{"id":"https://openalex.org/W4385664955","doi":"https://doi.org/10.1145/3611665","title":"<scp>Horus</scp> : Accelerating Kernel Fuzzing through Efficient Host-VM Memory Access Procedures","display_name":"<scp>Horus</scp> : Accelerating Kernel Fuzzing through Efficient Host-VM Memory Access Procedures","publication_year":2023,"publication_date":"2023-08-08","ids":{"openalex":"https://openalex.org/W4385664955","doi":"https://doi.org/10.1145/3611665"},"language":"en","primary_location":{"id":"doi:10.1145/3611665","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3611665","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3611665","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3611665","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100693298","display_name":"Jianzhong Liu","orcid":"https://orcid.org/0000-0003-3612-4315"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Jianzhong Liu","raw_affiliation_strings":["Tsinghua University, China"],"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031776155","display_name":"Yuheng Shen","orcid":"https://orcid.org/0000-0002-2667-5431"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuheng Shen","raw_affiliation_strings":["Tsinghua University, China"],"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015388159","display_name":"Yiru Xu","orcid":"https://orcid.org/0000-0002-9386-1453"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yiru Xu","raw_affiliation_strings":["Tsinghua University, China"],"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085216038","display_name":"Hao Sun","orcid":"https://orcid.org/0000-0003-2095-092X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Sun","raw_affiliation_strings":["Tsinghua University, China"],"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5060117799","display_name":"Yu Jiang","orcid":"https://orcid.org/0000-0003-0955-503X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Jiang","raw_affiliation_strings":["Tsinghua University, China"],"affiliations":[{"raw_affiliation_string":"Tsinghua University, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5100693298"],"corresponding_institution_ids":["https://openalex.org/I99065089"],"apc_list":null,"apc_paid":null,"fwci":1.7838,"has_fulltext":true,"cited_by_count":9,"citation_normalized_percentile":{"value":0.85767543,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"33","issue":"1","first_page":"1","last_page":"25"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9918000102043152,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9918000102043152,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9897000193595886,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.987500011920929,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9074292778968811},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8965390920639038},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.6175709962844849},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5699655413627625},{"id":"https://openalex.org/keywords/virtual-memory","display_name":"Virtual memory","score":0.48102837800979614},{"id":"https://openalex.org/keywords/linux-kernel","display_name":"Linux kernel","score":0.45589521527290344},{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.4342954158782959},{"id":"https://openalex.org/keywords/memory-safety","display_name":"Memory safety","score":0.4312335252761841},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.37053143978118896},{"id":"https://openalex.org/keywords/memory-management","display_name":"Memory management","score":0.1734786033630371},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.11207780241966248}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9074292778968811},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8965390920639038},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.6175709962844849},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5699655413627625},{"id":"https://openalex.org/C76399640","wikidata":"https://www.wikidata.org/wiki/Q189401","display_name":"Virtual memory","level":4,"score":0.48102837800979614},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.45589521527290344},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.4342954158782959},{"id":"https://openalex.org/C28180684","wikidata":"https://www.wikidata.org/wiki/Q4080983","display_name":"Memory safety","level":3,"score":0.4312335252761841},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.37053143978118896},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.1734786033630371},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.11207780241966248},{"id":"https://openalex.org/C136085584","wikidata":"https://www.wikidata.org/wiki/Q910289","display_name":"Overlay","level":2,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3611665","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3611665","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3611665","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3611665","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3611665","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3611665","source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1121271761","display_name":null,"funder_award_id":"Program","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4020255992","display_name":null,"funder_award_id":"Project","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4456633529","display_name":null,"funder_award_id":"92167101","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4796153733","display_name":null,"funder_award_id":"6202100","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5216889655","display_name":null,"funder_award_id":"62022046","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6127069372","display_name":null,"funder_award_id":"U20A600","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6311684539","display_name":null,"funder_award_id":"202204","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7029185775","display_name":null,"funder_award_id":"62022046, 