Pith. sign in

REVIEW 3 major objections 5 minor 40 references

A systematic review of fuzzing based on machine learning techniques

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This review argues that machine learning improves fuzzing by contributing at every major workflow stage, from seed generation to crash triage, though its strongest evidence comes from best-case reported metrics.

desk verdict Useful map of ML-assisted fuzzing, but the headline claim that ML improves fuzzing is undercut by the paper's own LAVA-M table. read the letter →

arxiv 1908.01262 v1 pith:6YIQBGZW submitted 2019-08-04 cs.CR cs.LG

Yan Wang , Peng Jia , Luping Liu , Jiayong Liu This is my paper · ORCID
classification cs.CRcs.LG
keywords fuzzingmachinelearningvulnerabilitydiscoverytestcasegenerationseedmutationoperatorselectiondeepcoverage
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This systematic review asks whether machine learning can make fuzzing better at finding software vulnerabilities. It argues yes: after reviewing 29 studies, it identifies six fuzzing stages where ML has been applied—seed generation, testcase generation, testcase filtering, mutation operator selection, fitness evaluation, and crash exploitability analysis—and concludes that ML classifiers have acceptable predictive capability and that ML-based fuzzers improve coverage, unique crashes, pass rate, and efficiency over traditional baselines. The claim is qualified by the review's own benchmark comparison, which shows that on the LAVA-M injected-bug suite most ML-based fuzzers do not beat state-of-the-art non-ML fuzzers. A sympathetic reader would therefore take the paper's contribution as a structured map of how ML enters fuzzing and evidence that it helps in several concrete systems, rather than as proof that ML dominates all fuzzing.

What carries the argument

The carrying machinery is a workflow taxonomy paired with a metric-aggregation procedure. The taxonomy splits fuzzing into six stages—seed file generation, testcase generation, testcase filtering, mutation operator selection, fitness evaluation, and exploitability analysis—and assigns each surveyed system to the stage where its machine learning component acts. This mapping is what lets the review answer 'where can ML help.' The aggregation procedure then collects the classification metrics (accuracy, precision, recall, loss) reported by each paper, taking the maximum values for the first three and the minimum for loss, and reads those as evidence that ML models predict usefully in fuzzing settings. The same two-part structure—ML model quality, then fuzzer vulnerability-detection quality—organizes the performance evaluation.

What would settle it

Recompute accuracy, precision, recall, and loss using medians or means across all runs reported in the surveyed papers; if median values approach chance levels or are no better than a trivial predictor, the 'acceptable capability' conclusion fails. Alternatively, run a controlled head-to-head where identical seed corpora, time budgets, and target binaries are given to matched ML-guided and conventional fuzzers; if coverage and unique crashes are not higher on the ML-guided side, the central claim collapses.

Watch

Extended reading notes

Core claim

The paper's central claim is that machine learning can be inserted into fuzzing at six distinct points—seed file generation, testcase generation, testcase filtering, mutation operator selection, fitness function design, and exploitability analysis—and that doing so improves fuzzer performance. The review organizes the field by algorithm family (traditional ML, deep learning, reinforcement learning), preprocessing method, dataset source, evaluation metric, and hyperparameter choice. It then aggregates the reported classification metrics across the surveyed papers, taking the maximum accuracy, precision, and recall and the minimum loss from each, and finds accuracy mostly above 0.9, precision above 0.92, recall between 0.6 and 0.98, and loss between 0.05 and 0.53; from this it concludes that machine learning has reasonable predictive power for fuzzing decisions. On vulnerability discovery, it reports improvements in coverage, unique paths, crashes, pass rate, and efficiency for systems such as NEUZZ, Skyfire, DeepSmith, and Thompson Sampling, while acknowledging that the LAVA-M comparison shows most ML-based tools do not substantially outperform state-of-the-art traditional fuzzers, a conclusion the authors themselves flag as threatened by the small number of ML fuzzers tested on that suite.

Load-bearing premise

The review's positive conclusion rests on taking each surveyed paper's best reported accuracy, precision, and recall and its lowest loss as representative of typical machine learning performance; if median or mean values were used, the conclusion could change.

