CS 5963

CS 5963/6963: Applied Software Security Testing

Part 0: Course Intro and Research 101

Monday Meeting	Wednesday Meeting
Jan. 06 Course Introduction (slides)	Jan. 08 Research 101: Ideas (slides)
Jan. 13 Research 101: Writing (slides) Beginner Fuzzing Lab released	Jan. 15 Research 101: Reviewing & Presenting (slides) Sign-up for paper presentations by 11:59pm
Jan. 20 No Class (Martin Luther King Jr. Day)	Jan. 22 Introduction to Fuzzing Readings: Fuzz Revisited: A Re-Examination Of The Reliability Of UNIX Utilities And Services The Relevance of Classic Fuzz Testing: Have We Solved This One?

Part 1: Fuzzing Fundamentals

Monday Meeting	Wednesday Meeting
Jan. 27 Input Generation Readings: Fuzztruction: Using Fault Injection-based Fuzzing to Leverage Implicit Domain Knowledge FuzzInMem: Fuzzing Programs via In-memory Structures Triage Lab released	Jan. 29 Runtime Feedback Readings: Data Coverage for Guided Fuzzing Logos: Log Guided Fuzzing for Protocol Implementations Beginner Fuzzing Lab due by 11:59pm via Canvas
Feb. 03 Bugs & Triage I Readings: Fuzz to the Future: Uncovering Occluded Future Vulnerabilities via Robust Fuzzing Janus: Detecting Rendering Bugs in Web Browsers via Visual Delta Consistency Harnessing Lab released	Feb. 05 Bugs & Triage II Readings: Sleuth: A Switchable Dual-Mode Fuzzer to Investigate Bug Impacts Following a Single PoC SyzBridge: Bridging the Gap in Exploitability Assessment of Linux Kernel Bugs in the Linux Ecosystem Triage Lab due by 11:59pm via Canvas
Feb. 10 Harnessing I Readings: FRIES: Fuzzing Rust Library Interactions via Efficient Ecosystem-Guided Target Generation Atlas: Automating Cross-Language Fuzzing on Android Final Project released	Feb. 12 Harnessing II Readings: Invivo Fuzzing by Amplifying Actual Executions Program Environment Fuzzing
Feb. 17 No Class (President's Day)	Feb. 19 Tackling Roadblocks Readings: Beyond the Coverage Plateau: A Comprehensive Study of Fuzz Blockers Novelty Not Found: Adaptive Fuzzer Restarts to Improve Input Space Coverage Harnessing Lab due by 11:59pm via Canvas Final deadline for approval of a solo project
Feb. 24 Fuzzing Science Readings: SoK: Prudent Evaluation Practices for Fuzzing On Understanding and Forecasting Fuzzers Performance with Static Analysis Sign-up your project team by 11:59pm	Feb. 26 Project Lightning Pitches

Monday Meeting	Wednesday Meeting
Mar. 03 Optimization I Readings: RIFF: Reduced Instruction Footprint for Coverage-Guided Fuzzing Accelerating Fuzzing through Prefix-Guided Execution	Mar. 05 Optimization II Readings: No Linux, No Problem: Fast and Correct Windows Binary Fuzzing via Target-embedded Snapshotting FuzzCache: Optimizing Web Application Fuzzing Through Software-Based Data Cache
Mar. 10 No Class (Spring Break)	Mar. 12 No Class (Spring Break)
Mar. 17 Hybrid Fuzzing I Readings: When Compiler Optimizations Meet Symbolic Execution: An Empirical Study Symbolic execution with SymCC: Don't interpret, compile!	Mar. 19 Hybrid Fuzzing II Readings: SymFit: Making the Common (Concrete) Case Fast for Binary-Code Concolic Execution CO3: Concolic Co-execution for Firmware
Mar. 24 Directed Fuzzing Readings: Everything is Good for Something: Counterexample-Guided Directed Fuzzing via Likely Invariant Inference FISHFUZZ: Catch Deeper Bugs by Throwing Larger Nets	Mar. 26 In-class Project Workday

Monday Meeting

Wednesday Meeting

Mar. 03
Optimization I

Readings:

Mar. 05
Optimization II

Readings:

No Linux, No Problem: Fast and Correct Windows Binary Fuzzing via Target-embedded Snapshotting
FuzzCache: Optimizing Web Application Fuzzing Through Software-Based Data Cache

Mar. 10
No Class (Spring Break)

Mar. 12
No Class (Spring Break)

Mar. 17
Hybrid Fuzzing I

Readings:

Mar. 19
Hybrid Fuzzing II

Readings:

Mar. 24
Directed Fuzzing

Readings:

Mar. 26

In-class Project Workday

Monday Meeting	Wednesday Meeting
Mar. 31 Kernel Fuzzing Readings: Toss a Fault to BpfChecker: Revealing Implementation Flaws for eBPF runtimes with Differential Fuzzing To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux’ Wireless Stacks through VirtIO Devices SyzGen++: Dependency Inference for Augmenting Kernel Driver Fuzzing	Apr. 02 LLM-assisted Fuzzing Readings: Large Language Model guided Protocol Fuzzing Large Language Models are Edge-Case Generators: Crafting Unusual Programs for Fuzzing Deep Learning Libraries Towards Understanding the Effectiveness of Large Language Models on Directed Test Input Generation
Apr. 07 Compiler Fuzzing Readings: AsFuzzer: Differential Testing of Assemblers with Error-Driven Grammar Inference UBfuzz: Finding Bugs in Sanitizer Implementations Boosting Compiler Testing by Injecting Real-World Code	Apr. 09 Hardware Fuzzing Readings: Cascade: CPU Fuzzing via Intricate Program Generation RISCVuzz: Discovering Architectural CPU Vulnerabilities via Differential Hardware Fuzzing CrossFire: Fuzzing macOS Cross-XPU Memory on Apple Silicon
Apr. 14 Fuzzing Configurable Software Readings: Mozi: Discovering DBMS Bugs via Configuration-Based Equivalent Transformation A Little Goes a Long Way: Tuning Configuration Selection for Continuous Kernel Fuzzing ECFuzz: Effective Configuration Fuzzing for Large-Scale Systems	Apr. 16 Final Presentations (Day 1)
Apr. 21 Final Presentations (Day 2) Final Reports due Tuesday by 11:59pm via Canvas	Apr. 23 No Class (Reading Day)

Monday Meeting

Wednesday Meeting

Mar. 31
Kernel Fuzzing

Readings:

Apr. 02
LLM-assisted Fuzzing

Readings:

Apr. 07
Compiler Fuzzing

Readings:

Apr. 09
Hardware Fuzzing

Readings:

Apr. 14
Fuzzing Configurable Software

Readings:

Apr. 16

Final Presentations (Day 1)

Apr. 21

Final Presentations (Day 2)

Final Reports due Tuesday by 11:59pm via Canvas

Apr. 23
No Class (Reading Day)

CS 5963/6963: Applied Software Security Testing

Part 0: Course Intro and Research 101

Part 1: Fuzzing Fundamentals

Part 2: Fuzzing Enhancements

Part 3: New Frontiers in Fuzzing