Newest papers

Raise or Check? Predicting the Necessity of Additional Fuzzing for Continuous Fuzzing

Riku Kato, Tatsuya Shirai, Olivier Nourry, Yutaro Kashiwa, Kenji Fujiwara, Yasutaka Kamei, Hajimu Iida · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27828 · cited by 0 works (OpenAlex) · open-access PDF

Korean

OSS-Fuzz 가이드와 같은 대규모 서비스는 1,300 개 이상의 프로젝트를 가리키고 10,000 개 이상의 취약점 추정치를 공개했습니다. 그럼에도 불구하고, 취약점이 도입 될 때 비용 효율적인 (즉, 노출 세션) 프레임 워크 (Just-In-Time) 프레임 워크 인 Risk-Aware Intensive Statement Execution Framework (RAISE)가 존재하는 경우 상당한 시간을 예측합니다. OSS-Fuzz 가이드와 같은 대규모 서비스는 1,300 개 이상의 프로젝트를 가리키고 있으며, 취약점을 효율적으로 할당하는 것을 목표로합니다. 우리는 취약점이 특정 날에 도입되는지 여부를 예측하기 위해 취약점을 효율적으로 할당할 수 있습니다. 우리는 특정 날짜에 취

Machine translation (Meta M2M100); the English original follows.

Abstract

Continuous fuzzing is used for vulnerability detection in Open Source Software (OSS). Large-scale services such as Google's OSS-Fuzz fuzz over 1,300 projects and have revealed more than 10,000 vulnerabilities. Despite this, a considerable time lag often exists between when a vulnerability is introduced and when it is detected (i.e., the window of exposure). Given the computational cost of additional fuzzing, we aim to allocate fuzzing resources efficiently using vulnerability-risk estimates. We propose RAISE (Risk-Aware Intensive Supplemental Execution Framework), a Just-In-Time (JIT) framework that prioritizes additional fuzzing for high-risk project-days. RAISE performs binary classification at the project-day granularity to estimate whether a vulnerability is introduced on a given day. We construct a dataset combining vulnerability-introducing commits from the OSV database with daily coverage and change metrics from OSS-Fuzz, covering 15 C/C++ projects and 15,210 project-days, of which 347 (2.28%) are vulnerability-introducing. In a cross-project validation setting, our best model, a Random Forest combining VCCFinder-based static features with dynamic fuzzing features, achieves a ROC-AUC of 0.74, substantially outperforming a random baseline; coverage metrics, led by PatchCoverage, are the most important features. In a simulation over 968 vulnerabilities comparing five allocation strategies, Simple-Regression was significantly more cost-efficient than the prediction-agnostic heuristics, spending 91.60 additional fuzzing sessions per detected vulnerability, roughly half the cost of the Median heuristic (171.89). RAISE shows that JIT vulnerability prediction with coverage-aware fuzzing features can effectively guide risk-aware allocation of continuous fuzzing resources.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Fuzz testing, Computer science, Vulnerability (computing), Heuristic, Data mining, Software bug

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange