{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T02:07:38Z","timestamp":1789178858547,"version":"build-2803163510"},"publisher-location":"Cham","reference-count":50,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031641701","type":"print"},{"value":"9783031641718","type":"electronic"}],"license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024]]},"DOI":"10.1007\/978-3-031-64171-8_12","type":"book-chapter","created":{"date-parts":[[2024,7,10]],"date-time":"2024-07-10T11:02:33Z","timestamp":1720609353000},"page":"227-250","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["SandPuppy: Deep-State Fuzzing Guided by\u00a0Automatic Detection of\u00a0State-Representative Variables"],"prefix":"10.1007","author":[{"given":"Vivin","family":"Paliath","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Erik","family":"Trickel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruoyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Adam","family":"Doup\u00e9","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,7,9]]},"reference":[{"key":"12_CR1","unstructured":"Libfuzzer - a library for coverage-guided fuzz testing. https:\/\/llvm.org\/docs\/LibFuzzer.html. Accessed 26 Oct 2021"},{"key":"12_CR2","doi-asserted-by":"crossref","unstructured":"Aschermann, C., Frassetto, T., Holz, T., Jauernig, P., Sadeghi, A.R., Teuchert, D.: Nautilus: fishing for deep bugs with grammars. In: NDSS (2019)","DOI":"10.14722\/ndss.2019.23412"},{"key":"12_CR3","doi-asserted-by":"crossref","unstructured":"Aschermann, C., Schumilo, S., Abbasi, A., Holz, T.: IJON: exploring deep state spaces via fuzzing. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 1597\u20131612. IEEE (2020)","DOI":"10.1109\/SP40000.2020.00117"},{"key":"12_CR4","doi-asserted-by":"crossref","unstructured":"Aschermann, C., Schumilo, S., Blazytko, T., Gawlik, R., Holz, T.: REDQUEEN: fuzzing with input-to-state correspondence. In: NDSS, vol.\u00a019, pp. 1\u201315 (2019)","DOI":"10.14722\/ndss.2019.23371"},{"key":"12_CR5","unstructured":"Ba, J., B\u00f6hme, M., Mirzamomen, Z., Roychoudhury, A.: Stateful greybox fuzzing. In: 31st USENIX Security Symposium (USENIX Security 22), pp. 3255\u20133272 (2022)"},{"key":"12_CR6","unstructured":"Blazytko, T., et\u00a0al.: GRIMOIRE: synthesizing structure while fuzzing. In: 28th USENIX Security Symposium (USENIX Security 19), pp. 1985\u20132002 (2019)"},{"key":"12_CR7","unstructured":"B\u00f6hme, M.: Aflfast. https:\/\/github.com\/mboehme\/aflfast. Accessed 26 Oct 2021"},{"key":"12_CR8","doi-asserted-by":"crossref","unstructured":"B\u00f6hme, M., Pham, V.T., Nguyen, M.D., Roychoudhury, A.: Directed greybox fuzzing. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 2329\u20132344 (2017)","DOI":"10.1145\/3133956.3134020"},{"issue":"5","key":"12_CR9","doi-asserted-by":"publisher","first-page":"489","DOI":"10.1109\/TSE.2017.2785841","volume":"45","author":"M B\u00f6hme","year":"2017","unstructured":"B\u00f6hme, M., Pham, V.T., Roychoudhury, A.: Coverage-based greybox fuzzing as Markov chain. IEEE Trans. Softw. Eng. 45(5), 489\u2013506 (2017)","journal-title":"IEEE Trans. Softw. Eng."},{"key":"12_CR10","doi-asserted-by":"crossref","unstructured":"Chen, P., Chen, H.: Angora: efficient fuzzing by principled search. In: 2018 IEEE Symposium on Security and Privacy (SP), pp. 711\u2013725. IEEE (2018)","DOI":"10.1109\/SP.2018.00046"},{"key":"12_CR11","doi-asserted-by":"crossref","unstructured":"Chen, P., Liu, J., Chen, H.: Matryoshka: fuzzing deeply nested branches. In: Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 499\u2013513 (2019)","DOI":"10.1145\/3319535.3363225"},{"key":"12_CR12","unstructured":"Chen, Y., Ahmadi, M., Wang, B., Lu, L., et\u00a0al.: $$MEUZZ$$: smart seed scheduling for hybrid fuzzing. In: 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020), pp. 77\u201392 (2020)"},{"key":"12_CR13","doi-asserted-by":"crossref","unstructured":"Chen, Y., et al.: SAVIOR: towards bug-driven hybrid testing. