OptionFuzz: The Fuzzer with Coverage-Guided Dynamic Configuration Scheduling

As a security testing technique, fuzzing has demonstrated its powerful capabilities. In fuzzing, the configuration of the target system is crucial, as it often determines the program's execution paths. A thorough exploration of configurations can significantly enhance the coverage of fuzzing, which has drawn substantial attention from researchers. Currently, research on configuration exploration in fuzzing is mainly divided into two categories: mutation-based and generation-based approaches. Among these, generation-based methods have achieved notable success due to their efficient configuration generation processes. However, these approaches also face challenges, such as dependence on formal documentation and a lack of configuration scheduling strategies. In this paper, we propose OptionFuzz, a configuration-aware fuzzing framework based on generation, designed to address some of the limitations of previous approaches. The framework first generates configurations through a Markov decision process based on edge coverage analysis, followed by configuration scheduling guided by function coverage analysis. In tests conducted on 9 real-world popular programs, OptionFuzz explored 46.9 % more execution paths compared to traditional fuzzers. Additionally, compared to other similar works in the field, OptionFuzz achieved an average 15.6 % higher coverage rate on the same targets. Furthermore, we conducted longterm testing on the latest versions of the experimental programs using OptionFuzz, discovering 17 unique crashes triggered by configurations generated by the framework, of which 5 have been confirmed and assigned CNNVD identifiers.