Efficient Directed Fuzz Testing System Based on the Exp3 Algorithm

This study addresses the inefficiency of triggering vulnerability areas and low test case effectiveness in directed fuzzing by proposing an Exponential-weight algorithm for Exploration and Exploitation (Exp3) algorithm-based system. The system locates suspicious targets through function flow graph similarity analysis, constructs reward functions using code coverage metrics, and dynamically optimizes seed mutation via a multiarmed bandit model to reduce randomness. Evaluated on Bind9 and Dnsmasq with AFL, AFLGO, SelectFuzz, and two variants (Upper Confidence Bound (UCB) / Exp3-based), the Exp3-based tool demonstrated superior performance in Bind9 tests, achieving higher target/path coverage without complex confidence interval calculations. This strategy provides an innovative solution for directed fuzzing efficiency enhancement.