Abstract:The energy allocation strategy is one of the most popular techniques in fuzzing to improve code coverage and vulnerability discovery. The core intuition is that fuzzers should allocate more computational energy to the seed files that have high efficiency to trigger unique paths and crashes after mutation. Existing solutions usually define several properties, e.g., the execution speed, the file size, and the number of the triggered edges in the control flow graph, to serve as the key measurements in their allocation logics to estimate the potential of a seed. The efficiency of a property is usually assumed to be the same across different programs. However, we find that this assumption is not always valid. As a result, the state-of-the-art energy allocation solutions with static energy allocation logics are hard to achieve desirable performance on different programs. To address the above problem, we propose a novel program-sensitive solution, named SLIME, to enable adaptive energy allocation on the seed files with various properties for each program. Specifically, SLIME first designs multiple property-aware queues, with each queue containing the seed files with a specific property. Second, to improve the return of investment, SLIME leverages a customized Upper Confidence Bound Variance-aware (UCB-V) algorithm to statistically select a property queue with the most estimated reward, i.e., finding the most new unique execution paths and crashes. Finally, SLIME mutates the seed files in the selected property queue to perform property-adaptive fuzzing on a program. We evaluate SLIME against state-of-the-art open source fuzzers AFL, MOPT, AFL++, AFL++HIER, EcoFuzz, and TortoiseFuzz on 9 real-world programs. The results demonstrate that SLIME discovers 3.53X, 0.24X, 0.62X, 1.54X, 0.88X, and 3.81X more unique vulnerabilities compared to the above fuzzers, respectively. We will open source the prototype of SLIME to facilitate future fuzzing research.

SAFL: increasing and accelerating testing coverage with symbolic execution and guided fuzzing.

FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing

FairFuzz: a targeted mutation strategy for increasing greybox fuzz testing coverage

Path Sensitive Fuzzing for Native Applications

AFL++: A Vulnerability Discovery and Reproduction Framework

SLIME: Program-sensitive Energy Allocation for Fuzzing

BazzAFL: Moving Fuzzing Campaigns Towards Bugs Via Grouping Bug-Oriented Seeds

PAFL: Extend Fuzzing Optimizations of Single Mode to Industrial Parallel Mode

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

FuzzCoder: Byte-level Fuzzing Test via Large Language Model

Semantic Sensitive Coverage-based Fuzzing

Target Program Select Test Input Trim Test Input Mutate Test Input Execute Program Update Queue Instrument Program Grammar

Facilitating Parallel Fuzzing with mutually-exclusive Task Distribution

ISC4DGF: Enhancing Directed Grey-box Fuzzing with LLM-Driven Initial Seed Corpus Generation

Evolutionary Mutation-based Fuzzing as Monte Carlo Tree Search

SYNTONY: Potential-Aware Fuzzing with Particle Swarm Optimization

Better Pay Attention Whilst Fuzzing.

Deep Learning-Based Hybrid Fuzz Testing

Improve Model Testing by Integrating Bounded Model Checking and Coverage Guided Fuzzing

Superion: Grammar-Aware Greybox Fuzzing

CAMFuzz: Explainable Fuzzing with Local Interpretation