Academic papers related to fuzzing, binary analysis, and exploit dev, which I want to read or have already read
See the codeREADME
Note
The sole purpose of this repository is to help me organize recent academic papers related to fuzzing, binary analysis, IoT security, and general exploitation. This is a non-exhausting list, even though I'll try to keep it updated... Feel free to suggest decent papers via a PR.
Table of Contents
Read & Tagged
- 2023 - Dissecting American Fuzzy Lop A FuzzBench Evaluation ✓
- Tags:: AFL, collisions, hitcounts, timeout, novelty search, corpus culling, score calculation, corpus scheduling, splicing
- 2022 - DARWIN: Survival of the Fittest Fuzzing Mutators ✓
- Tags: mutation scheduling, evolution strategy, AFL, AFL-MOpT, fuzzbench, magma, ecofuzz
- 2022 - Removing Uninteresting Bytes in Software Fuzzing ✓
- Tags: seed optimization, seed minimization, diar, coverage-guided
- 2021 - An Empirical Study of OSS-Fuzz Bugs ✓
- Tags: flaky bugs, clusterfuzz, sanitizer, bug detection, bug classification, time-to-fix, time-to-detect
- 2020 - Corpus Distillation for Effective Fuzzing ✓
- Tags: corpus minimization, afl-cmin, google fuzzer test suite, FTS, minset, AFL
- 2020 - Symbolic execution with SymCC: Don't interpret, compile! ✓
- Tags: KLEE, QSYM, LLVM, C, C++, compiler, symbolic execution, concolic execution, source code level, IR, angr, Z3, DARPA corpus, AFL
- 2020 - WEIZZ: Automatic Grey-Box Fuzzing for Structured Binary Formats ✓
- Tags: REDQUEEN, chunk-based formats, AFLSmart, I2S, checksums, magix bytes, QEMU, Eclipser, short fuzzing runs,
- 2020 - Efficient Binary-Level Coverage Analysis ✓
- Tags: bcov, detour + trampoline, basic block coverage, sliced microexecution, superblocks, strongly connected components, dominator graph, BAP, angr, IDA, DynamoRIO, Intel PI, BAP, angr, IDA, DynamoRIO, Intel PIN
- 2020 - Test-Case Reduction via Test-Case Generation: Insights From the Hypothesis Reducer ✓
- Tags: Test case reducer, property based testing, CSmith, test case generation, hierachical delta debugging
- 2020 - AFL++: Combining Incremental Steps of Fuzzing Research ✗
- Tags: AFL++, AFL, MOpt, LAF-Intel, Fuzzbench, Ngram, RedQueen, Unicorn, QBDI, CmpLog, AFLFast
- 2020 - FirmXRay: Detecting Bluetooth Link Layer Vulnerabilities From Bare-Metal Firmware ✓
- Tags: Ghdira, static analysis, sound disassembly, base address finder, BLE, vulnerability discovery
- 2020 - P2IM: Scalable and Hardware-independent Firmware Testing via Automatic Peripheral Interface Modeling ✓
- Tags: HALucinator, emulation, firmware, QEMU, AFL, requires source, MCU, peripheral abstraction
- 2020 - What Exactly Determines the Type? Inferring Types with Context ✓
- Tags: context assisted type inference, stripped binaries, variable and type reconstruction, IDA Pro, Word2Vec, CNN,
- 2020 - Causal Testing: Understanding Defects’ Root Causes ✓
- Tags: Defects4J, causal relationships, Eclipse plugin, unit test mutation, program trace diffing, static value diffing, user study
- 2020 - AURORA: Statistical Crash Analysis for Automated Root Cause Explanation ⚠
- Tags: RCA, program traces, input diversification, Intel PIN, Rust, CFG,
- 2020 - ParmeSan: Sanitizer-guided Greybox Fuzzing ✓
- Tags: interprocedural CFG, data flow analysis, directed fuzzing (DGF), disregarding 'hot paths', LAVA-M based primitives, LLVM, Angora, AFLGo, ASAP, santizer dependent
- 2020 - Magma: A Ground-Truth Fuzzing Benchmark ✓
- Tags: best practices, fuzzer benchmarking, ground truth, Lava-M
- 2020 - Fitness Guided Vulnerability Detection with Greybox Fuzzing ✓
- Tags: AFL, vuln specific fitness metric (headroom), buffer/integer overflow detection, AFLGo, pointer analysis, CIL, bad benchmarking
- 2020 - GREYONE: Data Flow Sensitive Fuzzing ✓
- Tags: data-flow fuzzing, taint-guided mutation, input prioritization, constraint conformance, REDQUEEN, good evaluation, VUzzer
- 2020 - FairFuzz-TC: a fuzzer targeting rare branches ✓
- Tags: AFL, required seeding, branch mask
- 2020 - Fitness Guided Vulnerability Detection with Greybox Fuzzing ✓
- Tags: AFL, vuln specific fitness metric (headroom), buffer/integer overflow detection, AFLGo, pointer analysis, CIL, bad evaluation
- 2020 - TOFU: Target-Oriented FUzzer ✓
- Tags: DGF, structured mutations, staged fuzzing/learning of cli args, target fitness, structure aware, Dijkstra for priority, AFLGo, Superion
- 2020 - FuZZan: Efficient Sanitizer Metadata Design for Fuzzing ✓
- Tags:: sanitizer metadata, optimization, ASAN, MSan, AFL
- 2020 - Boosting Fuzzer Efficiency: An Information Theoretic Perspective ✓
- Tags:: Shannon entropy, seed power schedule, libfuzzer, active SLAM, DGF, fuzzer efficiency
- 2020 - Learning Input Tokens for Effective Fuzzing ✓
- Tags: dynamic taint tracking, parser checks, magic bytes, creation of dict inputs for fuzzers
- 2020 - A Review of Memory Errors Exploitation in x86-64 ✓
- Tags: NX, canaries, ASLR, new mitigations, mitigation evaluation, recap on memory issues
- 2020 - SoK: The Progress, Challenges, and Perspectives of Directed Greybox Fuzzing ✓
- Tags: SoK, directed grey box fuzzing, AFL, AFL mutation operators, DGF vs CGF
- 2020 - MemLock: Memory Usage Guided Fuzzing ✓
- Tags: memory consumption, AFL, memory leak, uncontrolled-recursion, uncontrolled-memory-allocation, static analysis
- 2019 - Matryoshka: Fuzzing Deeply Nested Branches ✓
- Tags: AFL, QSYM, Angora, path constraints, nested conditionals, (post) dominator trees, gradient descent, REDQUEEN, LAVA-M
- 2019 - Building Fast Fuzzers ✓
- Tags: grammar based fuzzing, optimization, bold claims, comparison to badly/non-optimized fuzzers, python, lots of micro-optimizations, nice protocolling of failures, bad ASM optimization
- 2019 - Not All Bugs Are the Same: Understanding, Characterizing, and Classifying the Root Cause of Bugs ✓
- Tags: RCA via bug reports, classification model, F score,
- 2019 - AntiFuzz: Impeding Fuzzing Audits of Binary Executables ✓
- Tags: anti fuzzing, prevent crashes, delay executions, obscure coverage information, overload symbolic execution
- 2019 - MOpt: Optimized Mutation Scheduling for Fuzzers ✓
- Tags: mutation scheduling, particle swarm optimization (PSO), AFL, AFL mutation operators, VUzzer,
- 2019 - FuzzFactory: Domain-Specific Fuzzing with Waypoints ✓
- Tags: domain-specific fuzzing, AFL, LLVM, solve hard constraints like cmp, find dynamic memory allocations, binary-based
- 2019 - Fuzzing File Systems via Two-Dimensional Input Space Exploration ✓
- Tags: Ubuntu, file systems, library OS, ext4, brtfs, meta block mutations, edge cases
- 2019 - REDQUEEN: Fuzzing with Input-to-State Correspondence ⚠
- Tags: feedback-driven, AFL, magic-bytes, nested contraints, input-to-state correspondence, I2S
- 2019 - PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary ✓
- Tags: kernel, android, userland, embedded, hardware, Linux, device driver, WiFi
- 2019 - FirmFuzz: Automated IoT Firmware Introspection and Analysis ✓
- Tags: emulation, firmadyne, BOF, XSS, CI, NPD, semi-automatic
- 2019 - Firm-AFL: High-Throughput Greybox Fuzzing of IoT Firmware via Augmented Process Emulation ✓
- Tags: emulation, qemu, afl, full vs user mode, syscall redirect, "augmented process emulation", firmadyne
- 2018 - A Survey of Automated Root Cause Analysisof Software Vulnerability ✓
- Tags: Exploit mitigations, fuzzing basics, symbolic execution basics, fault localization, high level
- 2018 - PhASAR: An Inter-procedural Static Analysis Framework for C/C++ ✓
- Tags: LLVM, (inter-procedural) data-flow analysis, call-graph, points-to, class hierachy, CFG, IR
- 2018 - INSTRIM: Lightweight Instrumentation for Coverage-guided Fuzzing ✓
- Tags: LLVM, instrumentation optimization, graph algorithms, selective instrumentation, coverage calculation
- 2018 - What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices ✓
- Tags: embedded, challenges, heuristics, emulation, crash classification, fault detection
- 2018 - Evaluating Fuzz Testing ✓
- Tags: fuzzing evaluation, good practices, bad practices
- 2017 - Root Cause Analysis of Software Bugs using Machine Learning Techniques ✓
- Tags: ML, RC prediction for filed bug reports, unsupervised + supervised combination, RC categorisation, F score
- 2017 - kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels ✓
- Tags: intel PT, kernel, AFL, file systems, Windows, NTFS, Linux, ext, macOS, APFS, driver, feedback-driven
- 2016 - Driller: Argumenting Fuzzing Through Selective Symbolic Execution ✓
- Tags: DARPA, CGC, concolic execution, hybrid fuzzer, binary based
- 2015 - Challenges with Applying Vulnerability Prediction Models ✓
- Tags: VPM vs DPM, prediction models on large scale systems, files with frequent changes leave more vulns, older code exhibits more vulns
- 2014 - Optimizing Seed Selection for Fuzzing ✓
- Tags: BFF, (weighted) minset, peach, cover set problem, seed transferabilty, time minset, size minset, round robin
- 2013 - Automatic Recovery of Root Causes from Bug-Fixing Changes ✓
- Tags: ML + SCA, F score, AST, PPA, source tree analysis
Unread
Unread papers categorized by a common main theme.
General fuzzing implementations
- 2025 - Adaptive mutation based on multi-population evolution strategy for greybox fuzzing
- 2025 - BaSFuzz: Fuzz testing based on difference analysis for seed bytes
- 2025 - Grey-Box Fuzzing in Constrained Ultra-Large Systems: Lessons for SE Communit
- 2025 - CherryPicker: A Parallel Solving and State Sharing Hybrid Fuzzing System
- 2025 - Novelty Not Found: Exploring Input Shadowing in Fuzzing through Adaptive Fuzzer Restarts
- 2025 - AutoFuzz: automatic fuzzer-sanitizer scheduling with multi-armed bandit
- 2025 - RuMono: Fuzz Driver Synthesis for Rust Generic APIs
- 2025 - Improving seed quality with historical fuzzing results
- 2025 - A Fuzzing Tool Based on Automated Grammar Detection
- 2025 - ROSA: Finding Backdoors with Fuzzing
- 2025 - Invivo Fuzzing by Amplifying Actual Executions ✓
- 2025 - QMSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing ✓
- 2024 - LibAFL-DiFuzz: Advanced Architecture Enabling Directed Fuzzing
- 2024 - Program Environment Fuzzing
- 2024 - Logos: Log Guided Fuzzing for Protocol Implementations ✓
- 2024 - DDGF: Dynamic Directed Greybox Fuzzing with Path Profiling ✓
- 2024 - Sleuth: A Switchable Dual-Mode Fuzzer to Investigate Bug Impacts Following a Single PoC ✓
- 2024 - Tumbling Down the Rabbit Hole: How do Assisting Exploration Strategies Facilitate Grey-box Fuzzing? ✓
- 2024 - Modularizing Directed Greybox Fuzzing for Binaries over Multiple CPU Architectures ✓
- 2024 - LOOL: Low-Overhead, Optimization-Log-Guided Compiler Fuzzing ✓
- 2024 - Visualization Task Taxonomy to Understand the Fuzzing Internals ✓
- 2024 - Directed or Undirected: Investigating Fuzzing Strategies in a CI/CD Setup ✓
- 2024 - ZigZagFuzz: Interleaved Fuzzing of Program Options and Files ✓
- 2024 - Tango: Extracting Higher-Order Feedback through State Inference ✓
- 2024 - Directed Fuzzing Based on Bottleneck Detection ✓
- 2024 - Look Ma, No Input Samples! Mining Input Grammars from Code with Symbolic Parsing ✓
- 2024 - HuntFUZZ: Enhancing Error Handling Testing through Clustering Based Fuzzing ✓
- 2024 - AIMFuzz: Automated Function-Level In-Memory Fuzzing on Binaries ✓
- 2024 - Data Coverage for Guided Fuzzing ✓
- 2024 - Fuzzing at Scale: The Untold Story of the Scheduler ✓
- 2024 - FOX: Coverage-guided Fuzzing as Online Stochastic Control ✓
- 2024 - Fuzzing-based grammar learning from a minimal set of seed inputs ✓
- 2024 - LinFuzz: Program-Sensitive Seed Scheduling Greybox Fuzzing Based on LinUCB Algorithm ✓
- 2024 - Graphuzz: Data-driven Seed Scheduling for Coverage-guided Greybox Fuzzing ✓
- 2024 - Towards Tightly-coupled Hybrid Fuzzing via Excavating Input Specifications ✓
- 2024 - BazzAFL: Moving Fuzzing Campaigns Towards Bugs Via Grouping Bug-Oriented Seeds ✓
- 2024 - DeepGo: Predictive Directed Greybox Fuzzing ✓
- 2024 - LibAFL QEMU: A Library for Fuzzing-oriented Emulation ✓
- 2023 - Beyond the Coverage Plateau: A Comprehensive Study of Fuzz Blockers ✓
- 2023 - NestFuzz: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic ✓
- 2023 - DSFuzz: Detecting Deep State Bugs with Dependent State Exploration ✓
- 2023 - FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing ✓
- 2023 - Make out like a (Multi-Armed) Bandit: Improving the Odds of Fuzzer Seed Scheduling with T-Scheduler ✓
- 2023 - SYNTONY: Potential-Aware Fuzzing with Particle Swarm Optimization ✓
- 2023 - Triereme: Speeding up hybrid fuzzing through efficient query scheduling ✓
- 2023 - Hybrid Testing: Combining Static Analysis and Directed Fuzzing ✓
- 2023 - Titan : Efficient Multi-target Directed Greybox Fuzzing ✓
- 2023 - SpecFuzzer: A Tool for Inferring Class Specifications via Grammar-based Fuzzing ✓
- 2023 - Hopper: Interpretative Fuzzing for Libraries ✓
- 2023 - Enhancing Coverage-Guided Fuzzing via Phantom Program ✓
- 2023 - Hyperfuzzing: black-box security hypertesting with a grey-box fuzzer ✓
- 2023 - SHAPFUZZ: Efficient Fuzzing via Shapley-Guided Byte Selection ✓
- 2023 - PSOFuzz - Fuzzing Processors with Particle Swarm Optimization ✓
- 2023 - SymRustC: A Hybrid Fuzzer for Rust ✓
- 2023 - Finch: Fuzzing with Quantitative and Adaptive Hot-Bytes Identification ✓
- 2023 - HyperGo: Probability-based Directed Hybrid Fuzzing ✓
- 2023 - CrabSandwich: Fuzzing Rust with Rust ✓
- 2023 - InFuzz: An Interactive Tool for Enhancing Efficiency in Fuzzing through Visual Bottleneck Analysis ✓
- 2023 - Rare Path Guided Fuzzing∗ ✓
- 2023 - Guiding Greybox Fuzzing with Mutation Testing ✓
- 2023 - FGo: A Directed Grey-box Fuzzer with Probabilistic Exponential cut-the-loss Strategies ✓
- 2023 - FISHFUZZ: Catch Deeper Bugs by Throwing Larger Nets ✓
- 2023 - PosFuzz: augmenting greybox fuzzing with effective position distribution ✓
- 2023 - Bottleneck Analysis via Grammar-based Performance Fuzzing* ✓
- 2023 - What Happens When We Fuzz? Investigating OSS-Fuzz Bug History ✓
- 2023 - Toss a Fault to Your Witcher: Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect SQL and Command Injection Vulnerabilities ✓
- 2023 - Large Language Models are Edge-Case Fuzzers: Testing Deep Learning Libraries via FuzzGPT ✓
- 2023 - SBFT Tool Competition 2023 - Fuzzing Track ✓
- 2023 - CarpetFuzz: Automatic Program Option Constraint Extraction from Documentation for Fuzzing ✓
- 2023 - Learning Seed-Adaptive Mutation Strategies for Greybox Fuzzing ✓
- 2023 - Directed Greybox Fuzzing with Stepwise Constraint Focusing ✓
- 2023 - Generation-based fuzzing? Don’t build a new generator, reuse! ✓
- 2023 - RCABench: Open Benchmarking Platform for Root Cause Analysis ✓
- 2023 - Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis ✓
- 2023 - DAISY: Effective Fuzz Driver Synthesis with Object Usage Sequence Analysis ✓
- 2023 - autofz: Automated Fuzzer Composition at Runtime ✓
- 2023 - Towards Hybrid Fuzzing with Multi-level Coverage Tree and Reinforcement Learning in Greybox Fuzzing ✓
- 2023 - Fuzzing, Symbolic Execution, and Expert Guidance for Better Testing ✓
- 2023 - Fuzzing vs SBST: Intersections & Differences ✓
- 2023 - Evaluating the Fork-Awareness of Coverage-Guided Fuzzers ✓
- 2023 - Homo in Machina: Improving Fuzz Testing Coverage via Compartment Analysis ✓
- 2023 - The fun in fuzzing - The debugging techniquie comes into its own ✓
- 2023 - Reachable Coverage: Estimating Saturation in Fuzzing ✓
- 2023 - A Seed Scheduling Method With a Reinforcement Learning for a Coverage Guided Fuzzing ✓
- 2023 - SelectFuzz: Efficient Directed Fuzzing with Selective Path Exploration ✓
- 2022 - Explainable Fuzzer Evaluation ✓
- 2022 - Rare-Seed Generation for Fuzzing ✓
- 2022 - How to Compare Fuzzers ✓
- 2022 - Valkyrie: Improving Fuzzing Performance Through Deterministic Techniques ✓
- 2022 - FUZZING DEEPER LOGIC WITH IMPEDING FUNCTION TRANSFORMATION ✓
- 2022 - Alphuzz: Monte Carlo Search on Seed-Mutation Tree for Coverage-Guided Fuzzing ✓
- 2022 - AutoGenD: fuzz driver generation for binary libraries without header files and symbol information ✓
- 2022 - Mutation Optimization of Directional Fuzzing for Cumulative Defects ✓
- 2022 - IMPROVING AFL++ CMPLOG: TACKLING THE BOTTLENECKS ✓
- 2022 - One Fuzz Doesn’t Fit All: Optimizing Directed Fuzzing via Target-tailored Program State Restriction ✓
- 2022 - POLYFUZZ: Holistic Greybox Fuzzing of Multi-Language Systems ✓
- 2022 - Sydr-Fuzz: Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle ✓
- 2022 - Nimbus: Toward Speed Up Function Signature Recovery via Input Resizing and Multi-Task Learning ✓
- 2022 - So Many Fuzzers, So Little Time ✓
- 2022 - SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing ✓
- 2022 - DriveFuzz: Discovering Autonomous Driving Bugs through Driving Quality-Guided Fuzzing ✓
