Search NASA⌕ Search

SEARCH · Search NASA

Results for “AFL”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

11 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

StructuredFuzzer: Fuzzing Structured Text-Based Control Logic Applications

Rigorous testing methods are essential for ensuring the security and reliability of industrial controller software. Fuzzing, a technique that automatically discovers software bugs, has also proven effective in finding software vulnerabilities. Unsurprisingly, fuzzing has been applied to a wide range of platforms, including programmable logic controllers (PLCs). However, current approaches, such as coverage-guided evolutionary fuzzing implemented in the popular fuzzer American Fuzzy Lop Plus Plus (AFL++), are often inadequate for finding logical errors and bugs in PLC control logic applications. They primarily target generic programming languages like C/C++, Java, and Python, and do not consider the unique characteristics and behaviors of PLCs, which are often programmed using specialized programming languages like Structured Text (ST). Furthermore, these fuzzers are ill suited to deal with complex input structures encapsulated in ST, as they are not specifically designed to generate appropriate input sequences. This renders the application of traditional fuzzing techniques less efficient on these platforms. To address this issue, this paper presents a fuzzing framework designed explicitly for PLC software to discover logic bugs in applications written in ST specified by the IEC 61131-3 standard. The proposed framework incorporates a custom-tailored PLC runtime and a fuzzer designed for the purpose. We demonstrate its effectiveness by fuzzing a collection of ST programs that were crafted for evaluation purposes. We compare the performance against a popular fuzzer, namely, AFL++. The proposed fuzzing framework demonstrated its capabilities in our experiments, successfully detecting logic bugs in the tested PLC control logic applications written in ST. On average, it was at least 83 times faster than AFL++, and in certain cases, for example, it was more than 23,000 times faster.

47 OTHER INSTRUMENTATION↗
DOE OSTI2020

WeightedAFL

WeightedAFL (WAFL) is an improvement to open source fuzzer, American Fuzzy Lop (AFL). Fuzzers modify input to target programs in order to produce crashes and other unintended output in those target programs. WAFL integrates directly with AFL to determine offsets within a buffer that will improve performance metrics. WAFL uses various machine learning techniques to learn these offsets. WAFL also provides a novel software engineering solution to integrate with AFL and allows contributors to quickly write and test algorithms in python. SAND2020-12546 O Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy's National Nuclear Security Administration under contract DE-NA0003525.

Kincher-Winoto, Kina↗
DOE OSTI2019

Program Fuzzing on High Performance Computing Resources

American Fuzzy Lop (AFL) is an evolutionary fuzzer that is strategically implemented as a tool for discovering bugs in software during vulnerability research. This work seeks to understand how to best implement AFL on the High-Performance Computing resources available on the unclassified network at Sandia National Laboratories. We investigate various methods of executing AFL, requesting varying numbers of tasks on single compute nodes with 36 physical cores and 72 total threads. A Python script called Blue Claw is presented as an automated testbed generator tool to assist in the tedious process of creating and executing experiments of any scale and duration.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Multi-Node Program Fuzzing on High Performance Computing Resources

Significant effort is placed on tuning the internal parameters of fuzzers to explore the state space, measured as coverage, of binaries. In this work, we investigate the effects of the external environment on the resulting coverage after fuzzing two binaries with AFL for 24 hours. Parameters such as scaling to multiple nodes, node saturation, and parallel file system type on HPC resources are controlled in order to maximize coverage. It will be shown that employing a parallel file system such as IBM's General Parallel File System offers an advantage for fuzzing operations, since it contains enhancements for performance optimization. When combined with scaling to two and four nodes, while simultaneously restricting the number of coordinated AFL tasks per node on the low end (10-50% of available physical cores), coverage may be enhanced within a shorter period of time. Thus, controlling the external environment is a useful effort.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Predictive Inverse Model for Advective Heat Transfer in a Short–Circuited Fracture: Dimensional Analysis, Machine Learning, and Field Demonstration

