ISSN 1000-1239 CN 11-1777/TP

Journal of Computer Research and Development ›› 2021, Vol. 58 ›› Issue (5): 944-963.doi: 10.7544/issn1000-1239.2021.20201018

Special Issue: 2021人工智能安全与隐私保护技术专题

Previous Articles     Next Articles

A Review of Fuzzing Techniques

Ren Zezhong1, Zheng Han1, Zhang Jiayuan2, Wang Wenjie1, Feng Tao2, Wang He3, Zhang Yuqing1,3,4   

  1. 1(National Computer Network Intrusion Protection Center, University of Chinese Academy of Sciences, Beijing 101408);2(School of Computer and Communication, Lanzhou University of Technology, Lanzhou 730050);3(School of Cyber Engineering, Xidian University, Xi’an 710071);4(School of Computer Science and Cyberspace Security, Hainan University, Haikou 570228)
  • Online:2021-05-01
  • Supported by: 
    This work was supported by the National Key Research and Development Program of China (2018YFB0804701), the National Natural Science Foundation of China (U1836210, 61762060), and the Key Research and Development Program of the Science and Technology Department of Gansu Province of China (20YF3GA016).

Abstract: Fuzzing is a security testing technique, which is playing an increasingly important role, especially in detecting vulnerabilities. Fuzzing has experienced rapid development in recent years. A large number of new achievements have emerged, so it is necessary to summarize and analyze relevant achievements to follow fuzzing’s research frontier. Based on 4 top security conferences (IEEE S&P, USENIX Security, CCS, NDSS) about network and system security, we summarized fuzzing’s basic workflow, including preprocessing, input building, input selection, evaluation, and post-fuzzing. We discussed each link’s tasks, challenges, and the corresponding research results. We emphatically analyzed the fuzzing testing method based on coverage guidance, represented by the American Fuzzy Lop tool and its improvements. Using fuzzing testing technology in different fields will face vastly different challenges. We summarized the unique requirements and corresponding solutions for fuzzing testing in specific areas by sorting and analyzing the related literature. Mostly, we focused on the Internet of Things and the kernel security field because of their rapid development and importance. In recent years, the progress of anti-fuzzing testing technology and machine learning technology has brought challenges and opportunities to the development of fuzzing testing technology. These opportunities and challenges provide direction reference for the further research.

Key words: fuzzing, basic working process, IoT security, kernel security, machine learning

CLC Number: