Survey of Automatic Software Vulnerability Exploitation

Wu Zehui; Wei Qiang; Wang Xinlei; Wang Yunchao; Yan Chenyu; Chen Jing

doi:10.7544/issn1000-1239.202220410

Journal of Computer Research and Development > 2024 > 61(9): 2261-2274. > DOI: 10.7544/issn1000-1239.202220410 CSTR: 32373.14.issn1000-1239.202220410

Wu Zehui, Wei Qiang, Wang Xinlei, Wang Yunchao, Yan Chenyu, Chen Jing. Survey of Automatic Software Vulnerability Exploitation[J]. Journal of Computer Research and Development, 2024, 61(9): 2261-2274. DOI: 10.7544/issn1000-1239.202220410

Citation:

PDF (1780 KB)

Survey of Automatic Software Vulnerability Exploitation

1.
State Key Laboratory of Mathematical Engineering and Advanced Computing (Strategic Support Force Information Engineering University ), Zhengzhou 450001
2.
School of Cyber Science and Engineering, Zhengzhou University, Zhengzhou 450001

Funds: This work was supported by the National Key Research and Development Program of China (2019QY0501).

More Information

Author Bio:
Wu Zehui: born in 1988. PhD, lecturer. His mian research interest includes software and system vulnerability analysis

Wei Qiang: born in 1979. PhD, professor, PhD supervisor. His main research interests include software security analysis and industrial control system security

Wang Xinlei: born in 1990. Bachelor, assistant engineer. Her main research interest includes software security analysis

Wang Yunchao: born in 1992. PhD, lecturer. His main research interest includes software and system vulnerability analysis

Yan Chenyu: born in 1996. Master, teaching assistant. Her main research interest includes software security analysis

Chen Jing: born in 1999. Master. Her main research interest includes software security analysis
Received Date: May 20, 2022
Revised Date: December 18, 2023
Accepted Date: March 05, 2024
Available Online: March 06, 2024

Graphical Abstract

Abstract

Abstract

In recent years, the number of software vulnerabilities has increased sharply and its harmfulness has aroused widespread concern in society. Compiling vulnerability utilization code accurately, efficiently and quickly is the key to vulnerability damage assessment and vulnerability repairment. At present, the vulnerability exploitation code mainly relies on manual analysis and writing, which is inefficient. Therefore, how to realize automatic vulnerability exploitation code generation (AEG) is a hotspot and difficulty in software security research field. In this paper, we analyze the representative achievements in this field in recent 30 years. Firstly, we divide the vulnerability automatic utilization process into four typical segments: vulnerability root location, reachable path search, vulnerability primitive generation and utilization code generation. After that we sort out and select the typical work of the above achievements from the three perspectives of human-machine boundary, attack and defense game, and common basic technology. And on this basis, we define the key points, difficulties and phased achievements of the current research. Finally, from the gap between the existing achievements and the practical application of automatic exploit generation, we discuss the bottleneck problems existing in the current research, the future development trend of AEG, and the next research points we should focus on.
- software security,
- vulnerability analysis,
- automatic exploit,
- exploit generation,
- vulnerability root cause

FullText(HTML)

References (74)

