{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,20]],"date-time":"2026-10-20T16:48:35Z","timestamp":1792514915034,"version":"4.5.0"},"reference-count":189,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2023,10,5]],"date-time":"2023-10-05T00:00:00Z","timestamp":1696464000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Science and Technology Council of the Republic of China","award":["111-2628-E-A49-007-MY2 and 112-2634-F-A49-001-MBK"],"award-info":[{"award-number":["111-2628-E-A49-007-MY2 and 112-2634-F-A49-001-MBK"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2024,3,31]]},"abstract":"<jats:p>Massive software applications possess complex data structures or parse complex data structures; in such cases, vulnerabilities in the software become inevitable. The vulnerabilities are the source of cyber-security threats, and discovering this before the software deployment is challenging. Fuzzing is a vulnerability discovery solution that resonates with random-mutation, feedback-driven, coverage-guided, constraint-guided, seed-scheduling, and target-oriented strategies. Each technique is wrapped beneath the black-, white-, and grey-box fuzzers to uncover diverse vulnerabilities. It consists of methods such as identifying structural information about the test cases to detect security vulnerabilities, symbolic and concrete program states to explore the unexplored locations, and full semantics of code coverage to create new test cases. We methodically examine each kind of fuzzers and contemporary fuzzers with a profound observation that addresses various research questions and systematically reviews and analyze the gaps and their solutions. Our survey comprised the recent related works on fuzzing techniques to demystify the fuzzing methods concerning the application domains and the target that, in turn, achieves higher code coverage and sound vulnerability detection.<\/jats:p>","DOI":"10.1145\/3623375","type":"journal-article","created":{"date-parts":[[2023,9,9]],"date-time":"2023-09-09T06:56:17Z","timestamp":1694242577000},"page":"1-38","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":69,"title":["Demystify the Fuzzing Methods: A Comprehensive Survey"],"prefix":"10.1145","volume":"56","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3472-2717","authenticated-orcid":false,"given":"Sanoop","family":"Mallissery","sequence":"first","affiliation":[{"name":"Department of Computer Science, National Yang Ming Chiao Tung University (NYCU), Taiwan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9219-4804","authenticated-orcid":false,"given":"Yu-Sung","family":"Wu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, National Yang Ming Chiao Tung University (NYCU), Taiwan"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,10,5]]},"reference":[{"key":"e_1_3_2_2_2","unstructured":"Adobe 2021. Living off the Land (LotL) Classifier. Retrieved from https:\/\/github.com\/adobe\/libLOL"},{"key":"e_1_3_2_3_2","unstructured":"armDeveloper 2011. Embedded Trace Macrocell Architecture Specification in versions of the ARM architecture: ETMv1.0 to ETMv3.5. Retrieved from https:\/\/developer.arm.com\/documentation\/ihi0014\/latest"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23412"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23371"},{"key":"e_1_3_2_6_2","unstructured":"Vaggelis Atlidakis Roxana Geambasu Patrice Godefroid Marina Polishchuk and Baishakhi Ray. 2020. Pythia: Grammar-based fuzzing of REST APIs with coverage-guided feedback and learning-based mutations. CoRR abs\/2005.11498 (2020). arXiv:2005.11498. https:\/\/arxiv.org\/abs\/2005.11498"},{"key":"e_1_3_2_7_2","unstructured":"Avast 2021. What Is EternalBlue? Retrieved from https:\/\/www.avast.com\/c-eternalblue"},{"key":"e_1_3_2_8_2","first-page":"41","volume-title":"Proceedings of the USENIX Annual Technical Conference (ATC\u201905)","author":"B. Fabrice","year":"2005","unstructured":"Fabrice B.2005. QEMU, a fast & portable dynamic translator. In Proceedings of the USENIX Annual Technical Conference (ATC\u201905). 41\u201346."},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3561161"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/3182657"},{"key":"e_1_3_2_11_2","first-page":"10338","volume-title":"Proceedings of the 32 \\({nd}\\)  International Conference on Neural Information Processing Systems (NIPS\u201918)","author":"Balunovi\u0107 Mislav","year":"2018","unstructured":"Mislav Balunovi\u0107, Pavol Bielik, and Martin Vechev. 