A preliminary taxonomy of techniques used in software fuzzing

Abstract

Software fuzzing is a testing technique, which generates erroneous and random input to a software so that the software of interest can be monitored for exceptions such as crashes [1]. Both in the open source software (OSS) and proprietary domain, fuzzing has been widely used to explore software vulnerabilities. For example, information technology (IT) organizations such as Google1 and Microsoft2 use software fuzzing as part of the software development process. As of Jan 2019, GitHub hosts 2,915 OSS repositories related to fuzzing3.