Published Paper Details:

The integration of artificial intelligence (AI) and machine learning into fuzz testing, termed AI Fuzzing, presents a promising approach to enhancing software security by automating the identification of vulnerabilities through systematic input generation. However, traditional fuzz testing methods face significant limitations, particularly in their inability to encompass various attack types, leading to a critical gap in software protection prior to deployment. This study aims to explore the concept of AI Fuzzing, specifically focusing on the combination of coverage-guided and behavioral fuzzing techniques. The research employs a structured methodology utilizing OSS-Fuzz's Fuzz Introspector tool to identify under-fuzzed code segments, followed by an evaluation framework that generates and tests new fuzz targets using a large language model (LLM). The framework iteratively adjusts the fuzz targets based on observed outcomes, enhancing code coverage. The findings reveal prevalent software vulnerabilities, including memory leaks, injections, sensitive data exposure, insecure deserialization, buffer overflows, use-after-free errors, data races, and software crashes. These results underscore the effectiveness of AI-driven fuzz testing in revealing security flaws that traditional methods may overlook. The implications of this research highlight the potential for developers to leverage a variety of open-source fuzz testing tools, as well as enterprise solutions, to improve software security in diverse environments, particularly within larger development teams and DevOps settings. This study emphasizes the complementary nature of static code analysis and dynamic fuzz testing in identifying vulnerabilities, advocating for a holistic approach to software security.