Pith. sign in

REVIEW 3 major objections 5 minor 83 references

Ensemble Fuzzing with Dynamic Resource Scheduling and Multidimensional Seed Evaluation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that Legion, an ensemble fuzzing framework that reallocates CPU cores among base fuzzers each round via a multi-armed bandit scheduler and five-metric seed evaluation, outperforms existing ensemble fuzzing in coverage…

desk verdict Real empirical work, but Algorithm 2 as printed cannot schedule more than one core; without a corrected algorithm and artifact, the reported gains are unverifiable. read the letter →

arxiv 2507.22442 v2 pith:XSRQPQCA submitted 2025-07-30 cs.SE

Yukai Zhao , Shaohua Wang , Jue Wang , Xing Hu , Xin Xia This is my paper · ORCID
classification cs.SE
keywords ensemblefuzzingdynamicresourceschedulingmulti-armedbanditupperconfidenceboundseedevaluationcoverage-guidedvulnerabilitydetectionfuzzer-test-suite
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Legion is an ensemble fuzzing framework that runs several base fuzzers in parallel and, at each round, reallocates CPU cores among them based on each fuzzer's measured recent contribution. The paper claims this dynamic scheduling, modeled as a multi-armed bandit and driven by a five-metric seed evaluation, avoids the fixed allocation of EnFuzz and the profiling overhead of Autofz while finding more code and more bugs. On the fuzzer-test-suite, Legionα reports 10.63% and 5.62% more covered branches, 6.44% and 3.74% more executed paths, and 11.54% and 5.45% more unique crashes than EnFuzz and Autofzα. On nine current open-source projects, Legionβ reports 20 vulnerabilities, five previously unknown and three classified as CVEs, all five new bugs confirmed by developers. The paper's aim is to show that online, feedback-driven core assignment makes a fixed pool of fuzzers more productive than static or phase-based ensemble methods.

What carries the argument

The load-bearing mechanism is the round-based scheduling loop in Algorithm 1, with the UCB-style assignment in Algorithm 2 and the multidimensional seed reward of Section 3.3. Each fuzzer is an arm; assigning one CPU core for one round is one pull; the reward is the weighted sum of the five seed contributions; and the selection score combines that reward with an exploration term so that poorly explored fuzzers are tried again while proven producers get more cores. A fine-tuning step runs every half-round, stops fuzzers that stop producing beneficial seeds, and hands their cores to the current best fuzzer.

What would settle it

Track the provenance of every seed that increases coverage during a round: if a large share of a fuzzer's rewarded seeds were inherited from the global pool rather than produced by its own mutations, the reward signal misattributes credit and the scheduler is steering on noise rather than on fuzzer skill.

Watch

Extended reading notes

Core claim

The central claim is that an ensemble fuzzer can be steered online without a separate profiling phase by treating every base fuzzer as an arm of a multi-armed bandit and using its previous round's local seed pool as the reward. Legion scores each fuzzer on five metrics - new edges, new paths, crashes, deep edges, and rarely covered edges - weights the metrics by their standard deviation across fuzzers each round, adds a UCB exploration term, and assigns cores by soft-max selection. The reported result is that this scheduler makes Legionα consistently beat EnFuzz and Autofzα on branches, paths, and crashes across the fuzzer-test-suite, and makes Legionβ find 20 vulnerabilities in nine real-world projects, including every bug that the strongest single base fuzzer found and five bugs no tool had reported before.

Load-bearing premise

The scheduler assumes that the seeds found in a fuzzer's local pool at the end of a round measure that fuzzer's own contribution, even though every fuzzer starts the round from the same shared global seed pool and returns its seeds to it.

Editorial extensions

If this is right

  • If the reported numbers hold, a 12-hour six-core Legionα campaign covers 409,502 branches on the fuzzer-test-suite, compared with 370,138 for EnFuzz and 387,730 for Autofzα.
  • Legionβ's 20 bugs in nine projects include all 15 found by AFL++, so adding dynamic scheduling on top of a state-of-the-art fuzzer still yields a 33% improvement in bug finding.
  • The ablation variants attribute part of the gain to each mechanism: the random-scheduling variant NS loses 13.52% of branches and 23.40% of crashes, while the coverage-only variant Cov loses 5.92% of branches and 11.54% of crashes relative to Legionα.
  • Legion triggers all 58 unique crashes and all crashes found by EnFuzz (52) and Autofzα (55), with no crash lost to the scheduling decisions.
  • Because Legion's overhead stays stable while Autofz's profiling overhead grows past 10% in later rounds, the advantage should widen on longer campaigns.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct test of the reward model: log the provenance of every new-coverage seed in a round; if most come from seeds inherited from the global pool rather than mutations by the assigned fuzzer, the scheduler is crediting the wrong fuzzer and may be steering on noise.
  • As printed, Algorithm 2 defines $q = \frac{\gamma}{\gamma+t}$, which is not an average reward, so a literal implementation of the pseudo-code would differ from the scheduler the evaluation describes; the empirical claims depend on the implemented reward update, not the formula.
  • The five-metric reward could serve as a general corpus-minimization criterion for parallel fuzzing, ranking seeds by long-term promise instead of immediate new coverage.
  • If the scheduling signal is truly meaningful, running Legion on a pool of identical fuzzers should produce near-uniform core allocation; non-uniform allocation there would indicate that the UCB exploration term, not fuzzer skill, dominates early decisions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper presents Legion, an ensemble fuzzing framework that dynamically schedules CPU resources among base fuzzers using a UCB-style multi-armed bandit formulation and evaluates seeds with a multidimensional reward combining edge/path coverage, crash counts, deep-edge coverage, and rare-edge coverage. The framework splits a campaign into rounds, schedules fuzzers onto resource units, synchronizes seeds through a global pool, and adaptively weights the reward components by their standard deviations across fuzzers. The evaluation compares Legion variants with EnFuzz and Autofz on 24 fuzzer-test-suite subjects and with six modern base fuzzers on nine real-world projects, reporting average improvements of 10.63%/5.62% in branches, 6.44%/3.74% in paths, and 11.54%/5.45% in unique crashes over EnFuzz/Autofz, as well as 20 bugs with five previously unknown.

