{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,12]],"date-time":"2026-06-12T12:02:51Z","timestamp":1781265771808,"version":"3.54.1"},"reference-count":49,"publisher":"Association for Computing Machinery (ACM)","issue":"7","license":[{"start":{"date-parts":[[2024,8,26]],"date-time":"2024-08-26T00:00:00Z","timestamp":1724630400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2021YFB2701000"],"award-info":[{"award-number":["2021YFB2701000"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2024,9,30]]},"abstract":"<jats:p>\n            Seed scheduling is a critical step of greybox fuzzing, which assigns different weights to seed test cases during seed selection, and significantly impacts the efficiency of fuzzing. Existing seed scheduling strategies rely on manually designed models to estimate the\n            <jats:italic>potentials<\/jats:italic>\n            of seeds and determine their weights, which fails to capture the rich information of a seed and its execution and thus the estimation of seeds\u2019 potentials is not optimal. In this article, we introduce a new seed scheduling solution, Graphuzz, for coverage-guided greybox fuzzing, which utilizes deep learning models to estimate the potentials of seeds and works in a data-driven way. Specifically, we propose an extended control flow graph called e-CFG to represent the control-flow and data-flow features of a seed's execution, which is suitable for graph neural networks (GNN) to process and estimate seeds\u2019 potential. We evaluate each seed's code coverage increment and use it as the label to train the GNN model. Further, we propose a self-attention mechanism to enhance the GNN model so that it can capture overlooked features. We have implemented a prototype of Graphuzz based on the baseline fuzzer AFLplusplus. The evaluation results show that our model can estimate the potential of seeds and has the robust capability to generalize to different targets. Furthermore, the evaluation using 12 benchmarks from FuzzBench shows that Graphuzz outperforms AFLplusplus and the state-of-the-art seed scheduling solution K-Scheduler and other coverage-guided fuzzers in terms of code coverage, and the evaluation using 8 benchmarks from Magma shows that Graphuzz outperforms the baseline fuzzer AFLplusplus and SOTA solutions in terms of bug detection.\n          <\/jats:p>","DOI":"10.1145\/3664603","type":"journal-article","created":{"date-parts":[[2024,5,21]],"date-time":"2024-05-21T08:27:43Z","timestamp":1716280063000},"page":"1-36","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Graphuzz: Data-driven Seed Scheduling for Coverage-guided Greybox Fuzzing"],"prefix":"10.1145","volume":"33","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5183-0416","authenticated-orcid":false,"given":"Hang","family":"Xu","sequence":"first","affiliation":[{"name":"Key Laboratory of Cyberspace Security, Ministry of Education, Zhengzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-1700-2536","authenticated-orcid":false,"given":"Liheng","family":"Chen","sequence":"additional","affiliation":[{"name":"University of the Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6083-9049","authenticated-orcid":false,"given":"Shuitao","family":"Gan","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7894-8828","authenticated-orcid":false,"given":"Chao","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5858-8279","authenticated-orcid":false,"given":"Zheming","family":"Li","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-2807-5641","authenticated-orcid":false,"given":"Jiangan","family":"Ji","sequence":"additional","affiliation":[{"name":"Information Engineering University, Zhengzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-2048-951X","authenticated-orcid":false,"given":"Baojian","family":"Chen","sequence":"additional","affiliation":[{"name":"University of the Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9875-8973","authenticated-orcid":false,"given":"Fan","family":"Hu","sequence":"additional","affiliation":[{"name":"Key Laboratory of Cyberspace Security, Ministry of Education, Zhengzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,8,26]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1002\/STVR.1486"},{"key":"e_1_3_2_3_2","doi-asserted-by":"crossref","unstructured":"Sheila Becker Humberto J. Abdelnur Radu State and Thomas Engel. 