## 2 Related Work
### Coverage-Oriented Fuzzing  
Coverage-oriented fuzzing has become a predominant technology because it can automatically detect vulnerability in software without human participation. The use of runtime information in different ways has encouraged considerable new development. On the basis of the degree of acquisition and use of state information in the process of program testing, coverage-oriented fuzzing can be divided into three categories: light use, heavy use and medium use. AFL [9] is a typical representative of light use of state information that leverages instrumentation technology to obtain path coverage information. This information is used to evaluate samples and guide tests to execute paths not executed. Some technologies have improved AFL, such as AFLFast [10] and EcoFuzz [25], which leverage the Markov model and a variant of the adversarial multi-armed band model to allocate excessive energy to seeds that separately exercise the low-frequency paths. EcoFuzz [25] achieves a better performance. VUzzer [23] presented an application-aware evolutionary fuzzing strategy to maximize coverage and explore deeper paths based on static and dynamic analysis. Its error-handling basicblock detection technique is similar to the technique to identify low-frequency based on the Markov model in AFLFast [10], albeit much lightweight. CollAFL [11] achieves greater path coverage by reducing path conflicts in AFL. MQPT [13] optimizes the selection of mutation operations to improve the path coverage using the PSO algorithm. Unlike MQPT, PSOFuzzer leverages the PSO algorithm to generate samples, while MQPT leverages the PSO algorithm to assist AFL in selecting the mutation algorithm. In addition, PSOFuzzer is a target-oriented fuzzer, while MQPT is a coverage-oriented fuzzer. AFL++ [28] integrates several fuzzing studies and provides a benchmark to assess other fuzzing technologies. Because AFL++ is built on coverage-oriented fuzzing systems, it is not suitable for evaluating PSOFuzzer. In addition, some fuzzing techniques have been applied to specific types of software vulnerability detection. HFL [21] applies hybrid fuzzing to kernel testing by converting indirect control transfers, inferring system call sequences and identifying nested argument types of system calls, and shows a higher coverage than Moonshine [36] and Syzkaller [37]. FuzzGen [24] achieved better code coverage in testing the library by whole system analysis to infer the library's interface. MUZZ [26] hunts more bugs than AFL under a multithreading context by three novel thread-aware instrumentations to engender runtime feedback to accentuate execution states caused by thread interleavings. [PERSON] [27] introduced human analysis to guide the fuzzer by an annotation mechanism, which systematically explores the program's behavior by the internal state of the program. it obtains a higher coverage and more crash than AFL. Fuzzing via heavy use of state information is based mainly on symbol execution. For example, SAGE [17] achieves greater code coverage by solving symbolic expressions on different program execution paths. S2E [15] and MAYHEM [16] are similar to SAGE [17]. S2E [15] uses path analyzers to drive the target system down all the execution paths of interest while checking the security properties of each path. MAYHEM [16] can not only automatically detect vulnerabilities by dynamic symbol execution, but also generate hijack exploits automatically. PANGOLIN [20] leverages polyhedral path abstraction to preserve the exploration state in the concolic execution stage to implement incremental fuzzing. QSYM [19] achieves a better performance than VUzzer [23] and Driller [18] by losing the strict soundness requirements of conventional concolic executors. Symbol execution relies on many computing resources and faces the problem of pathexplosion [22]. Therefore, it is not more practical than coverage-oriented fuzzing based on sample mutation [9; 10; 11; 12; 13]. The development of fuzzing also brings new ideas by the medium use of state information.