{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,19]],"date-time":"2026-07-19T09:47:27Z","timestamp":1784454447805,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":42,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,5,24]],"date-time":"2021-05-24T00:00:00Z","timestamp":1621814400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Crystal Center at National University of Singapore"},{"name":"National Satellite of Excellence in Trustworthy Software Systems"},{"name":"DSOCL17019 from DSO Singapore"},{"name":"National Research Foundation (NRF) Singapore under National Cybersecurity R&D (NCR) programme"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2021,5,24]]},"DOI":"10.1145\/3433210.3437528","type":"proceedings-article","created":{"date-parts":[[2021,6,4]],"date-time":"2021-06-04T15:26:39Z","timestamp":1622820399000},"page":"537-549","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":22,"title":["Localizing Vulnerabilities Statistically From One Exploit"],"prefix":"10.1145","author":[{"given":"Shiqi","family":"Shen","sequence":"first","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aashish","family":"Kolluri","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhen","family":"Dong","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Prateek","family":"Saxena","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Abhik","family":"Roychoudhury","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2021,6,4]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[n.d.]. Honggfuzz: Security oriented software fuzzer. https:\/\/honggfuzz.dev\/.  [n.d.]. Honggfuzz: Security oriented software fuzzer. https:\/\/honggfuzz.dev\/."},{"key":"e_1_3_2_1_2_1","unstructured":"2019. DynamoRIO: Dynamic Instrumentation Tool Platform. https:\/\/www.dynamorio.org.  2019. DynamoRIO: Dynamic Instrumentation Tool Platform. https:\/\/www.dynamorio.org."},{"key":"e_1_3_2_1_3_1","unstructured":"2019. objdump. https:\/\/linux.die.net\/man\/1\/objdump.  2019. objdump. https:\/\/linux.die.net\/man\/1\/objdump."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1308173.1308264"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"crossref","unstructured":"Hiralal Agrawal and Joseph R Horgan. 1990. Dynamic program slicing. In PLDI.  Hiralal Agrawal and Joseph R Horgan. 1990. Dynamic program slicing. In PLDI.","DOI":"10.1145\/93542.93576"},{"key":"e_1_3_2_1_6_1","volume-title":"Fault localization for automated program repair: effectiveness, performance, repair correctness. Software Quality Journal","author":"Assiri Fatmah","year":"2016","unstructured":"Fatmah Assiri and James Bieman . 2016. Fault localization for automated program repair: effectiveness, performance, repair correctness. Software Quality Journal ( 2016 ). Fatmah Assiri and James Bieman. 2016. Fault localization for automated program repair: effectiveness, performance, repair correctness. Software Quality Journal (2016)."},{"key":"e_1_3_2_1_7_1","volume-title":"AURORA: Statistical Crash Analysis for Automated Root Cause Explanation. In USENIX.","author":"Blazytko Tim","year":"2020","unstructured":"Tim Blazytko , Moritz Schl\u00f6gel , Cornelius Aschermann , Ali Abbasi , Joel Frank , Simon W\u00f6rner , and Thorsten Holz . 2020 . AURORA: Statistical Crash Analysis for Automated Root Cause Explanation. In USENIX. Tim Blazytko, Moritz Schl\u00f6gel, Cornelius Aschermann, Ali Abbasi, Joel Frank, Simon W\u00f6rner, and Thorsten Holz. 2020. AURORA: Statistical Crash Analysis for Automated Root Cause Explanation. In USENIX."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"crossref","unstructured":"Marcel B\u00f6hme Van-Thuan Pham Manh-Dung Nguyen and Abhik Roychoudhury. 2017. Directed greybox fuzzing. In CCS.  Marcel B\u00f6hme Van-Thuan Pham Manh-Dung Nguyen and Abhik Roychoudhury. 2017. Directed greybox fuzzing. In CCS.","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"crossref","unstructured":"Satish Chandra Emina Torlak Shaon Barman and Rastislav Bodik. 2011. Angelic Debugging. In ICSE.  Satish Chandra Emina Torlak Shaon Barman and Rastislav Bodik. 2011. Angelic Debugging. In ICSE.","DOI":"10.1145\/1985793.1985811"},{"key":"e_1_3_2_1_10_1","unstructured":"Zheng Leong Chua Yanhao Wang Teodora Baluta Prateek Saxena Zhenkai Liang and Purui Su. 2019. One Engine To Serve'em All: Inferring Taint Rules Without Architectural Semantics.. In NDSS.  Zheng Leong Chua Yanhao Wang Teodora Baluta Prateek Saxena Zhenkai Liang and Purui Su. 2019. One Engine To Serve'em All: Inferring Taint Rules Without Architectural Semantics.. In NDSS."},{"key":"e_1_3_2_1_11_1","volume-title":"REPT: Reverse Debugging of Failures in Deployed Software. In OSDI.","author":"Cui Weidong","year":"2018","unstructured":"Weidong Cui , Xinyang Ge , Baris Kasikci , Ben Niu , Upamanyu Sharma , Ruoyu Wang , and Insu Yun . 2018 . REPT: Reverse Debugging of Failures in Deployed Software. In OSDI. Weidong Cui, Xinyang Ge, Baris Kasikci, Ben Niu, Upamanyu Sharma, Ruoyu Wang, and Insu Yun. 2018. REPT: Reverse Debugging of Failures in Deployed Software. In OSDI."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-32759-9_17"},{"key":"e_1_3_2_1_13_1","volume-title":"GREYONE: Data Flow Sensitive Fuzzing.","author":"Gan Shuitao","year":"2020","unstructured":"Shuitao Gan , Chao Zhang , Peng Chen , Bodong Zhao , Xiaojun Qin , Dong Wu , and Zuoning Chen . 2020 . GREYONE: Data Flow Sensitive Fuzzing. (2020). Shuitao Gan, Chao Zhang, Peng Chen, Bodong Zhao, Xiaojun Qin, Dong Wu, and Zuoning Chen. 2020. GREYONE: Data Flow Sensitive Fuzzing. (2020)."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3418461"},{"key":"e_1_3_2_1_15_1","volume-title":"Talos: Neutralizing vulnerabilities with security workarounds for rapid response. In S&P.","author":"Huang Zhen","year":"2016","unstructured":"Zhen Huang , Mariana D Angelo , Dhaval Miyani , and David Lie . 2016 . Talos: Neutralizing vulnerabilities with security workarounds for rapid response. In S&P. Zhen Huang, Mariana DAngelo, Dhaval Miyani, and David Lie. 2016. Talos: Neutralizing vulnerabilities with security workarounds for rapid response. In S&P."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"crossref","unstructured":"Zhen Huang David Lie Gang Tan and Trent Jaeger. 2019. Using Safety Properties to Generate Vulnerability Patches. In S&P.  Zhen Huang David Lie Gang Tan and Trent Jaeger. 2019. Using Safety Properties to Generate Vulnerability Patches. In S&P.","DOI":"10.1109\/SP.2019.00071"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"crossref","unstructured":"Wei Jin and Alessandro Orso. 2012. BugRedux: reproducing field failures for in-house debugging. In ICSE.  Wei Jin and Alessandro Orso. 2012. BugRedux: reproducing field failures for in-house debugging. In ICSE.","DOI":"10.1109\/ICSE.2012.6227168"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"crossref","unstructured":"Wei Jin and Alessandro Orso. 2013. F3: fault localization for field failures. In ISSTA.  Wei Jin and Alessandro Orso. 2013. F3: fault localization for field failures. In ISSTA.","DOI":"10.1145\/2483760.2483763"},{"key":"e_1_3_2_1_19_1","volume-title":"Mary Jean Harrold, and John Stasko","author":"Jones James A","year":"2002","unstructured":"James A Jones , Mary Jean Harrold, and John Stasko . 2002 . Visualization of test information to assist fault localization. In ICSE. James A Jones, Mary Jean Harrold, and John Stasko. 2002. Visualization of test information to assist fault localization. In ICSE."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"crossref","unstructured":"Manu Jose and Rupak Majumdar. 2011. Cause clue clauses: error localization using maximum satisfiability. In PLDI.  Manu Jose and Rupak Majumdar. 2011. Cause clue clauses: error localization using maximum satisfiability. In PLDI.","DOI":"10.1145\/1993498.1993550"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"crossref","unstructured":"Samuel T King and Peter M Chen. 2003. Backtracking intrusions. In SOSP.  