一句话：首次系统评估主流混合模糊测试器，并提出通过升级协调模式提升效果的 CoFuzz。
本文针对混合模糊测试器（结合模糊测试与 concolic 执行）评估设置不统一、性能优势不明确的问题，首次对最新混合模糊测试器展开广泛研究。研究发现，现有工具的性能难以泛化到不同基准与种子语料，且相对传统覆盖引导模糊测试的优势总体有限；协调模式比单独更新模糊策略或 concolic 执行器更关键。基于 QSYM，作者提出 CoFuzz，采用边导向调度，通过在线线性回归与随机梯度下降安排 concolic 执行，并采用采样增强同步，利用区间路径抽象和 John walk 生成种子并增量更新模型。评估显示，CoFuzz 的边覆盖比最佳混合模糊测试器高 16.31%，发现约两倍唯一崩溃，并检出 37 个未知缺陷，其中 30 个确认、8 个新 CVE、20 个修复。
To date, various hybrid fuzzers have been proposed for maximal program vulnerability exposure by integrating the power of fuzzing strategies and concolic executors. While the existing hybrid fuzzers have shown their superiority over conventional coverage-guided fuzzers, they seldom follow equivalent evaluation setups, e.g., benchmarks and seed corpora. Thus, there is a pressing need for a comprehensive study on the existing hybrid fuzzers to provide implications and guidance for future research in this area. To this end, in this paper, we conduct the first extensive study on state-of-the-art hybrid fuzzers. Surprisingly, our study shows that the performance of existing hybrid fuzzers may not well generalize to other experimental settings. Meanwhile, their performance advantages over conventional coverage-guided fuzzers are overall limited. In addition, instead of simply updating the fuzzing strategies or concolic executors, updating their coordination modes potentially poses crucial performance impact of hybrid fuzzers. Accordingly, we propose CoFuzz to improve the effectiveness of hybrid fuzzers by upgrading their coordination modes. Specifically, based on the baseline hybrid fuzzer QSYM, CoFuzz adopts edge-oriented scheduling to schedule edges for applying concolic execution via an online linear regression model with Stochastic Gradient Descent. It also adopts sampling-augmenting synchronization to derive seeds for applying fuzzing strategies via the interval path abstraction and John walk as well as incrementally updating the model. Our evaluation results indicate that CoFuzz can significantly increase the edge coverage (e.g., 16.31% higher than the best existing hybrid fuzzer in our study) and expose around 2X more unique crashes than all studied hybrid fuzzers. Moreover, CoFuzz successfully detects 37 previously unknown bugs where 30 are confirmed with 8 new CVEs and 20 are fixed.