References

[1]	Lu Hui, Jin Chengjie, Helu Xiaohan, et al. Research on intelligent detection of command level stack pollution for binary program analysis[J]. Mobile Networks and Applications, 2021(4): 1723−1732
[2]	Hu Ning, Tian Zhihong, Lu Hui, et al. A multiple-kernel clustering based intrusion detection scheme for 5G and IoT networks[J]. International Journal of Machine Learning and Cybernetics, 2021, 12(11): 1−16
[3]	Pan Menghai, Huang Weixiao, Li Yanhua, et al. DHPA: Dynamic human preference analytics framework: A case study on taxi drivers’ learning curve analysis[J]. ACM Transactions on Intelligent Systems, 2020, 11(1): 1−19
[4]	One A. Smashing the stack for fun and profit[J]. Phrack Magazine, 1996, 7(49): 14−16
[5]	Brumley D, Poosankam P, Song D, et al. Automatic patch-based exploit generation is possible: Techniques and implications[C]//Proc of the 2008 IEEE Symp on Security and Privacy. Piscataway, NJ: IEEE, 2008: 143−157
[6]	Heelan S. Automatic generation of control flow hijacking exploits for software vulnerabilities[D]. Oxford, UK: University of Oxford , 2009
[7]	Cha S K, Avgerinos T, Rebert A, et al. Unleashing Mayhem on binary code[C]//Proc of the 2012 IEEE Symp on Security and Privacy. Piscataway, NJ: IEEE, 2012: 380−394
[8]	Wang Minghua, Su Purui, Li Qi, et al. Automatic polymorphic exploit generation for software vulnerabilities[C]//Proc of the 9th Int Conf on Security and Privacy in Communication Systems. Berlin: Springer, 2013: 216−233
[9]	Avgerinos T, Cha S K, Rebert A, et al. Automatic exploit generation[J]. Communications of the ACM, 2014, 57(2): 74−84 doi: 10.1145/2560217.2560219
[10]	Hu Hong, Zheng Leongchua, Adrian S, et al. Automatic generation of data-oriented exploits[C]//Proc of the 24th USENIX Security Symp. Berkeley, CA: USENIX Association, 2015: 177−192
[11]	Schwartz E J, Avgerinos T, Brumley D. Q: Exploit hardening made easy[C]//Proc of the 20th USENIX Security Symp. Berkeley, CA: USENIX Association, 2011: 25−41
[12]	Huang S K, Huang M H, Huang P Y, et al. CRAX: Software crash analysis for automatic exploit generation by modeling attacks as symbolic continuations[C]//Proc of the 6th IEEE Int Conf on Software Security and Reliability. Piscataway, NJ: IEEE, 2012: 78−87
[13]	He Liang, Cai Yan, Hu Hong, et al. Automatically assessing crashes from heap overflows[C]//Proc of the 32nd IEEE/ACM Int Conf on Automated Software Engineering (ASE). Piscataway, NJ: IEEE, 2017: 274−279
[14]	Wang Yan, Zhang Chao, Xiang Xiaobo, et al. Revery: From proof-of-concept to exploitable[C]//Proc of the 2018 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2018: 1914−1927
[15]	李超,胡建伟,崔艳鹏. 基于符号执行的缓冲区溢出漏洞自动化利用[J]. 计算机应用与软件,2019,36(9):327−333 Li Chao, Hu Jianwei, Cui Yanpeng. Automated exploitation of buffer overflow vulnerabilities based on symbolic execution[J]. Computer Application and Software, 2019, 36(9): 327−333(in Chinese)
[16]	Wu Wei, Chen Yueqi, Xu Jun, et al. FUZE: Towards facilitating exploit generation for kernel use-after-free vulnerabilities[C]//Proc of the 27th USENIX Security Symp. Berkeley, CA: USENIX Association, 2018: 781−797
[17]	Chen Yueqi, Lin Zhenpeng, Xing Xinyu. A systematic study of elastic objects in kernel exploitation[C]//Proc of the 2020 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2020: 1165−1184
[18]	Liguori P, Al-Hossami E, Cotroneo D, et al. Shellcode_IA32: A dataset for automatic shellcode generation[J]. arXiv preprint, arXiv: 2104.13100, 2021
[19]	Yang Guang, Chen Xiang, Zhou Yanlin, et al. DualSC: Automatic generation and summarization of shellcode via transformer and dual learning[C]//Proc of the 29th IEEE Int Conf on Software Analysis Evolution and Reengineering (SAER 2022). Piscataway, NJ: IEEE, 2022: 361−372
[20]	Lu Hui, Jin Chengjie, Helu Xiaohan, et al. AutoD: Intelligent blockchain application unpacking based on JNI layer deception call[J]. IEEE Network, 2020, 35(2): 215−221
[21]	Khandait P, Hubballi N, Mazumdar B. IoTHunter: IoT network traffic classification using device specific keywords[J]. IET Networks, 2021, 10(2): 59−75 doi: 10.1049/ntw2.12007
[22]	Martin M C, Lam M S. Automatic generation of XSS and SQL injection attacks with goal-directed model checking[C]//Proc of the 17th USENIX Security Symp. Berkeley, CA: USENIX Association, 2008: 31−44
[23]	MICROFOST. The history of the !exploitable crash analyzer[EB/OL]. 2009[2023-10-15]. http://blogs.technet.com/b/srd/archive/2009/04/08/the-history-of-the-exploitable-crash-analyzer/
[24]	Miller C, Caballero J, Johnson N M, et al. Crash analysis with BitBlaze[J/OL]. 2010[2022-08-07]. https://media.blackhat.com/bh-us-10/whitepapers/Miller/BlackHat-USA-2010-CMiller-BitBlaze-wp.pdf
[25]	Bisht P, Hinrichs T, Skrupsky N, et al. WAPTEC: Whitebox analysis of web applications for parameter tampering exploit construction[C]//Proc of the 18th ACM Conf on Computer and Communications Security. New York: ACM, 2011: 575−586
[26]	Huang S K, Lu H L, Leong W M, et al. Craxweb: Automatic web application testing and attack generation[C]//Proc of the 7th IEEE Int Conf on Software Security and Reliability. Piscataway, NJ: IEEE, 2013: 208−217