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 1580\u20131596. IEEE (2020)","DOI":"10.1109\/SP40000.2020.00002"},{"key":"12_CR14","doi-asserted-by":"crossref","unstructured":"Coppik, N., Schwahn, O., Suri, N.: MEMFUZZ: using memory accesses to guide fuzzing. In: 2019 12th IEEE Conference on Software Testing, Validation and Verification (ICST), pp. 48\u201358. IEEE (2019)","DOI":"10.1109\/ICST.2019.00015"},{"key":"12_CR15","unstructured":"Fioraldi, A., D\u2019Elia, D.C., Balzarotti, D.: The use of likely invariants as feedback for fuzzers. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 2829\u20132846 (2021)"},{"key":"12_CR16","doi-asserted-by":"crossref","unstructured":"Fioraldi, A., D\u2019Elia, D.C., Coppa, E.: WEIZZ: automatic grey-box fuzzing for structured binary formats. In: Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 1\u201313 (2020)","DOI":"10.1145\/3395363.3397372"},{"key":"12_CR17","unstructured":"Gan, S., et al.: $$GREYONE$$: data flow sensitive fuzzing. In: 29th USENIX Security Symposium (USENIX Security 20), pp. 2577\u20132594 (2020)"},{"key":"12_CR18","doi-asserted-by":"crossref","unstructured":"Gan, S., et al.: CollAFL: path sensitive fuzzing. In: 2018 IEEE Symposium on Security and Privacy (SP), pp. 679\u2013696. IEEE (2018)","DOI":"10.1109\/SP.2018.00040"},{"key":"12_CR19","doi-asserted-by":"crossref","unstructured":"Han, H., Oh, D., Cha, S.K.: CodeAlchemist: semantics-aware code generation to find vulnerabilities in javascript engines. In: NDSS (2019)","DOI":"10.14722\/ndss.2019.23263"},{"key":"12_CR20","doi-asserted-by":"crossref","unstructured":"Hsu, C.C., Wu, C.Y., Hsiao, H.C., Huang, S.K.: Instrim: lightweight instrumentation for coverage-guided fuzzing. In: Symposium on Network and Distributed System Security (NDSS), Workshop on Binary Analysis Research (2018)","DOI":"10.14722\/bar.2018.23014"},{"key":"12_CR21","doi-asserted-by":"crossref","unstructured":"Huang, H., Yao, P., Wu, R., Shi, Q., Zhang, C.: Pangolin: incremental hybrid fuzzing with polyhedral path abstraction. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 1613\u20131627. IEEE (2020)","DOI":"10.1109\/SP40000.2020.00063"},{"key":"12_CR22","unstructured":"Lafintel: Lafintel, August 2016. https:\/\/lafintel.wordpress.com\/"},{"key":"12_CR23","doi-asserted-by":"crossref","unstructured":"Lemieux, C., Padhye, R., Sen, K., Song, D.: PerfFuzz: automatically generating pathological inputs. In: Proceedings of the 27th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 254\u2013265 (2018)","DOI":"10.1145\/3213846.3213874"},{"key":"12_CR24","doi-asserted-by":"crossref","unstructured":"Lemieux, C., Sen, K.: Fairfuzz: a targeted mutation strategy for increasing greybox fuzz testing coverage. In: Proceedings of the 33rd ACM\/IEEE International Conference on Automated Software Engineering, pp. 475\u2013485 (2018)","DOI":"10.1145\/3238147.3238176"},{"key":"12_CR25","doi-asserted-by":"crossref","unstructured":"Li, Y., Chen, B., Chandramohan, M., Lin, S.W., Liu, Y., Tiu, A.: Steelix: program-state based binary fuzzing. In: Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, pp. 627\u2013637 (2017)","DOI":"10.1145\/3106237.3106295"},{"key":"12_CR26","unstructured":"Lyu, C., Ji, S., Li, Y., Zhou, J., Chen, J., Chen, J.: Smartseed: smart seed generation for efficient fuzzing. arXiv preprint arXiv:1807.02606 (2018)"},{"key":"12_CR27","doi-asserted-by":"crossref","unstructured":"Mathis, B., Gopinath, R., Mera, M., Kampmann, A., H\u00f6schele, M., Zeller, A.: Parser-directed