# Not All Seeds Are Important: Fuzzing Guided by Untouched Edges
## 6 Evaluation
### RQ1: Code Coverage Improving  
Code coverage is a crucial metric for evaluating the performance of fuzzing techniques [17]. In general, the more code a fuzzer can cover in the target program, the higher the probability of discovering hidden vulnerabilities. As explained in Section 2.1.2, AFL [9] employs a 64 KB bitmap to collect coverage information, with each byte in the bitmap representing the number of hits for a particular edge ID. AFL maps program branches to the bitmap by using a hash function. If a branch is explored, the byte at the index corresponding to its edge ID in the bitmap is updated. AFL maintains a simplified bitmap in real time and stores it on local disk, which allows us to assess code coverage based on this simplified bitmap.  
Table 2 presents a comparison of UntouchFuzz with four other state-of-the-art fuzzers in terms of edge coverage. The data in the table represent the arithmetic average edge coverage across ten fuzzing tests. The results in Table 2 demonstrate that UntouchFuzz outperforms EcoFuzz and Alphuzz in edge coverage and slightly surpasses AFL and AFLFast. UntouchFuzz achieves better coverage than the other four baseline seed scheduling strategies in 11 out of the 12 programs tested (all except for mujs). Overall, the proposed method is effective in improving coverage. While the improvement percentages on AFL and AFLFast (2.16% and 3.31%) are relatively modest, these results are consistent with findings from previous research [40], which suggests that differences among fuzzers are minimized when using the single havoc strategy. Nonetheless, our seed scheduling strategy still has an impact on the direction of fuzzing evolution by concentrating mutation energy on more effective seeds, thus enhancing overall program coverage.  
Figure 6 shows the evolution of edge coverage over time, with samples taken every hour. Evidently, on the seven target programs, exiv2, pdfotext, tcpdump, tifcp, readelf, mm-new, and bsdtar, UntouchFuzz has a significantly higher edge coverage growth rate than the other four baseline seed scheduling strategies. However, for the remaining five target programs, the fuzzers converge quickly due to their smaller scale and lower complexity, negating the advantage demonstrated by UntouchFuzz.  
\begin{table}
\begin{tabular}{l r r r r r} \hline \hline  & **Default** & **RarePath** & **NewPath** & **SamePrefix** & **UntouchedEdge** \\ \hline
**Fuzzer** & **AFL** & **AFLFast** & **EcoFuzz** & **Alphuzz** & **UntouchFuzz** \\ \hline dipeg & 3998 & 3850 & 3646 & 3613 & **4101** \\ exiv2 & 12,152 & 12,104 & 11,310 & 11,958 & **12,304** \\ pdfotext & 15,160 & 15,120 & 11,408 & 14,510 & **15,280** \\ tcpdump & 18,208 & 17,252 & 16,134 & 17,640 & **18,556** \\ mp3 gain & 1375 & 1376 & 1364 & 1370 & **1382** \\ mp42 aac & **3263** & 3230 & 3178 & 3197 & **3263** \\ tifcp & 5841 & 5801 & 5405 & 5692 & **6659** \\ readelf & 10,336 & 10,503 & 9100 & 10,029 & **10,647** \\ nm-new & 5455 & 5463 & 5530 & 5185 & **5601** \\ xmlint & 10,406 & 10,332 & 10,121 & 10,172 & **10,470** \\ bsdtar & 5250 & 5227 & 5109 & 5169 & **5318** \\ mujs & 9170 & **9243** & 8892 & 9084 & 9210 \\ \hline Total & 100,614 & 99,501 & 91,197 & 97,619 & **102,791** \\  & \((-2.16\%)\) & \((-3.31\%)\) & \((-12.71\%)\) & \((-5.30\%)\) & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Arithmetic mean edge coverage comparison.