Fuzzing with Code Fragments

By Christian Holler, Kim Herzig, Andreas Zeller. USENIX Security Symposium, 2012

511 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/4275190822a329f06adb7f576d115f3618888edf

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Fuzz4ALL: Universal Fuzzing with Large Language Models (2023, background): “Traditional fuzzers can be classified into generation-based [34, 49, 81] and mutation-based [21, 31, 69].”
Compiler validation via equivalence modulo inputs (2014, background): “LangFuzz has found many bugs in the PHP and Mozilla JavaScript interpreters.”
Steelix: program-state based binary fuzzing (2017, background): “Note that a number of advances have also been made to improve the effectiveness and efficiency of generation-based fuzzing [10, 14, 26, 30, 35, 39, 42, 45, 46, 50].”
Superion: Grammar-Aware Greybox Fuzzing (2018, unknown): “LangFuzz [32] uses a grammar to separate previously failing test input to code fragments and save them into a fragment pool.”
kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels (2017, background): “[27] introduced learning interesting parts of the input grammar from old crashing inputs.”
Skyfire: Data-Driven Seed Generation for Fuzzing (2017, methodology): “CSmith [19], LangFuzz [20], IFuzzer [21], Radamsa [41], and the approach in [18] use the context-free grammar as the specification to generate inputs.”
FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, background): “There exist several fuzzers highly optimized for certain input file structures, including network protocols [4, 12], and source code [31, 43, 49].”
Learning to Fuzz from Symbolic Execution with Application to Smart Contracts (2019, unknown): “Because of its simplicity and practical effectiveness, fuzzing has become one of the main approaches for software testing [21, 30, 38, 68].”
Is Your Code Generated by ChatGPT Really Correct? Rigorous Evaluation of Large Language Models for Code Generation (2023, methodology): “Traditional black-box techniques can mainly be categorized into generation-based [61, 22, 46] and mutationbased [56, 10, 39] ones.”
Large Language Models Are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models (2022, background): “Additionally, TitanFuzz is the first work to demonstrate that LLMs can perform both generation-based [30, 78] and mutation-based [39, 49] fuzzing studied for decades [82], while being fully automated, generalizable, and applicable to domains challenging for traditional approaches (such as DL systems”
Learning to Fuzz: Application-Independent Fuzz Testing with Probabilistic, Generative Models of Input Data (2016, methodology): “• LangFuzz [23], the state of the art approach that is closest to our work.”
Large Language Model guided Protocol Fuzzing (2024, unknown): “To reduce the reliance on prior knowledge and manual work before fuzzing, several existing works have been proposed to dynamically infer message structures, including blackbox fuzzers [22], [35] and whitebox fuzzers [13], [16], [30].”
Neural Attribute Machines for Program Generation (2017, background): “Program generation has many potential applications, including automatically testing programming tools [4] and assisting humans as they solve programming tasks [5, 6].”
NEZHA: Efficient Domain-Independent Differential Testing (2017, methodology): “LangFuzz [38] uses a grammar to randomly generate valid JavaScript code fragments and test JavaScript VMs, while GLADE [22] synthesizes a context-free grammar encoding the language of valid program inputs and leverages it for fuzzing.”
Coverage-directed differential testing of JVM implementations (2016, methodology): “Fuzz testing has also been employed to ﬁnd issues re-lated to system calls [14, 40], security protocols [11, 36], language compilers [22] and interpreters [19, 32].”
Fuzzing: A Survey for Roadmap (2022, background): “The basic assumption is that a new bug may still exist in or near the locations where an input has already discovered a bug [80].”
NAUTILUS: Fishing for Deep Bugs with Grammars (2019, background): “Binary transformations generate inputs that struggle to pass initial lexical and syntactic analysis [36] and reach the code that executes after those checks, i.”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, methodology): “LangFuzz was applied to JavaScript and PHP. Blend-Fuzz [229] is based on similar ideas as LangFuzz, but targets XML and regular expression parsers.”