Accurate and Low-Cost Residual Risk Assessment via Sampled Profiling and Structure-Aware Coverage Amplification
Published in Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE '26), 2026
Estimating the residual risk of undiscovered bugs is critical for determining testing adequacy in fuzzing. This paper proposes a risk assessment method for black-box fuzzing that leverages hardware-enabled performance profiling — replacing coverage instrumentation with instruction pointer (IP) sampling — combined with must-execute analysis, a static control-flow analysis that reconstructs missing execution paths from partial observations. The method achieves 4.27x higher throughput than complete-coverage instrumentation, reaching stopping thresholds 2x faster while maintaining high accuracy, and triggers more bugs with speedups of up to 10x within the same time budget.
Recommended citation: Seongmin Lee, Işıl Özgü, Marcel Böhme, and Miryung Kim. 2026. "Accurate and Low-Cost Residual Risk Assessment via Sampled Profiling and Structure-Aware Coverage Amplification." In Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE '26), October 12–16, 2026, Munich, Germany. ACM, New York, NY, USA, 12 pages. https://doi.org/10.1145/3832783.3837519
Download Paper