Black Box Fuzzing Feedback via Machine Learning Prediction

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional black box fuzzing lacks the ability to improve over time due to the absence of feedback mechanisms, such as code coverage or path coverage, which limits its effectiveness in generating new test cases, especially for embedded systems and programs with non-deterministic outputs.

Innovation Solution

The method enhances black box fuzzing by using machine learning to predict secondary information about the effect of test cases on the target program, allowing for the generation of new test cases even without access to the program's source code, effectively simulating feedback mechanisms similar to gray or white box fuzzing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional black box fuzzing is used to test target programs, then the testing process is simple and does not require source code access, but the fuzzer cannot improve over time due to lack of feedback mechanisms

Engineering Contradiction:
Improveeffectiveness of fuzzingVSAvoidfeedback information
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent implements feedback mechanisms in black box fuzzing by using machine learning models to predict code coverage and path coverage metrics. The fuzzer collects actual coverage data from executed test cases, uses this data to train or fine-tune the ML model, and then employs the model's predictions to guide subsequent test case generation. This creates a closed-loop feedback system where coverage information from previous iterations informs future fuzzing directions, enabling continuous improvement without requiring source code modification or access during the fuzzing process itself

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The patent applies preliminary action by pre-training machine learning models on available training data that includes information about the target program's behavior and coverage characteristics. This pre-training phase prepares the ML model to make accurate predictions about code coverage and path coverage before the actual fuzzing begins. The model is ready to provide guidance from the start, eliminating the need for iterative model development during fuzzing and enabling immediate directed test case generation

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If random test case generation is used in black box fuzzing, then the fuzzer can operate without source code, but it cannot generate directed or targeted test cases to uncover specific vulnerabilities

Engineering Contradiction:
Improvetargeting accuracy of test casesVSAvoidcomplexity of fuzzing system
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces machine learning models as intermediary components between the fuzzer and the target program. These ML models act as mediators that translate raw coverage data into predictive insights about which test cases are likely to uncover vulnerabilities. The intermediary model layer processes coverage information and generates predictions about code coverage and path coverage, guiding the fuzzer to generate more targeted test cases without requiring direct access to source code or complex instrumentation of the target program

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional mechanical feedback mechanisms (which require source code instrumentation, breakpoints, and direct program-fuzzer communication) with a data-driven machine learning approach. Instead of using complex mechanical systems to track and report coverage information, the patent uses ML models trained on coverage data to predict which test cases will be effective. This substitution reduces the mechanical complexity of the fuzzing system while maintaining or improving targeting accuracy

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If black box fuzzing is applied to embedded systems with non-deterministic outputs, then the systems can be tested without source code access, but the fuzzing effectiveness is reduced due to inability to capture coverage feedback

Engineering Contradiction:
Improveapplicability to embedded systemsVSAvoidfuzzing effectiveness
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent implements feedback mechanisms that work specifically for embedded systems with non-deterministic outputs by using machine learning models to capture and predict coverage patterns. The system collects coverage data from executed test cases on the embedded system, trains ML models on this data to learn the system's behavior patterns, and then uses these models to guide subsequent test case generation. This feedback loop adapts to the non-deterministic nature of embedded systems by learning from actual execution patterns rather than relying on deterministic source code analysis

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The patent applies parameter changes by using machine learning models to dynamically adjust the parameters and characteristics of generated test cases based on predicted coverage information. The ML models analyze coverage patterns and modify test case parameters (such as input data characteristics, execution paths, or test conditions) to target areas of the embedded system that are less frequently exercised. This dynamic parameter adjustment enables effective fuzzing of non-deterministic embedded systems by adapting to their specific behavior patterns

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS20240354240A1Method for generating at least one new test case based on a black box fuzzing of a target program to be tested
Publication Date: 2024.10.24 ROBERT BOSCH GMBH
  • US20240354240A1 patent drawing
  • US20240354240A1 patent drawing

AI summary

A method for generating at least one new test case based on black box fuzzing of a target program to be tested. The method includes: providing at least one specified test case; predicting at least one item of secondary information based on the provided specified test case, wherein the at least one secondary information is specific for an effect of the provided specified test case on the target program to be tested; generating the at least one new test case based on the prediction.