fuzzbench

fuzzbench copied to clipboard

Idea from Marcel

Just to clarify.

The y-axis is the average normalized coverage across all benchmarks (mean of means per fuzzer). The normalized coverage for a benchmark is computed as the proportion of covered code elements (e.g., regions) w.r.t. the maximum number of code elements (e.g., regions) covered in any trial by any fuzzer. We take the mean of means because different (benchmark, fuzzer) combinations might have a differing number of trials.

The x-axis is log-time. It nicely shows how the fuzzer performs for short fuzzing campaign (like a short CI run). The trajectories might also hint at fuzzer performance at twice the time budget.

Was thinking something like this: