# Photon-pair generation in a heterogeneous silicon photonic chip

Mingwei Jin1,2,†, Neil MacFarlane3,†, Zhaohui Ma1,2, Yongmeng Sua1,2
Mark A. Foster3, Yuping Huang1,2, Amy C. Foster3

$\dagger$. Equally contributing authors
1\. Department of Physics, Stevens Institute of Technology, Hoboken, NJ,
07030, USA
2\. Center for Quantum Science and Engineering, Stevens Institute of
Technology, Hoboken, NJ, USA
3\. Department of Electrical and Computer Engineering, Johns Hopkins
University, 3400 North Charles Street,
Baltimore MD, 21218, USA

###### Abstract

Integrated Silicon photonics has played an important role in advancing the
applications of quantum information and quantum science. However, due to
different material properties, it is challenging to integrate all components
with excellent performance based on homogeneous material. Here, by combining
high nonlinearity and low losses in a heterogeneous silicon platform, we
efficiently generate high-quality photon pairs through spontaneous four-wave
mixing in hydrogenated amorphous silicon waveguide and route them off-chip
through low loss silicon nitride waveguide. A record high coincidence- to-
accidental rate value of 1632.6 ($\pm$ 260.4) is achieved in this
heterogeneous design with a photon pair generation rate of 1.94 MHz. We also
showcase a wide range of multi-channel photon sources with coincidence- to-
accidental rate consistently at 200. Lastly, we measure heralded single-
photons with a lowest $g^{(2)}_{H}(0)$ of 0.1085 $\pm$ 0.0014. Our results
demonstrate the heterogeneous silicon platform as an ideal platform for
efficient generation of photon pairs and routing them off-chip with low
losses. It also paves a way for the future hybrid photonic integrated circuit
by collecting distinct features from different materials.

##  1 Introduction

Integrated photonics has emerged as a key technology in various applications
such as data centers, telecommunication, photonic computing, and quantum
computing. These applications require numerous integrated components including
low-loss waveguide routing, laser sources, photodetectors, modulators, single
photon and photon pair sources. However, due to distinct properties of
different materials, it becomes necessary to incorporate various materials in
heterogeneous platforms to incorporate different components onto a single
platformDavanco et al. (2017); Schnauber et al. (2019); Moody et al. (2022).

Among those photonic components, correlated photon-pair sources are of great
interest due to their applications in quantum computing, quantum
teleportation, quantum information processing, quantum sensing, quantum
cryptography and othersO’Brien (2007); Bouwmeester et al. (1997); Kimble
(2008); Degen et al. (2017); Gisin et al. (2002); O’Brien et al. (2009). A
photon pair source with a broad and switchable bandwidth is essential for
applications such as quantum frequency multiplexing and quantum memoryLavoie
et al. (2013); Sinclair et al. (2014). Over the past decade, there has been
tremendous progress with chip-integrated photon pair sources by spontaneous
four-wave mixing (SFWM) and spontaneous parametric down-conversion (SPDC),
such as those in crystalline silicon (c-Si) Kues et al. (2017); Lu et al.
(2016), silicon nitride ($\mathrm{Si_{3}N_{4}}$) Zhang et al. (2016),
hydrogened amorphous Silicon (a-Si:H) Wang et al. (2014); Hemsley et al.
(2016), gallium phosphide (GaP) Logan et al. (2018), gallium arsenide (GaAs)
Chang et al. (2019), and lithium niobate (LiNbO3)Ma et al. (2020). Among these
platforms, a-Si:H has achieved particular attention as a photonic platform due
to its ultra-high Kerr nonlinearity ($n_{2}=7.43\pm 0.87x10^{-13}$ $cm^{2}/W$)
comparing to other silicon-based material platformsWang and Foster (2012).
With such a high Kerr coefficient, efficient SFWM can be achieved with only
millimeters of waveguide propagation. Contending with crystalline Silicon
(c-Si), a-Si:H can be easily deposited at a lower temperature and thus
incorporated in massive chip manufacturing processesHemsley et al. (2016).

Despite the excellent Kerr nonlinearity of a-Si:H, the lowest reported a-Si:H
linear propagation losses are about an order of magnitude higher than
$\mathrm{Si_{3}N_{4}}$Oo et al. (2019). In quantum application, Even though
the high nonlinearity of a-Si:H plays a key role in efficiently generating
photon pairs, the high propagation loss of a-Si:H waveguide resuts in many of
the photon pairs being lost on chip before off-chip detection. This
dramatically reduces the coincidence- to- accidental rate that can be observed
and severely limits its quantum applications.

In our previous work, to mitigate higher propagation losses in a-Si:H
waveguides, $\mathrm{Si_{3}N_{4}}$ waveguides are used for on/off-chip
coupling, and vertical coupling between a-Si:H and $\mathrm{Si_{3}N_{4}}$
occurs on-chipMacFarlane et al. (2019). With a careful design of vertical
coupler, the coupling loss is optimized around 0.5 dB per transition. The
replacement of the a-Si:H with a $\mathrm{Si_{3}N_{4}}$ waveguide for on-off
chip coupling dramatically reduces fiber-to-fiber loss. This reduces the
required pump power especially for photon pair generation and broadens the
applications of such a platform to other quantum technologies.

In this paper, leveraging the low loss and high nonlinearity of the
heterogeneous platform, we further explore the quantum performance of
a-Si:H/$\mathrm{SiN_{x}}$ waveguides. We experimentally demonstrate the photon
pair generation with the highest coincidence- to- accidental rate (CAR) of
1632.6 ($\pm$ 260.4) in non-resonant a-Si:H waveguides, showing significant
improvement comparing to the previous state of the art value in non-resonant
a-Si:H waveguideWang et al. (2014). The pure photon pairs are measured at
multiple channels with a detuning bandwidth of 6 nm and CAR value consistently
at 200. In addition, with the same chip, we perform heralded generation of
single photons. The auto-correlation is measurement as low as 0.0126 $\pm$
0.005. Our work combines the high nonlinearity of a-Si:H and the low
propagation loss of $\mathrm{Si_{3}N_{4}}$. Our results demonstrate the
benefits of a heterogeneous silicon platform for quantum applications by
utilizing both low transmission loss and highly nonlinearity. With low-loss
inter-layer coupler, such heterogeneous silicon platform also paves the way
for integrating even more layers and materials to achieve high-quality
components for various applications in quantum applications.

Figure 1: (a) Cross-section of multi-layer platform. (b) Side view of device
showing propagation lengths in $\mathrm{\mathrm{SiN_{x}}}$ (green) and a-Si:H
(blue) waveguides. (Inset - Top-down view of interlayer coupler with electric
field profiles at three locations along the interlayer coupler). (c) Dark-
field microscope image of $\mathrm{\mathrm{SiN_{x}}}$/a-Si:H waveguides and
interlayer coupling region.