- 2022 - UltraFuzz: Towards Resource-saving in Distributed Fuzzing ✓
- 2022 - Snappy: Efficient Fuzzing with Adaptive and Mutable Snapshots ✓
- 2022 - FuzzerAid: Grouping Fuzzed Crashes Based On Fault Signatures ✓
- 2022 - Automatically Seed Corpus and Fuzzing Executables Generation Using Test Framework ✓
- 2022 - CAMFuzz: Explainable Fuzzing with Local Interpretation ✓
- 2022 - Efficient Greybox Fuzzing to Detect Memory Errors ✓
- 2022 - LibAFL: A Framework to Build Modular and Reusable Fuzzers ✗
- 2022 - FishFuzz: Throwing Larger Nets to Catch Deeper Bugs ✓
- 2022 - SYMSAN: Time and Space Efficient Concolic Execution via Dynamic Data-flow Analysis ✓
- 2022 - AMSFuzz: An adaptive mutation schedule for fuzzing ✓
- 2022 - FixReverter: A Realistic Bug Injection Methodology for Benchmarking Fuzz Testing ✓
- 2022 - Multiple Targets Directed Greybox Fuzzing ✓
- 2022 - Combining BMC and Fuzzing Techniques for Finding Software Vulnerabilities in Concurrent Programs ✓
- 2022 - DocTer: Documentation-Guided Fuzzing for Testing Deep Learning API Functions ✓
- 2022 - Obtaining Fuzzing Results with Different Timeouts ✓
- 2022 - FASSFuzzer—An Automated Vulnerability Detection System for Android System Services ✓
- 2022 - WindRanger: A Directed Greybox Fuzzer driven by Deviation Basic Blocks ✗
- 2022 - Drifuzz: Harvesting Bugs in Device Drivers from Golden Seeds ✓
- 2022 - GraphFuzz: Library API Fuzzing with Lifetime-aware Dataflow Graphs ✓
- 2022 - AcoFuzz: Adaptive Energy Allocation for Greybox Fuzzing ✓
- 2022 - TargetFuzz: Using DARTs to Guide Directed Greybox Fuzzers ✓
- 2022 - Fast Fuzzing for Memory Errors ✓
- 2022 - Stateful Greybox Fuzzing ✓
- 2022 - Metamorphic Fuzzing of C++ Libraries ✓
- 2022 - Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis ✓
- 2022 - Comparing Fuzzers on a Level Playing Field with FuzzBench ✓
- 2022 - Vulnerability-oriented directed fuzzing for binary programs ✓
- 2022 - An Improvement of AFL Based On The Function Call Depth ✓
- 2022 - FuzzingDriver: the Missing Dictionary to Increase Code Coverage in Fuzzers ✓
- 2022 - BeDivFuzz: Integrating Behavioral Diversity into Generator-based Fuzzing ✓
- 2022 - One Fuzzing Strategy to Rule Them All ✓
- 2022 - Grammars for Free: Toward Grammar Inference for Ad Hoc Parsers ✓
- 2022 - Fuzzing Class Specifications ✓
- 2022 - Mutation Analysis: Answering the Fuzzing Challenge ✓
- 2022 - Ferry: State-Aware Symbolic Execution for Exploring State-Dependent Program Paths ✓
- 2022 - BEACON : Directed Grey-Box Fuzzing with Provable Path Pruning ✓
- 2022 - MORPHUZZ: Bending (Input) Space to Fuzz Virtual Devices ✓
- 2021 - A parallel fuzzing method based on two-stage mutation ✓
- 2021 - Better Pay Attention Whilst Fuzzing ✓
- 2021 - Diar: Removing Uninteresting Bytes from Seeds in Software Fuzzing ✓
- 2021 - Reducing Time-To-Fix For Fuzzer Bugs ✓
- 2021 - Casr-Cluster: Crash Clustering for Linux Applications ✓
- 2021 - Fuzzm: Finding Memory Bugs through Binary-Only Instrumentation and Fuzzing of WebAssembly ✓
- 2021 - InstruGuard: Find and Fix Instrumentation Errors for Coverage-based Greybox Fuzzing ✓
- 2021 - POSTER: OS Independent Fuzz Testing of I/O Boundary ✓
- 2021 - HDBFuzzer–Target-oriented Hybrid Directed Binary Fuzzer ✓
- 2021 - ovAFLow: Detecting Memory Corruption Bugs with Fuzzing-based Taint Inference ✓
- 2021 - SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel ✓
- 2021 - SiliFuzz: Fuzzing CPUs by proxy ✓
- 2021 - Same Coverage, Less Bloat: Accelerating Binary-only Fuzzing with Coverage-preserving Coverage-guided Tracing ✓
- 2021 - Facilitating Parallel Fuzzing with Mutually-exclusive Task Distribution ✓
- 2021 - PATA: Fuzzing with Path Aware Taint Analysis ✓
- 2021 - BSOD: Binary-only Scalable fuzzing Of device Drivers ✓
- 2021 - FuzzBench: An Open Fuzzer Benchmarking Platform and Service ✓
- 2021 - My Fuzzer Beats Them All! Developing a Framework for Fair Evaluation and Comparison of Fuzzers ✓
- 2021 - Scalable Fuzzing of Program Binaries with E9AFL ✓
- 2021 - HyperFuzzer: An Efficient Hybrid Fuzzer for Virtual CPUs ✓
- 2021 - BigMap: Future-proofing Fuzzers with Efficient Large Maps ✓
- 2021 - Token-Level Fuzzing ✓
- 2021 - Hashing Fuzzing: Introducing Input Diversity to Improve Crash Detection ✗
- 2021 - LeanSym: Efficient Hybrid Fuzzing Through Conservative Constraint Debloating ✓
- 2021 - ESRFuzzer: an enhanced fuzzing framework for physical SOHO router devices to discover multi-Type vulnerabilities ✓
- 2021 - KCFuzz: Directed Fuzzing Based on Keypoint Coverage ✓
- 2021 - TCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing ✓
- 2021 - Fuzzing with optimized grammar-aware mutation strategies ✓
- 2021 - Directed Fuzzing for Use-After-FreeVulnerabilities Detection ✓
- 2021 - DIFUZZRTL: Differential Fuzz Testing to FindCPU Bugs ✓
- 2021 - Z-Fuzzer: device-agnostic fuzzing of Zigbee protocol implementation ✓
- 2021 - Fuzzing with Multi-dimensional Control of Mutation Strategy ✓
- 2021 - Using a Guided Fuzzer and Preconditions to Achieve Branch Coverage with Valid Inputs ✓
- 2021 - RIFF: Reduced Instruction Footprint for Coverage-Guided Fuzzing ✓
- 2021 - CoCoFuzzing: Testing Neural Code Models with Coverage-Guided Fuzzing ✓
- 2021 - Seed Selection for Successful Fuzzing ✓
- 2021 - Gramatron: Effective Grammar-Aware Fuzzing ✓
- 2021 - Hyntrospect: a fuzzer for Hyper-V devices ✓
- 2021 - FUZZOLIC: mixing fuzzing and concolic execution ✓
- 2021 - QFuzz: Quantitative Fuzzing for Side Channels ✓
- 2021 - Revizor: Fuzzing for Leaks in Black-box CPUs ✓
- 2021 - Unleashing Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing ✓
- 2021 - Constraint-guided Directed Greybox Fuzzing ✓
- 2021 - Test-Case Reduction and Deduplication Almost forFree with Transformation-Based Compiler Testing ✓
- 2021 - RULF: Rust Library Fuzzing via API Dependency Graph Traversal ✓
- 2021 - STOCHFUZZ: Sound and Cost-effective Fuzzing of Stripped Binaries by Incremental and Stochastic Rewriting ✓
- 2021 - PS-Fuzz: Efficient Graybox Firmware Fuzzing Based on Protocol State ✓
- 2021 - MuDelta: Delta-Oriented Mutation Testing at Commit Time ✓
- 2021 - CollabFuzz: A Framework for Collaborative Fuzzing ✓
- 2021 - MUTAGEN: Faster Mutation-Based Random Testing ✓
- 2021 - Inducing Subtle Mutations with Program Repair ✓
- 2021 - Differential Analysis of X86-64 Instruction Decoders ✓
- 2021 - On Introducing Automatic Test Case Generation in Practice: A Success Story and Lessons Learned ✓
- 2021 - A Priority Based Path Searching Method for Improving Hybrid Fuzzing ✓
- 2021 - IntelliGen: Automatic Driver Synthesis for Fuzz Testing ✓
- 2021 - icLibFuzzer: Isolated-context libFuzzer for Improving Fuzzer Comparability ✓
- 2021 - SN4KE: Practical Mutation Testing at Binary Level ✓
- 2021 - One Engine to Fuzz ’em All: Generic Language Processor Testing with Semantic Validation ✓
- 2021 - Growing A Test Corpus with Bonsai Fuzzing ✓
- 2021 - Fuzzing Symbolic Expressions ✓
- 2021 - JMPscare: Introspection for Binary-Only Fuzzing ✓
- 2021 - An Improved Directed Grey-box Fuzzer ✓
- 2021 - A Binary Protocol Fuzzing Method Based on SeqGAN ✓
- 2021 - Refined Grey-Box Fuzzing with Sivo ✓
- 2021 - PSOFuzzer: A Target-Oriented Software Vulnerability Detection Technology Based on Particle Swarm Optimization ✓
- 2021 - MooFuzz: Many-Objective Optimization Seed Schedule for Fuzzer ✓
- 2021 - CMFuzz: context-aware adaptive mutation for fuzzers ✓
- 2021 - GTFuzz: Guard Token Directed Grey-Box Fuzzing ✓
- 2021 - ProFuzzBench: A Benchmark for Stateful Protocol Fuzzing ✓
- 2021 - SymQEMU:Compilation-based symbolic execution for binaries ✓
- 2021 - CONCOLIC EXECUTION TAILORED FOR HYBRID FUZZING THESIS ⚠
- 2021 - Breaking Through Binaries: Compiler-quality Instrumentationfor Better Binary-only Fuzzing ✓
- 2021 - AlphaFuzz: Evolutionary Mutation-based Fuzzing as Monte Carlo Tree Search ✓
- 2020 - Fuzzing with Fast Failure Feedback ✓
- 2020 - LAFuzz: Neural Network for Efficient Fuzzing ✓
- 2020 - MaxAFL: Maximizing Code Coverage with a Gradient-Based Optimization Technique ✓
- 2020 - Program State Abstraction for Feedback-Driven Fuzz Testing using Likely Invariants ✓
- 2020 - PMFuzz: Test Case Generation for Persistent Memory Programs ✓
- 2020 - FuSeBMC: A White-Box Fuzzer for Finding Security Vulnerabilities in C Programs ✓
- 2020 - Integrity: Finding Integer Errors by Targeted Fuzzing ✓
- 2020 - ConFuzz: Coverage-guided Property Fuzzing for Event-driven Programs ✓
- 2020 - AFLTurbo: Speed up Path Discovery for Greybox Fuzzing ✓
- 2020 - Fuzzing Channel-Based Concurrency Runtimes using Types and Effects ✓
- 2020 - DeFuzz: Deep Learning Guided Directed Fuzzing ✓
- 2020 - CrFuzz: Fuzzing Multi-purpose Programs through InputValidation ✓
- 2020 - EPfuzzer: Improving Hybrid Fuzzing with Hardest-to-reach Branch Prioritization ✓
- 2020 - Fuzzing Based on Function Importance by Interprocedural Control Flow Graph ✓
- 2020 - UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers ✓
- 2020 - PathAFL: Path-Coverage Assisted Fuzzing ✓
- 2020 - Path Sensitive Fuzzing for Native Applications ✓
- 2020 - UniFuzz: Optimizing Distributed Fuzzing via Dynamic Centralized Task Scheduling ✓
- 2020 - Fuzzing Error Handling Code using Context-Sensitive Software Fault Injection ✓
- 2020 - SpecFuzz: Bringing Spectre-type vulnerabilities to the surface ✓
- 2020 - Zeror: Speed Up Fuzzing with Coverage-sensitive Tracing and Scheduling ✓
- 2020 - MUZZ: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs ✓
- 2020 - Evolutionary Grammar-Based Fuzzing ✓
- 2020 - AFLpro: Direction sensitive fuzzing ✓
- 2020 - CSI-Fuzz: Full-speed Edge Tracing Using Coverage Sensitive Instrumentation ✓
- 2020 - Scalable Greybox Fuzzing for Effective Vulnerability Management DISS ✓
- 2020 - HotFuzz Discovering Algorithmic Denial-of-Service Vulnerabilities through Guided Micro-Fuzzing ✓
- 2020 - Fuzzing Binaries for Memory Safety Errors with QASan ✓
- 2020 - Suzzer: A Vulnerability-Guided Fuzzer Based on Deep Learning ✓
- 2020 - IJON: Exploring Deep State Spaces via Fuzzing ⚠
- 2020 - Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities ✓
- 2020 - PANGOLIN: Incremental Hybrid Fuzzing with Polyhedral Path Abstraction ✓
- 2020 - UEFI Firmware Fuzzing with Simics Virtual Platform ✓
- 2020 - Typestate-Guided Fuzzer for Discovering Use-after-Free Vulnerabilities ✓
- 2020 - FuzzGuard: Filtering out Unreachable Inputs in Directed Grey-box Fuzzing through Deep Learning ✓
- 2020 - HyDiff: Hybrid Differential Software Analysis ✓
- 2019 - Engineering a Better Fuzzer with SynergicallyIntegrated Optimizations ✓
- 2019 - Superion: Grammar-Aware Greybox Fuzzing ✓
- 2019 - ProFuzzer: On-the-fly Input Type Probing for Better Zero-day Vulnerability Discovery ✓
- 2019 - Grimoire: Synthesizing Structure while Fuzzing ✓
- 2019 - Ptrix: Efficient Hardware-Assisted Fuzzing for COTS Binary ✓
- 2019 - SAVIOR: Towards Bug-Driven Hybrid Testing ✓
- 2019 - FUDGE: Fuzz Driver Generation at Scale ✓
- 2019 - NAUTILUS: Fishing for Deep Bugs with Grammars ⚠
- 2019 - Send Hardest Problems My Way: Probabilistic Path Prioritization for Hybrid Fuzzing ✓
- 2019 - EnFuzz: Ensemble Fuzzing with Seed Synchronization among Diverse Fuzzers ✓
- 2018 - Fuzz Testing in Practice: Obstacles and Solutions ✓
- 2018 - PAFL: Extend Fuzzing Optimizations of Single Mode to Industrial Parallel Mode ✓
- 2018 - PTfuzz: Guided Fuzzing with Processor Trace Feedback ✓
- 2018 - Angora: Efficient Fuzzing by Principled Search ✓
- 2018 - FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage ✓
- 2018 - NEUZZ: Efficient Fuzzing with Neural Program Smoothing ✓
- 2018 - CollAFL: path Sensitive Fuzzing ✗
- 2018 - Full-speed Fuzzing: Reducing Fuzzing Overhead through Coverage-guided Tracing ✓
- 2018 - QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing ✓
- 2018 - Coverage-based Greybox Fuzzing as Markov Chain ✓
- 2018 - MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation ✓
- 2018 - Singularity: Pattern Fuzzing for Worst Case Complexity ✓
- 2018 - Smart Greybox Fuzzing ✓
- 2018 - Hawkeye: Towards a Desired Directed Grey-box Fuzzer ✓
- 2018 - PerfFuzz: Automatically Generating Pathological Inputs ✓
- 2018 - FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage ✓
- 2018 - Enhancing Memory Error Detection for Large-Scale Applications and Fuzz Testing ✓
- 2018 - T-Fuzz: fuzzing by program transformation ✓
- 2017 - Evaluating and improving fault localization ✓
- 2017 - IMF: Inferred Model-based Fuzzer ✓
- 2017 - Synthesizing Program Input Grammars ✓
- 2017 - Steelix: Program-State Based Binary Fuzzing ✓
- 2017 - Designing New Operating Primitives to ImproveFuzzing Performance ✓
- 2017 - VUzzer: Application-aware Evolutionary Fuzzing ✓
- 2017 - DIFUZE: Interface Aware Fuzzing for Kernel Drivers ✓
- 2017 - Instruction Punning: Lightweight Instrumentation for x86-64 ✓
- 2017 - Designing New Operating Primitives to Improve Fuzzing Performance ✓
- 2014 - A Large-Scale Analysis of the Security of Embedded Firmwares ✓
- 2013 - Scheduling Black-box Mutational Fuzzing ✓
- 2013 - Dowsing for Overflows: A Guided Fuzzer to Find Buffer Boundary Violations ✓
- 2013 - RPFuzzer: A Framework for Discovering Router Protocols Vulnerabilities Based on Fuzzing ✓
- 2011 - Offset-Aware Mutation based Fuzzing for Buffer Overflow Vulnerabilities: Few Preliminary Results ✓
- 2010 - TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection ✓
- 2009 - Taint-based Directed Whitebox Fuzzing ✓
- 2009 - Dynamic Test Generation To Find Integer Bugs in x86 Binary Linux Programs ✓
- 2008 - Grammar-based Whitebox Fuzzing ✓
- 2008 - Vulnerability Analysis for X86 Executables Using Genetic Algorithm and Fuzzing ✓
- 2008 - KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs ✓
- 2008 - Automated Whitebox Fuzz Testing ✓
- 2005 - DART: Directed Automated Random Testing ✓
- 1994 - Dominators, Super Blocks, and Program Coverage ✓
Harnessing
- 2023 - AFGen: Whole-Function Fuzzing for Applications and Libraries ✓
- 2023 - NaNofuzz: A Usable Tool for Automatic Test Generation ✓
AI/LLM
- 2025 - SAFLITE: Fuzzing Autonomous Systems via Large Language Models
- 2025 - Large Language Model assisted Hybrid Fuzzing
- 2025 - A Roadmap for Software Testing in Open-Collaborative and AI-Powered Era
- 2025 - LLM-Powered Fuzz Testing of Automotive Diagnostic Protocols
- 2024 - Fixing Security Vulnerabilities with AI in OSS-Fuzz
- 2024 - Pentest GPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing
- 2024 - AutoSafeCoder: A Multi-Agent Framework for Securing LLM Code Generation through Static Analysis and Fuzz Testing
- 2024 - Fixing Security Vulnerabilities with AI in OSS-Fuzz ✓
- 2024 - ChatHTTPFuzz: Large Language Model-Assisted IoT HTTP Fuzzing ✓
- 2024 - Harnessing Large Language Models for Seed Generation in Greybox Fuzzing ✓
- 2024 - Magneto: A Step-Wise Approach to Exploit Vulnerabilities in Dependent Libraries via LLM-Empowered Directed Fuzzing ✓
- 2024 - Fuzzing BusyBox: Leveraging LLM and Crash Reuse for Embedded Bug Unearthing ✓
- 2024 - My Fuzzers Won’t Build: An Empirical Study of Fuzzing Build Failures ✓
- 2024 - ECG: Augmenting Embedded Operating System Fuzzing via LLM-based Corpus Generation ✓
- 2024 - FUZZCODER: Byte-level Fuzzing Test via Large Language Mode ✓
- 2024 - CyberSecEval 2: A Wide-Ranging Cybersecurity Evaluation Suite for Large Language Models
- 2024 - ProphetFuzz: Fully Automated Prediction and Fuzzing of High-Risk Option Combinations with Only Documentation via Large Language Model ✓
- 2024 - Is “AI” Useful for Fuzzing? (Keynote) ✓
- 2024 - Initial Seeds Generation Using LLM for IoT Device Fuzzing ✓
- 2024 - Your Fix Is My Exploit: Enabling Comprehensive DL Library API Fuzzing with Large Language Models ✓
- 2024 - WhiteFox: White-Box Compiler Fuzzing Empowered by Large Language Models ✓
- 2024 - The Mutators Reloaded: Fuzzing Compilers with Large Language Model Generated Mutation Operators ✓
- 2024 - A Coverage-Guided Fuzzing Method for Automatic Software Vulnerability Detection Using Reinforcement Learning-Enabled Multi-Level Input Mutation ✓
- 2024 - LLAMAFUZZ: Large Language Model Enhanced Greybox Fuzzing ✓
- 2024 - Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly ✓
- 2024 - Generative AI and Large Language Models for Cyber Security: All Insights You Need ✓
- 2024 - Large Language Model guided Protocol Fuzzing ✓
- 2024 - When Fuzzing Meets LLMs: Challenges and Opportunities ✓
- 2024 - Fuzz4All: Universal Fuzzing with Large Language Models ✓
- 2024 - Large Language Models for Cyber Security: A Systematic Literature Review ✓
- 2024 - LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs’ Vulnerability Reasoning ✓
- 2024 - Fuzzing BusyBox: Leveraging LLM and Crash Reuse for Embedded Bug Unearthing ✓
- 2024 - Prompt Fuzzing for Fuzz Driver Generation ✓
