SpeedDGF: Path-Guided Byte Energy for Efficient Directed Grey-Box Fuzzing

Directed grey-box fuzzing (DGF) is central to vulnerability reproduction, patch testing, static analysis, and information-flow detection. However, most existing DGF tools rely on largely random mutation strategies and thus produce many ineffective inputs. To address this, we present SpeedDGF, a directed grey-box fuzzer that employs a lightweight per-byte mutation strategy. At runtime, SpeedDGF dynamically identifies path-sensitive bytes—those most influential for reaching target code regions—and assigns them higher byte-energy, increasing their likelihood of selection during mutation. The effectiveness of SpeedDGF was systematically evaluated across 26 real-world vulnerabilities. The experimental results demonstrate that SpeedDGF is 4.63× faster in reaching the target locations and 5.78× more effective in reproducing target vulnerabilities compared with existing fuzzing tools. This approach significantly enhances the capability of the fuzzing tool to reach specified target locations and efficiently reproduce vulnerabilities.