Fuzzing: Progress, Challenges, and Perspectives
Source abstract
Abstract
As one of the most effective techniques for finding software vulnerabilities, fuzzing has become a hot topic in software security. It feeds potentially syntactically or semantically malformed test data to a target program to mine vulnerabilities and crash the system. In recent years, considerable efforts have been dedicated by researchers and practitioners towards improving fuzzing, so there are more and more methods and forms, which make it difficult to have a comprehensive understanding of the technique. This paper conducts a thorough survey of fuzzing, focusing on its general process, classification, common application scenarios, and some state-of-the-art techniques that have been introduced to improve its performance. Finally, this paper puts forward key research challenges and proposes possible future research directions that may provide new insights for researchers.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Software Testing and Debugging Techniques · Advanced Malware Detection Techniques · Adversarial Robustness in Machine Learning
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (100+)
Show source-provided references
1. Tomcat, “Apache Tomcat,” 2023. [Online]. Available: https://tomcat.apache.org/ (accessed on 26/03/2023)
2. CVE-2020-1938, 2023. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2020-1938 (accessed on 26/03/2023)
3. Detection of actuator enablement attacks by Petri nets in supervisory control systems10.3390/math11040943 ↗
4. Critical observability verification and enforcement of labeled Petri nets by using basis markings
5. Definition of software bug, 2023. [Online]. Available: https://www.lawinsider.com/dictionary/software-bug (accessed on 26/03/2023)
6. CVE definition, 2023. [Online]. Available: https://nvd.nist.gov/vuln (accessed on 26/03/2023)
7. Fuzzing: Challenges and reflections10.1109/MS.2020.3016773 ↗
8. An empirical study of the reliability of UNIX utilities10.1145/96267.96279 ↗
9. Fuzzing: A survey for roadmap10.1145/3512345 ↗
10. Smart greybox fuzzing
11. DeepFuzzer: Accelerated deep greybox fuzzing
12. The art, science, and engineering of fuzzing: A survey10.1109/TSE.2019.2946563 ↗
13. V-Fuzz: Vulnerability prediction-assisted evolutionary fuzzing for binary programs10.1109/TCYB.2020.3013675 ↗
14. VUzzer: Application-aware evolutionary fuzzing
15. Learn&Fuzz: Machine learning for input fuzzing
16. Skyfire: Data-driven seed generation for fuzzing
17. AFL, “American fuzzy lop,” 2015. [Online]. Available: http://lcamtuf.coredump.cx/afl/ (accessed on 26/03/2023)
18. NEUZZ: Efficient fuzzing with neural program smoothing
19. C. Lv, S. Ji, Y. Li, J. Zhou, J. Chen et al., “SmartSeed: Smart seed generation for efficient fuzzing,” arXiv:1807.02606, 2018.
20. Michael · Fuzzing: Brute Force Vulnerability Discovery · 2007 · 21
21. Kaksonen · Communications and Multimedia Security Issues of the New Century · 2001 · 17310.1007/978-0-387-35413-2_16 ↗
22. Gitlab, “Peach-fuzzer-community,” 2021. [Online]. Available: https://gitlab.com/peachtech/peach-fuzzer-community (accessed on 26/03/2023)
23. A. Pedram and P. Aaron, “Sulley,” 2023. [Online]. Available: https://github.com/OpenRCE/sulley (accessed on 26/03/2023)
24. Automated whitebox fuzz testing
25. funfuzz, “Javascript engine fuzzers,” 2023. [Online]. Available: https://github.com/MozillaSecurity/funfuzz (accessed on 26/03/2023)
26. Taint-based directed whitebox fuzzing
27. Hybrid algorithm for the classification of fractal designs and images
28. Coverage-based greybox fuzzing as markov chain10.1109/TSE.2017.2785841 ↗
29. Directed greybox fuzzing
30. NAUTILUS: Fishing for deep bugs with grammars
31. Driller: Augmenting fuzzing through selective symbolic execution
32. Deepfuzz: Triggering vulnerabilities deeply hidden in binaries
33. Dynamic test generation to find integer bugs in x86 binary linux programs
34. Full-speed fuzzing: Reducing fuzzing overhead through coverage-guided tracing
35. Not all coverage measurements are equal: Fuzzing by coverage accounting for input prioritization
36. TaintScope: A checksum-aware directed fuzzing tool for automatic software vulnerability detection
37. Dowsing for overflows: A guided fuzzer to find buffer boundary violations
38. Grammar-based whitebox fuzzing
39. Fuzzing with code fragments
40. Superion: Grammar-aware greybox fuzzing
41. A model-based approach to security flaw detection of network protocol implementations
42. Blendfuzz: A model-based framework for fuzz testing programs with grammatical inputs
43. Combining model-based and risk-based testing for effective test case generation
44. MOPT: Optimized mutation scheduling for fuzzers
45. EcoFuzz: Adaptive energy-saving greybox fuzzing as a variant of the adversarial multi-armed bandit
46. Regression greybox fuzzing
47. Symbolic execution and program testing10.1145/360248.360252 ↗
48. Selective symbolic execution
49. Testing network protocol binary software with selective symbolic execution
50. Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs
51. DART: Directed automated random testing
52. S2E: A platform for in-vivo multi-path analysis of software systems
53. P. Wang, X. Zhou, K. Lu, T. Yue and Y. Liu, “SoK: The progress, challenges, and perspectives of directed greybox fuzzing,” arXiv:2005.11907, 2020.
