{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,13]],"date-time":"2026-04-13T14:57:06Z","timestamp":1776092226713,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":41,"publisher":"ACM","license":[{"start":{"date-parts":[[2021,10,6]],"date-time":"2021-10-06T00:00:00Z","timestamp":1633478400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"DARPA\/AFRL\/ASU","award":["FA8750-19-C-0003"],"award-info":[{"award-number":["FA8750-19-C-0003"]}]},{"name":"DARPA\/ONR\/ASU","award":["HR001118C0060"],"award-info":[{"award-number":["HR001118C0060"]}]},{"name":"NSF","award":["CNS-1704253"],"award-info":[{"award-number":["CNS-1704253"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021,10,6]]},"DOI":"10.1145\/3471621.3471865","type":"proceedings-article","created":{"date-parts":[[2021,10,7]],"date-time":"2021-10-07T14:50:46Z","timestamp":1633618246000},"page":"456-468","source":"Crossref","is-referenced-by-count":14,"title":["SyML: Guiding Symbolic Execution Toward Vulnerable States Through Pattern Learning"],"prefix":"10.1145","author":[{"given":"Nicola","family":"Ruaro","sequence":"first","affiliation":[{"name":"UC Santa Barbara, US"}]},{"given":"Kyle","family":"Zeng","sequence":"additional","affiliation":[{"name":"Arizona State University & The Chinese University of Hong Kong, US, China"}]},{"given":"Lukas","family":"Dresel","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, US"}]},{"given":"Mario","family":"Polino","sequence":"additional","affiliation":[{"name":"Politecnico di Milano, Italy"}]},{"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[{"name":"Arizona State University, US"}]},{"given":"Andrea","family":"Continella","sequence":"additional","affiliation":[{"name":"University of Twente, Netherland"}]},{"given":"Stefano","family":"Zanero","sequence":"additional","affiliation":[{"name":"Politecnico di Milano, Italy"}]},{"given":"Christopher","family":"Kruegel","sequence":"additional","affiliation":[{"name":"University of California, Santa Barbara, US"}]},{"given":"Giovanni","family":"Vigna","sequence":"additional","affiliation":[{"name":"UC Santa Barbara, US"}]}],"member":"320","published-online":{"date-parts":[[2021,10,7]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2016. \u201dYour tool works better than mine? Prove it\u201d. https:\/\/blog.trailofbits.com\/2016\/08\/01\/your-tool-works-better-than-mine-prove-it\/  2016. \u201dYour tool works better than mine? Prove it\u201d. https:\/\/blog.trailofbits.com\/2016\/08\/01\/your-tool-works-better-than-mine-prove-it\/"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2560217.2560219"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568293"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/3182657"},{"key":"e_1_3_2_1_5_1","first-page":"46","article-title":"QEMU, a fast and portable dynamic translator. USENIX Annual Technical Conference","volume":"41","author":"Bellard Fabrice","year":"2005","unstructured":"Fabrice Bellard . 2005 . QEMU, a fast and portable dynamic translator. USENIX Annual Technical Conference , FREENIX Track 41 (2005), 46 . Fabrice Bellard. 2005. QEMU, a fast and portable dynamic translator. USENIX Annual Technical Conference, FREENIX Track 41 (2005), 46.","journal-title":"FREENIX Track"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/2008\/10\/P10008"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_27"},{"key":"e_1_3_2_1_8_1","volume-title":"Random forests. Machine learning 45, 1","author":"Breiman Leo","year":"2001","unstructured":"Leo Breiman . 2001. Random forests. Machine learning 45, 1 ( 2001 ), 5\u201332. Leo Breiman. 2001. Random forests. Machine learning 45, 1 (2001), 5\u201332."