Method, device, system, and computer program for coverage-guided software fuzzing

A method performed by a processor in a device for performing a coverage-guided fuzzing test of a program under test, the method comprising:

• executing, by the processor, the program under test having instrumentation code inserted at respective instrumentation points, while receiving a test input value;
• determining, during runtime and based on outputs generated by the instrumentation code, an executed-coverage profile indicating which instrumentation points were executed;
• calculating, for each instrumentation point, a dormant-coverage metric indicating one or more instrumentation points that have not been executed within a predefined range of execution counts during a predefined time interval;
• and
• updating the instrumentation code in the program under test by adding or removing the instrumentation code at one or more points based on the dormant-coverage metric, and dynamically reconfiguring an executable instrumentation map stored in memory based on the dormant-coverage metric, including modifying or disabling instrumentation code associated with the dormant instrumentation points;
• and
• executing subsequent fuzzing iterations using the reconfigured instrumentation map so as to reduce runtime monitoring overhead, improve system throughput.

A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause a device comprising the processor to perform operations comprising:

• executing, by the processor, a coverage-guided fuzzing test by passing test inputs to a program under test having instrumentation code inserted at respective instrumentation points;
• determining, during runtime and based on the outputs from the instrumentation code, a set of executed coverage points for each test input;
• identifying, for each instrumentation point and during predefined time intervals, one or more dormant-coverage metric representing instrumentation points that have not been executed within a predefined range of execution counts;
• updating the instrumentation code in the program under test by adding or removing instrumentation code at one or more instrumentation points based on the identified dormant-coverage metric, and dynamically reconfiguring an executable instrumentation map stored in memory based on the dormant-coverage metric, including modifying or disabling instrumentation code associated with the dormant instrumentation points;
• and
• executing subsequent fuzzing iterations using the reconfigured instrumentation map to reduce runtime monitoring overhead and improve system throughput.