Publication

Efficient State Merging in Symbolic Execution

Publications associées (25)

To Infinity, and Beyond (Coverage)

The pursuit of software security and reliability hinges on the identification and elimination of software vulnerabilities, a challenge compounded by the vast and evolving complexity of modern systems. Fuzzing has emerged as an indispensable technique for b ...

EPFL2024

Arvin: Greybox Fuzzing Using Approximate Dynamic CFG Analysis

Sirus Shahini, Mathias Josef Payer

Fuzzing has emerged as the most broadly used testing technique to discover bugs. Effective fuzzers rely on coverage to prioritize inputs that exercise new program areas. Edge-based code coverage of the Program Under Test (PUT) is the most commonly used cov ...

ASSOC COMPUTING MACHINERY2023

MINERVA: Browser API Fuzzing with Dynamic Mod-Ref Analysis

Mathias Josef Payer, Chijin Zhou, Yu Jiang

Browser APIs are essential to the modern web experience. Due to their large number and complexity, they vastly expand the attack surface of browsers. To detect vulnerabilities in these APIs, fuzzers generate test cases with a large amount of random API inv ...

Assoc Computing Machinery2022

One Fuzz Doesn’t Fit All: Optimizing Directed Fuzzing via Target-tailored Program State Restriction

Mathias Josef Payer

Fuzzing is the de-facto default technique to discover software flaws, randomly testing programs to discover crashing test cases. Yet, a particular scenario may only care about specific code regions (for, e.g., bug reproduction, patch or regression testing) ...

ASSOC COMPUTING MACHINERY2022

Seed Selection for Successful Fuzzing

Mathias Josef Payer

Mutation-based greybox fuzzing-unquestionably the most widely-used fuzzing technique-relies on a set of non-crashing seed inputs (a corpus) to bootstrap the bug-finding process. When evaluating a fuzzer, common approaches for constructing this corpus inclu ...

ASSOC COMPUTING MACHINERY2021

Automated Design: A Journey Across Modelling, Optimization, and Education

Cyril Picard

Machine intelligence greatly impacts almost all domains of our societies. It is profoundly changing the field of mechanical engineering with new technical possibilities and processes. The education of future engineers also needs to adapt in terms of techni ...

EPFL2021

FuZZan: Efficient Sanitizer Metadata Design for Fuzzing

Mathias Josef Payer

Fuzzing is one of the most popular and effective techniques for finding software bugs. To detect triggered bugs, fuzzers leverage a variety of sanitizers in practice. Unfortunately, sanitizers target long running experiments-e.g., developer test suites-not ...

USENIX ASSOC2020

USBFuzz: A Framework for Fuzzing USB Drivers by Device Emulation

Hui Peng, Mathias Josef Payer

The Universal Serial Bus (USB) connects external devices to a host. This interface exposes the OS kernels and device drivers to attacks by malicious devices. Unfortunately, kernels and drivers were developed under a security model that implicitly trusts co ...

USENIX ASSOC2020

Discover deeper bugs with dynamic symbolic execution and coverage-based fuzz testing

Vitaly Chipounov, George Candea, Bin Zhang, Chao Feng

Coverage-based fuzz testing and dynamic symbolic execution are both popular program testing techniques. However, on their own, both techniques suffer from scalability problems when considering the complexity of modern software. Hybrid testing methods attem ...

INST ENGINEERING TECHNOLOGY-IET2018

Elastic Program Transformations : Automatically Optimizing the Reliability/Performance Trade-off in Systems Software

Jonas Benedict Wagner

Performance and reliability are important yet conflicting properties of systems software. Software today often crashes, has security vulnerabilities and data loss, while many techniques that could address such issues remain unused due to performance concer ...

EPFL2017

Improving systems software security through program analysis and instrumentation

Volodymyr Kuznetsov

Security and reliability bugs are prevalent in systems software. Systems code is often written in low-level languages like C/C++, which offer many benefits but also delegate memory management and type safety to programmers. This invites bugs that cause cra ...

EPFL2016

Search Techniques for Code Generation

Tihomir Gvero

This dissertation explores techniques that synthesize and generate program fragments and test inputs. The main goal of these techniques is to improve and support automation in program synthesis and test input generation. This is important because performin ...

EPFL2015

Improving Scalability of Symbolic Execution for Software with Complex Environment Interfaces

Stefan Bucur

Manual software testing is laborious and prone to human error. Yet, among practitioners, it is the most popular method for quality assurance. Automating the test case generation promises better effectiveness, especially for exposing corner-case bugs. Symbo ...

EPFL2015

PBCOV: a property-based coverage criterion

Hamza Harkous, Kassem Fawaz

Coverage criteria aim at satisfying test requirements and compute metrics values that quantify the adequacy of test suites at revealing defects in programs. Typically, a test requirement is a structural program element, and the coverage metric value repres ...

Springer2015

Techniques for Detection, Root Cause Diagnosis, and Classification of In-Production Concurrency Bugs

Baris Can Cengiz Kasikci

Concurrency bugs are at the heart of some of the worst bugs that plague software. Concurrency bugs slow down software development because it can take weeks or even months before developers can identify and fix them. In-production detection, root cause ...

EPFL2015

Model-based automated testing of critical PLC programs

Simon Bliudze, Jean-Charles Tournier

Testing of critical PLC (Programmable Logic Controller) programs remains a challenging task for control system engineers as it can rarely be automated. This paper proposes a model-based approach which uses the BIP (Behavior, Interactions and Priorities) fr ...

IEEE2013

Execution Synthesis: A Technique for Automating the Debugging of Software

Cristian Zamfir

Debugging real systems is hard, requires deep knowledge of the target code, and is time-consuming. Bug reports rarely provide sufficient information for debugging, thus forcing developers to turn into detectives searching for an explanation of how the prog ...

EPFL2013

An Algorithm for Testing the Efficient Market Hypothesis

Ioana Andreea Boboc

The objective of this research is to examine the efficiency of EUR/USD market through the application of a trading system. The system uses a genetic algorithm based on technical analysis indicators such as Exponential Moving Average (EMA), Moving Average C ...

Public Library of Science2013

Designing Augmented Reality for the Classroom

Sébastien Cuendet, Pierre Dillenbourg, Quentin Bonnard

Augmented reality (AR) has recently received a lot of attention in education. Multiple AR systems for learning have been developed and tested through empirical studies often conducted in lab settings. While lab studies can be insightful, they leave out the ...

Elsevier2013

Efficient State Merging in Symbolic Execution

George Candea, Stefan Bucur, Volodymyr Kuznetsov, Johannes Kinder

Symbolic execution has proven to be a practical technique for building automated test case generation and bug finding tools. Nevertheless, due to state explosion, these tools still struggle to achieve scalability. Given a program, one way to reduce the num ...

ACM2012

Publications associées (25)