A Novel Seed Generation Approach for Vulnerability Mining Based on Generative Adversarial Networks and Attention Mechanisms

Chunlai Du,Guizhi Xu,Yanhui Guo,Zhongru Wang,Weiqiang Yu

DOI: https://doi.org/10.3390/math12050745

IF: 2.4

2024-03-02

Mathematics

Abstract:Coverage-guided fuzzing has been widely applied in software error and security vulnerability detection. The fuzzing technique based on AFL (American Fuzzy Loop) is a common coverage-guided fuzzing method. The code coverage during AFL fuzzing is highly dependent on the quality of the initial seeds. If the selected seeds' quality is poor, the AFL may not be able to detect program paths in a targeted manner, resulting in wasted time and computational resources. To solve the problems that the seed selection strategy in traditional AFL fuzzing cannot quickly and effectively generate high-quality seed sets and the mutated test cases cannot reach deeper paths and trigger security vulnerabilities, this paper proposes an attention mechanism-based generative adversarial network (GAN) seed generation approach for vulnerability mining, which can learn the characteristics and distribution of high-quality test samples during the testing process and generate high-quality seeds for fuzzing. The proposed method improves the GAN by introducing fully connected neural networks to balance the competitive adversarial process between discriminators and generators and incorporating attention mechanisms, greatly improving the quality of generated seeds. Our experimental results show that the seeds generated by the proposed method have significant improvements in coverage, triggering unique crashes and other indicators and improving the efficiency of AFL fuzzing.

mathematics

What problem does this paper attempt to address?

### Problems the Paper Attempts to Solve

This paper aims to address the issues in traditional fuzzing where the seed selection strategy cannot quickly and effectively generate high-quality seed sets, and the mutated test cases fail to deeply explore paths and trigger security vulnerabilities. Specifically:

1. **Low Seed Quality**: Traditional fuzzing tools (such as AFL) rely on manual selection or random selection for initial seed selection, which may lead to low seed quality, thereby affecting the efficiency and effectiveness of the testing.
2. **Insufficient Path Exploration**: Low-quality seeds may result in the inability to effectively explore deep paths in the program during testing, thus missing the opportunity to discover potential security vulnerabilities.
3. **Resource Waste**: If the seed selection is inappropriate, fuzzing may waste a significant amount of time and computational resources without achieving the expected test coverage.

To solve these problems, the paper proposes a novel seed generation method based on Generative Adversarial Networks (GAN) and attention mechanisms (AtGAN) to improve the quality and diversity of seeds, thereby enhancing the efficiency and effectiveness of fuzzing. By introducing the attention mechanism, AtGAN can better learn the feature distribution of high-quality test samples and generate high-quality seeds that can effectively trigger program crashes and new code paths.