2018

The Art, Science, and Engineering of Fuzzing: A Survey

Manes, Valentin J. M., Han, HyungSeok, Han, Choongwoo et al.

Understand

Among the many software vulnerability discovery techniques available today, fuzzing has remained highly popular due to its conceptual simplicity, its low barrier to deployment, and its vast amount of empirical evidence in discovering real-world software vulnerabilities.

At a high level, fuzzing refers to a process of repeatedly running a program with generated inputs that may be syntactically or semantically malformed.
While researchers and practitioners alike have invested a large and diverse effort towards improving fuzzing in recent years, this surge of work has also made it difficult to gain a comprehensive and coherent view of fuzzing.
To help preserve and bring coherence to the vast literature of fuzzing, this paper presents a unified, general-purpose model of fuzzing together with a taxonomy of the current fuzzing literature.

Built on

R. S. Boyer, B. Elspas, and K. N. Levitt, “SELECT—a formal system for testing and debugging programs by symbolic execution,” ACM SIGPLAN Notices , vol. 10, no. 6, pp. 234–245, 1975
1975
Earlier work this paper cites.
W. E. Howden, “Methodology for the generation of program test data,” IEEE Transactions on Computers , vol. C, no. 5, pp. 554–560, 1975
1975
Earlier work this paper cites.
J. C. King, “Symbolic execution and program testing,” Communications of the ACM , vol. 19, no. 7, pp. 385–394, 1976
1976
Earlier work this paper cites.
D. A. Berry and B. Fristedt, Bandit Problems: Sequential Allocation of Experiments . Springer Netherlands, 1985
1985
Earlier work this paper cites.
B. P. Miller, L. Fredriksen, and B. So, “An empirical study of the reliability of UNIX utilities,” Communications of the ACM , vol. 33, no. 12, pp. 32–44, 1990
1990
Earlier work this paper cites.
B. Beizer, Black-box Testing: Techniques for Functional Testing of Software and Systems . John Wiley & Sons, 1995
1995
Earlier work this paper cites.
P. Koopman, J. Sung, C. Dingman, D. Siewiorek, and T. Marz, “Comparing operating systems using robustness benchmarks,” in Proceedings of the Symposium on Reliable Distributed Systems , 1997, pp. 72–79
1997
Earlier work this paper cites.
W. M. McKeeman, “Differential testing for software,” Digital Technical Journal , vol. 10, no. 1, pp. 100–107, 1998
1998
Earlier work this paper cites.
F. B. Schneider, “Enforceable security policies,” ACM Transactions on Information System Security , vol. 3, no. 1, pp. 30–50, 2000
2000
Earlier work this paper cites.
D. Aitel, “An introduction to SPIKE, the fuzzer creation kit,” in Proceedings of the Black Hat USA , 2001
2001
Earlier work this paper cites.
——, “Sharefuzz,” https://sourceforge.net/projects/sharefuzz/ , 2001
2001
Earlier work this paper cites.
A. Edwards, A. Srivastava, and H. Vo, “Vulcan: Binary transformation in a distributed environment,” Microsoft Research, Tech. Rep. MSR-TR-2001-50, 2001
2001
Earlier work this paper cites.
R. Kaksonen, M. Laakso, and A. Takanen, “Software security assessment through specification mutations and fault injection,” in Proceedings of the IFIP TC 6/TC 11 International Conference on Communications and Multimedia Security , 2001, pp. 173–183
2001
Earlier work this paper cites.
A. Zeller and R. Hildebrandt, “Simplifying and isolating failure-inducing input,” IEEE Transactions on Software Engineering , vol. 28, no. 2, pp. 183–200, 2002
2002
Earlier work this paper cites.
G. Hoglund, “Runtime decompilation,” in Proceedings of the Black Hat USA , 2003
2003
Earlier work this paper cites.
A. Avizienis, J.-C. Laprie, B. Randell, and C. Landwehr, “Basic concepts and taxonomy of dependable and secure computing,” IEEE Transactions on Dependable and Secure Computing , vol. 1, no. 1, pp. 11–33, 2004
2004
Earlier work this paper cites.
