Skip to content
STIMSMITH

SearchSYS

Tool
First seen 8/4/2026
Last seen 8/12/2026
Evidence 44 chunks

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

50 connections
gem5 evaluates → 100% 8e
SearchSYS is used to test and evaluate the gem5 simulator.
differential testing implements → 100% 7e
SearchSYS implements differential testing by running outputs on real hardware and simulator.
TinyLlama uses → 100% 6e
TinyLlama is one of the LLMs used by SearchSYS for seed generation.
C Program Generation uses → 100% 6e
SearchSYS uses C program generation via LLMs to create initial seed inputs.
AFL uses → 100% 6e
SearchSYS uses AFL++ as its fuzzing engine.
Magicoder uses → 100% 5e
Magicoder is one of the LLMs used by SearchSYS for seed generation.
CodeBooga uses → 100% 4e
SearchSYS uses CodeBooga as one of its LLMs for test seed generation.
Llama2 uses → 100% 4e
SearchSYS uses Llama2 as one of its LLMs for test seed generation.
Phi2 uses → 100% 4e
SearchSYS uses Phi2 as one of its LLMs for test seed generation.
Ollama uses → 100% 4e
SearchSYS uses Ollama as the infrastructure for running local LLMs.
Search+LLM-based Testing for ARM Simulators ← introduces 100% 4e
The paper presents and discusses SearchSYS as its primary contribution.
Regression Testing uses → 90% 4e
SearchSYS supports regression testing by providing test cases tied to specific features of the ARM ISA.
Fuzzing implements → 100% 4e
SearchSYS implements fuzzing as one of its testing strategies.
GPT-3.5-turbo uses → 100% 4e
SearchSYS uses GPT-3.5-turbo as one of its LLMs for test seed generation.
seed generation uses → 100% 4e
SearchSYS uses LLMs to generate initial seeds for the fuzzing process.
Compiler Optimization Tokens uses → 95% 3e
SearchSYS uses compiler optimization tokens in its prompt templates to diversify LLM-generated test programs.
Binary File Mutation uses → 97% 2e
SearchSYS applies bit-flip mutations only to a program's compiled binary file.
Mutation-Based Testing implements → 100% 2e
SearchSYS applies mutation-based testing via custom mutation operators on binaries and their arguments.
Coverage-Guided Fuzzing implements → 95% 2e
SearchSYS employs coverage-guided fuzzing via AFL++ to explore simulator code.
Prompt Engineering implements → 95% 2e
SearchSYS uses prompt engineering with token-filled templates to guide LLM test generation.
Binary Mutation uses → 100% 2e
SearchSYS applies binary mutation as one of its core mutation operators.
ARM instruction set architecture evaluates → 100% 2e
SearchSYS is applied to evaluate gem5's simulation of the ARM Instruction Set Architecture.
X86 ISA ← compares with 90% 2e
SearchSYS results on ARM ISA are compared with its previous results on X86 ISA.
ChatFuzz ← compares with 85% 2e
ChatFuzz is compared with SearchSYS in related work as a similar LLM-based fuzzing approach.
Custom Mutator uses → 100% 2e
SearchSYS uses custom mutator libraries with AFL++.
seed corpus uses → 100% 2e
SearchSYS uses LLM-generated C programs as seed corpora for fuzzing.
cm-gem5c.so part of → 90% 2e
cm-gem5c.so is part of the SearchSYS custom mutator components.
Parameterized Input Generation uses → 98% 2e
SearchSYS creates test cases with parameterized inputs where LLMs provide types for input parameters.
Prompt Engineering uses → 97% 2e
SearchSYS uses prompt engineering to query LLMs for test program generation.
Zero-Shot Prompting implements → 100% 2e
SearchSYS uses zero-shot prompting to query LLMs for test program generation.
LLM-based Test Code Generation implements → 99% 2e
SearchSYS uses LLMs to create an initial set of test seeds as C source code.
Coverage-Guided Fuzz Testing implements → 98% 2e
SearchSYS uses AFL++-based coverage-guided fuzz testing as one of its main components.
Search-Based Software Testing implements → 90% 2e
SearchSYS is classified as a search-based software testing framework.
Mutation Operators uses → 99% 2e
SearchSYS applies three mutation operators for testing system simulators.
Large Language Model uses → 100% 2e
SearchSYS leverages large language models for initial seed C code generation.
ARM instruction set architecture uses → 98% 2e
SearchSYS is applied to test gem5's simulation of the ARM Instruction Set Architecture.
ARMv8 evaluates → 97% 2e
SearchSYS is used to evaluate gem5's ARMv8 simulation capabilities.
RISC-V mentions → 85% 2e
SearchSYS mentions potential applicability to RISC-V architectures.
X86 Instruction Set Architecture evaluates → 95% 2e
SearchSYS was previously used to find bugs in gem5's X86 architecture simulation.
Karine Even-Mendoza authored by → 100% 1e
Karine Even-Mendoza is one of the authors of SearchSYS.
afl-cmin uses → 97% 1e
SearchSYS uses afl-cmin for test suite minimization before fuzzing.
Test Suite Minimization uses → 95% 1e
SearchSYS uses afl-cmin for test suite minimization before fuzzing campaigns.
test suite generation uses → 100% 1e
SearchSYS generates test suites using LLMs and fuzzing.
CodeLlama uses → 95% 1e
SearchSYS uses CodeLlama as one of the LLMs for test seed generation.
Bobby R. Bruce authored by → 100% 1e
Bobby R. Bruce is one of the authors of SearchSYS.
Justyna Petke authored by → 100% 1e
Justyna Petke is one of the authors of SearchSYS.
cm-gem5c-types.so part of → 90% 1e
cm-gem5c-types.so is part of the SearchSYS custom mutator components.
Aidan Dakhama authored by → 100% 1e
Aidan Dakhama is one of the authors of SearchSYS.
C Token Categories for Prompt Templates uses → 97% 1e
SearchSYS uses four C token categories to fill gaps in the template prompts for LLMs.
cm-gem5c-bin.so part of → 90% 1e
cm-gem5c-bin.so is part of the SearchSYS custom mutator components.