{"id":"https://openalex.org/W4416549437","doi":"https://doi.org/10.1145/3719027.3744811","title":"SyzSpec: Specification Generation for Linux Kernel Fuzzing via Under-Constrained Symbolic Execution","display_name":"SyzSpec: Specification Generation for Linux Kernel Fuzzing via Under-Constrained Symbolic Execution","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549437","doi":"https://doi.org/10.1145/3719027.3744811"},"language":null,"primary_location":{"id":"doi:10.1145/3719027.3744811","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744811","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3719027.3744811","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100337968","display_name":"Hao Yu","orcid":"https://orcid.org/0000-0002-3944-3162"},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yu Hao","raw_affiliation_strings":["University of California, Riverside, Riverside, USA"],"raw_orcid":"https://orcid.org/0000-0002-3944-3162","affiliations":[{"raw_affiliation_string":"University of California, Riverside, Riverside, USA","institution_ids":["https://openalex.org/I103635307"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5115060881","display_name":"Juefei Pu","orcid":"https://orcid.org/0009-0001-9344-799X"},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Juefei Pu","raw_affiliation_strings":["University of California, Riverside, Riverside, USA"],"raw_orcid":"https://orcid.org/0009-0001-9344-799X","affiliations":[{"raw_affiliation_string":"University of California, Riverside, Riverside, USA","institution_ids":["https://openalex.org/I103635307"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034482606","display_name":"Xingyu Li","orcid":"https://orcid.org/0009-0007-1445-4993"},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xingyu Li","raw_affiliation_strings":["University of California, Riverside, Riverside, USA"],"raw_orcid":"https://orcid.org/0009-0007-1445-4993","affiliations":[{"raw_affiliation_string":"University of California, Riverside, Riverside, USA","institution_ids":["https://openalex.org/I103635307"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022038961","display_name":"Zhiyun Qian","orcid":"https://orcid.org/0000-0003-1506-2522"},"institutions":[{"id":"https://openalex.org/I103635307","display_name":"University of California, Riverside","ror":"https://ror.org/03nawhv43","country_code":"US","type":"education","lineage":["https://openalex.org/I103635307"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiyun Qian","raw_affiliation_strings":["University of California, Riverside, Riverside, USA"],"raw_orcid":"https://orcid.org/0000-0003-1506-2522","affiliations":[{"raw_affiliation_string":"University of California, Riverside, Riverside, USA","institution_ids":["https://openalex.org/I103635307"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5003045043","display_name":"Ardalan Amiri Sani","orcid":"https://orcid.org/0000-0003-0130-587X"},"institutions":[{"id":"https://openalex.org/I204250578","display_name":"University of California, Irvine","ror":"https://ror.org/04gyf1771","country_code":"US","type":"education","lineage":["https://openalex.org/I204250578"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ardalan Amiri Sani","raw_affiliation_strings":["University of California, Irvine, Irvine, USA"],"raw_orcid":"https://orcid.org/0000-0003-0130-587X","affiliations":[{"raw_affiliation_string":"University of California, Irvine, Irvine, USA","institution_ids":["https://openalex.org/I204250578"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"813","last_page":"826"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.3962000012397766,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.3962000012397766,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.19859999418258667,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.1014999970793724,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9815999865531921},{"id":"https://openalex.org/keywords/symbolic-execution","display_name":"Symbolic execution","score":0.7318000197410583},{"id":"https://openalex.org/keywords/linux-kernel","display_name":"Linux kernel","score":0.529699981212616},{"id":"https://openalex.org/keywords/software-bug","display_name":"Software bug","score":0.4860999882221222},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.476500004529953},{"id":"https://openalex.org/keywords/program-analysis","display_name":"Program analysis","score":0.37790000438690186}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9815999865531921},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8228999972343445},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.7318000197410583},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.6226000189781189},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.529699981212616},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.4860999882221222},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.476500004529953},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.4722999930381775},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.37790000438690186},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.3693000078201294},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3546000123023987},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.34860000014305115},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.30979999899864197},{"id":"https://openalex.org/C116253237","wikidata":"https://www.wikidata.org/wiki/Q1437424","display_name":"Formal specification","level":2,"score":0.2874999940395355},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.2775000035762787},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.258899986743927}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3719027.3744811","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744811","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3719027.3744811","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744811","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4317435905","display_name":null,"funder_award_id":"#2247880 & #2247881","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W2133608633","https://openalex.org/W2136601052","https://openalex.org/W2514974017","https://openalex.org/W2766711930","https://openalex.org/W2767715373","https://openalex.org/W2795052548","https://openalex.org/W2967996334","https://openalex.org/W2987375469","https://openalex.org/W3043337184","https://openalex.org/W3099499197","https://openalex.org/W3109904794","https://openalex.org/W3129980761","https://openalex.org/W3138777601","https://openalex.org/W3207016455","https://openalex.org/W3213182664","https://openalex.org/W4225985424","https://openalex.org/W4246166885","https://openalex.org/W4308641867","https://openalex.org/W4324007206","https://openalex.org/W4385899890"],"related_works":[],"abstract_inverted_index":{"Fuzzing":[0],"has":[1,36],"become":[2],"one":[3],"of":[4,57,63],"the":[5,31,42,55,58],"most":[6],"effective":[7],"and":[8,15,20],"widely":[9],"used":[10],"techniques":[11],"for":[12,77,83],"discovering":[13],"bugs":[14,40],"vulnerabilities,":[16],"particularly":[17],"in":[18,41,109],"large-scale":[19],"complex":[21,93],"programs":[22],"like":[23],"operating":[24],"system":[25],"kernels.":[26],"A":[27,51],"notable":[28],"example":[29],"is":[30,60],"kernel":[32],"fuzzer":[33],"syzkaller,":[34],"which":[35,66],"identified":[37],"over":[38],"6,800":[39],"Linux":[43],"kernel,":[44],"with":[45,92],"more":[46],"than":[47],"5,500":[48],"already":[49],"fixed.":[50],"crucial":[52],"reason":[53],"behind":[54],"success":[56],"syzkaller":[59],"its":[61],"collection":[62],"syscall":[64,81,111],"descriptions,":[65],"are":[67],"typically":[68],"provided":[69],"by":[70],"human":[71],"experts.":[72],"Although":[73],"some":[74],"methods":[75,98],"exist":[76],"automatically":[78],"generating":[79],"these":[80],"descriptions":[82],"device":[84],"drivers,":[85],"they":[86],"often":[87],"fall":[88],"short":[89],"when":[90],"dealing":[91],"user":[94],"inputs.":[95],"These":[96],"existing":[97],"either":[99],"lack":[100],"precision":[101],"or":[102],"have":[103],"a":[104],"limited":[105],"analysis":[106],"scope,":[107],"resulting":[108],"incomplete":[110],"descriptions.":[112]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-18T07:39:51.176621","created_date":"2025-11-23T00:00:00"}