[27]	李晓琦,刘奇旭,张玉清. 基于模拟攻击的内核提权漏洞自动利用系统[J].中国科学院大学学报,2015,32(3):384-390 Li Xiaoqi, Liu Qixu, Zhang Yuqing. An automatic exploit system for kernel power lifting vulnerabilities based on simulated attacks[J]. Journal of the University of Chinese Academy of Sciences, 2015, 32(3): 384−390 (in Chinese)
[28]	Zhang Puhan, Wu Jianxiong, Wang Xin, et al. Program crash analysis based on taint analysis[C]//Proc of the 9th Int Conf on P2P, Parallel, Grid, Cloud and Internet Computing. Piscataway, NJ: IEEE, 2014: 492−498
[29]	Do Q H, Bubel R, Hähnle R. Exploit generation for information flow leaks in object-oriented programs[C]//Proc of the 30th Int Information Security and Privacy Conf. Berlin: Springer, 2015: 401−415
[30]	Ruffell M, Hong J B, Kim H, et al. Towards automated exploit generation for embedded systems[C]//Proc of the 17th Int Workshop on Information Security Applications. Berlin: Springer, 2016: 161−173
[31]	Alhuzali A, Eshete B, Gjomemo R, et al. Chainsaw: Chained automated workflow-based exploit generation[C]//Proc of the 2016 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2016: 641−652
[32]	Hu Hong, Shinde S, Adrian S, et al. Data-oriented programming: On the expressiveness of non-control data attacks[C]//Proc of the 2016 IEEE Symp on Security and Privacy (SP). Piscataway, NJ: IEEE, 2016: 969−986
[33]	Shoshitaishvili Y, Wang Ruoyu, Salls C, et al. Sok: State of the art of war: Offensive techniques in binary analysis[C]//Proc of the 2016 IEEE Symp on Security and Privacy. Piscataway, NJ: IEEE, 2016: 138−157
[34]	Luo Lannan, Zeng Qiang, Cao Chen, et al. System service call-oriented symbolic execution of android framework with applications to vulnerability discovery and exploit generation[C]//Proc of the 15th Annual Int Conf on Mobile Systems, Applications, and Services. New York: ACM, 2017: 225−238
[35]	Repel D, Kinder J, Cavallaro L. Modular synthesis of heap exploits[C]//Proc of the 2017 Workshop on Programming Languages and Analysis for Security. New York: ACM, 2017: 25−35
[36]	Brooks T N. Survey of automated vulnerability detection and exploit generation techniques in cyber reasoning systems[C]//Proc the 2018 Science and Information Conf. Berlin: Springer, 2018: 1083−1102
[37]	万云鹏,邓艺,石东辉,等. 基于符号执行的自动利用生成系统[J]. 计算机系统应用,2017,26(10):44−52 Wan Yunpeng, Deng Yi, Shi Donghui, et al. Automatic utilization generation system based on symbolic execution[J]. Computer Systems Applications, 2017, 26(10): 44−52 (in Chinese)
[38]	Garcia J, Hammad M, Ghorbani N, et al. Automatic generation of inter-component communication exploits for Android applications[C]//Proc of the 11th Joint Meeting on Foundations of Software Engineering. New York: ACM, 2017: 661−671
[39]	Bao T, Wang Ruoyu, Shoshitaishvili Y, et al. Your exploit is mine: Automatic shellcode transplant for remote exploits[C]//Proc of the 2017 IEEE Symp on Security and Privacy(SP). Piscataway,NJ:IEEE,2017:824−839
[40]	Lu Kangjie, Walter M T, Pfaff D, et al. Unleashing use-before-initialization vulnerabilities in the Linux kernel using targeted stack spraying[C]//Proc of 2017 Network and Distributed System Security Symp. San Diego, CA: Internet Society, 2017: 125−136
[41]	Xu Luhang, Jia Weixi, Dong Wei, et al. Automatic exploit generation for buffer overflow vulnerabilities[C]//Proc of the 2018 IEEE Int Conf on Software Quality, Reliability and Security Companion (QRS-C). Piscataway, NJ: IEEE, 2018: 463−468
[42]	Krupp J, Rossow C. teEther: Gnawing at ethereum to automatically exploit smart contracts[C]//Proc of the 27th USENIX Security Symp. Berkeley, CA: USENIX Association, 2018: 1317−1333
[43]	Zhang Rui, Deutschbein C, Huang Peng, et al. End-to-end automated exploit generation for validating the security of processor designs[C]//Proc of the 51st Annual IEEE/ACM Int Symp on Microarchitecture (MICRO). Piscataway, NJ: IEEE, 2018: 815−827
[44]	Liu Danjun, Wang Jingyuan, Rong Zelin, et al. Pangr: A behavior-based automatic vulnerability detection and exploitation framework[C]//Proc of the 17th IEEE Int Conf on Trust, Security and Privacy in Computing and Communications. Piscataway, NJ: IEEE, 2018: 705−712
[45]	Alhuzali A, Gjomemo R, Eshete B, et al. NAVEX: Precise and scalable exploit generation for dynamic web applications[C]//Proc of the 27th USENIX Security Symp. Berkeley, CA: USENIX Association, 2018: 377−392
[46]	Heelan S, Melham T, Kroening D. Automatic heap layout manipulation for exploitation[C]//Proc of the 27th USENIX Security Symp. Berkeley, CA: USENIX Association, 2018: 763−779
[47]	Garmany B, Stoffel M, Gawlik R, et al. Towards automated generation of exploitation primitives for web browsers[C]//Proc of the 34th Annual Computer Security Applications Conf. New York: ACM, 2018: 300−312
[48]	Ispoglou K K, AlBassam B, Jaeger T, et al. Block oriented programming: Automating data-only attacks[C]//Proc of the 2018 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2018: 1868−1882
[49]	Zhou Mingsong, Zeng Fanping, Zhang Yu, et al. Automatic generation of capability leaks’ exploits for Android applications[C]//Proc of the 2019 IEEE Int Conf on Software Testing, Verification and Validation Workshops (ICSTW). Piscataway, NJ: IEEE, 2019: 291−295
[50]	Huang Ning, Huang Shuguang, Chang Chao. Analysis to heap overflow exploit in Linux with symbolic execution[C]//Proc of the 2019 IOP Conf Series: Earth and Environmental Science. Bristol: IOP Publishing, 2019: 4−20