2018. Learning to solve SMT formulas. In Proceedings of the 32 \\({nd}\\) International Conference on Neural Information Processing Systems (NIPS\u201918). 10338\u201310349."},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1145\/2024569.2024572"},{"key":"e_1_3_2_13_2","unstructured":"Beyond Security 2018. beSTORM Black-box. Retrieved from https:\/\/beyondsecurity.com\/fuzzer-bestorm-whitepaper-2.html"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/MS.2020.3016773"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102368"},{"key":"e_1_3_2_17_2","unstructured":"Bull SGI OSD 2022. Linux Test Project. Retrieved from https:\/\/linux-test-project.github.io"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2017.2785841"},{"issue":"4","key":"e_1_3_2_19_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3448976","article-title":"A survey of software log instrumentation","volume":"54","author":"Chen Boyuan","year":"2021","unstructured":"Boyuan Chen and Zhen Ming Jiang. 2021. A survey of software log instrumentation. ACM Comput. Surv. 54, 4 (2021), 1\u201334.","journal-title":"ACM Comput. Surv."},{"key":"e_1_3_2_20_2","first-page":"209","volume-title":"Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation (OSDI\u201908)","author":"Cadar Cristian","year":"2008","unstructured":"Cristian Cadar, Daniel Dunbar, and Dawson Engler. 2008. KLEE: Unassisted and automatic generation of high-coverage tests. In Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation (OSDI\u201908). 209\u2013224."},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/2408776.2408795"},{"key":"e_1_3_2_22_2","first-page":"746","volume-title":"Proceedings of the Annual Computer Security Applications Conference (ACSAC\u201920)","author":"Cao Chen","year":"2020","unstructured":"Chen Cao, Le Guan, Jiang Ming, and Peng Liu. 2020. Device-agnostic firmware execution is possible: A concolic execution approach. In Proceedings of the Annual Computer Security Applications Conference (ACSAC\u201920). IEEE, 746\u2013759."},{"key":"e_1_3_2_23_2","unstructured":"Census Labs 2016. Choronzon: An Evolutionary Knowledge-based Fuzzer. Retrieved from https:\/\/github.com\/CENSUS\/choronzon"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238214"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243849"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23159"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00046"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329828"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00071"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/1961295.1950396"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00082"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00114"},{"key":"e_1_3_2_33_2","first-page":"1201","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Clements Abraham A.","year":"2020","unstructured":"Abraham A. Clements, Eric Gustafson, Tobias Scharnowski, Paul Grosen, David Fritz, Christopher Kruegel, Giovanni Vigna, Saurabh Bagchi, and Mathias Payer. 2020. HALucinator: Firmware re-hosting through abstraction layer emulation. In Proceedings of the 29th USENIX Security Symposium1201\u20131218."},{"key":"e_1_3_2_34_2","unstructured":"ClusterFuzz 2021. ClusterFuzz. Retrieved from https:\/\/google.github.io\/clusterfuzz\/"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134069"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33826-7_16"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.15"},{"key":"e_1_3_2_38_2","unstructured":"Dave Aitel 2002. Block-Based Protocol Analysis. Retrieved from https:\/\/www.immunitysec.com\/downloads\/"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1145\/1995376.1995394"},{"key":"e_1_3_2_41_2","unstructured":"Department of Defense (DoD) 2019. DevSecOps Reference Design. Retrieved from https:\/\/dodcio.defense.gov\/Portals\/0\/Documents\/"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00009"},{"key":"e_1_3_2_43_2","unstructured":"Dmitry Vyukov 2021. Randomized Testing for Go. Retrieved from https:\/\/github.com\/dvyukov\/go-fuzz"},{"key":"e_1_3_2_44_2","unstructured":"Dmitry Vyukov and Andrey Konovalov 2022. Syzkaller. Retrieved from https:\/\/github.com\/google\/syzkaller"},{"key":"e_1_3_2_45_2","unstructured":"Dmytro Oleksiuk 2011. Ioctl Fuzzer. Retrieved from