AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided...
Transcript of AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided...
![Page 1: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/1.jpg)
AI Guided FuzzingAI Guided Fuzzing
Jonathon MartinJonathon Martin
Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera
![Page 2: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/2.jpg)
AI Guided Fuzzing
Jonathon Martin
Presentation Outline:Presentation Outline:
1. A more specific project title2. Explanation of specific title3. Progress so far4. Timeline for Semester 2
![Page 3: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/3.jpg)
AI Guided Fuzzing
Jonathon Martin
More specifically ...More specifically ...
"Machine learning (ML) for directed fuzzing
with American Fuzzy Lop (AFL)"
![Page 4: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/4.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
FuzzingFuzzing"Fuzzing is the process of finding security
vulnerabilities in input-parsing code byrepeatedly testing the parser with
modified, or fuzzed, inputs."
Godefroid, Peleg, Singh (2017)
![Page 5: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/5.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
The Infinite Monkey TheoremThe Infinite Monkey Theorem
A million monkeys typing on a milliontypewriters will eventually replicate the
works of Shakespeare.
![Page 6: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/6.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
The Infinite Input TheoryThe Infinite Input Theory
Running a program with every conceivableinput will eventually uncover any possible
crashes.
![Page 7: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/7.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
American Fuzzy LopAmerican Fuzzy LopIs a security-oriented fuzzer that
employs a novel type of compile-timeinstrumentation and genetic algorithms
to automatically discover clean,interesting test cases that trigger newinternal states in the targeted binary.
http://lcamtuf.coredump.cx/afl/
![Page 8: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/8.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
AFL Internal RepresentationsAFL Internal RepresentationsAFL uses a "bitmap" torepresent the internalstate of its target programduring execution. An inputgenerating a previouslyunseen bitmap is savedfor continued fuzzing.
= 65536 locations
![Page 9: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/9.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
Progress so far ...Progress so far ...
![Page 10: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/10.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
DatasetDataset
Generated a labelled dataset of bitmapsgenerated by a modified AFL.
![Page 11: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/11.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
seed
![Page 12: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/12.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
seed
![Page 13: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/13.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
seed
![Page 14: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/14.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
seed
crash!
![Page 15: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/15.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
predecessors
![Page 16: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/16.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
Dataset PropertiesDataset Properties
![Page 17: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/17.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
PredictionPredictionPredecessor bitmaps principle
components can be distinguished fromother bitmaps using a logistic regression
model with accuracy:
97.85%
![Page 18: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/18.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
Next steps ...Next steps ...
![Page 19: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/19.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
Build prediction modelBuild prediction model
![Page 20: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/20.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
Integrate model into AFLIntegrate model into AFL
![Page 21: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/21.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
See dramatic improvementSee dramatic improvementin AFLs ability to findin AFLs ability to find
crashes ...crashes ...maybe ...
![Page 22: AI Guided Fuzzing - CECS - ANUcourses.cecs.anu.edu.au/courses/CSPROJECTS/18S2/... · AI Guided Fuzzing Jonathon Martin Supervisors: Charles Gretton, Alwen Tiu, Adrian Herrera ...](https://reader030.fdocuments.in/reader030/viewer/2022041111/5f139c5f72f91001a768f878/html5/thumbnails/22.jpg)
ML for directed fuzzing with AFL
Jonathon Martin
Thank you!Thank you!
Alwen TiuCharles Gretton Adrian Herrera