OS Kernel fuzzers such as Syzkaller often struggle to generate syscall sequences that respect intrinsic Syscall Dependency Relations (SDRs), resulting in seeds that either violate kernel constraints or fail to reach deep execution paths. We propose leveraging an N-gram model to learn SDRs from both kernel execution history and ongoing fuzzing results. This enables the fuzzer to capture dependencies in similar kernel versions while adapting to target-specific behaviors, thereby improving the validity of generated seeds. Additionally, we introduce a bidirectional Random Walk strategy to enhance the diversity of generated seeds. We implement this approach in a prototype, Psyzkaller, on top of Syzkaller. Experiments show that, trained with the large-scale DongTing dataset and continuously updated with ongoing fuzzing results, Psyzkaller improves Syzkaller's code coverage by 4.6%-7.0%, triggers 110.4%-187.2% more crashes, and discovers eight previously unknown kernel vulnerabilities. Furthermore, Psyzkaller outperforms state-of-the-art fuzzers such as ACTOR and SyzDescribe in both coverage and crashes.

翻译：操作系统内核模糊测试工具（如Syzkaller）在生成遵循系统调用依赖关系（Syscall Dependency Relations，SDRs）的系统调用序列时常面临困难，导致生成的种子要么违反内核约束，要么无法触及深层执行路径。我们提出利用N-gram模型从内核执行历史与实时模糊测试结果中学习SDRs，使模糊测试工具既能捕捉相似内核版本中的依赖关系，又能适应目标系统的特定行为，从而提高生成种子的有效性。此外，我们引入双向随机游走策略以增强生成种子的多样性。我们在Syzkaller基础上实现了原型系统Psyzkaller。实验表明，通过大规模DongTing数据集训练并持续利用实时模糊测试结果更新，Psyzkaller将Syzkaller的代码覆盖率提升4.6%-7.0%，触发崩溃数量增加110.4%-187.2%，并发现了8个此前未知的内核漏洞。此外，Psyzkaller在覆盖率和崩溃数量两方面均优于ACTOR、SyzDescribe等当前最先进的模糊测试工具。