Constrained Mutation Fuzz Testing Using Heatmap-Guided Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional fuzzing algorithms face inefficiencies in identifying which bytes in an input file to mutate to increase the likelihood of causing the code to crash, as they often rely on random mutations and require millions of attempts to achieve meaningful code coverage.
Innovation Solution
Constrained mutation-based fuzz testing uses machine learning techniques, specifically neural networks, to learn patterns from past fuzzing explorations and generate targeted mutations, focusing on specific bytes that affect code coverage, thereby optimizing the fuzzing process by tailoring the algorithm based on a heatmap that maps bytes to their execution impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional random mutation-based fuzzing is used, then the fuzzing process can be simple to implement, but it requires millions of executions to achieve meaningful code coverage
Solution Approach 1:
The patent implements feedback mechanisms where the fuzzing system learns from past executions by analyzing which mutations led to new code coverage. This feedback is used to guide future mutation decisions, allowing the system to focus on promising areas of the input space rather than randomly exploring all possibilities, thereby achieving meaningful code coverage with fewer executions
Solution Approach 2:
The system dynamically changes mutation parameters based on learned patterns from previous executions. By adjusting which bytes to mutate and how to mutate them based on historical performance data, the system optimizes the fuzzing process to achieve higher code coverage efficiency while reducing the total number of executions needed
2Reliability
If random mutation locations are chosen, then the implementation is straightforward, but the likelihood of identifying critical bytes that cause crashes remains low
Solution Approach 1:
The system performs preliminary analysis of the input file to identify critical bytes that are more likely to cause crashes. By pre-processing the input and marking important bytes before the actual fuzzing process, the system increases the probability that mutations will hit critical locations, thereby improving crash identification effectiveness while maintaining high mutation success rates
3Reliability
If comprehensive code coverage is pursued, then more bugs can be discovered, but the search space becomes too large to explore efficiently
Solution Approach 1:
The patent applies local quality by treating different regions of the input file differently based on their importance. Critical bytes that are more likely to lead to new code coverage or crashes receive more focused mutation attention, while less important regions are mutated less frequently. This localized approach allows comprehensive code coverage to be pursued without overwhelming the search space
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Techniques for constrained mutation-based fuzzing are described. Machine accesses an input file of code for testing. Machine performs multiple runs of a fuzzing algorithm using the input file and the code. Each run includes: performing a mutation of one or more bytes of the input file and determining which parts of the code were executed when the code was run with the mutated input file. Machine stores, for each run, an indication of whether the mutation caused execution of a portion of the code which was not executed prior to the mutation. Machine generates heatmap of the input file based on the stored indications. The heatmap maps each of the bytes in the input file to a value indicating whether the mutation of the byte caused execution of the portion of the code for testing which was not executed prior to the mutation. Machine tailors fuzzing algorithm based on heatmap.