##  2 Experimental Results

The multi-layer architecture is shown in Figure 1 (a-c). The device
fabrication starts with a 100-mm silicon wafer with a 3-$\mu$m thick layer of
thermal oxide on its surface. 240 nm of $\mathrm{SiN_{x}}$ is deposited using
low-pressure chemical vapor deposition (LPCVD). The recipe parameters
consisted of a deposition rate of 4-nm/min, a temperature of 775
$\mathrm{{}^{o}C}$, 1000-MPa tensile stress, and 250 mTorr chamber pressure.
Platinum marks for alignment between layers were patterned using electron beam
lift-off lithography. Weaveguides in the $\mathrm{SiN_{x}}$ layer were
patterned and etched by e-beam lithography and reactive ion etching
respectively. The Silicon dioxide ($\mathrm{SiO_{2}}$) cladding was then
deposited with plasma-enhanced chemical vapor deposition (PECVD).
Planarization of the $\mathrm{SiO_{2}}$ surface was performed using chemical
mechanical polishing. 225-nm of a-Si:H was then deposited by PECVD. The a-Si:H
layer was deposited using recipe parameters of a temperature of 300
$\mathrm{{}^{o}C}$, a RF power of 15-W, 1000-SCCM of 5% silane/helium gas
flow, and 1800 mTorr chamber pressure. With the lower a-Si:H deposition
temperature we are able to deposit it directly on top of the
$\mathrm{SiN_{x}}$ waveguides without damaging them. Finally, a-Si:H
waveguides are patterned and etched using e-beam lithography and reactive ion
etching. The a-Si:H waveguides are clad with PECVD ($\mathrm{SiO_{2}}$) and
individual chips are diced out of the wafer. Figure 1 (b) shows the geometry
of the interlayer coupler. The optical modes at different coupler sections are
simulated as figure 1 (b). Figure 1 (c) shows a dark-field microscope image of
$\mathrm{SiN_{x}}$ and a-Si:H waveguides and the interlayer coupling region.

Figure 2: (a) Interlayer coupler loss per wavelength. (b) FWM conversion
efficiency for different propagation lengths of a-Si:H waveguides. (originally
published in MacFarlane et al. (2022))

To characterize the Kerr coefficient of a-Si:H waveguides, we first perform
classic degenerate FWM in our multi-layer devices. Light is coupled on/off
chip via inverse taper couplers in the $\mathrm{SiN_{x}}$ layer as shown in
Figure 1 (b). We couple on/off the chip using tapered lensed fibers with mode-
field diameters of 2.5 $\mathrm{\mu m}$. The $\mathrm{SiN_{x}}$ layer offers
improved fiber-to-chip coupling efficiency from better mode-matching with the
lensed fiber compared to the a-Si:H waveguides. Once on-chip, the light
propagates for 1.5 mm in the $\mathrm{SiN_{x}}$ layer and is then coupled to
the a-Si:H layer via evanescent inverse taper couplers and propagates for
varying a-Si:H lengths between 1 mm and 5.5 mm. The signal is then coupled
back to the $\mathrm{SiN_{x}}$ layer, where it propagates for another 3.2 mm
and is finally output via the $\mathrm{SiN_{x}}$ layer and coupled to a
tapered lensed fiber. The on-chip interlayer coupling insertion loss is
measured to be less than 1 dB per transition over a 100 nm bandwidth, while
the propagation losses in the $\mathrm{SiN_{x}}$ and a-Si:H waveguides are 0.5
dB/cm and 4 dB/cm, respectively. The insertion losses as a function of
wavelength are shown in Figure 2 (a). We measure the four-wave mixing
conversion efficiency (CE), defined as the ratio of the output idler power to
the input signal power, using multiple devices with varying propagation
lengths in the a-Si:H layer. The measured conversion efficiency values as a
function of a-Si:H propagation length are shown in Figure 2 (b). These results
equate to a Kerr coefficient of $\sim 5$ x $10^{-13}$ $\mathrm{cm^{2}/W}$,
which is comparable to the state-of-the-art value ($7.43$ x $10^{-13}$
$\mathrm{cm^{2}/W}$) Wang and Foster (2012).

Figure 3: (a) Experimental setup. MLL: mode locked laser. VA: variable
attenuator. DWDM: dense wavelength-division multiplexer. FPC: fiber
polarization controller. DUT: device under test. SNSPDs: superconducting
nanowire single photon detectors. (b) Single photon counts of Stokes and anti-
Stokes channels versus the on-chip pump power. ((b) originally published in
MacFarlane et al. (2022))

The photon pairs are then generated through SFWM in the a-Si:H waveguides. In
figure 3 (a), a 50MHz mode lock laser(Calmar Mendocino) is connected with a
variable attenuator and four cascaded dense wavelength-division multiplexing
(DWDM) filters at 1552.5 nm to accurately control pump power and suppress
photons beyond pump wavelength, respectively. We couple to the TE waveguide
mode for optimum SFWM efficiency and broad bandwidth by carefully tuning a
fiber polarization controller (FPC) and couple to the $\mathrm{SiN_{x}}$
inverse taper coupler through a lensed fiber. After propagating in the
$\mathrm{\mathrm{SiN_{x}}}$ waveguide, light is coupled through an interlayer
coupler to a 2.5 mm long a-Si:H waveguide where the photon-pair is generated.
The generated photon-pair is coupled back to a low-loss $\mathrm{SiN_{x}}$
waveguide and collected by a lensed fiber at the output. The total on-off chip
loss is 9 dB. The remaining pump photons are immediately rejected by two
cascaded DWDM filters with labelled 60 dB extinction. Two DWDM filters at
1545.3 nm collect Stokes photons and reject all other wavelengths. The anti-
Stokes photon at 1559.7nm is collected by two other DWDMs. The bandwidth for
the DWDM filters are aligned to be 200 GHz. The total losses by the output
DWDM sets are 1.9 dB and 2.2 dB at Stokes and anti-Stokes channels,
respectively. To ensure maximum detection efficiency, two FPCs are placed
before entering superconducting nanowire single photon detectors (4 channels
SNSPDs, ID281, ID Quantique). The SNSPDs have dark-count rate of 50-100 Hz and
detection efficiency of 85%. The detected signals are lastly resolved by a
time-tagging unit (Swabian Instruments) for photon counting and correlated
detection.

The stimulated Raman scattering (SRS) noise is first characterized by
measuring the power-dependent single photon counts. In the waveguide, the SRS
generated photons are linearly proportional to the on-chip pump power $P_{in}$
while the SFWM generated photons are proportional to $P_{in}^{2}$. Thus, SRS
noise can be abstracted at Stokes and anti-Stokes channels by fitting the
curves as shown in figure 3 (b).

Figure 4 (a) shows the coincidence-to-accidental ratios (CAR) versus on-chip
pump power. The dark count has been subtracted from coincidence and accidental
counts to eliminate dark-count noise, which may significantly decrease CAR in
the low count rate regime. The highest CAR is achieved at 1632.6 ($\pm$ 260.4)
with average on-chip pump power of about -30.5 dBm. The corresponding photon
pair generation rate (PGR) is measured and estimated to be 1.94 MHz. The CAR
then drops to 1335.3 ($\pm$ 240.9) when further lowering on-chip pump power.
This occurs because the background noise contributes more to the result when
the count rates of Stokes and anti-Stokes photons are closer to the dark-count
level. Figure 4 (b) plots coincidence measurement at the highest measured CAR.
The coincidences are counted using the full width at half maximum (FWHM) of
the pulse which is depicted in the upper inset. The lower inset shows the
accidental counts and background noise. Figure 4(c) plots PGR at low on-chip
pump power regime. The error bars are within the dotted areas. The coincidence
rate is measured on the same run of CAR measurement. The PGR is then estimated
as $N_{1}N_{2}/N_{12}$, where $N_{1}$, $N_{2}$ and $N_{12}$ donates the
detection rate of signal, idler and two-photon coincidences.

