一句话：提出CovRL-Fuzz，用覆盖率反馈强化学习引导LLM变异，提升JavaScript解释器模糊测试覆盖与缺陷发现。
JavaScript解释器对现代浏览器至关重要，但严格的语法要求使模糊测试输入生成困难。现有基于语言模型的上下文感知变异虽有前景，却缺乏覆盖率引导。本文提出CovRL技术，将大语言模型与来自覆盖率反馈的强化学习结合。CovRL-Fuzz利用TF-IDF构建加权覆盖率图，并据此计算模糊测试奖励，再通过强化学习更新基于LLM的变异器，从而生成更可能探索新覆盖区域的测试用例，同时减少语法与语义错误，且无需额外后处理。评估表明，CovRL-Fuzz在提升代码覆盖率和识别JavaScript解释器缺陷方面优于当前最优模糊测试器；它在最新解释器中发现了58个真实安全相关缺陷，包括50个此前未知缺陷和15个CVE。
JavaScript interpreters, crucial for modern web browsers, require an effective fuzzing method to identify security-related bugs. However, the strict grammatical requirements for input present significant challenges. Recent efforts to integrate language models for context- aware mutation in fuzzing are promising but lack the necessary coverage guidance to be fully effective. This paper presents a novel technique called CovRL (Coverage-guided Reinforcement Learning) that combines Large Language Models (LLMs) with Reinforcement Learning (RL) from coverage feedback. Our fuzzer, CovRL-Fuzz, integrates coverage feedback directly into the LLM by leveraging the Term Frequency-Inverse Document Frequency (TF-IDF) method to construct a weighted coverage map. This map is key in calculating the fuzzing reward, which is then applied to the LLM-based mutator through reinforcement learning. CovRL-Fuzz, through this approach, enables the generation of test cases that are more likely to discover new coverage areas, thus improving bug detection while minimizing syntax and semantic errors, all without needing extra post-processing. Our evaluation results show that CovRL-Fuzz outperforms the state-of-the-art fuzzers in enhancing code coverage and identifying bugs in JavaScript interpreters: CovRL-Fuzz identified 58 real-world security-related bugs in the latest JavaScript interpreters, including 50 previously unknown bugs and 15 CVEs.
@inproceedings{paperbot8570,
title = {Fuzzing JavaScript Interpreters with Coverage-Guided Reinforcement Learning for LLM-Based Mutation},
author = {Jueon Eom and Seyeon Jeong and Taekyoung Kwon},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680389}
}