title: Ð¤Ð°Ð·Ð·Ð¸Ð½Ð³ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð¸ÑÑ Ð¾Ð´Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð° Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð½ÐµÐ¹ÑÐ¾Ð½Ð½ÑÑ ÑÐµÑÐµÐ¹ Ð´Ð»Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÑ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Fuzzing with neural networks to detect software vulnerabilities
Creators: name: Ð¤Ð¸ÑÑÐº, ÐÐ»ÐµÐºÑÐµÐ¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: ÑÐ°Ð·Ð·Ð¸Ð½Ð³ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ
Ð½ÐµÐ¹ÑÐ¾Ð½Ð½ÑÐµ ÑÐµÑÐ¸
Ð³ÑÐ°Ð´Ð¸ÐµÐ½ÑÐ½ÑÐ¹ ÑÐ¿ÑÑÐº
Ð¿Ð¾ÐºÑÑÑÐ¸Ðµ ÐºÐ¾Ð´Ð°
American Fuzzy Loop (AFL)
Tensorflow
Keras
Linux
fuzzing
neural networks
gradient descent
test coverage

description: Ð¤Ð°Ð·Ð·Ð¸Ð½Ð³ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÐ²Ð»ÑÐµÑÑÑ ÑÑÐ°Ð½Ð´Ð°ÑÑÐ½ÑÐ¼ Ð¼ÐµÑÐ¾Ð´Ð¾Ð¼ Ð¿Ð¾Ð¸ÑÐºÐ° ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÐµÐ¹ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ. ÐÐ´Ð½Ð°ÐºÐ¾ Ð´Ð°Ð¶Ðµ ÑÐ°Ð¼ÑÐµ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÐµ ÑÑÐµÐ´ÑÑÐ²Ð° Ð½Ðµ Ð¾ÑÐµÐ½Ñ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ñ Ð² Ð¿Ð¾Ð¸ÑÐºÐµ ÑÑÑÐ´Ð½Ð¾Ð¸Ð·Ð²Ð»ÐµÐºÐ°ÐµÐ¼ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÑ Ð¾ÑÐ¸Ð±Ð¾Ðº. ÐÐ¾Ð»ÑÑÐ¸Ð½ÑÑÐ²Ð¾ Ð¿Ð¾Ð¿ÑÐ»ÑÑÐ½ÑÑ ÑÐ°Ð·Ð·ÐµÑÐ¾Ð² Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑ ÑÐ²Ð¾Ð»ÑÑÐ¸Ð¾Ð½Ð½Ð¾Ðµ Ð¼ÐµÑÐ¾Ð´Ñ Ð´Ð»Ñ Ð³ÐµÐ½ÐµÑÐ°ÑÐ¸Ð¸ Ð²ÑÐ¾Ð´Ð½ÑÑ Ð´Ð°Ð½Ð½ÑÑ, ÐºÐ¾ÑÐ¾ÑÑÐµ Ð¼Ð¾Ð³ÑÑ Ð²ÑÐ·Ð²Ð°ÑÑ ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÐµ Ð¾ÑÐ¸Ð±ÐºÐ¸. Ð¢Ð°ÐºÐ¸Ðµ ÑÐ²Ð¾Ð»ÑÑÐ¸Ð¾Ð½Ð½ÑÐµ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ñ Ð±ÑÑÑÑÑ Ð¸ Ð¿ÑÐ¾ÑÑÑ Ð² ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸, Ð½Ð¾ ÑÐ°ÑÑÐ¾ Ð·Ð°ÑÑÑÐµÐ²Ð°ÑÑ Ð² Ð¿Ð¾ÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÐµÐ»ÑÐ½Ð¾ÑÑÑÑ ÑÐ»ÑÑÐ°Ð¹Ð½ÑÑ Ð¼ÑÑÐ°ÑÐ¸Ð¹. Ð Ð´Ð°Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð¸Ð·Ð»Ð¾Ð¶ÐµÐ½Ð° ÑÑÑÐ½Ð¾ÑÑÑ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð° Ðº Ð³ÐµÐ½ÐµÑÐ°ÑÐ¸Ð¸ Ð²ÑÐ¾Ð´Ð½ÑÑ Ð´Ð°Ð½Ð½ÑÑ Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð½ÐµÐ¹ÑÐ¾Ð½Ð½ÑÑ ÑÐµÑÐµÐ¹, ÐºÐ¾ÑÐ¾ÑÑÐµ Ð¼Ð¾Ð³ÑÑ Ð¾Ð±ÑÑÐ°ÑÑÑÑ Ð¸ ÑÐ²ÐµÐ»Ð¸ÑÐ¸Ð²Ð°ÑÑ Ð¿Ð¾ÐºÑÑÑÐ¸Ðµ ÐºÐ¾Ð´Ð° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼ ÑÐ¾ ÑÐ»Ð¾Ð¶Ð½ÑÐ¼ Ð²ÐµÑÐ²Ð»ÐµÐ½Ð¸ÐµÐ¼. ÐÐ´Ð½Ð°ÐºÐ¾ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ Ð³ÑÐ°Ð´Ð¸ÐµÐ½ÑÐ½ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð½Ð°Ð¿ÑÑÐ¼ÑÑ Ð½ÐµÐ¿ÑÐ¸Ð¼ÐµÐ½Ð¸Ð¼Ð¾ Ðº ÑÐ°Ð·Ð·Ð¸Ð½Ð³Ñ, ÑÐ°Ðº ÐºÐ°Ðº Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼ Ð¸Ð¼ÐµÐµÑ Ð¼Ð½Ð¾Ð¶ÐµÑÑÐ²Ð¾ ÑÐ°Ð·ÑÑÐ²Ð¾Ð². Ð­ÑÑ Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼Ñ Ð¿ÑÐµÐ´Ð»Ð°Ð³Ð°ÐµÑÑÑ ÑÐµÑÐ¸ÑÑ Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð°Ð¿Ð¿ÑÐ¾ÐºÑÐ¸Ð¼Ð°ÑÐ¸Ð¸ Ð´Ð¸ÑÐºÑÐµÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ñ Ð½ÐµÐ¿ÑÐµÑÑÐ²Ð½Ð¾Ð¹ ÑÑÐ½ÐºÑÐ¸ÐµÐ¹. Ð¢ÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð¿ÑÐ¾Ð²Ð¾Ð´Ð¸Ð»Ð¾ÑÑ Ð½Ð° 4 Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°Ñ Ñ Ð¾ÑÐºÑÑÑÑÐ¼ Ð¸ÑÑÐ¾Ð´Ð½ÑÐ¼ ÐºÐ¾Ð´Ð¾Ð¼ Ð¸Ð· Ð½Ð°Ð±Ð¾ÑÐ° Ð´Ð°Ð½Ð½ÑÑ LAVA-M Ñ Ð¸ÑÐºÑÑÑÑÐ²ÐµÐ½Ð½Ð¾ Ð²Ð½ÐµÑÐµÐ½Ð½ÑÐ¼Ð¸ ÑÑÐ·Ð²Ð¸Ð¼Ð¾ÑÑÑÐ¼Ð¸. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´ Ð¿Ð¾ÐºÐ°Ð·Ð°Ð» Ð¾ÑÐ»Ð¸ÑÐ½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¾ÑÐ½Ð¾ÑÐ¸ÑÐµÐ»ÑÐ½Ð¾ ÑÑÐµÑ ÑÐ°ÑÑÐ¼Ð°ÑÑÐ¸Ð²Ð°ÐµÐ¼ÑÑ Ð¤Ð°Ð·Ð·ÐµÑÐ¾Ð²: AFL, AFL++, AFLSmart.
description: Fuzzing testing is a standard method of finding software vulnerabilities. However, even the most modern software tools are not very effective in finding hard-to-recover software errors. Most popular fuzzers use evolutionary methods to generate input data that can cause various errors. Such evolutionary algorithms are fast and easy to implement, but they often get stuck in sequences of random mutations. This paper describes the essence of the approach to generating input data using neural networks that can be trained and increase the code coverage of programs with complex branching. However, the use of gradient methods is not directly applicable to fuzzing, since the behavior of programs has many discontinuities. It is proposed to solve this problem by approximating the discrete behavior of the program by a continuous function. Testing was carried out on 4 open source programs from the LAVA-M dataset with artificially introduced vulnerabilities. The implemented method showed excellent results with respect to the tree considered Fuzzers: AFL, AFL++, AFLSmart.