ISSN: 2583-9888

DOI: [Link]/10.51219/JAIMLD/priyank-anurag/114

Journal of Artificial Intelligence, Machine Learning and Data Science

[Link]

Vol: 2 & Iss: 1 Research Article

Secure Software Development using Fuzzing Techniques

Priyank Rathod* and Anurag

Intel Corporation Folsom, CA, USA

Citation: Rathod P, Anurag. Secure Software Development using Fuzzing Techniques. J Artif Intell Mach Learn & Data Sci 2024,
2(1), 411-414. DOI: [Link]/10.51219/JAIMLD/priyank-anurag/114
Received: 01 January, 2024; Accepted: 18 January, 2024; Published: 20 January, 2024
*Corresponding author: Priyank Jayantilal Rathod, Intel Corporation Folsom, CA, USA, E-mail: rathodpriyank@[Link]
Copyright: © 2024 Rathod P, et al., Enhancing Supplier Relationships: Critical Factors in Procurement Supplier Selection.., This
is an open-access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted
use, distribution, and reproduction in any medium, provided the original author and source are credited.

ABSTRACT
Fuzzing is a method to try out random input samples to find bugs and vulnerabilities in the software application, where most
software testing is limited to unit tests and static and dynamic code analysis. In recent years, after the heartbleed bug was found in
a widely used open-source library, it became evident that secure testing is paramount for any software application used anywhere.
As people are becoming increasingly reliant on the latest technologies and getting used to working more efficiently than ever, it
becomes a necessity rather than a requirement to validate the software in all possible scenarios unimagined by the developer or
the validation team. Fuzzing is becoming popular rapidly to secure systems for future attacks and vulnerabilities due to a lack of
proper testing and secure code reviews.
Keywords: Secure Software, Fuzzing, Software Testing, Secure Coding, Bug & Vulnerability Detection, System Crash

1. Introduction Borzacchiello et al. 1propose a novel approximate solver

called Fuzzy-Sat for concolic and hybrid fuzzing engines.
The World depends on software now more than ever. As the
Traditional consoles and hybrid fuzzing engines rely on
day goes by, the complexity of software systems and applications
Satisfiability Modulo Theories (SMT) solvers to explain the
is growing exponentially. Growing usage of software would
symbolic expressions generated during execution. But, the
increase the threat and put the systems running this software
SMT solvers can be expensive and time-consuming, especially
in harm’s way in unimaginable ways. There are many critical
for complex expressions. Fuzzy-Sat addresses this challenge
systems running these software applications. Fuzzing is a
by providing an approximate solution that is faster than SMT
technique where vulnerabilities would be found using various
solvers while still being able to find bugs effectively. 2Pham,
methods, such as malformed or out-of-bound input values. It adds
2023 describes AFLSmart++ as an extension of the AFLSmart
significant value to any software application used in mission-
grey box fuzzer that improves its effectiveness and usability.
critical systems. Fuzzing generally operates on significant,
AFLSmart is a structure-aware greybox fuzzer designed for
unpredicted, unexpected inputs to make software applications
testing programs that take highly structured inputs, such as PNG,
behave abnormally and either crash or hang the system to
PDF, and WAV files. AFLSmart++ improves upon AFLSmart in
identify the weak entry point for any software application. The
several ways. First, it introduces new structure-aware mutation
most common vulnerabilities in any software application are
operators more effective at generating valid and interesting test
memory-related, which can be exploited to gain unauthorized
inputs. Second, it presents a composite input model that allows
access to the system and its confidential information.
AFLSmart++ to handle more complex file formats.

