AFLGopher: Accelerating Directed Fuzzing via Feasibility-Aware Guidance

2025-11-13

AI Summary

Existing directed fuzzing guidance mechanisms compute control-flow distance in a feasibility-unaware manner—ignoring path feasibility—resulting in low target-reach efficiency. To address this, we propose a feasibility-aware directed fuzzing approach: we design a lightweight machine learning–based branch feasibility classifier trained on finite execution traces, integrated with a runtime dynamic feedback update mechanism to enable more accurate path reachability prediction and distance estimation. Our method is implemented via dynamic binary instrumentation within the AFL framework, significantly enhancing guidance effectiveness. Experimental evaluation demonstrates that, compared to AFLGo, BEACON, WindRanger, SelectFuzz, and an enhanced AFLGo variant, our approach achieves 2.52–3.76× faster target reaching and 4.52–5.60× faster vulnerability triggering. Notably, this work is the first to deeply integrate path feasibility modeling into directed distance metrics, representing a significant advancement in directed fuzzing guidance mechanisms.

Technology Category

• Search and Optimization: Sampling/Simulation-based Search
• Machine Learning: Calibration & Uncertainty Quantification
• Reasoning under Uncertainty: Stochastic Optimization

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Directed fuzzing is a useful testing technique that aims to efficiently reach target code sites in a program. The core of directed fuzzing is the guiding mechanism that directs the fuzzing to the specified target. A general guiding mechanism adopted in existing directed fuzzers is to calculate the control-flow distance between the current progress and the target, and use that as feedback to guide the directed fuzzing. A fundamental problem with the existing guiding mechanism is that the distance calculation is emph{feasibility-unaware}. In this work, we propose feasibility-aware directed fuzzing named AFLGopher. Our new feasibility-aware distance calculation provides pragmatic feedback to guide directed fuzzing to reach targets efficiently. We propose new techniques to address the challenges of feasibility prediction. Our new classification method allows us to predict the feasibility of all branches based on limited traces, and our runtime feasibility-updating mechanism gradually and efficiently improves the prediction precision. We implemented AFLGopher and compared AFLGopher with state-of-the-art directed fuzzers including AFLGo, enhanced AFLGo, WindRanger, BEACON and SelectFuzz. AFLGopher is 3.76x, 2.57x, 3.30x, 2.52x and 2.86x faster than AFLGo, BEACON, WindRanger, SelectFuzz and enhanced AFLGo, respectively, in reaching targets. AFLGopher is 5.60x, 5.20x, 4.98x, 4.52x, and 5.07x faster than AFLGo, BEACON, WindRanger, SelectFuzz and enhanced AFLGo, respectively, in triggering known vulnerabilities.

Problem

• Addresses feasibility-unaware distance calculation in directed fuzzing
• Proposes feasibility prediction for branches using limited execution traces
• Improves target reach speed and vulnerability detection in software testing

Innovation

• Feasibility-aware distance calculation for fuzzing guidance
• Branch feasibility prediction using limited execution traces
• Runtime updating mechanism improves prediction precision gradually