https:\/\/github.com\/Cr4sh\/ioctlfuzzer\/"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3385412.3385972"},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-59762-7_8"},{"key":"e_1_3_2_48_2","unstructured":"Eduard Kovacs 2021. Open Source Security Tools. Retrieved from https:\/\/google-adobe-announce-new-open-source-security-tools"},{"key":"e_1_3_2_49_2","unstructured":"Eldar Marcussen 2019. Doona\u2014Network Based Protocol Fuzzer. Retrieved from https:\/\/github.com\/wireghoul\/doona"},{"key":"e_1_3_2_50_2","unstructured":"James Fell. 2017. A Review of Fuzzing Tools and Methods. Retrieved from https:\/\/tinyurl.com\/4r6pkuha"},{"key":"e_1_3_2_51_2","first-page":"1237","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Feng Bo","year":"2020","unstructured":"Bo Feng, Alejandro Mera, and Long Lu. 2020. P2IM: Scalable and hardware-independent firmware testing via automatic peripheral interface modeling. In Proceedings of the 29th USENIX Security Symposium, 1237\u20131254."},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484543"},{"key":"e_1_3_2_53_2","first-page":"1","volume-title":"Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT\u201920)","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Dominik Maier, Heiko Ei\u00dffeldt, and Marc Heuse. 2020. AFL++: Combining incremental steps of fuzzing research. In Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT\u201920). 1\u201312."},{"key":"e_1_3_2_54_2","unstructured":"United States Food & Drug Administration. 2018. Efforts to Strengthen the Agency\u2019s Medical Device Cybersecurity Program. Retrieved from https:\/\/www.fda.gov\/news-events\/"},{"key":"e_1_3_2_55_2","unstructured":"FuzzBall 2021. FuzzBALL Symbolic Engine. Retrieved from https:\/\/github.com\/bitblaze-fuzzball\/fuzzball"},{"key":"e_1_3_2_56_2","unstructured":"FuzzBallVine 2021. FuzzBALL: Vine-based Binary Symbolic Execution. Retrieved from http:\/\/bitblaze.cs.berkeley.edu\/fuzzball.html"},{"key":"e_1_3_2_57_2","unstructured":"Fuzzit 2020. Coverage Guided Fuzz Testing for Java. Retrieved from https:\/\/github.com\/fuzzitdev\/javafuzz"},{"key":"e_1_3_2_58_2","unstructured":"Fuzzit 2020. Coverage Guided Fuzz Testing for Javascript. Retrieved from https:\/\/github.com\/fuzzitdev\/jsfuzz"},{"key":"e_1_3_2_59_2","unstructured":"Fuzzit 2020. Coverage Guided Fuzz Testing for Python. Retrieved from https:\/\/github.com\/fuzzitdev\/pythonfuzz"},{"key":"e_1_3_2_60_2","first-page":"2577","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Gan Shuitao","year":"2020","unstructured":"Shuitao Gan, Chao Zhang, Peng Chen, Bodong Zhao, Xiaojun Qin, Dong Wu, and Zuoning Chen. 2020. GREYONE: Data flow sensitive fuzzing. In Proceedings of the 29th USENIX Security Symposium, 2577\u20132594."},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00040"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2009.5070546"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE51524.2021.9678913"},{"key":"e_1_3_2_64_2","doi-asserted-by":"publisher","DOI":"10.1145\/3363824"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.1145\/1379022.1375607"},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/2090147.2094081"},{"key":"e_1_3_2_67_2","unstructured":"Google 2015. Honggfuzz. Retrieved from https:\/\/github.com\/google\/honggfuzz"},{"key":"e_1_3_2_68_2","unstructured":"Google 2016. Fuzzing Chrome. Retrieved from https:\/\/security.googleblog.com\/2016\/08\/guided-in-process-fuzzing-of-chrome.html"},{"key":"e_1_3_2_69_2","unstructured":"Google 2021. ClusterFuzzLite. Retrieved from https:\/\/security.googleblog.com\/2021\/11\/clusterfuzzlite-continuous-fuzzing-for.html"},{"key":"e_1_3_2_70_2","unstructured":"Google 2021. Fuzzer-test-suite. Retrieved from https:\/\/github.com\/google\/fuzzer-test-suite"},{"key":"e_1_3_2_71_2","unstructured":"Google 2022. OSS-fuzz. Retrieved from https:\/\/github.com\/google\/oss-fuzz"},{"key":"e_1_3_2_72_2","volume-title":"FuzzIL: Coverage Guided Fuzzing for JavaScript Engines","author":"Gro\u00df Samuel","year":"2018","unstructured":"Samuel Gro\u00df. 2018. FuzzIL: Coverage Guided Fuzzing for JavaScript Engines. Master\u2019s thesis. Institute of Theoretical Informatics, Competence Center for Applied Security Technology."