- 2023 - HOW FAR HAVE WE GONE IN VULNERABILITY DETECTION USING LARGE LANGUAGE MODELS ✓
- 2023 - KernelGPT: Enhanced Kernel Fuzzing via Large Language Models ✓
- 2023 - Exploring the Limits of ChatGPT in Software Security Applications ✓
- 2023 - LLM-Based Code Generation Method for Golang Compiler Testing ✓
- 2023 - Large Language Model guided Protocol Fuzzing ✓
- 2023 - AI-assisted Vulnerability Analysis And Classification Framework for UDS on CAN-bus Fuzzer ✓
- 2023 - GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts ✓
- 2023 - FUZZLLM: A NOVEL AND UNIVERSAL FUZZING FRAMEWORK FOR PROACTIVELY DISCOVERING JAILBREAK VULNERABILITIES IN LARGE LANGUAGE MODELS ✓
- 2023 - Universal Fuzzing via Large Language Models ✓
- 2023 - Understanding Large Language Model Based Fuzz Driver Generation ✓
- 2023 - Large Language Models for Fuzzing Parsers ✓
- 2023 - Large Language Models Are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models ✓
- 2023 - Augmenting Greybox Fuzzing with Generative AI ✓
- 2023 - Understanding Programs by Exploiting (Fuzzing) Test Cases ✓
IoT fuzzing
- 2025 - EmbedFuzz: High Speed Fuzzing through Transplantation
- 2024 - Parallel Fuzzing of IoT Messaging Protocols through Collaborative Packet Generation ✓
- 2024 - TWFuzz: Fuzzing Embedded Systems with Three Wires ✓
- 2024 - IoTFuzzSentry: Hunting Bugs In The IoT Wilderness In Operational Phase Using Payload Fuzzing ✓
- 2024 - TAIFuzz: taint analysis instrumentation-based firmware fuzzing system ✓
- 2024 - RIoTFuzzer: Companion App Assisted Remote Fuzzing for Detecting Vulnerabilities in IoT Devices ✓
- 2024 - FIRMRCA: Towards Post-Fuzzing Analysis on ARM Embedded Firmware with Efficient Event-based Fault Localization ✓
- 2024 - MSLFuzzer: black-box fuzzing of SOHO router devices via message segment list inference ✓
- 2024 - MULTIFUZZ: A Multi-Stream Fuzzer For Testing Monolithic Firmware ✓
- 2023 - KVFL: Key-Value-Based Persistent Fuzzing for IoT Web Servers ✓
- 2023 - Firmulti Fuzzer: Discovering Multi-process Vulnerabilities in IoT Devices with Full System Emulation and VMI ✓
- 2023 - Fuzzability Testing Framework for Incomplete Firmware Binary ✓
- 2023 - Fuzzing Embedded Systems Using Debug Interfaces ✓
- 2023 - Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing ✓
- 2022 - FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules ✓
- 2022 - FuzzDocs: An Automated Security Evaluation Framework for IoT ✓
- 2022 - AflIot: Fuzzing on linux-based IoT device with binary-level instrumentation ✓
- 2022 - Tardis: Coverage-Guided Embedded Operating System Fuzzing ✓
- 2022 - Efficient greybox fuzzing of applications in Linux-based IoT devices via enhanced user-mode emulation ✓
- 2022 - Trampoline Over the Air: Breaking in IoT Devices Through MQTT Brokers ✓
- 2022 - PDFuzzerGen: Policy-Driven Black-Box Fuzzer Generation for Smart Devices ✓
- 2022 - RW-Fuzzer: A Fuzzing Method for Vulnerability Mining on Router Web Interface ✓
- 2022 - IoTInfer: Automated Blackbox Fuzz Testing of IoT Network Protocols Guided by Finite State Machine Inference ✓
- 2022 - Debugger-driven Embedded Fuzzing ✓
- 2022 - Game of Hide-and-Seek: Exposing Hidden Interfaces in Embedded Web Applications of IoT Devices ✓
- 2022 - 𝜇AFL: Non-intrusive Feedback-driven Fuzzing for Microcontroller Firmware ✓
- 2022 - FirVer: Concolic Testing for Systematic Validation of Firmware Binaries ✓
- 2022 - Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing ✓
- 2021 - CPscan: Detecting Bugs Caused by Code Pruning in IoT Kernels ✓
- 2021 - An Efficient Feedback-enhanced Fuzzing Scheme for Linux-based IoT Firmwares ✗
- 2021 - A Fuzzing Method for Embedded Software ✓
- 2021 - Large-scale Firmware Vulnerability Analysis Based on Code Similarity ✓
- 2021 - Towards Fast and Scalable Firmware Fuzzing with Dual-Level Peripheral Modeling ✓
- 2021 - Riding the IoT Wave with VFuzz: Discovering Security Flaws in Smart Home ✓
- 2021 - Zero WFuzzer: Target-Oriented Fuzzing for Web Interface of Embedded Devices ✓
- 2021 - StFuzzer: Contribution-Aware Coverage-Guided Fuzzing for Smart Devices ✓
- 2021 - Rtkaller: State-aware Task Generation for RTOS Fuzzing
- 2021 - IFIZZ: Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware ✓
- 2021 - Automatic Vulnerability Detection in Embedded Devices and Firmware: Survey and Layered Taxonomies ✓
- 2021 - Fuzzing the Internet of Things: A Review on the Techniques and Challenges for Efficient Vulnerability Discovery in Embedded Systems ✓
- 2021 - FIRM-COV: High-Coverage Greybox Fuzzing for IoT Firmware via Optimized Process Emulation ✓
- 2020 - Verification of Embedded Software Binaries using Virtual Prototypes ✓
- 2020 - μSBS: Static Binary Sanitization of Bare-metal Embedded Devices forFault Observability ✓
- 2020 - Device-agnostic Firmware Execution is Possible: A Concolic Execution Approach for Peripheral Emulation ✓
- 2020 - Vulnerability Detection in SIoT Applications: A Fuzzing Method on their Binaries ✓
- 2020 - FirmAE: Towards Large-Scale Emulation of IoT Firmware forDynamic Analysis ✓
- 2020 - FIRMNANO: Toward IoT Firmware Fuzzing Through Augmented Virtual Execution �
- 2020 - ARM-AFL: Coverage-Guided Fuzzing Framework for ARM-Based IoT Devices ✓
- 2020 - Bug detection in embedded environments by fuzzing and symbolic execution ✓
- 2020 - EM-Fuzz: Augmented Firmware Fuzzing via Memory Checking ✓
- 2020 - Verification of Embedded Binaries using Coverage-guided Fuzzing with System C-based Virtual Prototypes �
- 2020 - DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis ✓
- 2020 - Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware ✓
- 2020 - Taint-Driven Firmware Fuzzing of Embedded Systems ✓
- 2020 - A Dynamic Instrumentation Technology for IoT Devices ✓
- 2020 - Vulcan: a state-aware fuzzing tool for wear OS ecosystem ✓
- 2020 - A Novel Concolic Execution Approach on Embedded Device ✓
- 2020 - HFuzz: Towards automatic fuzzing testing of NB-IoT core network protocols implementations ✓
- 2020 - FIRMCORN: Vulnerability-Oriented Fuzzing of IoT Firmware via Optimized Virtual Execution ✓
- 2018 - IoTFuzzer: Discovering Memory Corruptions in IoT Through App-based Fuzzing ✓
- 2017 - Towards Automated Dynamic Analysis for Linux-based Embedded Firmware ✓
- 2016 - Scalable Graph-based Bug Search for Firmware Images ✓
- 2015 - SURROGATES: Enabling Near-Real-Time Dynamic Analyses of Embedded Systems ✓
- 2015 - Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware ✓
- 2014 - A Large-Scale Analysis of the Security of Embedded Firmwares ✓
- 2013 - RPFuzzer: A Framework for Discovering Router Protocols Vulnerabilities Based on Fuzzing ✓
Firmware Emulation
- 2025 - IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit
- 2024 - SyncEmu: Enabling Dynamic Analysis of Stateful Trusted Applications ✓
- 2022 - What You See is Not What You Get: Revealing Hidden Memory Mapping for Peripheral Modeling ✓
- 2022 - What Your Firmware Tells You Is Not How You Should Emulate It: A Specification-Guided Approach for Firmware Emulation (Extended Version) ✓
- 2022 - BEERR: Bench of Embedded system Experiments for Reproducible Research ✓
- 2022 - FIRMWIRE: Transparent Dynamic Analysis for Cellular Baseband Firmware ✓
- 2022 - An Automated Approach to Re-Hosting Embedded Firmware Through Removing Hardware Dependencies ✓
- 2021 - FIRMGUIDE: Boosting the Capability of Rehosting Embedded Linux Kernels through Model-Guided Kernel Execution ✓
- 2021 - Automatic Firmware Emulation through Invalidity-guided Knowledge Inference(Extended Version) ✓
- 2021 - Firmware Re-hosting Through Static Binary-level Porting ✓
- 2021 - Jetset: Targeted Firmware Rehosting for Embedded Systems ✓
- 2021 - Automatic Firmware Emulation through Invalidity-guided Knowledge Inference ✓
Network fuzzing
- 2025 - AFLNet Five Years Later: On Coverage-Guided Protocol Fuzzing
- 2025 - SGMFuzz: State Guided Mutation Protocol Fuzzing
- 2024 - Stateful protocol fuzzing with statemap-based reverse state selection ✓
- 2024 - No Peer, no Cry: Network Application Fuzzing via Fault Injection ✓
- 2024 - Stateful protocol fuzzing with statemap-based reverse state selection ✓
- 2024 - Gudifu: Guided Differential Fuzzing for HTTP Request Parsing Discrepancies ✓
- 2024 - Netfuzzlib: Adding First-Class Fuzzing Support to Network Protocol Implementations ✓
- 2023 - NSFuzz: Towards Eficient and State-Aware Network Service Fuzzing - RCR Report ✓
- 2023 - INTENDER: Fuzzing Intent-Based Networking with Intent-State Transition Guidance ✓
- 2023 - NSFuzz: Towards Eficient and State-Aware Network Service Fuzzing ✓
- 2022 - FitM: Binary-Only Coverage-Guided Fuzzing for Stateful Network Protocols ✓
- 2022 - WThreadAFL:Deterministic Greybox Fuzzing for Multi-threadNetwork Servers ✓
- 2022 - Model-Based Grey-Box Fuzzing of Network Protocols ✓
- 2022 - Registered Report: NSFuzz: Towards Efficient and State-Aware Network Service Fuzzing ✓
- 2022 - SnapFuzz: An Efficient Fuzzing Framework for Network Applications ✓
- 2022 - REST API Fuzzing by Coverage Level Guided Blackbox Testing ✓
- 2022 - SNPSFuzzer: A Fast Greybox Fuzzer for Stateful Network Protocols using Snapshots ✓
- 2022 - WAFL: Binary-Only WebAssembly Fuzzing with Fast Snapshots ✓
- 2021 - Nyx-Net: Network Fuzzing with Incremental Snapshots ✓
- 2021 - RapidFuzz: Accelerating Fuzzing via Generative Adversarial Networks ✓
- 2021 - StateAFL: Greybox Fuzzing for Stateful Network Servers ✓
- 2020 - AFLNET: A Greybox Fuzzer for Network Protocols ✓
- 2020 - Finding Security Vulnerabilities in Network Protocol Implementations ✓
Kernel fuzzing
- 2025 - SyzParam: Incorporating Runtime Parameters into Kernel Driver Fuzzing
- 2024 - OZZ: Identifying Kernel Out-of-Order Concurrency Bugs with In-Vivo Memory Access Reordering ✓
- 2024 - SyzLego: Enhancing Kernel Directed Greybox Fuzzing via Dependency Inference and Scheduling ✓
- 2024 - A Little Goes a Long Way: Tuning Configuration Selection for Continuous Kernel Fuzzing ✓
- 2024 - CountDown: Refcount-guided Fuzzing for Exposing Temporal Memory Errors in Linux Kernel ✓
- 2024 - Approaches to determining the attack surface for fuzzing the Linux kernel ✓
- 2024 - SyzGen++: Dependency Inference for Augmenting Kernel Driver Fuzzing ✓
- 2024 - SyzRetrospector: A Large-Scale Retrospective Study of Syzbot ✓
- 2024 - SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer ✓
- 2024 - MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency ✓
- 2023 - SyzDirect: Directed Greybox Fuzzing for Linux Kernel ✓
- 2023 - SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem ✓
- 2023 - KextFuzz: A Practical Fuzzer for macOS Kernel EXTensions on Apple Silicon ✓
- 2023 - WinkFuzz: Model-based Script Synthesis for Fuzzing ✓
- 2023 - SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers ✓
- 2023 - ACTOR: Action-Guided Kernel Fuzzing ✓
- 2023 - KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations ✓
- 2023 - BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing ✓
- 2023 - DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing ✓
- 2023 - Towards Unveiling Exploitation Potential With Multiple Error Behaviors for Kernel Bugs ✓
- 2023 - No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions ✓
- 2022 - PrIntFuzz: fuzzing Linux drivers via automated virtual device simulation ✓
- 2022 - KSG: Augmenting Kernel Fuzzing with System Call Specification Generation ✓
- 2022 - Demystifying the Dependency Challenge in Kernel Fuzzing ✓
- 2022 - Midas: Systematic Kernel TOCTTOU Protection ✓
- 2021 - Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph ✓
- 2021 - ACHyb: a hybrid analysis approach to detect kernel access control vulnerabilities ✓
- 2021 - CVFuzz: Detecting complexity vulnerabilities in OpenCL kernels via automated pathological input generation ✓
- 2021 - HEALER: Relation Learning Guided Kernel Fuzzing
- 2021 - SyzVegas: Beating Kernel Fuzzing Odds with Reinforcement Learning ✓
- 2021 - NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis ✓
- 2021 - Undo Workarounds for Kernel Bugs ✓
- 2020 - A Hybrid Interface Recovery Method for Android Kernels Fuzzing ✓
- 2020 - FINDING RACE CONDITIONS IN KERNELS:FROM FUZZING TO SYMBOLIC EXECUTION - THESIS ✓
- 2020 - Agamotto: Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints ✓
- 2020 - X-AFL: a kernel fuzzer combining passive and active fuzzing ✓
- 2020 - Identification of Kernel Memory Corruption Using Kernel Memory Secret Observation Mechanism ✓
- 2020 - HFL: Hybrid Fuzzing on the Linux Kernel ✓
- 2020 - Realistic Error Injection for System Calls ✓
- 2020 - KRACE: Data Race Fuzzing for Kernel File Systems ✓
- 2020 - USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation ✓
- 2019 - Fuzzing File Systems via Two-Dimensional Input Space Exploration ✓
- 2019 - Razzer: Finding Kernel Race Bugs through Fuzzing ✓
- 2019 - Unicorefuzz: On the Viability of Emulation for Kernel space Fuzzing ✓
- 2017 - Stateful Fuzzing of Wireless Device Drivers in an Emulated Environment ✓
- 2017 - DIFUZE: Interface Aware Fuzzing for Kernel Drivers ✓
- 2008 - Fuzzing Wi-Fi Drivers to Locate Security Vulnerabilities ⚠
Format specific fuzzing
- 2025 - Smart Contract Fuzzing Towards Profitable Vulnerabilities
- 2025 - DUMPLING: Fine-grained Differential JavaScript Engine Fuzzing ✓
- 2024 - SQLPass: A Semantic Effective Fuzzing Method for DBMS ✓
- 2024 - Atlas: Automating Cross-Language Fuzzing on Android Closed-Source Libraries ✓
- 2024 - Tacoma: Enhanced Browser Fuzzing with Fine-Grained Semantic Alignment ✓
- 2024 - Applying Fuzz Driver Generation to Native C/C++ Libraries of OEM Android Framework: Obstacles and Solutions ✓
- 2024 - CrossFire: Fuzzing macOS Cross-XPU Memory on Apple Silicon ✓
- 2024 - BArcherFuzzer: An Android System Services Fuzzier via Transaction Dependencies of BpBinder ✓
- 2024 - BRF: Fuzzing the eBPF Runtime ✓
- 2024 - Monarch: A Fuzzing Framework for Distributed File Systems ✓
- 2023 - Android Fuzzing: Balancing User-Inputs and Intents ✓
- 2023 - ItyFuzz: Snapshot-Based Fuzzer for Smart Contract ✓
- 2023 - BRF: eBPF Runtime Fuzzer ✓
- 2023 - MorFuzz: Fuzzing Processor via Runtime Instruction Morphing enhanced Synchronizable Co-simulation ✓
- 2023 - EFCF: High Performance Smart Contract Fuzzing for Exploit Generation ✓
- 2023 - ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing ✓
- 2023 - VIDEZZO: Dependency-aware Virtual Device Fuzzing ✓
- 2023 - HyPFuzz: Formal-Assisted Processor Fuzzing ✓
- 2023 - FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities ✓
- 2022 - SFuzz: Slice-based Fuzzing for Real-Time Operating Systems ✓
- 2022 - LFUZZ: Exploiting Locality for File-system Fuzzing ✓
- 2022 - MUNDOFUZZ: Hypervisor Fuzzing with Statistical Coverage Testing and Grammar Inference ✓
- 2022 - DTLS-Fuzzer: A DTLS Protocol State Fuzzer ✓
- 2022 - FuzzUSB: Hybrid Stateful Fuzzing of USB Gadget Stacks ✓
- 2022 - TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities ✓
- 2021 - V-Shuttle: Scalable and Semantics-Aware Hypervisor Virtual Device Fuzzing ✓
- 2021 - FormatFuzzer: Effective Fuzzing of Binary File Formats ✓
- 2020 - NYX: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types ✓
- 2020 - Tree2tree Structural Language Modeling for Compiler Fuzzing ✓
- 2020 - Detecting Critical Bugs in SMT Solvers Using Blackbox Mutational Fuzzing ✓
- 2020 - JS Engine - Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer ✓
- 2020 - JS Engine - Fuzzing JavaScript Engines with Aspect-preserving Mutation ✓
- 2020 - CUDA Compiler - CUDAsmith: A Fuzzer for CUDA Compilers ✓
- 2020 - Smart Contracts - sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts ✓
- 2019 - Compiler Fuzzing: How Much Does It Matter? ✓
- 2019 - Smart Contracts - Harvey: A Greybox Fuzzer for Smart Contracts ✓
- 2017 - XML - Skyfire: Data-Driven Seed Generation for Fuzzing ✓
Exploitation
- 2025 - AIRBUGCATCHER: Automated Wireless Reproduction of IoT Bugs
- 2024 - Revealing the exploitability of heap overflow through PoC analysis ✓
- 2024 - Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation ✓
- 2024 - K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel ✓
- 2023 - Enhanced Memory Corruption Detection in C/C++ Programs ✓
- 2023 - Automated Exploitable Heap Layout Generation for Heap Overflows Through Manipulation Distance-Guided Fuzzing ✓
- 2023 - The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders ✓
- 2023 - Detecting Exploit Primitives Automatically for Heap Vulnerabilities on Binary Programs ✓
- 2022 - RiscyROP: Automated Return-Oriented Programming Attacks on RISC-V and ARM64 ✓
- 2022 - Automatic Permission Check Analysis for Linux Kernel ✓
- 2022 - OS-Aware Vulnerability Prioritization via Differential Severity Analysis ✓
- 2022 - Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs ✗
