  Greybox fuzzing is a lightweight testing approach that effectively detects
bugs and security vulnerabilities. However, greybox fuzzers randomly mutate
program inputs to exercise new paths; this makes it challenging to cover code
that is guarded by complex checks.
  In this paper, we present a technique that extends greybox fuzzing with a
method for learning new inputs based on already explored program executions.
These inputs can be learned such that they guide exploration toward specific
executions, for instance, ones that increase path coverage or reveal
vulnerabilities. We have evaluated our technique and compared it to traditional
greybox fuzzing on 26 real-world benchmarks. In comparison, our technique
significantly increases path coverage (by up to 3X) and detects more bugs (up
to 38% more), often orders-of-magnitude faster.