Figure 4:  (a) CAR versus the on-chip pump power. (b) Coincidences measurement
at CAR of 1632.6 ($\pm$ 260.4). The upper inset shows the coincidences at zero
time delay. The lower inset shows the background noise and accidental at non-
zero time delays. (c) Photon pair generation rate (PGR) at low power regime.
(d) CAR for different wavelength channels. ((a) and (d) originally published
in MacFarlane et al. (2022))

Figure 4 (d) depicts CAR measurement for multi-channel photon-pairs. To
measure the CAR at different wavelength channels, instead of using DWDMs to
select the signals and idlers, the photon pairs are filtered using a
programmable waveshaper. The waveshaper introduces an additional 5 dB loss,
which increases the required pump power. With on-chip pump power at -20.5 dBm,
the CAR remains about 200 for the wavelength detuning from 4.2 nm to 10.2 nm.
This showcases a wide bandwidth for photon-pair generation that can be
dispersion engineered into these devices.

The heralded single-photon generation and the auto-correlation function
($g_{H}^{(2)}(\tau)$) are important for ensuring the purity of photon pair
source. As is shown in Figure 5 (a), to measure the heralded single-photon
generation, the idler is separated by a 50/50 splitter into two as idler I and
idler II. Then together with signal, they are all sent into SNSPD to measure
double coincidences between signal and Idler I ($N_{12}$), Idler II ($N_{13}$)
and triple coincidences $N_{123}$. The auto-correlation function of
$g_{H}^{(2)}(\tau)$ is then calculated by $N_{123}N_{1}/N_{12}N_{13}$, where
$N_{1}$ donates signal detection rate. Using the programmable time-tagging
unit, the coincidence rates at different time delays can be measured during
the same experimental run. This is enabled by duplicating the detected
physical photon channel to multiple virtual channels with different time
delays and thus all corresponding coincidences are measured at once. This
method largely simplifies the experiment and reduces noise and instabilities
induced by different experimental runs. Figure 5 (b) plots the auto-
correlation function with zero time delay, which is normalized to the averaged
$g^{(2)}_{H}(\tau)$ at other 20 ns-delays (corresponding to the 50 MHz
repetition rate of our MLL). The lowest $g^{(2)}_{H}(0)$ is measured to be
0.0126 $\pm$ 0.005 at an on-chip power of -22.5 dBm and $N_{1}$ of 18 kHz. It
increases to 0.1085 $\pm$ 0.0014 at on-chip power of -16.3 dBm and $N_{1}$ of
310 kHz. This $g_{H}^{(2)}(\tau)$ measurement indicates our heterogeneous chip
is a versatile single and paired photon sources for a variety of quantum
optical information technologies.

Figure 5:  (a) Experimental setup for heralded single-photon generation. (b)
normalized auto-correlation function with zero time delay $g^{(2)}_{H}(0)$ at
different on-chip pump powers

Table 1 shows the state of the art of photon pair generation through
$\chi^{(3)}$ process. Comparing with the previous result in a pure a-Si:H
platform, our device has exhibited 4 times higher CAR and 30 times higher PGR
due to much lower propagation/coupling loss through the waveguide. With the
CAR higher than 1000, our work features a high PGR of 1.94 MHz. This shows
that our device can massively produce high quality photon pairs. Leveraging
high the nonlinearity of a-Si:H waveguide, the photon pairs can be produced
efficiently through our non-resonant waveguide without the nonlinearity
enhancement by microring. This allows more freedom of wavelength selection and
avoid the instabilities of resonance shifting due to the thermo-optic effect
or nonlinear phase modulation from a strong pump. Our showcase this
heterogeneous a-Si:H/$Si_{3}N_{4}$ platform as an excellent and stable
platform for photon pair and single photon generation.

Table 1: The state of the art of photon pair generation through $\chi^{(3)}$ process Reference | Material | On-chip pump power | CAR | PGR | $g_{H}^{(2)}$
---|---|---|---|---|---
K. Wang(2014)Wang et al. (2014) | a-Si:H | 18 $\mu W$ | 399 | 65 kHz | …
This work | a-Si:H/$\mathrm{Si_{3}N_{4}}$ | 0.9 $\mu W$ | 1632.6 | 1.94 MHz | …
This work | a-Si:H/$\mathrm{Si_{3}N_{4}}$ | 5.6 $\mu$W | 373.3 | 3.29 MHz | 0.0126
W. Jiang(2015)Jiang et al. (2015) | c-Si disk | 79 $\mu W$ | 274 | 855 kHz | …
X. Lu(2016)Lu et al. (2016) | c-Si disk | 12$\mu W$ | 2610 | 1.2 kHz | 0.003
C. Ma(2017) Ma et al. (2017) | c-Si ring | 7.4 $\mu W$ | 12105 | 16 kHz | 0.005
C. Ma(2017) Ma et al. (2017) | c-Si ring | 59 $\mu W$ | 532 | 1.1 MHz | 0.005
X. Lu(2019) Lu et al. (2019) |  $\mathrm{Si_{3}N_{4}}$ ring | 46 $\mu W$ | 2280 | 4.8 kHz | …
T. Steiner(2021)Steiner et al. (2021) | AlGaAsOI ring | 3.4 $\mu W$ | 4389 | 230KHz | 0.004

##  3 Conclusion

In this paper, utilizing the high nonlinearity of a-Si:H for efficient photon
pair generation and low loss of $\mathrm{SiN_{x}}$ for the routing of photon
pairs, we have experimentally demonstrated photon-pair generation with a
record high CAR of 1632.6 ($\pm$ 260.4) for non-resonant a-Si:H waveguides,
which shows 4-times improvement compared to the previous single-layer a-Si:H
platform Wang et al. (2014). We also demonstrate multi-channel photon-pair
sources with a CAR of around 200 across 10-nm bandwidth. Additionally, we have
measured the heralded single-photon generation and demonstrated low
correlation function of $g_{H}^{(2)}(0)$ at 0.0125 $\pm$ 0.005. Our results
show that with the increased coupling efficiency and low propagation losses of
the $\mathrm{SiN_{x}}$ waveguide, higher photon detection rate can be observed
with much lower on-chip pump power. This enables us to achieve a high CAR and
high photon pair generation rate. The multi-material deposition and low-loss
interlayer couplers has enabled a way to combine different materials’ features
onto the single platform and flexibly transfer photons and optical signals
between different layers and materials with low transition loss. This solution
offers the possibility for the future PICs to integrate components from other
material platforms and further miniaturize the experimental setups used in
this work, for example $\chi^{2}$ nonlinearity and electro-optic modulation
from lithium niobate, laser source from III-V materials, and photodetectors
from germanium Chen et al. (2019); Wang et al. (2018); Jin et al. (2021);
Keyvaninia et al. (2013); Guo et al. (2019); Michel et al. (2010); Marris-
Morini et al. (2018).

