<?xml version="1.0" encoding="utf-8"?>
<export-example>
  <doc>
    <id>5464</id>
    <completedYear/>
    <publishedYear>2018</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst/>
    <pageLast/>
    <pageNumber>2</pageNumber>
    <edition/>
    <issue/>
    <volume/>
    <articleNumber/>
    <type>preprint</type>
    <publisherName>arXiv</publisherName>
    <publisherPlace>Ithaca</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2024-12-12</completedDate>
    <publishedDate>--</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">Reviewing KLEE’s Sonar-Search Strategy in Context of Greybox Fuzzing</title>
    <abstract language="eng">Automatic test-case generation techniques of symbolic execution and fuzzing are the most widely used methods to discover vulnerabilities in, both, academia and industry. However, both these methods suffer from fundamental drawbacks that stop them from achieving high path coverage that may, consequently, lead to discovering vulnerabilities at the numerical scale of static analysis. In this presentation, we examine systems-under-test (SUTs) at the granularity level of functions and postulate that achieving higher function coverage (execution of functions in a program at least once) than, both, symbolic execution and fuzzing may be a necessary condition for discovering more vulnerabilities than both. We will start this presentation with the design of a targeted search strategy for KLEE, sonar-search, that prioritizes paths leading to a target function, rather than maximizing overall path coverage in the program. Then, we will show that examining SUTs at the level of functions (compositional analysis) leads to discovering more vulnerabilities than symbolic execution from a single entry point. Using this finding, we will, then, demonstrate a greybox fuzzing method that can achieve higher function coverage than symbolic execution. Finally, we will present a framework to effectively manage vulnerabilities and assess their severities.</abstract>
    <identifier type="urn">urn:nbn:de:bvb:573-54646</identifier>
    <enrichment key="THI_relatedIdentifier">https://doi.org/10.48550/arXiv.1803.04881</enrichment>
    <enrichment key="THI_review">nein</enrichment>
    <enrichment key="THI_openaccess">ja</enrichment>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">true</enrichment>
    <licence>Creative Commons BY-NC-SA 4.0</licence>
    <author>
      <first_name>Saahil</first_name>
      <last_name>Ognawala</last_name>
    </author>
    <author>
      <first_name>Alexander</first_name>
      <last_name>Pretschner</last_name>
    </author>
    <author>
      <first_name>Thomas</first_name>
      <last_name>Hutzelmann</last_name>
    </author>
    <author>
      <first_name>Eirini</first_name>
      <last_name>Psallida</last_name>
    </author>
    <author>
      <first_name>Ricardo Nales</first_name>
      <last_name>Amato</last_name>
    </author>
    <collection role="open_access" number="">open_access</collection>
    <collection role="persons" number="58221">Hutzelmann, Thomas</collection>
    <thesisPublisher>Technische Hochschule Ingolstadt</thesisPublisher>
    <file>https://opus4.kobv.de/opus4-haw/files/5464/1803.04881v1.pdf</file>
  </doc>
  <doc>
    <id>5443</id>
    <completedYear/>
    <publishedYear>2018</publishedYear>
    <thesisYearAccepted/>
    <language>eng</language>
    <pageFirst>1475</pageFirst>
    <pageLast>1482</pageLast>
    <pageNumber/>
    <edition/>
    <issue/>
    <volume/>
    <articleNumber/>
    <type>conferenceobject</type>
    <publisherName>ACM</publisherName>
    <publisherPlace>New York</publisherPlace>
    <creatingCorporation/>
    <contributingCorporation/>
    <belongsToBibliography>0</belongsToBibliography>
    <completedDate>2024-12-10</completedDate>
    <publishedDate>--</publishedDate>
    <thesisDateAccepted>--</thesisDateAccepted>
    <title language="eng">Improving Function Coverage with Munch: A Hybrid Fuzzing and Directed Symbolic Execution Approach</title>
    <parentTitle language="eng">Proceedings of the 33rd Annual ACM Symposium on Applied Computing</parentTitle>
    <identifier type="isbn">978-1-4503-5191-1</identifier>