D. L. Bruening, “Efficient, transparent, and comprehensive runtime code manipulation,” Ph.D. dissertation, Massachusetts Institute of Technology, 2004
2004
Earlier work this paper cites.
M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti, “Control-flow integrity,” in Proceedings of the ACM Conference on Computer and Communications Security , 2005, pp. 340–353
2005
Earlier work this paper cites.
F. Bellard, “QEMU, a fast and portable dynamic translator,” in Proceedings of the USENIX Annual Technical Conference , 2005, pp. 41–46
2005
Earlier work this paper cites.
P. Godefroid, N. Klarlund, and K. Sen, “DART: Directed automated random testing,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2005, pp. 213–223
2005
Earlier work this paper cites.
C.-K. Luk, R. Cohn, R. Muth, H. Patil, A. Klauser, G. Lowney, S. Wallace, V. J. Reddi, and K. Hazelwood, “Pin: Building customized program analysis tools with dynamic instrumentation,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2005, pp. 190–200
2005
Earlier work this paper cites.
J. Newsome and D. Song, “Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software,” in Proceedings of the Network and Distributed System Security Symposium , 2005
2005
Earlier work this paper cites.
H. Raffelt, B. Steffen, and T. Berg, “LearnLib: A library for automata learning and experimentation,” in Proceedings of the International Workshop on Formal Methods for Industrial Critical Systems , 2005, pp. 62–71
2005
Earlier work this paper cites.
K. Sen, D. Marinov, and G. Agha, “CUTE: A concolic unit testing engine for C,” in Proceedings of the International Symposium on Foundations of Software Engineering , 2005, pp. 263–272
2005
Earlier work this paper cites.
M. Sutton, “Filefuzz,” http://osdir.com/ml/security.securiteam/2005-09/msg00007.html
2005
Earlier work this paper cites.
M. Sutton and A. Greene, “The art of file format fuzzing,” in Proceedings of the Black Hat Asia , 2005
2005
Earlier work this paper cites.
M. Vuagnoux, “Autodafé: an act of software torture,” in Proceedings of the Chaos Communication Congress , 2005, pp. 47–58
2005
Earlier work this paper cites.
G. Banks, M. Cova, V. Felmetsger, K. Almeroth, R. Kemmerer, and G. Vigna, “SNOOZE: Toward a stateful network protocol fuzzer,” in Proceedings of the International Conference on Information Security , 2006, pp. 343–358
2006
Earlier work this paper cites.
S. Embleton, S. Sparks, and R. Cunningham, ““sidewinder”: An evolutionary guidance system for malicious input crafting,” in Proceedings of the Black Hat USA , 2006
2006
Earlier work this paper cites.
D. Hamlet, “When only random testing will do,” in Proceedings of the International Workshop on Random Testing , 2006, pp. 1–9
2006
Earlier work this paper cites.
H. J. Abdelnur, R. State, and O. Festor, “KiF: A stateful sip fuzzer,” in Proceedings of the International Conference on Principles , 2007, pp. 47–56
2007
Earlier work this paper cites.
J. Caballero, H. Yin, Z. Liang, and D. Song, “Polyglot: Automatic extraction of protocol message format using dynamic binary analysis,” in Proceedings of the ACM Conference on Computer and Communications Security , 2007, pp. 317–329
2007
Earlier work this paper cites.
K. Chen and D. Wagner, “Large-scale analysis of format string vulnerabilities in debian linux,” in Proceedings of the Workshop on Programming Languages and Analysis for Security , 2007, pp. 75–84
2007
Earlier work this paper cites.
J. D. DeMott, R. J. Enbody, and W. F. Punch, “Revolutionizing the field of grey-box attack surface testing with evolutionary fuzzing,” in Proceedings of the Black Hat USA , 2007
2007
Earlier work this paper cites.
G. Evron, N. Rathaus, R. Fly, A. Jenik, D. Maynor, C. Miller, and Y. Naveh, Open Source Fuzzing Tools . Syngress, 2007
2007
Earlier work this paper cites.
P. Godefroid, “Random testing for security: Blackbox vs. whitebox fuzzing,” in Proceedings of the International Workshop on Random Testing , 2007, pp. 1–1
2007
Earlier work this paper cites.
