DeepGo用AI预测路径,让模糊测试更快找到目标代码。
DeepGo: Predictive Directed Greybox Fuzzing
- 用神经网络预测未执行路径的奖励,弥补传统方法缺乏前瞻性的不足。
- 结合历史数据与预测结果,通过强化学习生成最优执行路径序列。
- 提出动作组机制,优化关键步骤,提升到达目标路径的效率。
当前最先进的定向灰盒模糊测试(DGF)技术通过优化适应度度量来精确快速地到达目标代码位置。然而,这些优化主要依赖启发式算法,通常基于历史执行信息,缺乏对尚未执行路径的前瞻性判断,导致复杂约束下的难执行路径阻碍DGF达到目标,降低效率。本文提出DeepGo,一种结合历史与预测信息的预测性定向灰盒模糊测试框架。我们首先构建路径转移模型,将DGF视为通过特定路径转移序列抵达目标的过程;新种子的变异会引发路径转移,高奖励路径转移序列意味着更可能通向目标。为预测未执行路径转移及其奖励,我们利用深度神经网络构建虚拟集成环境(VEE),逐步模仿路径转移模型并预测未发生路径的奖励。为确定最优路径,我们设计了用于模糊测试的强化学习模型(RLF),生成具有最高序列奖励的路径转移序列,并制定指导变异策略的策略。最后,为高效执行高奖励路径转移序列,我们引入动作组概念,全面优化模糊测试中的关键步骤,实现高效抵达目标。
原文摘要 · Abstract (English)
The state-of-the-art DGF techniques redefine and optimize the fitness metric to reach the target sites precisely and quickly. However, optimizations for fitness metrics are mainly based on heuristic algorithms, which usually rely on historical execution information and lack foresight on paths that have not been exercised yet. Thus, those hard-to-execute paths with complex constraints would hinder DGF from reaching the targets, making DGF less efficient. In this paper, we propose DeepGo, a predictive directed grey-box fuzzer that can combine historical and predicted information to steer DGF to reach the target site via an optimal path. We first propose the path transition model, which models DGF as a process of reaching the target site through specific path transition sequences. The new seed generated by mutation would cause the path transition, and the path corresponding to the high-reward path transition sequence indicates a high likelihood of reaching the target site through it. Then, to predict the path transitions and the corresponding rewards, we use deep neural networks to construct a Virtual Ensemble Environment (VEE), which gradually imitates the path transition model and predicts the rewards of path transitions that have not been taken yet. To determine the optimal path, we develop a Reinforcement Learning for Fuzzing (RLF) model to generate the transition sequences with the highest sequence rewards. The RLF model can combine historical and predicted path transitions to generate the optimal path transition sequences, along with the policy to guide the mutation strategy of fuzzing. Finally, to exercise the high-reward path transition sequence, we propose the concept of an action group, which comprehensively optimizes the critical steps of fuzzing to realize the optimal path to reach the target efficiently.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。