## 4 System Design
### Locating RC Points and Negating Procedure
According to these results, after filtering out reported crashes the number of false positives was very low, indicating the efficient performance of Bug Validation mode. Figure 4 shows the number of explored paths in the LAVA-M dataset. We compared DeepDiver coverage results which were a fuzzing execution time of three hours with the state-of-the-art hybrid fuzzers QSYM [22] and DeepFuzz [47]. Results show that during the first hour of the execution time results of all hybrid fuzzing techniques were almost the same in _base64_, _md5 sum_ and _who_ applications. When analyzing the _uniq_ binary, the coverage results of QSYM were slightly higher in the first hour than DeepDiver. All hybrid testing approaches showed nearly the same coverage results in the middle of the all LAVA-M software analysis process. However, at the end of the testing process, DeepDiver reached the highest result compared with both hybrid fuzzing tools except binary _who_ where path coverage results of DeepDiver were slightly higher than QSYM. Despite the execution time has been three hours, DeepDiver explored the many paths. Without a doubt, AFL ++ power schedules integrated from AFLFast [27] and concolic execution play a vital role in covering many paths. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Program**} & **Listed** & \multicolumn{2}{c}{**T-Fuzz**} & \multicolumn{2}{c}{**DeepFuzz**} & \multicolumn{2}{c}{**DeepDiver**} & \multicolumn{2}{c}{**QSYM (R)**} & \multicolumn{2}{c}{**QSYM (P)**} \\ \cline{3-10}  & **Bugs** & **3 h** & **5 h** & **3 h** & **5 h** & **3 h** & **5 h** & **3 h** & **5 h** & **5 h** \\ \hline \multirow{2}{*}{base64} & \multirow{2}{*}{44} & 21 & 43 & 15 & 29 & 39 & 44 & 22 & 38 & 44 \\  & & 47.7\% & 97.7\% & 34.0\% & 64.9\% & 88.6\% & 100\% & 50\% & 86.3\% & 100\% \\ \hline \multirow{2}{*}{uniq} & \multirow{2}{*}{28} & 16 & 26 & 2 & 16 & 26 & 28 & 6 & 13 & 28 \\  & & 57.1\% & 92.8\% & 7.14\% & 57.1\% & 92.8\% & 100\% & 21.4\% & 46.4\% & 100\% \\ \hline \multirow{2}{*}{md5 sum} & \multirow{2}{*}{57} & 27 & 49 & 19 & 30 & 48 & 57 & 26 & 44 & 57 \\  & & 47.3\% & 85.9\% & 33.3\% & 52.6\% & 84.2\% & 100\% & 45.6\% & 77.1\% & 100\% \\ \hline \multirow{2}{*}{who} & \multirow{2}{*}{2136} & 41 & 63 & 12 & 21 & 79 & 101 & 34 & 71 & 1238 \\  & & 1.91\% & 2.94\% & 0.56\% & 0.98\% & 3.69\% & 4.72\% & 1.59\% & 3.32\% & 57.9\% \\ \hline \end{tabular}
\end{table} 
Table 2: The number of found bugs in testing on LAVA-M dataset. Figure 4: Number of covered paths in the LAVA-M dataset. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Program**} & **Reported** & **True** & **False** & **Split FP** \\  & **Crashes** & **Bugs** & **Bugs** & **Instructions** \\ \hline base64 & 51 & 44 & 7 & 41 \\ uniq & 36 & 28 & 8 & 33 \\ md5 sum & 63 & 57 & 6 & 72 \\ who & 111 & 101 & 10 & 159 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Filtering out detected crashes by Bug Validation and the number of split floating-point instructions in LAVA-M dataset. ### Evaluation of Real-World Programs

In this evaluation, we used 8 real-world non-trivial software applications that have been tested by other state-of-the-art fuzzing techniques for a long period of time. Table 4 shows detailed information regarding these applications. By fuzzing the second group programs, we compared DeepDiver's efficiency with the high-performance fuzzing tools, including AFL [3], AFLFast [27], and two hybrid fuzzers, QSYM [22] and DeepFuzz [47]. The run time for each program was six hours, and we analyzed each program five times to summarize the average results. Table 5 illustrates the number of unique crashes found by evaluating real-world programs. According to the results, our implementation overcame other state-of-the-art fuzzers and hybrid testing techniques. A total of 159 unique crashes were detected in six hours by DeepDiver. When compared with hybrid fuzzers QSYM and DeepFuzz, 120 and 56 total unique crashes were found, respectively.