Abstract:Mutation-based fuzzing is a simple yet effective technique to discover bugs and security vulnerabilities in software. Given a set of well-formed initial seeds, mutation-based fuzzers continually generate interesting seeds by applying specific mutation strategy in order to maximize code coverage or the number of unique bugs explored at any point-in-time. However, existing fuzzers remain limited in the paths it could cover since it simply follows a uniform distribution to choose mutation operators. In this paper, we proposed a novel context-aware adaptive mutation scheme, namely CMFuzz, which utilizes a contextual bandit algorithm LinUCB to effectively choose optimal mutation operators for various seed files. To this end, CMFuzz dynamically extracts and encodes file characteristics, which allows mutation-based fuzzers to perform context-aware mutation. We apply this scheme on top of several state-of-the-art fuzzers, i.e., PTfuzz, AFL, and AFLFast, and implement CMFuzz-PT, CMFuzz-AFL, and CMFuzz-AFLFast, respectively. We conduct evaluation on 12 real-world open source applications and LAVA-M dataset against their counterparts. Extensive evaluations demonstrate that CMFuzz-based fuzzers achieve higher code coverage and find more crashes at a faster rate than their counterparts on most cases. Furthermore, we also utilize other mainstream bandit algorithms, e.g., Thompson Sample and epsilon-greedy, and implement Thompson-PT and Greedy-PT based on PTfuzz to examine the performance of proposed model. CMFuzz-PT significantly outperforms Thompson-PT especially in terms of unique crashes and paths, i.e., found 1.79× unique crashes and 1.29× unique paths on average. Compared to Greedy-PT, our approach still increases the amount of unique crashes and paths by 1.11× and 1.05×, respectively.

JFuzz: A Tool for Automated Java Unit Testing Based on Data Mutation and Metamorphic Testing Methods

FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing

Fuzzing for CPS Mutation Testing

MOTIF: A tool for Mutation Testing with Fuzzing

Systematic Assessment of Fuzzers using Mutation Analysis

Testing Software Modelling Tools Using Data Mutation.

Generating Structurally Complex Test Cases by Data Mutation: A Case Study of Testing an Automated Modelling Tool

Investigating Coverage Guided Fuzzing with Mutation Testing

DeltaFuzz: Historical Version Information Guided Fuzz Testing

JSTIFuzz: Type-Inference-based JavaScript Engine Fuzzing

FairFuzz: a targeted mutation strategy for increasing greybox fuzz testing coverage

Homo in Machina: Improving Fuzz Testing Coverage via Compartment Analysis

Coverage-directed Differential Testing of JVM Implementations.

CMFuzz: Context-Aware Adaptive Mutation for Fuzzers

AMSFuzz: an Adaptive Mutation Schedule for Fuzzing

JMLAutoTest: A Novel Automated Testing Framework Based on JML and JUnit

Fuzzing with Optimized Grammar-Aware Mutation Strategies

MMFuzz: Towards Enhancing RTL Fuzz Testing Using Metric Feedbacks Based on Markov Chain

Fuzz Testing Based On Virtualization Technology

PyFuzzer: Automatic in-memory fuzz testing method

FuzzFactory: domain-specific fuzzing with waypoints