IDFuzz: Intelligent Directed Grey-box Fuzzing

Motivation • We can identify critical fields for mutation based on past mutations input a distance: d byte position x change value input b distance: d-1 • critical field of input a: offset x, length 1 • Mutate the critical field directly rather than making blind attempts!!! ⽹络研究院 INSC ⽹络研究院 INSC Motivation • Q1: Applicable to future mutations? ➢ critical field of input a --> critical field of input x?

• Q2: Reach unexplored code regions? ➢ distance: d to d-1 --> d-1 to 0?

• A1: Learn the high-level pattern through a neural network model

• A2: learn to reach an unexplored branch from covered sibling branches