FuzzCoder: Byte-level Fuzzing Test via Large Language Model
Fuzzing is an important dynamic program analysis technique designed for
finding vulnerabilities in complex software. Fuzzing involves presenting a
target program with crafted malicious input to cause crashes, buffer overflows,
memory errors, and exceptions. Crafting malicious inputs in an efficient manner
is a difficult open problem and the best approaches often apply uniform random
mutations to pre-existing valid inputs. In this work, we propose to adopt
fine-tuned large language models (FuzzCoder) to learn patterns in the input
files from successful attacks to guide future fuzzing explorations.
Specifically, we develop a framework to leverage the code LLMs to guide the
mutation process of inputs in fuzzing. The mutation process is formulated as
the sequence-to-sequence modeling, where LLM receives a sequence of bytes and
then outputs the mutated byte sequence. FuzzCoder is fine-tuned on the created
instruction dataset (Fuzz-Instruct), where the successful fuzzing history is
collected from the heuristic fuzzing tool. FuzzCoder can predict mutation
locations and strategies locations in input files to trigger abnormal behaviors
of the program. Experimental results show that FuzzCoder based on AFL (American
Fuzzy Lop) gain significant improvements in terms of effective proportion of
mutation (EPM) and number of crashes (NC) for various input formats including
ELF, JPG, MP3, and XML.
66d7da557720d3992e5f7a18
Liqun Yang
66d7da557720d3992e5f7a19
Jian Yang
claimed_verified
2024-10-14T19:04:30.629Z
64ccb9bfead94891d12aef42
/avatars/c54809d43d93d3f0766bd2555cecc4e3.svg
Yang Jian
user
CSJianYang
66d7da557720d3992e5f7a1a
Chaoren Wei
admin_assigned
2024-09-06T09:22:24.740Z
6565a1fdbfb751371830e69c
/avatars/1da6f1a2a890d2dbd7cbbede28ca3aa6.svg
Chaoren Wei
user
WeiSumi
66d7da557720d3992e5f7a1b
Guanglin Niu
admin_assigned
2024-09-06T09:22:31.933Z
66c5f5a8b67d2b050b854888
/avatars/6208398d750b692852c40f2c3087b427.svg
Guanglin Niu
user
ngl567
66d7da557720d3992e5f7a1c
Ge Zhang
claimed_verified
2024-09-06T07:06:31.734Z
638efcf4c67af472d316d424
/avatars/97a57859d7d87a3a8f1bb41d32a72bc2.svg
Ge Zhang
user
zhangysk
66d7da557720d3992e5f7a1d
Yunli Wang
admin_assigned
2024-09-06T09:20:12.283Z
666a5e3dd7597fcf294f98a2
/avatars/a3f4d3f4fa6b59f7faef6ec59ad15ade.svg
Yunli Wang
user
Pony12
66d7da557720d3992e5f7a1e
Linzheng ChaI
admin_assigned
2024-09-06T09:20:18.301Z
64ba096e760936217a3ad2e2
https://cdn-avatars.huggingface.co/v1/production/uploads/64ba096e760936217a3ad2e2/aNQK83Jg5PsBkY0UDg-RA.jpeg
Linzheng Chai
user
Challenging666
66d7da557720d3992e5f7a1f
Wanxu Xia
66d7da557720d3992e5f7a20
Hongcheng Guo
admin_assigned
2024-09-06T09:20:57.153Z
60ff653699f651283c017df7
/avatars/075257e8d7fefc43be24738f978ea5c3.svg
Hongcheng Guo
user
hongcheng
66d7da557720d3992e5f7a21
Shun Zhang
66d7da557720d3992e5f7a22
Jiaheng Liu
admin_assigned
2024-09-06T09:21:45.415Z
65377c30e48353201e6fdda0
/avatars/a8f803b6f2e598eaee9c52c0d2ddfc16.svg
Jiaheng Liu
user
CheeryLJH
66d7da557720d3992e5f7a23
Yuwei Yin
claimed_verified
2024-09-06T07:06:29.797Z
64510a21f800611f94f0d9f8
https://cdn-avatars.huggingface.co/v1/production/uploads/noauth/lOeHK9Bvt3IXcB7Urx6jZ.jpeg
Yuwei Yin
user
yuweiyin
66d7da557720d3992e5f7a24
Junran Peng
admin_assigned
2024-09-06T09:21:51.754Z
62c11a7360edb2dd7765b80d
/avatars/92db3258d0ba44daee22952f0644cd93.svg
Junran Peng
user
JrPeng
66d7da557720d3992e5f7a25
Jiaxin Ma
66d7da557720d3992e5f7a26
Liang Sun
66d7da557720d3992e5f7a27
Zhoujun Li
FuzzCoder: Byte-level Fuzzing Test via Large Language Model
Fuzzing is an important dynamic program analysis technique designed for
finding vulnerabilities in complex software. Fuzzing involves presenting a
target program with crafted malicious input to cause crashes, buffer overflows,
memory errors, and exceptions. Crafting malicious inputs in an efficient manner
is a difficult open problem and the best approaches often apply uniform random
mutations to pre-existing valid inputs. In this work, we propose to adopt
fine-tuned large language models (FuzzCoder) to learn patterns in the input
files from successful attacks to guide future fuzzing explorations.
Specifically, we develop a framework to leverage the code LLMs to guide the
mutation process of inputs in fuzzing. The mutation process is formulated as
the sequence-to-sequence modeling, where LLM receives a sequence of bytes and
then outputs the mutated byte sequence. FuzzCoder is fine-tuned on the created
instruction dataset (Fuzz-Instruct), where the successful fuzzing history is
collected from the heuristic fuzzing tool. FuzzCoder can predict mutation
locations and strategies locations in input files to trigger abnormal behaviors
of the program. Experimental results show that FuzzCoder based on AFL (American
Fuzzy Lop) gain significant improvements in terms of effective proportion of
mutation (EPM) and number of crashes (NC) for various input formats including
ELF, JPG, MP3, and XML.
A framework uses fine-tuned large language models to guide input mutation in fuzzing, improving the detection of software vulnerabilities.
fine-tuned large language models FuzzCoder sequence-to-sequence modeling instruction dataset Fuzz-Instruct effective proportion of mutation number of crashes