NeuFuzz: Efficient Fuzzing With Deep Neural Network
Coverage-guided graybox fuzzing is one of the most popular and effective techniques for discovering vulnerabilities due to its nature of high speed and scalability. However, the existing techniques generally focus on code coverage but not on vulnerable code. These techniques aim to cover as many pat...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2019-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8672949/ |
| _version_ | 1819170322565300224 |
|---|---|
| author | Yunchao Wang Zehui Wu Qiang Wei Qingxian Wang |
| author_facet | Yunchao Wang Zehui Wu Qiang Wei Qingxian Wang |
| author_sort | Yunchao Wang |
| collection | DOAJ |
| description | Coverage-guided graybox fuzzing is one of the most popular and effective techniques for discovering vulnerabilities due to its nature of high speed and scalability. However, the existing techniques generally focus on code coverage but not on vulnerable code. These techniques aim to cover as many paths as possible rather than to explore paths that are more likely to be vulnerable. When selecting the seeds to test, the existing fuzzers usually treat all seed inputs equally, ignoring the fact that paths exercised by different seed inputs are not equally vulnerable. This results in wasting time testing uninteresting paths rather than vulnerable paths, thus reducing the efficiency of vulnerability detection. In this paper, we present a solution, NeuFuzz, using the deep neural network to guide intelligent seed selection during graybox fuzzing to alleviate the aforementioned limitation. In particular, the deep neural network is used to learn the hidden vulnerability pattern from a large number of vulnerable and clean program paths to train a prediction model to classify whether paths are vulnerable. The fuzzer then prioritizes seed inputs that are capable of covering the likely to be vulnerable paths and assigns more mutation energy (i.e., the number of inputs to be generated) to these seeds. We implemented a prototype of NeuFuzz based on an existing fuzzer PTfuzz and evaluated it on two different test suites: LAVA-M and nine real-world applications. The experimental results showed that NeuFuzz can find more vulnerabilities than the existing fuzzers in less time. We have found 28 new security bugs in these applications, 21 of which have been assigned as CVE IDs. |
| first_indexed | 2024-12-22T19:33:33Z |
| format | Article |
| id | doaj.art-89c977dbbca04adf8455d83959499e7e |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-22T19:33:33Z |
| publishDate | 2019-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-89c977dbbca04adf8455d83959499e7e2022-12-21T18:15:02ZengIEEEIEEE Access2169-35362019-01-017363403635210.1109/ACCESS.2019.29032918672949NeuFuzz: Efficient Fuzzing With Deep Neural NetworkYunchao Wang0https://orcid.org/0000-0003-0457-0900Zehui Wu1Qiang Wei2Qingxian Wang3China National Digital Switching System Engineering and Technological Research Center, Zhengzhou, ChinaChina National Digital Switching System Engineering and Technological Research Center, Zhengzhou, ChinaChina National Digital Switching System Engineering and Technological Research Center, Zhengzhou, ChinaChina National Digital Switching System Engineering and Technological Research Center, Zhengzhou, ChinaCoverage-guided graybox fuzzing is one of the most popular and effective techniques for discovering vulnerabilities due to its nature of high speed and scalability. However, the existing techniques generally focus on code coverage but not on vulnerable code. These techniques aim to cover as many paths as possible rather than to explore paths that are more likely to be vulnerable. When selecting the seeds to test, the existing fuzzers usually treat all seed inputs equally, ignoring the fact that paths exercised by different seed inputs are not equally vulnerable. This results in wasting time testing uninteresting paths rather than vulnerable paths, thus reducing the efficiency of vulnerability detection. In this paper, we present a solution, NeuFuzz, using the deep neural network to guide intelligent seed selection during graybox fuzzing to alleviate the aforementioned limitation. In particular, the deep neural network is used to learn the hidden vulnerability pattern from a large number of vulnerable and clean program paths to train a prediction model to classify whether paths are vulnerable. The fuzzer then prioritizes seed inputs that are capable of covering the likely to be vulnerable paths and assigns more mutation energy (i.e., the number of inputs to be generated) to these seeds. We implemented a prototype of NeuFuzz based on an existing fuzzer PTfuzz and evaluated it on two different test suites: LAVA-M and nine real-world applications. The experimental results showed that NeuFuzz can find more vulnerabilities than the existing fuzzers in less time. We have found 28 new security bugs in these applications, 21 of which have been assigned as CVE IDs.https://ieeexplore.ieee.org/document/8672949/Fuzzingvulnerability detectiondeep neural networkseed selectionsoftware security |
| spellingShingle | Yunchao Wang Zehui Wu Qiang Wei Qingxian Wang NeuFuzz: Efficient Fuzzing With Deep Neural Network IEEE Access Fuzzing vulnerability detection deep neural network seed selection software security |
| title | NeuFuzz: Efficient Fuzzing With Deep Neural Network |
| title_full | NeuFuzz: Efficient Fuzzing With Deep Neural Network |
| title_fullStr | NeuFuzz: Efficient Fuzzing With Deep Neural Network |
| title_full_unstemmed | NeuFuzz: Efficient Fuzzing With Deep Neural Network |
| title_short | NeuFuzz: Efficient Fuzzing With Deep Neural Network |
| title_sort | neufuzz efficient fuzzing with deep neural network |
| topic | Fuzzing vulnerability detection deep neural network seed selection software security |
| url | https://ieeexplore.ieee.org/document/8672949/ |
| work_keys_str_mv | AT yunchaowang neufuzzefficientfuzzingwithdeepneuralnetwork AT zehuiwu neufuzzefficientfuzzingwithdeepneuralnetwork AT qiangwei neufuzzefficientfuzzingwithdeepneuralnetwork AT qingxianwang neufuzzefficientfuzzingwithdeepneuralnetwork |