FuzzCoder：基于大语言模型的字节级模糊测试

摘要

模糊测试（Fuzzing）是一种重要的动态程序分析技术，旨在发现复杂软件中的漏洞。该技术通过向目标程序提供精心构造的恶意输入，以引发崩溃、缓冲区溢出、内存错误及异常。高效地构造此类恶意输入是一个尚未解决的难题，目前最佳方法通常是对已有有效输入进行均匀随机变异。在本研究中，我们提出采用微调后的大型语言模型（FuzzCoder），通过学习成功攻击案例中输入文件的模式，来指导未来的模糊测试探索。具体而言，我们开发了一个框架，利用代码大语言模型来引导模糊测试中的输入变异过程。这一变异过程被建模为序列到序列的生成任务，其中大语言模型接收一个字节序列，并输出变异后的字节序列。FuzzCoder在创建的指令数据集（Fuzz-Instruct）上进行了微调，该数据集收集了启发式模糊测试工具的成功测试历史。FuzzCoder能够预测输入文件中的变异位置及策略，以触发程序的异常行为。实验结果表明，基于AFL（American Fuzzy Lop）的FuzzCoder在多种输入格式（包括ELF、JPG、MP3和XML）上，在有效变异比例（EPM）和崩溃次数（NC）方面均取得了显著提升。

English

Fuzzing is an important dynamic program analysis technique designed for finding vulnerabilities in complex software. Fuzzing involves presenting a target program with crafted malicious input to cause crashes, buffer overflows, memory errors, and exceptions. Crafting malicious inputs in an efficient manner is a difficult open problem and the best approaches often apply uniform random mutations to pre-existing valid inputs. In this work, we propose to adopt fine-tuned large language models (FuzzCoder) to learn patterns in the input files from successful attacks to guide future fuzzing explorations. Specifically, we develop a framework to leverage the code LLMs to guide the mutation process of inputs in fuzzing. The mutation process is formulated as the sequence-to-sequence modeling, where LLM receives a sequence of bytes and then outputs the mutated byte sequence. FuzzCoder is fine-tuned on the created instruction dataset (Fuzz-Instruct), where the successful fuzzing history is collected from the heuristic fuzzing tool. FuzzCoder can predict mutation locations and strategies locations in input files to trigger abnormal behaviors of the program. Experimental results show that FuzzCoder based on AFL (American Fuzzy Lop) gain significant improvements in terms of effective proportion of mutation (EPM) and number of crashes (NC) for various input formats including ELF, JPG, MP3, and XML.

FuzzCoder：基于大语言模型的字节级模糊测试

FuzzCoder: Byte-level Fuzzing Test via Large Language Model

摘要

Support