一句话：首次系统研究 JVM fuzzing 的初始种子选择，提出基于控制流图的选择方法，在更低开销下大幅提升缺陷发现能力。
JVM fuzzing 是保障实现质量的重要手段，而初始种子构成其流程基础。传统程序 fuzzing 研究已表明种子冗余会影响效果，但 JVM fuzzing 代码规模大、结构复杂且兼具语法与语义特征，既有种子选择方法是否适用尚不清楚。本文设计覆盖基于覆盖率、pre-fuzz 与程序特征三类共 10 种初始种子选择方法，并在三种 JVM 实现上结合 JavaTailor 与 VECT 两种先进 fuzzing 技术开展实证研究，从有效性与效率、真实程序表现、新缺陷检测三方面评估。结果显示，基于控制流图的程序特征方法开销仅约 30 秒，效果较使用全部种子提升 142%–269%，并能改善真实程序质量、提升未知缺陷检出数，所检出的 25 个缺陷中 21 个已被开发者确认或修复。
JVM fuzzing techniques serve as a cornerstone for guaranteeing the quality of implementations. In typical fuzzing workflows, initial seeds are crucial as they form the basis of the process. Literature in traditional program fuzzing has confirmed that effectiveness is largely impacted by redundancy among initial seeds, thereby proposing a series of seed selection methods. JVM fuzzing, compared to traditional ones, presents unique characteristics, including large-scale and intricate code, and programs with both syntactic and semantic features. However, it remains unclear whether the existing initial seed selection methods are suitable for JVM fuzzing and whether utilizing program features can enhance effectiveness. To address this, we devise a total of 10 initial seed selection methods, comprising coverage-based, prefuzz-based, and program-feature-based methods. We then conduct an empirical study on three JVM implementations to extensively evaluate the performance of the initial seed selection methods within two state-of-the-art fuzzing techniques (JavaTailor and VECT). Specifically, we examine performance from three aspects: (i) effectiveness and efficiency using widely studied initial seeds, (ii) effectiveness using the programs in the wild, and (iii) the ability to detect new bugs. Evaluation results first show that the program-feature-based method that utilizes the control flow graph not only has a significantly lower time overhead (i.e., 30s), but also outperforms other methods, achieving 142% to 269% improvement compared to the full set of initial seeds. Second, results reveal that the initial seed selection greatly improves the quality of wild programs and exhibits complementary effectiveness by detecting new behaviors. Third, results demonstrate that given the same testing period, initial seed selection improves the JVM fuzzing techniques by detecting more unknown bugs. Particularly, 21 out of the 25 detected bugs have been confirmed or fixed by developers. This work takes the first look at initial seed selection in JVM fuzzing, confirming its importance in fuzzing effectiveness and efficiency.
DOI 原文 ·
@inproceedings{paperbot8841,
title = {Selecting Initial Seeds for Better JVM Fuzzing},
author = {Tianchang Gao and Junjie Chen and Dong Wang and Yile Guo and Yingquan Zhao and Zan Wang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00028}
}