{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T05:05:24Z","timestamp":1750309524906,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":38,"publisher":"ACM","license":[{"start":{"date-parts":[[2025,6,11]],"date-time":"2025-06-11T00:00:00Z","timestamp":1749600000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"NextGenEU NRRP MUR - PNRR M4.C2.1.1 PRIN 2022","award":["202225BZJC - CUP D53D23008380006"],"award-info":[{"award-number":["202225BZJC - CUP D53D23008380006"]}]},{"name":"NextGenEU NRRP MUR - PNRR M4.C2.1.1 PRIN 2022 PNRR","award":["P202233M9Z - CUP B53D23026000001"],"award-info":[{"award-number":["P202233M9Z - CUP B53D23026000001"]}]},{"name":"European Union?s Horizon research and innovation programme","award":["101189899"],"award-info":[{"award-number":["101189899"]}]},{"name":"Swiss National Science Foundation","award":["200429","10001777"],"award-info":[{"award-number":["200429","10001777"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,6,25]]},"DOI":"10.1145\/3713081.3731721","type":"proceedings-article","created":{"date-parts":[[2025,6,6]],"date-time":"2025-06-06T17:20:36Z","timestamp":1749230436000},"page":"92-97","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Hybrid Fuzzing of Infrastructure as Code Programs (Short Paper)"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8094-871X","authenticated-orcid":false,"given":"Emilio","family":"Coppa","sequence":"first","affiliation":[{"name":"LUISS University, Rome, Italy"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2911-8304","authenticated-orcid":false,"given":"Daniel","family":"Sokolowski","sequence":"additional","affiliation":[{"name":"Independent Researcher, Frankfurt a.M., Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9324-8894","authenticated-orcid":false,"given":"Guido","family":"Salvaneschi","sequence":"additional","affiliation":[{"name":"University of St. Gallen, St.Gallen, Switzerland, Switzerland"}]}],"member":"320","published-online":{"date-parts":[[2025,6,11]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Amazon Web Services. [n. d.]. Cloud Development Framework: AWS Cloud Dev. Kit. https:\/\/aws.amazon.com\/cdk\/."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Cornelius Aschermann Sergej Schumilo Tim Blazytko Robert Gawlik and Thorsten Holz. 2019. REDQUEEN: Fuzzing with Input-to-State Correspondence. In 26th Annual Network and Distributed System Security Symposium NDSS. https:\/\/www.ndss-symposium.org\/ndss-paper\/redqueen-fuzzing-with-input-to-state-correspondence\/","DOI":"10.14722\/ndss.2019.23371"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3182657"},{"key":"e_1_3_2_1_4_1","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Blazytko Tim","year":"2019","unstructured":"Tim Blazytko, Cornelius Aschermann, Moritz Schl\u00f6gel, Ali Abbasi, Sergej Schumilo, Simon W\u00f6rner, and Thorsten Holz. 2019. GRIMOIRE: Synthesizing Structure while Fuzzing. In 28th USENIX Security Symposium (USENIX Security 19). https:\/\/www.usenix.org\/system\/files\/sec19-blazytko.pdf"},{"key":"e_1_3_2_1_5_1","volume-title":"Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation (OSDI'08)","author":"Cadar Cristian","year":"2008","unstructured":"Cristian Cadar, Daniel Dunbar, and Dawson Engler. 2008. KLEE: Unassisted and Automatic Generation of High-coverage Tests for Complex Systems Programs. In Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation (OSDI'08). 209\u2013224. http:\/\/dl.acm.org\/citation.cfm?id=1855741.1855756"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-81685-8_36"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-10769-6_17"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSREW.2018.00-19"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSA-C54293.2022.00049"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3051492"},{"key":"e_1_3_2_1_11_1","volume-title":"14th USENIX Workshop on Offensive Technologies (WOOT 20)","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Dominik Maier, Heiko Ei\u00dffeldt, and Marc Heuse. 2020. AFL++ : Combining Incremental Steps of Fuzzing Research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20). USENIX Association. https:\/\/www.usenix.org\/conference\/woot20\/presentation\/fioraldi"},{"key":"e_1_3_2_1_12_1","unstructured":"Google. 2019. Google OSS-Fuzz: continuous fuzzing of open source software. https:\/\/github.com\/google\/oss-fuzz."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2019.00092"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/2983990.2984000"},{"key":"e_1_3_2_1_15_1","unstructured":"HashiCorp. [n. d.]. CDK for Terraform. https:\/\/developer.hashicorp.com\/terraform\/cdktf. Accessed: 2024-01-15."