##  4 Acknowledgement

This research was supported in part by National Science Foundation (#1641094).

## References

  * Bouwmeester et al. [1997] Dik Bouwmeester, Jian-Wei Pan, Klaus Mattle, Manfred Eibl, Harald Weinfurter, and Anton Zeilinger.  Experimental quantum teleportation.  _Nature_ , 390(6660):575–579, Dec 1997.  ISSN 1476-4687.  doi:10.1038/37539.  URL https://doi.org/10.1038/37539.
  * Chang et al. [2019] Lin Chang, Andreas Boes, Paolo Pintus, Jon D. Peters, MJ Kennedy, Xiao-Wen Guo, Nicolas Volet, Su-Peng Yu, Scott B. Papp, and John E. Bowers.  Strong frequency conversion in heterogeneously integrated gaas resonators.  _APL Photonics_ , 4(3):036103, 2019.  doi:10.1063/1.5065533.  URL https://doi.org/10.1063/1.5065533.
  * Chen et al. [2019] Jia-Yang Chen, Zhao-Hui Ma, Yong Meng Sua, Zhan Li, Chao Tang, and Yu-Ping Huang.  Ultra-efficient frequency conversion in quasi-phase-matched lithium niobate microrings.  _Optica_ , 6(9):1244–1245, Sep 2019.  doi:10.1364/OPTICA.6.001244.  URL http://opg.optica.org/optica/abstract.cfm?URI=optica-6-9-1244.
  * Davanco et al. [2017] Marcelo Davanco, Jin Liu, Luca Sapienza, Chen-Zhao Zhang, José Vinícius De Miranda Cardoso, Varun Verma, Richard Mirin, Sae Woo Nam, Liu Liu, and Kartik Srinivasan.  Heterogeneous integration for on-chip quantum photonic circuits with single quantum dot devices.  _Nature Communications_ , 8(1):889, Oct 2017.  ISSN 2041-1723.  doi:10.1038/s41467-017-00987-6.  URL https://doi.org/10.1038/s41467-017-00987-6.
  * Degen et al. [2017] C. L. Degen, F. Reinhard, and P. Cappellaro.  Quantum sensing.  _Rev. Mod. Phys._ , 89:035002, Jul 2017.  doi:10.1103/RevModPhys.89.035002.  URL https://link.aps.org/doi/10.1103/RevModPhys.89.035002.
  * Gisin et al. [2002] Nicolas Gisin, Grégoire Ribordy, Wolfgang Tittel, and Hugo Zbinden.  Quantum cryptography.  _Rev. Mod. Phys._ , 74:145–195, Mar 2002.  doi:10.1103/RevModPhys.74.145.  URL https://link.aps.org/doi/10.1103/RevModPhys.74.145.
  * Guo et al. [2019] Xuhan Guo, An He, and Yikai Su.  Recent advances of heterogeneously integrated III–v laser on si.  _Journal of Semiconductors_ , 40(10):101304, oct 2019.  doi:10.1088/1674-4926/40/10/101304.  URL https://doi.org/10.1088/1674-4926/40/10/101304.
  * Hemsley et al. [2016] Elizabeth Hemsley, Damien Bonneau, Jason Pelc, Ray Beausoleil, Jeremy L. O’Brien, and Mark G. Thompson.  Photon pair generation in hydrogenated amorphous silicon microring resonators.  _Scientific Reports_ , 6(1):38908, Dec 2016.  ISSN 2045-2322.  doi:10.1038/srep38908.  URL https://doi.org/10.1038/srep38908.
  * Jiang et al. [2015] Wei C. Jiang, Xiyuan Lu, Jidong Zhang, Oskar Painter, and Qiang Lin.  Silicon-chip source of bright photon pairs.  _Opt. Express_ , 23(16):20884–20904, Aug 2015\.  doi:10.1364/OE.23.020884.  URL http://opg.optica.org/oe/abstract.cfm?URI=oe-23-16-20884.
  * Jin et al. [2021] Mingwei Jin, Jiayang Chen, Yongmeng Sua, Prajnesh Kumar, and Yuping Huang.  Efficient electro-optical modulation on thin-film lithium niobate.  _Opt. Lett._ , 46(8):1884–1887, Apr 2021.  doi:10.1364/OL.419597.  URL http://opg.optica.org/ol/abstract.cfm?URI=ol-46-8-1884.
  * Keyvaninia et al. [2013] Shahram Keyvaninia, Gunther Roelkens, Dries Van Thourhout, Christophe Jany, Marco Lamponi, Alban Le Liepvre, Francois Lelarge, Dalila Make, Guang-Hua Duan, Damien Bordel, and Jean-Marc Fedeli.  Demonstration of a heterogeneously integrated iii-v/soi single wavelength tunable laser.  _Opt. Express_ , 21(3):3784–3792, Feb 2013.  doi:10.1364/OE.21.003784.  URL http://opg.optica.org/oe/abstract.cfm?URI=oe-21-3-3784.
  * Kimble [2008] H. J. Kimble.  The quantum internet.  _Nature_ , 453(7198):1023–1030, Jun 2008.  ISSN 1476-4687.  doi:10.1038/nature07127.  URL https://doi.org/10.1038/nature07127.
  * Kues et al. [2017] Michael Kues, Christian Reimer, Piotr Roztocki, Luis Romero Cortés, Stefania Sciara, Benjamin Wetzel, Yanbing Zhang, Alfonso Cino, Sai T. Chu, Brent E. Little, David J. Moss, Lucia Caspani, José Azaña, and Roberto Morandotti.  On-chip generation of high-dimensional entangled quantum states and their coherent control.  _Nature_ , 546(7660):622–626, Jun 2017.  ISSN 1476-4687.  doi:10.1038/nature22986.  URL https://doi.org/10.1038/nature22986.
  * Lavoie et al. [2013] J. Lavoie, J. M. Donohue, L. G. Wright, A. Fedrizzi, and K. J. Resch.  Spectral compression of single photons.  _Nature Photonics_ , 7(5):363–366, May 2013.  ISSN 1749-4893.  doi:10.1038/nphoton.2013.47.  URL https://doi.org/10.1038/nphoton.2013.47.
  * Logan et al. [2018] Alan D. Logan, Michael Gould, Emma R. Schmidgall, Karine Hestroffer, Zin Lin, Weiliang Jin, Arka Majumdar, Fariba Hatami, Alejandro W. Rodriguez, and Kai-Mei C. Fu.  400%/w second harmonic conversion efficiency in 14 μm-diameter gallium phosphide-on-oxide resonators.  _Opt. Express_ , 26(26):33687–33699, Dec 2018\.  doi:10.1364/OE.26.033687.  URL http://www.osapublishing.org/oe/abstract.cfm?URI=oe-26-26-33687.
  * Lu et al. [2016] Xiyuan Lu, Steven Rogers, Thomas Gerrits, Wei C. Jiang, Sae Woo Nam, and Qiang Lin.  Heralding single photons from a high-q silicon microdisk.  _Optica_ , 3(12):1331–1338, Dec 2016.  doi:10.1364/OPTICA.3.001331.  URL http://www.osapublishing.org/optica/abstract.cfm?URI=optica-3-12-1331.
  * Lu et al. [2019] Xiyuan Lu, Gregory Moille, Anshuman Singh, Qing Li, Daron A. Westly, Ashutosh Rao, Su-Peng Yu, Travis C. Briles, Scott B. Papp, and Kartik Srinivasan.  Milliwatt-threshold visible–telecom optical parametric oscillation using silicon nanophotonics.  _Optica_ , 6(12):1535–1541, Dec 2019.  doi:10.1364/OPTICA.6.001535.  URL http://opg.optica.org/optica/abstract.cfm?URI=optica-6-12-1535.
  * Ma et al. [2017] Chaoxuan Ma, Xiaoxi Wang, Vikas Anant, Andrew D. Beyer, Matthew D. Shaw, and Shayan Mookherjea.  Silicon photonic entangled photon-pair and heralded single photon generation with car > 12,000 and g(2)(0) < 0.006.  _Opt. Express_ , 25(26):32995–33006, Dec 2017\.  doi:10.1364/OE.25.032995.  URL http://opg.optica.org/oe/abstract.cfm?URI=oe-25-26-32995.
  * Ma et al. [2020] Zhaohui Ma, Jia-Yang Chen, Zhan Li, Chao Tang, Yong Meng Sua, Heng Fan, and Yu-Ping Huang.  Ultrabright quantum photon sources on chip.  _Phys. Rev. Lett._ , 125:263602, Dec 2020.  doi:10.1103/PhysRevLett.125.263602.  URL https://link.aps.org/doi/10.1103/PhysRevLett.125.263602.