[51]	Jan S, Panichella A, Arcuri A, et al. Automatic generation of tests to exploit XML injection vulnerabilities in web applications[J]. IEEE Transactions on Software Engineering, 2017, 45(4): 335−362
[52]	方皓,吴礼发,吴志勇. 基于符号执行的 return-to-dl-resolve 利用代码自动生成方法[J]. 计算机科学,2019,46(2):127−132 doi: 10.11896/j.issn.1002-137X.2019.02.020 Fang Hao, Wu Lifa, Wu Zhiyong. A symbolic execution-based return-to-dl-resolve approach for automatic code generation using[J]. Computer Science, 2019, 46(2): 127−132 (in Chinese) doi: 10.11896/j.issn.1002-137X.2019.02.020
[53]	Chen Yueqi, Xing Xinyu. Slake: Facilitating slab manipulation for exploiting vulnerabilities in the Linux kernel[C]//Proc of the 2019 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2019: 1707−1722
[54]	Wu Wei, Chen Yueqi, Xing Xinyu, et al. KEPLER: Facilitating control-flow hijacking primitive evaluation for Linux kernel vulnerabilities[C]//Proc of the 28th USENIX Security Symp. Berkeley, CA: USENIX Association, 2019: 1187−1204
[55]	Heelan S, Melham T, Kroening D. Gollum: Modular and greybox exploit generation for heap overflows in interpreters[C]//Proc of the 2019 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2019: 1689−1706
[56]	Wei Yuan, Luo Senlin, Zhuge Jianwei, et al. ARG: Automatic ROP chains generation[J]. IEEE Access, 2019, 7: 120152−120163 doi: 10.1109/ACCESS.2019.2937585
[57]	Moscovich N, Bitton R, Mallah Y, et al. Autosploit: A fully automated framework for evaluating the exploitability of security vulnerabilities[J]. arXiv preprint, arXiv: 2007.00059, 2020
[58]	Schwartz E J, Cohen C F, Gennari J S, et al. A generic technique for automatically finding defense-aware code reuse attacks[C]//Proc of the 2020 ACM SIGSAC Conf on Computer and Communications Security. New York: ACM, 2020: 1789−1801
[59]	Chen Weiteng, Zou Xiaochen, Li Guoren, et al. KOOBE: Towards facilitating exploit generation of kernel out-of-bounds write vulnerabilities[C]//Proc of the 29th USENIX Security Symp. Berkeley, CA: USENIX Association, 2020: 1093−1110
[60]	Chae S, Jin Hongjoo, Park M C, et al. HS-Pilot: Heap security evaluation tool model based on atomic heap interaction[J]. IEEE Access, 2020, 8: 201914−201924 doi: 10.1109/ACCESS.2020.3036118
[61]	Zhao Zixuan, Wang Yan, Gong Xiaorui. HAEPG: An automatic multi-hop exploitation generation framework[C]//Proc the 17th Int Conf on Detection of Intrusions and Malware, and Vulnerability Assessment. Berlin: Springer, 2020: 89−109
[62]	Yilmaz F, Sridhar M, Choi W. Guide me to exploit: Assisted ROP exploit generation for actionscript virtual machine[C]//Proc of the 2020 Annual Computer Security Applications Conf. New York: ACM, 2020: 386−400
[63]	Yun I, Kapil D, Kim T. Automatic techniques to systematically discover new heap exploitation primitives[C]//Proc of the 29th USENIX Security Symp. Berkeley, CA: USENIX Association, 2020: 1111−1128
[64]	Blazytko T, Schlögel M, Aschermann C, et al. AURORA: Statistical crash analysis for automated root cause explanation[C]//Proc of the 29th USENIX Security Symp. Berkeley, CA: USENIX Association, 2020: 235−252
[65]	Deng Fenglei, Wang Jian, Zhang Bin, et al. A pattern-based software testing framework for exploitability evaluation of metadata corruption vulnerabilities[J]. Scientific Programming, 2020, 5(10): 1−21
[66]	Lee Y, Min C, Lee B. EXPRACE: Exploiting kernel races through raising interrupts[C]//Proc of the 30th USENIX Security Symp. Berkeley, CA: USENIX Association, 2021: 2363−2380
[67]	马湘宁,张兆庆,冯晓兵,等. 二进制翻译中的过程恢复技术[J]. 计算机工程与应用,2002,38(19):1−5 doi: 10.3321/j.issn:1002-8331.2002.19.001 Ma Xiangning, Zhang Zhaoqing, Feng Xiaobing, et al. Process recovery techniques in binary translation[J]. Computer Engineering and Applications, 2002, 38(19): 1−5 (in Chinese) doi: 10.3321/j.issn:1002-8331.2002.19.001
[68]	付文,魏博,张天雷,等. 过程恢复技术在IA64二进制翻译中的应用与实现[J]. 计算机工程与应用,2006,42(21):81−83 Fu Wen, Wei Bo, Zhang Tianlei, et al. Application and implementation of process recovery techniques in IA64 binary translation[J]. Computer Engineering and Applications, 2006, 42(21): 81−83 (in Chinese)
[69]	方霞,尹青,蒋烈辉,等. 基于数据流分析的寄存器参数恢复方法[J]. 计算机工程,2009,35(22):62−64 Fang Xia, Yin Qing, Jiang Liehui, et al. A data flow analysis based register parameter recovery method[J]. Computer Engineering, 2009, 35(22): 62−64 (in Chinese)
[70]	Wang Ruipeng, Pan Zulie, Shi Fan, et al. AEMB: An automated exploit mitigation bypassing solution[J]. Applied Sciences, 2021, 11(20): 9727−9728 doi: 10.3390/app11209727
[71]	Ispoglou K K, Austin D, Mohan V, et al. FuzzGen: Automatic Fuzzer generation[C]//Proc of the 29th USENIX Conf on Security Symp. Berkeley, CA: USENIX Association, 2020: 2271−2287
[72]	Zhang Hangwei, Lu Kai, Zhou Xu, et al. SIoTFuzzer: Fuzzing Web interface in IoT firmware via stateful message generation[J]. Applied Sciences, 2021, 11(7): 3120−3121 doi: 10.3390/app11073120
[73]	Wang Yan, Zhang Chao, Zhao Zixuan, et al. MAZE: Towards automated heap feng shui[C]//Proc of the 2021 USENIX Security Symp. Berkeley, CA: USENIX Association, 2021: 1647−1664
[74]	Kang Xiyu, Debray S. A framework for automatic exploit generation for JIT compilers[C]//Proc of the 2021 Research on Offensive and Defensive Techniques in the Context of Man at the End (MATE) Attacks. New York: ACM, 2021: 11−19