Significance. If the reported results hold, Legion is a useful engineering contribution to ensemble fuzzing: it replaces Autofz's per-round preparation phase with a low-overhead scheduler, adds fine-grained seed metrics, and demonstrates consistent gains over strong baselines across many subjects. The evaluation is extensive and careful in several respects: all experiments are repeated ten times, Mann-Whitney U tests are reported for branch and path coverage, ablation variants (NS and Cov) isolate the scheduling and evaluation components, and the real-world bug findings include developer confirmation. The main weakness is that the central scheduling algorithm is described by pseudocode that is internally inconsistent, so the paper currently does not pin down the method that produced the results.

major comments (3)
  1. [§3.2, Algorithm 2 (Lines 3–19)] As printed, `schedule-resources` cannot allocate six cores to six fuzzers. `assign` removes the selected tuple from `Q` at Line 17, and `schedule-resources` calls `assign` once per resource unit (Lines 3–5); after the first call the candidate set is empty (or shorter than `R`), so later soft-max selections are undefined. If `Q` is instead passed by value, Line 17 has no effect on the caller and the accompanying statement that removing from the candidate list ensures each fuzzer is assigned only once is false; the text in §3.3 also says a base fuzzer may run on multiple resource units simultaneously. In addition, `N` is incremented only in the local scope of `assign` and never returned, so the exploration term cannot use an accumulated pull count. The pseudocode must be rewritten with explicit selection-with-replacement or state-passing semantics, and the actual implementation should be released to confirm that it implements the corrected algorithm.
  2. [§3.2, Algorithm 2 Lines 11–16 and 22–29] q=γ/(γ+t) is labeled 'average reward' but γ is the accumulated reward over past rounds and t is the previous round pull count, so the ratio is not a mean reward; if a normalized score is intended, the text should say so. Furthermore, a fuzzer that was not scheduled in a round has t=0 and is then treated as never-deployed at Line 11, resetting its evaluation to q_init=1, u_init=∞ despite any accumulated γ; this discards historical information and contradicts the 'historical reward' claim. Finally, when more than one fuzzer has t=0 (which happens in the initial priming round), every such fuzzer has exp(q+u)=exp(∞), so the soft-max in Line 18 is undefined; the statement that the priming round selects all base fuzzers does not follow from the formula.
  3. [§3.1 and §3.3] The reward γ_new used for UCB updates is computed by evaluating the entire final local pool S_f, but all fuzzers are initialized each round from the same global pool and receive synchronized seeds during the round. Coverage newly discovered in S_f can therefore originate from seeds produced by another fuzzer rather than by f itself. This makes the rewards misattribute performance and the scheduler may steer on noise. The paper should describe how seed provenance is tracked (e.g., marking newly generated seeds, isolating per-fuzzer mutations) or provide an empirical analysis of the sensitivity of scheduling decisions to this attribution.
minor comments (5)
  1. [Various] There are several typos and small errors: 'Micorsoft' in §2.1, 'forseed synchronization' in §3.1, 'fuzzersz' in Related Work, and the function name 'chedule-resources' in Algorithm 2 should be 'schedule-resources'.
  2. [Listing 1] The caption says 'Python example' but the code is written in C syntax with `void foo(char *A, ...)`; please correct the caption or the code.
  3. [§3.3] The definition of 'less frequently covered edges' as edges whose coverage count is less than 1/2 μ is ambiguous because μ is defined as the average coverage count of all covered edges; clarify whether μ is recomputed per round and how edges with zero coverage are treated.
  4. [§4.2 and Evaluation] No artifact or repository link is provided. Given the central role of the scheduler and the inconsistencies in Algorithm 2, an artifact would be needed to verify that the implementation matches the described method.
  5. [Figure 4] The overhead measure for Autofz counts preparation-phase CPU hours that include running fuzzers, while Legion's overhead counts CPU hours not used to run base fuzzers; the two definitions are not directly comparable and should be stated more explicitly.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: Legion's central claims are empirical comparisons against external baselines; the data-dependent evaluation weights are a heuristic, not a folded prediction.