- 2022 - KASPER: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel ✓
- 2022 - MaMaDroid 2.0 - The Holes of control flow graphs ✓
- 2022 -ShadowHeap: Memory Safety through Efficient Heap Metadata Validation ✓
- 2022 - MACH2: System for Root Cause Analysis of Kernel Vulnerabilities [THESIS]
- 2021 - Automated Bug Hunting With Data-Driven Symbolic Root Cause Analysis ✓
- 2021 - MAJORCA: Multi-Architecture JOP and ROP Chain Assembler ✓
- 2021 - A Novel Method for the Automatic Generation of JOP Chain Exploits ✓
- 2021 - V0Finder: Discovering the Correct Origin of Publicly Reported Software Vulnerabilities ✓
- 2021 - Identifying Valuable Pointers in Heap Data ✓
- 2021 - OCTOPOCS: Automatic Verification of Propagated Vulnerable Code Using Reformed Proofs of Concept ✓
- 2021 - Characterizing Vulnerabilities in a Major Linux Distribution ✓
- 2021 - MAZE: Towards Automated Heap Feng Shui ✓
- 2021 - Vulnerability Detection in C/C++ Source Code With Graph Representation Learning ✓
- 2021 - mallotROPism: a metamorphic engine for malicious software variation development ✓
- 2020 - Automatic Techniques to Systematically Discover New Heap Exploitation Primitives ✓
- 2020 - Shadow-Heap: Preventing Heap-based Memory Corruptions by Metadata Validation ✓
- 2020 - Practical Fine-Grained Binary Code Randomization ✓
- 2020 - Tiny-CFA: Minimalistic Control-Flow Attestation UsingVerified Proofs of Execution ⚠
- 2020 - Greybox Automatic Exploit Generation for Heap Overflows in Language Interpreters - PHD THESIS ✓
- 2020 - ABCFI: Fast and Lightweight Fine-Grained Hardware-Assisted Control-Flow Integrity ✓
- 2020 - HeapExpo: Pinpointing Promoted Pointers to Prevent Use-After-Free Vulnerabilities ✗
- 2020 - Localizing Patch Points From One Exploit ✓
- 2020 - Speculative Dereferencing of Registers: Reviving Foreshadow ✓
- 2020 - HAEPG: An Automatic Multi-hop Exploitation Generation Framework ✓
- 2020 - Exploiting More Binaries by Using Planning to Assemble ROP Exploiting More Binaries by Using Planning to Assemble ROP Attacks Attacks ✓
- 2020 - ROPminer: Learning-Based Static Detection of ROP Chain Considering Linkability of ROP Gadgets ✓
- 2020 - KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities ✓
- 2020 - Preventing Return Oriented Programming Attacks By Preventing Return Instruction Pointer Overwrites ✓
- 2020 - KASLR: Break It, Fix It, Repeat ✓
- 2020 - ShadowGuard : Optimizing the Policy and Mechanism of Shadow Stack Instrumentation using Binary Static Analysis ✓
- 2020 - VulHunter: An Automated Vulnerability Detection System Based on Deep Learning and Bytecode ✓
- 2020 - Analysis and Evaluation of ROPInjector ✓
- 2020 - API Misuse Detection in C Programs: Practice on SSL APIs ✓
- 2020 - KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities ✓
- 2020 - Egalito: Layout-Agnostic Binary Recompilation ✓
- 2020 - Verifying Software Vulnerabilities in IoT Cryptographic Protocols ✓
- 2020 - μRAI: Securing Embedded Systems with Return Address Integrity ✓
- 2020 - Preventing Return Oriented Programming Attacks By Preventing Return Instruction Pointer Overwrites ✓
- 2019 - Kernel Protection Against Just-In-Time Code Reuse ✓
- 2019 - Kernel Exploitation Via Uninitialized Stack ✓
- 2019 - KEPLER: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities ✓
- 2019 - SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel ✓
- 2018 - HeapHopper: Bringing Bounded Model Checkingto Heap Implementation Security ✓
- 2018 - K-Miner: Uncovering Memory Corruption in Linux ✓
- 2017 - HAIT: Heap Analyzer with Input Tracing ✓
- 2017 - DROP THE ROP: Fine-grained Control-flow Integrity for the Linux Kernel ✓
- 2017 - kR^X: Comprehensive Kernel Protection against Just-In-Time Code Reuse ✓
- 2017 - Unleashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying ✓
- 2017 - Towards Automated Dynamic Analysis for Linux-based Embedded Firmware ✓
- 2016 - Scalable Graph-based Bug Search for Firmware Images ✓
- 2015 - Cross-Architecture Bug Search in Binary Executables ✓
- 2015 - SURROGATES: Enabling Near-Real-Time Dynamic Analyses of Embedded Systems ✓
- 2015 - From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel ✓
- 2015 - PIE: Parser Identification in Embedded Systems ✓
- 2014 - ret2dir: Rethinking Kernel Isolation ✓
- 2014 - Make It Work, Make It Right, Make It Fast: Building a Platform-Neutral Whole-System Dynamic Binary Analysis Platform ✓
- 2011 - Linux kernel vulnerabilities: state-of-the-art defenses and open problems ✓
- 2011 - Protecting the Core: Kernel Exploitation Mitigations ✓
- 2015 - From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel ✓
- 2014 - ret2dir: Rethinking Kernel Isolation ✓
- 2012 - Anatomy of a Remote Kernel Exploit ⚠
- 2012 - A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator ✗
- 2011 - Linux kernel vulnerabilities: state-of-the-art defenses and open problems ✓
- 2011 - Protecting the Core: Kernel Exploitation Mitigations ✓
Static Binary Analysis
- 2025 - LLM-Powered Static Binary Taint Analysis
- 2025 - BinHunter: A Fine-Grained Graph Representation for Localizing Vulnerabilities in Binary Executables
- 2024 - Effectiveness of ChatGPT for Static Analysis: How Far Are We?Effectiveness of ChatGPT for Static Analysis: How Far Are We? ✓
- 2024 - Bin2Summary: Beyond Function Name Prediction in Stripped Binaries with Functionality-Specific Code Embeddings ✓
- 2021 - ICALLEE: Recovering Call Graphs for Binaries ✓
- 2021 - EnBinDiff: Identifying Data-only Patches for Binaries ✓
- 2021 - VIVA: Binary Level Vulnerability Identification via Partial Signature ✓
- 2021 - Overview of the advantages and disadvantages of static code analysis tools ✓
- 2021 - Multi-Level Cross-Architecture Binary Code Similarity Metric ✓
- 2020 - VulDetector: Detecting Vulnerabilities using Weighted Feature Graph Comparison ✓
- 2020 - DEEPBINDIFF: Learning Program-Wide Code Representations for Binary Diffing ✓
- 2020 - BinDeep: A Deep Learning Approach to Binary Code Similarity Detection ✓
- 2020 - Revisiting Binary Code Similarity Analysis using Interpretable Feature Engineering and Lessons Learned ✓
- 2020 - iDEA: Static Analysis on the Security of Apple Kernel Drivers ✓
- 2020 - HART: Hardware-Assisted Kernel Module Tracing on Arm ✓
- 2020 - AN APPROACH TO COMPARING CONTROL FLOW GRAPHS BASED ON BASIC BLOCK MATCHING ✓
- 2020 - How Far We Have Come: Testing Decompilation Correctness of C Decompilers ✓
- 2020 - Dynamic Binary Lifting and Recompilation DISS ✓
- 2020 - Similarity Based Binary Backdoor Detection via Attributed Control Flow Graph ✓
- 2020 - IoTSIT: A Static Instrumentation Tool for IoT Devices ✓
- 2019 - Code Similarity Detection using AST and Textual Information ✗
- 2018 - CodEX: Source Code Plagiarism DetectionBased on Abstract Syntax Trees ✓
- 2017 - rev.ng: a unified binary analysis framework to recover CFGs and function boundaries ✓
- 2017 - Angr: The Next Generation of Binary Analysis ✓
- 2016 - Binary code is not easy ✓
- 2015 - Cross-Architecture Bug Search in Binary Executables ✓
- 2014 - A platform for secure static binary instrumentation ✓
- 2013 - MIL: A language to build program analysis tools through static binary instrumentation ✓
- 2013 - Binary Code Analysis ✓
- 2013 - A compiler-level intermediate representation based binary analysis and rewriting system ✓
- 2013 - Protocol reverse engineering through dynamic and static binary analysis ✓
- 2013 - BinaryPig: Scalable Static Binary Analysis Over Hadoop ✓
- 2011 - BAP: A Binary Analysis Platform ✓
- 2009 - Syntax tree fingerprinting for source code similarity detection ✓
- 2008 - BitBlaze: A New Approach to Computer Security via Binary Analysis ✓
- 2005 - Practical analysis of stripped binary code ✓
- 2004 - Detecting kernel-level rootkits through binary analysis ✓
Misc
- 2025 RangeSanitizer: Detecting Memory Errors with Efficient Range Checks
- 2024 - Tyche: Making Sense of Property-Based Testing Effectiveness ✓
- 2024 - ARVO: Atlas of Reproducible Vulnerabilities for Open Source Software ✓
- 2024 - LeanBin: Harnessing Lifting and Recompilation to Debloat Binaries ✓
- 2024 - Operation Mango: Scalable Discovery of Taint-Style Vulnerabilities in Binary Firmware Services ✗
- 2024 - A Binary-level Thread Sanitizer or Why Sanitizing on the Binary Level is Hard ✓
- 2023 - MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries ✓
- 2023 - ARMore: Pushing Love Back Into Binaries ✓
- 2023 - gMutant: A gCov based Mutation Testing Analyser ✓
- 2022 - Auto Off-Target: Enabling Thorough and Scalable Testing for Complex Software Systems ✓
- 2022 - GRIN: Make Rewriting More Precise ✓
- 2022 - CFINSIGHT: A Comprehensive Metric for CFI Policies ✓
- 2022 - Odin: On-Demand Instrumentation with On-the-Fly Recompilation ✓
- 2022 - Debloating Address Sanitizer ✓
- 2021 - FMViz: Visualizing Tests Generated by AFL at the Byte-level ✓
- 2021 - Raising MIPS Binaries to LLVM IR ✓
- 2021 - yzGen: Automated Generation of Syscall Specification of Closed-Source macOS Drivers ✓
- 2021 - Igor: Crash Deduplication Through Root-Cause Clustering ✓
- 2021 - UAFSan: an object-identifier-based dynamic approach for detecting use-after-free vulnerabilities ✓
- 2021 - SyML: Guiding Symbolic Execution Toward Vulnerable States Through Pattern Learning ✓
- 2021 - LLSC: A Parallel Symbolic Execution Compiler for LLVM IR ✓
- 2021 - FuzzSplore: Visualizing Feedback-Driven Fuzzing Techniques ✓
- 2020 - Memory Error Detection Based on Dynamic Binary Translation ✓
- 2020 - Sydr: Cutting Edge Dynamic Symbolic Execution ✓
- 2020 - DrPin: A dynamic binary instumentator for multiple processor architectures ✓
- 2020 - MVP: Detecting Vulnerabilities using Patch-Enhanced Vulnerability Signatures ✓
- 2020 - Collecting Vulnerable Source Code from Open-Source Repositories for Dataset Generation ✓
- 2020 - LEOPARD: Identifying Vulnerable Code for Vulnerability Assessment through Program Metrics ✓
- 2020 - Dynamic Program Analysis Tools in GCC and CLANG Compilers ✓
- 2020 - On Using k-means Clustering for Test Suite Reduction ✓
- 2020 - Optimizing the Parameters of an Evolutionary Algorithm for Fuzzing and Test Data Generation ✓
- 2020 - Inputs from Hell: Learning Input Distributions for Grammar-Based Test Generation ✓
- 2020 - IdSan: An identity-based memory sanitizer for fuzzing binaries ✓
- 2020 - An experimental study oncombining automated andstochastic test data generation - MASTER THESIS ✓
- 2020 - FuzzGen: Automatic Fuzzer Generation ✓
- 2020 - Fuzzing: On the Exponential Cost of Vulnerability Discovery ✓
- 2020 - Poster: Debugging Inputs ✓
- 2020 - API Misuse Detection in C Programs: Practice on SSL APIs ✓
- 2020 - Egalito: Layout-Agnostic Binary Recompilation ✓
- 2020 - Verifying Software Vulnerabilities in IoT Cryptographic Protocols ✓
- 2020 - μRAI: Securing Embedded Systems with Return Address Integrity ✓
- 2020 - Fast Bit-Vector Satisfiability ✓
- 2020 - MARDU: Efficient and Scalable Code Re-randomization ✓
- 2020 - Towards formal verification of IoT protocols: A Review ✓
- 2020 - Automating the fuzzing triage process ✓
- 2020 - COMPARING AFL SCALABILITY IN VIRTUAL-AND NATIVE ENVIRONMENT ✓
- 2020 - SYMBION: Interleaving Symbolic with Concrete Execution ✓
- 2020 - Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input Prioritization ✓
- 2019 - Toward the Analysis of Embedded Firmware through Automated Re-hosting ✓
- 2019 - FUZZIFICATION: Anti-Fuzzing Techniques ✓
- 2018 - VulinOSS: A Dataset of Security Vulnerabilities in Open-source Systems ✓
- 2018 - HDDr: A Recursive Variantof the Hierarchical Delta Debugging Algorithm ✓
- 2017 - Coarse Hierarchical Delta Debugging ✓
- 2017 - VUDDY: A Scalable Approach for Vulnerable CodeClone Discovery ✓
- 2017 - Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts ✓
- 2017 - Synthesizing Program Input Grammars ✓
- 2017 - Designing New Operating Primitives to Improve Fuzzing Performance ✓
- 2017 - Instruction Punning: Lightweight Instrumentation for x86-64 ✓
- 2016 - Modernizing Hierarchical Delta Debugging ✓
- 2016 - VulPecker: An Automated Vulnerability Detection SystemBased on Code Similarity Analysis ✓
- 2016 - CREDAL: Towards Locating a Memory Corruption Vulnerability with Your Core Dump ✓
- 2016 - RETracer: Triaging Crashes by Reverse Execution fromPartial Memory Dumps ✓
- 2015 - PIE: Parser Identification in Embedded Systems ✓
- 2010 - Iterative Delta Debugging ✓
- 2009 - Dynamic Test Generation To Find Integer Bugs in x86 Binary Linux Programs ✓
- 2006 - HDD: Hierarchical Delta Debugging ✓
Surveys, SoKs, and Studies
- 2025 - Fuzzing drones for anomaly detection: A systematic literature review
- 2025 - SoK: Towards Effective Automated Vulnerability Repair
- 2025 - SoK: Unraveling the Veil of OS Kernel Fuzzing
- 2024 - SoK: Prudent Evaluation Practices for Fuzzing
- 2024 - An Empirical Examination of Fuzzer Mutator Performance ✓
- 2024 - An Empirical Study on the Distance Metric in Guiding Directed Grey-box Fuzzing ✓
- 2024 - Exploring the Adoption of Fuzz Testing in Open-Source Software: A Case Study of the Go Community ✓
- 2024 - Is Stateful Fuzzing Really Challenging? ✓
- 2024 - Fuzzing Frameworks for Server-side Web Applications: A Survey ✓
- 2024 - SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing ✓
- 2024 - A Survey of Protocol Fuzzing ✓
- 2024 - Large Language Models Based Fuzzing Techniques: A Survey ✓
- 2024 - Fuzzing: Progress, Challenges, and Perspectives ✓
- 2023 - A systematic review of fuzzing ✓
- 2023 - An Empirical Study on AST-level mutation-based fuzzing techniques for JavaScript Engines ✓
- 2023 - Software Bug Detection: Challenges and Synergies ✓
- 2023 - Demystify the Fuzzing Methods: A Comprehensive Survey ✓
- 2023 - The Human Side of Fuzzing: Challenges Faced by Developers During Fuzzing Activities ✓
- 2023 - ASanity: On Bug Shadowing by Early ASan Exits ✓
- 2023 - A Case Study on Fuzzing Satellite Firmware ✓
- 2023 - Fuzzing the Latest NTFS in Linux with Papora: An Empirical Study ✓
- 2023 - Fuzzing REST APIs for Bugs: An Empirical Analysis ✓
- 2023 - Automated Binary Analysis: A Survey ✓
- 2023 - Fuzzers for stateful systems: Survey and Research Directions ✓
- 2022 - Detecting Vulnerability on IoT Device Firmware: A Survey ✓
- 2022 - Fuzzing of Embedded Systems: A Survey ✓
- 2022 - Embedded Fuzzing: a Review of Challenges, Tools, and Solutions ✓
- 2022 - An empirical study of vulnerability discovery methods over the past ten years ✓
- 2022 - Fuzzing vulnerability discovery techniques: Survey, challenges and future directions ✓
- 2022 - Fuzzing: A Survey for Roadmap ✓
- 2022 - How Long Do Vulnerabilities Live in the Code? A Large-Scale Empirical Measurement Study on FOSS Vulnerability Lifetimes ✓
- 2021 - Protocol Reverse-Engineering Methods and Tools: A Survey ✓
- 2021 - Exploratory Review of Hybrid Fuzzing for Automated Vulnerability Detection ✓
- 2021 - A Systematic Review of Network Protocol Fuzzing Techniques ✓
- 2021 - Vulnerability Detection is Just the Beginning ✓
- 2021 - Evaluating Synthetic Bugs ✓
- 2020 - A Practical, Principled Measure of Fuzzer Appeal:A Preliminary Study ✓
- 2020 - A Systemic Review of Kernel Fuzzing ✓
- 2020 - A Survey of Hybrid Fuzzing based on Symbolic Execution ✓
- 2020 - A Study on Using Code Coverage Information Extracted from Binary to Guide Fuzzing ✓
- 2020 - Study of Security Flaws in the Linux Kernel by Fuzzing ✓
- 2020 - Dynamic vulnerability detection approaches and tools: State of the Art ✓
- 2020 - Fuzzing: Challenges and Reflections ✓
- 2020 - The Relevance of Classic Fuzz Testing: Have We Solved This One? ✓
- 2020 - A Practical, Principled Measure of Fuzzer Appeal:A Preliminary Study ✓
- 2020 - SoK: All You Ever Wanted to Know About x86/x64 Binary Disassembly But Were Afraid to Ask ✓
- 2020 - A Quantitative Comparison of Coverage-Based Greybox Fuzzers ✓
- 2020 - A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices ✓
- 2020 - A systematic review of fuzzing based on machine learning techniques ✓
- 2019 - A Survey of Binary Code Similarity ✓
- 2019 - The Art, Science, and Engineering of Fuzzing: A Survey ✓
- 2012 - Regression testing minimization, selection and prioritization: a survey ✓
directed-fuzzing
embedded
exploitation
fuzzing
fuzzing-binaries
guided-fuzzing
hybrid-fuzzing
iot
kernel
linux
linux-kernel
mitigations
paper
rca
root-cause
sanitizer
vulnerability-detection
Contributors
Similar repos
Languages
Python
100.0%
Academic papers related to fuzzing, binary analysis, and exploit dev, which I want to read or have already read
See the codeREADME
Note
The sole purpose of this repository is to help me organize recent academic papers related to fuzzing, binary analysis, IoT security, and general exploitation. This is a non-exhausting list, even though I'll try to keep it updated... Feel free to suggest decent papers via a PR.