},{"key":"e_1_3_2_1_9_1","first-page":"209","article-title":". KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs","volume":"8","author":"Cadar Cristian","year":"2008","unstructured":"Cristian Cadar , Daniel Dunbar , Dawson\u00a0 R Engler , 2008 . KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs . OSDI 8 (2008), 209 \u2013 224 . Cristian Cadar, Daniel Dunbar, Dawson\u00a0R Engler, 2008. KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs. OSDI 8(2008), 209\u2013224.","journal-title":"OSDI"},{"key":"e_1_3_2_1_10_1","volume-title":"MEUZZ: Smart Seed Scheduling for Hybrid Fuzzing. arXiv preprint arXiv:2002.08568(2020).","author":"Chen Yaohui","year":"2020","unstructured":"Yaohui Chen , Mansour Ahmadi , Boyu Wang , Long Lu , 2020 . MEUZZ: Smart Seed Scheduling for Hybrid Fuzzing. arXiv preprint arXiv:2002.08568(2020). Yaohui Chen, Mansour Ahmadi, Boyu Wang, Long Lu, 2020. MEUZZ: Smart Seed Scheduling for Hybrid Fuzzing. arXiv preprint arXiv:2002.08568(2020)."},{"key":"e_1_3_2_1_11_1","volume-title":"SAVIOR: Towards Bug-Driven Hybrid Testing. arXiv preprint arXiv:1906.07327(2019).","author":"Chen Yaohui","year":"2019","unstructured":"Yaohui Chen , Peng Li , Jun Xu , Shengjian Guo , Rundong Zhou , Yulong Zhang , Long Lu , 2019 . SAVIOR: Towards Bug-Driven Hybrid Testing. arXiv preprint arXiv:1906.07327(2019). Yaohui Chen, Peng Li, Jun Xu, Shengjian Guo, Rundong Zhou, Yulong Zhang, Long Lu, 2019. SAVIOR: Towards Bug-Driven Hybrid Testing. arXiv preprint arXiv:1906.07327(2019)."},{"key":"e_1_3_2_1_12_1","volume-title":"Proceedings of the 5th Workshop on Hot Topics in System Dependability (HotDep)CONF(2009)","author":"Chipounov Vitaly","year":"2009","unstructured":"Vitaly Chipounov , Vlad Georgescu , Cristian Zamfir , and George Candea . 2009 . Selective Symbolic Execution . Proceedings of the 5th Workshop on Hot Topics in System Dependability (HotDep)CONF(2009) . Vitaly Chipounov, Vlad Georgescu, Cristian Zamfir, and George Candea. 2009. Selective Symbolic Execution. Proceedings of the 5th Workshop on Hot Topics in System Dependability (HotDep)CONF(2009)."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354249"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.15"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2347736.2347755"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1273463.1273464"},{"key":"e_1_3_2_1_17_1","first-page":"151","article-title":". Automated Whitebox Fuzz Testing","volume":"8","author":"Godefroid Patrice","year":"2008","unstructured":"Patrice Godefroid , Michael\u00a0 Y Levin , David\u00a0 A Molnar , 2008 . Automated Whitebox Fuzz Testing . NDSS 8 (2008), 151 \u2013 166 . Patrice Godefroid, Michael\u00a0Y Levin, David\u00a0A Molnar, 2008. Automated Whitebox Fuzz Testing. NDSS 8(2008), 151\u2013166.","journal-title":"NDSS"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/CNS48642.2020.9162164"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00063"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2345156.2254088"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2544173.2509553"},{"key":"e_1_3_2_1_22_1","volume-title":"The defender\u2019s dilemma: Charting a course toward cybersecurity","author":"Libicki C","unstructured":"Martin\u00a0 C Libicki , Lillian Ablon , and Tim Webb . 2015. The defender\u2019s dilemma: Charting a course toward cybersecurity . Rand Corporation . Martin\u00a0C Libicki, Lillian Ablon, and Tim Webb. 2015. The defender\u2019s dilemma: Charting a course toward cybersecurity. Rand Corporation."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1051\/itmconf\/20171203025"},{"key":"e_1_3_2_1_24_1","volume-title":"SAS 2011, Venice, Italy, September 14-16, 2011. Proceedings 6887","author":"Ma Kin-Keung","year":"2011","unstructured":"Kin-Keung Ma , Yit\u00a0Phang Khoo , Jeffrey\u00a0 S. Foster , and Michael Hicks . 2011 . Directed Symbolic Execution. Static Analysis - 18th International Symposium , SAS 2011, Venice, Italy, September 14-16, 2011. Proceedings 6887 (2011), 95\u2013111. https:\/\/doi.org\/10.1007\/978-3-642-23702-7_11 Kin-Keung Ma, Yit\u00a0Phang Khoo, Jeffrey\u00a0S. Foster, and Michael Hicks. 