full rationale

Legion's headline results (10.63% more branches, 6.44% more paths, 11.54% more unique crashes than EnFuzz/Autofzα; 20 real-world bugs) are empirical measurements against external baselines (EnFuzz, Autofz, fuzzer-test-suite, and nine real-world projects), not quantities derived from fitted constants. The resource scheduler and seed evaluation are heuristics whose claimed value is supported by ablations (NS and Cov) and by direct comparison with external tools; no equation makes the reported outcome equal to an input by construction. The θ weights in Section 3.3 are recomputed from the same c_j metrics they weight, and the 'less frequently covered edges' threshold uses an 'empirically tested and selected' factor, but these are design choices inside the method, not predictions that reduce to their inputs. The only self-citations (refs [51] and [76]) appear in related-work context and are not load-bearing. Per the reviewing rule, I explicitly flag two non-circular correctness risks: Algorithm 2's assign loop removes each fuzzer from Q via 'Q←Q/{⟨f,γ,t⟩}' on line 17, so with six cores the second assignment sees an empty candidate set; 'q←γ/(γ+t)' on line 12 is not an average reward; and u_init=+∞ makes the soft-max in the priming round undefined. These would prevent the printed algorithm from being the implemented scheduler, but they are internal-consistency or reproducibility defects, not cases where a claimed result is equivalent to its inputs. Overall circularity score: 2.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central method rests on hand-chosen thresholds and on attribution assumptions about seeds, not on new physical or mathematical entities. The main free parameters are the deep-edge and rare-edge thresholds, the initial UCB values, and the adaptive reward weights. The strongest hidden assumption is that local seed pools cleanly reflect the performance of the assigned fuzzer despite global synchronization.

free parameters (4)
  • deep-edge depth factor rho = 1.5
    Section 3.3: edges deeper than 1.5 times the average call depth are counted as deep; chosen from an outlier-detection convention rather than an independent objective.
  • rare-edge coverage factor = 1/2
    Section 3.3: edges covered fewer than half the average coverage count are 'less frequently covered'; the paper states this factor was empirically tested and selected.
  • initial UCB values (q_init, u_init) = q_init=1, u_init=positive infinity
    Algorithm 2, Line 16: these values force deployment of every fuzzer in the priming round; with multiple never-deployed fuzzers the soft-max over infinite values is undefined as written.
  • reward weight vector theta = theta_j = sigma_j / sum(sigma_i), per round
    Section 3.3: weights are recomputed from the standard deviation of each metric across selected fuzzers, so the reward function adapts to the same data being measured.
assumptions (4)
  • domain assumption Seed value is a linear combination of five metrics: gamma_s(theta) = sum theta_j c_j.
    Section 3.3 assumes coverage increments, crash counts, deep-edge counts, and rare-edge counts can be summed into a scalar reward that predicts future fuzzer value.
  • domain assumption New coverage in a fuzzer's local seed pool is attributable to that fuzzer.
    Section 3.1 and Algorithm 2 perf-feedback credit each fuzzer with seeds in its local pool, but all fuzzers start from the global pool and synchronize, so inherited global seeds may dominate the measured contribution.
  • ad hoc to paper The UCB exploration formulation remains valid after replacing cumulative pull counts with previous-round pull counts.
    Section 3.2 acknowledges that standard UCB assumptions are violated by fuzzing randomness and uses t = previous round pull count; no regret bound or convergence guarantee is provided for this modification.
  • domain assumption Static call-graph depth approximates deep program states.
    Section 3.3 defines deep edges through call-graph depth with a single factor rho = 1.5; this is a proxy that may miss data-flow depth or input-dependent depth.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Ensemble Fuzzing with Dynamic Resource Scheduling and Multidimensional Seed Evaluation." pith.science (2026). https://pith.science/paper/XSRQPQCA

@misc{pith2026250722442,
  author       = {Pith},
  title        = {Pith review of: Ensemble Fuzzing with Dynamic Resource Scheduling and Multidimensional Seed Evaluation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XSRQPQCA}},
  note         = {Machine review of arXiv:2507.22442}
}
read the original abstract

Fuzzing is widely used for detecting bugs and vulnerabilities, with various techniques proposed to enhance its effectiveness. To combine the advantages of multiple technologies, researchers proposed ensemble fuzzing, which integrates multiple base fuzzers. Despite promising results, state-of-the-art ensemble fuzzing techniques face limitations in resource scheduling and performance evaluation, leading to unnecessary resource waste. In this paper, we propose Legion, a novel ensemble fuzzing framework that dynamically schedules resources during the ensemble fuzzing campaign. We designed a novel resource scheduling algorithm based on the upper confidence bound algorithm to reduce the resource consumption of ineffective base fuzzers. Additionally, we introduce a multidimensional seed evaluation strategy, which considers multiple metrics to achieve more comprehensive fine-grained performance evaluation. We implemented Legion as a prototype tool and evaluated its effectiveness on Google's fuzzer-test-suite as well as real-world open-source projects. Results show that Legion outperforms existing state-of-the-art base fuzzers and ensemble fuzzing techniques, detecting 20 bugs in real-world open-source projects-five previously unknown and three classified as CVEs.

