Vertical and Horizontal Expansion of Fuzzing Techniques
COM3 Level 2
MR21, COM3 02-61
Abstract:
Fuzzing —a biased random exploration of software behavior— has become one of the most successful automated techniques for discovering vulnerabilities in large, real-world systems. Yet despite its remarkable efficacy , fuzzing remains a point technology that is narrowly deployed in practice. Today’s fuzzers excel primarily on stateless, sequential programs and remain largely isolated from the broader software engineering workflows in which security and reliability failures are discovered, diagnosed, and repaired. Indeed, the use of fuzzing is currently seen as an “after-thought”, testing a fully developed software project instead of integrating into software development processes. As software systems grow increasingly concurrent and interdependent, we need techniques that both scale vertically into richer software workflows and horizontally across richer program behaviors. This thesis investigates how fuzzing techniques can be expanded holistically to answer the challenges presented by our vast and growing software infrastructure.
First, this thesis examines how fuzzing can be embedded more naturally within the software development and maintenance practices. Through an empirical study, it identifies how fuzzing can be shifted earlier in the development lifecycle and integrated into automated CI/CD workflows. It also demonstrates how fuzzing can form the foundation of end-to-end automated security systems encompassing testing, crash triage, debugging, and automated repair. It presents an example of such an integrated system, and examines how recent advances in Large Language Models can best be leveraged to improve on such systems in the future.
Second, it develops new systems and algorithms that extend fuzzing into the domain of controlled concurrency testing (CCT), enabling exploration of the vast, stateful, and nondeterministic behaviors of modern multithreaded software. These contributions include new CCT platforms for user-space and kernel-space targets, efficient mechanisms for schedule control, and novel randomized algorithms that provide semantic feedback for exploring deep concurrency bugs. Evaluated across both C/C++ user applications and the Linux kernel, these techniques uncover elusive concurrency defects that evade existing tools.
Together, these contributions present a unified view of fuzzing as a general-purpose behavioral search methodology: one that can explore concurrent executions, integrate with modern development practices, and support autonomous vulnerability discovery and repair. This work suggests a path toward holistic, automated software protection infrastructures capable of handling the complexity of future software systems written by both humans and generative AI tools.