· 2017
Learn&Fuzz: Machine learning for input fuzzing
- 320citations
- 2017year
Short summary
Learn&Fuzz automates input grammar generation for fuzzing using machine learning, successfully applied to Microsoft Edge's PDF parser.
AI-generated from the title and abstract; the full text is not read.
Key points
- Automates input grammar generation for fuzzing using machine learning.
- Successfully applied to a complex input format (PDF) and a security-critical parser (Microsoft Edge's PDF parser).
- Introduces a guided fuzzing algorithm that uses learned input probability distributions.
- Addresses the conflict between learning well-formed input structure and fuzzing's goal of breaking it.
AI-generated from the title and abstract; the full text is not read.
Abstract
Fuzzing consists of repeatedly testing an application with modified, or fuzzed, inputs with the goal of finding security vulnerabilities in input-parsing code. In this paper, we show how to automate the generation of an input grammar suitable for input fuzzing using sample inputs and neural-network-based statistical machine-learning techniques. We present a detailed case study with a complex input format, namely PDF, and a large complex security-critical parser for this format, namely, the PDF parser embedded in Microsoft's new Edge browser. We discuss and measure the tension between conflicting learning and fuzzing goals: learning wants to capture the structure of well-formed inputs, while fuzzing wants to break that structure in order to cover unexpected code paths and find bugs. We also present a new algorithm for this learn&fuzz challenge which uses a learnt input probability distribution to intelligently guide where to fuzz inputs.
The authors' abstract, as published at the source., 2017 · DOI ↗
Continue with a free account
Ask the paper: 3 free questions a day about this paper; save it, get its citation, new summaries every day for your field. Takeaways are Premium.
Continue free on the webSign in with Google or Apple; no card needed. You come back to this paper.
On your phone:
Field: Software
SoftwareComputer Science