  Among the many software vulnerability discovery techniques available today,
fuzzing has remained highly popular due to its conceptual simplicity, its low
barrier to deployment, and its vast amount of empirical evidence in discovering
real-world software vulnerabilities. At a high level, fuzzing refers to a
process of repeatedly running a program with generated inputs that may be
syntactically or semantically malformed. While researchers and practitioners
alike have invested a large and diverse effort towards improving fuzzing in
recent years, this surge of work has also made it difficult to gain a
comprehensive and coherent view of fuzzing. To help preserve and bring
coherence to the vast literature of fuzzing, this paper presents a unified,
general-purpose model of fuzzing together with a taxonomy of the current
fuzzing literature. We methodically explore the design decisions at every stage
of our model fuzzer by surveying the related literature and innovations in the
art, science, and engineering that make modern-day fuzzers effective.
