{"id":"https://openalex.org/W3162301386","doi":"https://doi.org/10.1109/tdsc.2021.3079857","title":"Unleashing Coveraged-Based Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing","display_name":"Unleashing Coveraged-Based Fuzzing Through Comprehensive, Efficient, and Faithful Exploitable-Bug Exposing","publication_year":2021,"publication_date":"2021-05-13","ids":{"openalex":"https://openalex.org/W3162301386","doi":"https://doi.org/10.1109/tdsc.2021.3079857","mag":"3162301386"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2021.3079857","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2021.3079857","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100412541","display_name":"Bowen Wang","orcid":"https://orcid.org/0000-0002-0479-3189"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bowen Wang","raw_affiliation_strings":["University of Minnesota, Minneapolis, MN, USA"],"raw_orcid":"https://orcid.org/0000-0002-0479-3189","affiliations":[{"raw_affiliation_string":"University of Minnesota, Minneapolis, MN, USA","institution_ids":["https://openalex.org/I130238516"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043198742","display_name":"Kangjie Lu","orcid":"https://orcid.org/0000-0002-4763-7354"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kangjie Lu","raw_affiliation_strings":["University of Minnesota, Minneapolis, MN, USA"],"raw_orcid":"https://orcid.org/0000-0002-4763-7354","affiliations":[{"raw_affiliation_string":"University of Minnesota, Minneapolis, MN, USA","institution_ids":["https://openalex.org/I130238516"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082177069","display_name":"Qiushi Wu","orcid":"https://orcid.org/0009-0001-9251-9760"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qiushi Wu","raw_affiliation_strings":["University of Minnesota, Minneapolis, MN, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Minnesota, Minneapolis, MN, USA","institution_ids":["https://openalex.org/I130238516"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5075194516","display_name":"Aditya Pakki","orcid":"https://orcid.org/0000-0003-4704-2606"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Aditya Pakki","raw_affiliation_strings":["University of Minnesota, Minneapolis, MN, USA"],"raw_orcid":"https://orcid.org/0000-0003-4704-2606","affiliations":[{"raw_affiliation_string":"University of Minnesota, Minneapolis, MN, USA","institution_ids":["https://openalex.org/I130238516"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I130238516"],"apc_list":null,"apc_paid":null,"fwci":1.266,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.79267974,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":96},"biblio":{"volume":"19","issue":"5","first_page":"2998","last_page":"3010"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11005","display_name":"Radiation Effects in Electronics","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9969000220298767,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9156396389007568},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7950544357299805},{"id":"https://openalex.org/keywords/software-bug","display_name":"Software bug","score":0.5411128401756287},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.46865740418434143},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.4605966806411743},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.38733088970184326},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3120523691177368}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9156396389007568},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7950544357299805},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.5411128401756287},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.46865740418434143},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.4605966806411743},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.38733088970184326},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3120523691177368}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2021.3079857","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2021.3079857","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7504357125","display_name":null,"funder_award_id":"CNS-1815621","funder_id":"https://openalex.org/F4320335353","funder_display_name":"National Science Foundation of Sri Lanka"},{"id":"https://openalex.org/G8670239156","display_name":null,"funder_award_id":"CNS-1931208","funder_id":"https://openalex.org/F4320335353","funder_display_name":"National Science Foundation of Sri Lanka"}],"funders":[{"id":"https://openalex.org/F4320335353","display_name":"National Science Foundation of Sri