Agent-based detection of fuzzing activity associated with a target program

Abstract

Disclosed embodiments relate to systems and methods for detecting fuzzing activity associated with a target program. Techniques include accessing a target program, monitoring, by a monitoring agent in a kernel space environment, the target program, and analyzing dynamic and static patterns of the target program. The techniques may further include assessing process parameters and inputs, evaluating instrumentation patterns in at least one basic block, assessing process creation frequency, assessing Syscalls invocation frequency, identifying suspicious processes, or comparing a runtime coverage ratio of a process to an expected coverage ratio. Systems and methods may also include calculating a confidence score, including applying a weighted value to an analyzed individual pattern based on the analysis, and identifying a likelihood of fuzzing activity based on the confidence score.