# Effective Seed Scheduling for Directed Fuzzing with Function Call Sequence Complexity Estimation
## 2 Background and Related Work
### Related Work  
Many recent works have been proposed to improve the directed fuzzing efficiency based on distance calculations. The AFLGo method is a typical scheme for distance-guided directed fuzzing, which uses the distance between the input and the target as a fitness metric. It prioritizes seeds based on distance, giving preference to those closer to the target. RDFuzz [20] combines the distance and the execution frequency of basic blocks to determine the priority of seeds. UAFuzz [21] uses a distance metric based on call chains, which point to functions that are more likely to call allocation and deallocation functions,  
Figure 1: A motivating example. Code snippet crafted from CVE-2016-4491, its corresponding selective instrumented CG, and execution traces of 4 seeds.  
detecting complex behaviors such as \"use after free\" vulnerabilities. WindRanger [10] addresses issues with AFLGo's distance calculation by considering deviations in basic blocks. [PERSON] [22] not only considers distance feedback but also takes into account the error coverage guided by Sanitizers. In this paper, SEZZ differentiates itself from these tools by considering the function sequences for triggering vulnerabilities and capturing the runtime program behaviors, like the calling contexts for the feedback.  
A major trend in optimizing mutations is to mutate the relevant input offsets to satisfy uncovered branch conditions. In addition to random mutations, [PERSON] [23] identifies input offsets that do not require value changes, thus minimizing the input search space to improve the mutation efficiency. Angora [17] employs byte-level taint tracking to identify input bytes relevant to target conditions, followed by a gradient descent-based search strategy. [PERSON] [24] suggests using intermediate values as feedback to modify values in the input. PATA [25] improves the accuracy of taint analysis by distinguishing between different paths and contexts. Another direction is to combine fuzzing with symbolic execution to address complex path constraints. QSYM [26] resolves partial path constraints of base seeds and utilizes mutations to generate valid inputs that meet actual conditions. Intrigue [27] further replaces symbolic simulation with dynamic taint analysis. [PERSON] [28] suggests retaining constraints as abstractions and reusing them to guide further input generation. It is recommended to focus fuzz testing on undiscovered paths instead of exploring all paths through hybrid execution. These methods are orthogonal to SEZZ and can assist in faster correction of program execution.  
In addition to distance calculation and mutation techniques, other techniques, especially selective instrumentation, also greatly improve the performance of DGF. Beacon [8] tries to exclude other unrelated codes during a directed fuzzing campaign. SieveFuzz [19] avoids executing irrelevant paths by modifying the tested program at runtime. SelectFuzz [18] is the first fuzzer that instruments only the code related to the target sites. In addition, FuzzGuard [29] employs deep learning to filter out irrelevant test cases, thereby enhancing the performance of AFLGo. AFLChurn [9] assigns numerical weights based on the most recent change time or frequency of basic blocks.