Table of Contents
Read & Tagged
- 2023 - Dissecting American Fuzzy Lop A FuzzBench Evaluation ✓
- Tags:: AFL, collisions, hitcounts, timeout, novelty search, corpus culling, score calculation, corpus scheduling, splicing
- 2022 - DARWIN: Survival of the Fittest Fuzzing Mutators ✓
- Tags: mutation scheduling, evolution strategy, AFL, AFL-MOpT, fuzzbench, magma, ecofuzz
- 2022 - Removing Uninteresting Bytes in Software Fuzzing ✓
- Tags: seed optimization, seed minimization, diar, coverage-guided
- 2021 - An Empirical Study of OSS-Fuzz Bugs ✓
- Tags: flaky bugs, clusterfuzz, sanitizer, bug detection, bug classification, time-to-fix, time-to-detect
- 2020 - Corpus Distillation for Effective Fuzzing ✓
- Tags: corpus minimization, afl-cmin, google fuzzer test suite, FTS, minset, AFL
- 2020 - Symbolic execution with SymCC: Don't interpret, compile! ✓
- Tags: KLEE, QSYM, LLVM, C, C++, compiler, symbolic execution, concolic execution, source code level, IR, angr, Z3, DARPA corpus, AFL
- 2020 - WEIZZ: Automatic Grey-Box Fuzzing for Structured Binary Formats ✓
- Tags: REDQUEEN, chunk-based formats, AFLSmart, I2S, checksums, magix bytes, QEMU, Eclipser, short fuzzing runs,
- 2020 - Efficient Binary-Level Coverage Analysis ✓
- Tags: bcov, detour + trampoline, basic block coverage, sliced microexecution, superblocks, strongly connected components, dominator graph, BAP, angr, IDA, DynamoRIO, Intel PI, BAP, angr, IDA, DynamoRIO, Intel PIN
- 2020 - Test-Case Reduction via Test-Case Generation: Insights From the Hypothesis Reducer ✓
- Tags: Test case reducer, property based testing, CSmith, test case generation, hierachical delta debugging
- 2020 - AFL++: Combining Incremental Steps of Fuzzing Research ✗
- Tags: AFL++, AFL, MOpt, LAF-Intel, Fuzzbench, Ngram, RedQueen, Unicorn, QBDI, CmpLog, AFLFast
- 2020 - FirmXRay: Detecting Bluetooth Link Layer Vulnerabilities From Bare-Metal Firmware ✓
- Tags: Ghdira, static analysis, sound disassembly, base address finder, BLE, vulnerability discovery
- 2020 - P2IM: Scalable and Hardware-independent Firmware Testing via Automatic Peripheral Interface Modeling ✓
- Tags: HALucinator, emulation, firmware, QEMU, AFL, requires source, MCU, peripheral abstraction
- 2020 - What Exactly Determines the Type? Inferring Types with Context ✓
- Tags: context assisted type inference, stripped binaries, variable and type reconstruction, IDA Pro, Word2Vec, CNN,
- 2020 - Causal Testing: Understanding Defects’ Root Causes ✓
- Tags: Defects4J, causal relationships, Eclipse plugin, unit test mutation, program trace diffing, static value diffing, user study
- 2020 - AURORA: Statistical Crash Analysis for Automated Root Cause Explanation ⚠
- Tags: RCA, program traces, input diversification, Intel PIN, Rust, CFG,
- 2020 - ParmeSan: Sanitizer-guided Greybox Fuzzing ✓
- Tags: interprocedural CFG, data flow analysis, directed fuzzing (DGF), disregarding 'hot paths', LAVA-M based primitives, LLVM, Angora, AFLGo, ASAP, santizer dependent
- 2020 - Magma: A Ground-Truth Fuzzing Benchmark ✓
- Tags: best practices, fuzzer benchmarking, ground truth, Lava-M
- 2020 - Fitness Guided Vulnerability Detection with Greybox Fuzzing ✓
- Tags: AFL, vuln specific fitness metric (headroom), buffer/integer overflow detection, AFLGo, pointer analysis, CIL, bad benchmarking
- 2020 - GREYONE: Data Flow Sensitive Fuzzing ✓
- Tags: data-flow fuzzing, taint-guided mutation, input prioritization, constraint conformance, REDQUEEN, good evaluation, VUzzer
- 2020 - FairFuzz-TC: a fuzzer targeting rare branches ✓
- Tags: AFL, required seeding, branch mask
- 2020 - Fitness Guided Vulnerability Detection with Greybox Fuzzing ✓
- Tags: AFL, vuln specific fitness metric (headroom), buffer/integer overflow detection, AFLGo, pointer analysis, CIL, bad evaluation
- 2020 - TOFU: Target-Oriented FUzzer ✓
- Tags: DGF, structured mutations, staged fuzzing/learning of cli args, target fitness, structure aware, Dijkstra for priority, AFLGo, Superion
- 2020 - FuZZan: Efficient Sanitizer Metadata Design for Fuzzing ✓
- Tags:: sanitizer metadata, optimization, ASAN, MSan, AFL
- 2020 - Boosting Fuzzer Efficiency: An Information Theoretic Perspective ✓
- Tags:: Shannon entropy, seed power schedule, libfuzzer, active SLAM, DGF, fuzzer efficiency
- 2020 - Learning Input Tokens for Effective Fuzzing ✓
- Tags: dynamic taint tracking, parser checks, magic bytes, creation of dict inputs for fuzzers
- 2020 - A Review of Memory Errors Exploitation in x86-64 ✓
- Tags: NX, canaries, ASLR, new mitigations, mitigation evaluation, recap on memory issues
- 2020 - SoK: The Progress, Challenges, and Perspectives of Directed Greybox Fuzzing ✓
- Tags: SoK, directed grey box fuzzing, AFL, AFL mutation operators, DGF vs CGF
- 2020 - MemLock: Memory Usage Guided Fuzzing ✓
- Tags: memory consumption, AFL, memory leak, uncontrolled-recursion, uncontrolled-memory-allocation, static analysis
- 2019 - Matryoshka: Fuzzing Deeply Nested Branches ✓
- Tags: AFL, QSYM, Angora, path constraints, nested conditionals, (post) dominator trees, gradient descent, REDQUEEN, LAVA-M
- 2019 - Building Fast Fuzzers ✓
- Tags: grammar based fuzzing, optimization, bold claims, comparison to badly/non-optimized fuzzers, python, lots of micro-optimizations, nice protocolling of failures, bad ASM optimization
- 2019 - Not All Bugs Are the Same: Understanding, Characterizing, and Classifying the Root Cause of Bugs ✓
- Tags: RCA via bug reports, classification model, F score,
- 2019 - AntiFuzz: Impeding Fuzzing Audits of Binary Executables ✓
- Tags: anti fuzzing, prevent crashes, delay executions, obscure coverage information, overload symbolic execution
- 2019 - MOpt: Optimized Mutation Scheduling for Fuzzers ✓
- Tags: mutation scheduling, particle swarm optimization (PSO), AFL, AFL mutation operators, VUzzer,
- 2019 - FuzzFactory: Domain-Specific Fuzzing with Waypoints ✓
- Tags: domain-specific fuzzing, AFL, LLVM, solve hard constraints like cmp, find dynamic memory allocations, binary-based
- 2019 - Fuzzing File Systems via Two-Dimensional Input Space Exploration ✓
- Tags: Ubuntu, file systems, library OS, ext4, brtfs, meta block mutations, edge cases
- 2019 - REDQUEEN: Fuzzing with Input-to-State Correspondence ⚠
- Tags: feedback-driven, AFL, magic-bytes, nested contraints, input-to-state correspondence, I2S
- 2019 - PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary ✓
- Tags: kernel, android, userland, embedded, hardware, Linux, device driver, WiFi
- 2019 - FirmFuzz: Automated IoT Firmware Introspection and Analysis ✓
- Tags: emulation, firmadyne, BOF, XSS, CI, NPD, semi-automatic
- 2019 - Firm-AFL: High-Throughput Greybox Fuzzing of IoT Firmware via Augmented Process Emulation ✓
- Tags: emulation, qemu, afl, full vs user mode, syscall redirect, "augmented process emulation", firmadyne
- 2018 - A Survey of Automated Root Cause Analysisof Software Vulnerability ✓
- Tags: Exploit mitigations, fuzzing basics, symbolic execution basics, fault localization, high level
- 2018 - PhASAR: An Inter-procedural Static Analysis Framework for C/C++ ✓
- Tags: LLVM, (inter-procedural) data-flow analysis, call-graph, points-to, class hierachy, CFG, IR
- 2018 - INSTRIM: Lightweight Instrumentation for Coverage-guided Fuzzing ✓
- Tags: LLVM, instrumentation optimization, graph algorithms, selective instrumentation, coverage calculation
- 2018 - What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices ✓
- Tags: embedded, challenges, heuristics, emulation, crash classification, fault detection
- 2018 - Evaluating Fuzz Testing ✓
- Tags: fuzzing evaluation, good practices, bad practices
- 2017 - Root Cause Analysis of Software Bugs using Machine Learning Techniques ✓
- Tags: ML, RC prediction for filed bug reports, unsupervised + supervised combination, RC categorisation, F score
- 2017 - kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels ✓
- Tags: intel PT, kernel, AFL, file systems, Windows, NTFS, Linux, ext, macOS, APFS, driver, feedback-driven
- 2016 - Driller: Argumenting Fuzzing Through Selective Symbolic Execution ✓
- Tags: DARPA, CGC, concolic execution, hybrid fuzzer, binary based
- 2015 - Challenges with Applying Vulnerability Prediction Models ✓
- Tags: VPM vs DPM, prediction models on large scale systems, files with frequent changes leave more vulns, older code exhibits more vulns
- 2014 - Optimizing Seed Selection for Fuzzing ✓
- Tags: BFF, (weighted) minset, peach, cover set problem, seed transferabilty, time minset, size minset, round robin
- 2013 - Automatic Recovery of Root Causes from Bug-Fixing Changes ✓
- Tags: ML + SCA, F score, AST, PPA, source tree analysis
Unread
Unread papers categorized by a common main theme.
General fuzzing implementations
- 2025 - Adaptive mutation based on multi-population evolution strategy for greybox fuzzing
- 2025 - BaSFuzz: Fuzz testing based on difference analysis for seed bytes
- 2025 - Grey-Box Fuzzing in Constrained Ultra-Large Systems: Lessons for SE Communit
- 2025 - CherryPicker: A Parallel Solving and State Sharing Hybrid Fuzzing System
- 2025 - Novelty Not Found: Exploring Input Shadowing in Fuzzing through Adaptive Fuzzer Restarts
- 2025 - AutoFuzz: automatic fuzzer-sanitizer scheduling with multi-armed bandit
- 2025 - RuMono: Fuzz Driver Synthesis for Rust Generic APIs
- 2025 - Improving seed quality with historical fuzzing results
- 2025 - A Fuzzing Tool Based on Automated Grammar Detection
- 2025 - ROSA: Finding Backdoors with Fuzzing
- 2025 - Invivo Fuzzing by Amplifying Actual Executions ✓
- 2025 - QMSan: Efficiently Detecting Uninitialized Memory Errors During Fuzzing ✓
- 2024 - LibAFL-DiFuzz: Advanced Architecture Enabling Directed Fuzzing
- 2024 - Program Environment Fuzzing
- 2024 - Logos: Log Guided Fuzzing for Protocol Implementations ✓
- 2024 - DDGF: Dynamic Directed Greybox Fuzzing with Path Profiling ✓
- 2024 - Sleuth: A Switchable Dual-Mode Fuzzer to Investigate Bug Impacts Following a Single PoC ✓
- 2024 - Tumbling Down the Rabbit Hole: How do Assisting Exploration Strategies Facilitate Grey-box Fuzzing? ✓
- 2024 - Modularizing Directed Greybox Fuzzing for Binaries over Multiple CPU Architectures ✓
- 2024 - LOOL: Low-Overhead, Optimization-Log-Guided Compiler Fuzzing ✓
- 2024 - Visualization Task Taxonomy to Understand the Fuzzing Internals ✓
- 2024 - Directed or Undirected: Investigating Fuzzing Strategies in a CI/CD Setup ✓
- 2024 - ZigZagFuzz: Interleaved Fuzzing of Program Options and Files ✓
- 2024 - Tango: Extracting Higher-Order Feedback through State Inference ✓
- 2024 - Directed Fuzzing Based on Bottleneck Detection ✓
- 2024 - Look Ma, No Input Samples! Mining Input Grammars from Code with Symbolic Parsing ✓
- 2024 - HuntFUZZ: Enhancing Error Handling Testing through Clustering Based Fuzzing ✓
- 2024 - AIMFuzz: Automated Function-Level In-Memory Fuzzing on Binaries ✓
- 2024 - Data Coverage for Guided Fuzzing ✓
- 2024 - Fuzzing at Scale: The Untold Story of the Scheduler ✓
- 2024 - FOX: Coverage-guided Fuzzing as Online Stochastic Control ✓
- 2024 - Fuzzing-based grammar learning from a minimal set of seed inputs ✓
- 2024 - LinFuzz: Program-Sensitive Seed Scheduling Greybox Fuzzing Based on LinUCB Algorithm ✓
- 2024 - Graphuzz: Data-driven Seed Scheduling for Coverage-guided Greybox Fuzzing ✓
- 2024 - Towards Tightly-coupled Hybrid Fuzzing via Excavating Input Specifications ✓
- 2024 - BazzAFL: Moving Fuzzing Campaigns Towards Bugs Via Grouping Bug-Oriented Seeds ✓
- 2024 - DeepGo: Predictive Directed Greybox Fuzzing ✓
- 2024 - LibAFL QEMU: A Library for Fuzzing-oriented Emulation ✓
- 2023 - Beyond the Coverage Plateau: A Comprehensive Study of Fuzz Blockers ✓
- 2023 - NestFuzz: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic ✓
- 2023 - DSFuzz: Detecting Deep State Bugs with Dependent State Exploration ✓
- 2023 - FA-Fuzz: A Novel Scheduling Scheme Using Firefly Algorithm for Mutation-Based Fuzzing ✓
- 2023 - Make out like a (Multi-Armed) Bandit: Improving the Odds of Fuzzer Seed Scheduling with T-Scheduler ✓
- 2023 - SYNTONY: Potential-Aware Fuzzing with Particle Swarm Optimization ✓
- 2023 - Triereme: Speeding up hybrid fuzzing through efficient query scheduling ✓
- 2023 - Hybrid Testing: Combining Static Analysis and Directed Fuzzing ✓
- 2023 - Titan : Efficient Multi-target Directed Greybox Fuzzing ✓
- 2023 - SpecFuzzer: A Tool for Inferring Class Specifications via Grammar-based Fuzzing ✓
- 2023 - Hopper: Interpretative Fuzzing for Libraries ✓
- 2023 - Enhancing Coverage-Guided Fuzzing via Phantom Program ✓
- 2023 - Hyperfuzzing: black-box security hypertesting with a grey-box fuzzer ✓
- 2023 - SHAPFUZZ: Efficient Fuzzing via Shapley-Guided Byte Selection ✓
- 2023 - PSOFuzz - Fuzzing Processors with Particle Swarm Optimization ✓
- 2023 - SymRustC: A Hybrid Fuzzer for Rust ✓
- 2023 - Finch: Fuzzing with Quantitative and Adaptive Hot-Bytes Identification ✓
- 2023 - HyperGo: Probability-based Directed Hybrid Fuzzing ✓
- 2023 - CrabSandwich: Fuzzing Rust with Rust ✓
- 2023 - InFuzz: An Interactive Tool for Enhancing Efficiency in Fuzzing through Visual Bottleneck Analysis ✓
- 2023 - Rare Path Guided Fuzzing∗ ✓
- 2023 - Guiding Greybox Fuzzing with Mutation Testing ✓
- 2023 - FGo: A Directed Grey-box Fuzzer with Probabilistic Exponential cut-the-loss Strategies ✓
- 2023 - FISHFUZZ: Catch Deeper Bugs by Throwing Larger Nets ✓
- 2023 - PosFuzz: augmenting greybox fuzzing with effective position distribution ✓
- 2023 - Bottleneck Analysis via Grammar-based Performance Fuzzing* ✓
- 2023 - What Happens When We Fuzz? Investigating OSS-Fuzz Bug History ✓
- 2023 - Toss a Fault to Your Witcher: Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect SQL and Command Injection Vulnerabilities ✓
- 2023 - Large Language Models are Edge-Case Fuzzers: Testing Deep Learning Libraries via FuzzGPT ✓
- 2023 - SBFT Tool Competition 2023 - Fuzzing Track ✓
- 2023 - CarpetFuzz: Automatic Program Option Constraint Extraction from Documentation for Fuzzing ✓
- 2023 - Learning Seed-Adaptive Mutation Strategies for Greybox Fuzzing ✓
- 2023 - Directed Greybox Fuzzing with Stepwise Constraint Focusing ✓
- 2023 - Generation-based fuzzing? Don’t build a new generator, reuse! ✓
- 2023 - RCABench: Open Benchmarking Platform for Root Cause Analysis ✓
- 2023 - Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis ✓
- 2023 - DAISY: Effective Fuzz Driver Synthesis with Object Usage Sequence Analysis ✓
- 2023 - autofz: Automated Fuzzer Composition at Runtime ✓
- 2023 - Towards Hybrid Fuzzing with Multi-level Coverage Tree and Reinforcement Learning in Greybox Fuzzing ✓
- 2023 - Fuzzing, Symbolic Execution, and Expert Guidance for Better Testing ✓
- 2023 - Fuzzing vs SBST: Intersections & Differences ✓
- 2023 - Evaluating the Fork-Awareness of Coverage-Guided Fuzzers ✓
- 2023 - Homo in Machina: Improving Fuzz Testing Coverage via Compartment Analysis ✓
- 2023 - The fun in fuzzing - The debugging techniquie comes into its own ✓
- 2023 - Reachable Coverage: Estimating Saturation in Fuzzing ✓
- 2023 - A Seed Scheduling Method With a Reinforcement Learning for a Coverage Guided Fuzzing ✓
- 2023 - SelectFuzz: Efficient Directed Fuzzing with Selective Path Exploration ✓
- 2022 - Explainable Fuzzer Evaluation ✓
- 2022 - Rare-Seed Generation for Fuzzing ✓
- 2022 - How to Compare Fuzzers ✓
- 2022 - Valkyrie: Improving Fuzzing Performance Through Deterministic Techniques ✓
- 2022 - FUZZING DEEPER LOGIC WITH IMPEDING FUNCTION TRANSFORMATION ✓
- 2022 - Alphuzz: Monte Carlo Search on Seed-Mutation Tree for Coverage-Guided Fuzzing ✓
- 2022 - AutoGenD: fuzz driver generation for binary libraries without header files and symbol information ✓
- 2022 - Mutation Optimization of Directional Fuzzing for Cumulative Defects ✓
- 2022 - IMPROVING AFL++ CMPLOG: TACKLING THE BOTTLENECKS ✓
- 2022 - One Fuzz Doesn’t Fit All: Optimizing Directed Fuzzing via Target-tailored Program State Restriction ✓
- 2022 - POLYFUZZ: Holistic Greybox Fuzzing of Multi-Language Systems ✓
- 2022 - Sydr-Fuzz: Continuous Hybrid Fuzzing and Dynamic Analysis for Security Development Lifecycle ✓
- 2022 - Nimbus: Toward Speed Up Function Signature Recovery via Input Resizing and Multi-Task Learning ✓
- 2022 - So Many Fuzzers, So Little Time ✓
- 2022 - SLOPT: Bandit Optimization Framework for Mutation-Based Fuzzing ✓
- 2022 - DriveFuzz: Discovering Autonomous Driving Bugs through Driving Quality-Guided Fuzzing ✓
- 2022 - UltraFuzz: Towards Resource-saving in Distributed Fuzzing ✓
- 2022 - Snappy: Efficient Fuzzing with Adaptive and Mutable Snapshots ✓
- 2022 - FuzzerAid: Grouping Fuzzed Crashes Based On Fault Signatures ✓
- 2022 - Automatically Seed Corpus and Fuzzing Executables Generation Using Test Framework ✓