1
Rathod P, et al., J Artif Intell Mach Learn & Data Sci | Vol: 2 & Iss:1

The paper outlines the need for fuzzing methods to ensure input would be unexpected data or symbols, out-of-range
the software The development process incorporates these testing values, or something totally out of any expectation input. These
methods to mitigate any potential vulnerabilities in software inputs would be sent or bombarded to the software to make
applications in the future. In particular, we will detail the various it malfunction or crash. fundamentally, fuzzing mutates and
fuzzing methods, including which method is more effective than twists the inputs in some peculiar combinations. It is the most
others to achieve a higher degree of confidence in any software unconventional way to stress-test the software without rules or
application. predefined values.
2. Background
This section briefly explains why secure software development
is required for maximum defense against future threats. Many
techniques currently used are inadequate to discover these threats
beforehand; hence, more advanced techniques, such as fuzzing,
are required. The most commonly used techniques are static
analysis, dynamic analysis, symbolic execution, and advanced
fuzzing, based on various methods and algorithms. Static
analysis is one of the fastest methods to scan the source code
and sometimes the object code to detect the vulnerability. While
it is the quickest method, sometimes it can be a false positive,
but the good thing is that all the issues can be addressed without
running the code, saving the over-detection time. In contrast,
dynamic analysis runs the program and monitors it in real-time
to detect the issues. It offers slower speed but higher accuracy
and fewer false positives for the code. Often, it includes human
interfaces, which require strong technical skills to debug and fix
them. Because of human intervention, it is not easily scalable to
perform the analysis on larger systems. The symbolic execution
method maintains the set of constraints for each execution path
used in program inputs. When application execution interacts
with components out of The environment, as explained, there
would be system calls, APIs, or unreliable signals, and false
positives would increase exponentially with the application. It is
tricky and time-consuming to scale this type of threat detection.
The last technique is the most advanced out of all of the others
and has its own merits. It secures the application or system from
current and future threats before they can happen.
3. Fuzzing
Several fuzzers are used based on their purpose and need.
Based on the input, some of them are called generative and
mutation fuzzers. Generative fuzzers are there to generate the
inputs that rely on the random lines of slightly manipulated data.
whereas mutation fuzzers take valid inputs and mutate them to
trigger the crash.
Other types of fuzzers are based on the awareness of the
different sets of developers or validators. There are three types The aim of running these sorts of stress testing is to expose
of fuzzing in this approach. If it is black-box fuzzing in this the issues, bugs, crashes, vulnerabilities, security holes, and
approach, the software would be viewed as a black box, and other unknown problems otherwise known. It is more like the
testers would not have any idea about the internal workings of simulation of real-world attacks before the software is released, so
the software; still, inputs are generated randomly to make it crash it is more like precautionary testing to build the secure software.
or hang. The second one is white box fuzzing, where the tester or While it sounds like a can-do-all tool, it has limitations, such as
validator is aware of the functionality and inner workings of the it won’t guarantee that it will be able to find 100% of the bugs
software to generate the input to make the software more reliable in the software. Also is time-consuming, and it would increase
using the fuzzing. The third type is grey box fuzzing, where the based on The complexity of the software is exponential, and last
approach is a hybrid, and the tester may have some knowledge but not least, it would require a secure coding background or
about the inner workings, but not all. Hence, it is more like a expertise to interpret these results and fix them.
hybrid.
4. Literature Survey
Fuzzing is a technique where inputs are provided so that the
D. Kuts 3presented a method for handling symbolic
software malfunctions/hangs, or crashes in specific scenarios.
addresses in dynamic symbolic execution. Symbolic addresses
The analogy would be throwing whatever input we can to the
are addresses that are not known at compile time but are instead
software entry points and seeing what makes the software
determined at runtime. This can make it difficult for dynamic
behave abnormally or, better, make it crash. The software’s
2
Rathod P, et al., J Artif Intell Mach Learn & Data Sci | Vol: 2 & Iss: 1

