@inproceedings{ASE26-llm4bic,
author = {Risse, Niklas and B{\"o}hme, Marcel},
booktitle = {Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering},
numpages = {11},
series = {ASE'26},
title = {LLM-Based Agents for Identifying Bug-Introducing Commits},
year = {2026},
doi = {10.1145/3832783.3834337},
abstract = {First paper to substantially improve on SZZ in 20+ years using an agentic approach with grepping skills.},
pdf_url = {papers/ASE26-llm4bic.pdf},
artifact_doi = {10.5281/zenodo.19336271},
artifact_url = {https://doi.org/10.5281/zenodo.19336271},
}
@inproceedings{ASE26-FFTG,
author = {Jose Antonio Zamudio Amaya and Sapia, Gaetano and Turcotte, Alexi and Benavides, David and B{\"o}hme, Marcel and Zeller, Andreas},
booktitle = {Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering},
numpages = {13},
series = {ASE'26},
title = {Feature-Focused Test Generation},
year = {2026},
doi = {10.1145/3832783.3837479},
abstract = {Marries software variability and grammar-based fuzzing. Configure grammars to focus on program features.},
pdf_url = {papers/ASE26-FFTG.pdf},
artifact_doi = {10.6084/m9.figshare.31855447},
artifact_url = {https://doi.org/10.6084/m9.figshare.31855447},
}
@inproceedings{ASE26-profiling,
author = {Lee, Seongmin and Özgü, Işıl and B{\"o}hme, Marcel and Miryung Kim},
booktitle = {Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering},
numpages = {11},
series = {ASE'26},
title = {Accurate and Low-Cost Residual Risk Assessment via Sampled Profiling and Structure-Aware Coverage Amplification},
year = {2026},
doi = {10.1145/3832783.3837519},
abstract = {Explores the utility of no-overhead, hardware-based coverage profiling for residual risk estimation.},
pdf_url = {papers/ASE26-profiling.pdf},
artifact_doi = {10.5281/zenodo.19244795},
artifact_url = {https://doi.org/10.5281/zenodo.19244795},
}
@inproceedings{ASE26-empirical,
author = {Tang, Eric and Liu, Jing and B{\"o}hme, Marcel},
booktitle = {Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (NIER track)},
numpages = {5},
series = {ASE'26 (NIER)},
title = {Empirical Computation: Prompting versus Programming},
year = {2026},
doi = {10.1145/3832783.3834540},
abstract = {Vision paper that establishes Empirical Computation as an interesting new topic in Software Engineering.},
note = {Congrats Eric and Jing! Eric completed this work while interning in our group as a CMU undergrad. Stunning!},
pdf_url = {papers/ASE26-empirical.pdf},
artifact_url = {https://github.com/chinggg/EmpiricalComputation},
}
@inproceedings{FSE26-llmtesting,
author = {Liu, Jing and Lee, Seongmin and Losiouk, Eleonora and B{\"o}hme, Marcel},
title = {Evaluating LLM-Based Regression Test Generation},
year = {2026},
booktitle = {Proceedings of the ACM International Conference on the Foundations of Software Engineering},
series = {FSE'26},
abstract = {Establishes that *change intention* is more critical than the changed code in effective LLM-based Regression Testing.},
numpages = {23},
doi = {10.1145/3808129},
pdf_url = {papers/FSE26-llmtesting.pdf},
artifact_doi = {10.5281/zenodo.19616583},
artifact_url = {https://github.com/niMgnoeSeeL/cleverest},
artifact-badge-available_url = {},
artifact-badge-functional_url = {},
}
@inproceedings{FSE26-concordance,
author = {Madadi, Ardi and Lee, Seongmin and Aschermann, Cornelius and B{\"o}hme, Marcel},
title = {In Bugs We Trust? On Measuring the Randomness of a Fuzzer Benchmarking Outcome},
year = {2026},
booktitle = {Proceedings of the ACM International Conference on the Foundations of Software Engineering},
series = {FSE'26},
abstract = {First paper to establish concordance of a benchmarking method to measure the "randomness" of the benchmark outcome.},
numpages = {21},
doi = {10.1145/3797112},
pdf_url = {papers/FSE26-concordance.pdf},
artifact_url = {https://github.com/ardier/in_bugs_we_trust/},
}
@inproceedings{AAAI26-incoherence,
author = {Valentin, Thomas and Madadi, Ardi and Sapia, Gaetano and B{\"o}hme, Marcel},
