网络与信息安全学报2024，Vol.10Issue(6)：37-58,22.DOI:10.11959/j.issn.2096-109x.2024079
基于分布散度的自适应模糊测试优化方法
Self-adaptive fuzzing optimization method based on distribution divergence
摘要
Abstract
To improve the performance of coverage-guided fuzzing,a method for self-adaptive optimization of fuzz-ing using distribution divergence and a deep reinforcement learning model was proposed.An interprocedural com-parison flow graph was first constructed based on the interprocedural control flow graph to characterize the spatial random field corresponding to the branch condition variables of the program under test,and the distribution fea-tures of the random field generated by a fuzzing mutation strategy were extracted using the Monte Carlo method.Then,a deep graph convolutional neural network was constructed to extract the feature embeddings of the interpro-cedural comparison flow graph,and this neural network was used as the deep Q-network for deep reinforcement learning.Finally,an online deep reinforcement learning model was established based on the dual deep Q-network model,and an intelligent agent was trained to optimize the fuzzing mutation strategy.This deep reinforcement learning model defined its state using the random field distribution features corresponding to the seed file and the associated blocks.The selection for the focused mutation block of a seed file was defined as an action,and the dis-tribution divergence of the approximate distributions of the random fields before and after the action was defined as the reward.A prototype was implemented for this fuzzing optimization method,and multiple rounds of up to 24 hours of evaluation were carried out on this prototype.The experimental results show that on the benchmark Fuzz-Bench,the code coverage speed and overall coverage achieved by the prototype are significantly better than those of the baseline fuzzer AFL++and HavocMAB,and better results are achieved on most benchmarks compared to CmpLog.On the benchmark Magma,stronger vulnerability triggering capability is demonstrated by the prototype on the benchmarks openssl,libxml,and sqlite3.关键词
模糊测试/深度强化学习/分布散度/分支判断变量Key words
fuzzing/deep reinforcement learning/distribution divergence/branch condition variables分类
信息技术与安全科学引用本文复制引用
许航,计江安,马哲宇,张超..基于分布散度的自适应模糊测试优化方法[J].网络与信息安全学报,2024,10(6):37-58,22.基金项目
国家重点研发计划(2021YFB2701000) The National Key Research and Development Program of China(2021YFB2701000) （2021YFB2701000）