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-45065-5_19"},{"key":"e_1_3_2_1_17_1","unstructured":"Patrick Tser Jern Kon Jiachen Liu Yiming Qiu Weijun Fan Ting He Lei Lin Haoran Zhang Owen M. Park George S. Elengikal Yuxin Kang Ang Chen Mosharaf Chowdhury Myungjin Lee and Xinyu Wang. 2024. IaC-Eval: A Code Generation Benchmark for Cloud Infrastructure-as-Code Programs. In Advances in Neural Inf. Processing Systems."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-72013-1_6"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3092282.3092295"},{"volume-title":"Infrastructure as Code: Dynamic Systems for the Cloud Age","author":"Morris Kief","key":"e_1_3_2_1_20_1","unstructured":"Kief Morris. 2021. Infrastructure as Code: Dynamic Systems for the Cloud Age (second ed.). O'Reilly Media, Inc., Sebastopol, CA, USA."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00079"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM51674.2020.00032"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1390630.1390635"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","unstructured":"V. Pham M. Boehme A. E. Santosa A. R. Caciulescu and A. Roychoudhury. 2019. Smart Greybox Fuzzing. IEEE Transactions on Software Engineering (2019). 10.1109\/TSE.2019.2941681","DOI":"10.1109\/TSE.2019.2941681"},{"key":"e_1_3_2_1_25_1","volume-title":"Proceedings of the 29th USENIX Security Symposium (USENIX Security 20)","author":"Poeplau Sebastian","year":"2020","unstructured":"Sebastian Poeplau and Aur\u00e9lien Francillon. 2020. Symbolic execution with SymCC: Don't interpret, compile!. In Proceedings of the 29th USENIX Security Symposium (USENIX Security 20). USENIX Association, 181\u2013198. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/poeplau"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"crossref","unstructured":"Saurabh Pujar Luca Buratti Xiaojie Guo Nicolas Dupuis Burn Lewis Sahil Suneja Atin Sood Ganesh Nalawade Matthew Jones Alessandro Morari and Ruchir Puri. 2023. Automated Code generation for Information Technology Tasks in YAML through Large Language Models. arXiv:2305.02783 [cs.SE] https:\/\/arxiv.org\/abs\/2305.02783","DOI":"10.1109\/DAC56929.2023.10247987"},{"key":"e_1_3_2_1_27_1","unstructured":"Pulumi. [n. d.]. Pulumi AI. https:\/\/www.pulumi.com\/ai."},{"key":"e_1_3_2_1_28_1","unstructured":"Pulumi. [n. d.]. Pulumi: Infrastructure as Code in Any Programming Language. https:\/\/github.com\/pulumi\/pulumi. Accessed: 2024-01-15."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2018.12.004"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560419"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2908080.2908083"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2901761"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"crossref","unstructured":"Yan Shoshitaishvili Ruoyu Wang Christopher Salls Nick Stephens Mario Polino Audrey Dutcher John Grosen Siji Feng Christophe Hauser Christopher Kruegel and Giovanni Vigna. 2016. SoK: (State of) The Art of War: Offensive Techniques in Binary Analysis. (2016).","DOI":"10.1109\/SP.2016.17"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3393070"},{"key":"e_1_3_2_1_35_1","unstructured":"Kalahasti Ganesh Srivatsa Sabyasachi Mukhopadhyay Ganesh Katrapati and Manish Shrivastava. 2024. A Survey of using Large Language Models for Generating Infrastructure as Code. arXiv:2404.00227 [cs.SE] https:\/\/arxiv.org\/abs\/2404.00227"},{"key":"e_1_3_2_1_36_1","volume-title":"Fuzzing for Software Security Testing and Quality Assurance","author":"Takanen Ari","unstructured":"Ari Takanen, Jared D. Demott, and Charles Miller. 2018. Fuzzing for Software Security Testing and Quality Assurance (2nd ed.). Artech House, Inc.","edition":"2"},{"key":"e_1_3_2_1_37_1","unstructured":"Micha\u0142 Zalewski. 2019. American Fuzzy Lop. https:\/\/github.com\/Google\/AFL."},{"key":"e_1_3_2_1_38_1","unstructured":"A. Zeller R. Gopinath M. B\u00f6hme G. Fraser and C. Holler. 2019. The Fuzzing Book. https:\/\/www.fuzzingbook.org\/."}],"event":{"name":"ISSTA Companion '25: 34th ACM SIGSOFT International Symposium on Software Testing and Analysis","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"],"location":"Clarion Hotel Trondheim Trondheim Norway","acronym":"ISSTA Companion '25"},"container-title":["Proceedings of the 34th ACM SIGSOFT International Symposium on Software Testing and Analysis"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3713081.3731721","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:09Z","timestamp":1750295889000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3713081.3731721"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,11]]},"references-count":38,"alternative-id":["10.1145\/3713081.3731721","10.1145\/3713081"],"URL":"https:\/\/doi.org\/10.1145\/3713081.3731721","relation":{},"subject":[],"published":{"date-parts":[[2025,6,11]]},"assertion":[{"value":"2025-06-11","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}