Performance Comparison of Prompt Engineering and Fine-Tuning Approaches for Fuzz Driver Generation Using Large Language Models
摘要
Fuzz test is known as a dynamic testing method, which is reasonably effective at detecting security vulnerabilities and abnormal conditions by providing irregular inputs to the program and observing its response. The efficiency and application scope of fuzz test heavily depends on the quality of the fuzz driver that constructs appropriate inputs for the target function. However, it requires an enormous amount of time and professional knowledge to generate a high-quality fuzz driver. For that reason, numerous studies about automation of fuzz driver generation using LLM are being conducted recently. In this study, the performance difference between prompt engineering and fine-tuning is evaluated by the fuzz driver creation method using LLM. To do so, two types of data set were built based on prompt data used in OSS-Fuzz-gen and a fuzz driver source code collected from the project Introspector, and fine-tuning on GPT-3.5 Turbo Model was conducted. Performance evaluation was carried out based on line, function, and region coverage, as well as the success of target function invocations. As a result of this evaluation, the fine-tuning based model demonstrated overall superior performance compared to prompt-based model.