MASFuzzer: Fuzz Driver Generation and Adaptive Scheduling via Multidimensional API Sequences

2026-04-20

AI Summary

Existing large language models struggle to generate fuzzing drivers capable of deeply exploring complex program branches, while manual driver development remains prohibitively expensive. This work proposes a novel approach that integrates multidimensional API call sequence mining with adaptive fuzzing scheduling. It first constructs high-quality initial drivers by leveraging API usage examples from codebases through mutation propagation and semantic-aware techniques. Subsequently, a coverage-guided scheduler combined with driver mutation mechanisms continuously refines the testing process. By uniquely combining multidimensional API sequences with adaptive scheduling, the method achieves an average 8.54% improvement in code coverage across twelve open-source libraries and uncovers 16 previously unknown vulnerabilities—14 of which have been confirmed by maintainers and 9 assigned CVE identifiers.

Technology Category

• Planning, Routing, and Scheduling: Planning with Language Models
• Search and Optimization: Sampling/Simulation-based Search
• Natural Language Processing: Code Generation / Program Synthesis from Natural Language

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Security and Privacy: Large-scale security measurements

Abstract

Fuzz testing of software libraries relies on fuzz drivers to invoke library APIs. Traditionally, these drivers are written manually by developers - a process that is time-consuming and often inadequate for exercising complex program behaviors. While recent studies have explored the use of Large Language Models (LLMs) to automate fuzz driver generation, the resulting drivers often fail to cover deep program branches. To address these challenges, we propose MASFUZZER, a fuzzing framework that integrates multidimensional API sequence construction with adaptive fuzzing scheduling strategies to improve library testing. At its core, MASFUZZER synthesizes context-relevant API call sequences by referring to API usage examples from the codebase and applying mutation-propagation-based and semantic-aware API sequence mining. These multidimensional API sequences serve as the basis for LLMs to generate effective initial drivers. In addition, MASFUZZER incorporates a coverage-guided scheduler that prioritizes testing time for the most promising drivers, along with a driver mutation strategy to evolve them. This enables systematic generation of fuzz drivers to explore previously untested code regions. We evaluate MASFUZZER on 12 widely used open-source libraries. The results show that MASFUZZER achieves 8.54 percent higher code coverage than state-of-the-art techniques. Moreover, MASFUZZER uncovers 16 previously unknown vulnerabilities in extensively tested libraries, with 14 confirmed by developers and 9 assigned CVE identifiers. These results indicate that MASFUZZER provides an efficient and practical approach for fuzzing software libraries.

Problem

• fuzz testing
• fuzz driver generation
• API sequences
• code coverage
• software libraries

Innovation

• multidimensional API sequences
• fuzz driver generation
• adaptive scheduling
• coverage-guided fuzzing
• LLM-based testing