一句话：提出 SandBoxFuzz，用面向切面编程与运行时反射实现工业级微服务系统的可扩展灰盒模糊测试。
论文针对超大规模微服务金融科技系统测试中的难题：生产环境访问受限、依赖关系复杂、安全约束严苛。作者提出 SandBoxFuzz，一种可扩展的灰盒模糊测试技术，利用面向切面编程（AOP）与运行时反射实现动态规约挖掘，从而在受限环境中生成有针对性的输入。该技术还引入基于日志的覆盖率机制，并集成到构建流水线中，避免了在工业环境下常常不可行的运行时覆盖率探针代理。SandBoxFuzz 已在蚂蚁集团生产线上部署，相比基于当前最优模糊测试框架的初始方案，在其微服务软件中分支覆盖率提升 7.5%，额外发现 1850 个异常，环境搭建时间从数小时缩短到数分钟。作者已将工具开源，为研究者和从业者提供测试大规模微服务系统的实用工具。
Testing ultra-large microservices-based FinTech systems presents significant challenges, including restricted access to production environments, complex dependencies, and stringent security constraints. We propose SandBoxFuzz, a scalable grey-box fuzzing technique that addresses these limitations by leveraging aspect-oriented programming and runtime reflection to enable dynamic specification mining, generating targeted inputs for constrained environments. SandBoxFuzz also introduces a log-based coverage mechanism, seamlessly integrated into the build pipeline, eliminating the need for runtime coverage agents that are often infeasible in industrial settings. SandBoxFuzz has been successfully deployed to Ant Group's production line and, compared to an initial solution built on a state-of-the-art fuzzing framework, it demonstrates superior performance in their microservices software. SandBoxFuzz achieves a 7.5% increase in branch coverage, identifies 1,850 additional exceptions, and reduces setup time from hours to minutes, highlighting its effectiveness and practical utility in a real-world industrial environment. By open-sourcing SandBoxFuzz1, we provide a practical and effective tool for researchers and practitioners to test large-scale microservices systems.
@inproceedings{paperbot9055,
title = {Grey-Box Fuzzing in Constrained Ultra-Large Systems: Lessons for SE Community},
author = {Jiazhao Yu and Yanlun Tu and Zhanlei Zhang and Tiehua Zhang and Cheng Xu and Weigang Wu and Hong Jin Kang and Xi Zheng},
booktitle = {FSE},
year = {2025},
doi = {10.1145/3696630.3728546}
}