2011. Directed Symbolic Execution. Static Analysis - 18th International Symposium, SAS 2011, Venice, Italy, September 14-16, 2011. Proceedings 6887 (2011), 95\u2013111. https:\/\/doi.org\/10.1007\/978-3-642-23702-7_11"},{"key":"e_1_3_2_1_25_1","volume-title":"2017 USENIX Annual Technical Conference (USENIX ATC 17)","author":"O\u2019Callahan Robert","year":"2017","unstructured":"Robert O\u2019Callahan , Chris Jones , Nathan Froyd , Kyle Huey , Albert Noll , and Nimrod Partush . 2017 . Engineering record and replay for deployability . 2017 USENIX Annual Technical Conference (USENIX ATC 17) (2017), 377\u2013389. Robert O\u2019Callahan, Chris Jones, Nathan Froyd, Kyle Huey, Albert Noll, and Nimrod Partush. 2017. Engineering record and replay for deployability. 2017 USENIX Annual Technical Conference (USENIX ATC 17) (2017), 377\u2013389."},{"key":"e_1_3_2_1_26_1","volume-title":"Hybrid fuzz testing: Discovering software bugs via fuzzing and symbolic execution","author":"Pak S","year":"2012","unstructured":"Brian\u00a0 S Pak . 2012. Hybrid fuzz testing: Discovering software bugs via fuzzing and symbolic execution . School of Computer Science Carnegie Mellon University ( 2012 ). Brian\u00a0S Pak. 2012. Hybrid fuzz testing: Discovering software bugs via fuzzing and symbolic execution. School of Computer Science Carnegie Mellon University (2012)."},{"key":"e_1_3_2_1_27_1","volume-title":"Proceedings of the Annual International Conference on Computer Science and Software Engineering (CASCON)(2016)","author":"Parvez Riyad","year":"2016","unstructured":"Riyad Parvez , Paul A.\u00a0S. Ward , and Vijay Ganesh . 2016 . Combining static analysis and targeted symbolic execution for scalable bug-finding in application binaries . Proceedings of the Annual International Conference on Computer Science and Software Engineering (CASCON)(2016) . http:\/\/dl.acm.org\/citation.cfm?id=3049889 Riyad Parvez, Paul A.\u00a0S. Ward, and Vijay Ganesh. 2016. Combining static analysis and targeted symbolic execution for scalable bug-finding in application binaries. Proceedings of the Annual International Conference on Computer Science and Software Engineering (CASCON)(2016). http:\/\/dl.acm.org\/citation.cfm?id=3049889"},{"key":"e_1_3_2_1_28_1","first-page":"2825","article-title":"Scikit-learn: Machine learning in Python","author":"Pedregosa Fabian","year":"2011","unstructured":"Fabian Pedregosa , Ga\u00ebl Varoquaux , Alexandre Gramfort , Vincent Michel , Bertrand Thirion , Olivier Grisel , Mathieu Blondel , Peter Prettenhofer , Ron Weiss , Vincent Dubourg , 2011 . Scikit-learn: Machine learning in Python . Journal of machine learning research 12 , Oct (2011), 2825 \u2013 2830 . Fabian Pedregosa, Ga\u00ebl Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, 2011. Scikit-learn: Machine learning in Python. Journal of machine learning research 12, Oct (2011), 2825\u20132830.","journal-title":"Journal of machine learning research 12"},{"key":"e_1_3_2_1_29_1","volume-title":"Proceedings of the USENIX Security Symposium","author":"A.","year":"2015","unstructured":"David\u00a0 A. Ramos and Dawson\u00a0R. Engler. 2015. Under-Constrained Symbolic Execution: Correctness Checking for Real Code . Proceedings of the USENIX Security Symposium ( 2015 ). https:\/\/www.usenix.org\/conference\/usenixsecurity15\/technical-sessions\/presentation\/ramos David\u00a0A. Ramos and Dawson\u00a0R. Engler. 2015. Under-Constrained Symbolic Execution: Correctness Checking for Real Code. Proceedings of the USENIX Security Symposium (2015). https:\/\/www.usenix.org\/conference\/usenixsecurity15\/technical-sessions\/presentation\/ramos"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/1572272.1572299"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2015.132"},{"key":"e_1_3_2_1_33_1","first-page":"1","article-title":"Driller: Augmenting Fuzzing Through Selective Symbolic Execution","volume":"16","author":"Stephens Nick","year":"2016","unstructured":"Nick Stephens , John Grosen , Christopher Salls , Andrew Dutcher , Ruoyu Wang , Jacopo Corbetta , Yan Shoshitaishvili , Christopher Kruegel , and Giovanni Vigna . 