Not sure about the posted paper, but another recent work that comes to mind is from David Brumley's group at CMU: http://security.ece.cmu.edu/aeg/ http://secur

Not sure about the posted paper, but another recent work that comes to mind is from David Brumley's group at CMU: http://security.ece.cmu.edu/aeg/ http://security.ece.cmu.edu/aeg/ "Automatic Exploit Generation" which does basically this. (I haven't read enough of either paper to understand how similar the analyses are, but both seem to be based on symbolic execution.)