},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3121994"},{"key":"e_1_3_2_74_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICoIA.2013.6650258"},{"key":"e_1_3_2_75_2","first-page":"135","volume-title":"Proceedings of the 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID\u201919)","author":"Gustafson Eric","year":"2019","unstructured":"Eric Gustafson, Marius Muench, Chad Spensky, Nilo Redini, Aravind Machiry, Yanick Fratantonio, Davide Balzarotti, Aur\u00e9lien Francillon, Yung Ryn Choe, Christophe Kruegel, and Giovanni Vigna. 2019. Toward the analysis of embedded firmware through automated re-hosting. In Proceedings of the 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID\u201919). USENIX, 135\u2013150."},{"key":"e_1_3_2_76_2","first-page":"49","volume-title":"Proceedings of the 22nd USENIX Security Symposium","author":"Haller Istvan","year":"2013","unstructured":"Istvan Haller, Asia Slowinska, Matthias Neugschwandtner, and Herbert Bos. 2013. Dowsing for Overflows: A guided fuzzer to find buffer boundary violations. In Proceedings of the 22nd USENIX Security Symposium, 49\u201364."},{"key":"e_1_3_2_77_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2017.27"},{"key":"e_1_3_2_78_2","unstructured":"Hfiref0x 2021. NtCall64. Retrieved from https:\/\/github.com\/hfiref0x\/NtCall64"},{"key":"e_1_3_2_79_2","first-page":"445","volume-title":"Proceedings of the 21st USENIX Security Symposium","author":"Holler Christian","year":"2012","unstructured":"Christian Holler, Kim Herzig, and Andreas Zeller. 2012. Fuzzing with code fragments. In Proceedings of the 21st USENIX Security Symposium, 445\u2013458."},{"key":"e_1_3_2_80_2","doi-asserted-by":"publisher","DOI":"10.1145\/3203217.3203241"},{"key":"e_1_3_2_81_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833751"},{"key":"e_1_3_2_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00063"},{"key":"e_1_3_2_83_2","unstructured":"Intel 2020. Processor Tracing. Retrieved from https:\/\/software.intel.com\/content\/www\/us\/en\/develop\/blogs\/processor-tracing.html"},{"key":"e_1_3_2_84_2","unstructured":"J. B. Crawford 2018. A Survey of Some Free Fuzzing Tools. Retrieved from https:\/\/lwn.net\/Articles\/744269\/"},{"key":"e_1_3_2_85_2","unstructured":"James Spadaro and Lilith Wyatt 2017. Mutiny Fuzzing Framework and Decept Proxy. Retrieved from http:\/\/blog.talosintelligence.com\/"},{"key":"e_1_3_2_86_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00017"},{"key":"e_1_3_2_87_2","unstructured":"Jesse Hertz 2017. Triforce Linux Syscall Fuzzer. Retrieved from https:\/\/github.com\/nccgroup\/TriforceLinuxSyscallFuzzer"},{"key":"e_1_3_2_88_2","unstructured":"Jesse Hertz 2017. TriforceAFL. Retrieved from https:\/\/github.com\/nccgroup\/TriforceAFL"},{"key":"e_1_3_2_89_2","unstructured":"Jesse Ruderman 2021. jsfunfuzz: Test JS Engine in Firefox. Retrieved from https:\/\/github.com\/MozillaSecurity\/funfuzz\/"},{"key":"e_1_3_2_90_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2020.102497"},{"key":"e_1_3_2_91_2","doi-asserted-by":"publisher","DOI":"10.5555\/3489212.3489358"},{"key":"e_1_3_2_92_2","doi-asserted-by":"crossref","unstructured":"Zu-Ming Jiang Jia-Ju Bai Kangjie Lu and Shi-Min Hu. 2022. Context-Sensitive and directional concurrency fuzzing for data-race detection. In Proc. of the Net. & Distr. Sec. Symp. (NDSS) . 1\u201318.","DOI":"10.14722\/ndss.2022.24296"},{"key":"e_1_3_2_93_2","doi-asserted-by":"publisher","DOI":"10.5555\/2337223.2337279"},{"key":"e_1_3_2_94_2","first-page":"321","volume-title":"Proceedings of the 30th USENIX Security Symposium","author":"Johnson Evan","year":"2021","unstructured":"Evan Johnson, Maxwell Bland, YiFei Zhu, Joshua Mason, Stephen Checkoway, Stefan Savage, and Kirill Levchenko. 2021. Jetset: Targeted firmware rehosting for embedded systems. In Proceedings of the 30th USENIX Security Symposium, 321\u2013338."},{"key":"e_1_3_2_95_2","unstructured":"Josh Fruhlinger 2018. The Mirai Botnet Explained. Retrieved from https:\/\/www.csoonline.com\/article\/"},{"key":"e_1_3_2_96_2","unstructured":"Joshua Pereyda 2017. boofuzz: Network Protocol Fuzzing for Humans. Retrieved from https:\/\/boofuzz.readthedocs.io\/en\/stable\/"},{"key":"e_1_3_2_97_2","unstructured":"Kaspersky 2017. WannaCry. Retrieved from https:\/\/www.kaspersky.com\/resource-center\/threats\/ransomware-wannacry"},{"key":"e_1_3_2_98_2","first-page":"1","volume-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS\u201917)","author":"Kim Kyungtae","year":"2017","unstructured":"Kyungtae Kim, Dae R. Jeong, Chung Hwan Kim, Yeongjin Jang, Insik Shin, and Byoungyoung Lee. 2017. HFL: Hybrid fuzzing on the linux kernel. In Proceedings of the Network and Distributed System Security Symposium (NDSS\u201917). 