Samuel T King and Peter M Chen. 2003. Backtracking intrusions. In SOSP.","DOI":"10.1145\/945445.945467"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Pavneet Singh Kochhar Xin Xia David Lo and Shanping Li. 2016. Practitioners' expectations on automated fault localization. In ISSTA.  Pavneet Singh Kochhar Xin Xia David Lo and Shanping Li. 2016. Practitioners' expectations on automated fault localization. In ISSTA.","DOI":"10.1145\/2931037.2931051"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3318162"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"crossref","unstructured":"Xia Li Wei Li Yuqun Zhang and Lingming Zhang. 2019. DeepFL: integrating multiple fault diagnosis dimensions for deep fault localization. In ISSTA.  Xia Li Wei Li Yuqun Zhang and Lingming Zhang. 2019. DeepFL: integrating multiple fault diagnosis dimensions for deep fault localization. In ISSTA.","DOI":"10.1145\/3293882.3330574"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"crossref","unstructured":"Zhenkai Liang and R. Sekar. 2005. Fast and automated generation of attack signatures: a basis for building self-protecting servers. In CCS.  Zhenkai Liang and R. Sekar. 2005. Fast and automated generation of attack signatures: a basis for building self-protecting servers. In CCS.","DOI":"10.1145\/1102120.1102150"},{"key":"e_1_3_2_1_26_1","unstructured":"LibTIFF. [n.d.]. an open source implementaiton on github. https:\/\/github.com\/vadz\/libtiff.  LibTIFF. [n.d.]. an open source implementaiton on github. https:\/\/github.com\/vadz\/libtiff."},{"key":"e_1_3_2_1_27_1","unstructured":"James Newsome and Dawn Xiaodong Song. 2005. Dynamic Taint Analysis for Automatic Detection Analysis and SignatureGeneration of Exploits on Commodity Software.. In NDSS.  James Newsome and Dawn Xiaodong Song. 2005. Dynamic Taint Analysis for Automatic Detection Analysis and SignatureGeneration of Exploits on Commodity Software.. In NDSS."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"crossref","unstructured":"Carlos Pacheco Shuvendu K Lahiri Michael D Ernst and Thomas Ball. 2007. Feedback-directed random test generation. In ICSE.  Carlos Pacheco Shuvendu K Lahiri Michael D Ernst and Thomas Ball. 2007. Feedback-directed random test generation. In ICSE.","DOI":"10.1109\/ICSE.2007.37"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"crossref","unstructured":"Spencer Pearson Jos\u00e9 Campos Ren\u00e9 Just Gordon Fraser Rui Abreu Michael D Ernst Deric Pang and Benjamin Keller. 2017. Evaluating and improving fault localization. In ICSE.  Spencer Pearson Jos\u00e9 Campos Ren\u00e9 Just Gordon Fraser Rui Abreu Michael D Ernst Deric Pang and Benjamin Keller. 2017. Evaluating and improving fault localization. In ICSE.","DOI":"10.1109\/ICSE.2017.62"},{"key":"e_1_3_2_1_30_1","volume-title":"Darwin: An approach to debugging evolving programs. TOSEM","author":"Qi Dawei","year":"2012","unstructured":"Dawei Qi , Abhik Roychoudhury , Zhenkai Liang , and Kapil Vaswani . 2012 . Darwin: An approach to debugging evolving programs. TOSEM (2012). Dawei Qi, Abhik Roychoudhury, Zhenkai Liang, and Kapil Vaswani. 2012. Darwin: An approach to debugging evolving programs. TOSEM (2012)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"crossref","unstructured":"Jeremias R\u00f6\u03b2ler Gordon Fraser Andreas Zeller and Alessandro Orso. 2012. Isolating failure causes through test case generation. In ISSTA.  Jeremias R\u00f6\u03b2ler Gordon Fraser Andreas Zeller and Alessandro Orso. 2012. Isolating failure causes through test case generation. In ISSTA.","DOI":"10.1145\/2338965.2336790"},{"key":"e_1_3_2_1_32_1","unstructured":"Cliff Saran. 2018. Security professionals admit pais getting harder. https:\/\/www.computerweekly.com\/news\/252438578\/Security-professionals-admit-patching-is-getting-harder.  Cliff Saran. 2018. Security professionals admit pais getting harder. https:\/\/www.computerweekly.com\/news\/252438578\/Security-professionals-admit-patching-is-getting-harder."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"crossref","unstructured":"E. J. Schwartz T. Avgerinos and D. Brumley. 2010. All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask). In S&P.  