RespFuzzer

This repository contains the implementation and all necessary scripts to reproduce the results of our paper "Reflective Seed Generation and Semantic-Driven Mutation for Python Library Fuzzing"， currently submitted to IEEE TSE.

Architecture

• Reflective Seed Generation
  • src/respfuzzer/lib/library_visitor.py
  • src/respfuzzer/lib/agentic_function_resolver.py
• Semantic-Guided Mutation
  • src/respfuzzer/lib/fuzz/instrument.py
  • src/respfuzzer/lib/mutator.py
  • src/respfuzzer/lib/llm_mutator.py
  • src/respfuzzer/lib/fuzz/fuzz_function.py
  • src/respfuzzer/lib/fuzz/fuzz_library.py
  • src/lib.rs
  • src/chain_rng.rs
  • src/mutator.rs

Installation

0. Prerequisites:

• uv tool for virtual environment management (https://docs.astral.sh/uv/getting-started/installation/)
• Python 3.13 (Based on uv)
• rust and cargo for building native extensions (https://rust-lang.org/tools/install/)

1. Clone the repository:

git clone https://github.com/EgodPrime/respfuzzer.git
cd respfuzzer

2. Create and activate a virtual environment:

uv venv --python 3.13
source .venv/bin/activate

3. Install the project and its dependencies:

uv pip install -e .
# (Optional) Developer mode:
# uv pip install -e .[dev]

4. install dcov for coverage analysis:

uv pip install git+https://github.com/EgodPrime/dcov.git@python_v2

5. Install the libraries under test:

# edit the script and set USE_UV=0 if you are not using uv
bash scripts/install_lut.sh

6. Configure the framework:

cp config.toml.default config.toml
# Edit config.toml to set your model API key and other settings
vim config.toml

Configuration

The framework uses config.toml for configuration. Key settings include:

Model Configuration

used by Reflective Seed Generation

• base_url: Base URL for the model API.
• api_key: API key for authentication.
• model_name: Name of the model to use.

Database Configuration

• db_name: Name of the SQLite database file.

Redis Configuration

• host: Redis server host.
• port: Redis server port.
• db: Redis database index.

Fuzzing Parameters

• execution_timeout: Timeout for function execution.
• llm_fuzz_per_seed: Number of LLM-based mutations per seed.
• data_fuzz_per_seed: Number of data-based mutations per seed.
• max_try_per_seed: Maximum attempts per seed.

Usage Examples

Extract Functions from a Library

reflective_seeder extract_functions numpy

There will be a new SQLite database file (<db_name>.db where <db_name> is set in config.toml) created in the run_data folder containing the extracted functions.

Generate Function Calls

reflective_seeder generate_seeds numpy

Start Fuzzing

fuzz fuzz_library numpy

Libraries Under Test

The following libraries are used for testing and evaluation of the RespFuzzer framework:

Library	Type	Composition	URL
NLTK	Natural Language Processing	Pure Python	https://www.nltk.org/
Dask	Parallel Computing	Pure Python	https://dask.org/
PyYAML	YAML Parsing	Pure Python	https://pyyaml.org/
Prophet	Time Series Forecasting	Python + C extension	https://facebook.github.io/prophet/
NumPy	Scientific Computing	Python + C extension	https://numpy.org/
Pandas	Data Analysis	Python + C extension	https://pandas.pydata.org/
Scikit-learn	Machine Learning	Python + C extension	https://scikit-learn.org/
Scipy	Scientific Computing	Python + C extension	https://scipy.org/
Requests	HTTP Library	Pure Python	https://requests.readthedocs.io/
spaCy	Natural Language Processing	Python + C extension	https://spacy.io/
PyTorch	Deep Learning	Python + C extension	https://pytorch.org/
PaddlePaddle	Deep Learning	Python + C extension	https://www.paddlepaddle.org.cn/