FuzzGPT: 테스트 케이스 최적화를 위한 LLM 기반 프롬프트 엔지니어링 퍼징 기법
FuzzGPT: LLM Prompt Engineering-Based Fuzzing Technique for Test Case Optimization
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
소프트웨어 정의 서비스 (Software Defined Service) 환경이 전 산업으로 확대됨에 따라 소프트웨어의 취약점을 효율적으로 탐지할 수 있는 기술에 대한 수요가 증가하고 있다. 종래의 범용 무작위 퍼징 기법들은 탐지 성능과 커버리지가 우수하지만, 퍼징 대상 프로그램이 복잡할수록 의미 있는 테스트 케이스를 생성하기 어렵고 오버헤드가 증가하는 한계점이 있다. 따라서 본 논문에서는 LLM 모델을 대상으로 한 프롬프트 엔지니어링 기법을 활용하여 퍼징 대상 프로그램의 문맥과 구조를 파악하여 최적의 테스트 케이스를 생성하는 LLM 기반 프롬프트 엔지니어링 퍼징 기법을 제안한다. 실험 결과에 따르면 제안한 방법은 종래의 무작위 데이터를 사용한 무작위 퍼저 대비 크래시 탐지율을 48% 개선할 수 있었다.
Abstract
As the Software Defined Service(SDS) environment expands to all industries, the demand for technologies that can efficiently detect software vulnerabilities is increasing. Conventional general-purpose random fuzzing techniques have excellent detection performance and coverage, but they share a common limitation in that it is difficult to generate meaningful test cases, and the overhead increases as the complexity of the target program for fuzzing grows. Therefore, in this paper, we propose an LLM prompt engineering-based fuzzing technique that uses the LLM model to identify the context and structure of the target program for fuzzing and generates optimal test cases. Experimental results demonstrate that the proposed method enhances the crash detection rate by 48% compared to traditional random fuzzers utilizing random data.
참고문헌 (16)
- Kwang-Man Ko, "Deep Learning based Dynamic Taint Detection Technique for Binary Code Vulnerability Detection", Journal of Korea Institute of Information, Electronics, and Communication Technology (KIIECT), 16(3), pp.161~166 (2023)
- Seoksu Lee, "Binary Vulnerability Analysis Framework Combining Static and Dynamic Analyses", Journal of Korean Institute of Information Scientists and Engineers (KIISE), 45(12), pp.1217~1226 (2018)
- Sun-jin. Lee, "Study on Systematic Ransomware Detection Techniques", Proceedings of the 202123rd International Conference on Advanced Communication Technology (ICACT), pp.297~301 (2021)
- Hyun-suk Cho, "A Study on the Application Method of Fuzz Testing to Domestic WeaponSystems Considering the Software Development Life Cycle (SDLC)", Journal of The Korea Institute of Information Security &Cryptology, 31(2), pp.279~289 (2021)
- Marcel Boehme, "Fuzzing:Challenges and Reflections", IEEE Software, 38(3), pp.79~86 (2021)
- Xiaogang Zhu, "Fuzzing : A Survey for Roadmap", ACM Comput. Surv, 54(11s), pp.1~36 (2022)
- Na-Eun Park, "Testcase Selection Technique for Lightweight Fuzzing", Korea Information Processing Society Conference (ASK2024), pp.290~293 (2024)
- Rongqi Pan, "Test case selection and prioritization using machine learning: a systematic literature review", Empirical Software Engineering, 27(2), pp.29~ (2021)
- Xiajing Wang, "SYNTONY:Potential-aware fuzzing with particle swarm optimization", Journal of Systems and Software, 208, pp.111880~ (2024)
- Jeewoo Jung, "A Study of Machine Learning-Based Scheduling Strategy for Fuzzing", Journal of the Korea Institute of Information Security & Cryptology, 34(5), pp.973~980 (2024)
- Daehoon Ko, "LockPickFuzzer: Exploring Vulnerabilities in Android Lock Screen Mechanisms through ADB-Based Fuzzing", Journal of the Korea Institute of Information Security & Cryptology, 34(4), pp.651~666 (2024)
- Na-Hyun Kim, "Partial Fuzzing Technique for Lightweight Firmware Update of Internet of Thing", Korea Information Processing Society Conference (ASK2024), pp.181~182 (2024)
- Jeong Young Sang, "A Study on Dataset Generation Method for Korean Language Information Extraction from Generative Large Language Model and Prompt Engineering", The Transactions of the Korea Information Processing Society (KTSDE), 12(11), pp.481~492 (2023)
- Pengfei Liu, "Pre-train, Prompt, and Predict: A Systematic Survey of Prompting Methods in Natural Language Processing", ACM Computing, 55(9), pp.1~35 (2023)
- "openai/simple-evals" (2024)[URL]
- "hardik05/Damn_Vulnerable_C _Program" (2024)[URL]