| 摘要: |
| 模糊测试是一种自动化的软件测试方法, 通过向目标软件系统输入大量自动生成的测试数据, 以发现系统潜在的安全漏洞、软件缺陷或异常行为. 然而, 传统模糊测试技术受限于自动化程度低、测试效率低、代码覆盖率低等因素, 无法应对现代的大型软件系统. 近年来, 大语言模型的迅猛发展不仅为自然语言处理领域带来重大突破, 也为模糊测试领域带来了新的自动化方案. 因此, 为了更好地提升模糊测试技术的效果, 现有的工作提出了多种结合大语言模型的模糊测试方法, 涵盖了测试输入生成、缺陷检测、后模糊处理等模块. 但是现有工作缺乏对基于大语言模型的模糊测试技术的系统性调研和梳理讨论, 为了填补上述综述方面的空白, 对现有的基于大语言模型的模糊测试技术的研究发展现状进行全面的分析和总结. 主要内容包括: (1)概述模糊测试的整体流程和模糊测试研究中常用的大语言模型相关技术; (2)讨论大模型时代之前的基于深度学习的模糊测试方法的局限性; (3)分析大语言模型在模糊测试方法中不同环节的应用方式; (4)探讨大语言模型技术在模糊测试中的主要挑战和今后可能的发展方向. |
| 关键词: 大语言模型 模糊测试 测试输入生成 缺陷检测 后模糊处理 |
| DOI：10.13328/j.cnki.jos.007323 |
| 分类号: |
| 基金项目:国家自然科学基金(61972373) |
|
| Survey on Fuzzing Based on Large Language Model |
|
LI Yan1, YANG Wen-Zhang2, ZHANG Yi1, XUE Yin-Xing2,3
|
|
1.School of Software Engineering, University of Science and Technology of China, Hefei 230026, China;2.School of Computer Science and Technology, University of Science and Technology of China, Hefei 230027, China;3.Suzhou Institute for Advanced Study, University of Science and Technology of China, Suzhou 215123, China
|
| Abstract: |
| Fuzzing, as an automated software testing method, aims to detect potential security vulnerabilities, software defects, or abnormal behaviors by inputting a large quantity of automatically generated test data into the target software system. However, traditional fuzzing techniques are restricted by such factors as low automation level, low testing efficiency, and low code coverage, being unable to handle modern large-scale software systems. In recent years, the rapid development of large language models has not only brought significant breakthroughs to the field of natural language processing but also introduced new automation solutions to the field of fuzzing. Therefore, to better enhance the effectiveness of fuzzing technology, existing works have proposed various fuzzing methods combined with large language models, covering modules like test input generation, defect detection, and post-fuzzing. Nevertheless, the existing works lack systematic investigation and discussion on fuzzing techniques based on large language models. To fill the above-mentioned gaps in the review, this study comprehensively analyzes and summarizes the current research and development status of fuzzing techniques based on large language models. The main contents include (1) summarizing the overall process of fuzzing and the relevant technologies related to large language models commonly used in fuzzing research; (2) discussing the limitations of deep learning based fuzzing methods before the era of large language model (LLM); (3) analyzing the application methods of large language models in different stages of fuzzing; (4) exploring the main challenges and possible future development directions of large language model technology in fuzzing. |
| Key words: large language model (LLM) fuzzing test input generation defect detection post-fuzzing |