92167101, U1911401, 62021002, U20A6003","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7091651887","display_name":null,"funder_award_id":"62021002","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7534379770","display_name":null,"funder_award_id":"TC210H02S","funder_id":"https://openalex.org/F4320323970","funder_display_name":"Ministry of Industry and Information Technology of the People's Republic of China"},{"id":"https://openalex.org/G8356187857","display_name":null,"funder_award_id":"U20A6003","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320323970","display_name":"Ministry of Industry and Information Technology of the People's Republic of China","ror":"https://ror.org/0385nmy68"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4385664955.pdf","grobid_xml":"https://content.openalex.org/works/W4385664955.grobid-xml"},"referenced_works_count":19,"referenced_works":["https://openalex.org/W2025819261","https://openalex.org/W2106035061","https://openalex.org/W2248331481","https://openalex.org/W2505126681","https://openalex.org/W2734941459","https://openalex.org/W2751862727","https://openalex.org/W2794670092","https://openalex.org/W2804093830","https://openalex.org/W2899189777","https://openalex.org/W2927543040","https://openalex.org/W2964241064","https://openalex.org/W2966992680","https://openalex.org/W2981689050","https://openalex.org/W3016185124","https://openalex.org/W3200602700","https://openalex.org/W3207016455","https://openalex.org/W4220830491","https://openalex.org/W4232884709","https://openalex.org/W4308477756"],"related_works":["https://openalex.org/W4282010060","https://openalex.org/W4225847901","https://openalex.org/W3006186133","https://openalex.org/W2912063542","https://openalex.org/W175863638","https://openalex.org/W3113028789","https://openalex.org/W2924291353","https://openalex.org/W2966992680","https://openalex.org/W4288057707","https://openalex.org/W2999227841"],"abstract_inverted_index":{"Kernel":[0],"fuzzing":[1,99,241],"is":[2],"an":[3],"effective":[4],"technique":[5],"in":[6,25,32,83,127,142],"operating":[7,35,51],"system":[8,36],"vulnerability":[9],"detection.":[10],"Fuzzers":[11],"such":[12,64,134],"as":[13,65],"Syzkaller":[14,210,220,248],"and":[15,29,41,48,81,87,115,122,176,185,213,215,221,231,238,245,249],"Moonshine":[16,212,222,250],"frequently":[17],"pass":[18],"highly":[19],"structured":[20],"data":[21,40,100,107,117,172,182],"between":[22,173],"fuzzer":[23],"processes":[24,31],"guest":[26,45,129,177],"virtual":[27,46,130],"machines":[28],"manager":[30],"the":[33,44,49,78,105,128,143,151,158,161,174,181,187,191],"host":[34,50,159,175],"to":[37,121,157,184,196],"synchronize":[38],"fuzzing-relevant":[39],"information.":[42],"Since":[43],"machines\u2019":[47],"system\u2019s":[52],"memory":[53,113,125,145],"spaces":[54],"are":[55,155],"mutually":[56],"isolated,":[57],"fuzzers":[58,209],"conduct":[59],"synchronization":[60],"operations":[61],"using":[62,138,199,259],"mechanisms":[63],"Remote":[66],"Procedure":[67],"Calls":[68],"over":[69],"TCP/IP":[70],"networks,":[71],"incurring":[72],"significant":[73],"overheads":[74],"that":[75,103,197],"negatively":[76],"impact":[77],"fuzzer\u2019s":[79,162],"efficiency":[80],"effectiveness":[82],"increasing":[84],"code":[85],"coverage":[86,254],"finding":[88],"vulnerabilities.":[89],"In":[90],"this":[91],"paper,":[92],"we":[93],"propose":[94],"Horus":[95,110,132,168,205,224,260,264],",":[96,211,223],"a":[97,200,253],"kernel":[98,208],"transfer":[101,108,227],"mechanism":[102],"mitigates":[104],"aforementioned":[106],"overheads.":[109],"removes":[111],"host-VM":[112],"isolation":[114],"performs":[116],"transfers":[118,136],"through":[119,137,179,258],"copying":[120,180],"from":[123,186],"target":[124],"locations":[126],"machine.":[131],"facilitates":[133],"efficient":[135],"fixed":[139],"stub":[140,188],"structures":[141],"guest\u2019s":[144,152],"space,":[146],"whose":[147],"addresses,":[148],"along":[149],"with":[150],"RAM":[153],"contents,":[154],"exposed":[156],"during":[160],"initialization":[163],"process.":[164],"When":[165],"conducting":[166],"transfers,":[167],"passes":[169],"highly-structured":[170],"non-trivial":[171,234],"instances":[178],"directly":[183],"structures,":[189],"reducing":[190],"overall":[192],"overhead":[193],"significantly":[194],"compared":[195],"of":[198,256],"network-based":[201],"approach.":[202],"We":[203],"implemented":[204],"upon":[206],"state-of-the-art":[207],"kAFL":[214],"evaluated":[216],"its":[217,267],"effectiveness.":[218],"For":[219,262],"increased":[225],"their":[226,240],"speeds":[228,271],"by":[229,243,272],"84.5%":[230],"85.8%":[232],"for":[233],"workloads":[235],"on":[236],"average":[237],"improved":[239,265],"throughputs":[242],"31.07%":[244],"30.62%,":[246],"respectively.":[247],"both":[251],"achieved":[252],"speedup":[255],"1.6\u00d7":[257],".":[261],"kAFL,":[263],"specifically":[266],"Redqueen":[268],"component\u2019s":[269],"execution":[270],"19.4%.":[273]},"counts_by_year":[{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":3}],"updated_date":"2026-04-15T08:11:43.952461","created_date":"2025-10-10T00:00:00"}