The Saturation Effect in Fuzzing – Embedded in Academia

Fuzzing can experience saturation where the number of new bugs found by a fuzzer drops off over time, either due to the bugs being triggered at low probability or because some bugs are out of reach for the fuzzer. Saturation can be detected using coverage-based stopping criteria or by splitting a testing effort into subsets with their own coverage measure. Mitigating saturation can be done by finding more bugs before saturation occurs through wider net casting and adding new mutation operators for mutation-based fuzzers.