Learning Based Fuzzing with AALpy

Learning-based fuzzing is a technique for stateful fuzzing of black-box systems.

Following code snipped show how it can be set up with AALpy (on the high level).

imports ...

# Learning has been performed and result is saved in the base_model
base_model = run_Lstar(alphabet, normalSUL, eq_oracle)

# Fuzzing SULs, as defined in previously mentioned paper
# we suggest 
#  implementing trace_with_concrete_values() in FuzzingSUL class
#    it performs inputs with concrete values and returns associated output
#  keeping the concrete values in the sul.concrete_trace list
#  that way, reproducibility is assured

fuzzing_suls = [FuzzingSUL(system1), FuzzingSUL(system2), FuzzingSUL(system3)]

while True:
    for sul in fuzzing_suls:
        eo  = StatePrefixEqOracle(sul=sul, alphabet=alphabet, walks_per_state=20, walk_len=10)
        cex = eo.find_cex(base_model)
        if cex:
            print("Counterexample found")
            print("Inputs values", cex)
            print("Concrete values",sul.concrete_trace)

            base_model.reset_to_initial()
            output_base = [base_model.step(i) for i in cex]
            sul.post()
            sul.pre()

            output_sul = [sul.trace_with_concrete_values(i,c) for i,c in zip(cex, sul.concrete_trace)]

            print("Model Output", output_base)
            print("SUF Output", output_sul)