This program is tentative and subject to change.
Fuzzing is an effective technique for detecting bugs by executing programs with randomly generated or mutated inputs. However, as various fuzzers have been developed, selecting the most suitable fuzzer for a specific program has become increasingly difficult. To address this issue, collaborative fuzzing techniques have been proposed, which combine multiple fuzzers and select the optimal one. However, existing approaches are inefficient and have limited accuracy, as they require significant time to evaluate fuzzer performance and fail to effectively utilize the latest results from the fuzzing campaign. To overcome these challenges, we propose RCFuzzer, a ReCommendation based collaborative Fuzzer. RCFuzzer treats the fuzzer selection problem as a Multi-Armed Bandit(MAB) problem and improves the efficiency and accuracy of selecting the optimal fuzzer using Thompson sampling. First, RCFuzzer is efficient because it directly utilizes the current fuzzing results, eliminating the need for additional time to evaluate individual fuzzers. Second, RCFuzzer can accurately select the optimal fuzzer by using the fuzzing results obtained from the current state of the fuzzing target as feedback. Additionally, to further improve the accuracy of fuzzer selection, RCFuzzer adopts the branch difficulty heuristics, which assigns different weights to branches based on their difficulty to cover and evaluates fuzzers accordingly. The empirical evaluation on the 47 programs from MAGMA, UNIFUZZ and Google’s Fuzzer-Test-Suite shows that RCFuzzer outperforms individual fuzzers in code coverage and crash detection capability. Additionally, RCFuzzer achieves higher code coverage for 29 out of 47 programs and detects 18 more unique crashes than autofz, the state-of-the-art collaborative fuzzer.
This program is tentative and subject to change.
Tue 18 NovDisplayed time zone: Seoul change
14:00 - 15:30 | |||
14:00 10mTalk | RSFuzz: A Robustness-Guided Swarm Fuzzing Framework Based on Behavioral Constraints Research Papers Ruoyu Zhou School of Computer Science and Technology, Xidian University, Xi'an, China; Shaanxi Key Laboratory of Network and System Security, Xidian University, Xi'an, China, Zhiwei Zhang School of Computer Science and Technology, Xidian University, Xi'an, China; Shaanxi Key Laboratory of Network and System Security, Xidian University, Xi'an, China, Haocheng Han School of Computer Science and Technology, Xidian University, Xi'an, China; Shaanxi Key Laboratory of Network and System Security, Xidian University, Xi'an, China, Xiaodong Zhang University of Chinese Academy of Science, Zehan Chen School of Computer Science and Technology, Xidian University, Xi’an, China; Shaanxi Key Laboratory of Network and System Security , Xidian University, Jun Sun Singapore Management University, Yulong Shen Xidian University, Dehai Xu Yiqiyin (Hangzhou) Technology Co., Ltd. Xi'an Branch, Xi'an, China | ||
14:10 10mTalk | DualFuzz: Detecting Vulnerability in Wi-Fi NICs through Dual-Directional Fuzzing Research Papers Yuanliang Chen Tsinghua University, Fuchen Ma Tsinghua University, Yanyang Zhao Tsinghua University, Yuanyi Li Shuimu Yulin Technology Co., Ltd, Yu Jiang Tsinghua University | ||
14:20 10mTalk | ORFuzz: Fuzzing the "Other Side" of LLM Safety – Testing Over-Refusal Research Papers Haonan Zhang Zhejiang University, Dongxia Wang Zhejiang University, Yi Liu Nanyang Technological University, Kexin Chen Zhejiang University, Jiashui Wang Zhejiang University, Xinlei Ying Ant Group, Long Liu Ant Group, Wenhai Wang Zhejiang University Pre-print | ||
14:30 10mTalk | DNAFuzz: Descriptor-Aware Fuzzing for USB Drivers Research Papers Zhengshu Wang Hubei University, Peng He Hubei University, Fuchen Ma Tsinghua University, Yuanliang Chen Tsinghua University, Shuoshuo Duan Shuimu Yulin Technology Co., Ltd, Yiyuan Bai Shuimu Yulin Technology Co., Ltd, Yu Jiang Tsinghua University | ||
14:40 10mTalk | ARG: Testing Query Rewriters via Abstract Rule Guided Fuzzing Research Papers Dawei Li Beihang University, Yuxiao Guo Beihang University, Qifan Liu Beihang University, Jie Liang Beihang University, Zhiyong Wu Tsinghua University, China, Jingzhou Fu School of Software, Tsinghua University, Chi Zhang Tsinghua University, Yu Jiang Tsinghua University | ||
14:50 10mTalk | Algernon: A Flag-Guided Hybrid Fuzzer for Unlocking Hidden Program Paths Research Papers Peng Deng Fudan University, Lei Zhang Fudan University, Jingqi Long Fudan University, Wenzheng Hong Independent, Zhemin Yang Fudan University, Yuan Zhang Fudan University, Donglai Zhu Fudan University, Min Yang Fudan University | ||
15:00 10mTalk | Interleaved Learning and Exploration: A Self-Adaptive Fuzz Testing Framework for MLIR Research Papers Zeyu Sun Institute of Software, Chinese Academy of Sciences, Jingjing Liang East China Normal University, Weiyi Wang Institute of Software, Chinese Academy of Sciences, Chenyao Suo Tianjin University, Junjie Chen Tianjin University, Fanjiang Xu Institute of Software at Chinese Academy of Sciences | ||
15:10 10mTalk | RCFuzz: Recommendation-based Collaborative Fuzzer Journal-First Track | ||
15:20 10mTalk | WingMuzz: Blackbox Testing of IoT Protocols via Two-dimensional Fuzzing Schedule Research Papers Xiaogang Zhu The University of Adelaide, Enze Dai Shenzhen International Graduate School, Tsinghua University, Xiaotao Feng 360 Vulnerability Research Institute, Shaohua Wang Central University of Finance and Economics, Xin Xia Zhejiang University, Sheng Wen Swinburne University of Technology, Kwok-Yan Lam Nanyang Technological University, Singapore, Yang Xiang Digital Research & Innovation Capability Platform, Swinburne University of Technology | ||