paperbot · PL 论文追踪

全部论文 待读 收藏

P2 RandSet: Randomized Corpus Reduction for Fuzzing Seed Scheduling

RandSet:面向模糊测试种子调度的随机化语料库缩减
OOPSLA 10(OOPSLA1)2026匹配度 2/10 · 该论文属于模糊测试与种子调度方向,聚焦语料库缩减以缓解种子爆炸,与用户画像中的静态分析、LLM/Agent 程序分析、浮点程序分析和贝叶斯程序分析均无直接关联。引用 0 inbox
Yuchong Xie, Kaikai Zhang, Yu Liu, Rundong Yang, Ping Chen, Shuai Wang, Dongdong She
crossref: 2026-09-10

AI 速览

一句话:提出随机化语料库缩减技术 RandSet,在缓解种子爆炸的同时实现多样化种子选择并保持低运行时开销。

种子爆炸指模糊测试语料库过大,导致调度难以选出有潜力的种子。现有工作侧重种子优先级排序,未缩减语料库规模。本文提出 RandSet,将种子调度中的语料库缩减建模为集合覆盖问题,并引入随机性计算覆盖全体特征的随机子集,以同时获得多样选择与低开销。RandSet 调度小型随机子集而非整个语料库。作者在 AFL++、LibAFL、Centipede 中实现,并在独立程序、FuzzBench、Magma 上评估。缩减后平均子集比例仅 4.03%/5.99%,AFL++ 中独立程序性能提升 16.58%,Magma 上多触发最多 7 个真实漏洞,额外开销低至 1.17%。

问题
模糊测试种子调度中的种子爆炸:语料库规模过大,难以从海量种子中选出有潜力的种子;已有种子优先级排序方法未缩减语料库规模。
方法
将种子调度中的语料库缩减形式化为集合覆盖问题,利用随机化算法计算覆盖整个语料库特征的随机种子子集,并用该小型随机子集进行种子调度;在 AFL++、LibAFL 和 Centipede 上实现。
评估
在独立程序、FuzzBench 和 Magma 基准上评估,与已有语料库缩减技术和最先进模糊器比较,报告子集比例、选择多样性、性能提升、真实漏洞触发数与运行时开销。
原文摘要(Abstract)

Seed explosion is a fundamental problem in fuzzing seed scheduling. It occurs when a fuzzer maintains a corpus with a huge number of seeds and fails to choose a promising one. Existing seed scheduling works focus on seed prioritization but suffer from the seed explosion since the seed corpus size is still huge. We tackle seed explosion from a new perspective, corpus reduction, i.e., compute a seed corpus subset. Corpus reduction can eliminate redundant seeds in the corpus and significantly reduce corpus size. However, this could lead to poor diversity in seed selection and severely impact the fuzzing performance. Meanwhile, effective corpus reduction incurs large runtime overhead. In practice, it’s challenging to adopt corpus reduction in fuzzing seed scheduling. Prior techniques like cull_queue , AFL-Cmin and MinSet all suffer from poor seed diversity. AFL-Cmin and MinSet incur prohibitive runtime overhead and are hence only applicable to one-time task initial seed selection rather than high-frequency seed scheduling. We propose a novel randomized corpus reduction technique, RandSet, that can reduce the corpus size and yield diverse seed selection simultaneously. Meanwhile, the runtime overhead of RandSet is minimal, suiting a high-frequency seed scheduling task. Our key insight is to introduce randomness into corpus reduction so as to enjoy the two benefits of a randomized algorithm: randomized output (i.e., diverse seed selection) and low runtime overhead. Specifically, we formulate the corpus reduction in seed scheduling as a classic set cover problem and compute a randomized subset of seed corpus as a set cover to cover all features of the entire corpus. We then develop a novel seed scheduling approach using the randomized corpus subset. Our technique can effectively mitigate seed explosion by scheduling a small and randomized subset of the corpus rather than the entire corpus. We implement RandSet on three popular fuzzers: AFL++, LibAFL and Centipede to showcase its general algorithmic design. We perform a comprehensive evaluation of RandSet on three benchmarks: standalone programs, FuzzBench and Magma. Our evaluation results show that RandSet can achieve significantly more diverse seed selection compared with other corpus reduction techniques. RandSet also yields high reduction ratio, achieving an average subset ratio of 4.03% and 5.99% after corpus reduction in terms of standalone programs and FuzzBench programs. In terms of fuzzing performance gain from our randomized corpus reduction, RandSet achieves a 16.58% gain on standalone programs and up to 3.57% gain on FuzzBench programs in AFL++. RandSet triggers up to 7 more ground-truth bugs than the state-of-the-art fuzzer on Magma, while introducing only 3.93% overhead on standalone programs and as low as 1.17% overhead on FuzzBench.

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@article{paperbot3781,
  title = {RandSet: Randomized Corpus Reduction for Fuzzing Seed Scheduling},
  author = {Yuchong Xie and Kaikai Zhang and Yu Liu and Rundong Yang and Ping Chen and Shuai Wang and Dongdong She},
  journal = {Proceedings of the ACM on Programming Languages},
  volume = {10},
  number = {OOPSLA1},
  year = {2026},
  doi = {10.1145/3798257}
}