Пример #1
0
def main(_):
    """Constructs the fuzzer and fuzzes."""

    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)

    # Set up initial seed inputs
    image, label = fuzz_utils.basic_mnist_input_corpus(
        choose_randomly=FLAGS.random_seed_corpus)
    seed_inputs = [[image, label]]
    image_copy = image[:]

    with tf.Session() as sess:
        # Specify input, coverage, and metadata tensors
        input_tensors, coverage_tensors, metadata_tensors = \
          fuzz_utils.get_tensors_from_checkpoint(
              sess, FLAGS.checkpoint_dir
          )

        # Construct and run fuzzer
        fuzzer = Fuzzer(
            sess=sess,
            seed_inputs=seed_inputs,
            input_tensors=input_tensors,
            coverage_tensors=coverage_tensors,
            metadata_tensors=metadata_tensors,
            coverage_function=sum_coverage_function,
            metadata_function=metadata_function,
            objective_function=objective_function,
            mutation_function=mutation_function,
            sample_function=recent_sample_function,
            threshold=FLAGS.ann_threshold,
        )
        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)

        if result is not None:
            # Double check that there is persistent disagreement
            for idx in range(10):
                logits, quantized_logits = sess.run(
                    [coverage_tensors[0], coverage_tensors[1]],
                    feed_dict={
                        input_tensors[0]: np.expand_dims(result.data[0], 0)
                    },
                )
                if np.argmax(logits, 1) != np.argmax(quantized_logits, 1):
                    tf.logging.info("disagreement confirmed: idx %s", idx)
                else:
                    tf.logging.info("SPURIOUS DISAGREEMENT!!!")
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
            max_diff = np.max(result.data[0] - image_copy)
            tf.logging.info(
                "Max difference between perturbation and original: %s.",
                max_diff,
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
Пример #2
0
def main(_):
    """Configures and runs the fuzzer."""

    # Log more and return how logging output will be produced
    tf.logging.set_verbosity(tf.logging.INFO)

    coverage_function = raw_logit_coverage_function  # change function name
    target_seed = np.random.uniform(low=0.0, high=1.0, size=(1, ))  # 语料库,随机值
    numpy_arrays = [[target_seed]]

    targets_tensor = tf.placeholder(tf.float32, [64, 1])
    coverage_tensor = tf.identity(targets_tensor)
    loss_batch_tensor, _ = binary_cross_entropy_with_logits(
        tf.zeros_like(targets_tensor), tf.nn.sigmoid(targets_tensor))
    grads_tensor = tf.gradients(loss_batch_tensor, targets_tensor)[0]
    tensor_map = {
        "input": [targets_tensor],
        "coverage": [coverage_tensor],
        "metadata": [loss_batch_tensor, grads_tensor],
    }

    with tf.Session() as sess:

        fetch_function = build_fetch_function(sess, tensor_map)
        size = FLAGS.mutations_per_corpus_item
        mutation_function = lambda elt: do_basic_mutations(
            elt, size, a_min=-1000, a_max=1000)
        # 从语料库选择种子
        seed_corpus = seed_corpus_from_numpy_arrays(numpy_arrays,
                                                    coverage_function,
                                                    metadata_function,
                                                    fetch_function)
        # corpus: mutations_processed, corpus, time, sample_function, updater
        corpus = InputCorpus(seed_corpus, uniform_sample_function,
                             FLAGS.ann_threshold, "kdtree")
        fuzzer = Fuzzer(
            corpus,
            coverage_function,
            metadata_function,
            objective_function,
            mutation_function,
            fetch_function,
        )
        # fuzzer run
        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)
        if result is not None:
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
Пример #3
0
def main(_):
    """Constructs the fuzzer and performs fuzzing."""

