Abstract: Directed fuzzing is designed to quickly produce test cases, reach a series of given target locations, and discover program errors. However, the current directed fuzzing tools generally have the problem of low test efficiency. So a directed grey-box method based on neural network is proposed which builds a model to predict where the current seed can produce input gain by learning variation patterns in different locations in the input files from past fuzzing explorations, so as to guide the fuzzer to optimize mutation. At the same time, in order to solve the tradeoff of exploration-exploitation problem in directed fuzzers, a dynamic strategy is introduced to adaptively coordinate two stages in the process of fuzzy testing. A prototype system named DYNFuzz is implemented based on the existing fuzzing framework AFL, and is tested and evaluated on three benchmarks, which shows that DYNFuzz has higher directed performance and test efficiency than other fuzzers and would not be caught up in local dilemmas caused by the exploration-exploitation imbalance.

Key words: directed fuzzing, neural network, optimize mutations, dynamic strategy

摘要： 定向模糊测试旨在快速生产测试用例，达到给定的程序目标位置区域并发现程序错误。但目前的定向模糊测试工具普遍存在测试效率较低的问题，为此提出了一种基于神经网络的定向灰盒模糊测试方法，通过学习过去的模糊探索输入文件中不同位置的变异模式以生成模型来预测当前种子能够产生输入增益的位置，从而指导模糊器进行优化突变。同时为了解决定向灰盒模糊器中探索与开发的权衡问题，引入了一种动态策略在模糊测试过程中自适应协调两个阶段。基于现有的模糊测试框架AFL实现了一个原型系统，命名为DYNFuzz，并在3个基准上对其进行了测试和评估，实验结果表明，DYNFuzz具有比其他模糊器更高的定向性能和测试效率，并且不会陷入由探索开发不平衡导致的局部困境。

关键词: 定向模糊测试, 神经网络, 优化突变, 动态策略