All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask)

Edward J. Schwartz, Thanassis Avgerinos, David Brumley
[doi] [ISBN] [Google Scholar] [DBLP] [Citeseer] [url]

Proceedings of the 2010 IEEE Symposium on Security and Privacy
SP '10
IEEE Computer Society
USA
Pages 317-331
2010
Note(s): symbolic execution