Dissecting Software Graphs: Structural Insights for Driver-Guided Fuzzing

• URL: http://arxiv.org/abs/2608.12859v1
• Date: Thu, 13 Aug 2026 06:06:04 GMT
• Title: Dissecting Software Graphs: Structural Insights for Driver-Guided Fuzzing
• Abstract summary: We present an empirical study of software structure under multi-driver fuzzing.<n>We propose a structural abstraction that uses a static call graph as a shared backbone.<n>We apply it to 27 OSS-Fuzz-derived C/C++ projects, spanning 43 executables and 854 driver configurations.
• Score: 15.98590412750366
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Many software systems expose multiple execution modes through command-line options, subcommands, and configuration flags. For such programs, fuzzing depends on both mutated inputs and the invoked mode. Yet evaluations still focus on coverage and bug counts, leaving unclear how execution modes partition, overlap, and miss software structure, and how these differences affect effectiveness. We present an empirical study of software structure under multi-driver fuzzing. We propose a structural abstraction that uses a static call graph as a shared backbone and projects driver-specific dynamic coverage onto it to derive driver-induced subgraphs. Based on this abstraction, we develop a four-phase methodology for backbone construction, fuzzing and profiling, graph-based analysis, and research-question-driven evaluation. We apply it to 27 OSS-Fuzz-derived C/C++ projects, spanning 43 executables and 854 driver configurations. Under the same total budget, multi-driver fuzzing outperforms the best single-driver baseline, increasing covered call-graph nodes by 27.9% and CFG-edge coverage by 73.5%, and revealing 11 unique bugs and abnormal behaviors largely missed by single-driver fuzzing. However, driver contributions are uneven, subgraphs differ substantially in cohesion, fragmentation, modularity, overlap, and residual under-exploration follows recurring regimes rather than a homogeneous tail. These results show that multi-driver fuzzing is fundamentally a structural exploration problem.

Related papers

• Graph-Aware Fuzzing for Graph Database Management Systems [22.261896283072137]
  We propose GRAF, a black box fuzzing framework for GDBMS query engines.<n>It generates valid and structurally diverse queries under complex graph constraints.<n>It applies five graph specific mutation operators guided by execution state feedback, including execution time, result size, and system status.<n> GRAF consistently improves line coverage by 31.6% to 41.1% over the strongest baseline on each target.
  arXiv  Detail & Related papers  (2026-07-04T07:08:14Z)
• OneDrive: Unified Multi-Paradigm Driving with Vision-Language-Action Models [69.2503510410147]
  We present a unified autonomous driving framework built upon a pretrained VLM.<n>We demonstrate that pretrained VLM attention exhibits strong transferability beyond pure language modeling.<n>Experiments on end-to-end autonomous driving benchmarks demonstrate state-of-the-art performance.
  arXiv  Detail & Related papers  (2026-04-20T07:50:00Z)
• Dynamic analysis enhances issue resolution [53.50448142467294]
  DAIRA (Dynamic Analysis-enhanced Issue Resolution Agent) is an automated repair framework that embeds dynamic analysis into the agent's reasoning cycle.<n> Driven by a Test Tracing-Driven methodology, DAIRA utilizes lightweight monitors to extract critical runtime data.<n>When powered by Gemini 3 Flash Preview, DAIRA establishes a new state-of-the-art (SOTA) performance, achieving a 79.4% resolution rate on the SWE-bench Verified dataset.
  arXiv  Detail & Related papers  (2026-03-23T14:48:54Z)
• GPTrace: Effective Crash Deduplication Using LLM Embeddings [0.8166364251367626]
  Crash deduplication is the task of finding duplicate crashing inputs and thereby reducing the data that needs to be examined.<n>We present GPTrace, a deduplication workflow that leverages a large language model to evaluate the similarity of various data sources associated with crashes.<n>We evaluate our approach on over 300 000 crashing inputs belonging to 50 ground truth labels from 14 different targets.
  arXiv  Detail & Related papers  (2025-12-01T12:30:30Z)
• DynamiQ: Unlocking the Potential of Dynamic Task Allocation in Parallel Fuzzing [18.082974145476843]
  We present DynamiQ, a full-fledged and optimized successor to AFLTeam that supports dynamic and adaptive parallel fuzzing.<n>DynamiQ leverages structural information from the program's call graph to define tasks and continuously refines task allocation using runtime feedback.<n> Evaluated on 12 real-world targets from OSS-Fuzz and FuzzBench over 25,000 CPU hours, DynamiQ outperforms state-of-the-art parallel fuzzers in both code coverage and vulnerability discovery.
  arXiv  Detail & Related papers  (2025-10-06T03:43:40Z)
• Divide by Question, Conquer by Agent: SPLIT-RAG with Question-Driven Graph Partitioning [62.640169289390535]
  SPLIT-RAG is a multi-agent RAG framework that addresses the limitations with question-driven semantic graph partitioning and collaborative subgraph retrieval.<n>The innovative framework first create Semantic Partitioning of Linked Information, then use the Type-Specialized knowledge base to achieve Multi-Agent RAG.<n>The attribute-aware graph segmentation manages to divide knowledge graphs into semantically coherent subgraphs, ensuring subgraphs align with different query types.<n>A hierarchical merging module resolves inconsistencies across subgraph-derived answers through logical verifications.
  arXiv  Detail & Related papers  (2025-05-20T06:44:34Z)
• LibAFL-DiFuzz: Advanced Architecture Enabling Directed Fuzzing [0.0]
  We construct flexible tool for directed fuzzing with components able to be easily combined with other techniques.<n>We evaluate our fuzzer in comparison with AFLGo and BEACON, and reveal speedup in time to exposure on several benchmarks.
  arXiv  Detail & Related papers  (2024-12-26T09:54:57Z)
• CKGFuzzer: LLM-Based Fuzz Driver Generation Enhanced By Code Knowledge Graph [29.490817477791357]
  We propose an automated fuzz testing method driven by a code knowledge graph and powered by an intelligent agent system.<n>The code knowledge graph is constructed through interprocedural program analysis, where each node in the graph represents a code entity.<n> CKGFuzzer achieved an average improvement of 8.73% in code coverage compared to state-of-the-art techniques.
  arXiv  Detail & Related papers  (2024-11-18T12:41:16Z)
• Dynamic Perceiver for Efficient Visual Recognition [87.08210214417309]
  We propose Dynamic Perceiver (Dyn-Perceiver) to decouple the feature extraction procedure and the early classification task. A feature branch serves to extract image features, while a classification branch processes a latent code assigned for classification tasks. Early exits are placed exclusively within the classification branch, thus eliminating the need for linear separability in low-level features.
  arXiv  Detail & Related papers  (2023-06-20T03:00:22Z)
• DiffStack: A Differentiable and Modular Control Stack for Autonomous Vehicles [75.43355868143209]
  We present DiffStack, a differentiable and modular stack for prediction, planning, and control. Our results on the nuScenes dataset indicate that end-to-end training with DiffStack yields substantial improvements in open-loop and closed-loop planning metrics.
  arXiv  Detail & Related papers  (2022-12-13T09:05:21Z)
• Dynamic Graph Message Passing Networks for Visual Recognition [112.49513303433606]
  Modelling long-range dependencies is critical for scene understanding tasks in computer vision. A fully-connected graph is beneficial for such modelling, but its computational overhead is prohibitive. We propose a dynamic graph message passing network, that significantly reduces the computational complexity.
  arXiv  Detail & Related papers  (2022-09-20T14:41:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.