1. National Institute of Standards and Technology (NIST). (2008). Technical Guide to Information Security Testing and Assessment (NIST Special Publication 800-115). Section 5.7, "Fuzz Testing," p. 5-13. The document states, "Fuzz testing (or fuzzing) is a software testing technique that involves providing a software or system with invalid, unexpected, or random data."
2. Miller, B. P., Fredriksen, L., & So, B. (1990). An empirical study of the reliability of UNIX utilities. Communications of the ACM, 33(12), 32–44. In this foundational academic paper on the topic, the authors describe their tool that generates random character streams as input to test the robustness of programs, defining the core concept of fuzzing. (Section 2, "The Fuzz Generator").
3. Zalewski, M. (2011). The Tangled Web: A Guide to Securing Modern Web Applications. No Starch Press. Chapter 15, "Automated Attack Tools," discusses fuzzing as a method for "triggering catastrophic failures in the tested code by providing it with unexpected, invalid, or simply random inputs." (p. 267). This source is widely used in university curricula on software security.