Dissecting Software Graphs: Structural Insights for Driver-Guided Fuzzing

2026-08-13

AI Summary

This study addresses the unclear relationship between multiple fuzzing drivers and their collective impact on structural coverage and testing efficacy. It formulates the problem as a structural exploration task and introduces a four-stage analytical framework: leveraging static call graphs as a backbone, mapping dynamic coverage from individual drivers onto subgraphs, and applying graph-theoretic analysis to uncover heterogeneity in cohesion, fragmentation, modularity, and coverage overlap. Experimental results demonstrate that, under identical testing budgets, the multi-driver approach achieves 27.9% higher call-graph node coverage and 73.5% greater control-flow graph edge coverage compared to the best single driver. Furthermore, it identifies 11 unique vulnerabilities and anomalous behaviors missed by any individual driver.

Abstract

Many software systems expose multiple execution modes through command-line options, subcommands, and configuration flags. For such programs, fuzzing depends on both mutated inputs and the invoked mode. Yet evaluations still focus on coverage and bug counts, leaving unclear how execution modes partition, overlap, and miss software structure, and how these differences affect effectiveness. We present an empirical study of software structure under multi-driver fuzzing. We propose a structural abstraction that uses a static call graph as a shared backbone and projects driver-specific dynamic coverage onto it to derive driver-induced subgraphs. Based on this abstraction, we develop a four-phase methodology for backbone construction, fuzzing and profiling, graph-based analysis, and research-question-driven evaluation. We apply it to 27 OSS-Fuzz-derived C/C++ projects, spanning 43 executables and 854 driver configurations. Under the same total budget, multi-driver fuzzing outperforms the best single-driver baseline, increasing covered call-graph nodes by 27.9% and CFG-edge coverage by 73.5%, and revealing 11 unique bugs and abnormal behaviors largely missed by single-driver fuzzing. However, driver contributions are uneven, subgraphs differ substantially in cohesion, fragmentation, modularity, overlap, and residual under-exploration follows recurring regimes rather than a homogeneous tail. These results show that multi-driver fuzzing is fundamentally a structural exploration problem.

Problem

• multi-driver fuzzing
• execution modes
• software structure
• coverage
• structural exploration

Innovation

• multi-driver fuzzing
• structural abstraction
• call graph
• coverage analysis
• software structure