When to Stop Fuzzing

Let’s say residual risk is the probability that the next test input reveals a vulnerability that has not been found, yet. Here is a proof sketch that shows that an estimator of discovery probability for an arbitrary definition of species gives an upper bound on the probability to discover a vulnerability when none has been found: Suppose, for each “old” species A (here, execution trace), we derive two “new” species: Some inputs belonging to A expose a vulnerability while others belonging to A do not. Hence, the probability to discover a new species gives an upper bound on the probability to discover (a species that exposes) a vulnerability.

Source: www.fuzzingbook.org