Advancements in Fuzzing and Vulnerability Detection

The field of fuzzing and vulnerability detection is rapidly evolving, with a growing focus on leveraging large language models (LLMs) to improve the efficiency and effectiveness of testing. Recent developments have centered around harnessing LLMs to guide fuzzing, generate high-quality test drivers, and identify complex vulnerabilities. Notably, LLM-based approaches have shown promise in reducing the costs associated with fuzzing black-box components and improving the accuracy of vulnerability detection. Furthermore, innovative techniques such as constraint-based fuzz driver generation and dual scheduling have been proposed to optimize computational resource utilization and increase overall coverage. These advancements have significant implications for the field, enabling more comprehensive and efficient testing of complex software systems. Noteworthy papers include: Harnessing LLMs for Document-Guided Fuzzing of OpenCV Library which introduced VISTAFUZZ, a novel technique for harnessing LLMs to parse API documentation and generate standardized API information. LibLMFuzz, a framework that pairs an LLM with a lightweight tool-chain to autonomously analyze stripped binaries and generate drivers. BACFuzz, the first gray-box fuzzing framework specifically designed to uncover Broken Access Control vulnerabilities in web applications. Scheduzz, an LLM-based library fuzzing technique that leverages dual scheduling to efficiently manage API combinations and fuzz drivers.

Sources

Harnessing LLMs for Document-Guided Fuzzing of OpenCV Library

LibLMFuzz: LLM-Augmented Fuzz Target Generation for Black-box Libraries

BACFuzz: Exposing the Silence on Broken Access Control Vulnerabilities in Web Applications

Assessing Reliability of Statistical Maximum Coverage Estimators in Fuzzing

Scheduzz: Constraint-based Fuzz Driver Generation with Dual Scheduling

Built with on top of