    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)  # 为将要被记录的日志设置开始入口
    # Set the seeds!
    if FLAGS.seed:
        random.seed(FLAGS.seed)
        np.random.seed(FLAGS.seed)

    coverage_function = all_logit_coverage_function  # 覆盖计算方法,所有logit的绝对值之和
    image, label = fuzz_utils.basic_mnist_input_corpus(
        choose_randomly=FLAGS.
        random_seed_corpus  # 这里为False, 返回第一张图片和标签, 图片为28*28*1
    )
    numpy_arrays = [[image, label]]

    with tf.Session() as sess:

        tensor_map = fuzz_utils.get_tensors_from_checkpoint(  # 载入checkpoints
            sess, FLAGS.checkpoint_dir)
        fetch_function = fuzz_utils.build_fetch_function(
            sess, tensor_map)  # ===============

        size = FLAGS.mutations_per_corpus_item  # 每次变异数量
        mutation_function = lambda elt: do_basic_mutations(elt, size)  # 变异方法
        seed_corpus = seed_corpus_from_numpy_arrays(  # 建立seed corpus,输入集 numpy_array是一张图片,返回的 seedcorpus包含一个元素,有metada和coverage信息
            numpy_arrays, coverage_function, metadata_function, fetch_function)
        corpus = InputCorpus(  # 建立input corpus
            seed_corpus,
            recent_sample_function,
            FLAGS.ann_threshold,
            "kdtree"  # recent_sample_function用于选择下一个元素
        )
        fuzzer = Fuzzer(
            corpus,
            coverage_function,
            metadata_function,
            objective_function,
            mutation_function,
            fetch_function,
        )
        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)
        if result is not None:
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
Пример #4
0
def main(_):
    """Constructs the fuzzer and performs fuzzing."""

    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)
    # Set the seeds!
    if FLAGS.seed:
        random.seed(FLAGS.seed)
        np.random.seed(FLAGS.seed)

    coverage_function = all_logit_coverage_function  # a function to compute coverage
    image, label = fuzz_utils.basic_mnist_input_corpus(
        choose_randomly=FLAGS.random_seed_corpus)
    numpy_arrays = [[image, label]]

    with tf.Graph().as_default() as g:  # change codes and it works
        sess = tf.Session()  # here
        tensor_map = fuzz_utils.get_tensors_from_checkpoint(
            sess, FLAGS.checkpoint_dir)

        fetch_function = fuzz_utils.build_fetch_function(sess, tensor_map)

        size = FLAGS.mutations_per_corpus_item
        mutation_function = lambda elt: do_basic_mutations(elt, size)  # pram 1
        seed_corpus = seed_corpus_from_numpy_arrays(numpy_arrays,
                                                    coverage_function,
                                                    metadata_function,
                                                    fetch_function)
        corpus = InputCorpus(seed_corpus, recent_sample_function,
                             FLAGS.ann_threshold, "kdtree")  # pram 2
        fuzzer = Fuzzer(
            corpus,
            coverage_function,
            metadata_function,
            objective_function,
            mutation_function,
            fetch_function,
        )
        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)  # iterations
        if result is not None:
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
            tf.logging.info("Elements for Crashes: {0}".format(result))
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
Пример #5
0
def main(_):
    """Constructs the fuzzer and performs fuzzing."""

    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)
    # Set the seeds!
    if FLAGS.seed:
        random.seed(FLAGS.seed)
        np.random.seed(FLAGS.seed)

    # Set up seed inputs
    sz = 16
    #    target_seed = np.random.uniform(low=0.0, high=1.0, size=(sz,))
    target_seed = np.ones(sz, dtype=np.uint32) * 4
    seed_inputs = [[target_seed]]

    # Specify input, coverage, and metadata tensors
    input_tensor = tf.placeholder(tf.int32, [None, sz])
    op_tensor = tf.cumprod(input_tensor)
    grad_tensors = tf.gradients(op_tensor, input_tensor)

    with tf.Session() as sess:
        # Construct and run fuzzer
        fuzzer = Fuzzer(
            sess=sess,
            seed_inputs=seed_inputs,
            input_tensors=[input_tensor],
            coverage_tensors=grad_tensors,
            metadata_tensors=grad_tensors,
            coverage_function=raw_coverage_function,
            metadata_function=metadata_function,
            objective_function=objective_function,
            mutation_function=mutation_function,
            sample_function=recent_sample_function,
            threshold=FLAGS.ann_threshold,
        )

        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)
        if result is not None:
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
Пример #6
0
def main(_):
    """Constructs the fuzzer and performs fuzzing."""