1\u201317."},{"key":"e_1_3_2_99_2","first-page":"1","volume-title":"Proceedings of 12th USENIX Workshop on Offensive Technologies (WOOT\u201918)","author":"Kleber Stephan","year":"2018","unstructured":"Stephan Kleber, Henning Kopp, and Frank Kargl. 2018. NEMESYS: Network message syntax reverse engineering by analysis of the intrinsic structure of individual messages. In Proceedings of 12th USENIX Workshop on Offensive Technologies (WOOT\u201918). 1\u201313."},{"key":"e_1_3_2_100_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2022.111379"},{"key":"e_1_3_2_101_2","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510628"},{"key":"e_1_3_2_102_2","volume-title":"ZZUF: Multi-purpose Fuzzer","author":"(latest) ZZUF 0.15","year":"2017","unstructured":"ZZUF 0.15 (latest). 2017. ZZUF: Multi-purpose Fuzzer. Retrieved February 1, 2022 from http:\/\/caca.zoy.org\/wiki\/zzuf"},{"key":"e_1_3_2_103_2","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2004.1281665"},{"key":"e_1_3_2_104_2","unstructured":"Caroline Lemieux and Koushik Sen. 2017. FairFuzz: Targeting rare branches to rapidly increase greybox fuzz testing coverage. CoRR abs\/1709.07101 (2017). arXiv:1709.07101. http:\/\/arxiv.org\/abs\/1709.07101"},{"issue":"6","key":"e_1_3_2_105_2","first-page":"1","article-title":"Fuzzing: A survey","volume":"1","author":"Li Jun","year":"2018","unstructured":"Jun Li, Bodong Zhao, and Chao Zhang. 2018. Fuzzing: A survey. Cybersecurity 1, 6 (2018), 1\u201313.","journal-title":"Cybersecurity"},{"key":"e_1_3_2_106_2","unstructured":"Wenqiang Li Jiameng Shi Fengjun Li Jingqiang Lin Wei Wang and Le Guan. 2022.  \\(\\mu\\) AFL: Non-intrusive feedback-driven fuzzing for microcontroller firmware. In Proc. of the 44th International Conference on Software Engineering (ICSE) . ACM 1\u201312."},{"key":"e_1_3_2_107_2","doi-asserted-by":"crossref","unstructured":"Yuwei Li Shouling Ji Chenyang Lyu Yuan Chen Jianhai Chen Qinchen Gu Chunming Wu and Raheem Beyah. 2022. V-Fuzz: Vulnerability prediction-assisted evolutionary fuzzing f or binary programs. IEEE Trans. Cybern. 52 5 (2022) 3745\u20133756.","DOI":"10.1109\/TCYB.2020.3013675"},{"key":"e_1_3_2_108_2","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2018.2834476"},{"key":"e_1_3_2_109_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833594"},{"key":"e_1_3_2_110_2","unstructured":"LibFuzzer 2017. libFuzzer\u2014A Library for Coverage-guided Fuzz Testing. Retrieved from https:\/\/llvm.org\/docs\/LibFuzzer.html"},{"issue":"1","key":"e_1_3_2_111_2","first-page":"1044","article-title":"DeepFuzz: Automatic generation of syntax valid c programs for fuzz testing","volume":"33","author":"Liu Xiao","year":"2019","unstructured":"Xiao Liu, Xiaoting Li, Rupesh P, and Dinghao Wu. 2019. DeepFuzz: Automatic generation of syntax valid c programs for fuzz testing. Proc. AAAI Conf. Artif. Intell. 33, 1 (2019), 1044\u20131051.","journal-title":"Proc. AAAI Conf. Artif. Intell."},{"key":"e_1_3_2_112_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE51524.2021.9678671"},{"key":"e_1_3_2_113_2","unstructured":"Lucas Leong. 2019. Make Static Instrumentation Great Again: High Performance Fuzzing for Windows System. Retrieved from https:\/\/msrnd-cdn-stor.azureedge.net\/bluehat\/bluehatil\/2019\/"},{"key":"e_1_3_2_114_2","doi-asserted-by":"publisher","DOI":"10.1145\/1064978.1065034"},{"key":"e_1_3_2_115_2","first-page":"1949","volume-title":"Proceedings of the 28th USENIX Security Symposium","author":"Lyu Chenyang","year":"2019","unstructured":"Chenyang Lyu, Shouling Ji, Chao Zhang, Yuwei Li, Wei-Han Lee, Yu Song, and Raheem Beyah. 2019. MOPT: Optimized mutation scheduling for fuzzers. In Proceedings of the 28th USENIX Security Symposium, 1949\u20131966."},{"key":"e_1_3_2_116_2","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534226"},{"key":"e_1_3_2_117_2","first-page":"553","volume-title":"Proceedings of the 6th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE\u201907)","author":"Majumdar Rupak","year":"2007","unstructured":"Rupak Majumdar and Ru-Gang Xu. 2007. Directed test generation using symbolic grammars. In Proceedings of the 6th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE\u201907). ACM, 553\u2013556."