Multi-Dimensional and Message-Guided Fuzzing for Robotic Programs in Robot Operating System

An increasing number of robotic programs are implemented based on Robot Operating System (ROS), which provides many practical tools and libraries for robot development. To improve robot reliability and security, several recent approaches apply fuzzing to ROS programs for bug detection. However, these approaches still have some main limitations, including inefficient test case generation, ineffective program feedback and weak generality/automation.In this paper, we design a new fuzzing framework named ROFER, to effectively test robotic programs in ROS for bug detection. Compared to existing ROS fuzzing approaches, ROFER has two novel techniques: (1) a dimension-level mutation method that considers the contribution of each input dimension to testing coverage, to generate efficient test cases from multiple dimensions; (2) a message-guided fuzzing approach that uses a new coverage metric named message feature, to reflect the robot's possible state transitions affected by multiple ROS nodes. We evaluate ROFER on 13 common robotic programs in ROS2, and it finds 88 real bugs, 46 of which have been confirmed by ROS developers. We compare ROFER to four state-of-the-art ROS fuzzing approaches, and it finds more bugs with higher testing coverage.