Analyzing 1-day vulnerabilities is a critical task in software security, but it is often challenging to reproduce the bugs due to the lack of information about the vulnerabilities. In this paper, we explore how Large Language Models (LLMs) can be leveraged to generate inputs that trigger specific vulnerabilities. There are two main challenges: LLMs must (1) correctly analyze the target vulnerability and (2) identify relevant fields to generate meaningful program inputs. We address these challenges through a three-stage prompting approach, where we provide necessary information at each stage, guiding the LLM to ultimately generate input for reproducing the target bug. By using these generated inputs as seeds for directed fuzzing, we show that our strategy can effectively generate useful inputs for vulnerability reproduction.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Short Paper: Systematic Bug Reproduction with Large Language Model

  • Sanghyun Park,
  • Haeun Lee,
  • Sang Kil Cha

摘要

Analyzing 1-day vulnerabilities is a critical task in software security, but it is often challenging to reproduce the bugs due to the lack of information about the vulnerabilities. In this paper, we explore how Large Language Models (LLMs) can be leveraged to generate inputs that trigger specific vulnerabilities. There are two main challenges: LLMs must (1) correctly analyze the target vulnerability and (2) identify relevant fields to generate meaningful program inputs. We address these challenges through a three-stage prompting approach, where we provide necessary information at each stage, guiding the LLM to ultimately generate input for reproducing the target bug. By using these generated inputs as seeds for directed fuzzing, we show that our strategy can effectively generate useful inputs for vulnerability reproduction.