用注意力机制优化JS引擎模糊测试的突变位置选择
Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzing
- 基于注意力机制的组合强化学习，动态选择代码突变位置
- 相比现有方法，有效测试用例提升20.3%，每用例覆盖率增8.9%
- 适合安全研究者和漏洞挖掘人员使用，尤其在复杂场景下表现优
JavaScript 引擎广泛应用于浏览器、PDF 阅读器和服务器端应用。随着对其安全性的关注上升，已出现多种定向模糊测试技术。但现有方法采用随机方式决定代码突变位置。我们提出 CLUTCH，一种新型深度组合赌博机，可处理可变长度的 JavaScript 测试用例表示，利用深度学习中的注意力机制。同时，通过 Concrete Dropout 实现探索策略的动态自适应。实验表明，相比三种先进方案，CLUTCH 在平均上使有效测试用例数量提升 20.3%，每用例覆盖率提高 8.9%。在动态和组合场景下，其表现优于现有最优赌博机，分别实现至少 78.1% 和 4.1% 的更少遗憾（regret）。
原文摘要 · Abstract (English)
JavaScript engines are widely used in web browsers, PDF readers, and server-side applications. The rise in concern over their security has led to the development of several targeted fuzzing techniques. However, existing approaches use random selection to determine where to perform mutations in JavaScript code. We postulate that the problem of selecting better mutation targets is suitable for combinatorial bandits with a volatile number of arms. Thus, we propose CLUTCH, a novel deep combinatorial bandit that can observe variable length JavaScript test case representations, using an attention mechanism from deep learning. Furthermore, using Concrete Dropout, CLUTCH can dynamically adapt its exploration. We show that CLUTCH increases efficiency in JavaScript fuzzing compared to three state-of-the-art solutions by increasing the number of valid test cases and coverage-per-testcase by, respectively, 20.3% and 8.9% on average. In volatile and combinatorial settings we show that CLUTCH outperforms state-of-the-art bandits, achieving at least 78.1% and 4.1% less regret in volatile and combinatorial settings, respectively.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。