  * MacFarlane et al. [2019] Neil MacFarlane, Michael R. Kossey, Jasper R. Stroud, Mark A. Foster, and Amy C. Foster.  A multi-layer platform for low-loss nonlinear silicon photonics.  _APL Photonics_ , 4(11):110809, 2019.  doi:10.1063/1.5115234.  URL https://doi.org/10.1063/1.5115234.
  * MacFarlane et al. [2022] Neil MacFarlane, Mingwei Jin, Zhaohui Ma, Sua Yongmeng, Mark A. Foster, Amy C. Foster, and Yuping Huang.  Photon-pair generation in a heterogeneous silicon photonic chip.  In _2022 Conference on Lasers and Electro-Optics (CLEO)_ , pages 1–2, 2022.
  * Marris-Morini et al. [2018] Delphine Marris-Morini, Vladyslav Vakarin, Joan Manel Ramirez, Qiankun Liu, Andrea Ballabio, Jacopo Frigerio, Miguel Montesinos, Carlos Alonso-Ramos, Xavier Le Roux, Samuel Serna, Daniel Benedikovic, Daniel Chrastina, Laurent Vivien, and Giovanni Isella.  Germanium-based integrated photonics from near- to mid-infrared applications.  _Nanophotonics_ , 7(11):1781–1793, 2018.  doi:doi:10.1515/nanoph-2018-0113.  URL https://doi.org/10.1515/nanoph-2018-0113.
  * Michel et al. [2010] Jurgen Michel, Jifeng Liu, and Lionel C. Kimerling.  High-performance ge-on-si photodetectors.  _Nature Photonics_ , 4(8):527–534, Aug 2010.  ISSN 1749-4893.  doi:10.1038/nphoton.2010.157.  URL https://doi.org/10.1038/nphoton.2010.157.
  * Moody et al. [2022] Galan Moody, Volker J Sorger, Daniel J Blumenthal, Paul W Juodawlkis, William Loh, Cheryl Sorace-Agaskar, Alex E Jones, Krishna C Balram, Jonathan C F Matthews, Anthony Laing, Marcelo Davanco, Lin Chang, John E Bowers, Niels Quack, Christophe Galland, Igor Aharonovich, Martin A Wolff, Carsten Schuck, Neil Sinclair, Marko Lončar, Tin Komljenovic, David Weld, Shayan Mookherjea, Sonia Buckley, Marina Radulaski, Stephan Reitzenstein, Benjamin Pingault, Bartholomeus Machielse, Debsuvra Mukhopadhyay, Alexey Akimov, Aleksei Zheltikov, Girish S Agarwal, Kartik Srinivasan, Juanjuan Lu, Hong X Tang, Wentao Jiang, Timothy P McKenna, Amir H Safavi-Naeini, Stephan Steinhauer, Ali W Elshaari, Val Zwiller, Paul S Davids, Nicholas Martinez, Michael Gehl, John Chiaverini, Karan K Mehta, Jacquiline Romero, Navin B Lingaraju, Andrew M Weiner, Daniel Peace, Robert Cernansky, Mirko Lobino, Eleni Diamanti, Luis Trigo Vidarte, and Ryan M Camacho.  2022 roadmap on integrated quantum photonics.  _Journal of Physics: Photonics_ , 4(1):012501, jan 2022.  doi:10.1088/2515-7647/ac1ef4.  URL https://doi.org/10.1088/2515-7647/ac1ef4.
  * O’Brien [2007] Jeremy L. O’Brien.  Optical quantum computing.  _Science_ , 318(5856):1567–1570, 2007.  doi:10.1126/science.1142892.  URL https://www.science.org/doi/abs/10.1126/science.1142892.
  * O’Brien et al. [2009] Jeremy L. O’Brien, Akira Furusawa, and Jelena Vučković.  Photonic quantum technologies.  _Nature Photonics_ , 3(12):687–695, Dec 2009\.  ISSN 1749-4893.  doi:10.1038/nphoton.2009.229.  URL https://doi.org/10.1038/nphoton.2009.229.
  * Oo et al. [2019] Swe Z. Oo, Antulio Tarazona, Ali Z. Khokhar, Rafidah Petra, Yohann Franz, Goran Z. Mashanovich, Graham T. Reed, Anna C. Peacock, and Harold M. H. Chong.  Hot-wire chemical vapor deposition low-loss hydrogenated amorphous silicon waveguides for silicon photonic devices.  _Photon. Res._ , 7(2):193–200, Feb 2019.  doi:10.1364/PRJ.7.000193.  URL http://www.osapublishing.org/prj/abstract.cfm?URI=prj-7-2-193.
  * Schnauber et al. [2019] Peter Schnauber, Anshuman Singh, Johannes Schall, Suk In Park, Jin Dong Song, Sven Rodt, Kartik Srinivasan, Stephan Reitzenstein, and Marcelo Davanco.  Indistinguishable photons from deterministically integrated single quantum dots in heterogeneous gaas/si3n4 quantum photonic circuits.  _Nano Letters_ , 19(10):7164–7172, Oct 2019.  ISSN 1530-6984.  doi:10.1021/acs.nanolett.9b02758.  URL https://doi.org/10.1021/acs.nanolett.9b02758.
  * Sinclair et al. [2014] Neil Sinclair, Erhan Saglamyurek, Hassan Mallahzadeh, Joshua A. Slater, Mathew George, Raimund Ricken, Morgan P. Hedges, Daniel Oblak, Christoph Simon, Wolfgang Sohler, and Wolfgang Tittel.  Spectral multiplexing for scalable quantum photonics using an atomic frequency comb quantum memory and feed-forward control.  _Phys. Rev. Lett._ , 113:053603, Jul 2014.  doi:10.1103/PhysRevLett.113.053603.  URL https://link.aps.org/doi/10.1103/PhysRevLett.113.053603.
  * Steiner et al. [2021] Trevor J. Steiner, Joshua E. Castro, Lin Chang, Quynh Dang, Weiqiang Xie, Justin Norman, John E. Bowers, and Galan Moody.  Ultrabright entangled-photon-pair generation from an $\mathrm{Al}\mathrm{Ga}\mathrm{As}$-on-insulator microring resonator.  _PRX Quantum_ , 2:010337, Mar 2021.  doi:10.1103/PRXQuantum.2.010337.  URL https://link.aps.org/doi/10.1103/PRXQuantum.2.010337.
  * Wang et al. [2018] Cheng Wang, Mian Zhang, Xi Chen, Maxime Bertrand, Amirhassan Shams-Ansari, Sethumadhavan Chandrasekhar, Peter Winzer, and Marko Lončar.  Integrated lithium niobate electro-optic modulators operating at cmos-compatible voltages.  _Nature_ , 562(7725):101–104, Oct 2018.  ISSN 1476-4687.  doi:10.1038/s41586-018-0551-y.  URL https://doi.org/10.1038/s41586-018-0551-y.
  * Wang and Foster [2012] Ke-Yao Wang and Amy C. Foster.  Ultralow power continuous-wave frequency conversion in hydrogenated amorphous silicon waveguides.  _Opt. Lett._ , 37(8):1331–1333, Apr 2012.  doi:10.1364/OL.37.001331.  URL http://www.osapublishing.org/ol/abstract.cfm?URI=ol-37-8-1331.
  * Wang et al. [2014] Ke-Yao Wang, Vesselin G. Velev, Kim Fook Lee, Abijith S. Kowligy, Prem Kumar, Mark A. Foster, Amy C. Foster, and Yu-Ping Huang.  Multichannel photon-pair generation using hydrogenated amorphous silicon waveguides.  _Opt. Lett._ , 39(4):914–917, Feb 2014.  doi:10.1364/OL.39.000914.  URL http://www.osapublishing.org/ol/abstract.cfm?URI=ol-39-4-914.
  * Zhang et al. [2016] Xiang Zhang, Yanbing Zhang, Chunle Xiong, and Benjamin J Eggleton.  Correlated photon pair generation in low-loss double-stripe silicon nitride waveguides.  _Journal of Optics_ , 18(7):074016, jun 2016.  doi:10.1088/2040-8978/18/7/074016.  URL https://doi.org/10.1088/2040-8978/18/7/074016.