Figures

Figures reproduced from arXiv: 2507.22442 by the authors.

Figure 2
Figure 2. Overview of the Legion Framework resources to 𝑓 , increasing its chances of generating seeds containing “Magic_Number”. Moreover, all generated seeds are synchronized to other base fuzzers to increase the chances of directly triggering the bug after solving the constraint Line 14. 3 Our Approach: Legion 3.1 Overview [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 4
Figure 4. Overhead analysis for the first 12 rounds. 4.2 Settings and Analysis Procedures RQ1 Analysis Procedure. To answer RQ1, we compared Legion with state-of-the-art ensemble fuzzing techniques EnFuzz [12] and Autofz [21] on the fuzzer-test-suite. EnFuzz integrates six base fuzzers, namely AFL [22], AFLFast [4], FairFuzz [36], LibFuzzer [57], Radamsa [31], and QSYM [74]. Considering that the implementation of EnFuzz is de… view at source ↗
Figure 5
Figure 5. RQ1. Overlapping results between Legion𝛼 , EnFuzz, and Autofz𝛼 algorithm quickly outweighed such additional cost, giving Legion𝛼 a substantial lead over EnFuzz after three hours. Compared with Autofz𝛼 , Legion𝛼 achieves slightly worse in the first hour but quickly catches up. While Legion𝛼 utilizes the fuzzing results of previous rounds for resource scheduling, Autofz𝛼 conducts a Preparation Phase at each round. Suc… view at source ↗
Figures from the paper (1 more)
Figure 6
Figure 6. Figure 6: RQ4. Coverage results of tools on real-world projects [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

83 extracted references · 59 canonical work pages

  1. [1]

    Craig Beaman, Michael Redbourne, J Darren Mummery, and Saqib Hakak. 2022. Fuzzing vulnerability discovery techniques: Survey, challenges and future directions. Computers & Security 120 (2022), 102813

    2022

  2. [2]

    Jacob Beningo and Jacob Beningo. 2017. Documenting Firmware with Doxygen. Reusable Firmware Development: A Practical Approach to APIs, HALs and Drivers (2017), 121–148

    2017

  3. [3]

    Aabha Biyani, Gantavya Sharma, Jagannath Aghav, Piyush Waradpande, Purva Savaji, and Mrityunjay Gautam. 2011. Extension of SPIKE for Encrypted Protocol Fuzzing. In 2011 Third International Conference on Multimedia Information Networking and Security. 343–347. doi:10.1109/MINES.2011.143

    work page doi:10.1109/mines.2011.143 2011

  4. [4]

    Marcel Böhme, Van-Thuan Pham, and Abhik Roychoudhury. 2016. Coverage-Based Greybox Fuzzing as Markov Chain. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (Vienna, Austria) (CCS ’16). Association for Computing Machinery, New York, NY, USA, 1032–1043. doi:10.1145/2976749.2978428

    arXiv 2016

  5. [5]

    Sébastien Bubeck, Nicolo Cesa-Bianchi, et al. 2012. Regret analysis of stochastic and nonstochastic multi-armed bandit problems. Foundations and Trends® in Machine Learning 5, 1 (2012), 1–122

    2012

  6. [6]

    Alexander Bulekov, Bandan Das, Stefan Hajnoczi, and Manuel Egele. 2023. No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions.. In NDSS

    work page 2023

  7. [7]

    Konstantin Böttinger, Patrice Godefroid, and Rishabh Singh. 2018. Deep Reinforcement Fuzzing. In 2018 IEEE Security and Privacy Workshops (SPW). 116–122. doi:10.1109/SPW.2018.00026

    arXiv 2018

  8. [8]

    Alexandra Carpentier, Alessandro Lazaric, Mohammad Ghavamzadeh, Rémi Munos, and Peter Auer. 2011. Upper- confidence-bound algorithms for active learning in multi-armed bandits. In International Conference on Algorithmic Learning Theory. Springer, 189–203

    work page 2011

Show all 83 references
  1. [9]

    Chen Chen, Baojiang Cui, Jinxin Ma, Runpu Wu, Jianchao Guo, and Wenqian Liu. 2018. A systematic review of fuzzing techniques. Computers & Security 75 (2018), 118–137

    2018

  2. [10]

    Peng Chen and Hao Chen. 2018. Angora: Efficient Fuzzing by Principled Search. In 2018 IEEE Symposium on Security and Privacy (SP). 711–725. doi:10.1109/SP.2018.00046

    2018

  3. [11]

    Yaohui Chen, Mansour Ahmadi, Reza Mirzazade farkhani, Boyu Wang, and Long Lu. 2020. MEUZZ: Smart Seed Scheduling for Hybrid Fuzzing. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020). USENIX Association, San Sebastian, 77–92. https://w...

