LLM-based fuzz driver generation
As software complexity continues to escalate, traditional fuzzing methodologies encounter limitations in efficiently discovering vulnerabilities, underscoring the need for innovative approaches. This thesis investigates the innovative integration of Large Language Models (LLMs) into the process of f...
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Final Year Project (FYP) |
| Language: | English |
| Published: |
Nanyang Technological University
2024
|
| Subjects: | |
| Online Access: | https://hdl.handle.net/10356/175404 |
| _version_ | 1826129123257352192 |
|---|---|
| author | Chai, Wen Xuan |
| author2 | Liu Yang |
| author_facet | Liu Yang Chai, Wen Xuan |
| author_sort | Chai, Wen Xuan |
| collection | NTU |
| description | As software complexity continues to escalate, traditional fuzzing methodologies encounter limitations in efficiently discovering vulnerabilities, underscoring the need for innovative approaches. This thesis investigates the innovative integration of Large Language Models (LLMs) into the process of fuzz driver generation, aiming to enhance the efficiency and effectiveness of fuzz testing in software development. Fuzz testing, a critical technique in identifying vulnerabilities within software applications, traditionally requires extensive manual effort to generate fuzz drivers capable of automating the discovery of bugs and security flaws. The advent of LLMs, exemplified by models such as GPT-3 and GPT-4, offers a promising avenue to automate and optimize this process. Through a comprehensive exploration, this research delves into the potential of LLMs to revolutionize fuzz driver generation, thereby significantly improving software testing methodologies.
The study begins with an in-depth analysis of the current state of fuzzing practices and the role of LLMs in code generation, laying the groundwork for understanding the significance of integrating these advanced models into fuzz testing. It then progresses to a systematic examination of LLM-based fuzz driver generation, including the formulation of methodologies, evaluation of existing tools, and analysis of the generated drivers’ effectiveness compared to traditional methods. Challenges inherent in leveraging LLMs for this purpose are also critically assessed, with a focus on model specificity, evaluation metrics, and the integration with existing fuzzing frameworks. Empirical findings from this research indicate that LLMs can substantially increase code
coverage and identify vulnerabilities more efficiently, albeit with notable challenges in accuracy and relevance of the generated code. The thesis concludes with a discussion on future directions, highlighting the need for advancements in LLM technologies, methodological innovations, and the potential for LLMs to redefine software security practices. This research contributes to the field by bridging theoretical AI advancements with practical applications in software testing, offering insights into the future of automated and efficient fuzz testing methodologies. |
| first_indexed | 2024-10-01T07:35:35Z |
| format | Final Year Project (FYP) |
| id | ntu-10356/175404 |
| institution | Nanyang Technological University |
| language | English |
| last_indexed | 2024-10-01T07:35:35Z |
| publishDate | 2024 |
| publisher | Nanyang Technological University |
| record_format | dspace |
| spelling | ntu-10356/1754042024-04-26T15:45:13Z LLM-based fuzz driver generation Chai, Wen Xuan Liu Yang School of Computer Science and Engineering yangliu@ntu.edu.sg Computer and Information Science Security As software complexity continues to escalate, traditional fuzzing methodologies encounter limitations in efficiently discovering vulnerabilities, underscoring the need for innovative approaches. This thesis investigates the innovative integration of Large Language Models (LLMs) into the process of fuzz driver generation, aiming to enhance the efficiency and effectiveness of fuzz testing in software development. Fuzz testing, a critical technique in identifying vulnerabilities within software applications, traditionally requires extensive manual effort to generate fuzz drivers capable of automating the discovery of bugs and security flaws. The advent of LLMs, exemplified by models such as GPT-3 and GPT-4, offers a promising avenue to automate and optimize this process. Through a comprehensive exploration, this research delves into the potential of LLMs to revolutionize fuzz driver generation, thereby significantly improving software testing methodologies. The study begins with an in-depth analysis of the current state of fuzzing practices and the role of LLMs in code generation, laying the groundwork for understanding the significance of integrating these advanced models into fuzz testing. It then progresses to a systematic examination of LLM-based fuzz driver generation, including the formulation of methodologies, evaluation of existing tools, and analysis of the generated drivers’ effectiveness compared to traditional methods. Challenges inherent in leveraging LLMs for this purpose are also critically assessed, with a focus on model specificity, evaluation metrics, and the integration with existing fuzzing frameworks. Empirical findings from this research indicate that LLMs can substantially increase code coverage and identify vulnerabilities more efficiently, albeit with notable challenges in accuracy and relevance of the generated code. The thesis concludes with a discussion on future directions, highlighting the need for advancements in LLM technologies, methodological innovations, and the potential for LLMs to redefine software security practices. This research contributes to the field by bridging theoretical AI advancements with practical applications in software testing, offering insights into the future of automated and efficient fuzz testing methodologies. Bachelor's degree 2024-04-24T01:53:03Z 2024-04-24T01:53:03Z 2024 Final Year Project (FYP) Chai, W. X. (2024). LLM-based fuzz driver generation. Final Year Project (FYP), Nanyang Technological University, Singapore. https://hdl.handle.net/10356/175404 https://hdl.handle.net/10356/175404 en SCSE23-0667 application/pdf Nanyang Technological University |
| spellingShingle | Computer and Information Science Security Chai, Wen Xuan LLM-based fuzz driver generation |
| title | LLM-based fuzz driver generation |
| title_full | LLM-based fuzz driver generation |
| title_fullStr | LLM-based fuzz driver generation |
| title_full_unstemmed | LLM-based fuzz driver generation |
| title_short | LLM-based fuzz driver generation |
| title_sort | llm based fuzz driver generation |
| topic | Computer and Information Science Security |
| url | https://hdl.handle.net/10356/175404 |
| work_keys_str_mv | AT chaiwenxuan llmbasedfuzzdrivergeneration |