paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Peeling Off the Cocoon: Unveiling Suppressed Golden Seeds for Mutational Greybox Fuzzing

剥茧抽丝:揭示变异灰盒模糊测试中被抑制的黄金种子
OOPSLA 10(OOPSLA1)2026匹配度 2/10 · 论文研究传统灰盒模糊测试中的种子选择与程序变换,不涉及 LLM/Agent、机器学习系统静态分析、浮点程序分析或贝叶斯程序分析,与用户研究画像的核心方向没有直接交集;仅在软件测试/程序分析外围相关。引用 0 inbox
Ruixiang Qian, Chunrong Fang, Zengxu Chen, Youxin Fu, Zhenyu Chen
crossref: 2026-09-10

AI 速览

一句话:提出 PoCo,通过禁用障碍条件守卫并迭代选择,挖掘被覆盖守卫抑制的黄金种子以提升模糊测试效果。

变异灰盒模糊测试的初始种子集影响效果,但种子集膨胀会降低吞吐。现有基于覆盖率的种子选择存在盲点:无法识别因未通过覆盖守卫而被抑制的黄金种子,即使其中包含有价值的载荷。论文提出 PoCo,通过轻量级程序变换灵活禁用障碍条件守卫,并借助守卫层级分析识别障碍守卫,再以迭代式种子选择逐步挖掘被抑制的黄金种子。作者在 AFL++ 4.10c 上实现原型,与七个基线(含 afl-cmin、OptiMin)比较:两小时内相比 afl-cmin 多选出 3–40 个种子。在 Magma 八个目标上进行超过 17,280 CPU 小时的 AFL++ 模糊测试,结果显示额外种子在覆盖率和缺陷发现上有适度提升,同时揭示了 PoCo 的局限并提炼出经验教训。

问题
传统基于覆盖率的种子选择存在盲点:无法识别被未通过覆盖守卫抑制的黄金种子,使这些含高价值载荷的种子无法发挥价值,进而可能降低下游变异灰盒模糊测试的效果。
方法
提出 PoCo,利用轻量级程序变换灵活禁用条件守卫,并通过守卫层级分析识别障碍守卫,再以迭代式种子选择算法逐步选出被抑制的黄金种子。
评估
在 AFL++ 4.10c 上实现原型,与七个基线(包括 afl-cmin 和 OptiMin)比较;两小时内可比 afl-cmin 多选出 3–40 个种子,并在 Magma 的八个目标上用 AFL++ 进行超过 17,280 CPU 小时的模糊测试,观察到覆盖率和缺陷发现的适度提升。
原文摘要(Abstract)

Mutational greybox fuzzing (MGF) is a powerful software testing technique. Initial seeds are critical for MGF since they define the space of possible inputs and fundamentally shape the effectiveness of MGF. Nevertheless, having more initial seeds is not always better. A bloated initial seed set can inhibit throughput, thereby degrading the effectiveness of MGF. To avoid bloating, modern fuzzing practices recommend performing seed selection to maintain golden seeds (i.e., those identified as beneficial for MGF) while minimizing the size of the set. Typically, seed selection favors seeds that execute unique code regions and discards those that contribute stale coverage. This coverage-based strategy is straightforward and useful, and is widely adopted by the fuzzing community. However, coverage-based seed selection (CSS) is not flawless and has a notable blind spot: it fails to identify golden seeds suppressed by unpassed coverage guards, even if these seeds contain valuable payload that can benefit MGF. This blind spot prevents suppressed golden seeds from realizing their true values, which may ultimately degrade the effectiveness of downstream MGF. In this paper, we propose a novel technique named PoCo to address the blind spot of traditional CSS. The basic idea behind PoCo is to manifest the true strengths of the suppressed golden seeds by gradually disabling obstacle conditional guards. To this end, we develop a lightweight program transformation to enable flexible disabling of guards and devise a novel guard hierarchy analysis to identify obstacle ones. An iterative seed selection algorithm is constructed to stepwise select suppressed golden seeds. We prototype PoCo on top of the AFL++ utilities (version 4.10c) and compare it with seven baselines, including two state-of-the-art tools afl-cmin and OptiMin . Compared with afl-cmin , PoCo selects 3–40 additional seeds within a practical time budget of two hours. To evaluate how effective the studied techniques are in seeding MGF, we further conduct extensive fuzzing (over 17, 280 CPU hours) with eight different targets from a mature benchmark named Magma, adopting the most representative fuzzer AFL++ for MGF. The results show that the additional seeds selected by PoCo yield modest improvements in both code coverage and bug discovery. Although our evaluation reveals some limitations of PoCo , it also demonstrates the presence and value of suppressed golden seeds. Based on the evaluation results, we distill lessons and insights that may inspire the fuzzing community.

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@article{paperbot3799,
  title = {Peeling Off the Cocoon: Unveiling Suppressed Golden Seeds for Mutational Greybox Fuzzing},
  author = {Ruixiang Qian and Chunrong Fang and Zengxu Chen and Youxin Fu and Zhenyu Chen},
  journal = {Proceedings of the ACM on Programming Languages},
  volume = {10},
  number = {OOPSLA1},
  year = {2026},
  doi = {10.1145/3798205}
}