Cloud systems are highly configurable, with hundreds to thousands of configuration parameters. Configuration-related bugs are major sources of cloud failures, yet most tests only run under default configurations, leaving systems vulnerable to untested configurations. This paper applies coverage-based greybox fuzzing to configuration testing of cloud systems. We use developer-written unit tests as fuzz drivers: they avoid the cluster-initialization overhead of system tests and thus provide the high test execution speed that greybox fuzzing demands. Since cloud systems expose hundreds to thousands of configuration parameters but any unit test typically exercises only a small subset of them (15.14% on average), we design parameter-aware mutation and fuzzing energy allocation strategies: (1) we restrict mutation to only the configuration parameters exercised by each seed, and (2) we incorporate both code coverage and configuration parameter coverage into fuzzing energy allocation, giving more effort to seeds that explore more code and parameters. We implement these ideas in ConfFuzz and evaluate it on nine widely used cloud systems. Compared with a greybox fuzzing baseline without parameter-aware mutation and energy allocation, ConfFuzz covers roughly 3.2 times more branches while exploring substantially more configuration parameters. In total, ConfFuzz and its variants have detected 125 bugs, of which 14 have been fixed and 12 more have been confirmed.

@inproceedings{paperbot12513,
  title = {ConfFuzz: Parameter-Aware Greybox Fuzzing for Configurable Cloud Systems},
  author = {Shuai Wang and Hao Wang and Darko Marinov and Tianyin Xu and Yongle Zhang},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3837476}
}