title = {Incoherence as Oracle-less Measure of Error in LLM-Based Code Generation},
booktitle = {Proceedings of the 40th Annual AAAI Conference on Artificial Intelligence},
series = {AAAI'26},
year = {2026},
numpages = {14},
abstract = {How to estimate the correctness of an LLM-generated program when we have no specification or ground-truth available.},
pdf_url = {papers/AAAI26-incoherence.pdf},
artifact_url = {https://github.com/mpi-softsec/difftrust},
}
@inproceedings{ICSE26-reachabilityGap,
author = {Sapia, Gaetano and B{\"o}hme, Marcel},
title = {Scaling Security Testing by Addressing the Reachability Gap},
booktitle = {Proceedings of the 48th IEEE/ACM International Conference on Software Engineering},
series = {ICSE'26},
year = {2026},
numpages = {11},
abstract = {How to configure and interact with any software system to execute a given target functionality (and run invivo fuzzing)?},
pdf_url = {papers/ICSE26-reachabilityGap.pdf},
artifact_url = {https://github.com/GPSapia/ReachabilityAgent_ICSE},
}
@inproceedings{ICSE26-dependency,
author = {Lee, Seongmin and B{\"o}hme, Marcel},
title = {Dependency-aware Residual Risk Analysis},
booktitle = {Proceedings of the 48th IEEE/ACM International Conference on Software Engineering},
series = {ICSE'26},
year = {2026},
numpages = {12},
abstract = {First work to account for dependencies among coverage elements in residual risk estimation.},
pdf_url = {papers/ICSE26-dependency.pdf},
artifact_doi = {10.5281/zenodo.18176114},
artifact_url = {https://doi.org/10.5281/zenodo.18176114},
artifact-badge-available_url = {},
artifact-badge-functional_url = {},
}
@inproceedings{ICSE26-interaction,
author = {Kitsios, Konstantinos and B{\"o}hme, Marcel and Bacchelli, Alberto},
title = {On Interaction Effects in Greybox Fuzzing},
booktitle = {Proceedings of the 48th IEEE/ACM International Conference on Software Engineering},
series = {ICSE'26},
year = {2026},
numpages = {12},
abstract = {First work to identify and exploit interaction effects between mutation operators in greybox fuzzing.},
pdf_url = {papers/ICSE26-interaction.pdf},
artifact_doi = {10.5281/zenodo.17391101},
artifact_url = {https://doi.org/10.5281/zenodo.17391101},
}
@inproceedings{SP26-cottontail,
author = {Tu, Haoxin and Lee, Seongmin and Li, Yuxian and Chen, Peng and Jiang, Lingxiao and B{\"o}hme, Marcel},
title = {Cottontail: LLM-Driven Concolic Execution for Highly Structured Test Input Generation},
booktitle = {Proceedings of the 47th IEEE Symposium on Security and Privacy},
series = {SP'26},
year = {2026},
numpages = {18},
abstract = {How to perform concolic execution to generate highly structured test inputs for systematically testing parsing programs.},
pdf_url = {papers/SP26-cottontail.pdf},
artifact_url = {https://github.com/haoxintu/cottontail}
}
@inproceedings{NDSS26-survey,
author = {J. Evertz and N. Risse and N. Neuer and A. M{\"u}ller and P. Normann and G. Sapia and S. Gupta and D. Pape and S. Shaw and D. Srivastav and C. Wressnegger and E. Quiring and T. Eisenhofer and D. Arp and L. Sch{\"o}nherr},
title = {Chasing Shadows: Pitfalls in LLM Security Research},
booktitle = {The Network and Distributed System Security Symposium},
series = {NDSS'26},
year = {2026},
numpages = {15},
pdf_url = {http://niklasrisse.github.io/files/evertz-2026-chasing-shadows.pdf},
abstract = {We uncover nine pitfalls in LLM Security research that can compromise the validity of the research.},
artifact_url = {https://github.com/Dormant-Neurons/llm-pitfalls},
}
@article{TOSEM26-vital,
author = {Tu, Haoxin and Jiang, Lingxiao and B{\"o}hme, Marcel},
journal = {ACM Transactions on Software Engineering and Methodology},
series = {TOSEM},
title = {Vital: Vulnerability-Oriented Symbolic Execution via Type-Unsafe Pointer-Guided Monte Carlo Tree Search},
year = {2026},
abstract = {How to guide symbolic execution towards the most vulnerable parts of the execution tree using MCTS.},
numpages = {24},
pdf_url = {https://arxiv.org/pdf/2408.08772},