    2020

  4. [12]

    Yuanliang Chen, Yu Jiang, Fuchen Ma, Jie Liang, Mingzhe Wang, Chijin Zhou, Xun Jiao, and Zhuo Su. 2019. EnFuzz: Ensemble Fuzzing with Seed Synchronization among Diverse Fuzzers. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA, 1967–1...

    2019

  5. [13]

    Yongheng Chen, Rui Zhong, Yupeng Yang, Hong Hu, Dinghao Wu, and Wenke Lee. 2023. {𝜇FUZZ}: Redesign of Parallel Fuzzing using Microservice Architecture. In32nd USENIX Security Symposium (USENIX Security 23). 1325–1342

    2023

  6. [14]

    Mingi Cho, Seoyoung Kim, and Taekyoung Kwon. 2019. Intriguer: Field-Level Constraint Solving for Hybrid Fuzzing. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (London, United Kingdom) (CCS ’19). Association for Computing Machinery, Ne...

    2019

  7. [15]

    Jaeseung Choi, Joonun Jang, Choongwoo Han, and Sang Kil Cha. 2019. Grey-box concolic testing on binary code. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . IEEE, 736–747

    2019

  8. [17]

    Christian Degott, Nataniel P Borges Jr, and Andreas Zeller. 2019. Learning user interface element interactions. In Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis . 296–306

    2019

  9. [18]

    Yinlin Deng, Chunqiu Steven Xia, Haoran Peng, Chenyuan Yang, and Lingming Zhang. 2023. Large Language Models Are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and...

    2023

  10. [19]

    Andrea Fioraldi, Daniele Cono D’Elia, and Davide Balzarotti. 2021. The use of likely invariants as feedback for fuzzers. In Security

    2021

  11. [20]

    Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, and Marc Heuse. 2020. AFL++ : Combining Incremental Steps of Fuzzing Research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20) . USENIX Association. https: //www.usenix.org/conference/woot20/presentation/fioraldi

    2020

  12. [21]

    Yu-Fu Fu, Jaehyuk Lee, and Taesoo Kim. 2023. autofz: Automated Fuzzer Composition at Runtime. arXiv:2302.12879 [cs.CR]

    2023 arXiv

  13. [22]

    Google. 2023. American Fuzzy Loop. Retrieved July 27, 2023 from https://github.com/google/AFL

    2023

  14. [23]

    Google. 2023. fuzzer-test-suite. Retrieved July 27, 2023 from https://github.com/google/fuzzer-test-suite , Vol. 1, No. 1, Article . Publication date: September 2025. 20 Yukai Zhao, Shaohua Wang, Jue Wang, Xing Hu, and Xin Xia

    2023

  15. [24]

    Google. 2023. HonggFuzz. Retrieved July 27, 2023 from https://honggfuzz.dev/

    2023

  16. [25]

    Google. 2023. OSS-Fuzz. Retrieved July 27, 2023 from https://google.github.io/oss-fuzz/

    2023

  17. [26]

    Google. 2023. Peach Fuzzer. Retrieved July 27, 2023 from https://peachtech.gitlab.io/peach-fuzzer-community/

    2023

  18. [27]

    Taotao Gu, Xiang Li, Shuaibing Lu, Jianwen Tian, Yuanping Nie, Xiaohui Kuang, Zhechao Lin, Chenyifan Liu, Jie Liang, and Yu Jiang. 2022. Group-based corpus scheduling for parallel fuzzing. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Sympos...

    2022

  19. [28]

    Emre Güler, Philipp Görz, Elia Geretto, Andrea Jemmett, Sebastian Österlund, Herbert Bos, Cristiano Giuffrida, and Thorsten Holz. 2020. Cupid: Automatic Fuzzer Selection for Collaborative Fuzzing. In Annual Computer Security Applications Conference (Austin, USA) (ACSAC ’20). A...

    2020

  20. [29]

    Suyue Guo, Xinyu Wan, Wei You, Bin Liang, Wenchang Shi, Yiwei Zhang, Jianjun Huang, and Jian Zhang. 2023. Operand-Variation-Oriented Differential Analysis for Fuzzing Binding Calls in PDF Readers. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . ...

    2023

  21. [30]

    Nima Shiri Harzevili, Alvine Boaye Belle, Junjie Wang, Song Wang, Zhen Ming, Nachiappan Nagappan, et al. 2023. A survey on automated software vulnerability detection using machine learning and deep learning. arXiv preprint arXiv:2306.11673 (2023)

    2023 arXiv

  22. [31]

    Aki Helin. 2023. Radamsa. Retrieved July 27, 2023 from https://gitlab.com/akihe/radamsa

    2023

  23. [32]

    Jie Hu, Qian Zhang, and Heng Yin. 2023. Augmenting Greybox Fuzzing with Generative AI. arXiv:2306.06782 [cs.CR]

    2023 arXiv

  24. [33]

    Zhicheng Hu, Jianqi Shi, YanHong Huang, Jiawen Xiong, and Xiangxing Bu. 2018. GANFuzz: A GAN-Based Industrial Network Protocol Fuzzing Framework. In Proceedings of the 15th ACM International Conference on Computing Frontiers (Ischia, Italy)(CF ’18). Association for Computing M...

