Policy Generator (PG): A Heuristic-Based Fuzzer

Recently, grammar-based fuzzers have been proposed to automate the generation of testing data. Grammar-based fuzzers differ from traditional fuzzers because the fuzzer is provided a grammatical definition of the test objective for the system under test. A novel fuzzer, Policy Generator (PG), is introduced. PG utilizes a number of heuristic techniques to improve space coverage over existing fuzzers. A simple grammatical test-bed, firewall policy generation, is used to compare the performance of these two systems. The set of test cases produced for this scenario are examined and each algorithm is evaluated against a number of novel grammar-based coverage metrics. The empirical study demonstrates that PG generates superior coverage compared to current generation techniques.