{"id":"https://openalex.org/W2344257842","doi":"https://doi.org/10.1109/tr.2015.2512220","title":"Dynamically Discovering Likely Memory Layout to Perform Accurate Fuzzing","display_name":"Dynamically Discovering Likely Memory Layout to Perform Accurate Fuzzing","publication_year":2016,"publication_date":"2016-01-19","ids":{"openalex":"https://openalex.org/W2344257842","doi":"https://doi.org/10.1109/tr.2015.2512220","mag":"2344257842"},"language":"en","primary_location":{"id":"doi:10.1109/tr.2015.2512220","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tr.2015.2512220","pdf_url":null,"source":{"id":"https://openalex.org/S87725633","display_name":"IEEE Transactions on Reliability","issn_l":"0018-9529","issn":["0018-9529","1558-1721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Reliability","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100438008","display_name":"Kai Chen","orcid":"https://orcid.org/0000-0003-4399-8408"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Chen","raw_affiliation_strings":["Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078952133","display_name":"Yingjun Zhang","orcid":"https://orcid.org/0000-0003-4279-2715"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210128818","display_name":"Institute of Software","ror":"https://ror.org/033dfsn42","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yingjun Zhang","raw_affiliation_strings":["Institute of Software, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Software, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210128818"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100346828","display_name":"Peng Liu","orcid":"https://orcid.org/0000-0002-5091-8464"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peng Liu","raw_affiliation_strings":["College of IST, Penn State University, PA, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of IST, Penn State University, PA, U.S.A","institution_ids":["https://openalex.org/I130769515"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":3.9589,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.93298429,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"65","issue":"3","first_page":"1180","last_page":"1194"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11005","display_name":"Radiation Effects in Electronics","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9815987944602966},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.797399640083313},{"id":"https://openalex.org/keywords/buffer-overflow","display_name":"Buffer overflow","score":0.7356624007225037},{"id":"https://openalex.org/keywords/software-bug","display_name":"Software bug","score":0.5490952134132385},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.5459550619125366},{"id":"https://openalex.org/keywords/code-coverage","display_name":"Code coverage","score":0.4768437147140503},{"id":"https://openalex.org/keywords/crash","display_name":"Crash","score":0.47599685192108154},{"id":"https://openalex.org/keywords/memory-safety","display_name":"Memory safety","score":0.46371933817863464},{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.4626278579235077},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.43601152300834656},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.43087148666381836},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4264865219593048},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.4170716106891632},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4110926389694214},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.3446640074253082},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.2852811813354492},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.24778276681900024},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.22077545523643494},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.20484986901283264},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.12307628989219666}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9815987944602966},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.797399640083313},{"id":"https://openalex.org/C40842320","wikidata":"https://www.wikidata.org/wiki/Q19423","display_name":"Buffer overflow","level":2,"score":0.7356624007225037},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.5490952134132385},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.5459550619125366},{"id":"https://openalex.org/C53942775","wikidata":"https://www.wikidata.org/wiki/Q1211721","display_name":"Code coverage","level":3,"score":0.4768437147140503},{"id":"https://openalex.org/C183469790","wikidata":"https://www.wikidata.org/wiki/Q333501","display_name":"Crash","level":2,"score":0.47599685192108154},{"id":"https://openalex.org/C28180684","wikidata":"https://www.wikidata.org/wiki/Q4080983","display_name":"Memory safety","level":3,"score":0.46371933817863464},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.4626278579235077},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.43601152300834656},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.43087148666381836},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4264865219593048},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4170716106891632},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4110926389694214},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3446640074253082},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.2852811813354492},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.24778276681900024},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.22077545523643494},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.20484986901283264},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.12307628989219666},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tr.2015.2512220","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tr.2015.2512220","pdf_url":null,"source":{"id":"https://openalex.org/S87725633","display_name":"IEEE