Multi-driver fuzzing uncovers 27.9% more code paths
Researchers prove multi-driver fuzzing exposes 73.5% more control flow edges than single-driver approaches
Researchers from Utah State University, University of Michigan, and other institutions published a paper proposing a structural approach to multi-driver fuzzing that outperforms traditional single-driver methods. The team analyzed 27 OSS-Fuzz C/C++ projects with 43 executables and 854 driver configurations, developing a four-phase methodology that constructs static call graphs, profiles dynamic coverage, performs graph-based analysis, and evaluates research questions.
Their empirical study found that multi-driver fuzzing increases covered call-graph nodes by 27.9% and control-flow graph (CFG) edge coverage by 73.5% compared to the best single-driver baseline. The approach also uncovered 11 unique bugs and abnormal behaviors that single-driver fuzzing missed. However, driver contributions varied significantly, with subgraphs showing substantial differences in cohesion, fragmentation, modularity, and overlap, indicating that residual under-exploration follows recurring patterns rather than uniform distribution.
- Multi-driver fuzzing (using multiple execution modes) increased code coverage by 27.9% in call-graph nodes and 73.5% in CFG edges across 27 projects
- Researchers identified 11 unique bugs and abnormal behaviors missed by single-driver approaches
- Driver contributions were uneven, with subgraphs showing varying cohesion, fragmentation, and modularity
Why It Matters
This research transforms fuzz testing from random mutation to structural exploration, enabling more efficient bug discovery in complex software systems