N. Nethercote and J. Seward, “Valgrind: a framework for heavyweight dynamic binary instrumentation,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2007, pp. 89–100
2007
Earlier work this paper cites.
C. Pacheco, S. K. Lahiri, M. D. Ernst, and T. Ball, “Feedback-directed random test generation,” in Proceedings of the International Conference on Software Engineering , 2007, pp. 75–84
2007
Earlier work this paper cites.
K. Sen, “Effective random testing of concurrent programs,” in Proceedings of the International Conference on Automated Software Engineering , 2007, pp. 323–332
2007
Earlier work this paper cites.
M. Sutton, A. Greene, and P. Amini, Fuzzing: Brute Force Vulnerability Discovery . Addison-Wesley Professional, 2007
2007
Earlier work this paper cites.
S. Bratus, A. Hansen, and A. Shubina, “LZfuzz: a fast compression-based fuzzer for poorly documented protocols,” Dartmouth College, Tech. Rep. TR2008-634, 2008
2008
Earlier work this paper cites.
C. Cadar, D. Dunbar, and D. Engler, “KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs,” in Proceedings of the USENIX Symposium on Operating System Design and Implementation , 2008, pp. 209–224
2008
Earlier work this paper cites.
W. Cui, M. Peinado, K. Chen, H. J. Wang, and L. Irun-Briz, “Tupni: Automatic reverse engineering of input formats,” in Proceedings of the ACM Conference on Computer and Communications Security , 2008, pp. 391–402
2008
Earlier work this paper cites.
P. Godefroid, A. Kiezun, and M. Y. Levin, “Grammar-based whitebox fuzzing,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2008, pp. 206–215
2008
Earlier work this paper cites.
P. Godefroid, M. Y. Levin, and D. A. Molnar, “Automated whitebox fuzz testing,” in Proceedings of the Network and Distributed System Security Symposium , 2008, pp. 151–166
2008
Earlier work this paper cites.
J. Jung, A. Sheth, B. Greenstein, D. Wetherall, G. Maganis, and T. Kohno, “Privacy oracle: A system for finding application leaks with black box differential testing,” in Proceedings of the ACM Conference on Computer and Communications Security , 2008, pp. 279–288
2008
Earlier work this paper cites.
Z. Lin and X. Zhang, “Deriving input syntactic structure from execution,” in Proceedings of the International Symposium on Foundations of Software Engineering , 2008, pp. 83–93
2008
Earlier work this paper cites.
C. Miller, “Fuzz by number: More data about fuzzing than you ever wanted to know,” in Proceedings of the CanSecWest , 2008
2008
Earlier work this paper cites.
C.-S. Park and K. Sen, “Randomized active atomicity violation detection in concurrent programs,” in Proceedings of the International Symposium on Foundations of Software Engineering , 2008, pp. 135–145
2008
Earlier work this paper cites.
——, “Race directed random testing of concurrent programs,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2008, pp. 11–21
2008
Earlier work this paper cites.
A. Takanen, J. D. DeMott, and C. Miller, Fuzzing for Software Security Testing and Quality Assurance . Artech House, 2008
2008
Earlier work this paper cites.
D. Thiel, “Exposing vulnerabilities in media software,” in Proceedings of the Black Hat EU , 2008
2008
Earlier work this paper cites.
N. Tillmann and J. De Halleux, “Pex–white box test generation for .NET,” in Proceedings of the International Conference on Tests and Proofs , 2008, pp. 134–153
2008
Earlier work this paper cites.
——, “Control-flow integrity principles, implementations, and applications,” ACM Transactions on Information and Systems Security , vol. 13, no. 1, pp. 4:1–4:40, 2009
2009
Earlier work this paper cites.
P. Comparetti, G. Wondracek, C. Kruegel, and E. Kirda, “Prospex: Protocol specification extraction,” in Proceedings of the IEEE Symposium on Security and Privacy , 2009, pp. 110–125
2009
Earlier work this paper cites.
B. Dolan-Gavitt, A. Srivastava, P. Traynor, and J. Giffin, “Robust signatures for kernel data structures,” in Proceedings of the ACM Conference on Computer and Communications Security , 2009, pp. 566–577
2009
Earlier work this paper cites.