Editorial extensions

If this is right

  • If ML improves fuzzing as claimed, grammar-learning seed generators can raise the fraction of inputs that pass syntax checks while still reaching deeper program paths.
  • Predictive models of mutation locations and vulnerability-prone paths can let a fuzzer spend execution time on fewer, higher-value inputs, improving efficiency.
  • Reinforcement learning for mutation operator selection can increase code coverage, but gains depend on reward design and may carry training-time costs.
  • The claimed improvement is not uniform: on the LAVA-M benchmark, most ML-based fuzzers found fewer injected bugs than state-of-the-art non-ML tools, so the correct reading is that ML helps some stages and targets, not all.
  • If the review's taxonomy is correct, future fuzzers can be built modularly, choosing an ML component for each bottleneck rather than treating machine learning as a single monolithic addition.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A more cautious reading would compute medians rather than maxima across the surveyed papers; if typical accuracy and precision are close to chance, the 'acceptable capability' conclusion weakens, a check the paper does not perform.
  • The six identified stages are modular, but no surveyed system combines all of them; an obvious next experiment is a pipeline that uses grammar learning for seed generation, a coverage predictor for filtering, and reinforcement learning for mutation selection in a single fuzzer.
  • Because the paper finds no public benchmark dataset for ML-based fuzzing, cross-paper comparisons are not apples-to-apples; the positive conclusion should be read as per-system evidence until a shared benchmark exists.
  • The LAVA-M results suggest the practical contribution of ML may be assistance—prioritizing seeds, filtering testcases, triaging crashes—rather than replacing the core mutation engine of a mature fuzzer.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper is a systematic review of machine-learning-based fuzzing. It proposes a six-stage taxonomy of the fuzzing workflow (seed generation, testcase generation, testcase filter, mutation operator selection, fitness function, exploitability analysis), surveys 29 works, and organizes them by machine learning algorithm, preprocessing method, dataset, evaluation metric, and hyperparameter setting. It then evaluates the classification performance of the surveyed ML models (accuracy, precision, recall, loss) and compares ML-based fuzzers with traditional fuzzers on coverage, unique code paths, unique crashes/bugs, pass rate, and efficiency. The paper concludes that ML has an acceptable predictive capability for fuzzing and that introducing ML improves fuzzing performance, while noting limitations such as unbalanced training data and difficulty extracting vulnerability-related features.

Significance. If the central claim were established, the review would be a useful reference for researchers choosing ML techniques for fuzzing. Its strengths are the broad six-stage taxonomy, the systematic tabulation of algorithms, preprocessing methods, datasets, metrics, and hyperparameters, and the explicit inclusion of a LAVA-M bug-discovery comparison that is rare in survey papers. The paper also usefully identifies missing public benchmarks and feature-selection challenges as future directions. However, the central claim is not supported by the evidence as presented: the classification-performance evaluation in Section 6.1 uses best-case values without justification, and the bug-discovery data in Section 6.2.3 mainly point in the opposite direction of the headline conclusion. The paper's descriptive taxonomy and tables have standalone value, but the evaluative conclusions require substantial revision.