artifact_url = {https://github.com/haoxintu/Vital-SE},
}
@inproceedings{ICST26-keynote,
author = {Marcel B{\"o}hme},
title = {Keynote Talk: Adversarial Benchmarking},
year = {2026},
booktitle = {Proceedings of the IEEE International Conference on Software Testing, Verification and Validation},
series = {ICST'26},
abstract = {An Urgent Call for a Stronger Signal of Technological Progress},
numpages = {4},
doi = {10.1109/ICST69053.2026.00097},
pdf_url = {papers/ICST26-keynote.pdf},
slides_url = {https://www.slideshare.net/slideshow/icst-26-keynote-adversarial-benchmarking-an-urgent-call-for-a-stronger-signal-of-technological-progress/287579130},
}
@inproceedings{ISEC26-keynote,
author = {Marcel B{\"o}hme},
title = {Keynote Talk: On Estimating Incorrectness in the Absence of Evidence},
year = {2026},
booktitle = {Proceedings of the ACM Innovations in Software Engineering Conference},
series = {ISEC'26},
abstract = {Overview of the statistical program analysis work in our group.},
numpages = {2},
doi = {10.1145/3796563.3796565},
pdf_url = {papers/ISEC26-keynote.pdf},
slides_url = {https://www.slideshare.net/slideshow/on-estimating-incorrectness-in-the-absence-of-evidence/286267304},
}
@inproceedings{ISSTA25-topscore,
author = {Risse, Niklas and Liu, Jing and B{\"o}hme, Marcel},
title = {Top Score on the Wrong Exam: On Benchmarking in Machine Learning for Vulnerability Detection},
booktitle = {Proceedings of the 34th ACM/SIGSOFT International Symposium on Software Testing and Analysis},
series = {ISSTA'25},
year = {2025},
numpages = {22},
doi = {10.1145/3728887},
abstract = {The most prevalent problem statement of ML4VD as function-level binary classification problem is ill-defined.},
pdf_url = {papers/ISSTA25-topscore.pdf},
artifact_url = {https://github.com/niklasrisse/TopScoreWrongExam},
note = {Supplementary material can be found here: ISSTA25-supplementary.pdf},
award = {Our paper was selected as ACM Distinguished Papers (Top 8% of accepted papers). Congrats Niklas and Jing!}
}
@article{IEEESP25-howto,
author = {B\"{o}hme, Marcel},
journal = {IEEE Security and Privacy, Vol. 23, Issue 3},
series = {S\&P},
title = {How to Solve Cybersecurity Once and For All},
year = {2025},
abstract = {We should stop trying to confirm the effectiveness of our defenses and start failing to find counterexamples.},
volume = {23},
issue = {3},
doi = {10.1109/MSEC.2025.3551590},
pdf_url = {papers/IEEESP25-howto.pdf},
note = {Invited journal article. A much abbreviated version of the keynote at RAID'24}
}
@article{TOSEM25-roadmap,
author = {B\"{o}hme, Marcel and Bodden, Eric and Bultan, Tevfik and Cadar, Cristian and Liu, Yang and Scanniello, Giuseppe},
journal = {ACM Transactions on Software Engineering and Methodology},
series = {TOSEM},
title = {Software Security Analysis in 2030 and Beyond: A Research Roadmap},
year = {2025},
abstract = {Challenges and opportunities for the security analysis of our software systems of the future.},
numpages = {25},
doi = {10.1145/3708533},
pdf_url = {papers/TOSEM25-roadmap.pdf},
note = {Invited article (Special Section: 2030 Software Engineering Roadmap).}
}
@article{TOSEM25-bench,
author = {Wolff, Dylan and B\"{o}hme, Marcel and Roychoudhury, Abhik},
journal = {ACM Transactions on Software Engineering and Methodology},
series = {TOSEM},
title = {Fuzzing: On Benchmarking Outcome as a Function of Benchmark Properties},
year = {2025},
abstract = {How would fuzzer ranking change if programs were larger or initial seeds had more coverage?},
numpages = {24},
doi = {10.1145/3732936},
pdf_url = {papers/TOSEM25-bench.pdf}
}
@article{TSE25-aflnet,
author = {Meng, Ruijie and Pham, Van-Thuan and B\"{o}hme, Marcel and Roychoudhury, Abhik},
journal = {IEEE Transactions on Software Engineering},
series = {TSE},
title = {AFLNet Five Years Later: On Coverage-Guided Protocol Fuzzing},
year = {2025},
abstract = {State- and code-coverage-guided greybox fuzzing (Extended version of our ICSE'20 Tool Demo)},
