자연어 처리 모델을 활용한 퍼징 시드 생성 기법
A fuzzing seed generation technique using Natural Language Processing Model
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
Fuzzing에서 seed corpus의 품질은 취약점을 보다 빠르게 찾기 위해서 중요한 요소 중 하나라고 할 수 있다. 이에 dynamic taint analysis와 symbolic execution 기법 등을 활용하여 효율적인 seed corpus를 생성하는 연구들이 진행되어왔으나, 높은 전문 지식이 요구되고, 낮은 coverage로 인해 광범위한 활용에 제약이 있었다. 이에 본 논문에서는 자연어 처리 모델인 Sequence-to-Sequence 모델을 기반으로 seed corpus를 생성하는 DDRFuzz 시스템을 제안한다. 본 논문에서 제안하는 시스템은 멀티미디어 파일을 입력값으로 하는 5개의 오픈소스 프로젝트를 대상으로 관련 연구들과 비교하여 효과를 검증하였다. 실험 결과, DDRFuzz가 coverage와 crash count 측면에서 가장 뛰어난 성능을 나타냄을 확인할 수 있었고, 또한 신규 취약점을 포함하여 총 3개의 취약점을 탐지하였다.
Abstract
The quality of the fuzzing seed file is one of the important factors to discover vulnerabilities faster. Although the prior seed generation paradigm, using dynamic taint analysis and symbolic execution techniques, enhanced fuzzing efficiency, they are not extensively applied owing to their high complexity and need for expertise. This study proposed the DDRFuzz system, which creates seed files based on sequence-to-sequence models. We evaluated DDRFuzz on five open-source applications that used multimedia input files. Following experimental results, DDRFuzz showed the best performance compared with the state-of-the-art studies in terms of fuzzing efficiency.
참고문헌 (25)
- "CVE"[URL]
- A. Rebert, "Optimizing seed selection for fuzzing", Proceedings of the 23rd USENIX Security Symposium, pp.861~875 (2014)
- C. Lyu, "Smartseed : Smart seed generation for efficient fuzzing", arXiv, preprint arXiv:1807.02606, ~ (2019)
- V. J. M. Man`es, "The art, science, and engineering of fuzzing : A survey", IEEE Transaction on Software Engineering, pp.2312~2331 (2021)
- K. Fang, "Emulation-instrumented fuzz testing of 4g", lte android mobile devices guided by reinforcement learning, 2018, 20~40
- K. B¨ottinger, "Deep reinforcement fuzzing", IEEE Security and Privacy Workshops(SPW), pp.116~122 (2018)
- S. Karamcheti, "Adaptive grey-box fuzz-testing with thompson sampling", Proceedings of the 11th ACM Workshop on Artificial Intelligence and Security, pp.37~47 (2018)
- M. Rajpal, "Not all bytes are equal: Neural byte sieve for fuzzing", arXiv, preprint arXiv:1711.04596, ~ (2017)
- W. Drozd, "Fuzzergym : A competitive framework for fuzzing and learning", arXiv, preprint arXiv:1807.07490, ~ (2018)
- "libFuzzer"[URL]
- X. Liu, "Reinforcement compiler fuzzing", arXiv, preprint arXiv:1801.04589, ~ (2018)
- Z. Zhang, "Reinforcement learning-based fuzzing technology", International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, pp.244~253 (2020)
- Y. Wang, "Neufuzz : Efficient fuzzing with deep neural network", IEEE Access, 7, pp.36340~36352 (2019)
- J. Wang, "Skyfire: Data-driven seed generation for fuzzing", 2017 IEEE Symposium on Security and Privacy (SP), pp.579~594 (2017)
- P. Godefroid, "Learn&fuzz : Machine learning for input fuzzing", Proceedings of the 32nd IEEE, 2017, 50~59
- L. Cheng, "Optimizing seed inputs in fuzzing with machine learning", 2019IEEE, 2019, 244~245
- L. Joffe, "Machine learning augmented fuzzing", 2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), pp.178~183 (2018)
- R. Fan, "Machine learning for black-box fuzzing of network protocols", International Conference on Information and Communications Security, pp.621~632 (2018)
- Z. Hu, "Ganfuzz : a gan-based industrial network protocol fuzzing framework", Proceedings of the 15th ACM International Conference on Computing Frontiers, pp.138~145 (2018)
- Z. Li, "An intelligent fuzzing data generation method based on deep adversarial learning", IEEE Access, 7, pp.49327~49340 (2019)
- N. Nichols, "Faster fuzzing : Reinitialization with deep neural models", arXiv, preprint arXiv:1711.02807, ~ (2017)
- "American Fuzzy Loop"[URL]
- M. B¨ohme, "Coverage-based greybox fuzzing as markov chain", Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp.1032~1043 (2016)
- S. Rawat, "Vuzzer : Application-aware evolutionary fuzzing", NDSS, 17, pp.1~14 (2017)
- H. Peng, "T-fuzz: fuzzing by program transformation", 2018 IEEE Symposium on Security and Privacy (SP), pp.697~710 (2018)