FuzzDistill: Intelligent Fuzzing Target Selection using Compile-Time Analysis and Machine Learning
Fuente:
arXiv
Gespeichert in:
| 1. Verfasser: | |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2024
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866909424511090688 |
|---|---|
| author | Upadhyay, Saket |
| author_facet | Upadhyay, Saket |
| contents | Fuzz testing is a fundamental technique employed to identify vulnerabilities within software systems. However, the process can be protracted and resource-intensive, especially when confronted with extensive codebases. In this work, I present FuzzDistill, an approach that harnesses compile-time data and machine learning to refine fuzzing targets. By analyzing compile-time information, such as function call graphs' features, loop information, and memory operations, FuzzDistill identifies high-priority areas of the codebase that are more probable to contain vulnerabilities. I demonstrate the efficacy of my approach through experiments conducted on real-world software, demonstrating substantial reductions in testing time. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2412_08100 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | FuzzDistill: Intelligent Fuzzing Target Selection using Compile-Time Analysis and Machine Learning Upadhyay, Saket Software Engineering Cryptography and Security Machine Learning K.6.3; D.2.5 Fuzz testing is a fundamental technique employed to identify vulnerabilities within software systems. However, the process can be protracted and resource-intensive, especially when confronted with extensive codebases. In this work, I present FuzzDistill, an approach that harnesses compile-time data and machine learning to refine fuzzing targets. By analyzing compile-time information, such as function call graphs' features, loop information, and memory operations, FuzzDistill identifies high-priority areas of the codebase that are more probable to contain vulnerabilities. I demonstrate the efficacy of my approach through experiments conducted on real-world software, demonstrating substantial reductions in testing time. |
| title | FuzzDistill: Intelligent Fuzzing Target Selection using Compile-Time Analysis and Machine Learning |
| topic | Software Engineering Cryptography and Security Machine Learning K.6.3; D.2.5 |
| url | https://arxiv.org/abs/2412.08100 |