## 4 System Design
### Locating RC Points and Negating Procedure
AFLFast discovered 98 crashes, and the lowest result was recorded by AFL with 13 unique crashes. Among these software vulnerability testing techniques, QSYM can compete with DeepDiver, but the number of detected unique crashes is low because QSYM uses AFL, and the efficiency of AFL is not as high as that of AFL++. We leveraged AFL, AFLFast and AFL++ for our implementation, and determined that the most suitable technique for DeepDiver was AFL++, which had integrated many efficient features from the other state-of-the-art fuzzing techniques. In addition, we measured the number of paths covered to highlight the efficient performance of DeepDiver, and Figure 5 demonstrates the comparison results with abovementioned fuzzers. In general, the DeepDiver has achieved higher explored path results than its other competitors. Despite the fact that the DeepDiver and QSYM reached the same results at the sixth hour of the test time, in analyzing the _pdfftodtml_ and _pdfftotext_ binaries, DeepDiver explored almost all paths in the middle of the test. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Package** & \begin{tabular}{c} **Target** \\ **Programs** \\ \end{tabular} & **Version** & \begin{tabular}{c} **Class** \\ **Type** \\ \end{tabular} & \begin{tabular}{c} **Basic** \\ **Blocks** \\ \end{tabular} & \begin{tabular}{c} **Edges** \\ \end{tabular} & \
\begin{tabular}{c} **Input** \\ **Format** \\ \end{tabular} &
\begin{tabular}{c} **Test** \\ **Options** \\ \end{tabular} & **Source** \\ \hline binutils & readelf & 2.30 & dev & 21,249 & 31,086 & binary & -a @ @ & [51] \\ binutils & objdump & 2.30 & dev & 43,935 & 74,313 & binary & -d @ @ & [51] \\ libkksba & cert-basic & 1.3.5 & crypto & 9958 & 14,120 & crt & @ @ & [52] \\ libjpeg & djpeg & 9c & image & 4844 & 6776 & jpg & & [53] \\ libarchive & bsdtar & 3.3.2 & archive & 31,379 & 43,390 & tar & @ @ & [54] \\ tcpdump & tcpdump & 4.9.2 & net & 33,743 & 48,791 & pcap & -r/-nr @ & [55] \\ poppler & pdfftohtml & 0.22.5 & doc & 54,596 & 71,945 & html/pdf & @ @ & [56] \\ poppler & pdfftotext & 0.22.5 & doc & 49,867 & 62,391 & pdf/txt & & [56] \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Statistics on the eight evaluated real-world software applications. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Target** & **AFL** & **AFL-Fast** & **QSYM** & **DeepFuzz** & **DeepDiver** \\ \hline readelf & 8 & 27 & 25 & 14 & 48 \\ objdump & 0 & 30 & 31 & 12 & 35 \\ cert-basic & 1 & 12 & 11 & 6 & 13 \\ djpeg & 1 & 2 & 8 & 2 & 10 \\ bsdtar & 2 & 14 & 16 & 8 & 20 \\ tcpdump & 0 & 4 & 12 & 5 & 14 \\ pdfftohtml & 0 & 0 & 3 & 0 & 3 \\ pdfftotext & 1 & 9 & 14 & 9 & 16 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The number of detected unique crashes in 6 h.

Figure 6 illustrates the evaluation results of execution speed per second on eight real-world programs. According to the bar chart, it is clear that the average number of executions of DeepDiver is the highest compared to the other competitors. When fuzzing the _djpeg_ binary, the execution speed of DeepDiver, QSYM and AFLFast were almost the same, whereas in _tcpdump_ binary, those fuzzing techniques results were slightly different. In addition, AFL fuzzing tool showed the lowest performance in our evaluation. The reason is that it is very difficult to bypass nested complex checksums for traditional fuzzer like AFL. In other words, AFL requires investigation of the numerous executions to match magic bytes in the target program and if AFL cannot generate seed to bypass magic bytes or nested checksums it becomes stuck. Moreover, the execution speed performance of DeepFuzz was slightly higher than AFL. DeepFuzz combines a dynamic symbolic execution with AFL to dive deep into the binary; however symbolic execution-based tools are not able to fuzz faster because of the path explosion issue. Additionally, symbolic testing tools suffer from the symbolic emulation problem, and it gets slow-down in formulating path constraints [22].