{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:41:32Z","timestamp":1785512492978,"version":"3.56.0"},"reference-count":27,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2016,5]]},"DOI":"10.1109\/sp.2016.15","type":"proceedings-article","created":{"date-parts":[[2016,8,18]],"date-time":"2016-08-18T16:34:03Z","timestamp":1471538043000},"page":"110-121","source":"Crossref","is-referenced-by-count":218,"title":["LAVA: Large-Scale Automated Vulnerability Addition"],"prefix":"10.1109","author":[{"given":"Brendan","family":"Dolan-Gavitt","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Patrick","family":"Hulin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Engin","family":"Kirda","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tim","family":"Leek","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Andrea","family":"Mambretti","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wil","family":"Robertson","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Frederick","family":"Ulrich","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ryan","family":"Whelan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref10","article-title":"NIST software assurance metrics and tool evaluation (SAMATE) project","author":"kass","year":"2005","journal-title":"Workshop on the Evaluation of Software Defect Detection Tools"},{"key":"ref11","article-title":"Using a diagnostic corpus of C programs to evaluate buffer overflow detection by static analysis tools","author":"kratkiewicz","year":"2005","journal-title":"Proc of Workshop on the Evaluation of Software Defect Detection Tools"},{"key":"ref12","article-title":"BugBench: A benchmark for evaluating bug detection tools","author":"lu","year":"2005","journal-title":"Workshop on the Evaluation of Software Defect Detection Tools"},{"key":"ref13","article-title":"Benchmarking bug detection tools","author":"meftah","year":"2005","journal-title":"Workshop on the Evaluation of Software Defect Detection Tools"},{"key":"ref14","article-title":"Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software","author":"newsome","year":"2005","journal-title":"Network and Distributed Systems Symposium (NDSS)"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/1094855.1094866"},{"key":"ref16","article-title":"A practical dynamic buffer overflow detector","author":"ruwase","year":"2004","journal-title":"NDSS"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ISSREW.2015.7392027"},{"key":"ref18","article-title":"Bug specimens are important","author":"spacco","year":"2005","journal-title":"Workshop on the Evaluation of Software Defect Detection Tools"},{"key":"ref19","article-title":"Ponte Technologies LLC, and i_SW LLC","year":"2014","journal-title":"STONESOUP phase 3 test generation report Technical report"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/1950365.1950396"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/1029894.1029911"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.31"},{"key":"ref6","article-title":"Tunable cyber defensive security mechanisms","year":"2015"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2843859.2843867"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2009.5070546"},{"key":"ref7","article-title":"A call for a public bug and tool registry","author":"foster","year":"2005","journal-title":"Workshop on the Evaluation of Software Defect Detection Tools"},{"key":"ref2","article-title":"Center for Assured Software. Juliet test suite v1.2 user guide","year":"2012","journal-title":"Technical Report"},{"key":"ref9","article-title":"Dowsing for overflows: A guided fuzzer to find buffer boundary violations","author":"haller","year":"2013","journal-title":"In Proceedings of the 22nd USENIX Security Symposium (USENIX Security '13)"},{"key":"ref1","article-title":"KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs","author":"cadar","year":"2008","journal-title":"Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation OSDI'08"},{"key":"ref20","article-title":"Hacking team: A zero-day market case study","author":"tsyrklevich","year":"2015"},{"key":"ref22","article-title":"A comparison of publicly available tools for static intrusion prevention","author":"wilander","year":"2002","journal-title":"Proc Nordic Workshop Secure IT Syst"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.37"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"ref23","article-title":"A comparison of publicly available tools for dynamic buffer overflow prevention","author":"wilander","year":"2003","journal-title":"Proc Network and Distributed System Security Symp (NDSS)"},{"key":"ref26","author":"zitser","year":"0","journal-title":"Personal communication"},{"key":"ref25","article-title":"Dynamic buffer overflow detection","author":"zhivich","year":"2005","journal-title":"Workshop on the Evaluation of Software Defect Detection Tools"}],"event":{"name":"2016 IEEE Symposium on Security and Privacy (SP)","location":"San Jose, CA","start":{"date-parts":[[2016,5,22]]},"end":{"date-parts":[[2016,5,26]]}},"container-title":["2016 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"https:\/\/2.zoppoz.workers.dev:443\/http\/xplorestaging.ieee.org\/ielx7\/7528194\/7546461\/07546498.pdf?arnumber=7546498","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,8]],"date-time":"2017-06-08T16:42:56Z","timestamp":1496940176000},"score":1,"resource":{"primary":{"URL":"https:\/\/2.zoppoz.workers.dev:443\/http\/ieeexplore.ieee.org\/document\/7546498\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,5]]},"references-count":27,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.1109\/sp.2016.15","relation":{},"subject":[],"published":{"date-parts":[[2016,5]]}}}