AMNeuzz: A Strongly Directed Fuzz Testing Method Based on Attention Mechanism
Lei Zhang, Binbin Wang, Chang Liu, Mi Wen, Yan Zhang, Liangliang Wang · 2024
Fuzzy testing is one of the most popular vulnerability mining techniques recently, it plays a huge role in exploiting software security vulnerabilities and improving software security. Fuzzy testing mainly performs specific variations on the collected seeds to obtain a large number of test cases that can be used to execute the target program and trigger potential crashes in the program. However, traditional fuzzy testing generally suffers from a low level of test automation and fewer types of vulnerabilities detected. Aiming at the above problems, the application of machine learning techniques to fuzzy testing has become a hot research topic in academia. However, some recent studies still have problems, such as low edge coverage and poor generalization ability. Therefore, this paper proposes a strongly directed fuzz testing method based on attention mechanism and we name the fuzzer as AMNeuzz. AMNeuzz uses neural networks combined with attention mechanisms to construct an automatic sample generation model, which is trained so that the model learns the intrinsic formatting features of the samples, thus being able to automatically generate test samples that conform to certain syntactic specifications to quickly examine program paths that may have vulnerabilities, and this improves efficiency. In addition, the performance of the fuzzers is improved by improving Neuzz's gradient strategy. The final experimental results show that the AMNeuzz method proposed in this paper can achieve higher edge coverage than NEUZZ under the same time overhead.