V. Ganesh, T. Leek, and M. Rinard, “Taint-based directed whitebox fuzzing,” in Proceedings of the International Conference on Software Engineering , 2009, pp. 474–484
2009
Earlier work this paper cites.
K. Jayaraman, D. Harvison, V. Ganesh, and A. Kiezun, “jFuzz: A concolic whitebox fuzzer for java,” in Proceedings of the First NASA Forma Methods Symposium , 2009, pp. 121–125
2009
Earlier work this paper cites.
P. Joshi, C.-S. Park, K. Sen, and M. Naik, “A randomized dynamic program analysis technique for detecting real deadlocks,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2009, pp. 110–120
2009
Earlier work this paper cites.
D. Molnar, X. C. Li, and D. A. Wagner, “Dynamic test generation to find integer bugs in x86 binary linux programs,” in Proceedings of the USENIX Security Symposium , 2009, pp. 67–82
2009
Earlier work this paper cites.
S. Nagarakatte, J. Zhao, M. M. K. Martin, and S. Zdancewic, “SoftBound: Highly compatible and complete spatial memory safety for C,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2009, pp. 245–258
2009
Earlier work this paper cites.
D. Oleksiuk, “Ioctl fuzzer,” https://github.com/Cr4sh/ioctlfuzzer , 2009
2009
Earlier work this paper cites.
K. Serebryany and T. Iskhodzhanov, “ThreadSanitizer: data race detection in practice,” in Proceedings of the Workshop on Binary Instrumentation and Applications , 2009, pp. 62–71
2009
Earlier work this paper cites.
T. Xie, N. Tillmann, J. de Halleux, and W. Schulte, “Fitness-guided path exploration in dynamic symbolic execution,” in Proceedings of the International Conference on Dependable Systems Networks , 2009, pp. 359–368
2009
Earlier work this paper cites.
J. Caballero, P. Poosankam, S. McCamant, D. Babić, and D. Song, “Input generation via decomposition and re-stitching: Finding bugs in malware,” in Proceedings of the ACM Conference on Computer and Communications Security , 2010, pp. 413–425
2010
Earlier work this paper cites.

Similar

T. Y. Chen, F.-C. Kuo, R. G. Merkel, and T. H. Tse, “Adaptive random testing: The ART of test case diversity,” Journal of Systems and Software , vol. 83, no. 1, pp. 60–66, 2010
2010
Cited alongside, same era.
V. Iozzo, “0-knowledge fuzzing,” in Proceedings of the Black Hat USA , 2010
2010
Cited alongside, same era.
A. Kanade, R. Alur, S. Rajamani, and G. Ramanlingam, “Representation dependence testing using program inversion,” in Proceedings of the International Symposium on Foundations of Software Engineering , 2010, pp. 277–286
2010
Cited alongside, same era.
Z. Lai, S. Cheung, and W. Chan, “Detecting atomic-set serializability violations in multithreaded programs through active randomized testing,” in Proceedings of the International Conference on Software Engineering , 2010, pp. 235–244
2010
Cited alongside, same era.
M. Laurenzano, M. M. Tikir, L. Carrington, and A. Snavely, “PEBIL: Efficient static binary instrumentation for linux,” in Proceedings of the IEEE International Symposium on Performance Analysis of Systems & Software , 2010, pp. 175–183
2010
Cited alongside, same era.
——, “CETS: Compiler enforced temporal safety for C,” in Proceedings of the International Symposium on Memory Management , 2010, pp. 31–40
2010
Cited alongside, same era.
P. Saxena, S. Hanna, P. Poosankam, and D. Song, “FLAX: Systematic discovery of client-side validation vulnerabilities in rich web applications,” in Proceedings of the Network and Distributed System Security Symposium , 2010
2010
Cited alongside, same era.
E. J. Schwartz, T. Avgerinos, and D. Brumley, “All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask),” in Proceedings of the IEEE Symposium on Security and Privacy , 2010, pp. 317–331
2010
Cited alongside, same era.
T. Wang, T. Wei, G. Gu, and W. Zou, “TaintScope: A checksum-aware directed fuzzing tool for automatic software vulnerability detection,” in Proceedings of the IEEE Symposium on Security and Privacy , 2010, pp. 497–512
2010
Cited alongside, same era.
