Raise or Check? Predicting the Necessity of Additional Fuzzing for Continuous Fuzzing

What it is

RAISE (Risk-Aware Intensive Supplemental Execution Framework) is a day-level just-in-time classifier from Kato, Shirai, Nourry, Kashiwa, Fujiwara, Kamei and Iida (October 2026). It predicts whether a project-day on OSS-Fuzz introduced a vulnerability. The title's "raise or check" means: keep the regular fuzzing budget when predicted risk is low, and add fuzzing sessions when it is high. The code and data are at https://github.com/kr37577/RAISE.

How it works

• Labels come from OSV vulnerability-introducing commits. Features come from OSS-Fuzz daily coverage and change metrics, plus VCCFinder-style static change features (modified functions, C/C++ keywords in the patch, patch text).
• Only 347 of 15,210 project-days (2.28%) are positive, across 15 C/C++ projects. Evaluation is cross-project.
• The best model is a Random Forest combining static and fuzzing features, with ROC-AUC 0.74.
• Coverage metrics get the highest importance scores, and PatchCoverage ranks first.
• The authors then simulate five budget-constrained strategies for scheduling extra fuzzing, over 968 vulnerabilities. Simple-Regression is the cheapest at 91.60 extra sessions per detected vulnerability, against 171.89 for the Median heuristic. The authors call the difference significant.

Preconditions / Affected

The model needs per-day coverage data of the kind OSS-Fuzz publishes through Fuzz Introspector, and a way to run extra fuzzing sessions on demand. It was built and tested only on C/C++ projects from OSS-Fuzz.

Caveats

• An AUC of 0.74 on a 2.28% positive rate is a moderate signal, not a precise one.
• The cost figures come from a simulation, not from running additional fuzzing in production.
• The fetched text stops in the related-work section. It does not describe the other three strategies, the budget settings, or the threats-to-validity section, so those are not covered here.