VERTFuzz: Version transformer-driven fuzzing for complex file parsers

Abstract

Fuzzing test technology has seen significant growth in recent years and has evolved into an important tool for more thoroughly and efficiently identifying programme vulnerabilities and defects. However, fuzzing test for complex format files remains challenging. Most fuzz testers require extensive expert knowledge and heavily rely on manually constructed format models, or struggle to accurately identify complex structural relationships, resulting in numerous invalid test variants. In this paper, we propose a metadata-based mutation technique that leverages deep learning models to identify metadata location information and incorporate it into specific mutations, enabling rapid identification of file structures. We also utilise the Version Transformer model to filter out valid test cases from the queue, effectively addressing the issue of sparse defect space in input, making the mutated test cases more effective. Experimental results show that VERTFuzz has identified 32 unique errors across ten different programs, including four complex file formats. On average, VERTFuzz discovered 29% more paths and 14.54% more code blocks than AFL++.