Improving Validity-guided Grey-box Fuzzing based on Adaptive Seed Ranking

Grey-box fuzzing has emerged as the predominant automated testing technique for software security. For target programs with complex input structures and semantic constraints, the guidance of semantic validity enables efficient exploration of semantic input space. However, existing validity-guided grey-box fuzzers exhibit insufficient research on strategies of searching the semantic input space, particularly neglecting the importance of seed scheduling. This paper proposes an adaptive seed ranking mechanism to facilitate validity-guided grey-box fuzzing. We first design a novel metric to quantify the outlier degree of pending seeds, which affects the mutation intensity as well. Then, we update the distance metrics and prioritize the seeds adaptively to reduce additional overhead. Experiments results across multiple real-world Java programs demonstrate that our approach can make improvements on top of the state-of-the-art fuzzer regarding the valid branch coverage and uncovered crashes.