[1]	Xia Sibo, Ma Minghua, Jin Pengxiang, Cui Liyue, Zhang Shenglin, Jin Wa, Sun Yongqian, Pei Dan. Response Time Anomaly Diagnosis for Search Service[J]. Journal of Computer Research and Development, 2024, 61(6): 1573-1584. DOI: 10.7544/issn1000-1239.202330054
[2]	Zhang Yiwen, Cui Guangming, Yan Yuanting, Zhao Shu, Zhang Yanping. Quality Constraints-Aware Service Composition Based on Task Granulating[J]. Journal of Computer Research and Development, 2018, 55(6): 1345-1355. DOI: 10.7544/issn1000-1239.2018.20170234
[3]	Wan Changlin, Shi Zhongzhi, Hu Hong, Zhang Dapeng. QoS-Aware Semantic Web Service Modeling and Discovery[J]. Journal of Computer Research and Development, 2011, 48(6): 1059-1066.
[4]	Yang Yahui, Niu Zhenying, Xu Ke. Optimizing Design of Server Deployment in P2P Streaming System[J]. Journal of Computer Research and Development, 2010, 47(7): 1219-1224.
[5]	Deng Xiaopeng, Xing Chunxiao, Zhang Yong, Cai Lianhong. A QoS-Oriented Approach for Web Service Group Testing[J]. Journal of Computer Research and Development, 2009, 46(8): 1285-1293.
[6]	Yue Kun, Liu Weiyi, Wang Xiaoling, Li Jin. An Approach for Measuring Quality of Web Services Based on the Superposition of Uncertain Factors[J]. Journal of Computer Research and Development, 2009, 46(5): 841-849.
[7]	Tang Lei, Liao Yuan, Li Mingshu, Huai Xiaoyong. The Dynamic Deployment Problem and the Algorithm of Service Component for Pervasive Computing[J]. Journal of Computer Research and Development, 2007, 44(5): 815-822.
[8]	Hu Chunming, Huai Jinpeng, and Wo Tianyu. Flexible Resource Capacity Reservation Mechanism for Service Grid Using Slack Time[J]. Journal of Computer Research and Development, 2007, 44(1): 20-28.
[9]	Xu Mingwei, Hu Chunming, Liu Xudong, and Ma Dianfu. Research and Implementation of Web Service Differentiated QoS[J]. Journal of Computer Research and Development, 2005, 42(4): 669-675.
[10]	Li Zhendong and Xie Li. Research on Ensuring QoS and Its Admission Control in Web Servers[J]. Journal of Computer Research and Development, 2005, 42(4): 662-668.