major comments (3)
  1. [Section 6.1, Figs. 2-5] The meta-analysis selects the maximum Accuracy, Precision, and Recall and the minimum Loss from each surveyed study, and then concludes that machine learning has 'reasonable predictive power' for fuzzing. This aggregation is not justified: the studies use different programs, datasets, preprocessing pipelines, and train/test splits, so the best reported value per study is not a comparable or unbiased estimator of typical performance. The text even notes that ExploitMeter's average accuracy is 0.9, average precision is about 0.4, and average recall is 0.2, yet Fig. 2-3 display the maxima of 1.0. The conclusion should be based on reported ranges, medians, or a stated aggregation rule that accounts for variance; otherwise the claim of 'acceptable capability' is unsupported.
  2. [Section 6.2.3, Table 10] The paper's own LAVA-M comparison contradicts the abstract and Section 7 claim that 'the introduction of machine learning technology can improve the performance of fuzzing.' Table 10 shows that traditional fuzzers such as REDQUEEN (44/57/28/2134), Angora (48/57/29/1541), and T-fuzz (43/49/26/63) far outperform most ML-based fuzzers, including NeuFuzz (6/--/5/8), V-Fuzz (27/--/28/62), and Thompson Sampling (31/1/0/106), with NEUZZ as the sole competitive ML-based tool. The text acknowledges that 'the vulnerability discovery capability of the machine learning based fuzzing tool is not improved compared with the state-of-the-art fuzzing tools,' but then dismisses this as a threat to validity. This is not a threat-to-validity caveat; it is the primary evidence on the central purpose of fuzzing. The conclusion must either restrict the improvement claim to coverage, pass rate, and efficiency, or it must integrate the bug-discovery counter-evidence and explain why the selected metrics outweigh it.
  3. [Section 7 and Section 6.2] The paper aggregates five incomparable fuzzing metrics (coverage, unique code path, unique crash or bug, pass rate, efficiency) into the general statement that ML improves fuzzing performance. Different studies measure these metrics on different corpora and baselines, and trade-offs between metrics are acknowledged in the text (e.g., pass rate vs. coverage in Section 6.2.4). Without a stated evaluation protocol or a decision rule for weighing conflicting outcomes, the general claim is not derivable from the evidence. A revised conclusion should either specify the conditions under which ML-based fuzzing helps or present a principled aggregation across metrics.
minor comments (5)
  1. [Abstract and Section 1] The phrase 'an acceptable capability of categorize predictive for fuzzing' is grammatically unclear; consider 'an acceptable predictive-classification capability for fuzzing.'
  2. [Section 6.1, text after Fig. 5] The sentence 'The statistical recall value in Fig. 5 is at least 0.05, and the highest is 0.53' appears to discuss loss, not recall; as written it conflates the two metrics and should be corrected.
  3. [References] The reference list contains duplicate entries for 'Fan and Chang 2017' (listed twice with identical citation data), and Section 6.2.2 cites it as 'Fan and Chang 2018'; the citation year should be made consistent.
  4. [Section 2.1] The definition of vulnerabilities as 'flows or weaknesses' appears to be a typo for 'flaws or weaknesses.'
  5. [Section 5.5, Table 7] The statement that 'the maximum epoch's option is 50, but 40 works best' is presented without supporting citation or statistical evidence; if this is an observation from the surveyed papers, it should be attributed and qualified.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation found: the review aggregates externally reported results; its internal LAVA-M inconsistency is a correctness issue, not circularity.

full rationale

This paper is a systematic review rather than a derivation, so there is no fitted parameter renamed as a prediction, no self-definitional equation, and no uniqueness theorem imported from the authors' prior work. The central conclusions ('acceptable capability of categorize predictive for fuzzing' and 'machine learning technology can improve the performance of fuzzing') are presented as aggregations of experimental results reported in the surveyed literature, not as consequences of definitions or of the authors' own fitted values. The few self-citations (e.g., Liu et al. 2019a for malicious-code detection and InsFuzz as a baseline in Table 10) are background or baseline entries rather than load-bearing evidence for the review's claims. The most salient problem is that the paper's own LAVA-M comparison (Table 10) shows traditional fuzzers outperforming most ML-based fuzzers, and the text itself concedes that 'the vulnerability discovery capability of the machine learning based fuzzing tool is not improved compared with the state-of-the-art fuzzing tools.' That is an evidentiary inconsistency or correctness risk in the review's synthesis, not a circularity: the conclusion does not reduce by construction to its inputs. No equation is equated to another by definition, and no result is forced by a self-citation chain.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

This is a review, so there are no fitted free parameters or newly postulated entities. The quantitative conclusions rest on the reliability and comparability of the cited papers' reported results, on the best-case aggregation rule, and on the validity of the six-stage taxonomy.

assumptions (4)
  • domain assumption The 29 surveyed papers are a representative and complete sample of machine learning based fuzzing research, and their reported results are accurate.
    No search protocol, inclusion criteria, or screening process is given (Section 4); the evidence base is asserted rather than demonstrated.
  • ad hoc to paper Best-case values of accuracy, precision, recall, and minimum loss across studies are valid and comparable indicators of typical model performance.
    Section 6.1 selects the maximum accuracy, precision, and recall and the minimum loss from each paper; this ad hoc aggregation is not justified and supports the favorable conclusion.
  • ad hoc to paper The six-stage taxonomy (seed generation, testcase generation, testcase filter, mutation operator selection, fitness function, exploitability analysis) is an exhaustive decomposition of the fuzzing workflow.
    Section 4 introduces this taxonomy without arguing for its completeness; it is used to assign every surveyed paper to a single stage.
  • domain assumption Performance metrics such as coverage, unique crashes, pass rate, and efficiency are valid proxies for vulnerability discovery effectiveness.
    Section 6 evaluates vulnerability detection capability using these metrics; their validity as proxies for real security impact is assumed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A systematic review of fuzzing based on machine learning techniques." pith.science (2026). https://pith.science/paper/6YIQBGZW