E. J. Schwartz T. Avgerinos and D. Brumley. 2010. All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask). In S&P.","DOI":"10.1109\/SP.2010.26"},{"key":"e_1_3_2_1_34_1","unstructured":"Kelly Sheridan. 2018. It Takes an Average 38 Days to Patch a Vulnerability. https:\/\/www.darkreading.com\/cloud\/it-takes-an-average-38-days-to-patch-a-vulnerability\/d\/d-id\/1332638.  Kelly Sheridan. 2018. It Takes an Average 38 Days to Patch a Vulnerability. https:\/\/www.darkreading.com\/cloud\/it-takes-an-average-38-days-to-patch-a-vulnerability\/d\/d-id\/1332638."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"crossref","unstructured":"Nikolai Tillmann and Jonathan De Halleux. 2008. Pex--white box test generation for. net. In TAP.  Nikolai Tillmann and Jonathan De Halleux. 2008. Pex--white box test generation for. net. In TAP.","DOI":"10.1007\/978-3-540-79124-9_10"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"crossref","unstructured":"Tao Wang and Abhik Roychoudhury. 2005. Automated path generation for software fault localization. In ASE.  Tao Wang and Abhik Roychoudhury. 2005. Automated path generation for software fault localization. In ASE.","DOI":"10.1145\/1101908.1101966"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"crossref","unstructured":"Tielei Wang Chengyu Song and Wenke Lee. 2014. Diagnosis and emergency patch generation for integer overflow exploits. In DIMVA.  Tielei Wang Chengyu Song and Wenke Lee. 2014. Diagnosis and emergency patch generation for integer overflow exploits. In DIMVA.","DOI":"10.1007\/978-3-319-08509-8_14"},{"key":"e_1_3_2_1_38_1","volume-title":"A survey on software fault localization. TSE","author":"Wong W Eric","year":"2016","unstructured":"W Eric Wong , Ruizhi Gao , Yihao Li , Rui Abreu , and Franz Wotawa . 2016. A survey on software fault localization. TSE ( 2016 ). W Eric Wong, Ruizhi Gao, Yihao Li, Rui Abreu, and Franz Wotawa. 2016. A survey on software fault localization. TSE (2016)."},{"key":"e_1_3_2_1_39_1","unstructured":"Michal Zalewski. [n.d.]. american fuzzy lop. https:\/\/github.com\/google\/honggfuzz.  Michal Zalewski. [n.d.]. american fuzzy lop. https:\/\/github.com\/google\/honggfuzz."},{"key":"e_1_3_2_1_40_1","volume-title":"Simplifying and isolating failure-inducing input. TSE","author":"Zeller Andreas","year":"2002","unstructured":"Andreas Zeller and Ralf Hildebrandt . 2002. Simplifying and isolating failure-inducing input. TSE ( 2002 ). Andreas Zeller and Ralf Hildebrandt. 2002. Simplifying and isolating failure-inducing input. TSE (2002)."},{"key":"e_1_3_2_1_41_1","unstructured":"Mingwei Zhang Aravind Prakash Xiaolei Li Zhenkai Liang and Heng Yin. 2012. Identifying and analyzing pointer misuses for sophisticated memory-corruption exploit diagnosis. In NDSS.  Mingwei Zhang Aravind Prakash Xiaolei Li Zhenkai Liang and Heng Yin. 2012. Identifying and analyzing pointer misuses for sophisticated memory-corruption exploit diagnosis. In NDSS."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"crossref","unstructured":"Xiangyu Zhang Neelam Gupta and Rajiv Gupta. 2006. Pruning dynamic slices with confidence. In PLDI.  Xiangyu Zhang Neelam Gupta and Rajiv Gupta. 2006. Pruning dynamic slices with confidence. In PLDI.","DOI":"10.1145\/1133981.1134002"}],"event":{"name":"ASIA CCS '21: ACM Asia Conference on Computer and Communications Security","location":"Virtual Event Hong Kong","acronym":"ASIA CCS '21","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3433210.3437528","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3433210.3437528","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T20:48:11Z","timestamp":1750193291000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3433210.3437528"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,5,24]]},"references-count":42,"alternative-id":["10.1145\/3433210.3437528","10.1145\/3433210"],"URL":"https:\/\/doi.org\/10.1145\/3433210.3437528","relation":{},"subject":[],"published":{"date-parts":[[2021,5,24]]},"assertion":[{"value":"2021-06-04","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}