numpages = {14},
pdf_url = {papers/TSE25-aflnet.pdf},
doi = {10.1109/TSE.2025.3535925},
artifact_url = {https://github.com/aflnet/aflnet}
}
@inproceedings{ICLR25-unseen,
author = {Seongmin Lee and Marcel B{\"o}hme},
title = {How Much is Unseen Depends Chiefly on Information About the Seen},
year = {2025},
booktitle = {Proceedings of the 13th International Conference on Learning Representations},
series = {ICLR'25},
abstract = {Significant progress on a beautiful statistical riddle. Can estimate data representativeness.},
numpages = {22},
pdf_url = {papers/ICLR25-unseen.pdf},
artifact_url = {https://github.com/niMgnoeSeeL/UnseenGA},
award = {Our paper was selected as ICLR'25 Spotlight (Top 5% of accepted papers). Congrats Seongmin!}
}
@inproceedings{ICSE25-invivo,
author = {Octavio Galland and Marcel B{\"o}hme},
title = {Invivo Fuzzing by Amplifying Actual Executions},
year = {2025},
booktitle = {Proceedings of the 47th International Conference on Software Engineering},
series = {ICSE'25},
abstract = {Don't attach a fuzzer using fuzz drivers! Inject a fuzzer and amplify any state.},
numpages = {13},
doi = {10.1109/ICSE55347.2025.00172},
pdf_url = {papers/ICSE25-invivo.pdf},
artifact_url = {https://github.com/OctavioGalland/afllive},
artifact-badge-available_url = {},
artifact-badge-functional_url = {},
artifact-badge-reusable_url = {}
}
@inproceedings{ICSE25-leak,
author = {Seongmin Lee and Shreyas Minocha and Marcel B{\"o}hme},
title = {Accounting for Missing Events in Statistical Information Leakage Analysis},
year = {2025},
booktitle = {Proceedings of the 47th International Conference on Software Engineering},
series = {ICSE'25},
abstract = {Estimating software privacy in the small sample regime.},
numpages = {12},
doi = {10.1109/ICSE55347.2025.00018},
pdf_url = {papers/ICSE25-leak.pdf},
artifact_url = {https://github.com/niMgnoeSeeL/ChaoMI},
artifact-badge-available_url = {},
artifact-badge-functional_url = {}
}
@inproceedings{FSE25-mendelfuzz,
author = {Han Zheng and Flavio Toffalini and Marcel B{\"o}hme and Mathias Payer},
title = {MendelFuzz: The Return of the Deterministic Stage},
year = {2025},
booktitle = {Proceedings of the ACM International Conference on the Foundations of Software Engineering},
series = {FSE'25},
abstract = {Can a fuzzer cover more code with minimal corruption of the initial seed?},
numpages = {21},
doi = {10.1145/3715713},
pdf_url = {papers/FSE25-mendelfuzz.pdf},
artifact_url = {http://github.com/HexHive/MendelFuzz-Artifact},
award = {Adopted as default mode in the most widely-used fuzzer AFL++ since v4.10c.},
artifact-badge-available_url = {},
artifact-badge-functional_url = {},
artifact-badge-reusable_url = {}
}
@inproceedings{USENIX24-ml4sec,
author = {Niklas Risse and Marcel B{\"o}hme},
title = {Uncovering the Limits of Machine Learning for Automatic Vulnerability Detection},
year = {2024},
booktitle = {Proceedings of the 33rd USENIX Security Symposium},
series = {USENIX Sec'24},
abstract = {Are machine learning models for vulnerability discovery as good as they seem?},
numpages = {19},
pdf_url = {papers/USENIX24-ml4sec.pdf},
artifact_url = {https://github.com/niklasrisse/USENIX_2024},
github_url = {https://github.com/niklasrisse/VPP},
slides_url = {https://www.usenix.org/system/files/usenixsecurity24_slides-risse.pdf}
}
@inproceedings{CCS24-lmtest,
author = {G. Barthe and M. B{\"o}hme and S. Cauligi and C. Chuengsatiansup and D. Genkin and M. Guarnieri and D. Romero and P. Schwabe and D. Wu and Y. Yarom},
title = {Testing Side-Channel Security of Cryptographic Implementations Against Future Microarchitectures},
year = {2024},
booktitle = {Proceedings of the 31st ACM Conference on Computer and Communications Security},
series = {CCS'24},
abstract = {How to find side-channels in crypto implementations running on future microarchitectures.},
numpages = {16},
doi = {10.1145/3658644.3670319},
pdf_url = {papers/CCS24-lmtest.pdf},
