Fuzzwise: Intelligent Initial Corpus Generation for Fuzzing
This work addresses the challenge of efficient initial corpus generation for fuzzing, which is crucial for software testing and security, but it appears incremental as it builds on existing fuzzing methods with LLM integration.
The paper tackles the problem of generating high-quality initial input seeds for mutation-based greybox fuzzing by proposing FuzzWise, which integrates corpus generation and minimization into one process using a multi-agent LLM framework. The result shows that FuzzWise generates significantly fewer test cases than baselines while achieving higher code coverage, triggering more runtime errors, and being more time- and coverage-efficient.
In mutation-based greybox fuzzing, generating high-quality input seeds for the initial corpus is essential for effective fuzzing. Rather than conducting separate phases for generating a large corpus and subsequently minimizing it, we propose FuzzWise which integrates them into one process to generate the optimal initial corpus of seeds (ICS). FuzzWise leverages a multi-agent framework based on Large Language Models (LLMs). The first LLM agent generates test cases for the target program. The second LLM agent, which functions as a predictive code coverage module, assesses whether each generated test case will enhance the overall coverage of the current corpus. The streamlined process allows each newly generated test seed to be immediately evaluated for its contribution to the overall coverage. FuzzWise employs a predictive approach using an LLM and eliminates the need for actual execution, saving computational resources and time, particularly in scenarios where the execution is not desirable or even impossible. Our empirical evaluation demonstrates that FuzzWise generates significantly fewer test cases than baseline methods. Despite the lower number of test cases, FuzzWise achieves high code coverage and triggers more runtime errors compared to the baselines. Moreover, it is more time-efficient and coverage-efficient in producing an initial corpus catching more errors.