一句话：提出用漏洞预测判断模糊测试是否饱和，以更早、更经济地停止测试活动，避免高估 fuzzing 效果。
模糊测试通过随机输入触发崩溃来发现安全漏洞，但何时停止测试活动十分困难。现有实践常在崩溃数或代码覆盖率一段时间内不再增长时终止；然而覆盖率可能只增长在非安全关键代码上，崩溃也可能重复触发，因此二者容易高估 fuzzing 的有效性，造成测试时间与成本浪费。本文提出 Green Fuzzing，一种基于饱和的停止准则，利用漏洞预测来判断 fuzzing 是否已接近漏洞发现饱和，从而决定是否终止。其目标是避免过早停止，同时减少不必要的测试开销。
Fuzzing is a widely used automated testing technique that uses random inputs to provoke program crashes indicating security breaches. A difficult but important question is when to stop a fuzzing campaign. Usually, a campaign is terminated when the number of crashes and/or covered code elements has not increased over a certain period of time. To avoid premature termination when a ramp-up time is needed before vulnerabilities are reached, code coverage is often preferred over crash count to decide when to terminate a campaign. However, a campaign might only increase the coverage on non-security-critical code or repeatedly trigger the same crashes. For these reasons, both code coverage and crash count tend to overestimate the fuzzing effectiveness, unnecessarily increasing the duration and thus the cost of the testing process.
@inproceedings{paperbot8055,
title = {Green Fuzzing: A Saturation-Based Stopping Criterion using Vulnerability Prediction},
author = {Stephan Lipp and Daniel Elsner and Severin Kacianka and Alexander Pretschner and Marcel Böhme and Sebastian Banescu},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598043}
}