artifact_url = {https://github.com/hw-sw-contracts/leakage-model-testing},
award = {Our paper won the ACM SIGSAC Distinguished Paper Award at CCS'24. Congrats all!}
}
@inproceedings{ICSE24-predict,
author = {Liyanage, Danushka and Lee, Seongmin and Tantithamthavorn, Chakkrit and B{\"o}hme, Marcel},
title = {Extrapolating Coverage Rate in Greybox Fuzzing},
year = {2024},
booktitle = {Proceedings of the 46th International Conference on Software Engineering},
series = {ICSE'24},
abstract = {How to *predict* the coverage rate of a greybox fuzzer in the future.},
numpages = {13},
doi = {10.1145/3597503.3639198},
pdf_url = {papers/ICSE24-predict.pdf},
artifact_url = {https://doi.org/10.5281/zenodo.10460578},
artifact_doi = {10.5281/zenodo.10460578},
artifact-badge-available_url = {},
artifact-badge-functional_url = {},
artifact-badge-reusable_url = {}
}
@inproceedings{NDSS24-chatafl,
author = {Ruijie Meng and Martin Mirchev and Marcel B\"{o}hme and Abhik Roychoudhury},
booktitle = {Proceedings of the Network and Distributed System Security Symposium},
series = {NDSS'24},
title = {Large Language Model guided Protocol Fuzzing},
abstract = {How to make a fuzzer ask ChatGPT about the correct structure and order of messages as specified in 100+ pages of RFC.},
year = {2024},
numpages = {15},
pdf_url = {papers/NDSS24-chatafl.pdf},
artifact_url = {https://zenodo.org/doi/10.5281/zenodo.8373804},
artifact_doi = {10.5281/zenodo.8373804},
github_url = {https://github.com/ChatAFLndss/ChatAFL},
award = {Number 29 in the Normalized Top-100 Security Papers of all time.},
artifact-badge-available_url = {},
artifact-badge-functional_url = {},
artifact-badge-reusable_url = {}
}
@article{TSE24-learn2fix,
author = {Charaka Geethal Kapugama and B\"{o}hme, Marcel and Pham, Van-Thuan},
journal = {IEEE Transactions on Software Engineering},
series = {TSE},
title = {Human-In-The-Loop Automatic Program Repair},
abstract = {Learn2fix automatically negotiates with the user the condition under which the bug is observed before it repairs the bug.},
year = {2024},
numpages = {24},
doi = {10.1109/TSE.2023.3305052},
note = {Journal extension of our homonymous ICST'20 paper.},
pdf_url = {papers/TSE24-learn2fix.pdf},
artifact_url = {https://github.com/charakageethal/learn2fix-journal-ext/}
}
@article{TOSEM24-dpsbst,
author = {Perera, Anjana and Turhan, Burak and Aleti, Aldeida and B\"{o}hme, Marcel},
title = {On the Impact of Lower Recall and Precision in Defect Prediction for Guiding Search-based Software Testing},
series = {TOSEM},
year = {2024},
issue_date = {July 2024},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {33},
number = {6},
issn = {1049-331X},
pdf_url = {https://doi.org/10.1145/3655022},
doi = {10.1145/3655022},
journal = {ACM Transactions on Software Engineering and Methodology},
month = jun,
articleno = {144},
numpages = {27},
artifact_url = {https://doi.org/10.6084/m9.figshare.16564146},
artifact_doi = {10.6084/m9.figshare.16564146}
}
@article{CACM23-entropic,
author = {B\"{o}hme, Marcel and Man\`{e}s, Valentin J. M. and Cha, Sang Kil},
title = {Boosting Fuzzer Efficiency: An Information Theoretic Perspective},
year = {2023},
issue_date = {November 2023},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {66},
number = {11},
issn = {0001-0782},
url = {https://doi.org/10.1145/3611019},
doi = {10.1145/3611019},
journal = {Communcations of the ACM},
series = {CACM},
month = {Oct},
pages = {89–97},
numpages = {9},
abstract = {Every generated input reveals some information about the program. Maximizing information maximizes efficiency.},
pdf_url = {papers/CACM23-entropic.pdf},
artifact_url = {https://doi.org/10.6084/m9.figshare.12415622},
artifact_doi = {10.6084/m9.figshare.12415622},
award = {CACM Research Highlight for the month of November. CACM a journal sent to all members of the ACM.},
note = {CACM Technical Perspective: "What's all the fuss about fuzzing?" by the amazing Gordon Fraser!}
}
@inproceedings{FSE23-reachability,
author = {Lee, Seongmin and B{\"o}hme, Marcel},
