Fuzzying

• used automated methods to perform vulnearbility analysis

• software ever incerasing in size and complexity…

• => challenge to test systems…

=> basically some type of random testing…

• random input into target

• -> detect if it crashes…

• can happen inside the processor

  • exception event

  • synchronous to processor clock

• or in processor-external hardware modules

  • failure condition by sending interrupt

  • asynchronous to processor clock -> asyncr. event

=> actual cause manifold…

• stop execution of curr. process

• save all process registers

• switch to os event handler -> indocated by interr. descriptor table

• operating system handler in turn sends a signal to the target process that evoked the interrupt.

• To eventually sense the crash at software side, we catch the signals that are sent from the operating system to the target process and filter the fatal ones

• random input

• -> target

• -> extract informatino from dsnamic binary instrumentaiton

• -> evaluate

• generate input based on evaluation

• -> target

• ->…

• which information from dynamic instrumentation should we extract?

• how can we evaluate wuality of test cases based on this info?

• how can we generate new test cases basd on this quality evaluation?

• how do we create feeback loop taht provides us a full yself-adaptive fuzzer?

• based on stochastic process

• Reward:

• Sum over each time step

• discount factor gamma ^t

• *

• Reward at point t+1

• Policy:

  • deterministic:

    • Maps state to action: X -> A

    • A_t = pi(X_t)

  • stochastic:

    • X -> D(A, sigma(A))

• Value⁽policy)(x)

• = Erwartungswert

• of reward

• for X0 = x

• observing biological systme

  • e.g. bumblebees

  • esals

  • fish

  • monkeys

  • …

• => basically some form of traversing space…

• => use to find next action and incorporate into markov decision process as policy…

• Levy flight foraging hypothesis

  • special class of stochastic processes called levy flights model real foraging behavior

• levy flight hypothesis

  • minimize search time when foraging sources of fodd that are sparsely and randomly distributed, resting and refillable

• maximize coverage of execution paths

  
  

• adjusted based on feedback

• probabiltiy of reaching a specific part of code veeeery slim

• symbolic execution