# P-Fuzz: A Parallel Grey-Box Fuzzing Framework
## 5 Experiment
### Results  
To evaluate the efficiency, we take a 2-h rapid experiment on P-fuzz, AFL in a single node, and Roving to test the above indicators of nine target programs and LVA-M data benchmarks. The result is listed in Table 1.  
As shown in the table, we can see P-fuzz covers more bytes of bitmap than AFL and Roving in most of target programs. The bitmap density of P-fuzz is 2.59\(\times\) higher than AFL and 1.66\(\times\) higher than Roving on average. Especially, the bitmap density reaches 36.77% in \"tcpdump\", which almost triples the bitmap density of Roving. It is worth mentioning that, in two image processing tools \"iffinfo\" and \"bmp2 tifr\", P-fuzz also shows its ability to handle format-awareness programs by utilizing deterministic mutation strategies. The bitmap density upper limits of both AFL and Roving in \"tiffinfo\" and \"bmp2 tifr\" are 0.04% and 0.61%, while P-fuzz reaches 4.8% and 3.56%, respectively. However, the three frameworks get similar bitmap densities in \"strings\" and LVA-M data benchmarks. The reason is that \"strings\" is a target program with fewer paths; all these three frameworks are easy to reach the covergence status. On the other hand, LVA-M is a designed data set; parallel fuzzing without the improvement in the algorithm is hard to cover more edges. Moreover, the rapid experiment in just 2 h is hard to find crashes. With the high-efficiency characteristic, P-fuzz speeds up the whole fuzzing process and finds more crashes than AFL and Roving in such a short time. In \"who\", P-fuzz triggers eight crashes while Roving only triggers one crash. Also, P-fuzz finds 38 crashes in \"bmp2 tifr\", more than AFL's 25 crashes and Roving's 26 crashes. The \"speed\" attribute in Table 1 is measured by the number of test cases executed per second. Because of parallelizing the fuzzing, P-fuzz easily gains an almost 4\(\times\) speed up. However, the average speed is a little lower than the Roving. The reason is that Roving uses nondeterministic mutations in the whole fuzzing process, while P-fuzz combines the two mutation strategies. The bitmap density measures the edge coverage of grey-box fuzzing. The increment rate of bitmap density also reflects the efficiency of tools. We select the bitmap density data of \"objdump\", which is shown in Figure 5, to prove the high efficiency of P-fuzz. The figure reveals the bitmap density increment during the start 1000 seconds of the experiment. P-fuzz surpasses AFL and Roving rapidly in five seconds and keeps increasing. \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \multirow{2}{*}{**Program**} & \multicolumn{4}{c}{**AFL**} & \multicolumn{4}{c}{**Roving**} & \multicolumn{4}{c}{**P-Fuzz**} \\ \cline{2-11}  & _Density_ & _Inputs_ & _Crashes_ & _Speed_ & _Density_ & _Inputs_ & _Crashes_ & _Speed_ & _Density_ & _Inputs_ & _Crashes_ & _Speed_ \\ \hline nm & 3.92 & 950 & 0 & 1089 & 6.57 & 2967 & 0 & 9928 & 6.76 & 5091 & 0 & 7351 \\ \hline strings & 0.16 & 64 & 0 & 1022 & 0.16 & 395 & 0 & 4521 & 0.16 & 143 & 0 & 5011 \\ \hline objdump & 8.48 & 1923 & 0 & 630 & 10.75 & 3777 & 0 & 12,352 & 12.49 & 7283 & 0 & 5612 \\ \hline size & 3.54 & 605 & 0 & 2648 & 6.64 & 2907 & 0 & 11,204 & 6.15 & 8723 & 0 & 8051 \\ \hline readelf & 7.27 & 1747 & 0 & 1219 & 12.1 & 6446 & 0 & 6252 & 9.24 & 1034 & 0 & 7006 \\ \hline tiffinfo & 0.04 & 9 & 0 & 4001 & 0.04 & 10 & 0 & 15,903 & 4.81 & 754 & 0 & 8603 \\ \hline bmp2 info & 0.61 & 480 & 25 & 228 & 0.6 & 1826 & 26 & 2836 & 3.56 & 201 & 38 & 6488 \\ \hline tcpdump & 3.61 & 775 & 0 & 1321 & 11.2 & 4072 & 0 & 5472 & 36.77 & 17,926 & 0 & 4812 \\ \hline nasm & 8.34 & 2531 & 0 & 1337 & 10.28 & 2528 & 0 & 3362 & 10.56 & 9152 & 0 & 2914 \\ \hline base64 & 0.58 & 389 & 0 & 368 & 0.58 & 788 & 0 & 8345 & 1.15 & 678 & 2 & 5921 \\ \hline md5 um & 0.83 & 156 & 0 & 206 & 1.01 & 2701 & 0 & 4366 & 0.86 & 412 & 0 & 688 \\ \hline uniq & 0.36 & 57 & 0 & 783 & 0.36 & 188 & 1 & 3624 & 0.37 & 143 & 1 & 3200 \\ \hline who & 2.46 & 178 & 0 & 1023 & 2.47 & 1008 & 1 & 6200 & 3.21 & 532 & 8 & 7722 \\ \hline \end{tabular}
\end{table}