title = {Statistical Reachability Analysis},
booktitle = {Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering},
series = {ESEC / FSE'23},
year = {2023},
numpages = {12},
doi = {10.1145/3611643.3616268},
abstract = {Quantiative program analysis using a statistical rather than an analytical approach.},
pdf_url = {papers/FSE23-reachability.pdf},
artifact_url = {https://doi.org/10.5281/zenodo.8267404},
artifact_doi = {10.5281/zenodo.8267404},
artifact-badge-available_url = {},
artifact-badge-functional_url = {},
artifact-badge-reusable_url = {}
}
@inproceedings{ASE23-preciseApprox,
author = {Nikhil Parasaram and Earl T. Barr and Sergey Mechtaev and Marcel B{\"o}hme},
booktitle = {Proceedings of the 38th IEEE/ACM International Conference on Automated Software Engineering},
numpages = {12},
publisher = {Association for Computing Machinery},
series = {ASE'23},
title = {Precise Data-Driven Approximation for Program Analysis via Fuzzing},
year = {2023},
doi = {10.1109/ASE56229.2023.00185},
abstract = {Marry static analysis to over-/under-approx. the valid state space and fuzzing + stats to estimate the degree of validity.},
pdf_url = {papers/ASE23-preciseApprox.pdf},
artifact_url = {https://doi.org/10.5281/zenodo.7902214},
artifact_doi = {10.5281/zenodo.7902214}
}
@inproceedings{ICSE23-effectiveness,
author = {Liyanage, Danushka and B{\"o}hme, Marcel and Tantithamthavorn, Chakkrit and Lipp, Stephan},
title = {Reachable Coverage: Estimating Saturation in Fuzzing},
year = {2023},
booktitle = {Proceedings of the 45th International Conference on Software Engineering},
series = {ICSE'23},
numpages = {13},
doi = {10.1109/ICSE48619.2023.00042},
abstract = {Estimating the maximum achievable coverage by automatic test input generation.},
note = {Featured in the Fuzzing Weekly Newsletter (CW5).},
pdf_url = {papers/ICSE23-effectiveness.pdf},
artifact_url = {https://doi.org/10.5281/zenodo.7571359},
artifact_doi = {10.5281/zenodo.7571359},
artifact-badge-available_url = {},
artifact-badge-reusable_url = {}
}
@inproceedings{ICSE23-debug-assumptions,
author = {Soremekun, Ezekiel and Kirschner, Lukas and B\"{o}hme, Marcel and Papadakis, Mike},
title = {Evaluating the Impact of Experimental Assumptions in Automated Fault Localization},
booktitle = {Proceedings of the ACM/IEEE 45th International Conference on Software Engineering},
series = {ICSE'23},
numpages = {13},
year = {2023},
doi = {10.1109/ICSE48619.2023.00025},
abstract = {Evaluating the assumptions that researchers make during debugging tool evaluations.},
pdf_url = {papers/ICSE23-debug-assumptions.pdf},
artifact_url = {https://figshare.com/articles/conference_contribution/Debugging_Assumptions_Artifact/21786743},
artifact_doi = {10.6084/m9.figshare.21786743.v6},
website_url = {https://debugging-assumptions.github.io/},
artifact-badge-available_url = {},
artifact-badge-reusable_url = {}
}
@inproceedings{ISSTA23-green,
author = {Lipp, Stephan and Elsner, Daniel and Kacianka, Severin and Pretschner, Alexander and B{\"o}hme, Marcel and Banescu, Sebastian},
title = {Green Fuzzing: A Saturation-based Stopping Criterion using Vulnerability Prediction},
booktitle = {Proceedings of the 32nd ACM/SIGSOFT International Symposium on Software Testing and Analysis},
series = {ISSTA'23},
doi = {10.1145/3597926.3598043},
year = {2023},
numpages = {13},
abstract = {We suggest to stop a fuzzing campaign when the coverage of potentially vulnerable code saturates.},
pdf_url = {papers/ISSTA23-green.pdf},
artifact_url = {https://doi.org/10.5281/zenodo.7944722},
artifact_doi = {10.5281/zenodo.7944722},
github_url = {https://github.com/tum-i4/green-fuzzing-artifacts/tree/1.0.0},
artifact-badge-available_url = {},
artifact-badge-functional_url = {}
}
@inproceedings{FSE23-src,
author = {Niklas Risse},
title = {Detecting Overfitting of Machine Learning Techniques for Automatic Vulnerability Detection},
booktitle = {Student Research Competition (SRC) at the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering},
