[Paper Review] A Review of Machine Learning Applications in Fuzzing

Gary Saavedra, Kathryn Rodhouse+2 more|arXiv (Cornell University)|Jun 13, 2019

Face and Expression Recognition55 references33 citations

TL;DR

This paper surveys how machine learning has been applied to fuzzing, detailing where ML improves input generation and post-fuzzing tasks, and outlining challenges and future directions.

ABSTRACT

Fuzzing has played an important role in improving software development and testing over the course of several decades. Recent research in fuzzing has focused on applications of machine learning (ML), offering useful tools to overcome challenges in the fuzzing process. This review surveys the current research in applying ML to fuzzing. Specifically, this review discusses successful applications of ML to fuzzing, briefly explores challenges encountered, and motivates future research to address fuzzing bottlenecks.

Motivation & Objective

• Summarize how ML techniques have been applied to fuzzing with a focus on vulnerability assessment.
• Identify which ML approaches (supervised, unsupervised, reinforcement learning) have been most effective in input generation and post-fuzzing tasks.
• Highlight challenges in integrating ML with fuzzing and suggest directions for future research.

Proposed method

• Review existing literature on ML applications in fuzzing across input generation and post-fuzzing tasks.
• Categorize ML techniques by learning type (supervised, unsupervised, reinforcement learning) and by fuzzing stage.
• Discuss the role of symbolic execution in conjunction with ML-based input generation.
• Present a framework for evaluating fuzzers and comparing ML-enabled fuzzers where possible.

Experimental results

Research questions

• RQ1 What ML techniques have been applied to generate inputs in fuzzing, and with what impact on code coverage or path exploration?
• RQ2 How have ML methods been used in post-fuzzing tasks such as crash triage and root-cause analysis?
• RQ3 What are the main challenges in applying ML to fuzzing (e.g., training costs, format dependency, reward definitions in RL)?
• RQ4 What future research directions can address bottlenecks in fuzzing when ML is employed?

Key findings

• Unsupervised learning, particularly genetic algorithms, and deep learning have shown promise for input generation in fuzzers.
• DL approaches can improve code coverage for some formats (e.g., PDF, ELF, XML, PNG) but results are format-dependent and not universally superior.
• Reinforcement learning has been explored for input generation, with reward design and program representation identified as critical factors.
• Symbolic execution can augment input generation to improve coverage but remains computationally expensive and imperfect.
• Post-fuzzing ML applications primarily focus on crash triage and root-cause categorization using supervised or unsupervised methods.
• There are notable gaps, including a lack of ML work on input minimization and corpus minimization.