Symbolic optimization with SMT solvers

LiYi,; AlbarghouthiAws,; KincaidZachary,; Gurfinkel, Arie; ChechikMarsha,

doi:10.1145/2578855.2535857

Cited by 26 publications

(3 citation statements)

References 64 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this work, we extend the path abstraction in an advanced fuzzer Pangolin [20], which has optimized the objective expressions of a state-of-theart abstraction inference method BWAI [16] for fuzzing. BWAI formulates the abstraction as an SMT-based optimization problem (SMT-Opt) [25]. It enumerates all linear relationships between input variables and solves these linear expressions subject to path constraints to get the boundaries of each input byte.…”

Section: Exploration Difficulty Analysismentioning

confidence: 99%

ShadowBug: Enhanced Synthetic Fuzzing Benchmark Generation

Zhou,

Wang

2024

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

Fuzzers have proven to be a vital tool in identifying vulnerabilities. As an area of active research, there is a constant drive to improve fuzzers, and it is equally important to improve benchmarks used to evaluate their performance alongside evolving heuristics. Current research has primarily focused on using CVE bugs as benchmarks, with synthetic benchmarks receiving less attention due to concerns about overfitting specific fuzzing heuristics. In this paper, we introduce ShadowBug, a new methodology that generates enhanced synthetic bugs. In contrast to existing synthetic benchmarks, our approach involves well-arranged bugs that fit specific distributions by quantifying the constraint-solving difficulty of each block. We also uncover implicit constraints of real-world bugs that prior research has overlooked and develop an integer-overflow-based transformation from normal constraints to their implicit forms. We construct a synthetic benchmark and evaluate it against five prominent fuzzers. The experiments reveal that 391 out of 466 bugs were detected, which confirms the practicality and effectiveness of our methodology. Additionally, we introduce a finer-grained evaluation metric called "bug difficulty," which sheds more light on their heuristic strengths with regard to constraint-solving and bug exploitation. The results of our study have practical implications for future fuzzer evaluation methods.

show abstract

Section: Exploration Difficulty Analysismentioning

confidence: 99%

ShadowBug: Enhanced Synthetic Fuzzing Benchmark Generation

Zhou,

Wang

2024

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

show abstract

“…As a result, there are several powerful SMT solvers, such as MathSAT5 [10], Yices 2.2 [14], and Z3 [13]. Applications of SMT solving arise on supervisory control of discrete-event systems [25], verification of neural networks [19], optimization [20], and beyond.…”

Section: Background On Smtmentioning

confidence: 99%

Computation of the Transient in Max-Plus Linear Systems via SMT-Solving

Abate

Cimatti

Micheli

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper proposes a new approach, grounded in Satisfiability Modulo Theories (SMT), to study the transient of a Max-Plus Linear (MPL) system, that is the number of steps leading to its periodic regime. Differently from state-of-the-art techniques, our approach allows the analysis of periodic behaviors for subsets of initial states, as well as the characterization of sets of initial states exhibiting the same specific periodic behavior and transient. Our experiments show that the proposed technique dramatically outperforms state-of-the-art methods based on max-plus algebra computations for systems of large dimensions.

show abstract

“…As a result, there are several powerful SMT solvers, such as MathSAT5 [27], Yices 2.6 [28], and Z3 [29], that can support different a variety of theories and their combinations [30]. Applications of SMT solving arise on supervisory control of discrete-event systems [31], verification of neural networks [32], optimization [33], and beyond.…”

Section: Satisfiability Modulo Theorymentioning

confidence: 99%

Bounded Model Checking of Max-Plus Linear Systems via Predicate Abstractions

Mufid

Adzkiya

Abate

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper introduces the abstraction of max-plus linear (MPL) systems via predicates. Predicates are automatically selected from system matrix, as well as from the specifications under consideration. We focus on verifying time-difference specifications, which encompass the relation between successive events in MPL systems. We implement a bounded model checking (BMC) procedure over a predicate abstraction of the given MPL system, to verify the satisfaction of time-difference specifications. Our predicate abstractions are experimentally shown to improve on existing MPL abstractions algorithms. Furthermore, with focus on the BMC algorithm, we can provide an explicit upper bound on the completeness threshold by means of the transient and the cyclicity of the underlying MPL system.

show abstract

Symbolic optimization with SMT solvers

Cited by 26 publications

References 64 publications

ShadowBug: Enhanced Synthetic Fuzzing Benchmark Generation

ShadowBug: Enhanced Synthetic Fuzzing Benchmark Generation

Computation of the Transient in Max-Plus Linear Systems via SMT-Solving

Bounded Model Checking of Max-Plus Linear Systems via Predicate Abstractions

Contact Info

Product

Resources

About