ISSTA 2025
Wed 25 - Sat 28 June 2025 Trondheim, Norway
Sat 28 Jun 2025 14:00 - 14:18 at Cosmos 3C - Afternoon 1

Knowing when a fuzzing campaign has reached saturation is crucial for practitioners to avoid unnecessarily lengthy campaigns without missing bugs within given resources. Unfortunately, existing solutions for determining the saturation point rely on coverage measurements, which are often error-prone and unreliable. In this paper, we present a novel way to detect saturation in fuzzing based on Benford’s law, which describes the characteristics of naturally occurring numbers. Specifically, we hypothesize that repeatedly occurring numbers in the fuzzing process, such as the number of mutated bytes, should show specific numerical patterns dictated by Benford’s law when the fuzzer reaches saturation, thereby the fuzzing process becomes less biased (hence, more natural). The key observation is that grey-box fuzzers become less biased as in random black-box testing when they reach saturation because there will be no seed to prioritize. We aim to test our hypothesis on 29 real-world programs using the state-of-the-art fuzzer, AFL++, and empirically show that one can use Benford’s law to detect fuzzing saturation.

Sat 28 Jun

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

14:00 - 15:30
Afternoon 1FUZZING at Cosmos 3C
14:00
18m
Talk
On the Applicability of Benford’s Law to Detect Saturation in Fuzzing
FUZZING
Jungwoo Lee KAIST, Haeun Lee KAIST, Sangjun Park KAIST, Sang Kil Cha KAIST
14:18
18m
Talk
Trailblazer: Practical End-to-end Web API Fuzzing
FUZZING
Lianglu Pan University of Melbourne, Shaanan Cohney University of Melbourne, Toby Murray University of Melbourne, Thuan Pham University of Melbourne
14:36
18m
Talk
Revisiting the Combination of Static Analysis Error Traces and Dynamic Symbolic Execution: A Potential Approach for True Positive Confirmation
FUZZING
Yihua Xu East China Normal University, Chengyu Zhang Loughborough University, Geguang Pu East China Normal University, China
14:54
18m
Talk
MQueez: Specification-Driven Fuzzing for MQTT Broker
FUZZING
Xinpeng Liu Zhejiang University, Qinying Wang Zhejiang University, Peiyu Liu Zhejiang University, Wenhai Wang Zhejiang University, Shouling Ji Zhejiang University
15:12
18m
Talk
Shepherd: High-Precision Coverage Inference for Response-guided Blackbox Fuzzing
FUZZING
Takuya Shimizu Ricerca Security, Inc., Ryuichi Yoshizawa Ricerca Security, Inc., Kaoru Otsuka Ricerca Security, Inc., Yudai Fujiwara Ricerca Security, Inc., Yuichi Sugiyama Ricerca Security, Inc.

Information for Participants
Sat 28 Jun 2025 14:00 - 15:30 at Cosmos 3C - Afternoon 1
Info for room Cosmos 3C:

Cosmos 3C is the third room in the Cosmos 3 wing.

When facing the main Cosmos Hall, access to the Cosmos 3 wing is on the left, close to the stairs. The area is accessed through a large door with the number “3”, which will stay open during the event.