11institutetext:  11email<EMAIL_ADDRESS><EMAIL_ADDRESS>
University of Houston, Houston, TX, USA

# FMViz: Visualizing Tests Generated by AFL at the Byte-level

Aftab Hussain  Mohammad Amin Alipour

###### Abstract

Software fuzzing is a strong testing technique that has become the de facto
approach for automated software testing and software vulnerability detection
in the industry. The random nature of fuzzing makes monitoring and
understanding the behavior of fuzzers difficult. In this paper, we report the
development of Fuzzer Mutation Visualizer (FMViz), a tool that focuses on
visualizing byte-level mutations in fuzzers. In particular, FMViz extends
American Fuzzy Lop (AFL) to visualize the generated test inputs and highlight
changes between consecutively generated seeds as a fuzzing campaign
progresses. The overarching goal of our tool is to help developers and
students comprehend the inner-workings of the AFL fuzzer better. In this
paper, we present the architecture of FMViz, discuss a sample case study of
it, and outline the future work. FMViz is open-source and publicly available
at https://github.com/AftabHussain/afl-test-viz.

###### Keywords:

Software Visualization Fuzzing test input mutation.

##  1 Introduction

Fuzzing has become a widely popular tool for testing programs in the software
industry. The overall simplicity of the design of coverage-guided fuzzers
(e.g., AFL [21]) – generating test inputs by mutating other test inputs in a
pseudo-random fashion while optimizing for code coverage in the test subject,
and executing them on test subjects at scale – has been very effective in
finding bugs and vulnerabilities in software systems. Large companies have
integrated fuzzers in their testing ecosystem; for instance, Google is
continuously running fuzzers on its Chrome browser to find vulnerabilities.

There has been significant research in building efficient fuzzers that can
generate interesting test inputs faster in a fuzzing campaign: e.g., grammar-
based fuzzing [17, 10], data-flow techniques [16, 15], stochastic scheduling
methods [14], smarter test selection methods [12], etc. Nevertheless, there is
one theme that all fuzzers have in common, albeit in varying degrees:
randomness, which contributes to the “black-box” nature of their operation.

This randomness of fuzzers poses a challenge for developers to understand and
interpret what operations are being carried out on which test inputs, and
reason about the behavior of the fuzzers. While fuzzers, like AFL, do offer
high-level statistics on what operations are being performed, the information
is shown in a hard-to-follow111The stats are real-time and constantly-
changing. descriptive manner. They also store data for coverage-increasing
test inputs only, and provide no support for understanding how the other tests
were generated (which may contain useful information). In addition, the real-
time statistics do not portray which test inputs are being changed (i.e.
mutated). Furthermore, the initial choice of test inputs in a fuzzing campaign
can considerably influence its progress [12]. We thus believe it is necessary
to have an approach for understanding how the test inputs are being mutated
and address the problem from a visualization angle.

The importance of software visualization (SV) cannot be over-emphasized. The
superiority of visual memory in cognition is discussed in Diehl’s seminal work
[7] where it was mentioned that 75% of all information from the real world is
visually perceived, 13% through auditory senses, and the rest is perceived
through other senses. Despite its value, SV has a huge potential to be
realized in software engineering [6] and, to the best of our knowledge, even
more so in fuzzing (we discuss a few existing research we found in Section 2).
Towards the idea of bringing better visualization in fuzzing, we build a
visualization approach for the integral component of almost all state-of-the-
art fuzzers: mutation. Our tool, FMViz, helps us see which bytes of a test
input undergo mutations during an AFL fuzzing campaign, and thereby makes
mutation patterns in fuzzing more perceivable. The tool is light-weight and
easy to extend to other fuzzers. We believe this work is a stepping stone in
the direction of inspecting the behavior of mutational fuzzers on various test
inputs, at a deeper-level.

Contributions. The main contributions of this paper are as follows:

  * •

We provide a light-weight approach to visualize fuzzing mutation behavior in
AFL by visualizing test inputs generated during fuzzing and highlighting the
changes.

  * •

We instantiate the approach in FMViz by capturing and displaying mutation
locations in test inputs that undergo mutation in the fuzzing process –
observing series of FMViz output images help in seeing various mutation
patterns that take place during fuzzing.

