Fuzz testing (fuzzing) has witnessed its prosperity in detecting security flaws recently. It generates a large number of test cases and monitors the executions for defects. Fuzzing has detected thousands of bugs and vulnerabilities in various applications. Although effective, there lacks systematic analysis of gaps faced by fuzzing. As a technique of defect detection, fuzzing is required to narrow down the gaps between the entire input space and the defect space. Without limitation on the generated inputs, the input space is infinite. However, defects are sparse in an application, which indicates that the defect space is much smaller than the entire input space. Besides, because fuzzing generates numerous test cases to repeatedly examine targets, it requires fuzzing to perform in an automatic manner. Due to the complexity of applications and defects, it is challenging to automatize the execution of diverse applications. In this article, we systematically review and analyze the gaps as well as their solutions, considering both breadth and depth. This survey can be a roadmap for both beginners and advanced developers to better understand fuzzing.

The rapid advancement of large models has led to the development of increasingly sophisticated models capable of generating diverse, personalized, and high-quality content. Among these, DeepSeek has emerged as a pivotal open-source initiative, demonstrating high performance at significantly lower computation costs compared to closed-source counterparts. This survey provides a comprehensive overview of the DeepSeek family of models, including DeepSeek-V3 and DeepSeek-R1, covering their core innovations in architecture, system pipeline, algorithm, and infrastructure. We explore their practical applications across various domains, such as healthcare, finance, and education, highlighting their impact on both industry and society. Further-more, we examine potential security, privacy, and ethical concerns arising from the widespread deployment of these models, emphasizing the need for responsible AI development. Finally, we outline future research directions to enhance the performance, safety, and scalability of DeepSeek models, aiming to foster further advancements in the open-source large model community.

Software security poses substantial risks to our society because software has become part of our life. Numerous techniques have been proposed to resolve or mitigate the impact of software security issues. Among them, software testing and analysis are two of the critical methods, which significantly benefit from the advancements in deep learning technologies. Due to the successful use of deep learning in software security, recently, researchers have explored the potential of using large language models (LLMs) in this area. In this paper, we systematically review the results focusing on LLMs in software security. We analyze the topics of fuzzing, unit test, program repair, bug reproduction, data-driven bug detection, and bug triage. We deconstruct these techniques into several stages and analyze how LLMs can be used in the stages. We also discuss the future directions of using LLMs in software security, including the future directions for the existing use of LLMs and extensions from conventional deep learning research.

ChatGPT is a powerful artificial intelligence (AI) language model that has demonstrated significant improvements in various natural language processing (NLP) tasks. However, like any technology, it presents potential security risks that need to be carefully evaluated and addressed. In this survey, we provide an overview of the current state of research on security of using ChatGPT, with aspects of bias, disinformation, ethics, misuse, attacks and privacy. We review and discuss the literature on these topics and highlight open research questions and future directions. Through this survey, we aim to contribute to the academic discourse on AI security, enriching the understanding of potential risks and mitigations. We anticipate that this survey will be valuable for various stakeholders involved in AI development and usage, including AI researchers, developers, policy makers, and end-users.

As the Industrial Internet of Things (IIoT) continues to expand, the need for effective device identification becomes critical for securing industrial environments. Network traffic fingerprinting has emerged as an important technique for IIoT device identification, leveraging the unique communication patterns embedded in network traffic. Despite significant efforts in this area, a comprehensive overview of the relevant research is still missing. To address the lack of comprehensive research, this paper, for the first time, identifies critical knowledge gaps constraining IIoT device identification through network traffic analysis: obscure fingerprint feature space, limited generalizability to unknowns, and scarce data sources. Focusing on these gaps, existing methods are analyzed and summarized in detail across network traffic fingerprinting, IIoT device identification, and public IIoT datasets. Specifically, network traffic fingerprinting methods are categorized into three levels: Packet-level, flow-level, and business-level, and relevant methods are examined in terms of data formats, segmentation units, and extraction or generation techniques. In the context of IIoT device identification, tasks such as device type, model, and instance recognition, as well as abnormal device detection, are extensively investigated using rule-based, traditional machine learning-based, and deep learning-based approaches, with a focus on device fingerprints and application scenarios. Furthermore, main public datasets from the IoT, ICS, and IIoT scenarios are highlighted to support the development of fingerprinting and identification methods. Finally, several future research directions are proposed to guide new advancements in this area.

Cross-chain bridges, one of the foundational infrastructures of blockchain, provide the infrastructure and solutions for inter-operability, asset liquidity, data transfer, decentralized finance, and cross-chain governance between blockchain networks. However, because cross-chain bridges often have to handle communication and asset transfers between multiple blockchains, they involve complex protocols and technologies. This complexity increases the likelihood of vulnerabilities and potential attacks. In order to ensure the security and reliability of cross-chain bridges, this article launches a thorough investigation of existing cross-chain bridge projects, clarifying bridging mechanisms, bridge types, and security features. The following part goes into the subject of security and sheds light on the considerable challenges faced by cross-chain bridges. It conducts a thorough analysis of security flaws, covering problems like smart contract vulnerabilities, centralization risks, liquidity issues, and oracle manipulations. Furthermore, this study promotes a compendium of security solutions and best practises, pointing the way toward a cross-chain bridge scenario that is more secure.