# Constructing More Complete Control Flow Graphs Utilizing Directed Gray-Box Fuzzing
## 6 Evaluation
### Evaluation of the Iterative Feedback Mechanism (RQ2)  
In this section, we make an investigation about the effectiveness of our proposed iterative feedback mechanism. Another CFG constructor is implemented as a comparison.  
**NFB-CFGConstructor.** It is identical to our prototype DGF-CFGConstructor, except that the iterative feedback mechanism is removed.  
In the experiment, two appraisal indexes are used to evaluate the iterative feedback mechanism. The number of indirect jumps discovered is still one of them. In order to quantify the sustainable performance of the approaches, we present _stuck time_ as another appraisal index. \"Stuck\" indicates a state in the process of program testing, in which it is difficult to discover new paths. This concept is mentioned in previous works [7; 37], but not defined accurately. We attempt to give a quantitative definition about \"stuck\" state in discovering indirect jumps.  
\(I(t_{0},t_{1})\) is used to represent the number of indirect jump relations discovered from time \(t_{0}\) to \(t_{1}\). If there is a time \(t_{s}\), for any time \(t\) (\(t\geq t_{s}\)), the condition  
\[I(t,t+\Delta t)/I(0,t)<p \tag{4}\]  
is always satisfied, then the testing is considered to get \"stuck\" at \(t_{s}\). In the condition, \(\Delta t\) and \(p\) are given constants, representing the time interval and the threshold, respectively. _Stuck time_ is defined as the minimum of the time satisfying the above condition and denoted as \(T_{s}\). Intuitively, _stuck time_ represents the start time after which the test can hardly discover indirect jump relations.  
Figure 9 shows the analysis results of CGF-CFGConstructor and NFB-CFGConstructor on the eight benchmarks. In the experiment, \(\Delta t\) is set five hours and the threshold \(p\) is set 5%.  
In the early phase of the test, DGF-CFGConstructor (the red line) and NFB-CFGConstructor (the green line) have the similar performance. After the early phase, DGF-CFGConstructor has a more obvious increase than NFB-CFGConstructor. On the all benchmarks, NFB-CFGConstructor gets stuck earlier than CGF-CFGConstructor. When the approach without iterative feedback mechanism gets stuck, our approach can still resolve new indirect jumps continuously. This is because that the iterative feedback updates the seed distance with new structure information and allows our approach to continuously generate test cases that exercise indirect jumps.  
Figure 8: The total number of indirect jumps resolved by two approaches on 8 benchmarks after 20 h. The red bar represents our DGF-based approach (DGF-CFGConstructor), and the blue bar represents the CGF-based approach (CGF-CFGConstructor).  
Figure 10 shows the statistical results of the two approaches after 20 h. On the all eight benchmarks, DGF-CFGConstructor (the red bar) can resolve more indirect jumps than NFB-CFGConstructor (the green bar). More specifically, our approach discovers 37.1% more indirect jump relations than the approach without the iterative feedback mechanism.  
Overall, the analysis indicates that the answer to RQ2 is definite; our iterative feedback mechanism can improve the sustainability of test case generation and the ability of resolving indirect jumps.  
Figure 10: The total number of indirect jumps resolved by two approaches on 8 benchmarks after 20 h. The red bar (DGF) represents our approach with iterative feedback, and the green bar (DGF-NFB) is the opposite.  
Figure 9: The number of indirect jumps resolved by two approaches on 8 benchmarks. The red bar (DGF) represents our approach with iterative feedback, and the green bar (DGF-NFB) is the opposite. The vertical line represents the _stuck time_ of the corresponding approach.