@misc{pith2026190801262,
  author       = {Pith},
  title        = {Pith review of: A systematic review of fuzzing based on machine learning techniques},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6YIQBGZW}},
  note         = {Machine review of arXiv:1908.01262}
}
read the original abstract

Security vulnerabilities play a vital role in network security system. Fuzzing technology is widely used as a vulnerability discovery technology to reduce damage in advance. However, traditional fuzzing techniques have many challenges, such as how to mutate input seed files, how to increase code coverage, and how to effectively bypass verification. Machine learning technology has been introduced as a new method into fuzzing test to alleviate these challenges. This paper reviews the research progress of using machine learning technology for fuzzing test in recent years, analyzes how machine learning improve the fuzz process and results, and sheds light on future work in fuzzing. Firstly, this paper discusses the reasons why machine learning techniques can be used for fuzzing scenarios and identifies six different stages in which machine learning have been used. Then this paper systematically study the machine learning based fuzzing models from selection of machine learning algorithm, pre-processing methods, datasets, evaluation metrics, and hyperparameters setting. Next, this paper assesses the performance of the machine learning models based on the frequently used evaluation metrics. The results of the evaluation prove that machine learning technology has an acceptable capability of categorize predictive for fuzzing. Finally, the comparison on capability of discovering vulnerabilities between traditional fuzzing tools and machine learning based fuzzing tools is analyzed. The results depict that the introduction of machine learning technology can improve the performance of fuzzing. However, there are still some limitations, such as unbalanced training samples and difficult to extract the characteristics related to vulnerabilities.

Figures

Figures reproduced from arXiv: 1908.01262 by the authors.

Figure 2
Figure 2. Comparison of Accuracy between different models [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗
Figure 4
Figure 4. Comparison of Recall between different models [PITH_FULL_IMAGE:figures/full_fig_p013_4.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 37 canonical work pages

  1. [6]

    V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing

    Li Y, Ji S, Lv C, Chen Y, Chen J, Gu Q, et al. V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing. arXiv preprint arXiv:1901.01142. 2019a. Li Z, Zhao H, Shi J, Huang Y, Xiong J. An Intelligent Fuzzing Data Generation Method Based on Deep Adversarial Learning. IEEE Access. 2019b

    arXiv 1901

  2. [10]

    Static and dynamic analysis: Synergy and duality

    Ernst MD. Static and dynamic analysis: Synergy and duality. In: WODA 2003: ICSE Workshop on Dynamic Analysis

    work page 2003

  3. [14]

    p. 50–9. Goldberg Y, Levy O. word2vec Explained: deriving Mikolov et al.’s negative-sampling word-embedding method. arXiv preprint arXiv:1402.3722,

    arXiv

  4. [15]

    p. 85–96. 19 Haller I, Slowinska A, Bos H, Neugschwandtner MM. Dowsing for Overflows: A Guided Fuzzer to Find Buffer Boundary Violation. SEC ’13 Proc 22nd USENIX Conf Secur; 2013; 49–64. Hö schele M, Zeller A. Mining input grammars from dynamic taints. In: Proceedings of the 31st IEEE/ACM International Conference on Automated Software Engineering. ACM:

    work page 2013

  5. [16]

    Adaptive Grey-Box Fuzz-Testing with Thompson Sampling

    Karamcheti S, Mann G, Rosenberg D. Adaptive Grey-Box Fuzz-Testing with Thompson Sampling. In: Proceedings of the 11th ACM Workshop on Artificial Intelligence and Security. ACM; 2018a. p. 37–47. Karamcheti S, Mann G, Rosenberg D. Improving Grey-Box Fuzzing by Modeling Program Behavior. arXiv Prepr arXiv181108973. 2018b. Kifetew FM, Tiella R, Tonella P. Gen...

