Qianjin Du, Shiji Zhou, Xiaohui Kuang, Gang Zhao, Jidong Zhai. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing. 2023.

For malware detection, current state-of-the-art research concentrates on machine learning techniques. Binary -gram OpCode features are commonly used for malicious code identification and classification with high accuracy. Binary OpCode modification is much more difficult than modification of image pixels. Traditional adversarial perturbation methods could not be applied on OpCode directly. In this paper, we propose a bidirectional universal adversarial learning method for effective binary OpCode perturbation from both benign and malicious perspectives. Benign features are those OpCodes that represent benign behaviours, while malicious features are OpCodes for malicious behaviours. From a large dataset of benign and malicious binary applications, we select the most significant benign and malicious OpCode features based on the feature SHAP value in the trained machine learning model. We implement an OpCode modification method that insert benign OpCodes into executables as garbage codes without execution and modify malicious OpCodes by equivalent replacement preserving execution semantics. The experimental results show that the benign and malicious OpCode perturbation (BMOP) method could bypass malicious code detection models based on the SVM, XGBoost, and DNN algorithms.

Fuzzing is increasingly used to test ROS-based robotic systems, yet results remain difficult to compare because studies exercise different ROS layers and define failures in different ways. We analyze 92 selected works on ROS/ROS-based fuzzing and closely related robotic, cyber-physical, and autonomous-system testing. The corpus was built through a documented search, screening, and snowballing process. Each work is interpreted by its role in the fuzzing workflow and by the strength of its ROS-specific evidence, which separates direct ROS results from near-domain evidence that can be transferred only under explicit assumptions. Thereview shows a shift from message-validity testing toward runtime behavior and task-level failures, but the evidence profile is uneven: input modeling, feedback, and oracle construction have advanced more clearly than repeatable execution and diagnosable failure analysis. Treating ROS fuzzing as an evidence-bound workflow clarifies which claims can be compared, where evidence remains weak, and what support is needed for reproducible and repairable ROS fuzzing results.

Parallel fuzzing introduces two key steps: task division and task merging to improve efficiency and effectiveness. However, existing works lack effective analysis of task results during task merging; they employ simple differential seed distribution strategies during task division, which cannot prevent task conflicts. Moreover, there is a lack of coordination between task division and task merging phases, and the task division process does not fully utilize feedback information from task merging, reducing the collaboration efficiency between parallel sub-nodes. In this article, we first introduce a dual-loop multi-phase parallel framework. Under this framework, we combine the “exploration” capability of Structure-unaware (SU) task division strategy with the “exploitation” capability of Structure-aware (SA) task division strategy to form a new hybrid task division strategy, aiming to improve the efficiency and effectiveness of parallel fuzzing. Meanwhile, in the task merging phase, we design a comprehensive information collection mechanism that can effectively analyze task results, and in the task division phase, we can further iterate the hybrid task division strategy based on real-time testing feedback. We implement PFuzzer according to the proposed scheme. In our evaluation experiments, PFuzzer successfully discovered vulnerabilities in carefully fuzzed programs that baseline fuzzers failed to detect. Furthermore, on the FuzzBench test suite, PFuzzer discovered more code branches in most programs. Most importantly, the PFuzzer framework demonstrates good scalability, effectively parallelizing different base fuzzing engines.