用历史漏洞数据自动识别高风险输入，提升JavaScript引擎模糊测试效率。
From Coverage to Causes: Data-Centric Fuzzing for JavaScript Engines
- 基于历史漏洞训练模型，自动提取代码和运行时特征。
- 精度超85%，误报率低于1%，仅需25%特征达相近效果。
- 适合安全研究者与自动化漏洞挖掘工具开发者使用。
现代JavaScript引擎的全面模糊测试因程序状态和执行路径数量庞大而不可行。现有覆盖率引导的模糊测试会浪费资源在低风险输入上，常忽略不增加覆盖但能触发漏洞的输入。已有启发式方法依赖专家经验，脆弱且难适应。本文提出一种数据驱动、大模型辅助的新方法，通过学习历史V8漏洞，自动识别最小化的静态（代码）与动态（运行时）特征，以检测高风险输入。基于历史漏洞迭代提示生成115个静态特征和49个动态特征，后者仅需5个追踪标志，显著降低仪器开销。经特征筛选后保留41个特征，训练XGBoost模型用于模糊测试中预测高风险输入。结果表明，结合静态与动态特征可实现超过85%的精度和不足1%的误报率；仅需25%的特征即可达到相当性能，说明大部分搜索空间无关紧要。本工作引入特征引导模糊测试，一种自动化数据驱动方法，以数据导向推理替代传统覆盖率，引导模糊测试快速定位高风险状态，实现更高效、精准、可复现的漏洞发现。为支持开放科学，所有脚本与数据已公开于https://github.com/KKGanguly/DataCentricFuzzJS。
原文摘要 · Abstract (English)
Context: Exhaustive fuzzing of modern JavaScript engines is infeasible due to the vast number of program states and execution paths. Coverage-guided fuzzers waste effort on low-risk inputs, often ignoring vulnerability-triggering ones that do not increase coverage. Existing heuristics proposed to mitigate this require expert effort, are brittle, and hard to adapt. Objective: We propose a data-centric, LLM-boosted alternative that learns from historical vulnerabilities to automatically identify minimal static (code) and dynamic (runtime) features for detecting high-risk inputs. Method: Guided by historical V8 bugs, iterative prompting generated 115 static and 49 dynamic features, with the latter requiring only five trace flags, minimizing instrumentation cost. After feature selection, 41 features remained to train an XGBoost model to predict high-risk inputs during fuzzing. Results: Combining static and dynamic features yields over 85% precision and under 1% false alarms. Only 25% of these features are needed for comparable performance, showing that most of the search space is irrelevant. Conclusion: This work introduces feature-guided fuzzing, an automated data-driven approach that replaces coverage with data-directed inference, guiding fuzzers toward high-risk states for faster, targeted, and reproducible vulnerability discovery. To support open science, all scripts and data are available at https://github.com/KKGanguly/DataCentricFuzzJS .
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。