Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DynamiQ: Unlocking the Potential of Dynamic Task Allocation in Parallel Fuzzing

Wenqi Yan, Toby Murray, Benjamin I. P. Rubinstein, Van-Thuan Pham

TL;DR

This work addresses the inefficiency of traditional parallel fuzzing caused by task conflicts when seeds are treated as individual units. It introduces DynamiQ, a LibAFL-based framework that uses dynamic call-graph partitioning guided by entropy-weighted function scoring to create coherent tasks, combined with selective instrumentation and bounded context to minimize redundant exploration. The approach achieves substantial improvements in code coverage (up to $26.22\%$) and vulnerability discovery, including 9 previously unknown bugs across 12 real-world targets, validating the efficacy of dynamic, structure-aware partitioning at scale. The work provides a practical reproducibility package and demonstrates significant impact for real-world software security testing, with potential for further enhancements via directed fuzzing and adaptive repartitioning.

Abstract

We present DynamiQ, a full-fledged and optimized successor to AFLTeam that supports dynamic and adaptive parallel fuzzing. Unlike most existing approaches that treat individual seeds as tasks, DynamiQ leverages structural information from the program's call graph to define tasks and continuously refines task allocation using runtime feedback. This design significantly reduces redundant exploration and enhances fuzzing efficiency at scale. Built on top of the state-of-the-art LibAFL framework, DynamiQ incorporates several practical optimizations in both task allocation and task-aware fuzzing. Evaluated on 12 real-world targets from OSS-Fuzz and FuzzBench over 25,000 CPU hours, DynamiQ outperforms state-of-the-art parallel fuzzers in both code coverage and vulnerability discovery, uncovering 9 previously unknown bugs in widely used and extensively fuzzed open-source software.

DynamiQ: Unlocking the Potential of Dynamic Task Allocation in Parallel Fuzzing

TL;DR

This work addresses the inefficiency of traditional parallel fuzzing caused by task conflicts when seeds are treated as individual units. It introduces DynamiQ, a LibAFL-based framework that uses dynamic call-graph partitioning guided by entropy-weighted function scoring to create coherent tasks, combined with selective instrumentation and bounded context to minimize redundant exploration. The approach achieves substantial improvements in code coverage (up to ) and vulnerability discovery, including 9 previously unknown bugs across 12 real-world targets, validating the efficacy of dynamic, structure-aware partitioning at scale. The work provides a practical reproducibility package and demonstrates significant impact for real-world software security testing, with potential for further enhancements via directed fuzzing and adaptive repartitioning.

Abstract

We present DynamiQ, a full-fledged and optimized successor to AFLTeam that supports dynamic and adaptive parallel fuzzing. Unlike most existing approaches that treat individual seeds as tasks, DynamiQ leverages structural information from the program's call graph to define tasks and continuously refines task allocation using runtime feedback. This design significantly reduces redundant exploration and enhances fuzzing efficiency at scale. Built on top of the state-of-the-art LibAFL framework, DynamiQ incorporates several practical optimizations in both task allocation and task-aware fuzzing. Evaluated on 12 real-world targets from OSS-Fuzz and FuzzBench over 25,000 CPU hours, DynamiQ outperforms state-of-the-art parallel fuzzers in both code coverage and vulnerability discovery, uncovering 9 previously unknown bugs in widely used and extensively fuzzed open-source software.

Paper Structure

This paper contains 20 sections, 6 equations, 3 figures, 7 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background and Motivation
  3. Approach
  4. Function Scoring
  5. Periodic Partitioning
  6. Task-Specific Fuzzing
  7. Implementation
  8. Workflow
  9. System Implementation
  10. Evaluation
  11. RQ1: Comparison with Existing Parallel Fuzzers
  12. RQ2: Impact of Partitioning Strategies
  13. RQ3: Scalability with Core Count
  14. RQ4: Extended Bug Discovery Campaign
  15. Discussion
  16. ...and 5 more sections

Figures (3)

  • Figure 1: Overview of our dynamic task partitioning framework. The workflow consists of three phases: Initialization, where the call graph is extracted and initial binaries are built; Periodic Partitioning, triggered at some intervals to update the call graph, score functions, and generate partition-specific binaries; and Task-Specific Fuzzing, where each fuzzing instance explores a designated partition.
  • Figure 2: Comparison of vertex (left) and edge (right) partitioning. Vertex partitioning assigns each node to one partition; edges may cross partitions. Edge partitioning assigns edges to partitions, possibly replicating nodes. Dotted lines indicate cross-partition edges.
  • Figure 3: Branch coverage progression over time across all benchmarks. Each fuzzing instance was allocated a 50 GiB memory limit. $\mu$FUZZ encountered out-of-memory (OOM) failures on bloaty, libxml2, and lcms, crashing after 12,455, 17,734, and 488 seconds, respectively.