54. LibFuzzer, 2023. [Online]. Available: http://llvm.org/docs/LibFuzzer.html (accessed on 26/03/2023)
55. K. Serebryany, “Oss-fuzz,” 2023. [Online]. Available: https://github.com/google/oss-fuzz (accessed on 26/03/2023)
56. Google, “Honggfuzz,” 2021. [Online]. Available: https://github.com/google/honggfuzz (accessed on 26/03/2023)
57. A lattice model of secure information flow10.1145/360051.360056 ↗
58. A theory of type qualifiers10.1145/301631.301665 ↗
59. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software
60. DTA++: Dynamic taint analysis with targeted controlflow propagation
61. All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask)
62. Pin: Building customized program analysis tools with dynamic instrumentation10.1145/1064978.1065034 ↗
63. D. Bruening, Q. Zhao and R. Kleckner, “DynamoRIO,” 2023. [Online]. Available: https://github.com/DynamoRIO/dynamorio (accessed on 26/03/2023)
64. Valgrind: A framework for heavyweight dynamic binary instrumentation10.1145/1273442.1250746 ↗
65. Leveraging textual specifications for grammar-based fuzzing of network protocols
66. I. Schieferdecker, J. Grossmann and M. Schneider, “Model-based security testing,” arXiv:1202.6118, 2012.10.4204/EPTCS.80.1 ↗
67. A systematic review of fuzzing techniques10.1016/j.cose.2018.02.002 ↗
68. Optimization by simulated annealing10.1126/science.220.4598.671 ↗
69. Genetic algorithms10.1145/234313.234350 ↗
70. Feature selection based on hybridization of genetic algorithm and particle swarm optimization10.1109/LGRS.2014.2337320 ↗
71. Traffic management in internet of vehicles using improved ant colony optimization10.32604/cmc.2023.034413 ↗
72. NeuFuzz: Efficient fuzzing with deep neural network10.1109/ACCESS.2019.2903291 ↗
73. SeqFuzzer: An industrial protocol fuzzing framework from a deep learning perspective
74. An intelligent fuzzing data generation method based on deep adversarial learning10.1109/ACCESS.2019.2911121 ↗
75. FuzzGuard: Filtering out unreachable inputs in directed grey-box fuzzing through deep learning
76. Deep reinforcement fuzzing
77. An autonomic testing framework for IPv6 configuration protocols
78. Emulation-instrumented fuzz testing of 4G/LTE android mobile devices guided by reinforcement learning
79. W. Drozd and M. D. Wagner, “FuzzerGym: A competitive framework for fuzzing and learning,” arXiv:1807.07490, 2018.
80. Deep learning: Methods and applications10.1561/2000000039 ↗
81. Deep learning10.1038/nature14539 ↗
82. Recurrent neural networks
83. Long short-term memory10.1162/neco.1997.9.8.1735 ↗
84. Generative adversarial networks10.1145/3422622 ↗
85. Recent advances in convolutional neural networks10.1016/j.patcog.2017.10.013 ↗
86. Format-aware learn&fuzz: Deep test data generation for efficient fuzzing10.1007/s00521-020-05039-7 ↗
87. M. Rajpal, W. Blum and R. Singh, “Not all bytes are equal: Neural byte sieve for fuzzing,” arXiv:1711. 04596, 2017.
88. A. Radford, L. Metz and S. Chintala, “Unsupervised representation learning with deep convolutional generative adversarial networks,” arXiv:1511. 06434, 2015.
89. Generating text via adversarial training
90. SeqGAN: Sequence generative adversarial nets with policy gradient
91. N. Nichols, M. Raugas, R. Jasper and N. Hilliard, “Faster fuzzing: Reinitialization with deep neural models,” arXiv:1711.02807, 2017.
92. GANFuzz: A GAN-based industrial network protocol fuzzing framework
93. Reinforcement learning: An introduction10.1109/TNN.2004.842673 ↗
94. CGFuzzer: A fuzzing approach based on coverage-guided generative adversarial networks for industrial IoT protocols10.1109/JIOT.2022.3183952 ↗
95. ICS protocol fuzzing: Coverage guided packet crack and generation
96. Fuzz testing data generation for network protocol using classification tree
97. A deep convolution generative adversarial networks based fuzzing framework for industry control protocols10.1007/s10845-020-01584-z ↗
98. Web Application Security Consortium Glossary, 2023. [Online]. Available: http://www.webappsec.org/projects/ (accessed on 26/03/2023)
99. A survey on web application security10.32628/CSEIT206543 ↗
100. Enemy of the state: A state-aware black-box web vulnerability scanner