——, “ref_fuzz,” http://lcamtuf.blogspot.com/2010/06/announcing-reffuzz-2yo-fuzzer.html
2010
Cited alongside, same era.
D. Babic, L. Martignoni, S. McCamant, and D. Song, “Statically-directed dynamic automated test generation,” in Proceedings of the International Symposium on Software Testing and Analysis , 2011, pp. 12–22
2011
Cited alongside, same era.
A. Budi, D. Lo, L. Jiang, and Lucia, “kb-Anonymity: A model for anonymized behavior-preserving test and debugging data,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2011, pp. 447–457
2011
Cited alongside, same era.

Then

L. Ma, C. Artho, C. Zhang, H. Sato, J. Gmeiner, and R. Ramler, “GRT: Program-analysis-guided random testing,” in Proceedings of the International Conference on Automated Software Engineering , 2015, pp. 212–223
2015
Later among the works it cites.
J. D. Ruiter and E. Poll, “Protocol state fuzzing of tls implementations,” in Proceedings of the USENIX Security Symposium , 2015, pp. 193–206
2015
Later among the works it cites.
M. Samak, M. K. Ramanathan, and S. Jagannathan, “Synthesizing racy tests,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2015, pp. 175–185
2015
Later among the works it cites.
Z. Sialveras and N. Naziridis, “Introducing Choronzon: An approach at knowledge-based evolutionary fuzzing,” in Proceedings of the ZeroNights , 2015
2015
Later among the works it cites.
E. Stepanov and K. Serebryany, “MemorySanitizer: fast detector of uninitialized memory use in C++,” in Proceedings of the International Symposium on Code Generation and Optimization , 2015, pp. 46–55
2015
Later among the works it cites.
V. M. Weaver and D. Jones, “perf_fuzzer: Targeted fuzzing of the perf_event_open() system call,” UMaine VMW Group, Tech. Rep., 2015
2015
Later among the works it cites.
——, “New in AFL: persistent mode,” https://lcamtuf.blogspot.com/2015/06/new-in-afl-persistent-mode.html
2015
Later among the works it cites.
M. Aizatsky, K. Serebryany, O. Chang, A. Arya, and M. Whittaker, “Announcing OSS-Fuzz: Continuous fuzzing for open source software,” Google Testing Blog, 2016
2016
Later among the works it cites.
M. Böhme, V.-T. Pham, and A. Roychoudhury, “Coverage-based greybox fuzzing as markov chain,” in Proceedings of the ACM Conference on Computer and Communications Security , 2016, pp. 1032–1043
2016
Later among the works it cites.
Y. Chen, C. Su, C. Sun, S. Su, and J. Zhao, “Coverage-directed differential testing of jvm implementations,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2016, pp. 85–99
2016
Later among the works it cites.
W. Cui, M. Peinado, S. K. Cha, Y. Fratantonio, and V. P. Kemerlis, “RETracer: Triaging crashes by reverse execution from partial memory dumps,” in Proceedings of the International Conference on Software Engineering , 2016, pp. 820–831
2016
Later among the works it cites.
G. Grieco, M. Ceresa, and P. Buiras, “Quickfuzz: An automatic random fuzzer for common file formats,” in Proceedings of the 9th International Symposium on Haskell , 2016, pp. 13–20
2016
Later among the works it cites.
I. Haller, Y. Jeon, H. Peng, M. Payer, C. Giuffrida, H. Bos, and E. Van Der Kouwe, “TypeSan: Practical type confusion detection,” in Proceedings of the ACM Conference on Computer and Communications Security , 2016, pp. 517–528
2016
Later among the works it cites.
lafintel, “Circumventing fuzzing roadblocks with compiler transformations,” https://lafintel.wordpress.com/2016/08/15/circumventing-fuzzing-roadblocks-with-compiler-transformations/ , 2016
2016
Later among the works it cites.
V.-T. Pham, M. Böhme, and A. Roychoudhury, “Model-based whitebox fuzzing for program binaries,” in Proceedings of the International Conference on Automated Software Engineering , 2016, pp. 543–553
2016
Later among the works it cites.
