Abstract:—Mutation-based fuzzing is one of the most popular approaches to discover vulnerabilities in a program. To alleviate the inefﬁciency of mutation-based fuzzing incurred by high randomness in the mutation process, multiple solutions are developed in recent years, especially coverage-based fuzzing. They mainly employ adaptive mutation strategies or integrate constraint-solving techniques to make a good exploration of the test cases which trigger unique paths and crashes. However, they lack a ﬁne-grained reusing of fuzzing history to construct these interesting test cases, i.e., they largely fail to properly utilize fuzzing history across different fuzzing trials. In fact, we discover that test cases in fuzzing history contain rich knowledge of the key mutation strategies that lead to the discovery of unique paths and crashes. Speciﬁcally, partial path constraint solutions implicitly carried in these mutation strategies can be reused to accelerate the discovery of new paths and crashes that share similar partial path constraints. Therefore, we ﬁrst propose a lightweight and efﬁcient Proba- bilistic Byte Orientation Model ( PBOM ) that properly captures the byte-level mutation strategies from intra- and inter-trial history and thus can effectively trigger unique paths and crashes. We then present a novel history-driven mutation framework named EMS that employs PBOM as one of the mutation operators to probabilistically provide desired mutation byte values according to the input ones. We evaluate EMS against state-of-the-art fuzzers including AFL, QSYM, MO PT , MO PT -dict, EcoFuzz, and AFL++ on 9 real world programs. The results show that EMS discovers up to 4.91 × more unique vulnerabilities than the baseline, and ﬁnds more line coverage than other fuzzers on most programs. We report all of the discovered new vulnerabilities to vendors and will open source the prototype of EMS on GitHub.

NCMFuzzer: Using non-critical field mutation and test case combination to improve the efficiency of ICS protocol fuzzing

Vulnerability Detection of ICS Protocols Via Cross-State Fuzzing.

ICS Protocol Fuzzing: Coverage Guided Packet Crack and Generation

FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing

AMF: Efficient Browser Interprocess Communication Fuzzing

Constructing Cyber-Physical System Testing Suites Using Active Sensor Fuzzing

A deep convolution generative adversarial networks based fuzzing framework for industry control protocols

DiffusionFuzz: Fuzzing Framework of Industrial Control Protocols Based on Denoising Diffusion Probabilistic Model

A dynamic taint tracking optimized fuzz testing method based on multi-modal sensor data fusion

Active Fuzzing for Testing and Securing Cyber-Physical Systems

Fuzz testing in practice: Obstacles and solutions

Facilitating Vulnerability Assessment Through PoC Migration.

EMS: History-Driven Mutation for Coverage-based Fuzzing.

Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware

V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing

HFuzz: Towards automatic fuzzing testing of NB-IoT core network protocols implementations

Learning-Guided Network Fuzzing for Testing Cyber-Physical System Defences

Engineering a Better Fuzzer with Synergically Integrated Optimizations.

MSLFuzzer: black-box fuzzing of SOHO router devices via message segment list inference

Finding Causally Different Tests for an Industrial Control System

FuzzCoder: Byte-level Fuzzing Test via Large Language Model