},{"key":"e_1_3_2_118_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2946563"},{"key":"e_1_3_2_119_2","first-page":"235","volume-title":"Proceedings of the 9th Joint Meeting on Foundations of Software Engineering (ESEC\/FSE\u201920)","author":"Marinescu Paul Dan","year":"2020","unstructured":"Paul Dan Marinescu and Cristian Cadar. 2020. KATCH: High-coverage testing of software patches. In Proceedings of the 9th Joint Meeting on Foundations of Software Engineering (ESEC\/FSE\u201920). ACM, 235\u2013245."},{"key":"e_1_3_2_120_2","unstructured":"Martin Vuagnoux 2005. Autodafe: An Act of Software Tortur. Retrieved from https:\/\/infoscience.epfl.ch\/record\/140525?ln=en"},{"key":"e_1_3_2_121_2","doi-asserted-by":"publisher","DOI":"10.5555\/1077276.1077279"},{"key":"e_1_3_2_122_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00018"},{"key":"e_1_3_2_123_2","unstructured":"Micha\u0142 Zalewski. 2013. American Fuzzy Lop (AFL). Retrieved from https:\/\/lcamtuf.coredump.cx\/afl\/"},{"key":"e_1_3_2_124_2","unstructured":"MIT and Hewlett-Packard. 2009. DynamoRIO. Retrieved from https:\/\/dynamorio.org\/page_home.html"},{"key":"e_1_3_2_125_2","unstructured":"Mozilla Security. 2020. Dharma: Context-free Grammar Fuzzer. Retrieved from https:\/\/github.com\/mozillasecurity\/dharma"},{"key":"e_1_3_2_126_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00069"},{"key":"e_1_3_2_127_2","first-page":"1683","volume-title":"Proceedings of the 30th USENIX Security Symposium","author":"Nagy Stefan","year":"2021","unstructured":"Stefan Nagy, Anh Nguyen-Tuong, Jason D. Hiser, Jack W. Davidson, and Matthew Hicks. 2021. Breaking through binaries: Compiler-quality instrumentation for better binary-only fuzzing. In Proceedings of the 30th USENIX Security Symposium1683\u20131700."},{"key":"e_1_3_2_128_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484787"},{"key":"e_1_3_2_129_2","unstructured":"Nick Fitzgerald 2022. Cargo-Fuzz for Rust-code. Retrieved from https:\/\/rust-fuzz.github.io\/book\/cargo-fuzz\/guide.html"},{"key":"e_1_3_2_130_2","first-page":"33","volume-title":"Proceedings of the 26th USENIX Security Symposium","author":"Ning Zhenyu","year":"2017","unstructured":"Zhenyu Ning and Fengwei Zhang. 2017. Ninja: Towards transparent tracing and debugging on ARM. In Proceedings of the 26th USENIX Security Symposium. 33\u201349."},{"key":"e_1_3_2_131_2","doi-asserted-by":"publisher","DOI":"10.1145\/3324884.3418930"},{"key":"e_1_3_2_132_2","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3339002"},{"key":"e_1_3_2_133_2","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3330576"},{"key":"e_1_3_2_134_2","first-page":"729","volume-title":"Proceedings of the 27th USENIX Security Symposium","author":"Pailoor Shankara","year":"2018","unstructured":"Shankara Pailoor, Andrew Aday, and Suman Jana. 2018. MoonShine: Optimizing OS fuzzer seed selection with trace distillation. In Proceedings of the 27th USENIX Security Symposium, 729\u2013743."},{"key":"e_1_3_2_135_2","first-page":"149","volume-title":"Proceedings of the 26th USENIX Security Symposium","author":"Pan Jianfeng","year":"2017","unstructured":"Jianfeng Pan, Guanglu Yan, and Xiaocao Fan. 2017. Digtool: A virtualization-based framework for detecting kernel vulnerabilities. In Proceedings of the 26th USENIX Security Symposium, 149\u2013165."},{"key":"e_1_3_2_136_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00067"},{"key":"e_1_3_2_137_2","unstructured":"Patrice Godefroid 2020. Fuzzing and Why It\u2019s an Important Tool for Developers. Retrieved from https:\/\/www.microsoft.com\/en-us\/research\/blog\/a-brief-introduction-to-fuzzing-and-why-its-an-important-tool-for-developers\/"},{"key":"e_1_3_2_138_2","unstructured":"PEACH. 2014. PEACH Fuzzer. Retrieved from https:\/\/gitlab.com\/peachtech\/peach-fuzzer-community"},{"key":"e_1_3_2_139_2","unstructured":"Pedram Amini and Aaron Portnoy 2015. Sulley: Fuzzing Framework. Retrieved from https:\/\/github.com\/OpenRCE\/sulley"},{"key":"e_1_3_2_140_2","first-page":"2559","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Peng Hui","year":"2020","unstructured":"Hui Peng and Mathias Payer. 2020. USBFuzz: A framework for fuzzing USB drivers by device emulation. In Proceedings of the 29th USENIX Security Symposium, 2559\u20132575."