# Not All Seeds Are Important: Fuzzing Guided by Untouched Edges
## 6 Evaluation
### Experiment Settings  
(1) Baseline Seed Scheduling Strategies: Starting from the minimum coverage set, rare paths, new paths, and same-prefix coverage, the seed scheduling method proposed in this paper was compared with native AFL [9], AFLFast [12], EcoFuzz [14], and Alphuzz [16] seed scheduling strategies. It is important to note that these five tools differ only in their seed scheduling mechanisms while all other components remain the same. FairFuzz [13] was not compared due to its custom mutator, which aims to obtain mutation byte masks. When fuzzing large-scale seeds, the custom mutator might lead to starvation in subsequent seeds. Conversely, if seeds are small, the additional coverage gained from deterministic mutation might be unfair compared to fuzzers without deterministic mutation. Previous work [36] removed this custom mutation phase in experiments, but this deviated from FairFuzz's original intent. Therefore, we do not select FairFuzz for comparison.  
Additionally, the multi-property queue seed scheduling method SLIME [15] is not compared due to the additional instrumentation for the target program. This instrumentation affects program execution speed and differs significantly from the instrumentation used by the aforementioned tools. The tool we implemented can share the same instrumentation program with these tools, ensuring no experimental differences in comparison.  
(2) Benchmark Programs: We selected 12 real-world binary programs for testing based on their popularity, testing frequency, and diversity of categories. As shown in Table 1, these 12 binary programs include popular binary utilities (such as readelf), image parsing and processing libraries (such as libjpeg-turbo, exiv2), audio parsing tools (such as mp3 gain), document processing libraries (such as xpdf, libxml2), and network packet parsing tools (such as tcpdump). Since certain vulnerabilities (i.e., buffer overflows) do not affect the program execution, we apply Address Sanitizer (ASAN) [37] to capture memory errors.  
(3) Initial Corpus: The initial seed corpus used comes from datasets provided by Mopt [38] and uniFuzz [39], with some contributions from the open-source community.  
(4) Experimental Environment: The experiments were conducted on a server with a 56-core Intel Xeon CPU, 128 GB of memory, and running Ubuntu 22.04. Deterministic mutations were disabled as it is less effective compared to AFL's havoc mutation strategy [40]. To reduce the impact of randomness, we ran each benchmark program for 24 h, repeating the process 10 times and taking the arithmetic mean as the final result [41].  
(5) Experimental Metrics: We evaluated the proposed method against four fuzzers with different seed scheduling strategies, considering edge coverage, edge coverage over time, and the number of unique crashes. Additionally, the proposed guided mechanism for untouched edges was transplanted into MOpt to assess its performance across different  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Program** & **Library and Version** & **Input Type** & **Commands** \\ \hline dipeg & libjpeg-turbo-2.1.91 & jpg & @@ \\ exiv2 & exiv2-0.26 & jpg & @@/dev/null \\ pdttocket & xpdf-4.0 & pdf & @@ \\ tcmdump & tcmdump -4.8 & bin & -e-vv-nr@@ \\ mp3 gain & mp3 gain-1.5 & mp3 & @ \\ mp42 aac & Bento4-1.5-1.628 & mp4 & @/dev/null \\ tifcp & libtiff-3.9.7 & tiff & -i-E1-H10-V10-S8:4-R270@ \\  & & &./output.tif \\ readelf & binutils-2.28 & elf & -a@ \\ nm-new & binutils-2.28 & elf & -A-a-l-S-s-special-syms \\  & & & -synthetic –with-symbol-versions-D \\  & & & @ \\ xmlint & libxml-2.98 & xml & @ \\ bsdtar & libarchive-3.2.0 & tar & -xf@/dev/null \\ mujs & SQLite-3.8.9 & text(js) & @ \\ \hline \hline \end{tabular}
\end{table}
Table 1: Twelve real-world programs for evaluation.  
fuzzers. MOpt was chosen due to its focus on optimizing mutation operators while keeping the seed scheduling mechanism unaltered.