    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)
    # Set the seeds!
    if FLAGS.seed:
        random.seed(FLAGS.seed)
        np.random.seed(FLAGS.seed)

    # Set up seed images
    image, label = fuzz_utils.basic_mnist_input_corpus(
        choose_randomly=FLAGS.random_seed_corpus)
    seed_inputs = [[image, label]]

    with tf.Session() as sess:
        # Specify input, coverage, and metadata tensors
        input_tensors, coverage_tensors, metadata_tensors = \
          fuzz_utils.get_tensors_from_checkpoint(
              sess, FLAGS.checkpoint_dir
          )

        # Construct and run fuzzer
        fuzzer = Fuzzer(
            sess=sess,
            seed_inputs=seed_inputs,
            input_tensors=input_tensors,
            coverage_tensors=coverage_tensors,
            metadata_tensors=metadata_tensors,
            coverage_function=sum_coverage_function,
            metadata_function=metadata_function,
            objective_function=objective_function,
            mutation_function=mutation_function,
            sample_function=recent_sample_function,
            threshold=FLAGS.ann_threshold,
        )

        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)
        if result is not None:
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
Пример #7
0
def main(_):
    """Configures and runs the fuzzer."""

    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)

    # Set up initial seed inputs
    target_seed = np.random.uniform(low=0.0, high=1.0, size=(1, ))
    seed_inputs = [[target_seed]]

    # Specify input, coverage, and metadata tensors
    targets_tensor = tf.placeholder(tf.float32, [64, 1])
    coverage_tensor = tf.identity(targets_tensor)
    loss_batch_tensor, _ = binary_cross_entropy_with_logits(
        tf.zeros_like(targets_tensor), tf.nn.sigmoid(targets_tensor))
    grads_tensor = tf.gradients(loss_batch_tensor, targets_tensor)[0]

    # Construct and run fuzzer
    with tf.Session() as sess:
        fuzzer = Fuzzer(sess=sess,
                        seed_inputs=seed_inputs,
                        input_tensors=[targets_tensor],
                        coverage_tensors=[coverage_tensor],
                        metadata_tensors=[loss_batch_tensor, grads_tensor],
                        coverage_function=raw_coverage_function,
                        metadata_function=metadata_function,
                        objective_function=objective_function,
                        mutation_function=mutation_function,
                        sample_function=uniform_sample_function,
                        threshold=FLAGS.ann_threshold)
        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)
        if result is not None:
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
Пример #8
0
def main(_):
    """Constructs the fuzzer and fuzzes."""

    # Sets the threshold for what messages will be logged.
    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)

    # all works
    # coverage_function = raw_logit_coverage_function
    coverage_function = all_logit_coverage_function

    # get inputs corpus data
    image, label = fuzz_utils.basic_mnist_input_corpus(
        choose_randomly=FLAGS.random_seed_corpus)
    numpy_arrays = [[image, label]]
    image_copy = image[:]

    with tf.Graph().as_default() as g:
        sess = tf.Session()

        tensor_map = fuzz_utils.get_tensors_from_checkpoint(
            sess, FLAGS.checkpoint_dir)

        fetch_function = fuzz_utils.build_fetch_function(sess, tensor_map)
        size = FLAGS.mutations_per_corpus_item  # 100

        def mutation_function(elt):
            """Mutates the element in question."""
            return do_basic_mutations(elt, size, FLAGS.perturbation_constraint)