},{"key":"e_1_3_2_141_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00056"},{"issue":"9","key":"e_1_3_2_142_2","first-page":"1908","article-title":"Smart greybox fuzzing","volume":"47","author":"Pham Van-Thuan","year":"2021","unstructured":"Van-Thuan Pham, Marcel B\u00f6hme, Andrew E. Santosa, Alexandru R\u0103zvan C\u0103ciulescu, and Abhik Roychoudhury. 2021. Smart greybox fuzzing. IEEE Trans. Softw. Eng. 47, 9 (2021), 1908\u20131997.","journal-title":"IEEE Trans. Softw. Eng."},{"key":"e_1_3_2_143_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE51524.2021.9678810"},{"key":"e_1_3_2_144_2","first-page":"181","volume-title":"Proceedings of the 29th USENIX Security Symposium","author":"Poeplau Sebastian","year":"2020","unstructured":"Sebastian Poeplau and Aur\u00e9lien Francillon. 2020. Symbolic execution with SymCC: Don\u2019t interpret, compile! In Proceedings of the 29th USENIX Security Symposium, 181\u2013198."},{"key":"e_1_3_2_145_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-70692-0_3"},{"key":"e_1_3_2_146_2","doi-asserted-by":"publisher","DOI":"10.1145\/1858996.1859035"},{"key":"e_1_3_2_147_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23404"},{"key":"e_1_3_2_148_2","doi-asserted-by":"publisher","DOI":"10.1145\/3578245.3584851"},{"key":"e_1_3_2_149_2","unstructured":"Gary J. Saavedra Kathryn N. Rodhouse Daniel M. Dunlavy and W. Philip Kegelmeyer. 2019. A review of machine learning applications in fuzzing. CoRR abs\/1906.11133 (2019). arXiv:1906.11133. http:\/\/arxiv.org\/abs\/1906.11133"},{"key":"e_1_3_2_150_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10703-019-00337-w"},{"key":"e_1_3_2_151_2","first-page":"167","volume-title":"Proceedings of the 26th USENIX Security Symposium","author":"Schumilo Sergej","year":"2017","unstructured":"Sergej Schumilo, Cornelius Aschermann, Robert Gawlik, Sebastian Schinzel, and Thorsten Holz. 2017. kAFL: Hardware-assisted feedback fuzzing for OS kernels. In Proceedings of the 26th USENIX Security Symposium, 167\u2013182."},{"key":"e_1_3_2_152_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2018.06.024"},{"key":"e_1_3_2_153_2","unstructured":"Dongdong She Kexin Pei Dave Epstein Junfeng Yang Baishakhi Ray and Suman Jana. 2019. NEUZZ: Efficient fuzzing with neural program smoothing. In Proc. of the IEEE Symp. on Security and Privacy (S&P) . IEEE 803\u2013817."},{"key":"e_1_3_2_154_2","doi-asserted-by":"publisher","DOI":"10.1145\/3477014"},{"key":"e_1_3_2_155_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464814"},{"key":"e_1_3_2_156_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23368"},{"key":"e_1_3_2_157_2","doi-asserted-by":"publisher","DOI":"10.1145\/3477132.3483547"},{"key":"e_1_3_2_158_2","unstructured":"Synopsys. 2020. The Heartbleed Bug. Retrieved from https:\/\/heartbleed.com"},{"key":"e_1_3_2_159_2","doi-asserted-by":"publisher","DOI":"10.5555\/1404500"},{"key":"e_1_3_2_160_2","unstructured":"Talos-vulndev. 2018. AFL-Dyninst. Retrieved from https:\/\/github.com\/talos-vulndev\/afl-dyninst"},{"key":"e_1_3_2_161_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-27660-6_44"},{"key":"e_1_3_2_162_2","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev.2016.042"},{"key":"e_1_3_2_163_2","first-page":"2741","volume-title":"Proceedings of the 30th USENIX Security Symposium","author":"Wang Daimeng","year":"2021","unstructured":"Daimeng Wang, Zheng Zhang, Hang Zhang, Zhiyun Qian, Srikanth V.K., and Nael Abu-Ghazaleh. 2021. SyzVegas: Beating kernel fuzzing odds with reinforcement learning. In Proceedings of the 30th USENIX Security Symposium2741\u20132758."},{"key":"e_1_3_2_164_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.23"},{"key":"e_1_3_2_165_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00081"},{"key":"e_1_3_2_166_2","first-page":"147","volume-title":"Proceedings of the USENIX Annual Technical Conference (ATC\u201921)","author":"Wang Mingzhe","year":"2021","unstructured":"Mingzhe Wang, Jie Liang, Chijin Zhou, Yu Jiang, Rui Wang, Chengnian Sun, and Jiaguang Sun. 2021. RIFF: Reduced instruction footprint for coverage-guided fuzzing. In Proceedings of the USENIX Annual Technical Conference (ATC\u201921). 147\u2013159."