SAGE: Whitebox Fuzzing for Security Testing

By Patrice Godefroid, Michael Y. Levin, David A. Molnar. Queue, 2012

771 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/6ce012d209f742684f089d5eaff4fc1f6e3cb1aa

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Software

In Signal Processing

Citations in the corpus

T-Fuzz: Fuzzing by Program Transformation (2018, background): “Several tools have implemented symbolic execution, e.g., KLEE [35], Veritesting [36], SAGE [37], DART [38], SYMFUZZ [39], CUTE [40], SmartFuzz [41], and Driller [12], covering domains like automatic testcase generation, automatic bug finding and fuzzing.”
Superion: Grammar-Aware Greybox Fuzzing (2018, neutral): “SAGE [26, 27], Babi´c et al. [6], Pham et al. [53] and Badger [48] leverage symbolic execution to facilitate fuzzing.”
cvc5: A Versatile and Industrial-Strength SMT Solver (2022, background): “…engines for a variety of applications, including software and hardware veriﬁcation [19, 52, 60, 68, 82, 86], model checking [41, 42, 98], type checking, static analysis, security [10,62], automated test-case generation [40,135], synthesis [2,65], planning, scheduling, and optimization [127].”
Driller: Augmenting Fuzzing Through Selective Symbolic Execution (2016, background): “Other systems attempt to blend fuzzing with symbolic execution to gain maximal code coverage [6], [7], [19], [20].”
Directed Greybox Fuzzing (2017, background): “Coverage-basedwhitebox fuzzers [7, 12, 13] use symbolicexecution to increase coverage.”
AVATAR: A Framework to Support Dynamic Security Analysis of Embedded Systems' Firmwares (2014, background): “, packed or obfuscated code) and to perform a wide range of more sophisticated examinations [24] - including taint propagation [33], [55], symbolic and concolic execution [10], [15], [22], unpacking [34], malware sandboxing [1], [5], and whitebox fuzzing [28], [29].”
NAUTILUS: Fishing for Deep Bugs with Grammars (2019, methodology): “More advanced techniques are either taint-based [24], [27], [29], [43], [50], symbolic [26], or concolic [31], [32], [46] (a portmanteau of concrete and symbolic).”
Skyfire: Data-Driven Seed Generation for Fuzzing (2017, methodology): “SAGE [11, 12] and the approach in [10] leverage symbolic execution to perform fuzzing.”
Software Vulnerability Analysis and Discovery Using Machine-Learning and Data-Mining Techniques (2017, background): “— Fuzz-Testing: also known as random-testing , where well-formed input data are randomly mutated and fed to the program under test at large, while monitoring for failures (Godefroid 2007; Godefroid et al. 2012).”
kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels (2017, methodology): “Tools like SAGE [23], DART [22], KLEE [15], SmartFuzz [33], or Mayhem [16] try to enumerate complex paths by using techniques such as symbolic execution and constraint solving.”
SOK: (State of) The Art of War: Offensive Techniques in Binary Analysis (2016, background): “Thus, researchers have paired fuzzing with symbolic execution [14], [15], [17], [28], [29], [54].”
VUzzer: Application-aware Evolutionary Fuzzing (2017, positive): “There exist a number of approaches to make fuzzing more efficient, for example, by applying symbolic execution and dynamic taint analysis to solve branch constraints [20]–[24], [26].”
Steelix: program-state based binary fuzzing (2017, methodology): “SAGE [31, 32] leverages symbolic analysis on execution traces and relies on constraint solving to generate tests.”
Embed and Project: Discrete Sampling with Universal Hashing (2013, methodology): “For our experiments, we focus on software (SW) verification, u sing an industrial benchmark [18] produced by Microsoft’s SAGE system [19, 20].”
Handling a trillion (unfixable) flaws on a billion devices: Rethinking network security for the Internet-of-Things (2015, methodology): “Given the abstract model, we can apply techniques like fuzzing [19,22] or “monkeying” [8,10,34].”