## 4 Fuzzing System Design
### A Measurement of the Distance between a Seed Input and Target Point  
PSOFuzzer is a target-oriented fuzzing technology that aims to let more samples pass through the target point. The closer the execution path of a sample is to the target point, the more beneficial it is for testing. Therefore, the index for the testing guidance process is the distance between the current sample and the target point. To analyze the distance between the current sample and the locations of vulnerable points, we consider two types of granularity: basic block level and function level.  
The basic block refers to the sequence of statements that are executed in sequence. There is only one entry and one exit: entry is the first statement, and exit is the last  
Figure 2: PSOFuzzer Technology Framework.  
statement. A basic block enters only from its entry and exits from its exit. The execution path of sample \(s_{ij}\) is the execution flow from basic block \(b_{i}\) in the program to basic block \(b_{j}\), which is a sequence composed of several basic blocks in a certain order \((b_{i},b_{i+1},b_{i+2},\ldots b_{j})\). A distance calculator is used to calculate the shortest distance between all code blocks in path \(s_{ij}\) to a specified target \(t_{m}\) as the distance between the current sample and the locations of the vulnerable points.  
Functions are larger in granularity than basic blocks. To increase the weight of a function call when calculating the distance, we calculate the distance between the sample and the target point using a combination of the distance between two function calls and the distance between two code blocks in the function. The formula is shown in Formula (1):  
\[d=df*\alpha+db \tag{1}\]  
We guide the execution to the function containing the target point first, and then guide to the position of the target point in the function. In Formula (1), \(df\) is the distance on the function layer, i.e., the distance between the function and the target function, which includes the suspected vulnerable point. \(db\) is the distance on the basic block layer, i.e., the distance between the basic block and suspected vulnerable point. We use the Dijkstra algorithm to calculate these two types of distances. Additionally, to avoid \(db\) being too large to effectively guide the sample to execute the target function, we set the weight \(\alpha\) for \(df\), and the value of \(\alpha\) is the farthest distance to the vulnerable point in the target function.  
The distance between a sample and the target is calculated in three stages: static distance analysis stage, instrumentation stage and running stage. In the static distance analysis stage, the distance between each basic block and the target point, and the distance between each function and the function of the target point are calculated. In the instrumentation stage, the instrumentator inserts the distance calculation logic into the source code according to the distance between each function and the basic block from the target point. The logic is to compare the distance value of the current basic block or function with the executed values. If the former is less than the latter, the distance value is updated to the current value. In the running stage, the distance value is calculated by Formula (1) and compared with the historical minimum value according to the calculation logic of the instrumented code.