fuzzing. In: Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 548\u2013560 (2019)","DOI":"10.1145\/3314221.3314651"},{"key":"12_CR28","doi-asserted-by":"crossref","unstructured":"Mathis, B., Gopinath, R., Zeller, A.: Learning input tokens for effective fuzzing. In: Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 27\u201337 (2020)","DOI":"10.1145\/3395363.3397348"},{"key":"12_CR29","doi-asserted-by":"crossref","unstructured":"Ognawala, S., Hutzelmann, T., Psallida, E., Pretschner, A.: Improving function coverage with munch: a hybrid fuzzing and directed symbolic execution approach. In: Proceedings of the 33rd Annual ACM Symposium on Applied Computing, pp. 1475\u20131482 (2018)","DOI":"10.1145\/3167132.3167289"},{"key":"12_CR30","doi-asserted-by":"crossref","unstructured":"Padhye, R., Lemieux, C., Sen, K., Papadakis, M., Le\u00a0Traon, Y.: Validity fuzzing and parametric generators for effective random testing. In: 2019 IEEE\/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion), pp. 266\u2013267. IEEE (2019)","DOI":"10.1109\/ICSE-Companion.2019.00107"},{"key":"12_CR31","doi-asserted-by":"crossref","unstructured":"Padhye, R., Lemieux, C., Sen, K., Simon, L., Vijayakumar, H.: Fuzzfactory: domain-specific fuzzing with waypoints. Proc. ACM Program. Lang. 3(OOPSLA), 1\u201329 (2019)","DOI":"10.1145\/3360600"},{"key":"12_CR32","doi-asserted-by":"crossref","unstructured":"Peng, H., Shoshitaishvili, Y., Payer, M.: T-Fuzz: fuzzing by program transformation. In: 2018 IEEE Symposium on Security and Privacy (SP), pp. 697\u2013710. IEEE (2018)","DOI":"10.1109\/SP.2018.00056"},{"key":"12_CR33","doi-asserted-by":"crossref","unstructured":"Petsios, T., Zhao, J., Keromytis, A.D., Jana, S.: Slowfuzz: automated domain-independent detection of algorithmic complexity vulnerabilities. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 2155\u20132168 (2017)","DOI":"10.1145\/3133956.3134073"},{"issue":"9","key":"12_CR34","first-page":"1980","volume":"47","author":"VT Pham","year":"2019","unstructured":"Pham, V.T., B\u00f6hme, M., Santosa, A.E., C\u0103ciulescu, A.R., Roychoudhury, A.: Smart greybox fuzzing. IEEE Trans. Softw. Eng. 47(9), 1980\u20131997 (2019)","journal-title":"IEEE Trans. Softw. Eng."},{"key":"12_CR35","doi-asserted-by":"crossref","unstructured":"Rawat, S., Jain, V., Kumar, A., Cojocar, L., Giuffrida, C., Bos, H.: Vuzzer: application-aware evolutionary fuzzing. In: NDSS, vol.\u00a017, pp. 1\u201314 (2017)","DOI":"10.14722\/ndss.2017.23404"},{"key":"12_CR36","unstructured":"Rebert, A., et al.: Optimizing seed selection for fuzzing. In: 23rd USENIX Security Symposium (USENIX Security 14), pp. 861\u2013875 (2014)"},{"key":"12_CR37","unstructured":"Schumilo, S., Aschermann, C., Gawlik, R., Schinzel, S., Holz, T.: $$kAFL$$: hardware-assisted feedback fuzzing for $$OS$$ kernels. In: 26th USENIX Security Symposium (USENIX Security 17), pp. 167\u2013182 (2017)"},{"key":"12_CR38","doi-asserted-by":"crossref","unstructured":"Shoshitaishvili, Y., et al.: Rise of the HaCRS: augmenting autonomous cyber reasoning systems with human assistance. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 347\u2013362 (2017)","DOI":"10.1145\/3133956.3134105"},{"key":"12_CR39","doi-asserted-by":"crossref","unstructured":"Stephens, N., et al.: Driller: augmenting fuzzing through selective symbolic execution. In: NDSS, vol. 16, pp. 1\u201316 (2016)","DOI":"10.14722\/ndss.2016.23368"},{"key":"12_CR40","doi-asserted-by":"crossref","unstructured":"Wang, M., et al.: SAFL: increasing and accelerating testing coverage with symbolic execution and guided fuzzing. In: Proceedings of the 40th International Conference on Software Engineering: Companion Proceeedings, pp. 61\u201364 (2018)","DOI":"10.1145\/3183440.3183494"},{"key":"12_CR41","doi-asserted-by":"publisher","unstructured":"Wang, Y., et al.: Not all coverage measurements are equal: fuzzing by coverage accounting for input prioritization. In: Network and Distributed System Security Symposium (2020). https:\/\/doi.org\/10.14722\/ndss.2020.24422","DOI":"10.14722\/ndss.2020.24422"},{"key":"12_CR42","doi-asserted-by":"crossref","unstructured":"Wang, Y., et al.: Not all coverage measurements are equal: fuzzing by coverage accounting for input prioritization. In: NDSS (2020)","DOI":"10.14722\/ndss.2020.24422"},{"key":"12_CR43","doi-asserted-by":"publisher","first-page":"36340","DOI":"10.1109\/ACCESS.2019.2903291","volume":"7","author":"Y Wang","year":"2019","unstructured":"Wang, Y., Wu, Z., Wei, Q., Wang, Q.: Neufuzz: efficient fuzzing with deep neural network. IEEE Access 7, 36340\u201336352 (2019)","journal-title":"IEEE Access"},{"key":"12_CR44","doi-asserted-by":"crossref","unstructured":"Woo, M., Cha, S.K., Gottlieb, S., Brumley, D.: Scheduling black-box mutational fuzzing. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, pp. 511\u2013522 (2013)","DOI":"10.1145\/2508859.2516736"},{"key":"12_CR45","unstructured":"Yun, I., Lee, S., Xu, M., Jang, Y., Kim, T.: $$QSYM$$: a practical concolic execution engine tailored for hybrid fuzzing. In: 27th $$USENIX$$ Security Symposium ($$USENIX$$ Security 18), pp. 745\u2013761 (2018)"},{"key":"12_CR46","unstructured":"Zalewski, M.: American fuzzy lop (2.52b). https:\/\/lcamtuf.coredump.cx\/afl\/. Accessed 26 Oct 2021"},{"key":"12_CR47","doi-asserted-by":"crossref","unstructured":"Zhang, B., Ye, J., Feng, C., Tang, C.: S2F: discover hard-to-reach vulnerabilities by semi-symbolic fuzz testing. In: 2017 13th International Conference on Computational Intelligence and Security (CIS), pp. 548\u2013552. IEEE (2017)","DOI":"10.1109\/CIS.2017.00127"},{"key":"12_CR48","doi-asserted-by":"crossref","unstructured":"Zhang, L., Thing, V.L.: A hybrid symbolic execution assisted fuzzing method. In: TENCON 2017-2017 IEEE Region 10 Conference, pp. 822\u2013825. IEEE (2017)","DOI":"10.1109\/TENCON.2017.8227972"},{"key":"12_CR49","doi-asserted-by":"crossref","unstructured":"Zhao, L., Duan, Y., Yin, H., Xuan, J.: Send hardest problems my way: probabilistic path prioritization for hybrid fuzzing. In: NDSS (2019)","DOI":"10.14722\/ndss.2019.23504"},{"key":"12_CR50","unstructured":"Zhou, S., et al.: Ferry: state-aware symbolic execution for exploring state-dependent program paths, pp. 4365\u20134382 (2022)"}],"container-title":["Lecture Notes in Computer Science","Detection of Intrusions and Malware, and Vulnerability Assessment"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-64171-8_12","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,10]],"date-time":"2024-07-10T11:10:37Z","timestamp":1720609837000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-64171-8_12"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"ISBN":["9783031641701","9783031641718"],"references-count":50,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-64171-8_12","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]},"assertion":[{"value":"9 July 2024","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"DIMVA","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Lausanne","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Switzerland","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2024","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"17 July 2024","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19 July 2024","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"dimva2024","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/dimva.org\/dimva2024\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}