RFCAudit: An LLM Agent for Functional Bug Detection in Network Protocols

M. Musuvathi and D. R. Engler, “Model checking large network protocol implementations,” in NSDI . USENIX, 2004, pp. 155–168

2004

Earlier work this paper cites.

G. Díaz, F. Cuartero, V. V. Ruiz, and F. L. Pelayo, “Automatic verification of the TLS handshake protocol,” in SAC . ACM, 2004, pp. 789–794

2004

Earlier work this paper cites.

O. Udrea and C. Lumezanu, “Rule-based static analysis of network protocol implementations,” in USENIX Security Symposium . USENIX Association, 2006

2006

Earlier work this paper cites.

C. Cadar, D. Dunbar, and D. R. Engler, “Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs,” in Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation , ser. OSDI ’08. USENIX, 2008, pp. 209–224. [Online]. Available: https://www.usenix.org/conference/osdi-08/klee-unassisted-and-automatic-generation-high-coverage-tests-complex-systems

2008

Earlier work this paper cites.

P. Godefroid, M. Y. Levin, and D. Molnar, “Sage: whitebox fuzzing for security testing,” Communications of the ACM , vol. 55, no. 3, pp. 40–44, 2012

2012

Earlier work this paper cites.

Y. Sui and J. Xue, “SVF: interprocedural static value-flow analysis in LLVM,” in Proceedings of the 25th International Conference on Compiler Construction, CC 2016, Barcelona, Spain, March 12-18, 2016 , A. Zaks and M. V. Hermenegildo, Eds. ACM, 2016, pp. 265–266

2016

Earlier work this paper cites.

A. A. de Amorim, C. Hritcu, and B. C. Pierce, “The meaning of memory safety,” CoRR , vol. abs/1705.07354, 2017. [Online]. Available: http://arxiv.org/abs/1705.07354

Original

2017

Earlier work this paper cites.

I. Yun, S. Lee, M. Xu, Y. Jang, and T. Kim, “QSYM : A practical concolic execution engine tailored for hybrid fuzzing,” in 27th USENIX Security Symposium (USENIX Security 18) . Baltimore, MD: USENIX Association, Aug. 2018, pp. 745–761. [Online]. Available: https://www.usenix.org/conference/usenixsecurity18/presentation/yun

2018

Earlier work this paper cites.

H. Yan, Y. Sui, S. Chen, and J. Xue, “Spatio-temporal context reduction: a pointer-analysis-based static approach for detecting use-after-free vulnerabilities,” in Proceedings of the 40th International Conference on Software Engineering , ser. ICSE ’18. New York, NY, USA: Association for Computing Machinery, 2018, p. 327–337. [Online]. Available: https://doi.org/10.1145/3180155.3180178

2018

Earlier work this paper cites.

Q. Shi, X. Xiao, R. Wu, J. Zhou, G. Fan, and C. Zhang, “Pinpoint: Fast and precise sparse value flow analysis for million lines of code,” in Proceedings of the 39th ACM SIGPLAN Conference on Programming Language Design and Implementation , ser. PLDI ’18. ACM, 2018, pp. 693–706

2018

Earlier work this paper cites.

MITRE, “Cve-2020-1472,” https://nvd.nist.gov/vuln/detail/CVE-2020-1472 , 2020

2020

Earlier work this paper cites.

S. Poeplau and A. Francillon, “Symbolic execution with SymCC: Don’t interpret, compile!” in 29th USENIX Security Symposium (USENIX Security 20) . USENIX Association, Aug. 2020, pp. 181–198. [Online]. Available: https://www.usenix.org/conference/usenixsecurity20/presentation/poeplau

2020

Earlier work this paper cites.

G. S. Reen and C. Rossow, “Dpifuzz: a differential fuzzing framework to detect dpi elusion strategies for quic,” in Proceedings of the 36th Annual Computer Security Applications Conference , ser. ACSAC ’20. ACM, 2020, pp. 332–344

2020

Earlier work this paper cites.

V.-T. Pham, M. Böhme, and A. Roychoudhury, “Aflnet: a greybox fuzzer for network protocols,” in 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST) . IEEE, 2020, pp. 460–465

2020

Earlier work this paper cites.

R. Rutledge and A. Orso, “Automating differential testing with overapproximate symbolic execution,” in 2022 15th IEEE Conference on Software Testing, Verification and Validation , ser. ICST ’22. IEEE, 2022, pp. 256–266

2022

Cited alongside, same era.

Q. Shi, J. Shao, Y. Ye, M. Zheng, and X. Zhang, “Lifting network protocol implementation to precise format specification with security applications,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’23. ACM, 2023, p. 1287–1301

2023

Cited alongside, same era.

J. Pereyda, “Boofuzz,” https://github.com/jtpereyda/boofuzz , 2023

2023

Cited alongside, same era.

Microsoft, “Netlogon remote protocol,” https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f , 2024

2024

Cited alongside, same era.

C. Wang, J. Zhang, R. Wu, and C. Zhang, “Dainfer: Inferring API aliasing specifications from library documentation via neurosymbolic optimization,” Proc. ACM Softw. Eng. , vol. 1, no. FSE, pp. 2469–2492, 2024. [Online]. Available: https://doi.org/10.1145/3660816

2024

Later among the works it cites.

C. Ye, Y. Cai, and C. Zhang, “When threads meet interrupts: Effective static detection of { \{ Interrupt-Based } \} deadlocks in linux,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 6167–6184

2024

Later among the works it cites.

Z. Li, S. Dutta, and M. Naik, “Llm-assisted static analysis for detecting security vulnerabilities,” CoRR , vol. abs/2405.17238, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2405.17238

Original

2024

Later among the works it cites.

C. Wang, W. Zhang, Z. Su, X. Xu, and X. Zhang, “Sanitizing large language models in bug detection with data-flow,” in Findings of the Association for Computational Linguistics: EMNLP 2024, Miami, Florida, USA, November 12-16, 2024 , Y. Al-Onaizan, M. Bansal, and Y. Chen, Eds. Association for Computational Linguistics, 2024, pp. 3790–3805. [Online]. Available: https://aclanthology.org/2024.findings-emnlp.217