symbolic execution tools to reason about the control flow of mutation operators to these bytes to maximize the detection
a program, as they need to know which memory locations are rate10 studied the BUGOSS, a real-world benchmark for
valid. The method uses a combination of SMT solving and regression bugs found in the OSS-Fuzz. It is designed to be used
symbolic execution to reason about symbolic addresses. SMT to evaluate regression fuzzing techniques. Regression fuzzing
solving is used to determine the bounds of symbolic addresses, techniques are fuzzing techniques that are specifically designed
and symbolic execution is used to explore the possible values to find regressions, which are bugs that are introduced in a new
of symbolic addresses. This allows the tool to discover new version of a program. The BUGOSS benchmark can evaluate
execution paths that would otherwise be missed. It’s a promising the effectiveness of regression fuzzing techniques by comparing
new approach to handling symbolic addresses in dynamic their ability to find the bugs represented by the study artifacts11
symbolic execution. It can improve the tool’s accuracy and use reinforcement fuzzing, a newer approach that uses the
find new bugs in programs. 2Pham presented AFLSmart++, an learnings from past inputs to learn how to provide the inputs that
extension of the structure-aware grey box fuzzer AFLSmart. would likely find bugs in the software. Reinforcement fuzzing
AFLSmart++ improves AFLSmart in two main aspects: is effective in finding bugs in a variety of software programs.
structure-aware low-level mutation and composite input However, there are several challenges to using reinforcement
model. These tools make low-level mutations to data chunks, fuzzing, including the fact that it can be difficult to design good
fundamental building blocks for input data in any software rewards and that it can be computationally expensive to learn
application. At the same time, a composite input model provides policies. The benefits would be more efficient and faster than
a structured way for inputs to the software application. 4present other normal fuzzers.
Driller, a hybrid vulnerability excavation tool that combines
fuzzing and selective symbolic execution to find deeper bugs in
5. Conclusion
software. Traditional fuzzing is good at exploring large portions In conclusion, many methods exist to identify and secure
of the program’s state space, but it can struggle to find bugs that vulnerabilities in the code. Fuzzing is one of the most advanced
require satisfying complex path conditions. Symbolic execution, techniques, with its pitfalls, but it still has more coverage than
on the other hand, can be effective at finding such bugs, but it any other method. It is also proven to find any issues skipped
can be expensive and time-consuming to run on large programs. during the code reviews or the unit testing of the code base. It also
Driller addresses this challenge by using fuzzing to identify ensures that software works in all possible attack scenarios that
exciting paths in the program’s state space and then using would otherwise be catastrophic. It would be more effective if it
symbolic execution to generate inputs that satisfy the complex could be used in any continuous integration environment where
conditions on those paths. This allows Driller to find bugs that all the checked-in code is scanned for potential issues. Along
would be missed by traditional fuzzing or symbolic execution these lines, there are some fuzzers that are highly advanced in
alone. Generally, a driller is a powerful bug excavation tool that detecting bugs using reinforcement-based learning to find bugs
can find bugs rooted deep within software applications. by predicting potential inputs that would cause the program
to crash faster. So, in final remarks, fuzzing is a way forward,
C. Zhang et al. 5have presented a method to extract the
and using novel approaches surveyed in the paper, it is evident
features of a specific software application and use them to
that fuzzing would essentially become part of the development
recommend the methods to fuzz in the particular application
process at some point.
targeted. The critical thing to remember is before removing the
features from any software application, the developer needs 6. References
to determine which features are required, and based on the
requirement gathered from the developer or security researcher, 1. Borzacchiello L, Coppa E, Demetrescu C. Fuzzing Symbolic
the features are selected to select the appropriate fuzzer for Expressions. 2021 IEEE/ACM 43rd ICSE, 2021; 711-722.
the application6. proposed a malicious code image feature 2. Pham V-T. AFLSmart++: Smarter Greybox Fuzzing. 2023 IEEE/
extraction method based on entropy filtering. Introducing an ACM International Workshop on SBFT 2023; 76-79.
entropy filter helps identify the hidden patterns introduced by 3. Kuts D. Towards Symbolic Pointers Reasoning in Dynamic
specific packers and encryptors; therefore, this method performs Symbolic Execution. 2021 IVMEM 2021; 42-49.
better than the previous method. Due to the rise of deep learning
4. Stephens N, Grosen J, Salls C, et al. Driller: Augmenting fuzzing
technology and its wide application in the field of vulnerability through selective symbolic execution. NDSS ‘16 2016.
detection, more and more feature extraction will choose to use
5. Zhang C, Chen J. Fuzzing Methods Recommendation Based on
deep neural networks. 7proposed DL4MD. They introduced the
Feature Vectors. 2021 36th IEEE/ACM International Conference
stack autoencoder (SAE) model into malicious code analysis on Automated Software Engineering 2021; 1079-1081.
for the first time to realize unsupervised malicious code feature
extraction. 8Popov used convolutional neural networks (CNN) 6. Dey A, Bhattacharya S, Chaki N. Byte label malware classification
using image entropy: volume eight. Proceedings of the 2017
to extract code features. Automatic coding technology based IEEE International Conference on Advanced Computational and
on feature learning and recurrent neural networks based on Communication Paradigms 2019; 17-29.
classifiers is used to realize feature extraction of malicious code.
7. Hardy W, Chen L, Hou S, Ye Y, Li X. DL4MD: A deep learning
At the same time, there are some automatic tools to extract the framework for intelligent malware detection. Proceedings of the
characteristics of the target program, and most of them use 2016 Int’l Conf. Data Mining 2016; 61-67.
artificial intelligence technology.
8. Popov I. Malware detection using machine learning based
J. Shao et al. 9proposed a reinforcement learning-based on word2vec embeddings of machine code instructions.
fuzzing approach that can effectively improve the input and Proceedings of the 2017 SSDSE 2017; 1-4.
achieve higher code coverage. It would divide the fuzzing 9. Shao J, Zhou Y, Liu G, Zheng D. Optimized Mutation of Grey-
process into two stages: the stage where bytes causing the crash box Fuzzing: A Deep RL-based Approach. 2023 IEEE 12th
are identified and the The RL-based approach would apply DDCLS 2023; 1296-1300.

3
Rathod P, et al., J Artif Intell Mach Learn & Data Sci | Vol: 2 & Iss:1

10. Kim J, Hong S. BugOss: A regression bug benchmark for

empirical study of regression fuzzing techniques. 2023 IEEE
Conference on Software Testing, Verification and Validation
2023; 470-473.
11. Böttinger K, Godefroid P, Singh R. Deep reinforcement fuzzing.
2018 IEEE Security and Privacy Workshops 2018; 116-122.