一句话：FuzzerAid 用可执行的故障签名程序复现崩溃并聚类，把同一根因的 fuzzing 崩溃正确归为一组。
模糊测试在工业界被广泛用于发现程序缺陷，但每天会产生海量崩溃，人工诊断极其耗时。现有 fuzzer 常用代码覆盖率或调用栈哈希等廉价启发式去重，但精度不足，仍会把同一 bug 的多个崩溃报告为不同的“唯一”缺陷。本文提出 FuzzerAid，其核心是故障签名：一个由原程序中必要语句构成的小型可执行程序，能够复现某个缺陷。对给定崩溃，FuzzerAid 先生成故障签名，再用其他触发崩溃的输入执行该签名；若失败被复现，就把相应崩溃归入以该签名标记的组，否则生成新的签名。所有崩溃分类完毕后，再按同一根因合并故障签名。作者实现了工具并在 4 个大型开源项目、15 个真实缺陷产生的 3020 个崩溃上进行评估，正确定组率达 99.1%，仅报告 17（+2）个“唯一”缺陷，优于当前最先进的 fuzzer。
Fuzzing has been an important approach for finding bugs and vulnerabilities in programs. Many fuzzers deployed in industry run daily and can generate an overwhelming number of crashes. Diagnosing such crashes can be very challenging and time-consuming. Existing fuzzers typically employ heuristics such as code coverage or call stack hashes to weed out duplicate reporting of bugs. While these heuristics are cheap, they are often imprecise and end up still reporting many “unique” crashes corresponding to the same bug. In this paper, we present FuzzerAid that uses fault signatures to group crashes reported by the fuzzers. Fault signature is a small executable program and consists of a selection of necessary statements from the original program that can reproduce a bug. In our approach, we first generate a fault signature using a given crash. We then execute the fault signature with other crash inducing inputs. If the failure is reproduced, we classify the crashes into the group labeled with the fault signature; if not, we generate a new fault signature. After all the crash inducing inputs are classified, we further merge the fault signatures of the same root cause into a group. We implemented our approach in a tool called FuzzerAid and evaluated it on 3020 crashes generated from 15 real-world bugs and 4 large open source projects. Our evaluation shows that we are able to correctly group 99.1% of the crashes and reported only 17 (+2) “unique” bugs, outperforming the state-of-the-art fuzzers.