- 2022 - CAMFuzz: Explainable Fuzzing with Local Interpretation ✓
- 2022 - Efficient Greybox Fuzzing to Detect Memory Errors ✓
- 2022 - LibAFL: A Framework to Build Modular and Reusable Fuzzers ✗
- 2022 - FishFuzz: Throwing Larger Nets to Catch Deeper Bugs ✓
- 2022 - SYMSAN: Time and Space Efficient Concolic Execution via Dynamic Data-flow Analysis ✓
- 2022 - AMSFuzz: An adaptive mutation schedule for fuzzing ✓
- 2022 - FixReverter: A Realistic Bug Injection Methodology for Benchmarking Fuzz Testing ✓
- 2022 - Multiple Targets Directed Greybox Fuzzing ✓
- 2022 - Combining BMC and Fuzzing Techniques for Finding Software Vulnerabilities in Concurrent Programs ✓
- 2022 - DocTer: Documentation-Guided Fuzzing for Testing Deep Learning API Functions ✓
- 2022 - Obtaining Fuzzing Results with Different Timeouts ✓
- 2022 - FASSFuzzer—An Automated Vulnerability Detection System for Android System Services ✓
- 2022 - WindRanger: A Directed Greybox Fuzzer driven by Deviation Basic Blocks ✗
- 2022 - Drifuzz: Harvesting Bugs in Device Drivers from Golden Seeds ✓
- 2022 - GraphFuzz: Library API Fuzzing with Lifetime-aware Dataflow Graphs ✓
- 2022 - AcoFuzz: Adaptive Energy Allocation for Greybox Fuzzing ✓
- 2022 - TargetFuzz: Using DARTs to Guide Directed Greybox Fuzzers ✓
- 2022 - Fast Fuzzing for Memory Errors ✓
- 2022 - Stateful Greybox Fuzzing ✓
- 2022 - Metamorphic Fuzzing of C++ Libraries ✓
- 2022 - Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis ✓
- 2022 - Comparing Fuzzers on a Level Playing Field with FuzzBench ✓
- 2022 - Vulnerability-oriented directed fuzzing for binary programs ✓
- 2022 - An Improvement of AFL Based On The Function Call Depth ✓
- 2022 - FuzzingDriver: the Missing Dictionary to Increase Code Coverage in Fuzzers ✓
- 2022 - BeDivFuzz: Integrating Behavioral Diversity into Generator-based Fuzzing ✓
- 2022 - One Fuzzing Strategy to Rule Them All ✓
- 2022 - Grammars for Free: Toward Grammar Inference for Ad Hoc Parsers ✓
- 2022 - Fuzzing Class Specifications ✓
- 2022 - Mutation Analysis: Answering the Fuzzing Challenge ✓
- 2022 - Ferry: State-Aware Symbolic Execution for Exploring State-Dependent Program Paths ✓
- 2022 - BEACON : Directed Grey-Box Fuzzing with Provable Path Pruning ✓
- 2022 - MORPHUZZ: Bending (Input) Space to Fuzz Virtual Devices ✓
- 2021 - A parallel fuzzing method based on two-stage mutation ✓
- 2021 - Better Pay Attention Whilst Fuzzing ✓
- 2021 - Diar: Removing Uninteresting Bytes from Seeds in Software Fuzzing ✓
- 2021 - Reducing Time-To-Fix For Fuzzer Bugs ✓
- 2021 - Casr-Cluster: Crash Clustering for Linux Applications ✓
- 2021 - Fuzzm: Finding Memory Bugs through Binary-Only Instrumentation and Fuzzing of WebAssembly ✓
- 2021 - InstruGuard: Find and Fix Instrumentation Errors for Coverage-based Greybox Fuzzing ✓
- 2021 - POSTER: OS Independent Fuzz Testing of I/O Boundary ✓
- 2021 - HDBFuzzer–Target-oriented Hybrid Directed Binary Fuzzer ✓
- 2021 - ovAFLow: Detecting Memory Corruption Bugs with Fuzzing-based Taint Inference ✓
- 2021 - SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel ✓
- 2021 - SiliFuzz: Fuzzing CPUs by proxy ✓
- 2021 - Same Coverage, Less Bloat: Accelerating Binary-only Fuzzing with Coverage-preserving Coverage-guided Tracing ✓
- 2021 - Facilitating Parallel Fuzzing with Mutually-exclusive Task Distribution ✓
- 2021 - PATA: Fuzzing with Path Aware Taint Analysis ✓
- 2021 - BSOD: Binary-only Scalable fuzzing Of device Drivers ✓
- 2021 - FuzzBench: An Open Fuzzer Benchmarking Platform and Service ✓
- 2021 - My Fuzzer Beats Them All! Developing a Framework for Fair Evaluation and Comparison of Fuzzers ✓
- 2021 - Scalable Fuzzing of Program Binaries with E9AFL ✓
- 2021 - HyperFuzzer: An Efficient Hybrid Fuzzer for Virtual CPUs ✓
- 2021 - BigMap: Future-proofing Fuzzers with Efficient Large Maps ✓
- 2021 - Token-Level Fuzzing ✓
- 2021 - Hashing Fuzzing: Introducing Input Diversity to Improve Crash Detection ✗
- 2021 - LeanSym: Efficient Hybrid Fuzzing Through Conservative Constraint Debloating ✓
- 2021 - ESRFuzzer: an enhanced fuzzing framework for physical SOHO router devices to discover multi-Type vulnerabilities ✓
- 2021 - KCFuzz: Directed Fuzzing Based on Keypoint Coverage ✓
- 2021 - TCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing ✓
- 2021 - Fuzzing with optimized grammar-aware mutation strategies ✓
- 2021 - Directed Fuzzing for Use-After-FreeVulnerabilities Detection ✓
- 2021 - DIFUZZRTL: Differential Fuzz Testing to FindCPU Bugs ✓
- 2021 - Z-Fuzzer: device-agnostic fuzzing of Zigbee protocol implementation ✓
- 2021 - Fuzzing with Multi-dimensional Control of Mutation Strategy ✓
- 2021 - Using a Guided Fuzzer and Preconditions to Achieve Branch Coverage with Valid Inputs ✓
- 2021 - RIFF: Reduced Instruction Footprint for Coverage-Guided Fuzzing ✓
- 2021 - CoCoFuzzing: Testing Neural Code Models with Coverage-Guided Fuzzing ✓
- 2021 - Seed Selection for Successful Fuzzing ✓
- 2021 - Gramatron: Effective Grammar-Aware Fuzzing ✓
- 2021 - Hyntrospect: a fuzzer for Hyper-V devices ✓
- 2021 - FUZZOLIC: mixing fuzzing and concolic execution ✓
- 2021 - QFuzz: Quantitative Fuzzing for Side Channels ✓
- 2021 - Revizor: Fuzzing for Leaks in Black-box CPUs ✓
- 2021 - Unleashing Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing ✓
- 2021 - Constraint-guided Directed Greybox Fuzzing ✓
- 2021 - Test-Case Reduction and Deduplication Almost forFree with Transformation-Based Compiler Testing ✓
- 2021 - RULF: Rust Library Fuzzing via API Dependency Graph Traversal ✓
- 2021 - STOCHFUZZ: Sound and Cost-effective Fuzzing of Stripped Binaries by Incremental and Stochastic Rewriting ✓
- 2021 - PS-Fuzz: Efficient Graybox Firmware Fuzzing Based on Protocol State ✓
- 2021 - MuDelta: Delta-Oriented Mutation Testing at Commit Time ✓
- 2021 - CollabFuzz: A Framework for Collaborative Fuzzing ✓
- 2021 - MUTAGEN: Faster Mutation-Based Random Testing ✓
- 2021 - Inducing Subtle Mutations with Program Repair ✓
- 2021 - Differential Analysis of X86-64 Instruction Decoders ✓
- 2021 - On Introducing Automatic Test Case Generation in Practice: A Success Story and Lessons Learned ✓
- 2021 - A Priority Based Path Searching Method for Improving Hybrid Fuzzing ✓
- 2021 - IntelliGen: Automatic Driver Synthesis for Fuzz Testing ✓
- 2021 - icLibFuzzer: Isolated-context libFuzzer for Improving Fuzzer Comparability ✓
- 2021 - SN4KE: Practical Mutation Testing at Binary Level ✓
- 2021 - One Engine to Fuzz ’em All: Generic Language Processor Testing with Semantic Validation ✓
- 2021 - Growing A Test Corpus with Bonsai Fuzzing ✓
- 2021 - Fuzzing Symbolic Expressions ✓
- 2021 - JMPscare: Introspection for Binary-Only Fuzzing ✓
- 2021 - An Improved Directed Grey-box Fuzzer ✓
- 2021 - A Binary Protocol Fuzzing Method Based on SeqGAN ✓
- 2021 - Refined Grey-Box Fuzzing with Sivo ✓
- 2021 - PSOFuzzer: A Target-Oriented Software Vulnerability Detection Technology Based on Particle Swarm Optimization ✓
- 2021 - MooFuzz: Many-Objective Optimization Seed Schedule for Fuzzer ✓
- 2021 - CMFuzz: context-aware adaptive mutation for fuzzers ✓
- 2021 - GTFuzz: Guard Token Directed Grey-Box Fuzzing ✓
- 2021 - ProFuzzBench: A Benchmark for Stateful Protocol Fuzzing ✓
- 2021 - SymQEMU:Compilation-based symbolic execution for binaries ✓
- 2021 - CONCOLIC EXECUTION TAILORED FOR HYBRID FUZZING THESIS ⚠
- 2021 - Breaking Through Binaries: Compiler-quality Instrumentationfor Better Binary-only Fuzzing ✓
- 2021 - AlphaFuzz: Evolutionary Mutation-based Fuzzing as Monte Carlo Tree Search ✓
- 2020 - Fuzzing with Fast Failure Feedback ✓
- 2020 - LAFuzz: Neural Network for Efficient Fuzzing ✓
- 2020 - MaxAFL: Maximizing Code Coverage with a Gradient-Based Optimization Technique ✓
- 2020 - Program State Abstraction for Feedback-Driven Fuzz Testing using Likely Invariants ✓
- 2020 - PMFuzz: Test Case Generation for Persistent Memory Programs ✓
- 2020 - FuSeBMC: A White-Box Fuzzer for Finding Security Vulnerabilities in C Programs ✓
- 2020 - Integrity: Finding Integer Errors by Targeted Fuzzing ✓
- 2020 - ConFuzz: Coverage-guided Property Fuzzing for Event-driven Programs ✓
- 2020 - AFLTurbo: Speed up Path Discovery for Greybox Fuzzing ✓
- 2020 - Fuzzing Channel-Based Concurrency Runtimes using Types and Effects ✓
- 2020 - DeFuzz: Deep Learning Guided Directed Fuzzing ✓
- 2020 - CrFuzz: Fuzzing Multi-purpose Programs through InputValidation ✓
- 2020 - EPfuzzer: Improving Hybrid Fuzzing with Hardest-to-reach Branch Prioritization ✓
- 2020 - Fuzzing Based on Function Importance by Interprocedural Control Flow Graph ✓
- 2020 - UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers ✓
- 2020 - PathAFL: Path-Coverage Assisted Fuzzing ✓
- 2020 - Path Sensitive Fuzzing for Native Applications ✓
- 2020 - UniFuzz: Optimizing Distributed Fuzzing via Dynamic Centralized Task Scheduling ✓
- 2020 - Fuzzing Error Handling Code using Context-Sensitive Software Fault Injection ✓
- 2020 - SpecFuzz: Bringing Spectre-type vulnerabilities to the surface ✓
- 2020 - Zeror: Speed Up Fuzzing with Coverage-sensitive Tracing and Scheduling ✓
- 2020 - MUZZ: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs ✓
- 2020 - Evolutionary Grammar-Based Fuzzing ✓
- 2020 - AFLpro: Direction sensitive fuzzing ✓
- 2020 - CSI-Fuzz: Full-speed Edge Tracing Using Coverage Sensitive Instrumentation ✓
- 2020 - Scalable Greybox Fuzzing for Effective Vulnerability Management DISS ✓
- 2020 - HotFuzz Discovering Algorithmic Denial-of-Service Vulnerabilities through Guided Micro-Fuzzing ✓
- 2020 - Fuzzing Binaries for Memory Safety Errors with QASan ✓
- 2020 - Suzzer: A Vulnerability-Guided Fuzzer Based on Deep Learning ✓
- 2020 - IJON: Exploring Deep State Spaces via Fuzzing ⚠
- 2020 - Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities ✓
- 2020 - PANGOLIN: Incremental Hybrid Fuzzing with Polyhedral Path Abstraction ✓
- 2020 - UEFI Firmware Fuzzing with Simics Virtual Platform ✓
- 2020 - Typestate-Guided Fuzzer for Discovering Use-after-Free Vulnerabilities ✓
- 2020 - FuzzGuard: Filtering out Unreachable Inputs in Directed Grey-box Fuzzing through Deep Learning ✓
- 2020 - HyDiff: Hybrid Differential Software Analysis ✓
- 2019 - Engineering a Better Fuzzer with SynergicallyIntegrated Optimizations ✓
- 2019 - Superion: Grammar-Aware Greybox Fuzzing ✓
- 2019 - ProFuzzer: On-the-fly Input Type Probing for Better Zero-day Vulnerability Discovery ✓
- 2019 - Grimoire: Synthesizing Structure while Fuzzing ✓
- 2019 - Ptrix: Efficient Hardware-Assisted Fuzzing for COTS Binary ✓
- 2019 - SAVIOR: Towards Bug-Driven Hybrid Testing ✓
- 2019 - FUDGE: Fuzz Driver Generation at Scale ✓
- 2019 - NAUTILUS: Fishing for Deep Bugs with Grammars ⚠
- 2019 - Send Hardest Problems My Way: Probabilistic Path Prioritization for Hybrid Fuzzing ✓
- 2019 - EnFuzz: Ensemble Fuzzing with Seed Synchronization among Diverse Fuzzers ✓
- 2018 - Fuzz Testing in Practice: Obstacles and Solutions ✓
- 2018 - PAFL: Extend Fuzzing Optimizations of Single Mode to Industrial Parallel Mode ✓
- 2018 - PTfuzz: Guided Fuzzing with Processor Trace Feedback ✓
- 2018 - Angora: Efficient Fuzzing by Principled Search ✓
- 2018 - FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage ✓
- 2018 - NEUZZ: Efficient Fuzzing with Neural Program Smoothing ✓
- 2018 - CollAFL: path Sensitive Fuzzing ✗
- 2018 - Full-speed Fuzzing: Reducing Fuzzing Overhead through Coverage-guided Tracing ✓
- 2018 - QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing ✓
- 2018 - Coverage-based Greybox Fuzzing as Markov Chain ✓
- 2018 - MoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation ✓
- 2018 - Singularity: Pattern Fuzzing for Worst Case Complexity ✓
- 2018 - Smart Greybox Fuzzing ✓
- 2018 - Hawkeye: Towards a Desired Directed Grey-box Fuzzer ✓
- 2018 - PerfFuzz: Automatically Generating Pathological Inputs ✓
- 2018 - FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage ✓
- 2018 - Enhancing Memory Error Detection for Large-Scale Applications and Fuzz Testing ✓
- 2018 - T-Fuzz: fuzzing by program transformation ✓
- 2017 - Evaluating and improving fault localization ✓
- 2017 - IMF: Inferred Model-based Fuzzer ✓
- 2017 - Synthesizing Program Input Grammars ✓
- 2017 - Steelix: Program-State Based Binary Fuzzing ✓
- 2017 - Designing New Operating Primitives to ImproveFuzzing Performance ✓
- 2017 - VUzzer: Application-aware Evolutionary Fuzzing ✓
- 2017 - DIFUZE: Interface Aware Fuzzing for Kernel Drivers ✓
- 2017 - Instruction Punning: Lightweight Instrumentation for x86-64 ✓
- 2017 - Designing New Operating Primitives to Improve Fuzzing Performance ✓
- 2014 - A Large-Scale Analysis of the Security of Embedded Firmwares ✓
- 2013 - Scheduling Black-box Mutational Fuzzing ✓
- 2013 - Dowsing for Overflows: A Guided Fuzzer to Find Buffer Boundary Violations ✓
- 2013 - RPFuzzer: A Framework for Discovering Router Protocols Vulnerabilities Based on Fuzzing ✓
- 2011 - Offset-Aware Mutation based Fuzzing for Buffer Overflow Vulnerabilities: Few Preliminary Results ✓
- 2010 - TaintScope: A Checksum-Aware Directed Fuzzing Tool for Automatic Software Vulnerability Detection ✓
- 2009 - Taint-based Directed Whitebox Fuzzing ✓
- 2009 - Dynamic Test Generation To Find Integer Bugs in x86 Binary Linux Programs ✓
- 2008 - Grammar-based Whitebox Fuzzing ✓
- 2008 - Vulnerability Analysis for X86 Executables Using Genetic Algorithm and Fuzzing ✓
- 2008 - KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs ✓
- 2008 - Automated Whitebox Fuzz Testing ✓
- 2005 - DART: Directed Automated Random Testing ✓
- 1994 - Dominators, Super Blocks, and Program Coverage ✓
Harnessing
- 2023 - AFGen: Whole-Function Fuzzing for Applications and Libraries ✓
- 2023 - NaNofuzz: A Usable Tool for Automatic Test Generation ✓
AI/LLM
- 2025 - SAFLITE: Fuzzing Autonomous Systems via Large Language Models
- 2025 - Large Language Model assisted Hybrid Fuzzing
- 2025 - A Roadmap for Software Testing in Open-Collaborative and AI-Powered Era
- 2025 - LLM-Powered Fuzz Testing of Automotive Diagnostic Protocols
- 2024 - Fixing Security Vulnerabilities with AI in OSS-Fuzz
- 2024 - Pentest GPT: Evaluating and Harnessing Large Language Models for Automated Penetration Testing
- 2024 - AutoSafeCoder: A Multi-Agent Framework for Securing LLM Code Generation through Static Analysis and Fuzz Testing
- 2024 - Fixing Security Vulnerabilities with AI in OSS-Fuzz ✓
- 2024 - ChatHTTPFuzz: Large Language Model-Assisted IoT HTTP Fuzzing ✓
- 2024 - Harnessing Large Language Models for Seed Generation in Greybox Fuzzing ✓
- 2024 - Magneto: A Step-Wise Approach to Exploit Vulnerabilities in Dependent Libraries via LLM-Empowered Directed Fuzzing ✓
- 2024 - Fuzzing BusyBox: Leveraging LLM and Crash Reuse for Embedded Bug Unearthing ✓
- 2024 - My Fuzzers Won’t Build: An Empirical Study of Fuzzing Build Failures ✓
- 2024 - ECG: Augmenting Embedded Operating System Fuzzing via LLM-based Corpus Generation ✓
- 2024 - FUZZCODER: Byte-level Fuzzing Test via Large Language Mode ✓
- 2024 - CyberSecEval 2: A Wide-Ranging Cybersecurity Evaluation Suite for Large Language Models
- 2024 - ProphetFuzz: Fully Automated Prediction and Fuzzing of High-Risk Option Combinations with Only Documentation via Large Language Model ✓
- 2024 - Is “AI” Useful for Fuzzing? (Keynote) ✓
- 2024 - Initial Seeds Generation Using LLM for IoT Device Fuzzing ✓
- 2024 - Your Fix Is My Exploit: Enabling Comprehensive DL Library API Fuzzing with Large Language Models ✓
- 2024 - WhiteFox: White-Box Compiler Fuzzing Empowered by Large Language Models ✓
- 2024 - The Mutators Reloaded: Fuzzing Compilers with Large Language Model Generated Mutation Operators ✓
- 2024 - A Coverage-Guided Fuzzing Method for Automatic Software Vulnerability Detection Using Reinforcement Learning-Enabled Multi-Level Input Mutation ✓
- 2024 - LLAMAFUZZ: Large Language Model Enhanced Greybox Fuzzing ✓
- 2024 - Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly ✓
- 2024 - Generative AI and Large Language Models for Cyber Security: All Insights You Need ✓
- 2024 - Large Language Model guided Protocol Fuzzing ✓
- 2024 - When Fuzzing Meets LLMs: Challenges and Opportunities ✓
- 2024 - Fuzz4All: Universal Fuzzing with Large Language Models ✓
- 2024 - Large Language Models for Cyber Security: A Systematic Literature Review ✓
- 2024 - LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs’ Vulnerability Reasoning ✓
- 2024 - Fuzzing BusyBox: Leveraging LLM and Crash Reuse for Embedded Bug Unearthing ✓
- 2024 - Prompt Fuzzing for Fuzz Driver Generation ✓
- 2023 - HOW FAR HAVE WE GONE IN VULNERABILITY DETECTION USING LARGE LANGUAGE MODELS ✓
- 2023 - KernelGPT: Enhanced Kernel Fuzzing via Large Language Models ✓