2010. An autonomic testing framework for IPv6 configuration protocols. In Proceeding of the Mechanisms for Autonomous Management of Networks and Services 4th International Conference on Autonomous Infrastructure Management and Security (AIMS\u201910) Burkhard Stiller and Filip De Turck (Eds.). Lecture Notes in Computer Science Vol. 6155 Springer 65\u201376.","DOI":"10.1007\/978-3-642-13986-4_7"},{"key":"e_1_3_2_4_2","unstructured":"Lukas Biewald. 2020. Experiment Tracking with Weights and Biases. Retrieved from https:\/\/www.wandb.com\/Software available from wandb.com."},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409748"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978428"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00026"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3559550"},{"key":"e_1_3_2_10_2","first-page":"77","volume-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020)","author":"Chen Yaohui","year":"2020","unstructured":"Yaohui Chen, Mansour Ahmadi, Reza Mirzazade farkhani, Boyu Wang, and Long Lu. 2020. MEUZZ: Smart seed scheduling for hybrid fuzzing. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020). USENIX Association, San Sebastian, 77\u201392. Retrieved fromhttps:\/\/www.usenix.org\/conference\/raid2020\/presentation\/chen"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-Companion.2019.00096"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICST.2019.00015"},{"key":"e_1_3_2_13_2","volume-title":"14th USENIX Workshop on Offensive Technologies (WOOT 20)","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Dominik Maier, Heiko Ei\u00dffeldt, and Marc Heuse. 2020. \\(\\lbrace\\) AFL++ \\(\\rbrace\\) : Combining incremental steps of fuzzing research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20)."},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00040"},{"key":"e_1_3_2_15_2","first-page":"2083","volume-title":"international Conference on Machine Learning","author":"Gao Hongyang","year":"2019","unstructured":"Hongyang Gao and Shuiwang Ji. 2019. Graph u-nets. In international Conference on Machine Learning. PMLR, 2083\u20132092."},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115618"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2016.2582924"},{"key":"e_1_3_2_18_2","volume-title":"Networkx. High Productivity Software for Complex Networks. Webov\u00e1 str\u00e1 nka","author":"Hagberg A.","year":"2013","unstructured":"A. Hagberg, D. Schult, P. Swart, D. Conway, L. S\u00e9guin-Charbonneau, C. Ellison, B. Edwards, and J. Torrents. 2013. Networkx. High Productivity Software for Complex Networks. Webov\u00e1 str\u00e1 nka https:\/\/networkx.lanl.gov\/wiki. Ph. D. Dissertation."},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1145\/3428334"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","unstructured":"Heqing Huang Hung-Chun Chiu Qingkai Shi Peisen Yao and Charles Zhang. 2024. Balance seed scheduling via monte carlo planning. IEEE Trans. Dependable Secur. Comput. 21 3 (2024) 1469\u20131483. DOI:10.1109\/TDSC.2023.3285293","DOI":"10.1109\/TDSC.2023.3285293"},{"key":"e_1_3_2_21_2","unstructured":"Thomas N. Kipf and Max Welling. 2017. Semi-supervised classification with graph convolutional networks. In Proceeding of the 5th International Conference on Learning Representations (ICLR\u201917) OpenReview.net. Retrieved from https:\/\/openreview.net\/forum?id=SJU4ayYgl"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243804"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2004.1281665"},{"key":"e_1_3_2_24_2","series-title":"Proceedings of Machine Learning Research","first-page":"3734","volume-title":"Proceedings of the 36th International Conference on Machine Learning","volume":"97","author":"Lee Junhyun","year":"2019","unstructured":"Junhyun Lee, Inyeop Lee, and Jaewoo Kang. 2019. Self-attention graph pooling. In Proceedings of the 36th International Conference on Machine Learning(Proceedings of Machine Learning Research, Vol. 97), Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.). PMLR, 3734\u20133743. Retrieved from https:\/\/proceedings.mlr.press\/v97\/lee19c.html"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213874"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238176"},{"key":"e_1_3_2_27_2","unstructured":"LLVM. [n.d.]. Source-based Code Coverage. Retrieved from https:\/\/clang.llvm.org\/docs\/SourceBasedCodeCoverage.html"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00026"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3473932"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134073"},{"key":"e_1_3_2_31_2","unstructured":"Mohit Rajpal William Blum and Rishabh Singh. 