Seed selection for successful fuzzing

Herrera, Adrian; Gunadi, Hendra; Magrath, Shane; Norrish, Michael; Payer, Mathias; Hosking, Antony L.

doi:10.1145/3460319.3464795

Cited by 64 publications

(18 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If the seed format is incorrect, the fuzzing process will not function properly. The quality of the initial seed also affects the time(step) it takes to find the same bugs or achieve the same code coverage [28]. If a bad quality initial seed is given, it takes more time than when a good quality initial seed is given in order to achieve the same results.…”

Section: A Coverage-guided Fuzzing Approaches and Seed-scheduling Met...mentioning

confidence: 99%

A Seed Scheduling Method With a Reinforcement Learning for a Coverage Guided Fuzzing

et al. 2023

View full text Add to dashboard Cite

Seed scheduling, which determines which seed is input to the fuzzer first and the number of mutated test cases that are generated for the input seed, significantly influences crash detection performance in fuzz testing. Even for the same fuzzer, the performance in terms of detecting crashes that cause program failure varies considerably depending on the seed-scheduling method used. Most existing coverage-guided fuzzers use a heuristic seed-scheduling method. These heuristic methods can't properly determine the seed with a high potential to cause the crash; thus, the fuzzer detects the crash inefficiently. Moreover, the fuzzer's crash detection performance is affected by the characteristics of target programs. To address this problem, we propose a general-purpose reinforced seed-scheduling method that not only improves the crash detection performance of fuzz testing but also remains unaffected by the characteristics of the target program. The fuzzer with the proposed method detected the most crashes in all but one of the target programs in which crashes were detected in the experimental results conducted on various programs, and showed better crash detection efficiency than the comparison targets overall.

show abstract

Section: A Coverage-guided Fuzzing Approaches and Seed-scheduling Met...mentioning

confidence: 99%

A Seed Scheduling Method With a Reinforcement Learning for a Coverage Guided Fuzzing

et al. 2023

View full text Add to dashboard Cite

show abstract

“…Rebert et al [35] mathematically formulate seed selection to maximise bugs discoveries. Herrera et al [36] systematically investigate and evaluate the effects of initial seed selection strategies on bug finding. T-Fuzz [39] proposes a lightweight dynamic tracing-based technique to detect complex checks and bypass those checks by program transformation.…”

Section: B More Efficient Coverage-guided Fuzzingmentioning

confidence: 99%

Fine-Grained Coverage-Based Fuzzing

Nongpoh¹,

Bardin²,

Nour³

et al. 2022

Proceedings FUZZING 2022 - 1st International Fuzzing Workshop

View full text Add to dashboard Cite

Fuzzing is an effective software testing method that discovers bugs by feeding target applications with (usually a massive amount of) automatically generated inputs. Many stateof-art fuzzers use branch coverage as a feedback metric to guide the fuzzing process. The fuzzer retains inputs for further mutation only if branch coverage is increased. However, branch coverage only provides a shallow sampling of program behaviours and hence may discard inputs that might be interesting to mutate. This work aims at taking advantage of the large body of research over defining finer-grained code coverage metrics (such as mutation coverage) and use these metrics as better proxies to select interesting inputs for mutation. We propose to make coveragebased fuzzers support most fine-grained coverage metrics out of the box (i.e., without changing fuzzer internals). We achieve this by making the test objectives defined by these metrics (such as mutants to kill) explicit as new branches in the target program. Fuzzing such a modified target is then equivalent to fuzzing the original target, but the fuzzer will also retain inputs covering the additional metrics objectives for mutation. We propose a preliminary evaluation of this novel idea using two state-of-art fuzzers, namely AFL++(3.14c) and QSYM with AFL(2.52b), on the four standard LAVA-M benchmarks. Significantly positive results are obtained on one benchmark and marginally negative ones on the three others. We discuss directions towards a strong and complete evaluation of the proposed approach and call for early feedback from the fuzzing community.

show abstract

“…Starting from a seed input corpus, a coverage-guided fuzzer repeatedly selects a seed from the corpus, mutates it, and adds only those mutated inputs back to the corpus that generate new edge coverage. The performance of such fuzzers have been shown to heavily depend on seed scheduling, the order in which the seeds are selected for mutation [28].…”

Section: Introductionmentioning

confidence: 99%

Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis

She¹,

Shah²,

Jana³

2022

Preprint

View full text Add to dashboard Cite

Seed scheduling, the order in which seeds are selected, can greatly affect the performance of a fuzzer. Existing approaches schedule seeds based on their historical mutation data, but ignore the structure of the underlying Control Flow Graph (CFG). Examining the CFG can help seed scheduling by revealing the potential edge coverage gain from mutating a seed.An ideal strategy will schedule seeds based on a count of all reachable and feasible edges from a seed through mutations, but computing feasibility along all edges is prohibitively expensive. Therefore, a seed scheduling strategy must approximate this count. We observe that an approximate count should have 3 properties -(i) it should increase if there are more edges reachable from a seed; (ii) it should decrease if mutation history information suggests an edge is hard to reach or is located far away from currently visited edges; and (iii) it should be efficient to compute over large CFGs.We observe that centrality measures from graph analysis naturally provide these three properties and therefore can efficiently approximate the likelihood of reaching unvisited edges by mutating a seed. We therefore build a graph called the edge horizon graph that connects seeds to their closest unvisited nodes and compute the seed node's centrality to measure the potential edge coverage gain from mutating a seed.We implement our approach in K-Scheduler and compare with many popular seed scheduling strategies. We find that K-Scheduler increases feature coverage by 25.89% compared to Entropic and edge coverage by 4.21% compared to the nextbest AFL-based seed scheduler, in arithmetic mean on 12 Google FuzzBench programs. It also finds 3 more previously-unknown bugs than the next-best AFL-based seed scheduler.

show abstract

Seed selection for successful fuzzing

Cited by 64 publications

References 40 publications

A Seed Scheduling Method With a Reinforcement Learning for a Coverage Guided Fuzzing

A Seed Scheduling Method With a Reinforcement Learning for a Coverage Guided Fuzzing

Fine-Grained Coverage-Based Fuzzing

Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis

Contact Info

Product

Resources

About