title: FuzzCoder: Byte-level Fuzzing Test via Large Language Model
summary: Fuzzing is an important dynamic program analysis technique designed for
  finding vulnerabilities in complex software. Fuzzing involves presenting a
  target program with crafted malicious input to cause crashes, buffer overflows,
  memory errors, and exceptions. Crafting malicious inputs in an efficient manner
  is a difficult open problem and the best approaches often apply uniform random
  mutations to pre-existing valid inputs. In this work, we propose to adopt
  fine-tuned large language models (FuzzCoder) to learn patterns in the input
  files from successful attacks to guide future fuzzing explorations.
  Specifically, we develop a framework to leverage the code LLMs to guide the
  mutation process of inputs in fuzzing. The mutation process is formulated as
  the sequence-to-sequence modeling, where LLM receives a sequence of bytes and
  then outputs the mutated byte sequence. FuzzCoder is fine-tuned on the created
  instruction dataset (Fuzz-Instruct), where the successful fuzzing history is
  collected from the heuristic fuzzing tool. FuzzCoder can predict mutation
  locations and strategies locations in input files to trigger abnormal behaviors
  of the program. Experimental results show that FuzzCoder based on AFL (American
  Fuzzy Lop) gain significant improvements in terms of effective proportion of
  mutation (EPM) and number of crashes (NC) for various input formats including
  ELF, JPG, MP3, and XML.
paper_authors._id: 66d7da557720d3992e5f7a18
paper_authors.name: Liqun Yang
paper_authors._id: 66d7da557720d3992e5f7a19
paper_authors.name: Jian Yang
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2024-10-14T19:04:30.629Z
paper_authors._id: 64ccb9bfead94891d12aef42
paper_authors.avatarUrl: /avatars/c54809d43d93d3f0766bd2555cecc4e3.svg
paper_authors.fullname: Yang Jian
paper_authors.type: user
paper_authors.user: CSJianYang
paper_authors._id: 66d7da557720d3992e5f7a1a
paper_authors.name: Chaoren Wei
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2024-09-06T09:22:24.740Z
paper_authors._id: 6565a1fdbfb751371830e69c
paper_authors.avatarUrl: /avatars/1da6f1a2a890d2dbd7cbbede28ca3aa6.svg
paper_authors.fullname: Chaoren Wei
paper_authors.type: user
paper_authors.user: WeiSumi
paper_authors._id: 66d7da557720d3992e5f7a1b
paper_authors.name: Guanglin Niu
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2024-09-06T09:22:31.933Z
paper_authors._id: 66c5f5a8b67d2b050b854888
paper_authors.avatarUrl: /avatars/6208398d750b692852c40f2c3087b427.svg
paper_authors.fullname: Guanglin Niu
paper_authors.type: user
paper_authors.user: ngl567
paper_authors._id: 66d7da557720d3992e5f7a1c
paper_authors.name: Ge Zhang
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2024-09-06T07:06:31.734Z
paper_authors._id: 638efcf4c67af472d316d424
paper_authors.avatarUrl: /avatars/97a57859d7d87a3a8f1bb41d32a72bc2.svg
paper_authors.fullname: Ge Zhang
paper_authors.type: user
paper_authors.user: zhangysk
paper_authors._id: 66d7da557720d3992e5f7a1d
paper_authors.name: Yunli Wang
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2024-09-06T09:20:12.283Z
paper_authors._id: 666a5e3dd7597fcf294f98a2
paper_authors.avatarUrl: /avatars/a3f4d3f4fa6b59f7faef6ec59ad15ade.svg
paper_authors.fullname: Yunli Wang
paper_authors.type: user
paper_authors.user: Pony12
paper_authors._id: 66d7da557720d3992e5f7a1e
paper_authors.name: Linzheng ChaI
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2024-09-06T09:20:18.301Z
paper_authors._id: 64ba096e760936217a3ad2e2
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/64ba096e760936217a3ad2e2/aNQK83Jg5PsBkY0UDg-RA.jpeg
paper_authors.fullname: Linzheng Chai
paper_authors.type: user
