SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866910822843809792 |
|---|---|
| author | Weissberg, Felix Möller, Jonas Ganz, Tom Imgrund, Erik Pirch, Lukas Seidel, Lukas Schloegel, Moritz Eisenhofer, Thorsten Rieck, Konrad |
| author_facet | Weissberg, Felix Möller, Jonas Ganz, Tom Imgrund, Erik Pirch, Lukas Seidel, Lukas Schloegel, Moritz Eisenhofer, Thorsten Rieck, Konrad |
| contents | A common paradigm for improving fuzzing performance is to focus on selected regions of a program rather than its entirety. While previous work has largely explored how these locations can be reached, their selection, that is, the where, has received little attention so far. A common paradigm for improving fuzzing performance is to focus on selected regions of a program rather than its entirety. While previous work has largely explored how these locations can be reached, their selection, that is, the where, has received little attention so far. In this paper, we fill this gap and present the first comprehensive analysis of target selection methods for fuzzing. To this end, we examine papers from leading security and software engineering conferences, identifying prevalent methods for choosing targets. By modeling these methods as general scoring functions, we are able to compare and measure their efficacy on a corpus of more than 1,600 crashes from the OSS-Fuzz project. Our analysis provides new insights for target selection in practice: First, we find that simple software metrics significantly outperform other methods, including common heuristics used in directed fuzzing, such as recently modified code or locations with sanitizer instrumentation. Next to this, we identify language models as a promising choice for target selection. In summary, our work offers a new perspective on directed fuzzing, emphasizing the role of target selection as an orthogonal dimension to improve performance. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2502_08341 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing Weissberg, Felix Möller, Jonas Ganz, Tom Imgrund, Erik Pirch, Lukas Seidel, Lukas Schloegel, Moritz Eisenhofer, Thorsten Rieck, Konrad Software Engineering Cryptography and Security A common paradigm for improving fuzzing performance is to focus on selected regions of a program rather than its entirety. While previous work has largely explored how these locations can be reached, their selection, that is, the where, has received little attention so far. A common paradigm for improving fuzzing performance is to focus on selected regions of a program rather than its entirety. While previous work has largely explored how these locations can be reached, their selection, that is, the where, has received little attention so far. In this paper, we fill this gap and present the first comprehensive analysis of target selection methods for fuzzing. To this end, we examine papers from leading security and software engineering conferences, identifying prevalent methods for choosing targets. By modeling these methods as general scoring functions, we are able to compare and measure their efficacy on a corpus of more than 1,600 crashes from the OSS-Fuzz project. Our analysis provides new insights for target selection in practice: First, we find that simple software metrics significantly outperform other methods, including common heuristics used in directed fuzzing, such as recently modified code or locations with sanitizer instrumentation. Next to this, we identify language models as a promising choice for target selection. In summary, our work offers a new perspective on directed fuzzing, emphasizing the role of target selection as an orthogonal dimension to improve performance. |
| title | SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing |
| topic | Software Engineering Cryptography and Security |
| url | https://arxiv.org/abs/2502.08341 |