How to Spot Good Fuzzing Research

Summary: Trail of Bits reports that of nearly 200 fuzzing papers published in the last three years, most are academic clamor, held back by inconsistent and subjective benchmarks. The authors of the paper "Evaluating Fuzz Testing," presented by Andrew Ruef at the 2018 SIGSAC Conference on Computer and Communications Security in Toronto, reviewed 32 high-quality fuzzing publications and found not a single one that aligned with all 10 of their recommended best practices.
Key Takeaway: The same review found that AFLFast, despite finding many more 'unique' crashing inputs than AFL, had only a slightly higher likelihood of finding more unique bugs in a given run - a reminder that a fuzzer's headline crash count may not translate into bugs your team actually needs to fix.

Read the original at Trail of Bits Blog ↗