Google Online Security Blog
Follow
Hacking for Defenders: approaches to DARPA’s AI Cyber Challenge
DARPA's AI Cyber Challenge (AIxCC) aims to develop AI systems for securing open source projects crucial to infrastructure. Google's OSS-Fuzz and Security Engineering teams played a role in designing the competition framework and built a Cyber Reasoning System (CRS) using OSS-Fuzz technology. OSS-Fuzz, a free and open-source fuzz testing platform, has discovered and fixed over 11,000 vulnerabilities in open source projects. AIxCC challenges focus on finding vulnerabilities in open source projects, which OSS-Fuzz can efficiently fuzz using its existing toolchains. The CRS developed by Google leverages non-AI techniques and highlights areas where AI can enhance fuzz testing capabilities. To enable kernel fuzzing, Google adapted a technique from Cloudflare, using AFL and QEMU virtualization. Forcing the closure of FDs created by the challenge harness helped address potential issues during fuzzing. Static analysis can complement fuzzing, and LLMs could improve its accuracy and bug-finding capabilities. Google emphasizes the importance of delta debugging to identify the culprit commit and patch the vulnerability. AI could be leveraged to suggest patches and enhance the patching process, addressing challenges such as patch validation and prompt narrowing. The outcomes of the AIxCC will be integrated into OSS-Fuzz, benefiting the open source ecosystem.