Different factors in the performance of RLTG.

Directed greybox fuzzing guides fuzzers to explore specific objective code areas and has achieved good performance in some scenarios such as patch testing. However, if there are multiple objective code to explore, existing directed greybox fuzzers, such as AFLGo and Hawkeye, often neglect some targets because they use harmonic means of distance and prefers to test those targets with shorter reachable path. Besides, existing directed greybox fuzzers cannot calculate the accurate distance due to indirect calls in the program. In addition, existing directed greybox fuzzers fail to address the exploration and exploitation problem and have poor efficiency in seed scheduling. To address these problems, we propose a dynamic seed distance calculation scheme, it increase the seed distance dynamically when the reachable path encounter indirect call. Besides, the seed distance calculation can deal with the bias problem in multi-targets scenarios. With the seed distance calculation method, we propose a new seed scheduling algorithm based on the upper confidence bound algorithm to deal with the exploration and exploitation problem in drected greybox fuzzing. We implemented a prototype RLTG and evaluate it on real-world programs. Evaluation of our prototype shows that our approach outperforms a state-of-the-art directed fuzzer AFLGo. On the multi-targets benchmark Magma, RLTG reproduces bugs with 6.9x speedup and finds 66.7% more bugs than AFLGo.定向灰盒模糊测试（directed greybox fuzzing）可引导模糊器探索特定的目标代码区域，在补丁测试等场景中已取得优异表现。然而，当需要探索多个目标代码时，现有的定向灰盒模糊测试工具（如AFLGo和Hawkeye）往往会忽略部分目标，因为它们采用距离调和均值作为评估标准，更倾向于优先测试可达路径更短的目标。此外，由于程序中存在间接调用，现有的定向灰盒模糊测试工具无法计算准确的距离值。除此之外，现有定向灰盒模糊测试工具未能解决探索与利用的权衡问题，且种子调度的效率低下。为解决上述问题，本文提出一种动态种子距离计算方案：当可达路径遭遇间接调用时，该方案会动态调整种子距离值。同时，该种子距离计算方法能够处理多目标场景下的偏差问题。基于该种子距离计算方法，本文提出一种基于置信度上界（upper confidence bound）算法的新型种子调度算法，以解决定向灰盒模糊测试中的探索-利用权衡问题。本文实现了原型工具RLTG，并在真实程序上开展了评估实验。评估结果表明，本文所提方法的性能优于当前最先进的定向模糊测试工具AFLGo。在多目标基准测试集Magma上，RLTG的漏洞复现速度提升6.9倍，且较AFLGo多发现66.7%的漏洞。