    2018

  25. [34]

    Zhiyuan Jiang, Shuitao Gan, Adrian Herrera, Flavio Toffalini, Lucio Romerio, Chaojing Tang, Manuel Egele, Chao Zhang, and Mathias Payer. 2022. Evocatio: Conjuring bug capabilities from a single poc. In Proceedings of the 2022 ACM SIGSAC conference on computer and communication...

    2022

  26. [35]

    Suyoung Lee, HyungSeok Han, Sang Kil Cha, and Sooel Son. 2020. Montage: A Neural Network Language Model- Guided JavaScript Engine Fuzzer. In 29th USENIX Security Symposium (USENIX Security 20) . USENIX Association, 2613–2630. https://www.usenix.org/conference/usenixsecurity20/...

    2020

  27. [36]

    Caroline Lemieux and Koushik Sen. 2018. FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage. In Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering (Montpellier, France) (ASE ’18). Association for Computin...

    2018

  28. [37]

    Yuekang Li, Yinxing Xue, Hongxu Chen, Xiuheng Wu, Cen Zhang, Xiaofei Xie, Haijun Wang, and Yang Liu. 2019. Cerebro: Context-Aware Adaptive Fuzzing for Effective Vulnerability Detection. In Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conferen...

    2019

  29. [38]

    Jie Liang, Yu Jiang, Yuanliang Chen, Mingzhe Wang, Chijin Zhou, and Jiaguang Sun. 2018. Pafl: extend fuzzing optimizations of single mode to industrial parallel mode. In Proceedings of the 2018 26th ACM joint meeting on European software engineering conference and symposium on...

    2018

  30. [39]

    Jie Liang, Mingzhe Wang, Chijin Zhou, Zhiyong Wu, Yu Jiang, Jianzhong Liu, Zhe Liu, and Jiaguang Sun. 2022. Pata: Fuzzing with path aware taint analysis. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 1–17

    2022

  31. [40]

    Jie Liang, Mingzhe Wang, Chijin Zhou, Zhiyong Wu, Jianzhong Liu, and Yu Jiang. 2024. Dodrio: Parallelizing Taint Analysis Based Fuzzing via Redundancy-Free Scheduling. In Companion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering ...

    2024

  32. [41]

    Xiao Liu, Xiaoting Li, Rupesh Prajapati, and Dinghao Wu. 2019. DeepFuzz: Automatic Generation of Syntax Valid C Programs for Fuzz Testing. Proceedings of the AAAI Conference on Artificial Intelligence 33, 01 (Jul. 2019), 1044–1051. doi:10.1609/aaai.v33i01.33011044

    2019 doi

  33. [42]

    Guilong Lu, Xiaolin Ju, Xiang Chen, Wenlong Pei, and Zhilong Cai. 2024. GRACE: Empowering LLM-based software vulnerability detection with graph structure and in-context learning. Journal of Systems and Software 212 (2024), 112031

    2024

  34. [43]

    Chenyang Lyu, Shouling Ji, Chao Zhang, Yuwei Li, Wei-Han Lee, Yu Song, and Raheem Beyah. 2019. MOPT: Optimized Mutation Scheduling for Fuzzers. In 28th USENIX Security Symposium (USENIX Security 19) . USENIX Association, Santa Clara, CA, 1949–1966. https://www.usenix.org/confe...

    2019

  35. [44]

    Valentin JM Manès, HyungSeok Han, Choongwoo Han, Sang Kil Cha, Manuel Egele, Edward J Schwartz, and Maverick Woo. 2019. The art, science, and engineering of fuzzing: A survey. IEEE Transactions on Software Engineering 47, 11 (2019), 2312–2331

    2019

  36. [45]

    Abdalla Wasef Marashdih, Zarul Fitri Zaaba, and Khaled Suwais. 2023. An enhanced static taint analysis approach to detect input validation vulnerability. Journal of King Saud University-Computer and Information Sciences 35, 2 (2023), , Vol. 1, No. 1, Article . Publication date...

    2023

  37. [46]

    Patrick E McKnight and Julius Najab. 2010. Mann-Whitney U Test. The Corsini encyclopedia of psychology (2010), 1–1

    2010

  38. [47]

    Microsoft. 2023. OneFuzz. Retrieved July 27, 2023 from https://www.microsoft.com/en-us/research/project/project- onefuzz/

    2023

  39. [48]

    Nguyen, Long H

    Tai D. Nguyen, Long H. Pham, Jun Sun, Yun Lin, and Quang Tran Minh. 2020. SFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering (Seoul, South Korea) (ICSE ’20). Association for Com...

