Constrained Mutation Fuzz Testing Using Heatmap-Guided Neural Networks

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Traditional fuzzing algorithms face inefficiencies in identifying which bytes in an input file to mutate to increase the likelihood of causing the code to crash, as they often rely on random mutations and require millions of attempts to achieve meaningful code coverage.

Innovation Solution

Constrained mutation-based fuzz testing uses machine learning techniques, specifically neural networks, to learn patterns from past fuzzing explorations and generate targeted mutations, focusing on specific bytes that affect code coverage, thereby optimizing the fuzzing process by tailoring the algorithm based on a heatmap that maps bytes to their execution impact.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If traditional random mutation-based fuzzing is used, then the fuzzing process can be simple to implement, but it requires millions of executions to achieve meaningful code coverage

Engineering Contradiction:
Improvecode coverage efficiencyVSAvoidnumber of executions required
Core Design Contradiction:
ProductivityVSLoss of time

Solution Approach 1:

The patent implements feedback mechanisms where the fuzzing system learns from past executions by analyzing which mutations led to new code coverage. This feedback is used to guide future mutation decisions, allowing the system to focus on promising areas of the input space rather than randomly exploring all possibilities, thereby achieving meaningful code coverage with fewer executions

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The system dynamically changes mutation parameters based on learned patterns from previous executions. By adjusting which bytes to mutate and how to mutate them based on historical performance data, the system optimizes the fuzzing process to achieve higher code coverage efficiency while reducing the total number of executions needed

Inventive Principle:
Principle #35Parameter changes

2Reliability

If random mutation locations are chosen, then the implementation is straightforward, but the likelihood of identifying critical bytes that cause crashes remains low

Engineering Contradiction:
Improvecrash identification effectivenessVSAvoidmutation success rate
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary analysis of the input file to identify critical bytes that are more likely to cause crashes. By pre-processing the input and marking important bytes before the actual fuzzing process, the system increases the probability that mutations will hit critical locations, thereby improving crash identification effectiveness while maintaining high mutation success rates

Inventive Principle:
Principle #10Preliminary action

3Reliability

If comprehensive code coverage is pursued, then more bugs can be discovered, but the search space becomes too large to explore efficiently

Engineering Contradiction:
Improvecode coverage completenessVSAvoidsearch space size
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies local quality by treating different regions of the input file differently based on their importance. Critical bytes that are more likely to lead to new code coverage or crashes receive more focused mutation attention, while less important regions are mutated less frequently. This localized approach allows comprehensive code coverage to be pursued without overwhelming the search space

Inventive Principle:
Principle #3Local quality

Data Source

PatentEP3639141B1Machine learning for constrained mutation-based fuzz testing
Publication Date: 2023.01.11 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP3639141B1 patent drawingFigure 1
  • EP3639141B1 patent drawingFigure 2A
  • EP3639141B1 patent drawingFigure 2B

AI summary

Techniques for constrained mutation-based fuzzing are described. Machine accesses an input file of code for testing. Machine performs multiple runs of a fuzzing algorithm using the input file and the code. Each run includes: performing a mutation of one or more bytes of the input file and determining which parts of the code were executed when the code was run with the mutated input file. Machine stores, for each run, an indication of whether the mutation caused execution of a portion of the code which was not executed prior to the mutation. Machine generates heatmap of the input file based on the stored indications. The heatmap maps each of the bytes in the input file to a value indicating whether the mutation of the byte caused execution of the portion of the code for testing which was not executed prior to the mutation. Machine tailors fuzzing algorithm based on heatmap.