{"id":"https://openalex.org/W4417118638","doi":"https://doi.org/10.1109/dsn69566.2026.00024","title":"Psyzkaller: Learning from Historical and On-the-Fly Execution Data for Smarter OS Kernel Fuzzing","display_name":"Psyzkaller: Learning from Historical and On-the-Fly Execution Data for Smarter OS Kernel Fuzzing","publication_year":2026,"publication_date":"2026-06-22","ids":{"openalex":"https://openalex.org/W4417118638","doi":"https://doi.org/10.1109/dsn69566.2026.00024"},"language":"en","primary_location":{"id":"doi:10.1109/dsn69566.2026.00024","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dsn69566.2026.00024","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2510.08918","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5050117790","display_name":"Boyu Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Boyu Liu","raw_affiliation_strings":["University of Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100354659","display_name":"Yang Zhang","orcid":"https://orcid.org/0000-0002-2739-1916"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]},{"id":"https://openalex.org/I4210142167","display_name":"DigitalSpace (United States)","ror":"https://ror.org/04h1th525","country_code":"US","type":"company","lineage":["https://openalex.org/I4210142167"]}],"countries":["CN","US"],"is_corresponding":false,"raw_author_name":"Yang Zhang","raw_affiliation_strings":["Cryptography and Cyberspace Security (Whampoa) Institute,Guangzhou,China","Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cryptography and Cyberspace Security (Whampoa) Institute,Guangzhou,China","institution_ids":["https://openalex.org/I4210142167"]},{"raw_affiliation_string":"Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102718877","display_name":"Liang Cheng","orcid":"https://orcid.org/0000-0001-9627-5284"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liang Cheng","raw_affiliation_strings":["Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115603611","display_name":"Yi Zhang","orcid":"https://orcid.org/0000-0001-6223-4724"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]},{"id":"https://openalex.org/I4210142167","display_name":"DigitalSpace (United States)","ror":"https://ror.org/04h1th525","country_code":"US","type":"company","lineage":["https://openalex.org/I4210142167"]}],"countries":["CN","US"],"is_corresponding":false,"raw_author_name":"Yi Zhang","raw_affiliation_strings":["Cryptography and Cyberspace Security (Whampoa) Institute,Guangzhou,China","Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cryptography and Cyberspace Security (Whampoa) Institute,Guangzhou,China","institution_ids":["https://openalex.org/I4210142167"]},{"raw_affiliation_string":"Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079593916","display_name":"Junjie Fan","orcid":"https://orcid.org/0009-0004-5697-0628"},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junjie Fan","raw_affiliation_strings":["University of Chinese Academy of Sciences,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xiaoshan Sun","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoshan Sun","raw_affiliation_strings":["Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043540160","display_name":"Yu Fu","orcid":"https://orcid.org/0000-0001-8251-2306"},"institutions":[{"id":"https://openalex.org/I4210142167","display_name":"DigitalSpace (United States)","ror":"https://ror.org/04h1th525","country_code":"US","type":"company","lineage":["https://openalex.org/I4210142167"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yu Fu","raw_affiliation_strings":["Cryptography and Cyberspace Security (Whampoa) Institute,Guangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cryptography and Cyberspace Security (Whampoa) Institute,Guangzhou,China","institution_ids":["https://openalex.org/I4210142167"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zhen Li","orcid":null},"institutions":[{"id":"https://openalex.org/I119203015","display_name":"Shandong University of Technology","ror":"https://ror.org/02mr3ar13","country_code":"CN","type":"education","lineage":["https://openalex.org/I119203015"]},{"id":"https://openalex.org/I4210102264","display_name":"Shandong University of Political Science and Law","ror":"https://ror.org/01b2j5886","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210102264"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhen Li","raw_affiliation_strings":["Shandong University,School of Cyber Science and Technology,Jinan,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Shandong University,School of Cyber Science and Technology,Jinan,China","institution_ids":["https://openalex.org/I119203015","https://openalex.org/I4210102264"]}]},{"author_position":"last","author":{"id":null,"display_name":"Dengguo Feng","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dengguo Feng","raw_affiliation_strings":["Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Software, Chinese Academy of Sciences,TCA Lab,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.03343369,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"96","last_page":"108"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.7567999958992004,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.7567999958992004,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.1014999970793724,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.026100000366568565,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.967199981212616},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.6330000162124634},{"id":"https://openalex.org/keywords/table","display_name":"Table (database)","score":0.47530001401901245},{"id":"https://openalex.org/keywords/linux-kernel","display_name":"Linux kernel","score":0.43619999289512634},{"id":"https://openalex.org/keywords/tree-kernel","display_name":"Tree kernel","score":0.40860000252723694},{"id":"https://openalex.org/keywords/stateful-firewall","display_name":"Stateful firewall","score":0.40389999747276306},{"id":"https://openalex.org/keywords/symbolic-execution","display_name":"Symbolic execution","score":0.4011000096797943},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3799999952316284}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.967199981212616},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8144000172615051},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.6330000162124634},{"id":"https://openalex.org/C45235069","wikidata":"https://www.wikidata.org/wiki/Q278425","display_name":"Table (database)","level":2,"score":0.47530001401901245},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.43619999289512634},{"id":"https://openalex.org/C140417398","wikidata":"https://www.wikidata.org/wiki/Q16933942","display_name":"Tree kernel","level":5,"score":0.40860000252723694},{"id":"https://openalex.org/C22927095","wikidata":"https://www.wikidata.org/wiki/Q1784206","display_name":"Stateful firewall","level":3,"score":0.40389999747276306},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4018000066280365},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.4011000096797943},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3799999952316284},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.34700000286102295},{"id":"https://openalex.org/C106301342","wikidata":"https://www.wikidata.org/wiki/Q4117933","display_name":"Entropy (arrow of time)","level":2,"score":0.3427000045776367},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3319999873638153},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.33169999718666077},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.33070001006126404},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.2976999878883362},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2718999981880188},{"id":"https://openalex.org/C122280245","wikidata":"https://www.wikidata.org/wiki/Q620622","display_name":"Kernel method","level":3,"score":0.2619999945163727},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.2542000114917755},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2515000104904175}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/dsn69566.2026.00024","is_oa":false,"landing_page_url":"https://doi.org/10.1109/dsn69566.2026.00024","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2510.08918","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.08918","pdf_url":"https://arxiv.org/pdf/2510.08918","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:arXiv.org:2510.08918","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2510.08918","pdf_url":"https://arxiv.org/pdf/2510.08918","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2510.08918","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2510.08918","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2510.08918","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.08918","pdf_url":"https://arxiv.org/pdf/2510.08918","source":{"id":"https://openalex.org/S4393918464","display_name":"ArXiv.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"OS":[0],"Kernel":[1],"fuzzers":[2,140],"such":[3,141],"as":[4,142],"Syzkaller":[5],"often":[6],"struggle":[7],"to":[8,29,40,56,65,83],"generate":[9],"syscall":[10],"sequences":[11],"that":[12,22],"respect":[13],"intrinsic":[14],"Syscall":[15],"Dependency":[16],"Relations":[17],"(SDRs),":[18],"resulting":[19],"in":[20,59,94,146],"seeds":[21],"either":[23],"violate":[24],"kernel":[25,45,61,134],"constraints":[26],"or":[27],"fail":[28],"reach":[30],"deep":[31],"execution":[32,46],"paths.":[33],"We":[34,90],"propose":[35],"leveraging":[36],"an":[37],"N-gram":[38],"model":[39],"learn":[41],"SDRs":[42],"from":[43],"both":[44,147],"history":[47],"and":[48,111,129,144,149],"ongoing":[49,115],"fuzzing":[50,116],"results.":[51],"This":[52],"enables":[53],"the":[54,70,85,107],"fuzzer":[55],"capture":[57],"dependencies":[58],"similar":[60],"versions":[62],"while":[63],"adapting":[64],"target-specific":[66],"behaviors,":[67],"thereby":[68],"improving":[69],"validity":[71],"of":[72,87,100],"generated":[73,88],"seeds.":[74,89],"Additionally,":[75],"we":[76],"introduce":[77],"a":[78,95],"bidirectional":[79],"Random":[80],"Walk":[81],"strategy":[82],"enhance":[84],"diversity":[86],"implement":[91],"this":[92],"approach":[93],"prototype,":[96],"Psyzkaller,":[97],"on":[98],"top":[99],"Syzkaller.":[101],"Experiments":[102],"show":[103],"that,":[104],"trained":[105],"with":[106,114],"large-scale":[108],"DongTing":[109],"dataset":[110],"continuously":[112],"updated":[113],"results,":[117],"Psyzkaller":[118,137],"improves":[119],"Syzkaller's":[120],"code":[121],"coverage":[122,148],"by":[123],"4.6%-7.0%,":[124],"triggers":[125],"110.4%-187.2%":[126],"more":[127],"crashes,":[128],"discovers":[130],"eight":[131],"previously":[132],"unknown":[133],"vulnerabilities.":[135],"Furthermore,":[136],"outperforms":[138],"state-of-the-art":[139],"ACTOR":[143],"SyzDescribe":[145],"crashes.":[150]},"counts_by_year":[],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2025-10-14T00:00:00"}