Cited By

Cited by

Periodical cited type(10)

1.	陶蔚，陇盛，刘鑫，胡亚豪，黄金才. 深度学习步长自适应动量优化方法研究综述. 小型微型计算机系统. 2025(02): 257-265 .
2.	张泽东，陇盛，鲍蕾，陶卿. 基于AdaBelief的Heavy-Ball动量方法. 模式识别与人工智能. 2022(02): 106-115 .
3.	陇盛，陶蔚，张泽东，陶卿. 基于AdaGrad的自适应NAG方法及其最优个体收敛性. 软件学报. 2022(04): 1231-1243 .
4.	曲军谊. 基于对偶平均的动量方法研究综述. 计算机与数字工程. 2022(11): 2443-2448 .
5.	曲军谊，鲍蕾，陶卿. 非光滑凸问题投影型对偶平均优化方法的个体收敛性. 模式识别与人工智能. 2021(01): 25-32 .
6.	黄鉴之，陇盛，陶卿. 自适应策略下Heavy-Ball型动量法的最优个体收敛速率. 模式识别与人工智能. 2021(02): 137-145 .
7.	李兴怡，岳洋. 梯度下降算法研究综述. 软件工程. 2020(02): 1-4 .
8.	丁成诚，陶蔚，陶卿. 一种三参数统一化动量方法及其最优收敛速率. 计算机研究与发展. 2020(08): 1571-1580 . 本站查看
9.	鲁淑霞，蔡莲香，张罗幻. 基于动量加速零阶减小方差的鲁棒支持向量机. 计算机工程. 2020(12): 88-95+104 .
10.	黄鉴之，丁成诚，陶蔚，陶卿. 非光滑凸情形Adam型算法的最优个体收敛速率. 智能系统学报. 2020(06): 1140-1146 .