Donghai Tian

Software call graphs encode both the structural organization and interaction semantics of software systems. Existing network generators, however, usually emphasize local degree statistics or coarse topological similarity, and often cannot preserve community structure, global degree-pairing patterns, and degree–weight dependence simultaneously. This paper proposes a feature-driven framework for generating directed dual-weight software networks from function-call graphs, where code size is modeled as node weight and static call frequency is modeled as edge weight. The framework combines correlation-aware node-metric generation, community-preferential connectivity, assortativity-guided edge rewiring, and semantics-aware edge-weight assignment to improve the joint preservation of topological and weighted properties. Experimental results on four real software-network datasets, including Large-CG, the largest weakly connected component of an extracted Visual Studio Code function-call graph, demonstrate that the generated networks effectively reproduce key structural and weighted characteristics of the originals. In addition, ablation studies confirm the role of individual components, and scale-control experiments show stable behavior across different network sizes. Wall-clock runtime experiments under a unified CPU setting further show that the framework remains computationally feasible across all four target scales. The proposed method provides a reproducible and controllable solution for software-network generation and offers useful support for downstream software analysis tasks.

Fuzzing, which rapidly generates test cases through seed mutation, is considered as one of the most efficient detection technologies currently available. Directed fuzzing has the ability to gradually guide the fuzzer towards specific targets specified by the user, thereby enhancing the efficiency of discovering vulnerabilities in specified areas. However, fuzzing may hit bottlenecks and fail to reach the target area effectively, resulting in fuzzing stagnation. Traditional directed fuzzers calculate the distance between seed execution paths and points, which leads to resource-consuming preprocessing. In this paper, we proposed a new directed fuzzing method which extracts the dominance path of the target from ICFG, locates critical bottlenecks using basic block access frequency and selects fuzzing seeds that reaches these targets. Meanwhile we improved the "exploration-exploitation" phase switching mechanism and energy assignment algorithm. We implemented the techniques in a prototype system, BDFuzz. Crash reproduction experiments on several real-world programs show that BDFuzz outperforms other classic fuzzers, AFL and AFLGo.