ENZZ: Effective N-gram coverage assisted fuzzing with nearest neighboring branch estimation

Fuzzing is a highly effective approach for identifying software bugs and vulnerabilities. Among the various techniques employed, coverage-guided fuzzing stands out as particularly valuable, relying on tracing code coverage information. N-gram coverage is a coverage metric in gray-box fuzz testing, where the value of N determines the sensitivity of the coverage. Block and edge coverage can be represented as 0-gram and 1-gram, respectively. The value of N can range from 0 to infinity. However, the specific methodology for selecting the appropriate value of N is still an area yet to be explored.

This paper proposes an estimation method based on the nearest branch. We initially explained the role of N-gram in the execution paths of programs and elucidated the objective of selecting the value of N, which aims to cover the closest neighboring branches. Subsequently, based on this objective, we proposed a method for calculating N based on the closest neighboring branch and estimated N at the function level. Finally, in this paper, we designed a scheduling mechanism using Adversarial Multi-Armed Bandit model that automatically selects either the seeds generated by N-gram or the original queue seeds for fuzz testing.

We implement our approach in ENZZ based on AFL and compare it with other N-gram coverage fuzzers and the state-of-the-art path coverage-assisted fuzzer PathAFL. We find that ENZZ outperforms other N-gram fuzzers and PathAFL by achieving an average improvement of 5.57% and 4.38% on edge coverage, and it improves the efficiency of path-to-edge discovery by 31.5% and 26.1%, respectively, on 12 Google FuzzBench programs. It also finds more bugs than other N-gram fuzzers and three more real-world bugs than PathAFL.