- 2023 - Exploring the Limits of ChatGPT in Software Security Applications ✓
- 2023 - LLM-Based Code Generation Method for Golang Compiler Testing ✓
- 2023 - Large Language Model guided Protocol Fuzzing ✓
- 2023 - AI-assisted Vulnerability Analysis And Classification Framework for UDS on CAN-bus Fuzzer ✓
- 2023 - GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts ✓
- 2023 - FUZZLLM: A NOVEL AND UNIVERSAL FUZZING FRAMEWORK FOR PROACTIVELY DISCOVERING JAILBREAK VULNERABILITIES IN LARGE LANGUAGE MODELS ✓
- 2023 - Universal Fuzzing via Large Language Models ✓
- 2023 - Understanding Large Language Model Based Fuzz Driver Generation ✓
- 2023 - Large Language Models for Fuzzing Parsers ✓
- 2023 - Large Language Models Are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models ✓
- 2023 - Augmenting Greybox Fuzzing with Generative AI ✓
- 2023 - Understanding Programs by Exploiting (Fuzzing) Test Cases ✓
IoT fuzzing
- 2025 - EmbedFuzz: High Speed Fuzzing through Transplantation
- 2024 - Parallel Fuzzing of IoT Messaging Protocols through Collaborative Packet Generation ✓
- 2024 - TWFuzz: Fuzzing Embedded Systems with Three Wires ✓
- 2024 - IoTFuzzSentry: Hunting Bugs In The IoT Wilderness In Operational Phase Using Payload Fuzzing ✓
- 2024 - TAIFuzz: taint analysis instrumentation-based firmware fuzzing system ✓
- 2024 - RIoTFuzzer: Companion App Assisted Remote Fuzzing for Detecting Vulnerabilities in IoT Devices ✓
- 2024 - FIRMRCA: Towards Post-Fuzzing Analysis on ARM Embedded Firmware with Efficient Event-based Fault Localization ✓
- 2024 - MSLFuzzer: black-box fuzzing of SOHO router devices via message segment list inference ✓
- 2024 - MULTIFUZZ: A Multi-Stream Fuzzer For Testing Monolithic Firmware ✓
- 2023 - KVFL: Key-Value-Based Persistent Fuzzing for IoT Web Servers ✓
- 2023 - Firmulti Fuzzer: Discovering Multi-process Vulnerabilities in IoT Devices with Full System Emulation and VMI ✓
- 2023 - Fuzzability Testing Framework for Incomplete Firmware Binary ✓
- 2023 - Fuzzing Embedded Systems Using Debug Interfaces ✓
- 2023 - Icicle: A Re-Designed Emulator for Grey-Box Firmware Fuzzing ✓
- 2022 - FirmSolo: Enabling dynamic analysis of binary Linux-based IoT kernel modules ✓
- 2022 - FuzzDocs: An Automated Security Evaluation Framework for IoT ✓
- 2022 - AflIot: Fuzzing on linux-based IoT device with binary-level instrumentation ✓
- 2022 - Tardis: Coverage-Guided Embedded Operating System Fuzzing ✓
- 2022 - Efficient greybox fuzzing of applications in Linux-based IoT devices via enhanced user-mode emulation ✓
- 2022 - Trampoline Over the Air: Breaking in IoT Devices Through MQTT Brokers ✓
- 2022 - PDFuzzerGen: Policy-Driven Black-Box Fuzzer Generation for Smart Devices ✓
- 2022 - RW-Fuzzer: A Fuzzing Method for Vulnerability Mining on Router Web Interface ✓
- 2022 - IoTInfer: Automated Blackbox Fuzz Testing of IoT Network Protocols Guided by Finite State Machine Inference ✓
- 2022 - Debugger-driven Embedded Fuzzing ✓
- 2022 - Game of Hide-and-Seek: Exposing Hidden Interfaces in Embedded Web Applications of IoT Devices ✓
- 2022 - 𝜇AFL: Non-intrusive Feedback-driven Fuzzing for Microcontroller Firmware ✓
- 2022 - FirVer: Concolic Testing for Systematic Validation of Firmware Binaries ✓
- 2022 - Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing ✓
- 2021 - CPscan: Detecting Bugs Caused by Code Pruning in IoT Kernels ✓
- 2021 - An Efficient Feedback-enhanced Fuzzing Scheme for Linux-based IoT Firmwares ✗
- 2021 - A Fuzzing Method for Embedded Software ✓
- 2021 - Large-scale Firmware Vulnerability Analysis Based on Code Similarity ✓
- 2021 - Towards Fast and Scalable Firmware Fuzzing with Dual-Level Peripheral Modeling ✓
- 2021 - Riding the IoT Wave with VFuzz: Discovering Security Flaws in Smart Home ✓
- 2021 - Zero WFuzzer: Target-Oriented Fuzzing for Web Interface of Embedded Devices ✓
- 2021 - StFuzzer: Contribution-Aware Coverage-Guided Fuzzing for Smart Devices ✓
- 2021 - Rtkaller: State-aware Task Generation for RTOS Fuzzing
- 2021 - IFIZZ: Deep-State and Efficient Fault-Scenario Generation to Test IoT Firmware ✓
- 2021 - Automatic Vulnerability Detection in Embedded Devices and Firmware: Survey and Layered Taxonomies ✓
- 2021 - Fuzzing the Internet of Things: A Review on the Techniques and Challenges for Efficient Vulnerability Discovery in Embedded Systems ✓
- 2021 - FIRM-COV: High-Coverage Greybox Fuzzing for IoT Firmware via Optimized Process Emulation ✓
- 2020 - Verification of Embedded Software Binaries using Virtual Prototypes ✓
- 2020 - μSBS: Static Binary Sanitization of Bare-metal Embedded Devices forFault Observability ✓
- 2020 - Device-agnostic Firmware Execution is Possible: A Concolic Execution Approach for Peripheral Emulation ✓
- 2020 - Vulnerability Detection in SIoT Applications: A Fuzzing Method on their Binaries ✓
- 2020 - FirmAE: Towards Large-Scale Emulation of IoT Firmware forDynamic Analysis ✓
- 2020 - FIRMNANO: Toward IoT Firmware Fuzzing Through Augmented Virtual Execution �
- 2020 - ARM-AFL: Coverage-Guided Fuzzing Framework for ARM-Based IoT Devices ✓
- 2020 - Bug detection in embedded environments by fuzzing and symbolic execution ✓
- 2020 - EM-Fuzz: Augmented Firmware Fuzzing via Memory Checking ✓
- 2020 - Verification of Embedded Binaries using Coverage-guided Fuzzing with System C-based Virtual Prototypes �
- 2020 - DICE: Automatic Emulation of DMA Input Channels for Dynamic Firmware Analysis ✓
- 2020 - Fw‐fuzz: A code coverage‐guided fuzzing framework for network protocols on firmware ✓
- 2020 - Taint-Driven Firmware Fuzzing of Embedded Systems ✓
- 2020 - A Dynamic Instrumentation Technology for IoT Devices ✓
- 2020 - Vulcan: a state-aware fuzzing tool for wear OS ecosystem ✓
- 2020 - A Novel Concolic Execution Approach on Embedded Device ✓
- 2020 - HFuzz: Towards automatic fuzzing testing of NB-IoT core network protocols implementations ✓
- 2020 - FIRMCORN: Vulnerability-Oriented Fuzzing of IoT Firmware via Optimized Virtual Execution ✓
- 2018 - IoTFuzzer: Discovering Memory Corruptions in IoT Through App-based Fuzzing ✓
- 2017 - Towards Automated Dynamic Analysis for Linux-based Embedded Firmware ✓
- 2016 - Scalable Graph-based Bug Search for Firmware Images ✓
- 2015 - SURROGATES: Enabling Near-Real-Time Dynamic Analyses of Embedded Systems ✓
- 2015 - Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware ✓
- 2014 - A Large-Scale Analysis of the Security of Embedded Firmwares ✓
- 2013 - RPFuzzer: A Framework for Discovering Router Protocols Vulnerabilities Based on Fuzzing ✓
Firmware Emulation
- 2025 - IoT Firmware Emulation and Its Security Application in Fuzzing: A Critical Revisit
- 2024 - SyncEmu: Enabling Dynamic Analysis of Stateful Trusted Applications ✓
- 2022 - What You See is Not What You Get: Revealing Hidden Memory Mapping for Peripheral Modeling ✓
- 2022 - What Your Firmware Tells You Is Not How You Should Emulate It: A Specification-Guided Approach for Firmware Emulation (Extended Version) ✓
- 2022 - BEERR: Bench of Embedded system Experiments for Reproducible Research ✓
- 2022 - FIRMWIRE: Transparent Dynamic Analysis for Cellular Baseband Firmware ✓
- 2022 - An Automated Approach to Re-Hosting Embedded Firmware Through Removing Hardware Dependencies ✓
- 2021 - FIRMGUIDE: Boosting the Capability of Rehosting Embedded Linux Kernels through Model-Guided Kernel Execution ✓
- 2021 - Automatic Firmware Emulation through Invalidity-guided Knowledge Inference(Extended Version) ✓
- 2021 - Firmware Re-hosting Through Static Binary-level Porting ✓
- 2021 - Jetset: Targeted Firmware Rehosting for Embedded Systems ✓
- 2021 - Automatic Firmware Emulation through Invalidity-guided Knowledge Inference ✓
Network fuzzing
- 2025 - AFLNet Five Years Later: On Coverage-Guided Protocol Fuzzing
- 2025 - SGMFuzz: State Guided Mutation Protocol Fuzzing
- 2024 - Stateful protocol fuzzing with statemap-based reverse state selection ✓
- 2024 - No Peer, no Cry: Network Application Fuzzing via Fault Injection ✓
- 2024 - Stateful protocol fuzzing with statemap-based reverse state selection ✓
- 2024 - Gudifu: Guided Differential Fuzzing for HTTP Request Parsing Discrepancies ✓
- 2024 - Netfuzzlib: Adding First-Class Fuzzing Support to Network Protocol Implementations ✓
- 2023 - NSFuzz: Towards Eficient and State-Aware Network Service Fuzzing - RCR Report ✓
- 2023 - INTENDER: Fuzzing Intent-Based Networking with Intent-State Transition Guidance ✓
- 2023 - NSFuzz: Towards Eficient and State-Aware Network Service Fuzzing ✓
- 2022 - FitM: Binary-Only Coverage-Guided Fuzzing for Stateful Network Protocols ✓
- 2022 - WThreadAFL:Deterministic Greybox Fuzzing for Multi-threadNetwork Servers ✓
- 2022 - Model-Based Grey-Box Fuzzing of Network Protocols ✓
- 2022 - Registered Report: NSFuzz: Towards Efficient and State-Aware Network Service Fuzzing ✓
- 2022 - SnapFuzz: An Efficient Fuzzing Framework for Network Applications ✓
- 2022 - REST API Fuzzing by Coverage Level Guided Blackbox Testing ✓
- 2022 - SNPSFuzzer: A Fast Greybox Fuzzer for Stateful Network Protocols using Snapshots ✓
- 2022 - WAFL: Binary-Only WebAssembly Fuzzing with Fast Snapshots ✓
- 2021 - Nyx-Net: Network Fuzzing with Incremental Snapshots ✓
- 2021 - RapidFuzz: Accelerating Fuzzing via Generative Adversarial Networks ✓
- 2021 - StateAFL: Greybox Fuzzing for Stateful Network Servers ✓
- 2020 - AFLNET: A Greybox Fuzzer for Network Protocols ✓
- 2020 - Finding Security Vulnerabilities in Network Protocol Implementations ✓
Kernel fuzzing
- 2025 - SyzParam: Incorporating Runtime Parameters into Kernel Driver Fuzzing
- 2024 - OZZ: Identifying Kernel Out-of-Order Concurrency Bugs with In-Vivo Memory Access Reordering ✓
- 2024 - SyzLego: Enhancing Kernel Directed Greybox Fuzzing via Dependency Inference and Scheduling ✓
- 2024 - A Little Goes a Long Way: Tuning Configuration Selection for Continuous Kernel Fuzzing ✓
- 2024 - CountDown: Refcount-guided Fuzzing for Exposing Temporal Memory Errors in Linux Kernel ✓
- 2024 - Approaches to determining the attack surface for fuzzing the Linux kernel ✓
- 2024 - SyzGen++: Dependency Inference for Augmenting Kernel Driver Fuzzing ✓
- 2024 - SyzRetrospector: A Large-Scale Retrospective Study of Syzbot ✓
- 2024 - SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer ✓
- 2024 - MOCK: Optimizing Kernel Fuzzing Mutation with Context-aware Dependency ✓
- 2023 - SyzDirect: Directed Greybox Fuzzing for Linux Kernel ✓
- 2023 - SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem ✓
- 2023 - KextFuzz: A Practical Fuzzer for macOS Kernel EXTensions on Apple Silicon ✓
- 2023 - WinkFuzz: Model-based Script Synthesis for Fuzzing ✓
- 2023 - SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers ✓
- 2023 - ACTOR: Action-Guided Kernel Fuzzing ✓
- 2023 - KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations ✓
- 2023 - BoKASAN: Binary-only Kernel Address Sanitizer for Effective Kernel Fuzzing ✓
- 2023 - DDRace: Finding Concurrency UAF Vulnerabilities in Linux Drivers with Directed Fuzzing ✓
- 2023 - Towards Unveiling Exploitation Potential With Multiple Error Behaviors for Kernel Bugs ✓
- 2023 - No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions ✓
- 2022 - PrIntFuzz: fuzzing Linux drivers via automated virtual device simulation ✓
- 2022 - KSG: Augmenting Kernel Fuzzing with System Call Specification Generation ✓
- 2022 - Demystifying the Dependency Challenge in Kernel Fuzzing ✓
- 2022 - Midas: Systematic Kernel TOCTTOU Protection ✓
- 2021 - Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph ✓
- 2021 - ACHyb: a hybrid analysis approach to detect kernel access control vulnerabilities ✓
- 2021 - CVFuzz: Detecting complexity vulnerabilities in OpenCL kernels via automated pathological input generation ✓
- 2021 - HEALER: Relation Learning Guided Kernel Fuzzing
- 2021 - SyzVegas: Beating Kernel Fuzzing Odds with Reinforcement Learning ✓
- 2021 - NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis ✓
- 2021 - Undo Workarounds for Kernel Bugs ✓
- 2020 - A Hybrid Interface Recovery Method for Android Kernels Fuzzing ✓
- 2020 - FINDING RACE CONDITIONS IN KERNELS:FROM FUZZING TO SYMBOLIC EXECUTION - THESIS ✓
- 2020 - Agamotto: Accelerating Kernel Driver Fuzzing with Lightweight Virtual Machine Checkpoints ✓
- 2020 - X-AFL: a kernel fuzzer combining passive and active fuzzing ✓
- 2020 - Identification of Kernel Memory Corruption Using Kernel Memory Secret Observation Mechanism ✓
- 2020 - HFL: Hybrid Fuzzing on the Linux Kernel ✓
- 2020 - Realistic Error Injection for System Calls ✓
- 2020 - KRACE: Data Race Fuzzing for Kernel File Systems ✓
- 2020 - USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation ✓
- 2019 - Fuzzing File Systems via Two-Dimensional Input Space Exploration ✓
- 2019 - Razzer: Finding Kernel Race Bugs through Fuzzing ✓
- 2019 - Unicorefuzz: On the Viability of Emulation for Kernel space Fuzzing ✓
- 2017 - Stateful Fuzzing of Wireless Device Drivers in an Emulated Environment ✓
- 2017 - DIFUZE: Interface Aware Fuzzing for Kernel Drivers ✓
- 2008 - Fuzzing Wi-Fi Drivers to Locate Security Vulnerabilities ⚠
Format specific fuzzing
- 2025 - Smart Contract Fuzzing Towards Profitable Vulnerabilities
- 2025 - DUMPLING: Fine-grained Differential JavaScript Engine Fuzzing ✓
- 2024 - SQLPass: A Semantic Effective Fuzzing Method for DBMS ✓
- 2024 - Atlas: Automating Cross-Language Fuzzing on Android Closed-Source Libraries ✓
- 2024 - Tacoma: Enhanced Browser Fuzzing with Fine-Grained Semantic Alignment ✓
- 2024 - Applying Fuzz Driver Generation to Native C/C++ Libraries of OEM Android Framework: Obstacles and Solutions ✓
- 2024 - CrossFire: Fuzzing macOS Cross-XPU Memory on Apple Silicon ✓
- 2024 - BArcherFuzzer: An Android System Services Fuzzier via Transaction Dependencies of BpBinder ✓
- 2024 - BRF: Fuzzing the eBPF Runtime ✓
- 2024 - Monarch: A Fuzzing Framework for Distributed File Systems ✓
- 2023 - Android Fuzzing: Balancing User-Inputs and Intents ✓
- 2023 - ItyFuzz: Snapshot-Based Fuzzer for Smart Contract ✓
- 2023 - BRF: eBPF Runtime Fuzzer ✓
- 2023 - MorFuzz: Fuzzing Processor via Runtime Instruction Morphing enhanced Synchronizable Co-simulation ✓
- 2023 - EFCF: High Performance Smart Contract Fuzzing for Exploit Generation ✓
- 2023 - ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing ✓
- 2023 - VIDEZZO: Dependency-aware Virtual Device Fuzzing ✓
- 2023 - HyPFuzz: Formal-Assisted Processor Fuzzing ✓
- 2023 - FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities ✓
- 2022 - SFuzz: Slice-based Fuzzing for Real-Time Operating Systems ✓
- 2022 - LFUZZ: Exploiting Locality for File-system Fuzzing ✓
- 2022 - MUNDOFUZZ: Hypervisor Fuzzing with Statistical Coverage Testing and Grammar Inference ✓
- 2022 - DTLS-Fuzzer: A DTLS Protocol State Fuzzer ✓
- 2022 - FuzzUSB: Hybrid Stateful Fuzzing of USB Gadget Stacks ✓
- 2022 - TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities ✓
- 2021 - V-Shuttle: Scalable and Semantics-Aware Hypervisor Virtual Device Fuzzing ✓
- 2021 - FormatFuzzer: Effective Fuzzing of Binary File Formats ✓
- 2020 - NYX: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types ✓
- 2020 - Tree2tree Structural Language Modeling for Compiler Fuzzing ✓
- 2020 - Detecting Critical Bugs in SMT Solvers Using Blackbox Mutational Fuzzing ✓
- 2020 - JS Engine - Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer ✓
- 2020 - JS Engine - Fuzzing JavaScript Engines with Aspect-preserving Mutation ✓
- 2020 - CUDA Compiler - CUDAsmith: A Fuzzer for CUDA Compilers ✓
- 2020 - Smart Contracts - sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart Contracts ✓
- 2019 - Compiler Fuzzing: How Much Does It Matter? ✓
- 2019 - Smart Contracts - Harvey: A Greybox Fuzzer for Smart Contracts ✓
- 2017 - XML - Skyfire: Data-Driven Seed Generation for Fuzzing ✓
Exploitation
- 2025 - AIRBUGCATCHER: Automated Wireless Reproduction of IoT Bugs
- 2024 - Revealing the exploitability of heap overflow through PoC analysis ✓
- 2024 - Take a Step Further: Understanding Page Spray in Linux Kernel Exploitation ✓
- 2024 - K-LEAK: Towards Automating the Generation of Multi-Step Infoleak Exploits against the Linux Kernel ✓
- 2023 - Enhanced Memory Corruption Detection in C/C++ Programs ✓
- 2023 - Automated Exploitable Heap Layout Generation for Heap Overflows Through Manipulation Distance-Guided Fuzzing ✓
- 2023 - The Most Dangerous Codec in the World: Finding and Exploiting Vulnerabilities in H.264 Decoders ✓
- 2023 - Detecting Exploit Primitives Automatically for Heap Vulnerabilities on Binary Programs ✓
- 2022 - RiscyROP: Automated Return-Oriented Programming Attacks on RISC-V and ARM64 ✓
- 2022 - Automatic Permission Check Analysis for Linux Kernel ✓