  * •

We present a short demonstration of FMViz with an AFL fuzzing process on
libxml2, where we present some mutation patterns captured by the tool.

Paper Organization. In Section 2, we present some related literature. In
Section 3, we provide details of the architecture of FMViz. In Section 4, we
illustrate the results of a demo of FMViz in fuzzing libxml2. We conclude our
paper in Section 5, providing future directions.

##  2 Related Work

Information visualization has been widely used in different realms of software
engineering including bug analysis [20], evolution [9], refactoring [13, 3] –
it makes it easier for developers to understand, analyze, and deploy various
software engineering tasks. There are a few works that have adopted
visualization techniques in the fuzzing domain. For example, VisFuzz [22], an
LLVM plugin that works on top of a modified version of AFL, is an interactive
real-time visualization tool that visualizes constraints in the fuzz subject
by extracting a call graph and a control flow graph from the subject code.
FuzzSplore [8] provides statistical visualizations such as a coverage plot,
which shows the number of edges that are covered over time by test inputs, and
a plot that shows the number of interesting test inputs generated over the
campaign. Vainio [18] provides a fuzzing visualization framework that adopts
information visualization techniques (e.g. circle packing) to view fuzzing
performance data such as CPU and memory usage statistics and power
consumption. In [5], the coverage of a test subject’s call graph is visualized
when fuzzed by Hongfuzz [11] and AFL. Unlike our tool, FMViz, none of these
works delve into visualizing mutations in fuzzers; FMViz generates visuals of
how the mutations are occurring on the test inputs at the byte-level.

##  3 Tool Architecture

In this section, we provide an overview of the architecture of FMViz. We also
present information on its usage and performance. The implementation and
documentation of FMViz is available in
Github222https://github.com/AftabHussain/afl-test-viz.

Figure 1 depicts the architecture of FMViz and its main components, which are:
Test Input Color Representation Generator and Test Input Image Generator.

Figure 1: Overview of FMViz. Figure 2: Cropped sample image of a test input.

Figure 2 shows a sample visualization output of FMViz of a test input.

###  3.1 Extracting Color Representations of Test Inputs

FMViz extends AFL to capture the byte stream representations of new test
inputs that are generated as AFL mutates original seeds (Figure 3(a)). FMViz
saves these representations in a single file (a dump file in hexadecimal).
Each byte’s hex code is chosen to represent a shade of red, depending on the
value stored in the byte (we elaborate on the color representation in the
following subsection). Each line of this file corresponds to the
representation of a single test input.

###  3.2 Test Input Image Generator

This piece of our tool (Fig. 3(b)), written in Python, reads the file
generated by the color representation generator, line by line, and generates
PNG image files (where each line corresponds to a test input as mentioned
previously). In the image output, each box represents a byte of a test input.
For obtaining the box colors we use the six-digit hex triplet, a three-byte
hexadecimal number, which is typically used for various computing
applications, e.g. HTML, SVG, etc., to generate colors. Each of these three
bytes show the red, green, and blue components of the color respectively [19].
The box color representation for each byte of the test input is evaluated as
follows: byte $xy$ is translated to the hex color code $xy0000$, where $xy$ is
a hex representation of a test input byte, where $x$ and $y$ each belong to
the set of 16 hexadecimal symbols ($0-9$, $A-F$). The box dimensions can be
changed to vary the number of test input bytes to display in the image. The
PNG files can be used independently to represent individual test inputs, or
can be used to generate a time-lapse video of the evolution of the test inputs
using a linear image interpolator [2], or a screen recorder [4].

Figure 3: Workflow of the FMViz Tool. (a) Test Input Color Representation
Generation. (b) Test Input Image Generation

###  3.3 Usage and Performance Considerations

The present implementation is adapted for an AFL fuzzing campaign with a
single test input. Although the overhead of writing to the color dump file is
minimal during the fuzzing campaign, since a single file is used, the file can
get very large over long fuzzing periods. We are considering to extend FMViz
to optimize the storage use through using a more compressed representation of
the test inputs.

##  4 Demonstration: Fuzzing libxml2

In this section, we present a short demo of FMViz. The purpose of this demo is
to show how the mutation locations in a test input are visually captured.

Figure 4: Three observed visual patterns of how an XML test input is mutated
during fuzzing libxml2 with AFL. (a) 2-byte, shifting mutations (test inputs
7575 to 7581), (b) 4-byte, shifting mutations (test inputs 7851 to 7857), (c)
single-byte fixed mutations (test inputs 9358 to 9364) – yellow arrow added
for illustrating changing byte.

###  4.1 Steps Performed

We applied FMViz’s representation generator on top of AFL to fuzz the XML C
parser library, libxml2333We used the version,
https://github.com/GNOME/libxml2.git – commit id. 1fbcf40[1] for $10$ seconds.
This step produced $9,606$ test inputs and a dump file containing color
representations of each of those test inputs. Next, we used FMViz’s image
generator to parse the dump file and generate images for each test. The image
generation process took slightly over five minutes for all tests. Then viewing
a series of consecutive test input color matrix images (in PNG format), using
the default system image viewer, revealed patterns (we also produced a time-
lapse video from the sequence of images and saved them in a video file, which
is available in the repository.). For this experiment, we used a computer
system with Intel(R) 1.90GHz Xeon(R) CPU and 64 GB RAM with Ubuntu 18.04.5
LTS.

###  4.2 Mutation Patterns Observed

Figure 4 depicts the mutation patterns that we observed. For visualizing each
pattern, seven consecutively generated tests are shown.

2-byte, shifting mutation pattern (Figure 4(a)). Here, in every mutation
iteration, the fuzzer mutates a pair of bytes of the test input. This pair-
mutation operation progresses by shifting by one byte in the next iteration.

4-byte, shifting mutation pattern (Figure 4(b)). Here, in every mutation
iteration, the fuzzer mutates a set of four bytes of the test input. The
4-byte-mutation operation progresses by shifting by one byte in the next
iteration.

Single-byte, fixed mutation pattern (Figure 4(c)). Here, in every mutation
iteration, the fuzzer mutates the same byte. The changing byte in the figure
is shown with the yellow arrow.

##  5 Conclusion and Future Work

In this work, building on the motivation of software visualization, we
presented an easy-to-extend, light-weight visualization tool, FMViz, that
helps us better perceive the mutation process in the AFL fuzzer. In
particular, we visualize bytes of a test input that undergo mutation during
fuzzing. FMViz encodes bytes of test inputs as colors and mutations are
captured by changes in the colors. In the next steps, we plan to augment the
visual representation of test inputs by other information such as coverage. We
also plan to explore more efficient ways to store representations of test
inputs. Furthermore, we plan to evaluate the usefulness of FMViz and similar
visualization tools in teaching software testing to undergraduate students.

