Which software-testing technique can be automated or semi-automated and provides invalid, unexpected, or random data to the inputs of a computer…

Fuzzing, also known as fuzz testing, is a specific software testing technique that automates the process of finding security vulnerabilities and bugs. It operates by providing a stream of invalid, unexpected, or random data (known as "fuzz") to the inputs of a program. The system is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. This method is highly effective at discovering implementation bugs that could be exploited, directly matching the technique described in the question.

B. Static analysis: This technique examines code without executing it and does not involve providing input data to a running program.

C. Dynamic analysis: This is a broad category of testing done while a program is running. Fuzzing is a specific type of dynamic analysis, making "Fuzzing" the more precise answer.

D. Bugtraq: This is a public mailing list for discussing security vulnerabilities, not a software testing technique.

1. National Institute of Standards and Technology (NIST). (2008). Technical Guide to Information Security Testing and Assessment (NIST Special Publication 800-115). Section 5.7, "Fuzz Testing," p. 5-13. The document states, "Fuzz testing (or fuzzing) is a software testing technique that involves providing a software or system with invalid, unexpected, or random data."

2. Miller, B. P., Fredriksen, L., & So, B. (1990). An empirical study of the reliability of UNIX utilities. Communications of the ACM, 33(12), 32–44. In this foundational academic paper on the topic, the authors describe their tool that generates random character streams as input to test the robustness of programs, defining the core concept of fuzzing. (Section 2, "The Fuzz Generator").

3. Zalewski, M. (2011). The Tangled Web: A Guide to Securing Modern Web Applications. No Starch Press. Chapter 15, "Automated Attack Tools," discusses fuzzing as a method for "triggering catastrophic failures in the tested code by providing it with unexpected, invalid, or simply random inputs." (p. 267). This source is widely used in university curricula on software security.