  Fuzzing is widely used for software vulnerability detection. There are
various kinds of fuzzers with different fuzzing strategies, and most of them
perform well on their targets. However, in industry practice and empirical
study, the performance and generalization ability of those well-designed
fuzzing strategies are challenged by the complexity and diversity of real-world
applications.
  In this paper, inspired by the idea of ensemble learning, we first propose an
ensemble fuzzing approach EnFuzz, that integrates multiple fuzzing strategies
to obtain better performance and generalization ability than that of any
constituent fuzzer alone. First, we define the diversity of the base fuzzers
and choose those most recent and well-designed fuzzers as base fuzzers. Then,
EnFuzz ensembles those base fuzzers with seed synchronization and result
integration mechanisms. For evaluation, we implement EnFuzz , a prototype
basing on four strong open-source fuzzers (AFL, AFLFast, AFLGo, FairFuzz), and
test them on Google's fuzzing test suite, which consists of widely used
real-world applications. The 24-hour experiment indicates that, with the same
resources usage, these four base fuzzers perform variously on different
applications, while EnFuzz shows better generalization ability and always
outperforms others in terms of path coverage, branch coverage and crash
discovery. Even compared with the best cases of AFL, AFLFast, AFLGo and
FairFuzz, EnFuzz discovers 26.8%, 117%, 38.8% and 39.5% more unique crashes,
executes 9.16%, 39.2%, 19.9% and 20.0% more paths and covers 5.96%, 12.0%,
21.4% and 11.1% more branches respectively.
