FuzzDistill: Intelligent Fuzzing Target Selection using Compile-Time Analysis and Machine Learning

TL;DR

FuzzDistill leverages compile-time analysis and machine learning to prioritize fuzzing targets, significantly reducing testing time while improving vulnerability detection efficiency.

Contribution

This work introduces a novel method combining compile-time data and machine learning for intelligent fuzzing target selection.

Findings

Substantial reduction in fuzz testing time.

Improved identification of vulnerable code areas.

Effective on real-world software.

Abstract

Fuzz testing is a fundamental technique employed to identify vulnerabilities within software systems. However, the process can be protracted and resource-intensive, especially when confronted with extensive codebases. In this work, I present FuzzDistill, an approach that harnesses compile-time data and machine learning to refine fuzzing targets. By analyzing compile-time information, such as function call graphs' features, loop information, and memory operations, FuzzDistill identifies high-priority areas of the codebase that are more probable to contain vulnerabilities. I demonstrate the efficacy of my approach through experiments conducted on real-world software, demonstrating substantial reductions in testing time.