An Intelligent Fuzzing Data Generation Method Based on Deep Adversarial Learning

Zhihui Li

doi:10.1109/ACCESS.2019.2911121

2019-01-01

黄滟鸿 (Yanhong Huang) *

Jiawen Xiong

DOI：10.1109/ACCESS.2019.2911121

原文链接

查看原文

摘要

En 中文

Fuzzing (Fuzz testing) can effectively identify security vulnerabilities in software by providing a large amount of unexpected input to the target program. An important part of fuzzing test is the fuzzing data generation. Numerous traditional methods to generate fuzzing data have been developed, such as model-based fuzzing data generation and random fuzzing data generation. These techniques require the specification of the input data format or analyze the input data format by manual reverse engineering. In this paper, we introduce an approach using Wasserstein generative adversarial networks (WGANs), a deep adversarial learning method, to generate fuzzing data. This method does not require defining the input data format. To the best of our knowledge, this study is the first to use a WGAN-based method to generate fuzzing data. Industrial security has been an important and pressing issue globally. Network protocol fuzzing plays a significant role in ensuring the safety and reliability of industrial control systems (ICSs). Thus, the proposed method is significant for ICS testing. In the experiment, we use an industrial control protocol such as the Modbus-TCP protocol and EtherCAT protocol as our test target. Results indicate that this approach is more intelligent and capable than the methods used in previous studies. In addition, owing to its design, this model can be trained within a short time, which is computationally light and practical.

Keyword:

Automated vulnerability mining

deep adversarial learning

fuzzing

security testing

industrial security

industrial control protocol

protocol format learning