neuzz: efficient fuzzing with neural program smoothingneuzz: efficient fuzzing with neural program...
TRANSCRIPT
![Page 1: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/1.jpg)
NEUZZ:EfficientFuzzingwithNeuralProgramSmoothing
DongdongShe,KexinPei,DaveEpstein,JunfengYang,BaishakhiRay,andSumanJanaColumbiaUniversity
1
![Page 2: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/2.jpg)
Fuzzing:apopularwaytouncoverbugs
2
[Liang et al. 2019]
![Page 3: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/3.jpg)
EvolutionaryFuzzing
3
Advantage:easytoimplementDisadvantage:inefficient
• Randommutationsarenoteffective• Oftengetstuckinlongsequenceof
wastefulmutations
Mutation
Hardtofindscalableandadaptiveheuristicsforguidedmutation
Seed
Children
Grandchildren
![Page 4: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/4.jpg)
Anewapproachtofuzzing
4
![Page 5: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/5.jpg)
Fuzzing:AnOptimizationProblem
5
aprograminput#ofbugsfoundbyinputgenerateKinputsfrominputspace
Maximize
isdiscreteandhardtooptimize
FindC(X)thatcanmaximizetotalno.ofbugs
F (x)C(X) X
x x
x
!
x∈C(X)
F (x)
∈X
F (x)
![Page 6: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/6.jpg)
6
Fuzzing:AnOptimizationProblem
:#ofbugs
Input
Hardtofindinputslikeandamongflatplateaus
F (x)
xx1 x2
x1 x2
![Page 7: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/7.jpg)
Fuzzing:AnOptimizationProblem
7
aprograminputedgecoverageofinput
generateKinputsfrominputspace
Maximize
FindC(X)thatcanmaximizetotalnumberofedges
C(X) X
x x
x
∈X
G(x)
!
x∈C(X)
G(x)
![Page 8: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/8.jpg)
Input
8
Fuzzing:AnOptimizationProblem
:#ofedges
x
G(x)
![Page 9: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/9.jpg)
Input
9
Evolutionaryoptimization
x
1
2
3
4
5
Randommutationisnotefficient
:#ofedgesG(x)
![Page 10: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/10.jpg)
Input
10
Gradient-guidedOptimization
:#ofedges
x
SmoothApproximation+Gradient-guidedMutation
G(x)H(x):smoothapproximationofG(x)
![Page 11: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/11.jpg)
:smoothapproximationof
Input
11
Gradient-guidedOptimization
x
SmoothApproximation+Gradient-guidedMutation
H(x) G(x)
1
2
3
4 5
![Page 12: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/12.jpg)
SmoothApproximation
Problem:HowtosmoothlyapproximateG(x)?
NeuzzSolution:UseaNNtolearnasmoothH(x)
UniversalApproximationTheorem:ANNcanapproximateanycontinuousfunction
12
![Page 13: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/13.jpg)
Gradient-guidedMutation
13
Whygradientguidance?Gradientindicatescriticalpartsofinput
Whatarecriticalpartsoftheinput?Criticalpartsofinputaffectprogrambranches
Howgradient-guidedmutationworks?Focusmutationsonthecriticalpartsoftheinput
![Page 14: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/14.jpg)
MainIdeabehindNeuzz
14
Input Branching Behaviors
Program
NN
Gradient-guided mutation Smooth
Surrogate
Input Branching Behaviors
![Page 15: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/15.jpg)
APeekIntoNNModel
15
![Page 16: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/16.jpg)
GeneralizationtoUnseenbranches
Observations:- Realworldprograminputshavecriticalparts- MostofbranchesareaffectedbythecriticalpartsNeuzzSolution:- Identifycriticalpartsbasedonobservedbranches- Performmoremutationsonthecriticalpartof
inputstoexploreunseenbranches
16
![Page 17: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/17.jpg)
DesignofNEUZZ
17
![Page 18: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/18.jpg)
Evaluation
Ø 10realworldprogramsØ Lava-MandDARPACGCdatasetsØ ComparisonwithRNN-basedfuzzersØ Performanceofdifferentmodelchoices
18
![Page 19: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/19.jpg)
Evaluations:EdgeCoverageNEUZZvs.state-of-the-artfuzzers 10realworldapplicationsfor24hours
NEUZZachievesonaverage3xmoreedgecoveragethanotherfuzzers
19
![Page 20: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/20.jpg)
Evaluations:BugFindingNEUZZvs.state-of-the-artfuzzers
NEUZZfindsthemostnumberofbugsandall5bugtypesincludingtwo
newCVEs
20
![Page 21: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/21.jpg)
Evaluations:Lava-MandCGC
21
NEUZZoutperformsstate-of-the-artfuzzersonLAVA-MandCGC
Lava-Mdataset DARPACGCdataset
![Page 22: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/22.jpg)
Evaluations:NEUZZvs.RNN-basedFuzzer
NEUZZachieves6xmoreedgecoverageand20xlesstrainingtime
22
![Page 23: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/23.jpg)
Evaluations:EffectofDifferentNNs
23
NEUZZachievesbestperformancewithNN+Incremetallearning
Edgecoveragefor1Mmutations
![Page 24: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/24.jpg)
KeyTakeawaysofNEUZZ
● UseNNgradientstoidentifythecriticallocationsofprograminputs
● Focusmutationsonthecriticallocations● Minimizeruntimeoverheadbyusingsimplefeed-forward
neuralnetworks● Retrainthenetworkincrementallytofindnewcritical
locations
24
![Page 25: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/25.jpg)
GithubRepo
NEUZZisavailableathttps://github.com/Dongdongshe/neuzz
25
![Page 26: NEUZZ: Efficient Fuzzing with Neural Program SmoothingNEUZZ: Efficient Fuzzing with Neural Program Smoothing Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, and](https://reader034.vdocuments.us/reader034/viewer/2022042521/5faf93ca85e1ee782a715735/html5/thumbnails/26.jpg)
NEUZZ:EfficientFuzzingwithNeuralProgramSmoothing
DongdongShe,KexinPei,DaveEpstein,JunfengYang,BaishakhiRay,andSumanJanaColumbiaUniversity
26