ASE 2025
Sun 16 - Thu 20 November 2025 Seoul, South Korea

This program is tentative and subject to change.

Tue 18 Nov 2025 16:50 - 17:00 at Grand Hall 2 - Security 6

Fuzzing is widely used for software robustness testing. However, its application in commercial communication modules remains limited due to several key challenges, including labor-intensive template generation, lack of coverage collection support, limited testing performance, and inconsistencies between practical hardware and software CI/CD processes. In collaboration with China Mobile IoT, we present FuzzCM, a comprehensive protocol fuzzing framework tailored for commercial communication modules. FuzzCM employs a Retrieval-Augmented Generation (RAG)-enhanced large language model (LLM) to automate template generation and utilizes GPIO-based instrumentation for efficient runtime coverage data collection. Additionally, it leverages a knowledge base constructed from prior tests to guide hybrid mutation strategies and integrates CI/CD across both software and hardware layers, enabling continuous and environment-aware testing. We conducted industrial practice with FuzzCM on five LTE Cat.1 bis modules, identifying 21 previously unknown bugs, 15 of which have been fixed. The results demonstrate that FuzzCM outperforms both manual methods and the Peach* approach, achieving average coverage improvements of 51% and 29%, respectively, with overall coverage reaching 85%.

This program is tentative and subject to change.

Tue 18 Nov

Displayed time zone: Seoul change

16:00 - 17:00
16:00
10m
Talk
Measuring Software Resilience Using Socially Aware Truck Factor Estimation
NIER Track
Alexis Butler Royal Holloway University of London, Dan O'Keeffe Royal Holloway, University of London, Santanu Dash University of Surrey
16:10
10m
Talk
Should We Evaluate LLM Based Security Analysis Approaches on Open Source Systems?
Industry Showcase
Kohei Dozono Technical University of Munich, Jonas Engesser Technical University of Munich, Benjamin Hummel CQSE GmbH, Alexander Pretschner TU Munich, Tobias Roehm CQSE GmbH
16:20
10m
Talk
DALEQ - Explainable Equivalence for Java Bytecode
Industry Showcase
Jens Dietrich Victoria University of Wellington, Behnaz Hassanshahi Oracle
16:30
10m
Talk
A Secure Mocking Approach towards Software Supply Chain Security
NIER Track
Daisuke Yamaguchi NTT, Inc., Shinobu Saito NTT, Inc., Takuya Iwatsuka NTT, Nariyoshi Chida NTT, Inc, Tachio Terauchi Waseda University
16:40
10m
Talk
TRON: Fuzzing Linux Network Stack via Protocol-System Call Payload Synthesis
Industry Showcase
Qiang Zhang Hunan University, Yifei Chu Tsinghua University, Yuheng Shen Tsinghua University, Jianzhong Liu Tsinghua University, Heyuan Shi Central South University, Yu Jiang Tsinghua University, Wanli Chang College of Computer Science and Electronic Engineering, Hunan University
16:50
10m
Talk
Industry Practice of LLM-Assisted Protocol Fuzzing for Commercial Communication Modules
Industry Showcase
Qiang Fu Central South University, Changjian Liu Central South University, Yuan Ding China Mobile IoT, Chao Fan China Mobile IoT, Yulai Fu , Yuhan Chen Central South Sniversity, Ying Fu Tsinghua University, Ronghua Shi Central South University, Fuchen Ma Tsinghua University, Heyuan Shi Central South University