## References

  * [1] libxml2, http://xmlsoft.org/, visited on 2021-12-25
  * [2] timelapse, https://sites.google.com/site/timelapsepy/home, visited on 2021-12-25
  * [3] Alkhalid, A., Alshayeb, M., Mahmoud, S.: Software refactoring at the function level using new adaptive k-nearest neighbor algorithm. Adv. Eng. Softw. 41(10–11), 1160–1178 (2010)
  * [4] Baert, M.: Simplescreenrecorder, https://www.maartenbaert.be/simplescreenrecorder/, visited on 2021-12-25
  * [5] Böhme, M.: Visualizing fuzzer progress, https://mboehme.github.io/img/freetype2_dot.gif, visited on 2021-12-25
  * [6] Diehl, S.: Past, present, and future in and of software visualization. In: The International Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications. pp. 3–11 (2015)
  * [7] Diehl, S.: Past, present, and future of and in software visualization. In: Battiato, S., Coquillart, S., Pettré, J., Laramee, R.S., Kerren, A., Braz, J. (eds.) Computer Vision, Imaging and Computer Graphics - Theory and Applications. pp. 3–11. Cham (2015)
  * [8] Fioraldi, A., Pileggi, L.P.: Fuzzsplore: Visualizing feedback-driven fuzzing techniques. arXiv preprint arXiv:2102.02527 (2021)
  * [9] Gall, H.C., Lanza, M.: Software evolution: Analysis and visualization. In: Proceedings of the 28th International Conference on Software Engineering. p. 1055–1056. ICSE ’06 (2006)
  * [10] Godefroid, P., Kiezun, A., Levin, M.Y.: Grammar-based whitebox fuzzing. SIGPLAN Not. 43(6), 206–215 (2008)
  * [11] Google: Honggfuzz, https://github.com/google/honggfuzz, visited on 2021-12-25
  * [12] Herrera, A., Gunadi, H., Magrath, S., Norrish, M., Payer, M., Hosking, A.L.: Seed selection for successful fuzzing. In: Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis. p. 230–243. ISSTA 2021 (2021)
  * [13] Hussain, A., Rahman, M.S.: A new hierarchical clustering technique for restructuring software at the function level. In: Proceedings of the 6th India Software Engineering Conference. p. 45–54. ISEC ’13 (2013)
  * [14] Lyu, C., Ji, S., Zhang, C., Li, Y., Lee, W.H., Song, Y., Beyah, R.: MOPT: Optimized mutation scheduling for fuzzers. In: 28th USENIX Security Symposium (USENIX Security 19). pp. 1949–1966 (2019)
  * [15] Mathis, B., Gopinath, R., Mera, M., Kampmann, A., Höschele, M., Zeller, A.: Parser-directed fuzzing. PLDI 2019 (2019)
  * [16] Mathis, B., Gopinath, R., Zeller, A.: Learning input tokens for effective fuzzing. In: Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis. p. 27–37. ISSTA 2020 (2020)
  * [17] Srivastava, P., Payer, M.: Gramatron: Effective grammar-aware fuzzing. In: Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis. p. 244–256. ISSTA 2021 (2021)
  * [18] Vainio, J.: The use of data visualization in fuzz test monitoring. Master’s thesis, University of Oulu (2014)
  * [19] Wikipedia: Hex triplet, https://en.wikipedia.org/wiki/Web_colors#Hex_triplet
  * [20] Yeasmin, S., Roy, C.K., Schneider, K.A.: Interactive visualization of bug reports using topic evolution and extractive summaries. In: 2014 IEEE International Conference on Software Maintenance and Evolution. pp. 421–425 (2014)
  * [21] Zalewski, M.: American fuzzy lop (2017), http://lcamtuf.coredump.cx/afl, visited on 2021-12-25
  * [22] Zhou, C., Wang, M., Liang, J., Liu, Z., Sun, C., Jiang, Y.: Visfuzz: Understanding and intervening fuzzing with interactive visualization. 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE) pp. 1078–1081 (2019)

## A. Using FMViz

In this section, we describe the steps to run the first release of FMViz,
version 1.0. We use libxml2 as our fuzzing test subject. All commands provided
next are for the Linux environment.

### Setting up the Environment

1\. FMViz Setup

In any directory, we clone the FMViz repository as follows444Currently, the
name of the repository has been purposely kept different from FMViz.:

git clone --recursive git@github.com:AftabHussain/afl-test-viz.git

Then we build and install the AFL fuzzer, patched with FMViz’s Test Input
Color Representation Generator component, by performing the following command:

cd afl-test-viz/code/AFL-mut-viz/AFL && make -j32 && make install

2\. libxml2 Setup

Once we have setup the fuzzer, we build the test subject (libxml2) with AFL’s
compiler (afl-gcc), which prepares libxml2 binaries as fuzzing targets. We
first obtain libxml2 as follows in a folder outside afl-test-viz directory:

git clone https://github.com/GNOME/libxml2.git && cd libxml2 && git checkout
1fbcf40

Finally, we configure and build libxml2 by performing the following command:

cd libxml2 && export CC=afl-gcc && ./autogen.sh && make -j32

### Generating Color Representations of Test Inputs

We now invoke the first part of FMViz, the augmented AFL fuzzer, which
produces color representations (in hex) of test inputs generated while fuzzing
the test subject. In this demo, we fuzz the libxml2 binary, xmllint. We thus
enter the libxml2 folder, create an input folder (input), and place in it any
XML file as a test input (some sample inputs are available in the FMViz
repository):

cd libxml2 && mkdir input && cp [path_to_xml_file] input/

Thereafter, we invoke the fuzzer as follows:

export AFL_SKIP_CPUFREQ=1 && export LD_LIBRARY_PATH=./.libs/ &&
afl-fuzz -i input/ -o output/ -- ./.libs/xmllint -o /dev/null @@

The fuzzing process can be terminated anytime using Ctrl+C – on termination
all results are saved in the output folder, output. Inside this folder, the
color dump file tests_generated contains color representations of all the
tests created by the fuzzer.

### Generating Images from Color Representations of Test Inputs

To generate test input images, we process the color dump file obtained in the
previous phase. We place this file along with the Image Generation program
(viz_tests.py) in a separate directory:

mkdir process_color_rep

cp libxml2/output/tests_generated process_color_rep/

cp afl-test-viz/code/viz_tests.py process_color_rep/

Finally we invoke the script:

cd process_color_rep/ && python viz_tests.py

The above command generates PNG images for all tests, that are represented in
the color dump file, in process_color_rep directory:

ls | xargs -n 1

    .
    .
    .
    file_000005564.png
    file_000005565.png
    file_000005566.png
    file_000005567.png
    file_000005568.png
    file_000005569.png
    file_000005570.png
    file_000005571.png
    file_000005572.png
    .
    .

Figure 5: Screenshot of a test input image on Image Viewer

A sample screenshot of a test input image, opened with Image Viewer, a default
image viewer in Ubuntu, is shown in Figure 5. Since the image files for the
input tests are named in the order in which they were produced during fuzzing,
toggling over consecutive images in the image viewer application shows the
trends in mutations. In order to produce a time-lapse video, we use Simple
Screen Recorder [4], which once installed can be invoked by the command
simplescreenrecorder on the terminal. Then by starting recording and toggling
over multiple images on Image Viewer by holding the left/right arrow key, we
are able to record the mutation transitions that take place.