Fuzzing in Open-Source Software: Current State, Evolution, and Challenges
undergraduate researcher · VIP · advisor: Prof. Aravind Machiry, Purdue
presented at the Purdue Undergraduate Research Expo, fall 2024
An empirical study of fuzzing practice across the OpenSSF Alpha-Omega top 10,000 open-source projects. I owned the ground-truth and data layer.
Showed that keyword-based detection of fuzzing practice is wrong more often than right, close to two false positives for every true positive, which established that the study needed hand-labeled ground truth.
Curated and hand-labeled the trigger corpus (source context plus repository metadata) used as ground truth for the classification task.
Built the data pipeline over the OSS-Fuzz and Fuzz Introspector APIs, joined with GitHub commit history, to track fuzz harness reachability and coverage as projects evolved.
- fuzzing
- oss-fuzz
- fuzz introspector
- empirical se
- ground truth