    work page 2017

  6. [21]

    Pin: building customized program analysis tools with dynamic instrumentation

    Luk C, Cohn R, Muth R, Patil H, Klauser A, Lowney G, et al. Pin: building customized program analysis tools with dynamic instrumentation. ACM SIGPLAN Not; 2005 Jun 12; 40(6). p

    work page 2005

  7. [25]

    The NIST SARD project [Internet]

    NIST. The NIST SARD project [Internet]. 2006 [cited 2019 Jul 17]. Available from: https://samate.nist.gov/SRD/testsuite.php 20 Oehlert P. Violating Assumptions with Fuzzing. IEEE Secur Priv Mag; 2005 Mar; 3(2). p. 58–62. Paduraru C, Melemciuc M-C. An Automatic Test Data Generation Tool using Machine Learning. In: Proceedings of the 13th International Conf...

    work page 2006

  8. [26]

    p. 506–15. Peng H, Shoshitaishvili Y, Payer M. T-Fuzz: Fuzzing by Program Transformation. In: 2018 IEEE Symposium on Security and Privacy (SP). IEEE

    work page 2018

Show all 40 references
  1. [27]

    p. 697–710. Rajpal M, Blum W, Singh R. Not all bytes are equal: Neural byte sieve for fuzzing; 2017 Nov 9; 1–10. Rebert A, Cha SK, Avgerinos T, Foote J, Warren D, Grieco G, et al. Optimizing seed selection for fuzzing. In: 23rd {USENIX} Security Symposium ({USENIX} Security 14)

    2017

  2. [28]

    p. 354–70. Serebryany K, Bruening D. AddressSanitizer: a fast address sanity checker. In: Presented as part of the 2012 {USENIX} Annual Technical Conference ({USENIX} {ATC} 12)

    2012

  3. [29]

    p. 309–18. She D, Pei K, Epstein D, Yang J, Ray B, Jana S. NEUZZ: Efficient Fuzzing with Neural Program Smoothing; IEEE Symposium on Security & Privacy; 2019, 89(46). p

    2019

  4. [31]

    Body armor for binaries: preventing buffer overflows without recompilation

    Slowinska A, Stancescu T, Bos H. Body armor for binaries: preventing buffer overflows without recompilation. ATC’12 Proc 2012 USENIX Conf Annu Tech; 2012 .p. 125–37. Sparks S, Embleton S, Cunningham R, Zou C. Automated Vulnerability Analysis: Leveraging Control Flow for Evolut...

    2012

  5. [33]

    Exniffer: Learning to Prioritize Crashes by Assessing the Exploitability from Memory Dump

    Tripathi S, Grieco G, Rawat S. Exniffer: Learning to Prioritize Crashes by Assessing the Exploitability from Memory Dump. In: 2017 24th Asia-Pacific Software Engineering Conference (APSEC). IEEE; 2017 .p. 239-48. Wang J, Chen B, Wei L, Liu Y. Skyfire: Data-Driven Seed Generati...

    2017

  6. [34]

    p. 579–94. Wang Y, Wu Z, Wei Q, Wang Q. NeuFuzz: Efficient Fuzzing With Deep Neural Network. IEEE Access; 2019, 7 .p. 36340–52. Wichmann BA, Canning AA, Marsh DWR, Clutterbuck DL, Winsborrow LA, Ward NJ. Industrial perspective on static analysis. Softw Eng J; 1995, 10(2) .p

    2019

  7. [36]

    Vulnerability detection with deep learning

    Wu F, Wang J, Liu J, Wang W. Vulnerability detection with deep learning. In: 2017 3rd IEEE International Conference on Computer and Communications (ICCC)

    2017

  8. [37]

    1298–302

    p. 1298–302. Xie T, Tillmann N, de Halleux J, Schulte W. Fitness-guided path exploration in dynamic symbolic execution. In: 2009 IEEE/IFIP International Conference on Dependable Systems & Networks. IEEE

    2009

  9. [38]

    Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware

    Shoshitaishvili Y, Wang R, Hauser C, Kruegel C, Vigna G. Firmalice - Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware. In: Proceedings 2015 Network and Distributed System Security Symposium. Reston, VA: Internet Society

    2015

  10. [39]

    p. 359–68. Yan G, Lu J, Shu Z, Kucuk Y. ExploitMeter: Combining Fuzzing with Machine Learning for Automated Evaluation of Software Exploitability. In: 2017 IEEE Symposium on Privacy-Aware Computing (PAC). IEEE; 2017 .p. 164-75. Zalewski M. American fuzzy lop

    2017

  11. [40]

    Available from: http://lcamtuf.coredump.cx/afl/ Zhang G, Zhou X, Luo Y, Wu X, Min E

    [cited 2019 Jul 17]. Available from: http://lcamtuf.coredump.cx/afl/ Zhang G, Zhou X, Luo Y, Wu X, Min E. PTfuzz: Guided Fuzzing With Processor Trace Feedback. IEEE Access; 2018, 6 .p. 37302–13. Zhang H, Zhou A, Jia P, Liu L, Ma J, Liu L. InsFuzz: Fuzzing Binaries with Locatio...

    2019

  12. [41]

    From automation to intelligence: Survey of research on vulnerability discovery techniques

    Zou Q, Zhang T, Wu R, Ma J, Li M, Chen C, et al. From automation to intelligence: Survey of research on vulnerability discovery techniques. Qinghua Daxue Xuebao/Journal Tsinghua Univ; 2018, 58(12) .p. 1079–94

    2018

  13. [69]

    Fitness function [Internet]; 2019a [cited 2019 Jul 17]

    Wikipedia. Fitness function [Internet]; 2019a [cited 2019 Jul 17]. Available from: https://en.wikipedia.org/wiki/Fitness_function Wikipedia. WannaCry ransomware attack [Internet]; 2019b [cited 2019 Jul 6]. Available from: https://en.wikipedia.org/wiki/WannaCry_ransomware_attac...

    2019

  14. [190]

    SmartSeed: Smart Seed Generation for Efficient Fuzzing; arXiv preprint arXiv:1807.02606

    Lv C, Ji S, Li Y, Zhou J, Chen J, Chen J. SmartSeed: Smart Seed Generation for Efficient Fuzzing; arXiv preprint arXiv:1807.02606

    arXiv

  15. [436]

    Efficient backprop

    LeCun YA, Bottou L, Orr GB, Mü ller KR. Efficient backprop. Lect Notes Comput Sci (including Subser Lect Notes Artif Intell Lect Notes Bioinformatics). 2012; 9–48. Li J, Zhao B, Zhang C. Fuzzing: a survey. Cybersecurity; 2018 Dec 5; 1(1) .p

    2012

  16. [1992]

    p. 240–50. Deng L, Yu D, others. Deep learning: methods and applications. Found Trends®in Signal Process. 2014; 7(3--4). p. 197–387. Dolan-Gavitt B, Hulin P, Kirda E, Leek T, Mambretti A, Robertson W, et al. Lava: Large-scale automated vulnerability addition. In: 2016 IEEE Sym...

    2014

  17. [1998]

    !exploitable [Internet]

    Team MSECMSS. !exploitable [Internet]. 2013 [cited 2019 Jul 18]. Available from: http://msecdbg.codeplex.com Titonis TH, Manohar-Alers NR, Wysopal CJ. Automated behavioral and static analysis using an instrumented sandbox and machine learning classification for mobile security...

    2013

  18. [2001]

    p. 241–9. Miller BP, Fredriksen L, So B. An empirical study of the reliability of UNIX utilities. Commun ACM. 1990 Dec 1; 33 (12). p. 32–44. Mitchell TM. Machine learning and data mining. Commun ACM. 1999; 42(11). Mnih V, Kavukcuoglu K, Silver D, Graves A, Antonoglou I, Wierst...