paper_authors.user: Challenging666
paper_authors._id: 66d7da557720d3992e5f7a1f
paper_authors.name: Wanxu Xia
paper_authors._id: 66d7da557720d3992e5f7a20
paper_authors.name: Hongcheng Guo
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2024-09-06T09:20:57.153Z
paper_authors._id: 60ff653699f651283c017df7
paper_authors.avatarUrl: /avatars/075257e8d7fefc43be24738f978ea5c3.svg
paper_authors.fullname: Hongcheng Guo
paper_authors.type: user
paper_authors.user: hongcheng
paper_authors._id: 66d7da557720d3992e5f7a21
paper_authors.name: Shun Zhang
paper_authors._id: 66d7da557720d3992e5f7a22
paper_authors.name: Jiaheng Liu
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2024-09-06T09:21:45.415Z
paper_authors._id: 65377c30e48353201e6fdda0
paper_authors.avatarUrl: /avatars/a8f803b6f2e598eaee9c52c0d2ddfc16.svg
paper_authors.fullname: Jiaheng Liu
paper_authors.type: user
paper_authors.user: CheeryLJH
paper_authors._id: 66d7da557720d3992e5f7a23
paper_authors.name: Yuwei Yin
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2024-09-06T07:06:29.797Z
paper_authors._id: 64510a21f800611f94f0d9f8
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/noauth/lOeHK9Bvt3IXcB7Urx6jZ.jpeg
paper_authors.fullname: Yuwei Yin
paper_authors.type: user
paper_authors.user: yuweiyin
paper_authors._id: 66d7da557720d3992e5f7a24
paper_authors.name: Junran Peng
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2024-09-06T09:21:51.754Z
paper_authors._id: 62c11a7360edb2dd7765b80d
paper_authors.avatarUrl: /avatars/92db3258d0ba44daee22952f0644cd93.svg
paper_authors.fullname: Junran Peng
paper_authors.type: user
paper_authors.user: JrPeng
paper_authors._id: 66d7da557720d3992e5f7a25
paper_authors.name: Jiaxin Ma
paper_authors._id: 66d7da557720d3992e5f7a26
paper_authors.name: Liang Sun
paper_authors._id: 66d7da557720d3992e5f7a27
paper_authors.name: Zhoujun Li
paper_title: FuzzCoder: Byte-level Fuzzing Test via Large Language Model
paper_summary: Fuzzing is an important dynamic program analysis technique designed for
  finding vulnerabilities in complex software. Fuzzing involves presenting a
  target program with crafted malicious input to cause crashes, buffer overflows,
  memory errors, and exceptions. Crafting malicious inputs in an efficient manner
  is a difficult open problem and the best approaches often apply uniform random
  mutations to pre-existing valid inputs. In this work, we propose to adopt
  fine-tuned large language models (FuzzCoder) to learn patterns in the input
  files from successful attacks to guide future fuzzing explorations.
  Specifically, we develop a framework to leverage the code LLMs to guide the
  mutation process of inputs in fuzzing. The mutation process is formulated as
  the sequence-to-sequence modeling, where LLM receives a sequence of bytes and
  then outputs the mutated byte sequence. FuzzCoder is fine-tuned on the created
  instruction dataset (Fuzz-Instruct), where the successful fuzzing history is
  collected from the heuristic fuzzing tool. FuzzCoder can predict mutation
  locations and strategies locations in input files to trigger abnormal behaviors
  of the program. Experimental results show that FuzzCoder based on AFL (American
  Fuzzy Lop) gain significant improvements in terms of effective proportion of
  mutation (EPM) and number of crashes (NC) for various input formats including
  ELF, JPG, MP3, and XML.
paper_ai_summary: A framework uses fine-tuned large language models to guide input mutation in fuzzing, improving the detection of software vulnerabilities.
paper_ai_keywords: fine-tuned large language models FuzzCoder sequence-to-sequence modeling instruction dataset Fuzz-Instruct effective proportion of mutation number of crashes