Lanka","ror":"https://ror.org/010xaa060"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":46,"referenced_works":["https://openalex.org/W995370299","https://openalex.org/W1504083933","https://openalex.org/W1976919795","https://openalex.org/W2051990174","https://openalex.org/W2054426341","https://openalex.org/W2081105932","https://openalex.org/W2086277109","https://openalex.org/W2099813257","https://openalex.org/W2111817346","https://openalex.org/W2113864883","https://openalex.org/W2132523160","https://openalex.org/W2135200607","https://openalex.org/W2155877593","https://openalex.org/W2414287720","https://openalex.org/W2512784977","https://openalex.org/W2515236103","https://openalex.org/W2528894473","https://openalex.org/W2574017551","https://openalex.org/W2613534458","https://openalex.org/W2701082322","https://openalex.org/W2766540688","https://openalex.org/W2766898821","https://openalex.org/W2794670092","https://openalex.org/W2795192879","https://openalex.org/W2805359884","https://openalex.org/W2897668282","https://openalex.org/W2934715626","https://openalex.org/W2963934162","https://openalex.org/W2964097210","https://openalex.org/W2984796174","https://openalex.org/W2985831349","https://openalex.org/W3015365135","https://openalex.org/W3018471263","https://openalex.org/W3138733102","https://openalex.org/W4239035626","https://openalex.org/W4240590466","https://openalex.org/W6600040955","https://openalex.org/W6628302897","https://openalex.org/W6639560864","https://openalex.org/W6677689127","https://openalex.org/W6695414191","https://openalex.org/W6713944283","https://openalex.org/W6753913213","https://openalex.org/W6754182100","https://openalex.org/W6754597693","https://openalex.org/W6766204418"],"related_works":["https://openalex.org/W614438062","https://openalex.org/W3173990398","https://openalex.org/W4381785649","https://openalex.org/W4205454537","https://openalex.org/W4226494072","https://openalex.org/W4385301282","https://openalex.org/W3170526652","https://openalex.org/W3105061167","https://openalex.org/W2942625968","https://openalex.org/W4287849816"],"abstract_inverted_index":{"Fuzzing":[0],"has":[1,32,64],"become":[2],"an":[3],"essential":[4],"means":[5],"of":[6,119,169,176],"finding":[7,11],"software":[8],"bugs.":[9,43,59],"Bug":[10],"through":[12,127],"fuzzing":[13,30,107],"requires":[14],"two":[15],"parts\u2014exploring":[16],"code":[17,37],"paths":[18],"to":[19,124,165,210],"reach":[20],"bugs":[21,24,91,112,126],"and":[22,49,88,115,148,156,161,207],"exposing":[23,42,58,63],"when":[25],"they":[26],"are":[27,70],"reached.":[28],"Existing":[29],"research":[31],"primarily":[33],"focused":[34],"on":[35,41],"improving":[36],"coverage":[38],"but":[39,190],"not":[40,71,93,137,185],"Sanitizers":[44],"such":[45],"as":[46],"AddressSanitizer":[47],"(ASAN)":[48],"MemorySanitizer":[50,206],"(MSAN)":[51],"have":[52],"been":[53],"the":[54,65,167],"dominating":[55],"tools":[56],"for":[57,154],"However,":[60],"sanitizer-based":[61],"bug":[62],"following":[66],"limitations.":[67],"(1)":[68],"sanitizers":[69,77,83],"compatible":[72],"with":[73],"each":[74],"other.":[75],"(2)":[76],"incur":[78],"significant":[79],"runtime":[80],"overhead.":[81],"(3)":[82],"may":[84,92],"generate":[85],"false":[86],"positives,":[87],"(4)":[89],"exposed":[90],"be":[94],"exploitable.":[95],"To":[96],"address":[97],"these":[98],"limitations,":[99],"we":[100],"propose":[101],"<sc":[102,120,170,180,198],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[103,121,171,181,199],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">Expozzer</small>":[104,122,172,182,200],",":[105],"a":[106,130,146,152],"system":[108],"that":[109,179],"can":[110,183],"expose":[111],"comprehensively,":[113],"efficiently,":[114],"faithfully.":[116],"The":[117,174],"intuition":[118],"is":[123,201,208],"detect":[125,184],"divergences":[128],"in":[129,194],"properly":[131],"diversified":[132],"dual-execution":[133,150,155],"environment,":[134],"which":[135],"does":[136],"require":[138],"maintaining":[139],"or":[140],"checking":[141],"execution":[142],"metadata.":[143],"We":[144],"design":[145],"practical":[147],"deterministic":[149],"engine,":[151],"co-design":[153],"fuzzers,":[157],"bug-sensitive":[158],"diversification,":[159],"comprehensive,":[160],"efficient":[162],"divergence":[163],"detection":[164],"ensure":[166],"effectiveness":[168],".":[173],"results":[175],"evaluations":[177],"show":[178],"only":[186],"CVE-assigned":[187],"vulnerabilities":[188,193],"reliably,":[189],"also":[191],"new":[192],"well-tested":[195],"real-world":[196],"programs.":[197],"10":[202],"times":[203],"faster":[204],"than":[205],"similar":[209],"AddressSanitizer.":[211]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1}],"updated_date":"2026-06-26T08:34:08.712188","created_date":"2025-10-10T00:00:00"}