    2020 doi

  40. [49]

    Mitchell Olsthoorn, Arie van Deursen, and Annibale Panichella. 2021. Generating Highly-Structured Input Data by Combining Search-Based Testing and Grammar-Based Fuzzing. In Proceedings of the 35th IEEE/ACM International Con- ference on Automated Software Engineering (Virtual E...

    2021

  41. [50]

    Sebastian Österlund, Elia Geretto, Andrea Jemmett, Emre Güler, Philipp Görz, Thorsten Holz, Cristiano Giuffrida, and Herbert Bos. 2021. CollabFuzz: A Framework for Collaborative Fuzzing. In Proceedings of the 14th European Workshop on Systems Security (Online, United Kingdom) ...

    2021

  42. [51]

    Shengyi Pan, Jiayuan Zhou, Filipe Roseiro Cogo, Xin Xia, Lingfeng Bao, Xing Hu, Shanping Li, and Ahmed E Hassan

  43. [52]

    Sebastian Poeplau and Aurélien Francillon. 2020. Symbolic execution with SymCC: Don’t interpret, compile!. In 29th USENIX Security Symposium (USENIX Security 20) . USENIX Association, 181–198. https://www.usenix.org/conference/ usenixsecurity20/presentation/poeplau

    2020

  44. [53]

    Clément Poncelet, Konstantinos Sagonas, and Nicolas Tsiftes. 2022. So Many Fuzzers, So Little Time*: Experience from Evaluating Fuzzers on the Contiki-NG Network (Hay) Stack. In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering . 1–12

    2022

  45. [54]

    QSYM. 2020. Install Qsym on Ubuntu 18. Retrieved March 2, 2024 from https://github.com/sslab-gatech/qsym/issues/64

    2020

  46. [55]

    Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cojocar, Cristiano Giuffrida, and Herbert Bos. 2017. VUzzer: Application-aware Evolutionary Fuzzing.. In NDSS, Vol. 17. 1–14

    2017

  47. [56]

    Koushik Sen. 2007. Concolic Testing. In Proceedings of the 22nd IEEE/ACM International Conference on Automated Software Engineering (Atlanta, Georgia, USA) (ASE ’07). Association for Computing Machinery, New York, NY, USA, 571–572. doi:10.1145/1321631.1321746

    2007

  48. [57]

    Kosta Serebryany. 2016. Continuous Fuzzing with libFuzzer and AddressSanitizer. In 2016 IEEE Cybersecurity Develop- ment (SecDev). 157–157. doi:10.1109/SecDev.2016.043

    2016 doi

  49. [58]

    Deniz Simsek, Aryaz Eghbali, and Michael Pradel. 2025. PoCGen: Generating Proof-of-Concept Exploits for Vulnera- bilities in Npm Packages. arXiv preprint arXiv:2506.04962 (2025)

    2025 arXiv

  50. [59]

    Aleksandrs Slivkins. 2019. Introduction to Multi-Armed Bandits. Foundations and Trends® in Machine Learning 12, 1-2 (2019), 1–286. doi:10.1561/2200000068

    2019 doi

  51. [60]

    Nick Stephens, John Grosen, Christopher Salls, Andrew Dutcher, Ruoyu Wang, Jacopo Corbetta, Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna. 2016. Driller: Augmenting fuzzing through selective symbolic execution.. In NDSS, Vol. 16. 1–16

    2016

  52. [61]

    2023.AddressSanitizer

    The Clang Team. 2023.AddressSanitizer. Retrieved July 27, 2023 from https://clang.llvm.org/docs/AddressSanitizer.html

    2023

  53. [62]

    The Clang Team. 2023. UndefinedBehaviorSanitizer. Retrieved July 27, 2023 from https://clang.llvm.org/docs/ UndefinedBehaviorSanitizer.html

    2023

  54. [63]

    Spandan Veggalam, Sanjay Rawat, Istvan Haller, and Herbert Bos. 2016. Ifuzzer: An evolutionary interpreter fuzzer using genetic programming. In Computer Security–ESORICS 2016: 21st European Symposium on Research in Computer Security, Heraklion, Greece, September 26-30, 2016, P...

    2016

  55. [64]

    Huanting Wang, Zhanyong Tang, Shin Hwei Tan, Jie Wang, Yuzhe Liu, Hejun Fang, Chunwei Xia, and Zheng Wang

  56. [65]

    Junjie Wang, Bihuan Chen, Lei Wei, and Yang Liu. 2017. Skyfire: Data-Driven Seed Generation for Fuzzing. In 2017 IEEE Symposium on Security and Privacy (SP) . 579–594. doi:10.1109/SP.2017.23

    2017 doi

  57. [66]

    Jinghan Wang, Chengyu Song, and Heng Yin. 2021. Reinforcement Learning-based Hierarchical Seed Scheduling for Greybox Fuzzing. In 2021 Network and Distributed System Security Symposium

    2021

  58. [67]

    Xiajing Wang, Changzhen Hu, Rui Ma, Donghai Tian, and Jinyuan He. 2021. CMFuzz: context-aware adaptive mutation for fuzzers. Empirical Software Engineering 26 (2021), 1–34

    2021

  59. [68]

    Yifan Wang, Yuchen Zhang, Chenbin Pang, Peng Li, Nikolaos Triandopoulos, and Jun Xu. 2021. Facilitating parallel fuzzing with mutually-exclusive task distribution. In Security and Privacy in Communication Networks: 17th EAI , Vol. 1, No. 1, Article . Publication date: Septembe...