- 2022 - OS-Aware Vulnerability Prioritization via Differential Severity Analysis ✓
- 2022 - Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs ✗
- 2022 - KASPER: Scanning for Generalized Transient Execution Gadgets in the Linux Kernel ✓
- 2022 - MaMaDroid 2.0 - The Holes of control flow graphs ✓
- 2022 -ShadowHeap: Memory Safety through Efficient Heap Metadata Validation ✓
- 2022 - MACH2: System for Root Cause Analysis of Kernel Vulnerabilities [THESIS]
- 2021 - Automated Bug Hunting With Data-Driven Symbolic Root Cause Analysis ✓
- 2021 - MAJORCA: Multi-Architecture JOP and ROP Chain Assembler ✓
- 2021 - A Novel Method for the Automatic Generation of JOP Chain Exploits ✓
- 2021 - V0Finder: Discovering the Correct Origin of Publicly Reported Software Vulnerabilities ✓
- 2021 - Identifying Valuable Pointers in Heap Data ✓
- 2021 - OCTOPOCS: Automatic Verification of Propagated Vulnerable Code Using Reformed Proofs of Concept ✓
- 2021 - Characterizing Vulnerabilities in a Major Linux Distribution ✓
- 2021 - MAZE: Towards Automated Heap Feng Shui ✓
- 2021 - Vulnerability Detection in C/C++ Source Code With Graph Representation Learning ✓
- 2021 - mallotROPism: a metamorphic engine for malicious software variation development ✓
- 2020 - Automatic Techniques to Systematically Discover New Heap Exploitation Primitives ✓
- 2020 - Shadow-Heap: Preventing Heap-based Memory Corruptions by Metadata Validation ✓
- 2020 - Practical Fine-Grained Binary Code Randomization ✓
- 2020 - Tiny-CFA: Minimalistic Control-Flow Attestation UsingVerified Proofs of Execution ⚠
- 2020 - Greybox Automatic Exploit Generation for Heap Overflows in Language Interpreters - PHD THESIS ✓
- 2020 - ABCFI: Fast and Lightweight Fine-Grained Hardware-Assisted Control-Flow Integrity ✓
- 2020 - HeapExpo: Pinpointing Promoted Pointers to Prevent Use-After-Free Vulnerabilities ✗
- 2020 - Localizing Patch Points From One Exploit ✓
- 2020 - Speculative Dereferencing of Registers: Reviving Foreshadow ✓
- 2020 - HAEPG: An Automatic Multi-hop Exploitation Generation Framework ✓
- 2020 - Exploiting More Binaries by Using Planning to Assemble ROP Exploiting More Binaries by Using Planning to Assemble ROP Attacks Attacks ✓
- 2020 - ROPminer: Learning-Based Static Detection of ROP Chain Considering Linkability of ROP Gadgets ✓
- 2020 - KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities ✓
- 2020 - Preventing Return Oriented Programming Attacks By Preventing Return Instruction Pointer Overwrites ✓
- 2020 - KASLR: Break It, Fix It, Repeat ✓
- 2020 - ShadowGuard : Optimizing the Policy and Mechanism of Shadow Stack Instrumentation using Binary Static Analysis ✓
- 2020 - VulHunter: An Automated Vulnerability Detection System Based on Deep Learning and Bytecode ✓
- 2020 - Analysis and Evaluation of ROPInjector ✓
- 2020 - API Misuse Detection in C Programs: Practice on SSL APIs ✓
- 2020 - KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities ✓
- 2020 - Egalito: Layout-Agnostic Binary Recompilation ✓
- 2020 - Verifying Software Vulnerabilities in IoT Cryptographic Protocols ✓
- 2020 - μRAI: Securing Embedded Systems with Return Address Integrity ✓
- 2020 - Preventing Return Oriented Programming Attacks By Preventing Return Instruction Pointer Overwrites ✓
- 2019 - Kernel Protection Against Just-In-Time Code Reuse ✓
- 2019 - Kernel Exploitation Via Uninitialized Stack ✓
- 2019 - KEPLER: Facilitating Control-flow Hijacking Primitive Evaluation for Linux Kernel Vulnerabilities ✓
- 2019 - SLAKE: Facilitating Slab Manipulation for Exploiting Vulnerabilities in the Linux Kernel ✓
- 2018 - HeapHopper: Bringing Bounded Model Checkingto Heap Implementation Security ✓
- 2018 - K-Miner: Uncovering Memory Corruption in Linux ✓
- 2017 - HAIT: Heap Analyzer with Input Tracing ✓
- 2017 - DROP THE ROP: Fine-grained Control-flow Integrity for the Linux Kernel ✓
- 2017 - kR^X: Comprehensive Kernel Protection against Just-In-Time Code Reuse ✓
- 2017 - Unleashing Use-Before-Initialization Vulnerabilities in the Linux Kernel Using Targeted Stack Spraying ✓
- 2017 - Towards Automated Dynamic Analysis for Linux-based Embedded Firmware ✓
- 2016 - Scalable Graph-based Bug Search for Firmware Images ✓
- 2015 - Cross-Architecture Bug Search in Binary Executables ✓
- 2015 - SURROGATES: Enabling Near-Real-Time Dynamic Analyses of Embedded Systems ✓
- 2015 - From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel ✓
- 2015 - PIE: Parser Identification in Embedded Systems ✓
- 2014 - ret2dir: Rethinking Kernel Isolation ✓
- 2014 - Make It Work, Make It Right, Make It Fast: Building a Platform-Neutral Whole-System Dynamic Binary Analysis Platform ✓
- 2011 - Linux kernel vulnerabilities: state-of-the-art defenses and open problems ✓
- 2011 - Protecting the Core: Kernel Exploitation Mitigations ✓
- 2015 - From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel ✓
- 2014 - ret2dir: Rethinking Kernel Isolation ✓
- 2012 - Anatomy of a Remote Kernel Exploit ⚠
- 2012 - A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator ✗
- 2011 - Linux kernel vulnerabilities: state-of-the-art defenses and open problems ✓
- 2011 - Protecting the Core: Kernel Exploitation Mitigations ✓
Static Binary Analysis
- 2025 - LLM-Powered Static Binary Taint Analysis
- 2025 - BinHunter: A Fine-Grained Graph Representation for Localizing Vulnerabilities in Binary Executables
- 2024 - Effectiveness of ChatGPT for Static Analysis: How Far Are We?Effectiveness of ChatGPT for Static Analysis: How Far Are We? ✓
- 2024 - Bin2Summary: Beyond Function Name Prediction in Stripped Binaries with Functionality-Specific Code Embeddings ✓
- 2021 - ICALLEE: Recovering Call Graphs for Binaries ✓
- 2021 - EnBinDiff: Identifying Data-only Patches for Binaries ✓
- 2021 - VIVA: Binary Level Vulnerability Identification via Partial Signature ✓
- 2021 - Overview of the advantages and disadvantages of static code analysis tools ✓
- 2021 - Multi-Level Cross-Architecture Binary Code Similarity Metric ✓
- 2020 - VulDetector: Detecting Vulnerabilities using Weighted Feature Graph Comparison ✓
- 2020 - DEEPBINDIFF: Learning Program-Wide Code Representations for Binary Diffing ✓
- 2020 - BinDeep: A Deep Learning Approach to Binary Code Similarity Detection ✓
- 2020 - Revisiting Binary Code Similarity Analysis using Interpretable Feature Engineering and Lessons Learned ✓
- 2020 - iDEA: Static Analysis on the Security of Apple Kernel Drivers ✓
- 2020 - HART: Hardware-Assisted Kernel Module Tracing on Arm ✓
- 2020 - AN APPROACH TO COMPARING CONTROL FLOW GRAPHS BASED ON BASIC BLOCK MATCHING ✓
- 2020 - How Far We Have Come: Testing Decompilation Correctness of C Decompilers ✓
- 2020 - Dynamic Binary Lifting and Recompilation DISS ✓
- 2020 - Similarity Based Binary Backdoor Detection via Attributed Control Flow Graph ✓
- 2020 - IoTSIT: A Static Instrumentation Tool for IoT Devices ✓
- 2019 - Code Similarity Detection using AST and Textual Information ✗
- 2018 - CodEX: Source Code Plagiarism DetectionBased on Abstract Syntax Trees ✓
- 2017 - rev.ng: a unified binary analysis framework to recover CFGs and function boundaries ✓
- 2017 - Angr: The Next Generation of Binary Analysis ✓
- 2016 - Binary code is not easy ✓
- 2015 - Cross-Architecture Bug Search in Binary Executables ✓
- 2014 - A platform for secure static binary instrumentation ✓
- 2013 - MIL: A language to build program analysis tools through static binary instrumentation ✓
- 2013 - Binary Code Analysis ✓
- 2013 - A compiler-level intermediate representation based binary analysis and rewriting system ✓
- 2013 - Protocol reverse engineering through dynamic and static binary analysis ✓
- 2013 - BinaryPig: Scalable Static Binary Analysis Over Hadoop ✓
- 2011 - BAP: A Binary Analysis Platform ✓
- 2009 - Syntax tree fingerprinting for source code similarity detection ✓
- 2008 - BitBlaze: A New Approach to Computer Security via Binary Analysis ✓
- 2005 - Practical analysis of stripped binary code ✓
- 2004 - Detecting kernel-level rootkits through binary analysis ✓
Misc
- 2025 RangeSanitizer: Detecting Memory Errors with Efficient Range Checks
- 2024 - Tyche: Making Sense of Property-Based Testing Effectiveness ✓
- 2024 - ARVO: Atlas of Reproducible Vulnerabilities for Open Source Software ✓
- 2024 - LeanBin: Harnessing Lifting and Recompilation to Debloat Binaries ✓
- 2024 - Operation Mango: Scalable Discovery of Taint-Style Vulnerabilities in Binary Firmware Services ✗
- 2024 - A Binary-level Thread Sanitizer or Why Sanitizing on the Binary Level is Hard ✓
- 2023 - MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries ✓
- 2023 - ARMore: Pushing Love Back Into Binaries ✓
- 2023 - gMutant: A gCov based Mutation Testing Analyser ✓
- 2022 - Auto Off-Target: Enabling Thorough and Scalable Testing for Complex Software Systems ✓
- 2022 - GRIN: Make Rewriting More Precise ✓
- 2022 - CFINSIGHT: A Comprehensive Metric for CFI Policies ✓
- 2022 - Odin: On-Demand Instrumentation with On-the-Fly Recompilation ✓
- 2022 - Debloating Address Sanitizer ✓
- 2021 - FMViz: Visualizing Tests Generated by AFL at the Byte-level ✓
- 2021 - Raising MIPS Binaries to LLVM IR ✓
- 2021 - yzGen: Automated Generation of Syscall Specification of Closed-Source macOS Drivers ✓
- 2021 - Igor: Crash Deduplication Through Root-Cause Clustering ✓
- 2021 - UAFSan: an object-identifier-based dynamic approach for detecting use-after-free vulnerabilities ✓
- 2021 - SyML: Guiding Symbolic Execution Toward Vulnerable States Through Pattern Learning ✓
- 2021 - LLSC: A Parallel Symbolic Execution Compiler for LLVM IR ✓
- 2021 - FuzzSplore: Visualizing Feedback-Driven Fuzzing Techniques ✓
- 2020 - Memory Error Detection Based on Dynamic Binary Translation ✓
- 2020 - Sydr: Cutting Edge Dynamic Symbolic Execution ✓
- 2020 - DrPin: A dynamic binary instumentator for multiple processor architectures ✓
- 2020 - MVP: Detecting Vulnerabilities using Patch-Enhanced Vulnerability Signatures ✓
- 2020 - Collecting Vulnerable Source Code from Open-Source Repositories for Dataset Generation ✓
- 2020 - LEOPARD: Identifying Vulnerable Code for Vulnerability Assessment through Program Metrics ✓
- 2020 - Dynamic Program Analysis Tools in GCC and CLANG Compilers ✓
- 2020 - On Using k-means Clustering for Test Suite Reduction ✓
- 2020 - Optimizing the Parameters of an Evolutionary Algorithm for Fuzzing and Test Data Generation ✓
- 2020 - Inputs from Hell: Learning Input Distributions for Grammar-Based Test Generation ✓
- 2020 - IdSan: An identity-based memory sanitizer for fuzzing binaries ✓
- 2020 - An experimental study oncombining automated andstochastic test data generation - MASTER THESIS ✓
- 2020 - FuzzGen: Automatic Fuzzer Generation ✓
- 2020 - Fuzzing: On the Exponential Cost of Vulnerability Discovery ✓
- 2020 - Poster: Debugging Inputs ✓
- 2020 - API Misuse Detection in C Programs: Practice on SSL APIs ✓
- 2020 - Egalito: Layout-Agnostic Binary Recompilation ✓
- 2020 - Verifying Software Vulnerabilities in IoT Cryptographic Protocols ✓
- 2020 - μRAI: Securing Embedded Systems with Return Address Integrity ✓
- 2020 - Fast Bit-Vector Satisfiability ✓
- 2020 - MARDU: Efficient and Scalable Code Re-randomization ✓
- 2020 - Towards formal verification of IoT protocols: A Review ✓
- 2020 - Automating the fuzzing triage process ✓
- 2020 - COMPARING AFL SCALABILITY IN VIRTUAL-AND NATIVE ENVIRONMENT ✓
- 2020 - SYMBION: Interleaving Symbolic with Concrete Execution ✓
- 2020 - Not All Coverage Measurements Are Equal: Fuzzing by Coverage Accounting for Input Prioritization ✓
- 2019 - Toward the Analysis of Embedded Firmware through Automated Re-hosting ✓
- 2019 - FUZZIFICATION: Anti-Fuzzing Techniques ✓
- 2018 - VulinOSS: A Dataset of Security Vulnerabilities in Open-source Systems ✓
- 2018 - HDDr: A Recursive Variantof the Hierarchical Delta Debugging Algorithm ✓
- 2017 - Coarse Hierarchical Delta Debugging ✓
- 2017 - VUDDY: A Scalable Approach for Vulnerable CodeClone Discovery ✓
- 2017 - Postmortem Program Analysis with Hardware-Enhanced Post-Crash Artifacts ✓
- 2017 - Synthesizing Program Input Grammars ✓
- 2017 - Designing New Operating Primitives to Improve Fuzzing Performance ✓
- 2017 - Instruction Punning: Lightweight Instrumentation for x86-64 ✓
- 2016 - Modernizing Hierarchical Delta Debugging ✓
- 2016 - VulPecker: An Automated Vulnerability Detection SystemBased on Code Similarity Analysis ✓
- 2016 - CREDAL: Towards Locating a Memory Corruption Vulnerability with Your Core Dump ✓
- 2016 - RETracer: Triaging Crashes by Reverse Execution fromPartial Memory Dumps ✓
- 2015 - PIE: Parser Identification in Embedded Systems ✓
- 2010 - Iterative Delta Debugging ✓
- 2009 - Dynamic Test Generation To Find Integer Bugs in x86 Binary Linux Programs ✓
- 2006 - HDD: Hierarchical Delta Debugging ✓
Surveys, SoKs, and Studies
- 2025 - Fuzzing drones for anomaly detection: A systematic literature review
- 2025 - SoK: Towards Effective Automated Vulnerability Repair
- 2025 - SoK: Unraveling the Veil of OS Kernel Fuzzing
- 2024 - SoK: Prudent Evaluation Practices for Fuzzing
- 2024 - An Empirical Examination of Fuzzer Mutator Performance ✓
- 2024 - An Empirical Study on the Distance Metric in Guiding Directed Grey-box Fuzzing ✓
- 2024 - Exploring the Adoption of Fuzz Testing in Open-Source Software: A Case Study of the Go Community ✓
- 2024 - Is Stateful Fuzzing Really Challenging? ✓
- 2024 - Fuzzing Frameworks for Server-side Web Applications: A Survey ✓
- 2024 - SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing ✓
- 2024 - A Survey of Protocol Fuzzing ✓
- 2024 - Large Language Models Based Fuzzing Techniques: A Survey ✓
- 2024 - Fuzzing: Progress, Challenges, and Perspectives ✓
- 2023 - A systematic review of fuzzing ✓
- 2023 - An Empirical Study on AST-level mutation-based fuzzing techniques for JavaScript Engines ✓
- 2023 - Software Bug Detection: Challenges and Synergies ✓
- 2023 - Demystify the Fuzzing Methods: A Comprehensive Survey ✓
- 2023 - The Human Side of Fuzzing: Challenges Faced by Developers During Fuzzing Activities ✓
- 2023 - ASanity: On Bug Shadowing by Early ASan Exits ✓
- 2023 - A Case Study on Fuzzing Satellite Firmware ✓
- 2023 - Fuzzing the Latest NTFS in Linux with Papora: An Empirical Study ✓
- 2023 - Fuzzing REST APIs for Bugs: An Empirical Analysis ✓
- 2023 - Automated Binary Analysis: A Survey ✓
- 2023 - Fuzzers for stateful systems: Survey and Research Directions ✓
- 2022 - Detecting Vulnerability on IoT Device Firmware: A Survey ✓
- 2022 - Fuzzing of Embedded Systems: A Survey ✓
- 2022 - Embedded Fuzzing: a Review of Challenges, Tools, and Solutions ✓
- 2022 - An empirical study of vulnerability discovery methods over the past ten years ✓
- 2022 - Fuzzing vulnerability discovery techniques: Survey, challenges and future directions ✓
- 2022 - Fuzzing: A Survey for Roadmap ✓
- 2022 - How Long Do Vulnerabilities Live in the Code? A Large-Scale Empirical Measurement Study on FOSS Vulnerability Lifetimes ✓
- 2021 - Protocol Reverse-Engineering Methods and Tools: A Survey ✓
- 2021 - Exploratory Review of Hybrid Fuzzing for Automated Vulnerability Detection ✓
- 2021 - A Systematic Review of Network Protocol Fuzzing Techniques ✓
- 2021 - Vulnerability Detection is Just the Beginning ✓
- 2021 - Evaluating Synthetic Bugs ✓
- 2020 - A Practical, Principled Measure of Fuzzer Appeal:A Preliminary Study ✓
- 2020 - A Systemic Review of Kernel Fuzzing ✓
- 2020 - A Survey of Hybrid Fuzzing based on Symbolic Execution ✓
- 2020 - A Study on Using Code Coverage Information Extracted from Binary to Guide Fuzzing ✓
- 2020 - Study of Security Flaws in the Linux Kernel by Fuzzing ✓
- 2020 - Dynamic vulnerability detection approaches and tools: State of the Art ✓
- 2020 - Fuzzing: Challenges and Reflections ✓
- 2020 - The Relevance of Classic Fuzz Testing: Have We Solved This One? ✓
- 2020 - A Practical, Principled Measure of Fuzzer Appeal:A Preliminary Study ✓
- 2020 - SoK: All You Ever Wanted to Know About x86/x64 Binary Disassembly But Were Afraid to Ask ✓
- 2020 - A Quantitative Comparison of Coverage-Based Greybox Fuzzers ✓
- 2020 - A Survey of Security Vulnerability Analysis, Discovery, Detection, and Mitigation on IoT Devices ✓
- 2020 - A systematic review of fuzzing based on machine learning techniques ✓
- 2019 - A Survey of Binary Code Similarity ✓
- 2019 - The Art, Science, and Engineering of Fuzzing: A Survey ✓
- 2012 - Regression testing minimization, selection and prioritization: a survey ✓
directed-fuzzing
embedded
exploitation
fuzzing
fuzzing-binaries
guided-fuzzing
hybrid-fuzzing
iot
kernel
linux
linux-kernel
mitigations
paper
rca
root-cause
sanitizer
vulnerability-detection
Similar repos
Contributors
Languages
Python
100.0%