2016 . Driller: Augmenting Fuzzing Through Selective Symbolic Execution . NDSS 16 (2016), 1 \u2013 16 . Nick Stephens, John Grosen, Christopher Salls, Andrew Dutcher, Ruoyu Wang, Jacopo Corbetta, Yan Shoshitaishvili, Christopher Kruegel, and Giovanni Vigna. 2016. Driller: Augmenting Fuzzing Through Selective Symbolic Execution. NDSS 16(2016), 1\u201316.","journal-title":"NDSS"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180251"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"crossref","unstructured":"Zhongjie Wang Shitong Zhu Yue Cao Zhiyun Qian Cheng-Yu Song S.\u00a0V. Krishnamurthy Kevin\u00a0S. Chan and Tracy\u00a0D. Braun. 2020. SymTCP: Eluding Stateful Deep Packet Inspection with Automated Discrepancy Discovery. (2020).  Zhongjie Wang Shitong Zhu Yue Cao Zhiyun Qian Cheng-Yu Song S.\u00a0V. Krishnamurthy Kevin\u00a0S. Chan and Tracy\u00a0D. Braun. 2020. SymTCP: Eluding Stateful Deep Packet Inspection with Automated Discrepancy Discovery. (2020).","DOI":"10.14722\/ndss.2020.24083"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2009.5270315"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00017"},{"key":"e_1_3_2_1_38_1","volume-title":"Proceedings of the USENIX Security Symposium","author":"Yun Insu","year":"2018","unstructured":"Insu Yun , Sangho Lee , Meng Xu , Yeongjin Jang , and Taesoo Kim . 2018 . QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing . Proceedings of the USENIX Security Symposium (2018). Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. QSYM: A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing. Proceedings of the USENIX Security Symposium (2018)."},{"key":"e_1_3_2_1_39_1","unstructured":"Michal Zalewski. 2014. \u201dAmerican Fuzzy Lop\u201d. https:\/\/lcamtuf.coredump.cx\/afl\/  Michal Zalewski. 2014. \u201dAmerican Fuzzy Lop\u201d. https:\/\/lcamtuf.coredump.cx\/afl\/"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.80"},{"key":"e_1_3_2_1_41_1","volume-title":"Send Hardest Problems My Way: Probabilistic Path Prioritization for Hybrid Fuzzing. 26th Annual Network and Distributed System Security Symposium, NDSS 2019","author":"Zhao Lei","year":"2019","unstructured":"Lei Zhao , Yue Duan , Heng Yin , and Jifeng Xuan . 2019 . Send Hardest Problems My Way: Probabilistic Path Prioritization for Hybrid Fuzzing. 26th Annual Network and Distributed System Security Symposium, NDSS 2019 , San Diego, California, USA , February 24-27, 2019 (2019). Lei Zhao, Yue Duan, Heng Yin, and Jifeng Xuan. 2019. Send Hardest Problems My Way: Probabilistic Path Prioritization for Hybrid Fuzzing. 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019 (2019)."}],"event":{"name":"RAID '21: 24th International Symposium on Research in Attacks, Intrusions and Defenses","location":"San Sebastian Spain","acronym":"RAID '21"},"container-title":["24th International Symposium on Research in Attacks, Intrusions and Defenses"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3471621.3471865","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3471621.3471865","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3471621.3471865","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:24:49Z","timestamp":1750195489000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3471621.3471865"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,10,6]]},"references-count":41,"alternative-id":["10.1145\/3471621.3471865","10.1145\/3471621"],"URL":"https:\/\/doi.org\/10.1145\/3471621.3471865","relation":{},"subject":[],"published":{"date-parts":[[2021,10,6]]}}}