Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzing

Myles Foley, Sergio Maffeis, Muhammad Fakhrur Rozi, Takeshi Takahashi

TL;DR

The paper tackles the inefficiency of random mutation location selection in JavaScript fuzzing by framing the problem as a contextual combinatorial bandit with volatile, variable-length test cases. It introduces Clutch, an attention-based neural bandit that uses a Pointer Network and Concrete Dropout to adapt exploration and predict which mutation targets to apply. Empirical evaluation shows Clutch improves test-case validity by about 20.3% and coverage-per-test-case by about 8.9% across fuzzers and engines, and achieves substantially lower regret than state-of-the-art bandits in volatile and combinatorial settings. The results demonstrate that learning where to mutate can significantly enhance fuzzing efficiency, with CLUTCH outperforming both deep and linear bandits and generalizing across different JavaScript engines and fuzzing strategies. The approach has practical impact for bug discovery and could be extended to other domains with volatile, high-dimensional action spaces and contextual inputs.

Abstract

JavaScript engines are widely used in web browsers, PDF readers, and server-side applications. The rise in concern over their security has led to the development of several targeted fuzzing techniques. However, existing approaches use random selection to determine where to perform mutations in JavaScript code. We postulate that the problem of selecting better mutation targets is suitable for combinatorial bandits with a volatile number of arms. Thus, we propose CLUTCH, a novel deep combinatorial bandit that can observe variable length JavaScript test case representations, using an attention mechanism from deep learning. Furthermore, using Concrete Dropout, CLUTCH can dynamically adapt its exploration. We show that CLUTCH increases efficiency in JavaScript fuzzing compared to three state-of-the-art solutions by increasing the number of valid test cases and coverage-per-testcase by, respectively, 20.3% and 8.9% on average. In volatile and combinatorial settings we show that CLUTCH outperforms state-of-the-art bandits, achieving at least 78.1% and 4.1% less regret in volatile and combinatorial settings, respectively.

Clutch Control: An Attention-based Combinatorial Bandit for Efficient Mutation in JavaScript Engine Fuzzing

TL;DR

The paper tackles the inefficiency of random mutation location selection in JavaScript fuzzing by framing the problem as a contextual combinatorial bandit with volatile, variable-length test cases. It introduces Clutch, an attention-based neural bandit that uses a Pointer Network and Concrete Dropout to adapt exploration and predict which mutation targets to apply. Empirical evaluation shows Clutch improves test-case validity by about 20.3% and coverage-per-test-case by about 8.9% across fuzzers and engines, and achieves substantially lower regret than state-of-the-art bandits in volatile and combinatorial settings. The results demonstrate that learning where to mutate can significantly enhance fuzzing efficiency, with CLUTCH outperforming both deep and linear bandits and generalizing across different JavaScript engines and fuzzing strategies. The approach has practical impact for bug discovery and could be extended to other domains with volatile, high-dimensional action spaces and contextual inputs.

Abstract

JavaScript engines are widely used in web browsers, PDF readers, and server-side applications. The rise in concern over their security has led to the development of several targeted fuzzing techniques. However, existing approaches use random selection to determine where to perform mutations in JavaScript code. We postulate that the problem of selecting better mutation targets is suitable for combinatorial bandits with a volatile number of arms. Thus, we propose CLUTCH, a novel deep combinatorial bandit that can observe variable length JavaScript test case representations, using an attention mechanism from deep learning. Furthermore, using Concrete Dropout, CLUTCH can dynamically adapt its exploration. We show that CLUTCH increases efficiency in JavaScript fuzzing compared to three state-of-the-art solutions by increasing the number of valid test cases and coverage-per-testcase by, respectively, 20.3% and 8.9% on average. In volatile and combinatorial settings we show that CLUTCH outperforms state-of-the-art bandits, achieving at least 78.1% and 4.1% less regret in volatile and combinatorial settings, respectively.
Paper Structure (43 sections, 5 equations, 8 figures, 7 tables, 1 algorithm)

This paper contains 43 sections, 5 equations, 8 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Contextual Bandit Variants.
  4. Fuzzing Strategies.
  5. RL for Testing.
  6. Bandits for Software Testing.
  7. Fuzzing JavaScript Engines.
  8. JavaScript representation.
  9. Mutations.
  10. Challenges in targeting mutations
  11. Large search space.
  12. Complexity of JavaScript.
  13. Our Approach
  14. Motivation
  15. Clutch Control
  16. ...and 28 more sections

Figures (8)

  • Figure 1: The Clutch architecture shown within a fuzzer.
  • Figure 2: Analysis of 10,000 mutated test cases by Clutch and the equivalent fuzzer when tested on V8. The left column shows the percentage difference from Clutch selection in its top ten selected instructions per mutation. The right column shows the difference between clutch and the baseline fuzzer in terms of the errors caused per mutation.
  • Figure 3: Frequency of branches in V8 that are reached from 10,000 test cases from Fuzzilli and FClutch.
  • Figure 4: Throughput of test cases (five run average and standard deviation) from 24h fuzzing of JavaScript engines.
  • Figure 5: Distribution of error types caused by 10,000 test cases from different fuzzers, when testing on V8.
  • ...and 3 more figures