J. Somorovsky, “Systematic fuzzing and testing of tls libraries,” in Proceedings of the ACM Conference on Computer and Communications Security , 2016, pp. 1492–1504
2016
Later among the works it cites.
N. Stephens, J. Grosen, C. Salls, A. Dutcher, R. Wang, J. Corbetta, Y. Shoshitaishvili, C. Kruegel, and G. Vigna, “Driller: Augmenting fuzzing through selective symbolic execution,” in Proceedings of the Network and Distributed System Security Symposium , 2016
2016
Later among the works it cites.
S. Veggalam, S. Rawat, I. Haller, and H. Bos, “IFuzzer: An evolutionary interpreter fuzzer using genetic programming,” in Proceedings of the European Symposium on Research in Computer Security , 2016, pp. 581–601
2016
Later among the works it cites.
M. Y. Wong and D. Lie, “Intellidroid: A targeted input generator for the dynamic analysis of android malware,” in Proceedings of the Network and Distributed System Security Symposium , 2016
2016
Later among the works it cites.
O. Bastani, R. Sharma, A. Aiken, and P. Liang, “Synthesizing program input grammars,” in Proceedings of the ACM Conference on Programming Language Design and Implementation , 2017, pp. 95–110
2017
Later among the works it cites.
M. Böhme, V.-T. Pham, M.-D. Nguyen, and A. Roychoudhury, “Directed greybox fuzzing,” in Proceedings of the ACM Conference on Computer and Communications Security , 2017, pp. 2329–2344
2017
Later among the works it cites.
J. Corina, A. Machiry, C. Salls, Y. Shoshitaishvili, S. Hao, C. Kruegel, and G. Vigna, “DIFUZE: Interface aware fuzzing for kernel drivers,” in Proceedings of the ACM Conference on Computer and Communications Security , 2017, pp. 2123–2138
2017
Later among the works it cites.
L. Della Toffola, C. A. Staicu, and M. Pradel, “Saying ‘hi!’ is not enough: Mining inputs for effective test generation,” in Proceedings of the International Conference on Automated Software Engineering , 2017, pp. 44–49
2017
Later among the works it cites.
P. Godefroid, H. Peleg, and R. Singh, “Learn&Fuzz: Machine learning for input fuzzing,” in Proceedings of the International Conference on Automated Software Engineering , 2017, pp. 50–59
2017
Later among the works it cites.
H. Han and S. K. Cha, “IMF: Inferred model-based fuzzer,” in Proceedings of the ACM Conference on Computer and Communications Security , 2017, pp. 2345–2358
2017
Later among the works it cites.
Y. Jeon, P. Biswas, S. Carr, B. Lee, and M. Payer, “HexType: Efficient detection of type confusion errors for c++,” in Proceedings of the ACM Conference on Computer and Communications Security , 2017, pp. 2373–2387
2017
Later among the works it cites.
S. Y. Kim, S. Lee, I. Yun, W. Xu, B. Lee, Y. Yun, and T. Kim, “CAB-Fuzz: Practical concolic testing techniques for COTS operating systems,” in Proceedings of the USENIX Annual Technical Conference , 2017, pp. 689–701
2017
Later among the works it cites.
S. Lee, C. Yoon, C. Lee, S. Shin, V. Yegneswaran, and P. Porras, “DELTA: A security assessment framework for software-defined networks,” in Proceedings of the Network and Distributed System Security Symposium , 2017
2017
Later among the works it cites.
Y. Li, B. Chen, M. Chandramohan, S.-W. Lin, Y. Liu, and A. Tiu, “Steelix: Program-state based binary fuzzing,” in Proceedings of the International Symposium on Foundations of Software Engineering , 2017, pp. 627–637
2017
Later among the works it cites.
P. Liu, X. Zhang, M. Pistoia, Y. Zheng, M. Marques, and L. Zeng, “Automatic text input generation for mobile testing,” in Proceedings of the International Conference on Software Engineering , 2017, pp. 643–653
2017
Later among the works it cites.
J. Pan, G. Yan, and X. Fan, “Digtool: A virtualization-based framework for detecting kernel vulnerabilities,” in Proceedings of the USENIX Security Symposium , 2017, pp. 149–165
2017
Later among the works it cites.
