Reinforcement Learning-based Hierarchical Seed Scheduling for Greybox Fuzzing
Reinforcement Learning-based Hierarchical Seed Scheduling for Greybox Fuzzing
复制标题
DOI：
10.14722/ndss.2021.24486
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Jinghan Wang;Chengyu Song;Heng Yin
中科院分区：
文献类型：
--
作者：
Jinghan Wang;Chengyu Song;Heng Yin
- 覆盖率指标在灰盒模糊中起着至关重要的作用。最近的工作表明，细粒度的覆盖度量可以允许模糊器检测传统边缘覆盖无法覆盖的错误。然而，细粒度的覆盖度量也将选择更多的种子，这不能被现有算法有效地调度。本文通过引入一个新的多层覆盖度量概念和相应的基于学习的分层调度器来解决这个问题。在DARPA CGC上对我们的原型进行的评估表明，我们的方法明显优于A FL和A FL F AST：它可以检测到20%以上的错误，在180个挑战中的83个挑战中实现更高的覆盖率，并在60个挑战中实现相同的覆盖率。更重要的是，它可以检测到相同数量的错误，并更快地实现相同的覆盖率。在FuzzBench上，我们的方法在20个项目中的10个项目上实现了比A FL ++（Qemu）更高的覆盖率。
—Coverage metrics play an essential role in greybox fuzzing. Recent work has shown that fine-grained coverage metrics could allow a fuzzer to detect bugs that cannot be covered by traditional edge coverage. However, fine-grained coverage metrics will also select more seeds, which cannot be efficiently scheduled by existing algorithms. This work addresses this problem by introducing a new concept of multi-level coverage metric and the corresponding reinforcement-learning-based hierarchical scheduler. Evaluation of our prototype on DARPA CGC showed that our approach outperforms A FL and A FL F AST significantly: it can detect 20% more bugs, achieve higher coverage on 83 out of 180 challenges, and achieve the same coverage on 60 challenges. More importantly, it can detect the same number of bugs and achieve the same coverage faster. On FuzzBench, our approach achieves higher coverage than A FL ++ (Qemu) on 10 out of 20 projects.