一句话：提出 LLM 辅助的定向灰盒模糊测试框架，通过路径可行性过滤、难度排序与阻塞谓词种子合成提升漏洞触发效率。
定向灰盒模糊测试（DGF）能引导变异走向易受攻击代码区域，但常受目标路径优先级错置与阻塞谓词难满足两大瓶颈制约。ExcavatorFuzz 是 LLM 辅助的 DGF 框架：先做 CLI 感知可行性过滤，剪除配置不可行路径；再用综合显式谓词复杂度与隐式数据依赖复杂度的轻量难度度量排序候选路径。模糊测试中，它监测行级进展以发现阻塞路径，并通过结构化反馈调用 LLM 合成或精化种子来满足未满足谓词。在 30 个真实 C/C++ 基准上，24 小时内触发 29/30 个已知漏洞，相比七种先进模糊器平均获得 4.34 倍暴露时间加速；还发现三个未公开漏洞，其中两个获 CVE 编号。
Directed greybox fuzzing (DGF) is effective at steering mutations toward vulnerable code regions, but its efficiency is often limited by two bottlenecks: misprioritized target-reaching paths and hard-to-satisfy blocking predicates. We present ExcavatorFuzz, an LLM-assisted DGF framework that addresses both challenges in a unified workflow. ExcavatorFuzz first performs CLI-aware feasibility filtering to prune configuration-infeasible paths, and then ranks the remaining candidate paths using a lightweight difficulty metric that approximates their relative tractability based on explicit predicate complexity and implicit data-dependency complexity. During fuzzing, ExcavatorFuzz monitors line-level progress to detect blocked paths and invokes the LLM to synthesize or refine seeds for unsatisfied predicates using structured feedback. We evaluate ExcavatorFuzz on 30 real-world C/C++ benchmarks. ExcavatorFuzz triggers 29 out of 30 known vulnerabilities within 24 hours and achieves an average 4.34x speedup in time-to-exposure over seven state-of-the-art fuzzers. It also discovered three previously unknown vulnerabilities in open-source projects, two of which have been assigned CVE IDs.
@inproceedings{paperbot12533,
title = {ExcavatorFuzz: LLM-Guided Path-Difficulty-Driven Directed Greybox Fuzzing},
author = {Kaiyu Xie and Siyuan Li and Jiaqian Peng and Yun Yang and Yaowen Zheng and Kai Cheng and Jiayu Zhang and Shizhao Tian and Yubo Li and Hongsong Zhu},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837497}
}