## 4 System Design
### Locating RC Points and Negating Procedure
## 7 Conclusions

It is rather difficult to bypass nested complex checks in programs for mutational or symbolic execution-based fuzzing techniques and thus, hard-to-reach bugs will be left uncovered. In this paper, we introduced a new transformational hybrid fuzzing approach. We implement a scalable, lightweight hybrid fuzzing technique named DeepDiver, which can detect roadblock checks and negate them to execute new paths. According to the evaluation results, our implementation is scalable to test real-world programs and can deep-dive into complex binaries. Moreover, DeepDiver performed much better than the most modern state-of-the-art hybrid fuzzers, i.e., QSYM and DeepFuzz, as well as other types of fuzzers in LAVA-M dataset and real-world applications. On average, DeepDiver trigger bugs 32.2% and 41.6% faster than QSYM and AFLFast, respectively. Ultimately, we believe that our hybrid fuzzing design will contribute to the advancement of software vulnerability testing processes. [PERSON] contributed the ideas, conducted the experiments and wrote the paper; [PERSON] provided resources and database of vulnerable programs; [PERSON] supervised the whole paper including paper organization and proofread. All authors have read and agreed to the published version of the manuscript. This research was supported by the MSIT (Ministry of Science and ICT), Korea, under the ITRC (Information Technology Research Center) support program (IITP-2020-2018-0-01423) supervised by the IITP (Institute for Information & Communications Technology Planning & Evaluation). Also, this research was supported by the Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education (number NRF-2018R1D1A1B07047323). The authors declare no conflict of interest. ## References

* [PERSON] and [PERSON] (2018) [PERSON]; [PERSON] [PERSON] Angora: Efficient fuzzing by principled search. In Proceedings of the 39 th IEEE Symposium on Security and Privacy, San Francisco, CA, USA, 21-23 May 2018. * [PERSON] et al. (2018) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Understanding the reproducibility of crowd-reported security vulnerabilities. In Proceedings of the 27 th USENIX Conference on Security Symposium, Baltimore, MD, USA, 15-17 August 2018; pp. 919-936. * [PERSON] and American Fuzzy Lop (AFL) [PERSON] American Fuzzy Lop (AFL), README. Available online: [[http://icamtuf.coredump.cx/afl/](http://icamtuf.coredump.cx/afl/)]([http://icamtuf.coredump.cx/afl/](http://icamtuf.coredump.cx/afl/)) (accessed on 29 October 2019). * [PERSON] (2019) [PERSON] zzuf:multi-purpose Fuzzer. Available online: [[http://caca.zoy.org/wiki/zzuf](http://caca.zoy.org/wiki/zzuf)]([http://caca.zoy.org/wiki/zzuf](http://caca.zoy.org/wiki/zzuf)) (accessed on 9 November 2019). * [PERSON] (2005) [PERSON] Violating assumptions with fuzzing. _IEEE Secur. Priu._**2005**, 3, 58-62. [CrossRef]
* T-Fuzz Source Code (2019) T-Fuzz Source Code. Available online: [[https://github.com/HexHive/T-Fuzz](https://github.com/HexHive/T-Fuzz)]([https://github.com/HexHive/T-Fuzz](https://github.com/HexHive/T-Fuzz)) (accessed on 9 November 2019). * Month of Kernel Bugs (2019) Month of Kernel Bugs. Available online: [[https://jon.oberheide.org/mokb/](https://jon.oberheide.org/mokb/)]([https://jon.oberheide.org/mokb/](https://jon.oberheide.org/mokb/)) (accessed on 10 December 2019). * Month of Browser Bugs (2019) Month of Browser Bugs. Available online: [[http://browserfun.blogspot.com](http://browserfun.blogspot.com)]([http://browserfun.blogspot.com](http://browserfun.blogspot.com)) (accessed on 10 December 2019). * The Heartbleed Bug (2019) The Heartbleed Bug. Available online: [[http://heartbleed.com/](http://heartbleed.com/)]([http://heartbleed.com/](http://heartbleed.com/)) (accessed on 10 December 2019). * [PERSON] and Coss-Fuzz--Google's Continuous Fuzzing Service for Open-Source Software.