Identifying fluid flow maldistribution in planar geometries is a well–established problem in subsurface science/engineering. Of particular importance to the thermal performance of enhanced (or “engineered”) geothermal systems is identifying the existence of nonuniform (i.e., heterogeneous) permeability and subsequently predicting advective heat transfer. Here, machine learning via a genetic algorithm (GA) identifies the spatial distribution of an unknown permeability field in a two–dimensional Hele–Shaw geometry (i.e., parallel plates). The inverse problem is solved by minimizing the L2 norm between simulated residence time distribution (RTD) and measurements of an inert tracer breakthrough curve (BTC) (C–Dot nanoparticle). Principal component analysis (PCA) of spatially correlated permeability fields enabled reduction of the parameter space by more than a factor of 10 and restricted the inverse search to reservoir–scale permeability variations. Thermal experiments and tracer tests conducted at the mesoscale Altona Field Laboratory (AFL) demonstrate that the method accurately predicts the effects of extreme flow channeling on heat transfer in a single bedding–plane rock fracture. However, this is only true when the permeability distributions provide adequate matches to both tracer RTD and frictional pressure loss. Without good agreement to frictional pressure loss, it is still possible to match a simulated RTD to measurements, but subsequent predictions of heat transfer are grossly inaccurate. Here, the results of this study suggest that it is possible to anticipate the thermal effects of flow maldistribution, but only if both simulated RTDs and frictional pressure loss between fluid inlets and outlets are in good agreement with measurements.

42 ENGINEERING↗
DOE OSTI2025

Speeding-up fuzzing through directional seeds

Abstract Fuzzing is an automated process for discovering inputs in a program that may trigger unexpected behavior. Today, fuzzing has become a standard practice for the discovery of bugs and security vulnerabilities. However, the main issue with such practices is that the exploration of the input space of programs can often be prohibitively expensive. Therefore, several alternative fuzzing strategies have been introduced during the last few years. Some fuzzing techniques rely on human expertise to provide a plausible set of initial input examples, namely, seeds. However, the process of handcrafting seeds for fuzzing purposes often becomes strenuous for humans as it requires a deeper understanding of the Program-Under-Test (PUT). Also, the use of known inputs to programs often does not trigger vulnerable program behavior or may not reach potentially vulnerable code locations. To address those issues, we propose a seed generation framework that enables Human-In-The-Loop (HITL) directed fuzzing where the human assumes a more active role in the creation of seeds that can penetrate and assess desired locations of the PUT. Our proposed framework uses Symbolic Execution (SE) to generate seeds that exercise paths to target program locations. Moreover, our framework enables the visualization of the explored execution paths in the binary of the PUT for the generated seeds. We evaluated our approach on a set of 12 carefully designed C programs with diverse characteristics that mimic real-world programs. The experimental results show the effectiveness of the proposed approach in improving the performance of standard fuzzing tools such as the American Fuzzy Lop ("Image missing" <#comment/> ). Specifically, our solution can generate seeds that substantially enhance the performance of the fuzzer, achieving speedups ranging from $$1.46\times $$ 1.46 × to $$68.53\times $$ 68.53 × for branch conditions, $$1.39\times $$ 1.39 × to $$254.62\times $$ 254.62 × for branch depths, $$14,879.59\times $$ 14 , 879.59 × to $$30,295.88\times $$ 30 , 295.88 × for branch widths over traditional seeds. Additionally, the speedup increases with the number of target function ranging from $$12,260\times $$ 12 , 260 × to $$22,856.07\times $$ 22 , 856.07 × over traditional seeds while only requiring less than 15 seconds on average for the seed generation step.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Siting bioenergy facilities in the United States: Measuring participation in decisions and distribution of effects

Scientists and stakeholders can inform the process of siting renewable energy facilities in ways that do not perpetuate socioeconomic disparities associated with fossil fuel industries or create new ones. Procedural justice indicators and distributional justice indicators that incorporate environmental, social, and economic objectives can be used to site energy facilities in ways that increase benefits and reduce negative impacts to disadvantaged and underserved populations. A generic list of potential energy justice indicators for siting bioenergy facilities was developed collaboratively between U.S. bioenergy researchers and diverse agriculture, energy, and energy and environmental justice stakeholders and experts. From this list smaller numbers of indicators can be selected or modified with communities for local siting of bioenergy facilities. Groups of indicators can be used to guide biorefinery or biopower siting and permitting decisions, e.g., to compare siting options, to draw early attention to key problems, or to track progress toward justice-related targets.