Transactions on Reliability","issn_l":"0018-9529","issn":["0018-9529","1558-1721"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Reliability","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6700000166893005,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":54,"referenced_works":["https://openalex.org/W1112477","https://openalex.org/W33764377","https://openalex.org/W77946476","https://openalex.org/W157156687","https://openalex.org/W182734301","https://openalex.org/W1496222301","https://openalex.org/W1507845365","https://openalex.org/W1578723138","https://openalex.org/W1579850852","https://openalex.org/W1583425800","https://openalex.org/W1592914211","https://openalex.org/W1710734607","https://openalex.org/W1877773550","https://openalex.org/W1976878954","https://openalex.org/W2027991598","https://openalex.org/W2030906223","https://openalex.org/W2032153666","https://openalex.org/W2065948900","https://openalex.org/W2072385532","https://openalex.org/W2095551048","https://openalex.org/W2097576663","https://openalex.org/W2098010707","https://openalex.org/W2104136059","https://openalex.org/W2110908283","https://openalex.org/W2113714600","https://openalex.org/W2113864883","https://openalex.org/W2121579803","https://openalex.org/W2124081952","https://openalex.org/W2128985333","https://openalex.org/W2129487583","https://openalex.org/W2132897303","https://openalex.org/W2140323279","https://openalex.org/W2146455667","https://openalex.org/W2165015106","https://openalex.org/W2258595003","https://openalex.org/W2398729674","https://openalex.org/W2401156470","https://openalex.org/W2504609973","https://openalex.org/W3106729728","https://openalex.org/W3160978791","https://openalex.org/W4239813889","https://openalex.org/W4245435048","https://openalex.org/W6600040955","https://openalex.org/W6601362850","https://openalex.org/W6603227804","https://openalex.org/W6606430823","https://openalex.org/W6607492917","https://openalex.org/W6629841029","https://openalex.org/W6630124987","https://openalex.org/W6634652938","https://openalex.org/W6637688222","https://openalex.org/W6680790594","https://openalex.org/W6712660312","https://openalex.org/W6712751967"],"related_works":["https://openalex.org/W2316974788","https://openalex.org/W2381594293","https://openalex.org/W2107510936","https://openalex.org/W2367489380","https://openalex.org/W2344257842","https://openalex.org/W114061091","https://openalex.org/W3183415891","https://openalex.org/W2022203852","https://openalex.org/W2939998072","https://openalex.org/W3048076421"],"abstract_inverted_index":{"Malicious":[0],"Input":[1],"through":[2],"Buffer":[3],"Overflow":[4],"(MiBO)":[5],"vulnerabilities":[6,34,201],"play":[7],"important":[8],"roles":[9],"in":[10,22,77,207],"cyber":[11],"security.":[12],"To":[13,135],"identify":[14,145],"MiBO":[15,33,47,69,92,184,200,205],"vulnerabilities,":[16,48,70],"white-box":[17,86],"testing":[18,28],"approaches":[19,29],"analyze":[20,141],"instructions":[21],"all":[23],"possible":[24],"execution":[25],"paths.":[26],"Black-box":[27],"try":[30],"to":[31,65,89,103,144,182],"trigger":[32],"using":[35],"different":[36,125,128],"inputs.":[37],"However,":[38],"only":[39],"limited":[40],"coverage":[41],"can":[42],"be":[43,162,168],"achieved:":[44],"the":[45,67,105,120,130,154,171,180],"identified":[46,152],"when":[49],"being":[50],"\u201chit\u201d":[51],"by":[52],"a":[53,85,149,188],"test":[54],"input,":[55],"must":[56],"cause":[57],"exceptions":[58],"(e.g.,":[59],"crashes).":[60],"Type":[61],"information":[62,73],"could":[63],"help":[64,104],"catch":[66],"non-crash":[68,91],"but":[71],"such":[72],"is":[74,109,157],"not":[75],"contained":[76],"binary":[78],"code.":[79],"In":[80,124],"this":[81],"paper,":[82],"we":[83,97,139],"present":[84],"fuzzing":[87,106,165],"method":[88],"detect":[90],"vulnerabilities.":[93,185],"Without":[94],"source":[95],"code,":[96],"dynamically":[98],"discover":[99],"likely":[100],"memory":[101,113,142,146,155],"layouts":[102,116,131],"process.":[107],"This":[108],"very":[110],"challenging":[111],"since":[112],"addresses":[114],"and":[115,192],"keep":[117],"changing":[118],"with":[119,127,170],"running":[121],"of":[122],"software.":[123],"executions":[126],"inputs,":[129],"may":[132],"also":[133],"change.":[134],"address":[136],"these":[137],"challenges,":[138],"selectively":[140],"operations":[143],"layouts.":[147],"If":[148],"buffer":[150],"border":[151],"from":[153],"layout":[156,172],"exceeded,":[158],"an":[159],"error":[160],"will":[161,167],"reported.":[163],"The":[164],"results":[166],"compared":[169],"for":[173],"future":[174],"input":[175],"generation,":[176],"which":[177],"greatly":[178],"increases":[179],"opportunity":[181],"expose":[183],"We":[186],"implemented":[187],"prototype":[189],"called":[190],"ArtFuzz":[191,196],"performed":[193],"several":[194],"evaluations.":[195],"discovered":[197],"23":[198],"real":[199],"(including":[202],"8":[203],"zero-day":[204],"vulnerabilities)":[206],"nine":[208],"applications.":[209]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":2}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}