Learning to Fuzz from Symbolic Execution with Application to Smart Contracts

By Jingxuan He, Mislav Balunovic, Nodar Ambroladze, Petar Tsankov, Martin T. Vechev. Conference on Computer and Communications Security, 2019

295 citations recorded by the source corpus.

Fuzzing and symbolic execution are two complementary techniques for discovering software vulnerabilities. Fuzzing is fast and scalable, but can be ineffective when it fails to randomly select the right inputs. Symbolic execution is thorough but slow and often does not scale to deep program paths with complex path conditions. In this work, we propose to learn an effective and fast fuzzer from symbolic execution, by phrasing the learning task in the framework of imitation learning. During learning, a symbolic execution expert generates a large number of quality inputs improving coverage on thousands of programs. Then, a fuzzing policy, represented with a suitable architecture of neural networks, is trained on the generated dataset. The learned policy can then be used to fuzz new programs. We instantiate our approach to the problem of fuzzing smart contracts, a domain where contracts often implement similar functionality (facilitating learning) and security is of utmost importance. We present an end-to-end system, ILF (for Imitation Learning based Fuzzer), and an extensive evaluation over >18K contracts. Our results show that ILF is effective: (i) it is fast, generating 148 transactions per second, (ii) it outperforms existing fuzzers (e.g., achieving 33% more coverage), and (iii) it detects more vulnerabilities than existing fuzzing and symbolic execution tools for Ethereum.

Subfields: Artificial Intelligence, Software, Signal Processing

View Paper: https://www.semanticscholar.org/paper/bdef2c6323ba6e02ac8ff265d3652bc5027b3d97

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

  1. Sheng Wen
  2. Seyit Ahmet Camtepe
  3. Yang Xiang

In Software

  1. Sheng Wen
  2. Seyit Ahmet Camtepe
  3. Xiaogang Zhu
  4. Yang Xiang

In Signal Processing

  1. Sheng Wen
  2. Seyit Ahmet Camtepe
  3. Xiaogang Zhu
  4. Yang Xiang

Citations in the corpus