pdf_url = {papers/FSE23-src.pdf},
series = {ESEC / FSE'23 (SRC)},
year = {2023},
doi = {10.1145/3611643.3617845},
numpages = {3},
award = {Niklas won 2nd place in the ACM FSE Student Research Competition. Congrats Niklas!}
}
@inproceedings{SBFT23-cicd,
author = {Klooster, Thijs and Turkmen, Fatih and Broenink, Gerben and Hove, Ruben Ten and B{\"o}hme, Marcel},
booktitle = {2023 IEEE/ACM International Workshop on Search-Based and Fuzz Testing},
series = {SBFT'23},
title = {Continuous Fuzzing: A Study of the Effectiveness and Scalability of Fuzzing in CI/CD Pipelines},
year = {2023},
pages = {25-32},
numpages = {13},
doi = {10.1109/SBFT59156.2023.00015},
pdf_url = {https://arxiv.org/abs/2205.14964},
abstract = {How to integrate fuzzing in a CI/CD pipeline, where time is limited but the analysis can be incremental?},
artifact_url = {https://github.com/kloostert/CICDFuzzBench},
github_url = {https://github.com/kloostert/CICDFuzzBench}
}
@inproceedings{AISEC23-promises,
author = {Erik Imgrund and Tom Ganz and Martin Härterich and Lukas Pirch and Niklas Risse and Konrad Rieck},
title = {Broken Promises: Measuring Confounding Effects in Learning-based Vulnerability Discovery},
year = {2023},
numpages = {11},
doi = {10.1145/3605764.3623915},
booktitle = {Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security},
series = {AISec'23},
pdf_url = {https://mlsec.tu-berlin.de/docs/2023-aisec.pdf},
}
@inproceedings{ICSE22-benchmarking,
author = {B{\"o}hme, Marcel and Szekeres, L{\'a}szl{\'o} and Metzman, Jonathan},
title = {On the Reliability of Coverage-based Fuzzer Benchmarking},
year = {2022},
booktitle = {Proceedings of the 44th International Conference on Software Engineering},
series = {ICSE'22},
numpages = {13},
doi = {10.1145/3510003.3510230},
pdf_url = {papers/ICSE22-benchmarking.pdf},
abstract = {We find a strong correlation but no strong agreement on fuzzer superiority in terms of coverage versus bugs.},
artifact_doi = {10.5281/zenodo.6045830},
artifact_url = {https://doi.org/10.5281/zenodo.6045830},
github_url = {https://github.com/icse22data/},
slides_url = {https://www.slideshare.net/mboehme/on-the-reliability-of-coveragebased-fuzzer-benchmarking}
}
@inproceedings{SEC22-sgfuzz,
author = {Ba, Jinsheng and B{\"o}hme, Marcel and Mirzamomen, Zahra and Roychoudhury, Abhik},
title = {Stateful Greybox Fuzzing},
booktitle = {Proceedings of the 31st USENIX Security Symposium},
series = {USENIX SEC'22},
year = {2022},
numpages = {18},
abstract = {Navigating an unknown state space by identifying and monitoring state variables values.},
pdf_url = {papers/SEC22-sgfuzz.pdf},
artifact_url = {https://github.com/bajinsheng/SGFuzz},
slides_url = {https://www.usenix.org/system/files/sec22_slides-ba.pdf}
}
@inproceedings{ISSTA22-grammar2fix,
author = {Geethal, Charaka and Pham, Van-Thuan and Aleti, Aldeida and B{\"o}hme, Marcel},
title = {Human-in-the-Loop Oracle Learning for Semantic Bugs in String Processing Programs},
booktitle = {Proceedings of the 31st ACM/SIGSOFT International Symposium on Software Testing and Analysis},
series = {ISSTA'22},
year = {2022},
numpages = {12},
doi = {10.1145/3533767.3534406},
abstract = {Learning to identify semantic bugs for string processing programs.},
artifact_doi = {10.5281/zenodo.6530839},
artifact_url = {https://doi.org/10.5281/zenodo.6530839},
github_url = {https://github.com/charakageethal/grammar2fix},
artifact-badge-available_url = {},
artifact-badge-functional_url = {}
}
@article{TSE23-defectSBST,
title = {An Experimental Assessment of Using Theoretical Defect Predictors to Guide Search-based Software Testing},
author = {Anjana Perera and Aldeida Aleti and Burak Turhan and Marcel B{\"o}hme},
year = {2023},
doi = {10.1109/TSE.2022.3147008},
volume = {49},
pages = {131--146},
journal = {IEEE Transactions on Software Engineering},
issn = {0098-5589},
publisher = {IEEE, Institute of Electrical and Electronics Engineers},
