## 1 Introduction  
The appearance of an increasing number of software vulnerabilities has made automatic vulnerability detection technology a widespread concern in industry and academia. The main technology used in automatic vulnerability detection is fuzzing, the principle of which is shown in Figure 1. The core component of fuzzing is the sample generator. It generates many mutated samples, and then sends them to the target program for execution. These mutated samples will greatly expand their execution behavior in the program, which may meet the constraint requirements of the sample behavior that the vulnerability be triggered. One type of the most serious vulnerabilities, memory corruption vulnerability, will be exposed in the form of program crashes in this process. Early fuzzing technology [1, 2] implemented non-oriented fuzzing, which randomly mutates samples, including randomly adding, deleting and flipping bytes in the sample. This process does not adjust the mutation strategy of subsequent samples by returning the runtime information of previous tests, and the deep logic of the program cannot be executed because most of the generated samples are invalid due to the destroyed format of the samples by this kind of random mutation. Technology to restrict the sample format has been applied to fuzzing [3, 4, 5, 6, 7, 8] to greatly increase the number of valid samples, but the efficiency of fuzzing technology is low because the runtime state of the program cannot be perceived to adjust the fuzzing strategy. In contrast to non-oriented fuzzing, coverage-oriented fuzzing [9, 10, 11, 12, 13] can use lightweight instrumentation to obtain the runtime information of the program to effectively guide the fuzzing process to pursue high coverage in control flow graph (CFG). For example, by selecting the sample with a new edge as the seed sample for the next round of mutations, the execution of the sample will have a greater possibility of obtaining high coverage [9; 10; 11]; coverage-oriented fuzzing can also use heavyweight instrumentation to perform dynamic symbol execution [14; 15; 16; 17; 18; 19; 20; 21]. This approach transforms external data into symbols to participate in the execution, collects the symbol expressions at each program node, and generates samples that try to execute the full path by solving the expressions. Dynamic symbol execution can fully perceive the state of the program, but it is difficult to solve the expressions when they are overly complex. In addition, the problem of path explosion [22] is difficult to solve. Coverage-oriented fuzzing [9; 10; 11; 23; 24; 25; 26; 27; 28] increases the probability of triggering vulnerabilities by executing code blocks or paths as much as possible. However, it causes a large quantity of computational resources to be allocated to code that does not have vulnerabilities. Target-oriented fuzzing [29; 30; 31; 32] leads the test path to suspected vulnerable points by taking the samples close to the vulnerable point as the seed samples of the next mutation or solving the symbolic expression of the path to the vulnerable point. Although target-oriented fuzzing provides a clearer goal, the generated test samples do not effectively approach the goal because the guidance algorithm of the fuzzing and the sample mutation strategy are independent of each other, which results in a poor guidance effect. Moreover, the blindness of the random mutations results in a weak penetration ability of the samples to deeper program logic, and it is difficult to generate samples using dynamic symbol execution technology when the program is complex. In this paper, we transform fuzzing into a mathematical optimization problem by leveraging particle swarm optimization (PSO) [33], which learns the high-quality characteristics of all the samples in the whole time and generates many samples that can be executed to the target point. Additionally, we use format constraint technology to enhance the penetration ability of the samples in the program and improve the probability of trigger vulnerabilities.