VCDFuzz: A Vulnerability Characteristic Guided Directed Greybox Fuzzing Approach

While existing directed greybox fuzzing (DGF) tools excel in patch testing and bug reproduction, their bug detection mechanisms are predominantly constrained by code coverage-guided approaches. This results in two critical limitations: (1) no significant efficiency advantage over nondirected greybox fuzzing for bug discovery, and (2) an inherent bias toward inputs that enhance coverage rather than those directly relevant to target sites. To address these challenges, we propose VCDFuzz, a vulnerability characteristic-guided DGF methodology. The framework first identifies potentially vulnerable code blocks through vulnerability signature analysis based on code similarity detection. Subsequently, selective instrumentation is applied only to code blocks with control and data flow related to these hazardous regions, thereby minimizing redundant path exploration and enhancing fuzzing efficiency. Experimental validation across 10 programs with 27 distinct targets demonstrates that VCDFuzz outperforms AFL, AFLGo, and WindRanger by detecting bugs 3.18-4.3 times faster, reaching target sites $\mathbf{1 . 8 - 2}$ times faster, and reproducing known bugs 1.4-2.3 times faster.