Fuzz in the Dark: Genetic Algorithm for Black-Box Fuzzing - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2013

Fuzz in the Dark: Genetic Algorithm for Black-Box Fuzzing

Fabien Duchene
  • Function : Author
  • PersonId : 769095
  • IdRef : 179830104

Abstract

Fuzzing (aka Fuzz-Testing) consists of automatically creating and evaluating inputs towards discovering vulnerabilities. Traditional undirected fuzzing may get stuck into one direction and thus may not be efficient in finding a broad range of local optima. In this work, we combine artificial intelligence and security testing techniques to guide the fuzzing via an evolutionary algorithm. Our work is the first application of a genetic algorithm for black-box fuzzing for vulnerability detection. We designed heuristics for fuzzing PDF interpreters searching for memory corruption vulnerabilities and for fuzzing websites for cross site scripting. Our evolutionary fuzzers ShiftMonkey and KameleonFuzz outperform traditional black-box fuzzers both in vulnerability detection capabilities and efficiency.
No file

Dates and versions

hal-00978844 , version 1 (14-04-2014)

Identifiers

  • HAL Id : hal-00978844 , version 1

Cite

Fabien Duchene. Fuzz in the Dark: Genetic Algorithm for Black-Box Fuzzing. Black-Hat, 2013, São Paulo, Brazil. ⟨hal-00978844⟩
1242 View
1 Download

Share

Gmail Facebook Twitter LinkedIn More