The DOI matches its Crossref record; 111 of the 111 references it cites were found in a registry or an index.
Fuzzing: A Survey for Roadmap
Abstract
Fuzz testing (fuzzing) has witnessed its prosperity in detecting security flaws recently. It generates a large number of test cases and monitors the executions for defects. Fuzzing has detected thousands of bugs and vulnerabilities in various applications. Although effective, there lacks systematic analysis of gaps faced by fuzzing. As a technique of defect detection, fuzzing is required to narrow down the gaps between the entire input space and the defect space. Without limitation on the generated inputs, the input space is infinite. However, defects are sparse in an application, which indicates that the defect space is much smaller than the entire input space. Besides, because fuzzing generates numerous test cases to repeatedly examine targets, it requires fuzzing to perform in an automatic manner. Due to the complexity of applications and defects, it is challenging to automatize the execution of diverse applications. In this article, we systematically review and analyze the gaps as well as their solutions, considering both breadth and depth. This survey can be a roadmap for both beginners and advanced developers to better understand fuzzing.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
A Mathematical Theory of Communication
Shannon, C. E. (1948) · Bell System Technical Journal · doi:10.1002/j.1538-7305.1948.tb01338.x · Cited by 88,486
Kennedy, J., & Eberhart, R. (2002) · Proceedings of ICNN'95 - International Conference on Neural Networks · doi:10.1109/icnn.1995.488968 · Cited by 58,192
Wold, S., Esbensen, K., & Geladi, P. (1987) · Chemometrics and Intelligent Laboratory Systems · doi:10.1016/0169-7439(87)80084-9 · Cited by 11,606
de Moura, L., & Bjørner, N. (2008) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-78800-3_24 · Cited by 6,595
Metropolis, N., & Ulam, S. (1949) · Journal of the American Statistical Association · doi:10.1080/01621459.1949.10483310 · Cited by 6,474 · cited 1×
“At the beginning of fuzzing, the transition probabilities can be obtained by the Monte Carlo method [125], which examines basic blocks randomly.”
MethodFinite-time Analysis of the Multiarmed Bandit Problem
Auer, P., Cesa-Bianchi, N., & Fischer, P. (2002) · Machine Learning · doi:10.1023/a:1013689704352 · Cited by 6,033
Recurrent neural network based language model
Mikolov, T., Karafiát, M., Burget, L., Černocký, J., & Khudanpur, S. (2010) · Interspeech 2010 · doi:10.21437/interspeech.2010-343 · Cited by 5,390
Understanding the Metropolis-Hastings Algorithm
Chib, S., & Greenberg, E. (1995) · The American Statistician · doi:10.1080/00031305.1995.10476177 · Cited by 4,145
Implementing fault-tolerant services using the state machine approach: a tutorial
Schneider, F. B. (1990) · ACM Computing Surveys · doi:10.1145/98163.98167 · Cited by 2,387
Coverage‐based rarefaction and extrapolation: standardizing samples by completeness rather than size
Chao, A., & Jost, L. (2012) · Ecology · doi:10.1890/11-1952.1 · Cited by 2,213
Cited by
Detecting Vulnerability on IoT Device Firmware: A Survey
Feng, X., Zhu, X., Han, Q.-L., Zhou, W., Wen, S., & Xiang, Y. (2023) · IEEE/CAA Journal of Automatica Sinica · doi:10.1109/jas.2022.105860 · Cited by 185
Self-citationInsider threat detection using supervised machine learning algorithms
Manoharan, P., Yin, J., Wang, H., Zhang, Y., & Ye, W. (2024) · Telecommunication Systems · doi:10.1007/s11235-023-01085-3 · Cited by 34
LLM-Boofuzz: Generation-Based Black-Box Fuzzing for Network Protocols via LLMs
Wang, T., Li, Y., Pan, Z., Chen, Q., Li, Z., Zhang, Y., Shen, Y., Hu, M., & Chen, Q. (2025) · Electronics · doi:10.3390/electronics14234550 · Cited by 5
ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks?
Wang, Z., Schiller, N., Li, H., Narayana, S. S., Nasr, M., Carlini, N., Qi, X., Wallace, E., Bursztein, E., Invernizzi, L., et al. (2026) · arXiv · doi:10.48550/arxiv.2605.11086 · Cited by 3
Establishing Best Practices for Building Rigorous Agentic Benchmarks
Zhu, Y., Jin, T., Pruksachatkun, Y., Zhang, A., Liu, S., Cui, S., Kapoor, S., Longpre, S., Meng, K., Weiss, R., et al. (2025) · arXiv · doi:10.48550/arxiv.2507.02825 · Cited by 2
Metadata
- Authors
- Zhu, X., Wen, S., Camtepe, S., & Xiang, Y.
- Venue
- ACM Computing Surveys
- Published
- 2022-01-31
- Volume
- 54
- Issue
- 11s
- Pages
- 1-36
- ISSN
- 0360-0300 (ISSN-L)
- 1557-7341
- OpenAlex
- W4210660460
- Cited by
- 334
- References
- 111
- FWCI
- 135.74
- Type
- journal article
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Fuzzing: A Survey for Roadmap. https://app.cochat.ai/papers/10.1145/3512345
- The paper
- Zhu, X., Wen, S., Camtepe, S., & Xiang, Y. (2022). Fuzzing: A Survey for Roadmap. ACM Computing Surveys. https://doi.org/10.1145/3512345
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