2017. Not all bytes are equal: Neural byte sieve for fuzzing. arXiv:1711.04596. Retrieved from https:\/\/arxiv.org\/abs\/1711.04596."},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23404"},{"key":"e_1_3_2_33_2","unstructured":"Kostya Serebryany. 2017. \\(\\lbrace\\) OSS-Fuzz \\(\\rbrace\\) -Google's continuous fuzzing service for open source software. (2017)."},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409723"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00052"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833761"},{"key":"e_1_3_2_37_2","unstructured":"Ilya Sutskever Oriol Vinyals and Quoc V. Le. 2014. Sequence to sequence learning with neural networks. In Advances in Neural Information Processing Systems 27: Annual Conference on Neural Information Processing Systems Zoubin Ghahramani Max Welling Corinna Cortes Neil D. Lawrence and Kilian Q. Weinberger (Eds.). 3104\u20133112. https:\/\/proceedings.neurips.cc\/paper\/2014\/hash\/a14ac55a4f27472c5d894ec1c3c743d2-Abstract.html"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","unstructured":"Andr\u00e1s Vargha and Harold D. Delaney. 2000. A critique and improvement of the CL common language effect size statistics of McGraw and wong. Journal of Educational and Behavioral Statistics 25 2 (2000) 101\u2013132. 10.3102\/10769986025002101","DOI":"10.3102\/10769986025002101"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.24486"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24422"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","unstructured":"Yunchao Wang Zehui Wu Qiang Wei and Qingxian Wang. 2019. NeuFuzz: Efficient fuzzing with deep neural network. IEEE Access 7 (2019) 36340\u201336352. DOI:10.1109\/ACCESS.2019.2903291","DOI":"10.1109\/ACCESS.2019.2903291"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380396"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516736"},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510089"},{"key":"e_1_3_2_45_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560415"},{"key":"e_1_3_2_46_2","first-page":"2307","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Yue Tai","year":"2020","unstructured":"Tai Yue, Pengfei Wang, Yong Tang, Enze Wang, Bo Yu, Kai Lu, and Xu Zhou. 2020. \\(\\lbrace\\) EcoFuzz \\(\\rbrace\\) : Adaptive \\(\\lbrace\\) energy-saving \\(\\rbrace\\) greybox fuzzing as a variant of the adversarial \\(\\lbrace\\) multi-armed \\(\\rbrace\\) bandit. In 29th USENIX Security Symposium (USENIX Security 20). 2307\u20132324."},{"key":"e_1_3_2_47_2","article-title":"American fuzzy lop, 2017","author":"Zalewski Michal","year":"2014","unstructured":"Michal Zalewski. 2014. American fuzzy lop, 2017. Retrieved fromhttp:\/\/lcamtuf.coredump.cx\/afl (2014).","journal-title":"Retrieved fromhttp:\/\/lcamtuf.coredump.cx\/afl"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","unstructured":"Jie Zhou Ganqu Cui Shengding Hu Zhengyan Zhang Cheng Yang Zhiyuan Liu Lifeng Wang Changcheng Li and Maosong Sun. 2020. Graph neural networks: A review of methods and applications. AI Open 1 (2020) 57\u201381. DOI:10.1016\/J.AIOPEN.2021.01.001","DOI":"10.1016\/J.AIOPEN.2021.01.001"},{"key":"e_1_3_2_49_2","doi-asserted-by":"publisher","DOI":"10.1145\/3512345"},{"key":"e_1_3_2_50_2","first-page":"2255","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Zong Peiyuan","year":"2020","unstructured":"Peiyuan Zong, Tao Lv, Dawei Wang, Zizhuang Deng, Ruigang Liang, and Kai Chen. 2020. \\(\\lbrace\\) FuzzGuard \\(\\rbrace\\) : Filtering out unreachable inputs in directed grey-box fuzzing through deep learning. In 29th USENIX Security Symposium (USENIX Security 20). 2255\u20132269."}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664603","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3664603","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:03:44Z","timestamp":1750291424000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3664603"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,8,26]]},"references-count":49,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2024,9,30]]}},"alternative-id":["10.1145\/3664603"],"URL":"https:\/\/doi.org\/10.1145\/3664603","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,8,26]]},"assertion":[{"value":"2023-08-18","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-04-15","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-08-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}