Directed Fuzzing with Adaptive Path Guidance and Weighted Distribution

Existing directed fuzzing tool AFLGO calculates the distance to the target locations using a shortest path first approach to prioritize test cases. This results in potential paths to the target location that might not be executed. Moreover, the scoring strategy in AFLGO is calculated using fixed weights, which does not fully leverage the data and feedback generated during the testing process. In this paper, we propose a new guiding mechanism that marks key locations on reachable paths to the target locations. During execution, the priority of test cases is dynamically adjusted based on the coverage of these reachable paths to guide the generation of test cases. Additionally, we designed an adaptive weight distribution algorithm that continuously adjusts the weights of various influencing factors for test cases, allowing for more reasonable mutation time allocations in subsequent tests. We implemented these strategies and conducted experiments on four different open-source test programs. The experimental results show that our proposed method has significant improvements in code coverage and vulnerability detection compared to AFLGO.