Improving seed quality with historical fuzzing results

Abstract

Context:

Coverage-guided fuzzing (CGF) has achieved great success in discovering software vulnerabilities. The efficiency of CGF highly relies on the quality of the initial seed corpus. Although there have been some works in recent years investigating the initial seed selection, usually only the corpus given by developers or downloaded from the Internet is used to get the initial seed corpus.

Objective:

We assess several existing corpus minimization tools and find that none of them effectively leverage information contained in historical fuzzing results. The historical fuzzing results may come from previous fuzz testing or the emerging continuous fuzzing integration in the software development cycle. Therefore, we want to utilize history fuzzing results to generate a high-quality initial corpus to enhance the fuzzing performance. Besides, the size of the initial corpus will affect the fuzzing efficiency, so using a minimization tool to extract valuable seeds from historical results is essential.

Method:

We propose to use historical fuzzing results to help construct the initial seed corpus and further develop a corpus minimization tool named MCM (multiple corpora minimization), which can analyze multiple fuzzing results and use information including edge appearance frequency to help seed selection.

Results:

We implement a prototype of MCM and evaluate it on 10 open-source programs. Our experiments show that by using historical fuzzing results to expand the size of the initial seed corpus even a small number, e.g., from 20 to only 100, the branch coverage improves up to 14%. Meanwhile, MCM can achieve higher code coverage than existing corpus minimization tools, including AFL-CMIN and OPTIMIN.

Conclusion:

Our study shows using historical results to generate a high-quality initial corpus is practical and can effectively improve the fuzzing performance.