},{"key":"e_1_3_2_167_2","unstructured":"Pengfei Wang and Xu Zhou. 2020. SoK: The progress challenges and perspectives of directed greybox fuzzing. CoRR abs\/2005.11907 (2020). https:\/\/arxiv.org\/abs\/2005.11907"},{"key":"e_1_3_2_168_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.37"},{"key":"e_1_3_2_169_2","doi-asserted-by":"crossref","unstructured":"Yan Wang Peng Jia Luping Liu Cheng Huang and Zhonglin Liu. 2020. A systematic review of fuzzing based on machine learning techniques. PLOS ONE 15 8 (2020) 1\u201337.","DOI":"10.1371\/journal.pone.0237749"},{"key":"e_1_3_2_170_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24422"},{"key":"e_1_3_2_171_2","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380396"},{"key":"e_1_3_2_172_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.68"},{"key":"e_1_3_2_173_2","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3469079"},{"issue":"10","key":"e_1_3_2_174_2","first-page":"3071","article-title":"Hybrid testing method based on symbolic execution and fuzzing","volume":"30","author":"Xiaofei Xie","year":"2019","unstructured":"Xie Xiaofei and Li Xiaohong. 2019. Hybrid testing method based on symbolic execution and fuzzing. J. Softw. 30, 10 (2019), 3071\u20133089.","journal-title":"J. Softw."},{"key":"e_1_3_2_175_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00078"},{"key":"e_1_3_2_176_2","doi-asserted-by":"publisher","DOI":"10.1145\/1993316.1993532"},{"key":"e_1_3_2_177_2","unstructured":"Yoav Alon and Netanel Ben-Simon 2018. Fuzzing Adobe Reader. Retrieved from https:\/\/research.checkpoint.com\/2018\/"},{"key":"e_1_3_2_178_2","first-page":"745","volume-title":"Proceedings of the 27th USENIX Security Symposium","author":"Yun Insu","year":"2018","unstructured":"Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. QSYM : A practical concolic execution engine tailored for hybrid fuzzing. In Proceedings of the 27th USENIX Security Symposium, 745\u2013761."},{"key":"e_1_3_2_179_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23229"},{"key":"e_1_3_2_180_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2851237"},{"key":"e_1_3_2_181_2","doi-asserted-by":"publisher","DOI":"10.1145\/3444370.3444570"},{"key":"e_1_3_2_182_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSESS.2018.8663772"},{"key":"e_1_3_2_183_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00109"},{"key":"e_1_3_2_184_2","first-page":"3273","volume-title":"Proceedings of the 31st USENIX Security Symposium","author":"Zhao Bodong","year":"2022","unstructured":"Bodong Zhao, Zheming Li, Shisong Qin, Zheyu Ma, Ming Yuan, Wenyu Zhu, Zhihong Tian, and Chao Zhang. 2022. StateFuzz: System call-based state-aware linux driver fuzzing. In Proceedings of the 31st USENIX Security Symposium, 3273\u20133289."},{"key":"e_1_3_2_185_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417260"},{"key":"e_1_3_2_186_2","first-page":"2007","volume-title":"Proceedings of the 30th USENIX Security Symposium","author":"Zhou Wei","year":"2021","unstructured":"Wei Zhou, Le Guan, Peng Liu, and Yuqing Zhang. 2021. Automatic firmware emulation through invalidity-guided knowledge inference. In Proceedings of the 30th USENIX Security Symposium, 2007\u20132024."},{"key":"e_1_3_2_187_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3219520"},{"key":"e_1_3_2_188_2","unstructured":"Shunkai Zhu Jingyi Wang Jun Sun Jie Yang Xingwei Lin Liyi Zhang and Peng Cheng. 2021. Better pay attention whilst fuzzing. CoRR abs\/2112.07143 (2021). arXiv:2112.07143. https:\/\/arxiv.org\/abs\/2112.07143"},{"key":"e_1_3_2_189_2","doi-asserted-by":"publisher","DOI":"10.1145\/3512345"},{"key":"e_1_3_2_190_2","first-page":"3201","volume-title":"Proceedings of the 31st USENIX Security Symposium","author":"Zou Xiaochen","year":"2022","unstructured":"Xiaochen Zou, Guoren Li, Weiteng Chen, Hang Zhang, and Zhiyun Qian. 2022. SyzScope: Revealing high-risk security impacts of fuzzer-exposed bugs in linux kernel. In Proceedings of the 31st USENIX Security Symposium, 3201\u20133217."}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3623375","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3623375","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T12:36:26Z","timestamp":1750163786000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3623375"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,5]]},"references-count":189,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2024,3,31]]}},"alternative-id":["10.1145\/3623375"],"URL":"https:\/\/doi.org\/10.1145\/3623375","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,10,5]]},"assertion":[{"value":"2022-08-24","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-08-21","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-10-05","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}