Generating synthetic test cases for network fuzz testing
A system for generating synthetic test cases for fuzz testing. One example includes an electronic processor. The electronic processor is configured to pre-process training data, use the training data to train a discriminator DNN to evaluate a test case to determine whether the test case is likely to expose a software vulnerability, and use the discriminator DNN to train a generator DNN to generate a test case that is likely to expose a software vulnerability. The electronic processor uses the discriminator DNN to train the generator DNN by determining whether a test case generated by the generator DNN is likely to expose a software vulnerability and sending a determination of whether the test case generated by the generator DNN is likely to expose a software vulnerability to the generator DNN. The electronic processor is further configured to, when the generator DNN is trained, generate one or more test cases.
1. A system for generating synthetic test cases for fuzz testing, the system comprising:
an electronic processor configured to:
pre-process training data;
use the training data to train a discriminator DNN to evaluate a test case to determine whether the test case is likely to expose a software vulnerability;
use the discriminator DNN to train a generator DNN to generate a test case that is likely to expose a software vulnerability, wherein the electronic processor uses the discriminator DNN to train the generator DNN by determining whether a test case generated by the generator DNN is likely to expose a software vulnerability and sending a determination of whether the test case generated by the generator DNN is likely to expose a software vulnerability to the generator DNN; and
when the generator DNN is trained, generate, using the generator DNN, one or more test cases.
2. The system according to claim 1 , wherein the determination includes a label and a score.
3. The system according to claim 1 , wherein the electronic processor is configured to determine that the generator DNN is trained when a predetermined number of training sessions are completed.
4. The system according to claim 3 , wherein the electronic processor is configured to determine a training session is completed when the generator DNN produces a predetermined number of test cases likely to expose a software vulnerability.
5. The system according to claim 1 , wherein the electronic processor is configured to pre-process the training data by performing at least one selected from the group comprising padding the training data, normalizing the training data, re-formatting the training data, randomizing the order of the training data.
6. The system according to claim 1 , wherein the electronic processor is further configured to receive the training data from a historical data database, a target device, or both.
7. The system according to claim 1 , wherein the electronic processor is configured to:
send the one or more test cases from the generator DNN to a fuzzer; and
use the fuzzer to test a target device or software module by sending the target device or software module one or more messages based on the one or more test cases.
8. The system according to claim 7 , wherein the target device is an ECU included in a vehicle and configured to receive and send messages via a CAN bus.
9. The system according to claim 1 , wherein the electronic processor is configured to:
send the one or more test cases from the generator DNN to a fuzzer; and
use the fuzzer to evaluate source code for unhandled exceptions.
10. A method for generating synthetic test cases for fuzz testing, the method comprising:
pre-processing training data;
using the training data to train a discriminator DNN to evaluate a test case to determine whether the test case is likely to expose a software vulnerability;
using the discriminator DNN to train a generator DNN to generate a test case that is likely to expose a software vulnerability, wherein the discriminator DNN trains the generator DNN by determining whether a test case generated by the generator DNN is likely to expose a software vulnerability and sending a determination of whether the test case generated by the generator DNN is likely to expose a software vulnerability to the generator DNN; and
when the generator DNN is trained, generating, using the generator DNN, one or more test cases.
11. The method according to claim 10 , wherein the determination includes a label and a score.
12. The method according to claim 10 , the method further comprising determining that the generator DNN is trained when a predetermined number of training sessions are completed.
13. The method according to claim 12 , the method further comprising determining a training session is completed when the generator DNN produces a predetermined number of test cases likely to expose a software vulnerability.
14. The method according to claim 10 , wherein pre-processing the training data includes performing at least one selected from the group comprising padding the training data, normalizing the training data, re-formatting the training data, randomizing the order of the training data.
15. The method according to claim 10 , the method further comprising receiving the training data from a historical data database, a target device, or both.
16. The method according to claim 10 , the method further comprising:
sending the one or more test cases from the generator DNN to a fuzzer; and
using the fuzzer to test a target device or software module by sending the target device or software module one or more messages based on the one or more test cases.
17. The method according to claim 16 , wherein the target device is an ECU included in a vehicle and configured to receive and send messages via a CAN bus.
18. The method according to claim 10 , the method further comprising:
sending the one or more test cases from the generator DNN to a fuzzer; and
using the fuzzer to evaluate source code for unhandled exceptions.