# NEUZZ: Efficient Fuzzing with Neural Program Smoothing

**Authors:** Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray, Suman Jana  
**arXiv:** [1807.05620](https://arxiv.org/abs/1807.05620)  
**Date:** 2018-07-15  
**Summary page:** https://www.summarizepaper.com/en/paper/1807.05620v4/

## Key points

- NEUZZ is a new fuzzing technique developed to efficiently find software vulnerabilities.
- Fuzzing is used to generate inputs that can trigger different bugs in software.
- Existing state-of-the-art fuzzers are not very efficient at finding hard-to-trigger software bugs.
- Gradient-guided optimization has been shown to outperform evolutionary algorithms in domains like machine learning by utilizing gradients or higher-order derivatives of the underlying function.
- However, gradient-guided approaches are not directly applicable to fuzzing as real-world program behaviors contain many discontinuities, plateaus and ridges where the gradient-based methods often get stuck.
- NEUZZ proposes a novel program smoothing technique using surrogate neural network models that can incrementally learn smooth approximations of a complex, real-world program's branching behaviors.
- This approach creates a smooth surrogate function approximating the discrete branching behavior of target programs and enables gradient-guided input generation schemes to improve the fuzzing efficiency.
- NEUZZ significantly outperforms 10 state-of-the art graybox fuzzers on 10 real world programs both at finding new bugs and achieving higher edge coverage.
- NEUZZ found 31 unknown bugs that other fuzzers failed to find in 10 real world programs and achieved 3X more edge coverage than all of the tested graybox fuzzers for 24 hours running.
- The authors behind NEUZZ include Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray and Suman Jana who presented their findings at the 40th IEEE Symposium on Security and Privacy held from May 20 - 22 in San Francisco.

## Summary

NEUZZ is a new fuzzing technique developed to efficiently find software vulnerabilities. Fuzzing is a popular technique used to generate inputs that can trigger different bugs in software. However, existing state-of-the-art fuzzers are not very efficient at finding hard-to-trigger software bugs. Most popular fuzzers use evolutionary guidance to generate inputs but such algorithms often get stuck in fruitless sequences of random mutations. Gradient-guided optimization presents an alternative to evolutionary guidance and has been shown to outperform evolutionary algorithms in domains like machine learning by utilizing gradients or higher-order derivatives of the underlying function. However, gradient-guided approaches are not directly applicable to fuzzing as real-world program behaviors contain many discontinuities, plateaus and ridges where the gradient-based methods often get stuck. To address this problem, NEUZZ proposes a novel program smoothing technique using surrogate neural network models that can incrementally learn smooth approximations of a complex, real-world program's branching behaviors. This approach creates a smooth surrogate function approximating the discrete branching behavior of target programs and enables gradient-guided input generation schemes to improve the fuzzing efficiency. The extensive evaluations demonstrate that NEUZZ significantly outperforms 10 state-of-the art graybox fuzzers on 10 real world programs both at finding new bugs and achieving higher edge coverage. NEUZZ found 31 unknown bugs that other fuzzers failed to find in 10 real world programs and achieved 3X more edge coverage than all of the tested graybox fuzzers for 24 hours running. The authors behind NEUZZ include Dongdong She, Kexin Pei, Dave Epstein, Junfeng Yang, Baishakhi Ray and Suman Jana who presented their findings at the 40th IEEE Symposium on Security and Privacy held from May 20 - 22 in San Francisco.