{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,2]],"date-time":"2025-08-02T14:32:24Z","timestamp":1754145144486,"version":"3.41.2"},"reference-count":46,"publisher":"Association for Computing Machinery (ACM)","issue":"ISSTA","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2025,6,22]]},"abstract":"<jats:p>Fuzzing is one of the most efficient techniques for detecting vulnerabilities in software. Existing approaches struggle with performance inconsistencies across different targets and rely on rigid, coarse-grained fuzzing strategy composition, limiting the flexibility to adaptively combine the strengths of different fuzzing strategies at runtime.<\/jats:p>\n          <jats:p>To address these challenges, we present , a flexible and extensible fuzzing framework supporting fine-grained, runtime-adaptive strategy composition. integrates popular input scheduling and mutation scheduling strategies as fine-grained, independently switchable plugins, allowing users to adaptively replace any plugins throughout the fuzzing campaign. Furthermore, we introduce an adaptive algorithm based on Sliding-Window Thompson Sampling, which dynamically selects the optimal composition of the fuzzing strategy during the fuzzing campaign. Experimental results show that outperforms state-of-the-art fuzzers by achieving a 10.07% increase in unique vulnerability discovery and a 4.94% improvement in code coverage. Notably, is the first to detect 21 out of 37 vulnerabilities in the test suite, establishing its effectiveness across varied targets.<\/jats:p>","DOI":"10.1145\/3728873","type":"journal-article","created":{"date-parts":[[2025,6,22]],"date-time":"2025-06-22T10:52:56Z","timestamp":1750589576000},"page":"69-91","source":"Crossref","is-referenced-by-count":0,"title":["xFUZZ: A Flexible Framework for Fine-Grained, Runtime-Adaptive Fuzzing Strategy Composition"],"prefix":"10.1145","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-5573-0062","authenticated-orcid":false,"given":"Dongsong","family":"Yu","sequence":"first","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-2470-6280","authenticated-orcid":false,"given":"Yiyi","family":"Wang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"},{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7894-8828","authenticated-orcid":false,"given":"Chao","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"},{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-8379-6215","authenticated-orcid":false,"given":"Yang","family":"Lan","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5440-0518","authenticated-orcid":false,"given":"Zhiyuan","family":"Jiang","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6083-9049","authenticated-orcid":false,"given":"Shuitao","family":"Gan","sequence":"additional","affiliation":[{"name":"Labortory for Advanced Computing and Intelligence Engineering, Zhengzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0710-326X","authenticated-orcid":false,"given":"Zheyu","family":"Ma","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7823-7441","authenticated-orcid":false,"given":"Wende","family":"Tan","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,6,22]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"2016. Circumventing Fuzzing Roadblocks with Compiler Transformations. https:\/\/lafintel.wordpress.com\/"},{"key":"e_1_2_1_2_1","volume-title":"Sulley fuzzing framework. https:\/\/github.com\/OpenRCE\/sulley Accessed","author":"Amini P.","year":"2024","unstructured":"P. Amini. 2017. Sulley fuzzing framework. https:\/\/github.com\/OpenRCE\/sulley Accessed: 30 Oct 2024"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings 2019 Network and Distributed System Security Symposium, https:\/\/api.semanticscholar.org\/CorpusID:85546717","author":"Aschermann Cornelius","year":"2019","unstructured":"Cornelius Aschermann, Sergej Schumilo, Tim Blazytko, Robert Gawlik, and Thorsten Holz. 2019. REDQUEEN: Fuzzing with Input-to-State Correspondence. Proceedings 2019 Network and Distributed System Security Symposium, https:\/\/api.semanticscholar.org\/CorpusID:85546717"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1013689704352"},{"key":"e_1_2_1_5_1","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Blazytko Tim","year":"2019","unstructured":"Tim Blazytko, Matt Bishop, Cornelius Aschermann, Justin Cappos, Moritz Schl\u00f6gel, Nadia Korshun, Ali Abbasi, Marco Schweighauser, Sebastian Schinzel, and Sergej Schumilo. 2019. $GRIMOIRE$: Synthesizing structure while fuzzing. In 28th USENIX Security Symposium (USENIX Security 19). 1985\u20132002."