Search papers, labs, and topics across Lattice.
This study investigates the impact of execution modes on fuzzing effectiveness by employing a structural abstraction that utilizes a static call graph to analyze driver-specific dynamic coverage in software systems. By applying this methodology to 27 OSS-Fuzz-derived C/C++ projects, the authors demonstrate that multi-driver fuzzing significantly outperforms single-driver approaches, achieving a 27.9% increase in covered call-graph nodes and a 73.5% boost in CFG-edge coverage. The findings reveal that while multi-driver fuzzing uncovers unique bugs and behaviors, the contributions of different drivers are inconsistent, highlighting the structural complexities inherent in fuzzing strategies.
Multi-driver fuzzing can increase coverage by nearly 28% and expose unique bugs that single-driver approaches miss, revealing the structural intricacies of software exploration.
Many software systems expose multiple execution modes through command-line options, subcommands, and configuration flags. For such programs, fuzzing depends on both mutated inputs and the invoked mode. Yet evaluations still focus on coverage and bug counts, leaving unclear how execution modes partition, overlap, and miss software structure, and how these differences affect effectiveness. We present an empirical study of software structure under multi-driver fuzzing. We propose a structural abstraction that uses a static call graph as a shared backbone and projects driver-specific dynamic coverage onto it to derive driver-induced subgraphs. Based on this abstraction, we develop a four-phase methodology for backbone construction, fuzzing and profiling, graph-based analysis, and research-question-driven evaluation. We apply it to 27 OSS-Fuzz-derived C/C++ projects, spanning 43 executables and 854 driver configurations. Under the same total budget, multi-driver fuzzing outperforms the best single-driver baseline, increasing covered call-graph nodes by 27.9% and CFG-edge coverage by 73.5%, and revealing 11 unique bugs and abnormal behaviors largely missed by single-driver fuzzing. However, driver contributions are uneven, subgraphs differ substantially in cohesion, fragmentation, modularity, overlap, and residual under-exploration follows recurring regimes rather than a homogeneous tail. These results show that multi-driver fuzzing is fundamentally a structural exploration problem.
