Function Clustering-Based Fuzzing Termination: Toward Smarter Early Stopping

Abstract

This paper proposes a new fuzzing termination criterion based on function clustering to address inefficiencies in current methods (e.g., function coverage or crash counts). By using language models for function encoding and multi-metric clustering, we link function clusters to vulnerability distribution. Tests on eight libraries show our method reduces fuzzing time by 1.4–7.2 hours (5–30%) with minimal bug loss (avg. 0.25 bugs), outperforming existing approaches like vulnerability function coverage.

Motivaion

Function Clustering for Vulnerability Detection

Function clustering is a grouping method based on semantic similarity, functional proximity, or structural dependencies among functions. Recent advances in deep learning have enabled code-semantic-based function clustering to emerge as a key research area in code analysis.

Key Findings on Function Clustering and Vulnerabilities🥳

Correlation Between Semantic Similarity and Vulnerability Distribution
- Vulnerabilities often exhibit reproducible patterns in code with similar functionalities.
- By clustering functions based on semantics, testing efforts can be concentrated on high-risk categories, improving vulnerability detection efficiency.
- Statistical evidence:
  - In a study of 472 clusters, vulnerabilities were found in only 14 (~2.9%).
  - Figure 1 further confirms their marginal distribution across function libraries.
Enhanced Focus on High-Risk Areas
- A clustering-based fuzz testing approach allows prioritization:
  - High-risk clusters are tested more intensively.
  - Low-risk or dissimilar clusters receive reduced testing effort.
- Benefits:
  - Minimizes resource wastage.
  - Significantly improves testing efficiency.

Page updated

Google Sites

Report abuse