09 BIOMASS FUELS↗
DOE OSTI2024

Characterizing gravitational wave detector networks: from A # to cosmic explorer

Gravitational-wave observations by the laser interferometer gravitational-wave observatory (LIGO) and Virgo have provided us a new tool to explore the Universe on all scales from nuclear physics to the cosmos and have the massive potential to further impact fundamental physics, astrophysics, and cosmology for decades to come. In this paper we have studied the science capabilities of a network of LIGO detectors when they reach their best possible sensitivity, called A # , given the infrastructure in which they exist and a new generation of observatories that are factor of 10 to 100 times more sensitive (depending on the frequency), in particular a pair of L-shaped cosmic explorer (CE) observatories (one 40 km and one 20 km arm length) in the US and the triangular Einstein telescope with 10 km arms in Europe. We use a set of science metrics derived from the top priorities of several funding agencies to characterize the science capabilities of different networks. The presence of one or two A # observatories in a network containing two or one next generation observatories, respectively, will provide good localization capabilities for facilitating multimessenger astronomy (MMA) and precision measurement of the Hubble parameter. Two CE observatories are indispensable for achieving precise localization of binary neutron star events, facilitating detection of electromagnetic counterparts and transforming MMA. Their combined operation is even more important in the detection and localization of high-redshift sources, such as binary neutron stars, beyond the star-formation peak, and primordial black hole mergers, which may occur roughly 100 million years after the Big Bang. The addition of the Einstein Telescope to a network of two CE observatories is critical for accomplishing all the identified science metrics including the nuclear equation of state, cosmological parameters, the growth of black holes through cosmic history, but also make new discoveries such as the presence of dark matter within or around neutron stars and black holes, continuous gravitational waves from rotating neutron stars, transient signals from supernovae, and the production of stellar-mass black holes in the early Universe. For most metrics the triple network of next generation terrestrial observatories are a factor 100 better than what can be accomplished by a network of three A # observatories.

Einstein telescope↗
DOE OSTI2019

Detection prospects of core-collapse supernovae with supernova-optimized third-generation gravitational-wave detectors

We discuss how to optimize the third-generation gravitational-wave detector to maximize the range to detect core-collapse supernovae. Based on three-dimensional simulations for core-collapse and the corresponding gravitational-wave waveform emitted, the corresponding detection range for these waveforms is limited to within our Galaxy even in the era of third-generation detectors. The corresponding event rate is two per century. We find from the waveforms that to detect core-collapse supernovae with an event rate of one per year, the gravitational-wave detectors need a strain sensitivity of 3 × 10 -27 Hz -1/2 in a frequency range from 100 to 1500 Hz. We also explore detector configurations technologically beyond the scope of third-generation detectors. We find with these improvements, the event rate for gravitational-wave observations from core-collapse supernovae is still low, but is improved to one in twenty years.

79 ASTRONOMY AND ASTROPHYSICS↗
DOE OSTI2023

Measuring the properties of f - mode oscillations of a protoneutron star by third-generation gravitational-wave detectors

Core-collapse supernovae are among the astrophysical sources of gravitational waves that could be detected by third-generation gravitational-wave detectors. Here, we analyze the gravitational-wave strain signals from two- and three-dimensional simulations of core-collapse supernovae generated using the code FORNAX. A subset of the two-dimensional simulations has non-zero core rotation at the core bounce. A dominant source of time changing quadrupole moment is the l = 2 fundamental mode (f- mode) oscillation of the proto-neutron star. From the time-frequency spectrogram of the gravitational-wave strain we see that, starting ~ 400 ms after the core bounce, most of the power lies within a narrow track that represents the frequency evolution of the f-mode oscillations. The f-mode frequencies obtained from linear perturbation analysis of the angle averaged profile of the protoneutron star corroborate what we observe in the spectrograms of the gravitational wave signal. We explore the measurability of the f-mode frequency evolution of protoneutron star for a supernova signal observed in the third-generation gravitational-wave detectors. Measurement of the frequency evolution can reveal information about the masses, radii, and densities of the proto-neutron stars. We find that if the third generation detectors observe a supernova within 10 kpc, we can measure these frequencies to within ~90% accuracy. Here, we can also measure the energy emitted in the fundamental f-mode using the spectrogram data of the strain signal. We find that the energy in the f-mode can be measured to within 20% error for signals observed by Cosmic Explorer using simulations with successful explosion, assuming source distances within 10 kpc.

79 ASTRONOMY AND ASTROPHYSICS↗