{"id":"https://openalex.org/W7164556231","doi":"https://doi.org/10.1145/3800506.3803511","title":"KnitFuzz: LLM-guided Kernel Fuzzing via Context-Sensitive Socket System Calls","display_name":"KnitFuzz: LLM-guided Kernel Fuzzing via Context-Sensitive Socket System Calls","publication_year":2026,"publication_date":"2026-06-12","ids":{"openalex":"https://openalex.org/W7164556231","doi":"https://doi.org/10.1145/3800506.3803511"},"language":null,"primary_location":{"id":"doi:10.1145/3800506.3803511","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3800506.3803511","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3800506.3803511","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5138540120","display_name":"Siwei Zhang","orcid":"https://orcid.org/0009-0002-4729-2314"},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Siwei Zhang","raw_affiliation_strings":["Syracuse University, Syracuse, NY, USA"],"raw_orcid":"https://orcid.org/0009-0002-4729-2314","affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse, NY, USA","institution_ids":["https://openalex.org/I70983195"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5081564551","display_name":"Endadul Hoque","orcid":"https://orcid.org/0000-0002-6682-9618"},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Endadul Hoque","raw_affiliation_strings":["Syracuse University, Syracuse, NY, USA"],"raw_orcid":"https://orcid.org/0000-0002-6682-9618","affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse, NY, USA","institution_ids":["https://openalex.org/I70983195"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I70983195"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"321","last_page":"334"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.09380000084638596,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.09380000084638596,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10181","display_name":"Natural Language Processing Techniques","score":0.08900000154972076,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11307","display_name":"Domain Adaptation and Few-Shot Learning","score":0.061500001698732376,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.40540000796318054},{"id":"https://openalex.org/keywords/kernel","display_name":"Kernel (algebra)","score":0.32910001277923584},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.2612000107765198},{"id":"https://openalex.org/keywords/control-system","display_name":"Control system","score":0.25929999351501465},{"id":"https://openalex.org/keywords/noise","display_name":"Noise (video)","score":0.2313999980688095}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6344000101089478},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.40540000796318054},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.32910001277923584},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.2612000107765198},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.25929999351501465},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2556000053882599},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2337999939918518},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.2313999980688095},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.23070000112056732},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.22589999437332153}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3800506.3803511","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3800506.3803511","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3800506.3803511","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3800506.3803511","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the Sixteenth ACM Conference on Data and Application Security and Privacy","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":11,"referenced_works":["https://openalex.org/W2017565015","https://openalex.org/W2498764059","https://openalex.org/W2750952386","https://openalex.org/W2808820334","https://openalex.org/W2947814692","https://openalex.org/W3181528482","https://openalex.org/W4221162427","https://openalex.org/W4388857643","https://openalex.org/W4391579642","https://openalex.org/W4411523092","https://openalex.org/W4414485088"],"related_works":[],"abstract_inverted_index":{"The":[0],"kernel's":[1,169],"syscall":[2],"interface,":[3],"particularly":[4],"for":[5,27,104],"socket-based":[6,96],"networking,":[7],"remains":[8],"a":[9,48,109,153],"critical":[10],"yet":[11],"complex":[12,165],"attack":[13],"surface.":[14],"Existing":[15],"kernel":[16,39,50,150],"fuzzers,":[17],"such":[18],"as":[19,64],"Syzkaller,":[20],"struggle":[21],"to":[22,31,59,82,88,114,135],"generate":[23,60],"valid":[24],"test":[25],"cases":[26],"socket":[28],"syscalls":[29],"due":[30],"their":[32],"contextual":[33],"state---maintained":[34],"across":[35],"userspace":[36],"variables":[37],"and":[38,76,87,107,141],"data":[40],"structures.":[41],"In":[42],"this":[43],"paper,":[44],"we":[45],"present":[46],"KnitFuzz,":[47],"novel":[49],"fuzzing":[51],"framework":[52],"that":[53,70],"leverages":[54],"large":[55],"language":[56,75],"models":[57],"(LLMs)":[58],"context-aware":[61],"C":[62,81],"programs":[63],"seed":[65],"inputs.":[66],"Unlike":[67],"prior":[68,93],"fuzzers":[69],"depend":[71],"on":[72,80,124],"Syzkaller's":[73],"domain-specific":[74],"programs,":[77],"KnitFuzz":[78,99,123,146],"focuses":[79],"avoid":[83],"domain":[84],"language-specific":[85],"constraints":[86],"benefit":[89],"from":[90],"the":[91,168],"LLMs'":[92],"knowledge":[94],"of":[95],"networking":[97],"programs.":[98],"introduces":[100],"selective":[101],"memory":[102],"instrumentation":[103],"effective":[105],"mutation":[106],"incorporates":[108],"dynamic,":[110],"state-aware":[111],"remote":[112],"endpoint":[113],"simulate":[115],"realistic":[116],"network":[117,170],"interactions":[118],"when":[119],"necessary.":[120],"We":[121],"evaluated":[122],"multiple":[125],"Linux":[126],"kernels,":[127],"demonstrating":[128],"significant":[129],"improvements":[130],"over":[131],"state-of-the-art":[132],"fuzzers:":[133],"up":[134],"19.38%":[136],"higher":[137,143],"basic":[138],"block":[139],"coverage":[140],"29.84%":[142],"branch":[144],"coverage.":[145],"also":[147],"uncovers":[148],"two":[149],"bugs,":[151],"including":[152],"previously":[154],"unknown":[155],"vulnerability.":[156],"These":[157],"results":[158],"highlight":[159],"KnitFuzz's":[160],"effectiveness":[161],"in":[162,167],"exercising":[163],"deep,":[164],"paths":[166],"subsystem.":[171]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-06-13T00:00:00"}