{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,19]],"date-time":"2025-03-19T11:26:19Z","timestamp":1742383579867,"version":"3.37.3"},"reference-count":53,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2023,11,1]],"date-time":"2023-11-01T00:00:00Z","timestamp":1698796800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,11,1]],"date-time":"2023-11-01T00:00:00Z","timestamp":1698796800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,11,1]],"date-time":"2023-11-01T00:00:00Z","timestamp":1698796800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2021YFB2701000"],"award-info":[{"award-number":["2021YFB2701000"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61972224"],"award-info":[{"award-number":["61972224"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100017582","name":"Beijing National Research Center for Information Science and Technology","doi-asserted-by":"crossref","award":["BNR2022RC01006"],"award-info":[{"award-number":["BNR2022RC01006"]}],"id":[{"id":"10.13039\/501100017582","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2023,11]]},"DOI":"10.1109\/tdsc.2022.3191693","type":"journal-article","created":{"date-parts":[[2023,2,16]],"date-time":"2023-02-16T21:13:22Z","timestamp":1676582002000},"page":"5278-5292","source":"Crossref","is-referenced-by-count":2,"title":["TAICHI: Transform Your Secret Exploits Into Mine From a Victim's Perspective"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6506-1328","authenticated-orcid":false,"given":"Zhongyu","family":"Pei","sequence":"first","affiliation":[{"name":"Institute for Network Science and Cyberspace, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7120-9261","authenticated-orcid":false,"given":"Xingman","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5903-8554","authenticated-orcid":false,"given":"Songtao","family":"Yang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0083-733X","authenticated-orcid":false,"given":"Haixin","family":"Duan","sequence":"additional","affiliation":[{"name":"Institute for Network Science and Cyberspace of Tsinghua University, Beijing National Research Center for Information Science and Technology, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7894-8828","authenticated-orcid":false,"given":"Chao","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute for Network Science and Cyberspace of Tsinghua University, Beijing National Research Center for Information Science and Technology, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"article-title":"Data execution prevention: Changes to functionality in Microsoft Windows XP Service Pack 2, Part 3: Memory protection technologies","year":"2004","author":"Andersen","key":"ref1"},{"year":"2003","key":"ref2","article-title":"PaX ASLR (address space layout randomization)"},{"key":"ref3","first-page":"14","article-title":"Smashing the stack for fun and profit","volume":"7","author":"One","year":"1996","journal-title":"Phrack Mag."},{"year":"2019","key":"ref4","article-title":"Hacking team"},{"year":"2017","key":"ref5","article-title":"Shadowbroker"},{"article-title":"American fuzzy lop","year":"2013","author":"Zalewski","key":"ref6"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev.2016.043"},{"key":"ref8","article-title":"Oss-fuzz - Googles continuous fuzzing service for open source software","volume-title":"Proc. USENIX Secur. Symp.","author":"Serebryany","year":"2017"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/2560217.2560219"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243847"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/MSECP.2003.1193207"},{"key":"ref12","first-page":"23","article-title":"Bro: A system for detecting network intruders in real-time","volume-title":"Comput. Netw.","volume":"31","author":"Paxson","year":"1999"},{"key":"ref13","first-page":"229","article-title":"Snort: Lightweight intrusion detection for networks","volume-title":"Lisa","author":"Roesch","year":"1999"},{"year":"2018","key":"ref14","article-title":"DEF CON CTF"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37119-6_17"},{"key":"ref16","first-page":"167","article-title":"Secure and efficient application monitoring and replication","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Volckaert"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2015.2411254"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064178"},{"key":"ref19","first-page":"3","article-title":"Dynamic taint analysis: Automatic detection, analysis, and signature generation of exploit attacks on commodity software","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","volume":"5","author":"Newsome"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.26"},{"key":"ref21","first-page":"745","article-title":"QSYM: A practical concolic execution engine tailored for hybrid fuzzing","volume-title":"Proc. 27th {USENIX} Secur. Symp.","author":"Yun"},{"year":"2016","key":"ref22","article-title":"Angr"},{"key":"ref23","first-page":"63","article-title":"Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks","volume-title":"Proc. USENIX Secur. Symp.","volume":"98","author":"Cowan"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455776"},{"year":"2021","key":"ref25","article-title":"ROPgadget"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1064978.1065034"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-16462-5_12"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/1273463.1273490"},{"year":"2016","key":"ref29","article-title":"cb-multios"},{"year":"2007","key":"ref30","article-title":"Metasploit penetration testing software & framework"},{"year":"2013","key":"ref31","article-title":"CVE-2013\u20132028"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813676"},{"key":"ref33","article-title":"Armv8-a architecture: 2016 additions"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.31"},{"key":"ref35","first-page":"11","article-title":"Heap feng shui in javascript","volume":"2007","author":"Sotirov","year":"2007","journal-title":"Black Hat Europe"},{"key":"ref36","first-page":"781","article-title":"FUZE: Towards facilitating exploit generation for kernel use-after-free vulnerabilities","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Wu"},{"key":"ref37","first-page":"99","article-title":"Heaphopper: Bringing bounded model checking to heap implementation security","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Eckert"},{"key":"ref38","first-page":"763","article-title":"Automatic heap layout manipulation for exploitation","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Heelan"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.67"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2365864.2151042"},{"article-title":"TEMU: Binary code analysis via whole-system layered annotative execution","year":"2010","author":"Yin","key":"ref41"},{"key":"ref42","first-page":"31","article-title":"Triton: A dynamic symbolic execution framework","volume-title":"Proc. Symp. Sur La S\u00e9curit\u00e9 des Technol. de L\u2019Informat. et des Commun.","author":"Saudel"},{"key":"ref43","first-page":"209","article-title":"KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs","volume-title":"Proc. 8th USENIX Conf. Operating Syst. Des. Implementation","author":"Cadar"},{"article-title":"LLVM related publications","year":"2010","author":"Lattner","key":"ref44"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/1961296.1950396"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/2090147.2094081"},{"article-title":"Neuro-symbolic execution: Augmenting symbolic execution with neural constraints","volume-title":"Proc. Netw. Distrib. System Secur. Symp.","author":"Shen","key":"ref47"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/1609956.1609960"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3054924"},{"key":"ref51","first-page":"941","article-title":"Enforcing forward-edge control-flow integrity in GCC & LLVM","volume-title":"Proc. 23rd USENIX Conf. Secur. Symp.","author":"Tice"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.62"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243739"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/10314839\/10043784.pdf?arnumber=10043784","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,13]],"date-time":"2024-02-13T16:29:42Z","timestamp":1707841782000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10043784\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11]]},"references-count":53,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2022.3191693","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"type":"print","value":"1545-5971"},{"type":"electronic","value":"1941-0018"},{"type":"electronic","value":"2160-9209"}],"subject":[],"published":{"date-parts":[[2023,11]]}}}