## 4 Fuzzing System Design
### Mapping Fuzzing to Particle Swarm  
To perform sample generation using the PSO algorithm, each element in the sample generation must be mapped with each element in the PSO algorithm. The PSO algorithm extracts the information of particles participating in the movement of a group, learns the information of the optimal sample, and updates the information for the other particles, which makes an evolutionary process from disorder to order in the problem-solving space to obtain the optimal solution. Assume that the number of particles in the swarm is \(n\); at iteration time \(t\), the coordinate position of each particle in \(d\)-dimensional space can be expressed as  
\[\bar{x_{i}}(t)=(x_{i}^{1},x_{i}^{2},\ldots,x_{i^{\prime}}^{j},\ldots,x_{i}^{d}) \tag{2}\]  
In fuzzing, \(\bar{x_{i}}(t)\) represents a specific sample generated at iteration \(t\), and \(x_{i}^{j}\) represents a byte in the sample. The speed of the particle is expressed as  
\[\bar{v_{i}}(t)=(v_{i}^{1},v_{i}^{2},\ldots,v_{i^{\prime}}^{j},\ldots,v_{i}^{d}) \tag{3}\]  
In fuzzing, \(\bar{v_{i}}(t)\) represents the direction of the sample change. The coordinate position \(\bar{x_{i}}(t)\) and speed \(\bar{v_{i}}(t)\) of a particle at time \(t+1\) are adjusted as follows:  
\[\bar{v_{i}}(t+1)=\omega\bar{v_{i}}(t)+c_{1}r_{1}(\bar{p_{i}}(t)-\bar{x_{i}}(t) )+c_{2}r_{2}(\bar{p_{g}}(t)-\bar{x_{i}}(t)) \tag{4}\]\[\bar{x}_{i}(t+1)=\bar{x}_{i}(t)+\bar{v}_{i}(t) \tag{5}\]  
In Formulas (2) and (5), \(\bar{x}_{i}(t)\) and \(\bar{x}_{i}(t+1)\) represent the previous and current particles, respectively. In fuzzing, these values represent a sample generated at the previous and current iterations. In Formulas (3) and (4), \(\bar{v}_{i}(t)\) and \(\bar{v}_{i}(t+1)\) represent the previous and current speeds of the particle, respectively. In fuzzing, they represent the direction of the sample change in the previous iteration and current iteration.  
Here, \(\omega\) represents the weight of the particle inertia, which encourages expansion of the search space and exploration of new search areas, but it might restrict the local fine search in the later iterations of the algorithm. In fuzzing, this value is set to a random number distributed in [0,1] to adjust the intensity of the current sample change.  
\(\bar{p}_{i}(t)\) represents the optimal position experienced by the particle, which is called the \"self-knowledge part\" of the particle and refers to the ability of the particle to learn from itself. In fuzzing, this value represents the sample closest to the target point in the mutation process of the \(i\)th initial sample.  
\(\bar{p}_{S}(t)\) represents the best particle position in the swarm, which indicates the ability of particles to learn from the whole swarm. In fuzzing, this value represents the sample closest to the target point from all the initial samples and generated samples.  
The parameters \(c_{1}\) and \(c_{2}\) represent the acceleration constants of the particles, which are usually taken to be [0,2]. Here, \(r_{1}\) and \(r_{2}\) are two random numbers that are uniformly distributed in [0,1].  
Through the analysis, we map all types of elements in fuzzing to each element in PSO to provide a theoretical basis for the use of PSO to generate samples that continuously approach the preset target points in the program via continuous iteration.