Abstract:Literature in traditional program fuzzing has confirmed that effectiveness is largely impacted by redundancy among initial seeds, thereby proposing a series of seed selection methods. JVM fuzzing, compared to traditional ones, presents unique characteristics, including large-scale and intricate code, and programs with both syntactic and semantic features. However, it remains unclear whether the existing seed selection methods are suitable for JVM fuzzing and whether utilizing program features can enhance effectiveness. To address this, we devise a total of 10 initial seed selection methods, comprising coverage-based, prefuzz-based, and program-feature-based methods. We then conduct an empirical study on three JVM implementations to extensively evaluate the performance of the seed selection methods within two SOTA fuzzing techniques (JavaTailor and VECT). Specifically, we examine performance from three aspects: (i) effectiveness and efficiency using widely studied initial seeds, (ii) effectiveness using the programs in the wild, and (iii) the ability to detect new bugs. Evaluation results first show that the program-feature-based method that utilizes the control flow graph not only has a significantly lower time overhead (i.e., 30s), but also outperforms other methods, achieving 142% to 269% improvement compared to the full set of initial seeds. Second, results reveal that the initial seed selection greatly improves the quality of wild programs and exhibits complementary effectiveness by detecting new behaviors. Third, results demonstrate that given the same testing period, initial seed selection improves the JVM fuzzing techniques by detecting more unknown bugs. Particularly, 21 out of the 25 detected bugs have been confirmed or fixed by developers. This work takes the first look at initial seed selection in JVM fuzzing, confirming its importance in fuzzing effectiveness and efficiency.

Coverage-guided fuzz testing method based on reinforcement learning seed scheduling

FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing

Coverage-guided fuzzing for deep reinforcement learning systems

MEUZZ: Smart Seed Scheduling for Hybrid Fuzzing

Graphuzz: Data-driven Seed Scheduling for Coverage-guided Greybox Fuzzing

Selecting Initial Seeds for Better JVM Fuzzing

Improve Model Testing by Integrating Bounded Model Checking and Coverage Guided Fuzzing

SAFL: increasing and accelerating testing coverage with symbolic execution and guided fuzzing.

Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis

Stateful protocol fuzzing with statemap-based reverse state selection

Industrial Oriented Evaluation of Fuzzing Techniques

Better Pay Attention Whilst Fuzzing.

Evolutionary Mutation-based Fuzzing as Monte Carlo Tree Search

Semantic Sensitive Coverage-based Fuzzing

Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware

SeededFuzz: Selecting and Generating Seeds for Directed Fuzzing

A dynamic taint tracking optimized fuzz testing method based on multi-modal sensor data fusion

Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

PAVFuzz: State-Sensitive Fuzz Testing of Protocols in Autonomous Vehicles

Deep Learning-Based Hybrid Fuzz Testing