    2021

  60. [69]

    Peter Whittle. 1980. Multi-armed bandits and the Gittins index. Journal of the Royal Statistical Society: Series B (Methodological) 42, 2 (1980), 143–149

    1980

  61. [70]

    Wen Xu, Sanidhya Kashyap, Changwoo Min, and Taesoo Kim. 2017. Designing new operating primitives to improve fuzzing performance. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security . 2313–2328

    2017

  62. [71]

    Jiawei Yang, Susanto Rahardja, and Pasi Fränti. 2019. Outlier Detection: How to Threshold Outlier Scores? (AIIPCC ’19). Association for Computing Machinery, New York, NY, USA, Article 37, 6 pages. doi:10.1145/3371425.3371427

    2019

  63. [72]

    Jiageng Yang, Xinguo Zhang, Hui Lu, Muhammad Shafiq, and Zhihong Tian. 2021. StFuzzer: Contribution-aware coverage-guided fuzzing for smart devices. Security and Communication Networks 2021 (2021), 1–15

    2021

  64. [73]

    Xuejun Yang, Yang Chen, Eric Eide, and John Regehr. 2011. Finding and Understanding Bugs in C Compilers. In Proceedings of the 32nd ACM SIGPLAN Conference on Programming Language Design and Implementation (San Jose, California, USA) (PLDI ’11). Association for Computing Machin...

    2011 doi

  65. [74]

    Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. In 27th USENIX Security Symposium (USENIX Security 18) . USENIX Association, Baltimore, MD, 745–761. https://www.usenix.org/conference/...

    2018

  66. [75]

    Morteza Zakeri Nasrabadi, Saeed Parsa, and Akram Kalaee. 2021. Format-aware learn&fuzz: deep test data generation for efficient fuzzing. Neural Computing and Applications 33 (2021), 1497–1513

    2021

  67. [76]

    Junwei Zhang, Zhongxin Liu, Xing Hu, Xin Xia, and Shanping Li. 2023. Vulnerability detection by learning from syntax-based execution paths of code. IEEE Transactions on Software Engineering 49, 8 (2023), 4196–4212

    2023

  68. [77]

    Hui Zhao, Zhihui Li, Hansheng Wei, Jianqi Shi, and Yanhong Huang. 2019. SeqFuzzer: An Industrial Protocol Fuzzing Framework from a Deep Learning Perspective. In 2019 12th IEEE Conference on Software Testing, Validation and Verification (ICST). 59–67. doi:10.1109/ICST.2019.00016

    2019

  69. [78]

    Yuyue Zhao, Yangyang Li, Tengfei Yang, and Haiyong Xie. 2020. Suzzer: A vulnerability-guided fuzzer based on deep learning. In International Conference on Information Security and Cryptology . Springer, 134–153

    2020

  70. [79]

    Yiru Zhao, Xiaoke Wang, Lei Zhao, Yueqiang Cheng, and Heng Yin. 2022. Alphuzz: Monte Carlo Search on Seed- Mutation Tree for Coverage-Guided Fuzzing. InProceedings of the 38th Annual Computer Security Applications Conference (Austin, TX, USA) (ACSAC ’22). Association for Compu...

    2022

  71. [80]

    Bissyandé

    Teng Zhou, Kui Liu, Li Li, Zhe Liu, Jacques Klein, and Tegawendé F. Bissyandé. 2021. SmartGift: Learning to Generate Practical Inputs for Testing Smart Contracts. In 2021 IEEE International Conference on Software Maintenance and Evolution (ICSME). 23–34. doi:10.1109/ICSME52107...

    2021

  72. [81]

    Xiaogang Zhu, Sheng Wen, Seyit Camtepe, and Yang Xiang. 2022. Fuzzing: a survey for roadmap. ACM Computing Surveys (CSUR) 54, 11s (2022), 1–36

    2022

  73. [82]

    Peiyuan Zong, Tao Lv, Dawei Wang, Zizhuang Deng, Ruigang Liang, and Kai Chen. 2020. FuzzGuard: Filtering out Unreachable Inputs in Directed Grey-box Fuzzing through Deep Learning. In29th USENIX Security Symposium (USENIX Security 20). USENIX Association, 2255–2269. https://www...

    2020

  74. [2022]

    In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering

    Automated unearthing of dangerous issue reports. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering . 834–846

  75. [2024]

    In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering

    Combining Structured Static Code Information and Dynamic Symbolic Traces for Software Vulnerability Prediction. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering . 1–13

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.