Fuzzing Guided by Bayesian Program Analysis
summary
Redefines Bayesian program analysis so each alarm gets a probability of being reachable by exploitation fuzzing (99% threshold in evaluation), uses per-target exploitation feedback as posterior evidence to learn and update reachability, and allocates mutation budgets accordingly (examples use 1,000 mutations). Implemented on LTGF2 with SVF, Bayesian inference costs ~0.31% runtime. On 24 real-world programs it finds 3.25×–13× more unique bugs and uncovers 39 previously unknown bugs (30 assigned CVEs).
AI-written summary · about
chapters (8)
- 0:00Bayesian guided fuzzing intro
- 1:26Limitations in target prioritization
- 4:24Reachable fuzzing target problem
- 7:16Introducing Baser framework
- 11:27Semantics-aware Bayesian guidance
- 18:06Experimental evaluation results
- 21:45Conclusion and future work
- 22:34Q&A
related talks
01h 15mMake your programs more reliable with Fuzzing
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing
18mAccelerating Fuzzing through Prefix-Guided Execution
53mFuzzing 101
31m“Fuzz or lose..."
38mAlice in Kernel Land: Lessons Learned From the eBPF Rabbit Hole
52mStructure aware fuzzing
11mIDFuzz: Intelligent Directed Grey-box Fuzzing