T. Petsios, A. Tang, S. J. Stolfo, A. D. Keromytis, and S. Jana, “NEZHA: Efficient domain-independent differential testing,” in Proceedings of the IEEE Symposium on Security and Privacy , 2017, pp. 615–632
2017
Later among the works it cites.
S. Rasthofer, S. Arzt, S. Triller, and M. Pradel, “Making malory behave maliciously: Targeted fuzzing of android execution environments,” in Proceedings of the International Conference on Software Engineering , 2017, pp. 300–311
2017
Later among the works it cites.
S. Rawat, V. Jain, A. Kumar, L. Cojocar, C. Giuffrida, and H. Bos, “VUzzer: Application-aware evolutionary fuzzing,” in Proceedings of the Network and Distributed System Security Symposium , 2017
2017
Later among the works it cites.
S. Schumilo, C. Aschermann, R. Gawlik, S. Schinzel, and T. Holz, “kAFL: Hardware-assisted feedback fuzzing for os kernels,” in Proceedings of the USENIX Security Symposium , 2017, pp. 167–182
2017
Later among the works it cites.
W. Song, X. Qian, and J. Huang, “EHBDroid: Beyond GUI testing for android applications,” in Proceedings of the International Conference on Automated Software Engineering , 2017, pp. 27–37
2017
Later among the works it cites.
J. Wang, B. Chen, L. Wei, and Y. Liu, “Skyfire: Data-driven seed generation for fuzzing,” in Proceedings of the IEEE Symposium on Security and Privacy , 2017, pp. 579–594
2017
Later among the works it cites.
S. Wang, J. Nam, and L. Tan, “QTEP: Quality-aware test case prioritization,” in Proceedings of the International Symposium on Foundations of Software Engineering , 2017, pp. 523–534
2017
Later among the works it cites.
D. Xu, J. Ming, and D. Wu, “Cryptographic function detection in obfuscated binaries via bit-precise symbolic loop mapping,” in Proceedings of the IEEE Symposium on Security and Privacy , 2017, pp. 921–937
2017
Later among the works it cites.
W. Xu, S. Kashyap, C. Min, and T. Kim, “Designing new operating primitives to improve fuzzing performance,” in Proceedings of the ACM Conference on Computer and Communications Security , 2017, pp. 2313–2328
2017
Later among the works it cites.
M. Böhme, “STADS: Software testing as species discovery,” ACM Transactions on Software Engineering and Methodology , vol. 27, no. 2, pp. 7:1–7:52, 2018
2018
Closest in time.
J. Chen, W. Diao, Q. Zhao, C. Zuo, Z. Lin, X. Wang, W. C. Lau, M. Sun, R. Yang, and K. Zhang, “IoTFuzzer: Discovering memory corruptions in IoT through app-based fuzzing,” in Proceedings of the Network and Distributed System Security Symposium , 2018
2018
Closest in time.
P. Chen and H. Chen, “Angora: Efficient fuzzing by principled search,” in Proceedings of the IEEE Symposium on Security and Privacy , 2018, pp. 855–869
2018
Closest in time.
S. Gan, C. Zhang, X. Qin, X. Tu, K. Li, Z. Pei, and Z. Chen, “CollAFL: Path sensitive fuzzing,” in Proceedings of the IEEE Symposium on Security and Privacy , 2018, pp. 660–677
2018
Closest in time.
P. Goodman and A. Dinaburg, “The past, present, and future of cyberdyne,” in Proceedings of the IEEE Symposium on Security and Privacy , 2018, pp. 61–69
2018
Closest in time.
W. Han, B. Joe, B. Lee, C. Song, and I. Shin, “Enhancing memory error detection for large-scale applications and fuzz testing,” in Proceedings of the Network and Distributed System Security Symposium , 2018
2018
Closest in time.
G. Klees, A. Ruef, B. Cooper, S. Wei, and M. Hicks, “Evaluating fuzz testing,” in Proceedings of the ACM Conference on Computer and Communications Security , 2018, pp. 2123–2138
2018
Closest in time.
C. Lemieux, R. Padhye, K. Sen, and D. Song, “PerfFuzz: Automatically generating pathological inputs,” in Proceedings of the International Symposium on Software Testing and Analysis , 2018, pp. 254–265
2018
Closest in time.
