Dans le cadre de notre séminaire « La Cybersécurité sur un plateau » (Cybersecurity on a Plate), nous aurons deux interventions le 30 mai. Le séminaire CoaP aura lieu à 10h dans le bâtiment IMT/TP/TSP, en salle 3.A213.

Michaël Marcozzi (CEA) - Fine-Grained Coverage-Based Fuzzing

Fuzzing is a popular software testing method that discovers vulnerabilities by massively feeding target applications with automatically generated inputs. Many state-of-art fuzzers use branch coverage as a feedback metric to guide the fuzzing process. The fuzzer retains inputs for further mutation only if branch coverage is increased. However, branch coverage only provides a shallow sampling of program behaviours and hence may discard interesting inputs to mutate. This work aims at taking advantage of the large body of research over defining finer-grained code coverage metrics (such as control-flow, data-flow or mutation coverage) and at evaluating how fuzzing performance is impacted when using these metrics to select interesting inputs for mutation. We propose to make branch coverage-based fuzzers support most fine-grained coverage metrics out of the box (i.e., without changing fuzzer internals). We achieve this by making the test objectives defined by these metrics (such as conditions to activate or mutants to kill) explicit as new branches in the target program. Fuzzing such a modified target is then equivalent to fuzzing the original target, but the fuzzer will also retain inputs covering the additional metrics objectives for mutation. In addition, all the fuzzer mechanisms to penetrate hard-to-cover branches will help covering the additional metrics objectives. We use this approach to evaluate the impact of supporting two fine-grained coverage metrics (multiple condition coverage and weak mutation) over the performance of two state-of-the-art fuzzers (AFL++ and QSYM) with the standard LAVA-M and MAGMA benchmarks. This evaluation suggests that our mechanism for runtime fuzzer guidance, where the fuzzed code is instrumented with additional branches, is effective and could be leveraged to encode guidance from human users or static analysers. Our results also show that the impact of fine-grained metrics over fuzzing performance is hard to predict before fuzzing, and most of the time either neutral or negative. As a consequence, we do not recommend using them to guide fuzzers, except maybe in some possibly favourable circumstances yet to investigate, like for limited parts of the code or to complement classical fuzzing campaigns.

Houda Jmila (TSP) - Analyzing the Vulnerability of Machine Learning-Based IDS to Adversarial Attacks in Cybersecurity

The detection of intrusions is an important aspect of cybersecurity, as it seeks to safeguard computer systems and networks from malicious attacks. While machine learning (ML) techniques have been effective in this field, they face challenges such as the emergence of adversarial attacks that can deceive classifiers. Preventing cybercriminals from exploiting these vulnerabilities is crucial in preventing damage to data and systems. This presentation analyses the vulnerability of both deep learning and shallow classifiers, which are still widely used due to their maturity and ease of implementation, to adversarial attacks in ML-based IDS. Additionally, we explore whether adversarial attacks borrowed from computer vision pose a significant threat to IDS and to what extent realistic adversarial attacks can be generated using these methods.