{"id":75351,"date":"2018-01-03T09:00:15","date_gmt":"2018-01-03T17:00:15","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=75351"},"modified":"2023-05-15T22:58:23","modified_gmt":"2023-05-16T05:58:23","slug":"application-fuzzing-in-the-era-of-machine-learning-and-ai","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2018\/01\/03\/application-fuzzing-in-the-era-of-machine-learning-and-ai\/","title":{"rendered":"Application fuzzing in the era of Machine Learning and AI"},"content":{"rendered":"
<\/p>\n
Proactively testing software for bugs is not new. The earliest examples date back to the 1950s with the term \u201cfuzzing.\u201d Fuzzing as we now refer to it is the injection of random inputs and commands into applications. It made its debut quite literally on a dark and stormy night in 1988<\/a>. Since then, application fuzzing has become a staple of the secure software development lifecycle (SDLC), and according to Gartner*, \u201csecurity testing is growing faster than any other security market, as AST solutions adapt to new development methodologies and increased application complexity.\u201d<\/p>\n We believe there is good reason for this. The overall security risk profile of applications has grown in lockstep with accelerated software development and application complexity. Hackers are also aware of the increased vulnerabilities and, as the recent Equifax breach highlights, the application layer is highly targeted. Despite this, the security and development groups within organizations cannot find easy alignment to implement application fuzzing.<\/p>\n While DevOps is transforming the speed at which applications are created, tested, and integrated with IT, that same efficiency hampers the ability to mitigate identified security risks and vulnerabilities, without impacting business priorities. This is exactly the promise that machine learning, artificial intelligence (AI), and the use of deep neural networks (DNN) are expected to deliver on in evolved software vulnerability testing.<\/p>\n Most customers I talk to see AI as a natural next step given that most software testing for bugs and vulnerabilities is either manual or prone to false positives. With practically every security product claiming to be machine learning and AI-enabled, it can be hard to understand which offerings can deliver real value over current approaches.<\/p>\n Adoption of the latest techniques for application security testing doesn\u2019t mean CISOs must become experts in machine learning. Companies like Microsoft are using the on-demand storage and computing power of the cloud, combined with experience in software development and data science, to build security vulnerability mitigation tools that embed this expertise in existing systems for developing, testing, and releasing code. It is important, however, to understand your existing environment, application inventory, and testing methodologies to capture tangible savings in cost and time. For many organizations, application testing relies on tools that use business logic and common coding techniques. These are notoriously error-prone and devoid of security expertise. For this latter reason, some firms turn to penetration testing experts and professional services. This can be a costly, manual approach to mitigation that lengthens software shipping cycles.<\/p>\n Modern application security testing that is continuous and integrated with DevOps and SecOps can be transformative for business agility and security risk management. Consider these key use cases and whether your organization has embedded application security testing for each:<\/p>\n Of course, software development and testing are about more than just tools. The process to communicate risks to all stakeholders, and to act, is where the real benefit materializes. A barrier to effective application security testing is the highly siloed way that testing and remediation are conducted. Development waits for IT and security professionals to implement the changes\u2014slowing deployment and time to market. Legacy application security testing is ready for disruption and the built-in approach can deliver long-awaited efficiency in the development and deployment pipeline. Digital transformation, supply chain security, and risk detection all benefit from speed and agility. Let\u2019s consider the DevOps and SecOps workflows possible on a Microsoft-based application security testing framework:<\/p>\n Machine learning and artificial intelligence are not new, but the relatively recent availability of graphics processing units (GPUs) have brought their potential to mainstream by enabling faster (parallel) processing of large amounts of data. Our recently announced Microsoft Risk Detection (MSRD) service<\/a> is a showcase of the power of the cloud and AI to evolve fuzz testing. In fact, Microsoft\u2019s award winning work<\/a> in a specialized area of AI called \u201cconstraint solving\u201d has been 10 years in the making and was used to produce the world\u2019s first white-box fuzzer.<\/p>\n A key to effective application security testing is the inputs or seeds used to establish code paths and bring about crashes and bug discovery. These inputs can be static and predetermined, or in the case of MSRD, dynamic and mutated by training algorithms to generate relevant variations based on previous runs. While AI and constraint solving are used to tune the reasoning for finding bugs, Azure Resource Manager dynamically scales the required compute up or down creating a fuzzing lab that is right-sized for the customer\u2019s requirement. The Azure based approach also gives customers choices in running multiple fuzzers, in addition to Microsoft\u2019s own, so the customer gets value from several different methods of fuzzing.<\/p>\n For Microsoft, application security testing is fundamental to a secure digital transformation. MSRD for Windows and Linux workloads is yet another example of our commitment to building security into every aspect of our platform. While our AI-based application fuzzing is unique, Microsoft Research is already upping the ante with a new project for neural fuzzing<\/a>. Deep neural networks are an instantiation of machine learning that model the human brain. Their application can improve how MSRD identifies fuzzing locations and the strategies and parameters used. Integration with our security offerings is in the initial phases, and by folding in more capabilities over time we remove the walls between IT, developers, and security, making near real-time risk mitigation a reality. This is the kind of disruption that, as a platform company, Microsoft uniquely brings to application security testing for our customers and serves as further testament for the power of built-in.<\/p>\n * Gartner:<\/strong> Magic Quadrant for Application Security Testing published: 28 February 2017 ID:<\/strong> G00290926<\/p>\n","protected":false},"excerpt":{"rendered":" Proactively testing software for bugs is not new. The earliest examples date back to the 1950s with the term \u201cfuzzing.\u201d Fuzzing as we now refer to it is the injection of random inputs and commands into applications. It made its debut quite literally on a dark and stormy night in 1988. Since then, application fuzzing […]<\/p>\n","protected":false},"author":61,"featured_media":75357,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3664],"products":[3690,3692],"threat-intelligence":[],"tags":[],"coauthors":[1849],"class_list":["post-75351","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-ai-and-machine-learning","products-microsoft-defender","products-microsoft-defender-for-cloud-apps"],"yoast_head":"\nUse cases<\/h2>\n
\n
Platform leverage<\/h2>\n
\n
Cloud and AI<\/h2>\n
The future<\/h2>\n
\n