VDFUZZ: Visual Directed Fuzzer for Understanding and Intervening Fuzzing

Coverage-guided greybox fuzzing typically distributes equal attention to each component of the code, with its seed energy scheduling strategy favoring path discovery. Such strategies often lead to challenges in triggering vulnerabilities hidden within complex, deep-level logical sections during later fuzzing stages, resulting in stagnant path coverage growth-an phenomenon termed the “fuzzing bottleneck phase.” In contrast, directed greybox fuzzing aims to guide fuzzing efforts toward specific code regions by concentrating limited resources on predefined target areas. Since its initial release in 2017, greybox-directed fuzzing technologies have evolved progressively. A primary limitation of this approach lies in its dependency on manual analysis: Testers must manually identify target points based on deep program structure understanding and semantic knowledge. However, real-world programs often exhibit overwhelming semantic complexity that exceeds human analytical capacity, rendering manual code interpretation for targeted fuzzing impractical. Consequently, this technique remains predominantly effective for vulnerability reproduction, patch validation, and experimental testing, rather than exploring uncharted program regions where coverage-guided fuzzers typically outperform. This paper presents VDFuzz-a visuali-zation-enhanced greybox-directed fuzzing tool that integrates interactive visualization with fuzzing processes to improve test efficiency. By extracting call graphs and control flow graphs from source code and monitoring real-time statistics, VDFuzz facilitates rapid identification of unexplored region targets. Using VDFuzz, testers can locate the bottleneck-constrained regions through visual analytics. Direct fuzzing efforts toward these regions for enhanced coverage improvement. Our comprehensive evaluation benchmarks VDFuzz against four AFL-family fuzzers across eight real-world projects. Results demonstrate that VDFuzz achieves up to 229 % higher bottleneck-phase path coverage compared to AFLbased fuzzers. A comparative experiment with AFLGo reveals VDFuzz's superiority in target point construction efficiency: It constructs <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$60.13 \times$</tex> more target points while averaging only 8.15 % of AFLGo's time cost. Furthermore, benchmarking against visualization tool VisFuzz on four practical programs shows VDFuzz attains <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathbf{2 5 3. 7 \%}$</tex> greater the bottleneck coverage.