Weekly Report 2026-04-19

工作任务

1. 调研所有的内核漏洞扫描的sota工具

2. 对其中的某些sota工具进行实验

工作进展

调研内核扫描sota工具

首先通过布尔表达式从四大顶会中搜索相关论文，找到了130篇论文，然后将这130篇论文进行筛选，最终筛选出50篇，并分类，在分类的过程中也了解到了整个漏洞扫描工具的整体研究方向，以下是分类

一、静态SOTA工具

1. LLM直接分析

• LLMxCPG: Context-Aware Vulnerability Detection through Code Property Graph-Guided Large Language Models (USENIX Security 2025)

2. 符号执行

• KRover: A Symbolic Execution Engine for Dynamic Kernel Analysis (ICSE 2023)

• Symbolic Execution for Dynamic Kernel Analysis (ICSE 2024)

3. 静态Checker

通用：

• KNighter: Transforming Static Analysis with LLM-Synthesized Checkers (arXiv 2025)

• Type-Based Call Graph: Unleashing the Power of Type-Based Call Graph Construction by Using Regional Pointer Information (USENIX Security 2024)

特定：

• APP-Miner: Detecting API Misuses via Automatically Mining API Path Patterns (ICSE 2024)

• LR-Miner: Static Race Detection in OS Kernels by Mining Locking Rules (USENIX Security 2024)

• Interrupt Deadlock: When Threads Meet Interrupts: Effective Static Detection of Interrupt-Based Deadlocks in Linux (USENIX Security 2024)

• Inconsistent MM: Detecting Kernel Memory Bugs through Inconsistent Memory Management Intention Inferences (USENIX Security 2024)

• FIRE: Combining Multi-Stage Filtering with Taint Analysis for Scalable Recurring Vulnerability Detection (USENIX Security 2024)

• Error Spec Inference: Inference of Error Specifications and Bug Detection Using Structural Similarities (USENIX Security 2024)

• API Post-Handling: Detecting API Post-Handling Bugs Using Code and Description in Patches (USENIX Security 2023)

• Sailor: Save What Must Be Saved: Secure Context Switching with Sailor (USENIX Security 2025)

• ISA Analysis: Automatic ISA Analysis for Secure Context Switching (arXiv 2025)

• KallGraph: Redefining Indirect Call Analysis with KallGraph (ICSE 2025)

二、动态SOTA工具

1. SoK综述

• SoK: Prudent Evaluation Practices for Fuzzing (IEEE S&P 2024)

• SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing (ISSTA 2024)

• A Qualitative Analysis of Fuzzer Usability and Challenges (ICSE 2025)

2. Fuzz Driver生成

• Utopia: Automatic Generation of Fuzz Driver Using Unit Tests (ICSE 2023)

• Prompt Fuzzing: Prompt Fuzzing for Fuzz Driver Generation (FSE 2024)

3. Syzkaller类工具

(a) Syzlang依赖文件生成

• SyzSpec (ICSE 2025)

• SyzForge (arXiv 2025)

• SyzGen++ (IEEE S&P 2024)

• SyzDescribe (IEEE S&P 2023)

(b) Fuzz目标选择

• SyzParam (ICSE 2025)

• ProphetFuzz (FSE 2024)

• KLAUS (USENIX Security 2023)

(c) 定向Fuzz

• SyzDirect (ICSE 2023)

• SelectFuzz (IEEE S&P 2023)

• DAFL (USENIX Security 2023)

• Titan (IEEE S&P 2024)

• Critical Code Guided Directed Greybox Fuzzing for Commits (USENIX Security 2024)

• IDFuzz (USENIX Security 2025)

(d) 特定Fuzzer

• SegFuzz (IEEE S&P 2023)

• CountDown (FSE 2024)

• DDRace (USENIX Security 2023)

• Fuzzing API Error Handling Behaviors using Coverage Guided Fault Injection (ISSTA 2024)

(e) 种子/输入调度

• SyzVegas (USENIX Security 2021)

• ACTOR (USENIX Security 2023)

• FOX (FSE 2024)

• T-Scheduler (ISSTA 2024)

(f) 覆盖率

• StateFuzz (USENIX Security 2022)

• Arvin (ISSTA 2023)

• Binary Coverage for Kernel Fuzzing (FSE 2024)

• Multi-target Coverage-based Greybox Fuzzing (arXiv 2026)

• SyzRisk (ISSTA 2024)

(g) 内存检测

• Evaluating the Effectiveness of Memory Safety Sanitizers (ICSE 2025)

• CMASan: Custom Memory Allocator-Aware Address Sanitizer (ICSE 2025)

• RangeSanitizer (USENIX Security 2025)

4. 污点分析

• AirTaint: Making Dynamic Taint Analysis Faster and Easier (ICSE 2024)

5. 集成Fuzzer

• autofz: Automated Fuzzer Composition at Runtime (USENIX Security 2023)

对其中的某些sota工具进行实验

由于上述实现有50篇，人工一篇篇复现不现实，于是求助于ai工具，通过现有工具和一些改进，实现整个论文复现+实验的自动化workflow：

首先分为复现和实验，复现是对论文的直接复现，而实验是针对复现成功的实验，进行“传统工具不能检测出riscv漏洞”的实验，按照之前的实验设计，分为3个实验，exp123

使用claude-code的无头版本（即可以一直运行而不会进行用户询问）aris（auto research in sleep），编写repro和exp两份skills，让aris抓取最近一篇未复现的论文进行复现或者实验论文进行实验，并且通过worktree，让这个行为并行

（按照ai声称）最终我整理结果如下：
对于reproduce的论文：

成功复现的有18篇

Partial复现或者复现结果不符合预期的有12篇

复现失败（比如找不到论文的代码仓库）的有19篇

还未开始复现的有4篇

对于进行experiments的实验：

进行exp1的有5篇，4篇完成，1篇基本完成

进行exp3及其变体的有8篇，3篇完成，3篇基本完成，2篇被判定为用户态fuzzer失败

进行exp2及其变体的有1篇，失败1篇

未进行的实验总数是7篇

（exp1及是之前的smatch实验，静态分析内核并与代码量进行比例验证

exp2是之前的召回率实验，之前也是使用sota工具knight进行验证

exp3是之前的覆盖率实验，之前使用syzkaller进行验证）

具体的数据还未进行人工整理