BAC Honours Thesis

On the Reliability of Statistical Guidance for Stopping Fuzzing Campaigns

By Tan Ky Le

Supervised by: Rahul Gopinath and Danushka Liyanage

Abstract

Fuzz testing is a powerful technique for uncovering software bugs by generating unexpected program inputs. However, determining when to stop a fuzzing campaign remains a key challenge, as ongoing fuzzing may continue to consume resources without producing significant results. Recent research has proposed using statistical estimators and a stopping criterion to predict when fuzzing is nearing saturation, that is, when most reachable code has likely been explored. By quantifying testing progress, these techniques aim to provide a structured alternative to the intuition-based decisions traditionally made during fuzzing campaigns.

This thesis evaluates the effectiveness of that prior work by replicating its methodology across multiple real-world software targets using 48-hour fuzzing campaigns. The results show that while the estimators are consistent and reproducible, they often underestimate how much of the program is still unexplored. The proposed stopping criterion works in some cases but is not reliable across all scenarios. These findings suggest that statistical approaches can help guide fuzzing, but they require careful interpretation.