        # initialization of seed corpus
        seed_corpus = seed_corpus_from_numpy_arrays(numpy_arrays,
                                                    coverage_function,
                                                    metadata_function,
                                                    fetch_function)
        corpus = InputCorpus(seed_corpus, recent_sample_function,
                             FLAGS.ann_threshold, FLAGS.algorithm)

        fuzzer = Fuzzer(
            corpus,
            coverage_function,
            metadata_function,
            objective_function,
            mutation_function,
            fetch_function,
        )

        result = fuzzer.loop(
            FLAGS.total_inputs_to_fuzz)  # type is CorpusElement

        if result is not None:
            # Double check that there is persistent disagreement
            for idx in range(10):
                logits, quantized_logits = sess.run(
                    [tensor_map["coverage"][0], tensor_map["coverage"][1]],
                    feed_dict={
                        tensor_map["input"][0]:
                        np.expand_dims(result.data[0], 0)
                    },
                )  # feed_dict: replace tensor value

                if np.argmax(logits, 1) != np.argmax(quantized_logits, 1):
                    tf.logging.info("disagreement confirmed: idx %s", idx)
                else:
                    tf.logging.info(
                        "Idx: {0}, SPURIOUS DISAGREEMENT!!! LOGITS: {1}, QUANTIZED_LOGITS: {2}!"
                        .format(idx, logits, quantized_logits))
            tf.logging.info(
                "Fuzzing succeeded. Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
            max_diff = np.max(result.data[0] - image_copy)
            tf.logging.info(
                "Max difference between perturbation and original: %s.",
                max_diff,
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")
def main(_):
    """Constructs the fuzzer and fuzzes."""

    # Log more
    tf.logging.set_verbosity(tf.logging.INFO)  # 为将要被记录的日志设置开始入口

    coverage_function = raw_logit_coverage_function
    image, label = fuzz_utils.basic_mnist_input_corpus(  # 一张图片和对应的标签
        choose_randomly=FLAGS.random_seed_corpus)
    numpy_arrays = [[image, label]]
    image_copy = image[:]

    with tf.Session() as sess:

        tensor_map = fuzz_utils.get_tensors_from_checkpoint(
            sess, FLAGS.checkpoint_dir)

        fetch_function = fuzz_utils.build_fetch_function(sess,
                                                         tensor_map)  # 获取模型信息

        size = FLAGS.mutations_per_corpus_item

        def mutation_function(elt):  # elt为一个元素
            """Mutates the element in question."""
            return do_basic_mutations(
                elt, size,
                FLAGS.perturbation_constraint)  # 一个元素多次变异,返回多个变异后的数据

        """ numpy_arrays = [[image, label]] 一张图片
            coverage_function = raw_logit_coverage_function
            fetch_function = fuzz_utils.build_fetch_function(sess, tensor_map)
        """
        seed_corpus = seed_corpus_from_numpy_arrays(  # 建立seed_corpus
            numpy_arrays, coverage_function, metadata_function, fetch_function)

        corpus = InputCorpus(  # 建立input corpus
            seed_corpus, recent_sample_function, FLAGS.ann_threshold, "kdtree")
        fuzzer = Fuzzer(  # 建立Fuzzer对象
            corpus,  # InputCorpus(Input Corpus)
            coverage_function,  # 计算神经网络覆盖
            metadata_function,  # 获取metadata
            objective_function,  # 目标方法,检查是否被错误分类
            mutation_function,  # 变异方法
            fetch_function,  # 获取模型信息
        )
        result = fuzzer.loop(FLAGS.total_inputs_to_fuzz)
        if result is not None:
            # Double check that there is persistent disagreement
            for idx in range(10):
                logits, quantized_logits = sess.run(
                    [tensor_map["coverage"][0], tensor_map["coverage"][1]],
                    feed_dict={
                        tensor_map["input"][0]:
                        np.expand_dims(result.data[0], 0)
                    },
                )
                if np.argmax(logits, 1) != np.argmax(quantized_logits, 1):
                    tf.logging.info("disagreement confirmed: idx %s", idx)
                else:
                    tf.logging.info("SPURIOUS DISAGREEMENT!!!")  # 假的不一致
            tf.logging.info("Fuzzing succeeded.")
            tf.logging.info(
                "Generations to make satisfying element: %s.",
                result.oldest_ancestor()[1],
            )
            max_diff = np.max(result.data[0] - image_copy)
            tf.logging.info(
                "Max difference between perturbation and original: %s.",
                max_diff,
            )
        else:
            tf.logging.info("Fuzzing failed to satisfy objective function.")