    <enrichment key="opus_doi_flag">true</enrichment>
    <enrichment key="opus_import_data">{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,23]],"date-time":"2024-09-23T04:04:25Z","timestamp":1727064265625},"publisher-location":"New York, NY, USA","reference-count":29,"publisher":"ACM","license":[{"start":{"date-parts":[[2018,4,9]],"date-time":"2018-04-09T00:00:00Z","timestamp":1523232000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2018,4,9]]},"DOI":"10.1145\/3167132.3167289","type":"proceedings-article","created":{"date-parts":[[2018,7,3]],"date-time":"2018-07-03T09:54:10Z","timestamp":1530611650000},"page":"1475-1482","update-policy":"http:\/\/dx.doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":29,"title":["Improving function coverage with munch"],"prefix":"10.1145","author":[{"given":"Saahil","family":"Ognawala","sequence":"first","affiliation":[{"name":"Technical University of Munich, Germany"}]},{"given":"Thomas","family":"Hutzelmann","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}]},{"given":"Eirini","family":"Psallida","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}]},{"given":"Alexander","family":"Pretschner","sequence":"additional","affiliation":[{"name":"Technical University of Munich, Germany"}]}],"member":"320","published-online":{"date-parts":[[2018,4,9]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"{n. d.}. AFL Coverage. https:\/\/github.com\/mrash\/afl-cov. ({n. d.}). Accessed: 2017-09-09.  {n. d.}. AFL Coverage. https:\/\/github.com\/mrash\/afl-cov. ({n. d.}). Accessed: 2017-09-09."},{"volume-title":"d.}. AFL Fuzzer","key":"e_1_3_2_1_2_1"},{"volume-title":"d.}. Peach fuzzing platform","key":"e_1_3_2_1_3_1"},{"key":"e_1_3_2_1_4_1","unstructured":"D. Aitel. 2002. An introduction to SPIKE. (2002).  D. Aitel. 2002. An introduction to SPIKE. (2002)."},{"key":"e_1_3_2_1_5_1","unstructured":"S. Anand P. Godefroid and N. Tillmann. 2008. Demand-driven compositional symbolic execution. In TACAS.   S. Anand P. Godefroid and N. Tillmann. 2008. Demand-driven compositional symbolic execution. In TACAS."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991114"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"A. Biere A. Cimatti etal 2003. Bounded model checking. Advances in computers (2003).  A. Biere A. Cimatti et al. 2003. Bounded model checking. Advances in computers (2003).","DOI":"10.1016\/S0065-2458(03)58003-2"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"crossref","unstructured":"K. B\u00f6ttinger and C. Eckert. 2016. DeepFuzz: Triggering Vulnerabilities Deeply Hidden in Binaries. In DIMVA.  K. B\u00f6ttinger and C. Eckert. 2016. DeepFuzz: Triggering Vulnerabilities Deeply Hidden in Binaries. In DIMVA.","DOI":"10.1007\/978-3-319-40667-1_2"},{"volume-title":"KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs.. In OSDI.","year":"2008","author":"Cadar C.","key":"e_1_3_2_1_9_1"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/11537328_2"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2408776.2408795"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-23404-5_19"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"crossref","unstructured":"D. Fangquan D. Chaoqun etal 2015. Binary-oriented hybrid fuzz testing. In ICSESS.  D. Fangquan D. Chaoqun et al. 2015. Binary-oriented hybrid fuzz testing. In ICSESS.","DOI":"10.1109\/ICSESS.2015.7339071"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/1190215.1190226"},{"key":"e_1_3_2_1_15_1","unstructured":"P. Godefroid M. Levin etal 2008. Automated Whitebox Fuzz Testing.. In NDSS.  P. Godefroid M. Levin et al. 2008. Automated Whitebox Fuzz Testing.. In NDSS."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/360248.360252"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2345156.2254088"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"crossref","unstructured":"K. Ma K. Phang etal 2011. Directed symbolic execution. In SAS.   K. Ma K. Phang et al. 2011. Directed symbolic execution. In SAS.","DOI":"10.1007\/978-3-642-23702-7_11"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2007.41"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970281"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970316"},{"key":"e_1_3_2_1_24_1","unstructured":"A. Pretschner. 