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409748"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978428"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00046"},{"key":"e_1_2_1_9_1","volume-title":"Proceedings of the 28th USENIX Conference on Security Symposium (SEC\u201919)","author":"Chen Yuanliang","year":"2019","unstructured":"Yuanliang Chen, Yu Jiang, Fuchen Ma, Jie Liang, Mingzhe Wang, Chijin Zhou, Xun Jiao, and Zhuo Su. 2019. EnFuzz: ensemble fuzzing with seed synchronization among diverse fuzzers. In Proceedings of the 28th USENIX Conference on Security Symposium (SEC\u201919). USENIX Association, USA. 1967\u20131983. isbn:9781939133069"},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the 31st International Conference on Machine Learning, Eric P. Xing and Tony Jebara (Eds.) (Proceedings of Machine Learning Research","volume":"529","author":"Combes Richard","year":"2014","unstructured":"Richard Combes and Alexandre Proutiere. 2014. Unimodal Bandits: Regret Lower Bounds and Optimal Algorithms. In Proceedings of the 31st International Conference on Machine Learning, Eric P. Xing and Tony Jebara (Eds.) (Proceedings of Machine Learning Research, Vol. 32). PMLR, Bejing, China. 521\u2013529. https:\/\/proceedings.mlr.press\/v32\/combes14.html"},{"key":"e_1_2_1_11_1","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Ruiter Joeri De","year":"2015","unstructured":"Joeri De Ruiter and Erik Poll. 2015. Protocol state fuzzing of $TLS$ implementations. In 24th USENIX Security Symposium (USENIX Security 15). 193\u2013206."},{"key":"e_1_2_1_12_1","volume-title":"14th USENIX Workshop on Offensive Technologies (WOOT 20)","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Dominik Maier, Heiko Ei\u00df feldt, and Marc Heuse. 2020. AFL++: Combining Incremental Steps of Fuzzing Research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20). USENIX Association."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560602"},{"key":"e_1_2_1_14_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Fu Yu-Fu","year":"2023","unstructured":"Yu-Fu Fu, Jaehyuk Lee, and Taesoo Kim. 2023. autofz: Automated Fuzzer Composition at Runtime. In 32nd USENIX Security Symposium (USENIX Security 23). USENIX Association, Anaheim, CA. 1901\u20131918. isbn:978-1-939133-37-3 https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/fu-yu-fu"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1292414.1292416"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427266"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3428334"},{"key":"e_1_2_1_18_1","unstructured":"A. Helin. 2021. Radamsa. https:\/\/gitlab.com\/akihe\/radamsa"},{"key":"e_1_2_1_19_1","volume-title":"DARWIN: Survival of the Fittest Fuzzing Mutators. In 30th Annual Network and Distributed System Security Symposium, NDSS 2023","author":"Jauernig Patrick","year":"2023","unstructured":"Patrick Jauernig, Domagoj Jakobovic, Stjepan Picek, Emmanuel Stapf, and Ahmad-Reza Sadeghi. 2023. DARWIN: Survival of the Fittest Fuzzing Mutators. In 30th Annual Network and Distributed System Security Symposium, NDSS 2023, San Diego, California, USA, February 27 - March 3, 2023. The Internet Society. https:\/\/www.ndss-symposium.org\/ndss-paper\/darwin-survival-of-the-fittest-fuzzing-mutators\/"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00043"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238176"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-0002-y"},{"key":"e_1_2_1_23_1","volume-title":"Proceedings of the 30th USENIX Security Symposium.","author":"Li Yuwei","year":"2021","unstructured":"Yuwei Li, Shouling Ji, Yuan Chen, Sizhuang Liang, Wei-Han Lee, Yueyao Chen, Chenyang Lyu, Chunming Wu, Raheem Beyah, Peng Cheng, Kangjie Lu, and Ting Wang. 2021. UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers. In Proceedings of the 30th USENIX Security Symposium."},{"key":"e_1_2_1_24_1","volume-title":"MOPT: Optimized Mutation Scheduling for Fuzzers. In 28th USENIX Security Symposium (USENIX Security 19)","author":"Lyu Chenyang","year":"2019","unstructured":"Chenyang Lyu, Shouling Ji, Chao Zhang, Yuwei Li, Wei-Han Lee, Yu Song, and Raheem Beyah. 2019. MOPT: Optimized Mutation Scheduling for Fuzzers. In 28th USENIX Security Symposium (USENIX Security 19). USENIX Association, Santa Clara, CA. 1949\u20131966. isbn:978-1-939133-06-9 https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/lyu"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3473932"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10233-3"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3447852.3458720"},{"volume-title":"https:\/\/www.peach.tech\/ Accessed","year":"2024","key":"e_1_2_1_29_1","unstructured":"PeachTech. 