C. Lemieux and K. Sen, “FairFuzz: A targeted mutation strategy for increasing greybox fuzz testing coverage,” in Proceedings of the International Conference on Automated Software Engineering , 2018, pp. 475–485
2018
Closest in time.
J. Li, B. Zhao, and C. Zhang, “Fuzzing: a survey,” Cybersecurity , vol. 1, no. 1, 2018
2018
Closest in time.
H. Liang, X. Pei, X. Jia, W. Shen, and J. Zhang, “Fuzzing: State of the art,” IEEE Transactions on Reliability , vol. 67, no. 3, pp. 1199–1218, 2018
2018
Closest in time.
S. Pailoor, A. Aday, and S. Jana, “MoonShine: Optimizing OS fuzzer seed selection with trace distillation,” in Proceedings of the USENIX Security Symposium , 2018, pp. 729–743
2018
Closest in time.
H. Peng, Y. Shoshitaishvili, and M. Payer, “T-Fuzz: Fuzzing by program transformation,” in Proceedings of the IEEE Symposium on Security and Privacy , 2018, pp. 917–930
2018
Closest in time.
M. Schwarz, D. Gruss, M. Lipp, C. Maurice, T. Schuster, A. Fogh, and S. Mangard, “Automated detection, exploitation, and elimination of double-fetch bugs using modern CPU features,” in Proceedings of the ACM Symposium on Information, Computer and Communications Security , 2018, pp. 587–600
2018
Closest in time.
A. Takanen, J. D. DeMott, C. Miller, and A. Kettunen, Fuzzing for Software Security Testing and Quality Assurance , 2nd ed. Artech House, 2018
2018
Closest in time.
D. Trabish, A. Mattavelli, N. Rinetzky, and C. Cadar, “Chopped symbolic execution,” in Proceedings of the International Conference on Software Engineering , 2018, pp. 350–360
2018
Closest in time.
J. Wei, J. Chen, Y. Feng, K. Ferles, and I. Dillig, “Singularity: Pattern fuzzing for worst case complexity,” in Proceedings of the International Symposium on Foundations of Software Engineering , 2018, pp. 213–223
2018
Closest in time.
I. Yun, S. Lee, M. Xu, Y. Jang, and T. Kim, “QSYM: A practical concolic execution engine tailored for hybrid fuzzing,” in Proceedings of the USENIX Security Symposium , 2018, pp. 745–762
2018
Closest in time.
C. Aschermann, P. Jauernig, T. Frassetto, A.-R. Sadeghi, T. Holz, and D. Teuchert, “NAUTILUS: Fishing for deep bugs with grammars,” in Proceedings of the Network and Distributed System Security Symposium , 2019
2019
Closest in time.
C. Aschermann, S. Schumilo, T. Blazytko, R. Gawlik, and T. Holz, “REDQUEEN: Fuzzing with input-to-state correspondence,” in Proceedings of the Network and Distributed System Security Symposium , 2019
2019
Closest in time.
H. Han, D. Oh, and S. K. Cha, “CodeAlchemist: Semantics-aware code generation to find vulnerabilities in javascript engines,” in Proceedings of the Network and Distributed System Security Symposium , 2019
2019
Closest in time.
D. Song, F. Hetzelt, D. Das, C. Spensky, Y. Na, S. Volckaert, G. Vigna, C. Kruegel, J.-P. Seifert, and M. Franz, “Periscope: An effective probing and fuzzing framework for the hardware-os boundary,” in Proceedings of the Network and Distributed System Security Symposium , 2019
2019
Closest in time.
L. Zhao, Y. Duan, H. Yin, and J. Xuan, “Send hardest problems my way: Probabilistic path prioritization for hybrid fuzzing,” in Proceedings of the Network and Distributed System Security Symposium , 2019
2019
Closest in time.
H. Chen, Y. Xue, Y. Li, B. Chen, X. Xie, X. Wu, and Y. Liu, “Hawkeye: Towards a desired directed grey-box fuzzer,” in Proceedings of the ACM Conference on Computer and Communications Security , 2018, pp. 2095–2108
2095
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…