2001. Classical search strategies for test case generation With Constraint Logic Programming. In Formal Approaches to Testing of Software.  A. Pretschner. 2001. Classical search strategies for test case generation With Constraint Logic Programming. In Formal Approaches to Testing of Software."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"crossref","unstructured":"R. Qiu G. Yang C. S. Pasareanu and S. Khurshid. 2015. Compositional Symbolic Execution with Memoized Replay. In ICSE.   R. Qiu G. Yang C. S. Pasareanu and S. Khurshid. 2015. Compositional Symbolic Execution with Memoized Replay. In ICSE.","DOI":"10.1109\/ICSE.2015.79"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1095430.1081750"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2786805.2786830"},{"volume-title":"Driller: Augmenting fuzzing through selective symbolic execution. In NDSS.","year":"2016","author":"Stephens N.","key":"e_1_3_2_1_28_1"},{"key":"e_1_3_2_1_29_1","unstructured":"M. Sutton A. Greene and P. Amini. 2007. Fuzzing: brute force vulnerability discovery. Pearson Education.   M. Sutton A. Greene and P. Amini. 2007. Fuzzing: brute force vulnerability discovery. Pearson Education."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.37"}],"event":{"name":"SAC 2018: Symposium on Applied Computing","sponsor":["SIGAPP ACM Special Interest Group on Applied Computing"],"location":"Pau France","acronym":"SAC 2018"},"container-title":["Proceedings of the 33rd Annual ACM Symposium on Applied Computing"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3167132.3167289","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,1,11]],"date-time":"2023-01-11T14:31:50Z","timestamp":1673447510000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3167132.3167289"}},"subtitle":["a hybrid fuzzing and directed symbolic execution approach"],"short-title":[],"issued":{"date-parts":[[2018,4,9]]},"references-count":29,"alternative-id":["10.1145\/3167132.3167289","10.1145\/3167132"],"URL":"https:\/\/doi.org\/10.1145\/3167132.3167289","relation":{},"subject":[],"published":{"date-parts":[[2018,4,9]]},"assertion":[{"value":"2018-04-09","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}</enrichment>
    <enrichment key="local_crossrefDocumentType">proceedings-article</enrichment>
    <enrichment key="local_crossrefLicence">http://www.acm.org/publications/policies/copyright_policy#Background</enrichment>
    <enrichment key="local_import_origin">crossref</enrichment>
    <enrichment key="local_doiImportPopulated">PersonAuthorFirstName_1,PersonAuthorLastName_1,PersonAuthorFirstName_2,PersonAuthorLastName_2,PersonAuthorFirstName_3,PersonAuthorLastName_3,PersonAuthorFirstName_4,PersonAuthorLastName_4,Enrichmentconference_title,Enrichmentconference_place,PublisherName,PublisherPlace,TitleMain_1,TitleParent_1,PageNumber,PageFirst,PageLast,CompletedYear,Enrichmentlocal_crossrefLicence</enrichment>
    <enrichment key="conference_title">SAC 2018: Symposium on Applied Computing</enrichment>
    <enrichment key="conference_place">Pau France</enrichment>
    <enrichment key="opus.source">doi-import</enrichment>
    <enrichment key="THI_conferenceName">33rd Annual ACM Symposium on Applied Computing (SAC 2018), Pau (France), 09.-13.04.2018</enrichment>
    <enrichment key="THI_openaccess">nein</enrichment>
    <enrichment key="THI_review">peer-review</enrichment>
    <enrichment key="THI_relatedIdentifier">https://doi.org/10.1145/3167132.3167289</enrichment>
    <enrichment key="opus.doi.autoCreate">false</enrichment>
    <enrichment key="opus.urn.autoCreate">true</enrichment>
    <author>
      <first_name>Saahil</first_name>
      <last_name>Ognawala</last_name>
    </author>
    <author>
      <first_name>Thomas</first_name>
      <last_name>Hutzelmann</last_name>
    </author>
    <author>
      <first_name>Eirini</first_name>
      <last_name>Psallida</last_name>
    </author>
    <author>
      <first_name>Alexander</first_name>
      <last_name>Pretschner</last_name>
    </author>
    <collection role="persons" number="58221">Hutzelmann, Thomas</collection>
  </doc>
</export-example>