series = {TSE'23},
pdf_url = {papers/TSE23-defectSBST.pdf},
abstract = {What is the impact of defect predictor accuracy on defectiveness-guided test generation?},
artifact_url = {https://github.com/premosa-sbst}
}
@inproceedings{ICSE22-NIER-statistical,
author = {B\"{o}hme, Marcel},
title = {Statistical Reasoning About Programs},
booktitle = {Proceedings of the 44th International Conference on Software Engineering},
series = {ICSE'22 (NIER)},
year = {2022},
location = {Pittsburgh, USA},
numpages = {5},
doi = {10.1145/3510455.3512796},
pdf_url = {papers/ICSE22-NIER-statistical.pdf},
abstract = {Open challenges and new research directions for automated program analysis at scale.},
slides_url = {https://www.slideshare.net/mboehme/statistical-reasoning-about-programs}
}
@article{IEEESW21-challenges,
author = {B{\"o}hme, Marcel and Cadar, Cristian and Roychoudhury, Abhik},
journal = {IEEE Software},
title = {Fuzzing: Challenges and Opportunities},
year = {2021},
pages = {1--9},
numpages = {9},
doi = {10.1109/MS.2020.3016773},
series = {IEEE Software},
pdf_url = {papers/IEEESW21-challenges.pdf},
abstract = {A resource for practitioners and researchers to learn about the main open challenges in fuzzing and symbolic execution.},
note = {This is the outcome of a 3-day meeting of thought leaders and rising stars, both in industry and academia. We are happy to publish these results in the premier magazine (and journal) for software practitioners.},
slides_url = {https://www.slideshare.net/mboehme/fuzzing-challenges-and-reflections}
}
@inproceedings{CCS21-aflchurn,
author = {Zhu, Xiaogang and B{\"o}hme, Marcel},
title = {Regression Greybox Fuzzing},
booktitle = {Proceedings of the 28th ACM Conference on Computer and Communications Security},
series = {CCS'21},
year = {2021},
pdf_url = {papers/CCS21-aflchurn.pdf},
doi = {10.1145/3460120.3484596},
numpages = {12},
abstract = {Once a program is well-fuzzed, most bugs found are regressions. Fuzz all commits at once, but focus on recent ones.},
github_url = {https://github.com/aflchurn/aflchurn},
artifact_url = {https://www.kaggle.com/marcelbhme/aflchurn-ccs21/code}
}
@article{EMSE21-slicing,
author = {Soremekun, Ezekiel and Kirschner, Lukas and B{\"o}hme, Marcel and Zeller, Andreas},
doi = {10.1007/s10664-020-09931-7},
journal = {Empirical Software Engineering},
number = {3},
pages = {51},
title = {Locating faults with program slicing: an empirical analysis},
volume = {26},
year = {2021},
series = {EMSE'21},
abstract = {Empirical comparison of statistical fault localization and dynamic program slicing along more realistic assumptions.},
note = {Congrats to Ezekiel, Lukas, and Andreas! Ezekiel started this work with when I was still a PostDoc in Andreas' team.},
pdf_url = {papers/EMSE21-slicing.pdf},
artifact_url = {https://doi.org/10.6084/m9.figshare.13369400.v1},
artifact_doi = {10.6084/m9.figshare.13369400.v1}
}
@inproceedings{FSE21-residualrisk,
author = {B{\"o}hme, Marcel and Liyanage, Danushka and W{\"u}stholz, Valentin},
title = {Estimating Residual Risk in Greybox Fuzzing},
booktitle = {Proceedings of the 15th Joint meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering},
series = {ESEC / FSE'21},
year = {2021},
pages = {494-504},
numpages = {12},
doi = {10.1145/3468264.3468570},
pdf_url = {papers/FSE21-residualrisk.pdf},
abstract = {After 24hrs no crashes, you abort the campaign. What is the change to see a crash if you generated one more input?},
note = {Congrats Danushka on his first paper. Exciting work with our industry collaborator Valentin. We are breaking new ground!
Shoutout J. Campbell (Microsoft) finds this direction interesting for large-scale fuzzing campaigns in OneFuzz to maximize bug finding within the compute budget.},
artifact_url = {https://doi.org/10.5281/zenodo.4970239},
artifact_doi = {10.5281/zenodo.4970239},
github_url = {https://github.com/Adaptive-Bias/fse21_paper270},
artifact-badge-available_url = {},
artifact-badge-reusable_url = {}
}