduces costs associated with fuzzing closed-source libraries by pairing an agentic Large Language Model (LLM) with a lightweight tool-chain (disassembler/compiler/fuzzer) to autonomously analyze stripped binaries, plan fuzz strategies, generate drivers, and iteratively self-repair build or runtime errors. Tested on four widely-used Linux libraries, LibLMFuzz produced syntactically correct drivers for all 558 fuzz-able API functions, achieving 100% API coverage with no human intervention. Across the 1601 synthesized drivers, 75.52% were nominally correct on first execution. The results show that LLM-augmented middleware holds promise in reducing the costs of fuzzing black box components and provides a foundation for future research efforts. Future opportunities exist for research in branch coverage.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。