Fuzzing:Progress,Challenges,and Perspectives  

作　　者：Zhenhua Yu Zhengqi Liu Xuya Cong Xiaobo Li Li Yin 

机构地区：[1]Institute of Systems Security and Control,College of Computer Science and Technology,Xi'an University of Science and Technology,Xi'an,710054,China [2]School of Mathematics and Information Science,Baoji University of Arts and Sciences,Baoji,721013,China [3]Institute of Systems Engineering,Macao University of Science and Technology,Taipa,Macao,China

出　　处：《Computers, Materials & Continua》2024年第1期1-29,共29页计算机、材料和连续体（英文）

基　　金：supported in part by the National Natural Science Foundation of China under Grants 62273272,62303375,and 61873277;in part by the Key Research and Development Program of Shaanxi Province under Grant 2023-YBGY-243;in part by the Natural Science Foundation of Shaanxi Province under Grant 2020JQ-758;in part by the Youth Innovation Team of Shaanxi Universities,and in part by the Special Fund for Scientific and Technological Innovation Strategy of Guangdong Province under Grant 2022A0505030025.

摘　　要：As one of the most effective techniques for finding software vulnerabilities,fuzzing has become a hot topic in software security.It feeds potentially syntactically or semantically malformed test data to a target program to mine vulnerabilities and crash the system.In recent years,considerable efforts have been dedicated by researchers and practitioners towards improving fuzzing,so there aremore and more methods and forms,whichmake it difficult to have a comprehensive understanding of the technique.This paper conducts a thorough survey of fuzzing,focusing on its general process,classification,common application scenarios,and some state-of-the-art techniques that have been introduced to improve its performance.Finally,this paper puts forward key research challenges and proposes possible future research directions that may provide new insights for researchers.

关 键 词：FUZZING VULNERABILITY software testing software security 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]