2017. Peach. https:\/\/www.peach.tech\/ Accessed: 30 Oct 2024"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICST46399.2020.00062"},{"key":"e_1_2_1_31_1","volume-title":"VUzzer: Application-aware Evolutionary Fuzzing. In Network and Distributed System Security Symposium. https:\/\/api.semanticscholar.org\/CorpusID:2354736","author":"Rawat Sanjay","year":"2017","unstructured":"Sanjay Rawat, Vivek Jain, Ashish Kumar, Lucian Cojocar, Cristiano Giuffrida, and Herbert Bos. 2017. VUzzer: Application-aware Evolutionary Fuzzing. In Network and Distributed System Security Symposium. https:\/\/api.semanticscholar.org\/CorpusID:2354736"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833761"},{"key":"e_1_2_1_33_1","volume-title":"Fuzzing: Breaking software in an automated fashion.","author":"Sprundel Ilja Van","year":"2005","unstructured":"Ilja Van Sprundel. 2005. Fuzzing: Breaking software in an automated fashion."},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464814"},{"key":"e_1_2_1_35_1","volume-title":"https:\/\/github.com\/sslab-gatech\/autofz Accessed","author":"Project Autofz","year":"2025","unstructured":"SSLab@Gatech. 2023. Autofz Project. https:\/\/github.com\/sslab-gatech\/autofz Accessed: 23 Feb 2025"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1093\/biomet\/25.3-4.285"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1613\/jair.1.11407"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00081"},{"key":"e_1_2_1_39_1","volume-title":"Be Sensitive and Collaborative: Analyzing Impact of Coverage Metrics in Greybox Fuzzing. In 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019","author":"Wang Jinghan","year":"2019","unstructured":"Jinghan Wang, Yue Duan, Wei Song, Heng Yin, and Chengyu Song. 2019. Be Sensitive and Collaborative: Analyzing Impact of Coverage Metrics in Greybox Fuzzing. In 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019). USENIX Association, Chaoyang District, Beijing. 1\u201315. isbn:978-1-939133-07-6 https:\/\/www.usenix.org\/conference\/raid2019\/presentation\/wang"},{"key":"e_1_2_1_40_1","volume-title":"Proceedings 2020 Network and Distributed System Security Symposium, https:\/\/api.semanticscholar.org\/CorpusID:211268394","author":"Wang Yanhao","year":"2020","unstructured":"Yanhao Wang, Xiangkun Jia, Yuwei Liu, Kyle Zeng, Tiffany Bao, Dinghao Wu, and Purui Su. 2020. Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input Prioritization. Proceedings 2020 Network and Distributed System Security Symposium, https:\/\/api.semanticscholar.org\/CorpusID:211268394"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510174"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2936235"},{"key":"e_1_2_1_43_1","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Yue Tai","year":"2020","unstructured":"Tai Yue, Pengfei Wang, Yong Tang, Enze Wang, Bo Yu, Kai Lu, and Xu Zhou. 2020. EcoFuzz: Adaptive Energy-Saving Greybox Fuzzing as a Variant of the Adversarial Multi-Armed Bandit. In 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, 2307\u20132324. isbn:978-1-939133-17-5 https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/yue"},{"key":"e_1_2_1_44_1","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Yun Insu","year":"2018","unstructured":"Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. In 27th USENIX Security Symposium (USENIX Security 18). USENIX Association, Baltimore, MD. 745\u2013761. isbn:978-1-939133-04-5 https:\/\/www.usenix.org\/conference\/usenixsecurity18\/presentation\/yun"},{"key":"e_1_2_1_45_1","volume-title":"American Fuzzy Lop - Whitepaper. https:\/\/lcamtuf.coredump.cx\/afl\/technical_details.txt [Online","author":"Zalewski Micha\u0142","year":"2024","unstructured":"Micha\u0142 Zalewski. 2016. American Fuzzy Lop - Whitepaper. https:\/\/lcamtuf.coredump.cx\/afl\/technical_details.txt [Online; accessed 8 August 2024]"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23134"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3728873","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,16]],"date-time":"2025-07-16T16:54:33Z","timestamp":1752684873000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3728873"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,22]]},"references-count":46,"journal-issue":{"issue":"ISSTA","published-print":{"date-parts":[[2025,6,22]]}},"alternative-id":["10.1145\/3728873"],"URL":"https:\/\/doi.org\/10.1145\/3728873","relation":{},"ISSN":["2994-970X"],"issn-type":[{"type":"electronic","value":"2994-970X"}],"subject":[],"published":{"date-parts":[[2025,6,22]]}}}