The document summarizes various techniques for automated software testing using fuzzing, including coverage-based fuzzing (AFL), directed greybox fuzzing (AflGO), and neural network-based approaches (FuzzGuard). It discusses how genetic algorithms and simulated annealing are used in AFL and AflGO respectively to guide test case mutation towards new code areas. It also provides examples of vulnerabilities found using these fuzzing tools.

1. A survey of AFL and
guided fuzzing
The 3rd KISTI and NII Joint Security Workshop
14:40 – 15:05 2023/09/04
Ruo Ando (NII)

2. AFL
AFL++
AflGO
Scatter
FuzzGuard
Directed Gray-box Fuzzing (CCS17)
Manipulation-Distance Guided Fuzzing
(Usenix Sec 23)
Deep Learning
(Usenix Sec 20)
Incremental Step (Usenix Woot 20)
Google (2013)
Overview

3. Algorithm for fuzzing
• GA (Genetic Algorithm) : AFL (CBF)
• Simulated Annealing : AflGO (DGF)
• CNN (Convolutional Neural Network): Fuzz Guard
• Idea: Reinforcement learning / Dynamic
Programming

4. AFL: American Fuzzy Lop
• Coverage-based fuzzing
• Using GA (Genetic algorithm)
• Used to calculate score in
coverage based fuzzing (AFL).
• Developer: Michał Zalewski
• Software bugs in major software projects, including X.Org Server,[2] PHP,[3]
OpenSSL,[4][5] pngcrush, bash,[6] Firefox,[7] BIND,[8][9] Qt,[10] and SQLite.[11]

5. AFL: Mutation by GA
pre-process
Mutation (GA)
Crash or
hang ?
add input to queue
calibrate / trim / score
1. bitflip 2. arith 3. interest
4. dictionary 5. havoc
6. splice
YES
NO

6. AFL : score and mutation
• Score item
• Average execution time
• Coverage
• Queue Cycle
• Depth of branch execution
• Mutation
• SIMPLE
• ARITHMETIC INC/DEC
• INTERESTING VALUES
• DICTIONARY STUFF
• RANDOM HAVOC
• SPLICING

7. Coverage
• Depth of control flow graph
• How many branches the
program with given input
passed in fuzzing
• Used to calculate score in
coverage based fuzzing (AFL).
branch
covarage

8. AflGO (CCS17)
• Coverage-based Greybox Fuzzers (CGF)
• Coverage
• GA (Genetic algorithm)
• Directed Greybox Fuzzers (DGF) :
• reaching a given set of program location effectively
• BB (Basic Block Distance)
• Simulated annealing
• Control flow graph and call graph
• HeartBleed

9. FuzzGaurd (Usenix Sec 20)
• Predicting the reachability of inputs and filtering out
the unreachable test cases.
• Based on AflGO
• CNN (Convolutional Neural Network)
• Supervised learning
• Groud truth (Teacher signal): reachability
• Training data (inputs): control flow graph
• Famous vulnerability: CVE 2019-7582 (libming)

10. Idea: Reinforcement learning
Output: sequence of mutation – mutation1 -> mutation3 -> mutation 5 …