    1990

  19. [2003]

    p. 24–7. Fan E. Extended tanh-function method and its applications to nonlinear equations. Phys Lett A. 2000 Dec; 277(4–5). p. 212–8. Fan R, Chang Y. Machine Learning for Black-Box Fuzzing of Network Protocols. In: International Conference on Information and Communications Security

    2000

  20. [2006]

    Unleashing Mayhem on Binary Code

    Cha SK, Avgerinos T, Rebert A, Brumley D. Unleashing Mayhem on Binary Code. In: 2012 IEEE Symposium on Security and Privacy. IEEE

    2012

  21. [2007]

    Big Code

    p. 649–56. GCC. The GNU Compiler Collection [Internet]. 2019 [cited 2019 Jul 17]. Available from: http://gcc.gnu.org/ Github. Learning from “Big Code” [Internet]. 2017 [cited 2019 Jul 17]. Available from: http://learnbigcode.github.io/datasets/ Godefroid P, Kiezun A, Levin MY....

    2019

  22. [2008]

    p. 160-7. Cummins C, Petoumenos P, Murray A, Leather H. Compiler fuzzing through deep learning. In: Proceedings of the 27th ACM SIGSOFT International Symposium on Software Testing and Analysis. ACM, 2018: 95-105. CVE. Common Vulnerabilities & Exposures [Internet]. 2019 [cited ...

    2018

  23. [2009]

    p. 214–28. King JC. Symbolic execution and program testing. Commun ACM; 1976 Jul 1; 19(7). p. 385–94. Kipf TN, Welling M. Semi-supervised classification with graph convolutional networks. arXiv Prepr arXiv160902907. 2016; Krizhevsky A, Sutskever I, Hinton GE. Imagenet classifi...

    1976

  24. [2010]

    p. 65-76. Bö ttinger K, Godefroid P, Singh R. Deep reinforcement fuzzing. In: 2018 IEEE Security and Privacy Workshops (SPW). IEEE,

    2018

  25. [2011]

    p. 183-98. 18 Cadar C, Dunbar D, Engler DR. KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs. In: Proc 8th USENIX Conf Oper Syst Des Implement. 2008

    2008

  26. [2012]

    p. 380–94. Chen P, Chen H. Angora: Efficient Fuzzing by Principled Search. In: 2018 IEEE Symposium on Security and Privacy (SP). IEEE

    2018

  27. [2014]

    Available from: https://lcamtuf.blogspot.com/2014/08/binary-fuzzing-strategies-whatworks.html LeCun Y, Bengio Y, Hinton G

    [cited 2019 Jul 18]. Available from: https://lcamtuf.blogspot.com/2014/08/binary-fuzzing-strategies-whatworks.html LeCun Y, Bengio Y, Hinton G. Deep learning. Nature; 2015; 521 (7553). p

    2019

  28. [2015]

    p. 87–97. Nichols N, Raugas M, Jasper R, Hilliard N. Faster Fuzzing: Reinitialization with Deep Neural Models. arXiv preprint arXiv:1711.02807

    arXiv

  29. [2016]

    p. 110–21. Drewry W, Ormandy T. Flayer: exposing application internals. 2007; Drozd W, Wagner MD. FuzzerGym: A Competitive Framework for Fuzzing and Learning. arXiv preprint arXiv:1807.07490,

    2007 arXiv

  30. [2017]

    p. 621–32. Fan R, Chang Y. Machine learning for black-box fuzzing of network protocols. In: International Conference on Information and Communications Security. Springer, Cham, 2017.p. 621-32. Fang K, Yan G. Emulation-Instrumented Fuzz Testing of 4G/LTE Android Mobile Devices ...

    2017

  31. [2018]

    p. 711–25. Chen Y, Groce A, Zhang C, Wong W-K, Fern X, Eide E, et al. Taming compiler fuzzers. In: ACM SIGPLAN Not. 2013 Jun 23; 48(6).p.197-208. Cheng L, Zhang Y, Zhang Y, Wu C, Li Z, Fu Y, et al. Optimizing seed inputs in fuzzing with machine learning. In: Proceedings of the...

    2013

  32. [2019]

    AEG: Automatic exploit generation

    Avgerinos T, Cha SK, Rebert A, Schwartz EJ, Woo M, Brumley D. AEG: Automatic exploit generation. Commun ACM. 2014 Feb 1; 57(2). p. 74–84. Avgerinos T, Rebert A, Cha SK, Brumley D. Enhancing symbolic execution with veritesting. Commun ACM. 2016 May 23; 59(6). p. 93–100. Bastani...

    2014

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.