Automatic exploit generation (AEG) is the challenge of determining the exploitability of a given vulnerability by exploring all possible execution paths that can result from triggering the vulnerability. Since typical AEG implementations might need to explore an unbounded number of execution paths, they usually utilize a fuzz tester and a symbolic execution tool to facilitate this task. However, in the case of language virtual machines, such as the ActionScript Virtual Machine (AVM), AEG implementations cannot leverage fuzz testers or symbolic execution tools for generating the exploit script, because of two reasons: (1) fuzz testers cannot efficiently generate grammatically correct executables for the AVM due to the improbability of randomly generating highly-structured executables that follow the complex grammar rules and (2) symbolic execution tools encounter the well-known program-state-explosion problem due to the enormous number of control paths in early processing stages of a language virtual machine (e.g., lexing and parsing).

This paper surveys the area of in-lined reference monitors (IRMs), a language-based security enforcement technology that has gained much popularity in the recent past. IRMs enforce given security policies in target applications by inserting dynamic security guards into these applications; the guards check for impending policy violations at runtime. IRMs keep track of security state and can thus enforce rich, history-based policies. This survey discusses IRMs for a variety of programming languages, application execution platforms, and security policy specification languages. The survey also discusses the benefits and importance of adding IRM certification, and the technical and managerial challenges of employing IRMs.