BaSFuzz: Fuzz testing based on difference analysis for seed bytes

doi:10.1016/j.jss.2025.112340

BaSFuzz: Fuzz testing based on difference analysis for seed bytes

2025-04-01

0

PRE

AI

DOI：10.1016/j.jss.2025.112340

Original

Original request for help

Save

Abstract

En 中文

Coverage-guided Greybox Fuzzing (CGF) is one of the most effective dynamic software testing techniques, which focus on improving the code coverage. The methodology automatically generates new offspring test cases by mutating existing test cases and analyzing program execution, preserving the interesting test cases as seeds for subsequent mutations. However, existing CGF tools often neglect the similarity between seeds. The mutation of similar seeds can yield a multitude of similar offspring test cases, subsequently executing similar code segments of the program under test. This challenge hinders the improvement of code coverage, consequently impacting the efficiency of fuzz testing. To address this issue, this paper proposes a fuzz testing method BaSFuzz based on difference analysis for seed bytes. The method leverages both byte similarity and structure similarity to analyze the differences between seed bytes. Subsequently, it computes a similarity score for each seed and reorders the seed queue in ascending order of similarity scores. Based on this method, a prototype tool is developed and compared with AFL, AFLFast, MOpt, AFL++-Hier and HTFuzz on 12 target programs. The experimental results indicate that BaSFuzz achieved 190.14%, 143.9%, 10.93%, 374.85% and 11.79% more edge coverage compared to the five tools, respectively. Additionally, BaSFuzz triggered unique crashes 3.57 times, 1.46 times, 42.38%, 2.85 times, and 33.44% more than the five tools, respectively.

Keywords:

Coverage-guided Greybox Fuzzing

Byte similarity

Structure similarity

Seed selection

BaSFuzz: Fuzz testing based on difference analysis for seed bytes

Abstract

Journal

Organization