Fuzz test is known as a dynamic testing method, which is reasonably effective at detecting security vulnerabilities and abnormal conditions by providing irregular inputs to the program and observing its response. The efficiency and application scope of fuzz test heavily depends on the quality of the fuzz driver that constructs appropriate inputs for the target function. However, it requires an enormous amount of time and professional knowledge to generate a high-quality fuzz driver. For that reason, numerous studies about automation of fuzz driver generation using LLM are being conducted recently. In this study, the performance difference between prompt engineering and fine-tuning is evaluated by the fuzz driver creation method using LLM. To do so, two types of data set were built based on prompt data used in OSS-Fuzz-gen and a fuzz driver source code collected from the project Introspector, and fine-tuning on GPT-3.5 Turbo Model was conducted. Performance evaluation was carried out based on line, function, and region coverage, as well as the success of target function invocations. As a result of this evaluation, the fine-tuning based model demonstrated overall superior performance compared to prompt-based model.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Performance Comparison of Prompt Engineering and Fine-Tuning Approaches for Fuzz Driver Generation Using Large Language Models

  • Sanggu Kim,
  • Sun-young Lee

摘要

Fuzz test is known as a dynamic testing method, which is reasonably effective at detecting security vulnerabilities and abnormal conditions by providing irregular inputs to the program and observing its response. The efficiency and application scope of fuzz test heavily depends on the quality of the fuzz driver that constructs appropriate inputs for the target function. However, it requires an enormous amount of time and professional knowledge to generate a high-quality fuzz driver. For that reason, numerous studies about automation of fuzz driver generation using LLM are being conducted recently. In this study, the performance difference between prompt engineering and fine-tuning is evaluated by the fuzz driver creation method using LLM. To do so, two types of data set were built based on prompt data used in OSS-Fuzz-gen and a fuzz driver source code collected from the project Introspector, and fine-tuning on GPT-3.5 Turbo Model was conducted. Performance evaluation was carried out based on line, function, and region coverage, as well as the success of target function invocations. As a result of this evaluation, the fine-tuning based model demonstrated overall superior performance compared to prompt-based model.