{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T05:22:02Z","timestamp":1783574522124,"version":"3.55.0"},"reference-count":47,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T00:00:00Z","timestamp":1782086400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100003453","name":"Natural Science Foundation of Guangdong Province","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100003453","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,6,22]]},"DOI":"10.1109\/dsn69566.2026.00074","type":"proceedings-article","created":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T19:41:43Z","timestamp":1783539703000},"page":"745-757","source":"Crossref","is-referenced-by-count":0,"title":["MTFuzz: A Novel Efficacy Fuzzing Framework for Aerospace Monolithic Firmware"],"prefix":"10.1109","author":[{"given":"Shuai","family":"Wang","sequence":"first","affiliation":[{"name":"Tsinghua University,Tsinghua Shenzhen International Graduate School,Shenzhen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xi","family":"Xiao","sequence":"additional","affiliation":[{"name":"Tsinghua University,Tsinghua Shenzhen International Graduate School,Shenzhen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guangwu","family":"Hu","sequence":"additional","affiliation":[{"name":"Shenzhen Institute of Information Technology,School of Computer Science,Shenzhen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kehuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong,Hong Kong,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Le","family":"Yu","sequence":"additional","affiliation":[{"name":"Nanjing University of Posts and Telecommunications,Nanjing,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chengpei","family":"Tang","sequence":"additional","affiliation":[{"name":"Sun Yat-sen University,School of Advanced Manufacturing,Shenzhen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qing","family":"Li","sequence":"additional","affiliation":[{"name":"Peng Cheng Laboratory,Shenzhen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yong-Jie","family":"Yin","sequence":"additional","affiliation":[{"name":"China Electronics Corporation,Shenzhen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qizhen","family":"Xu","sequence":"additional","affiliation":[{"name":"Xiamen Software Supply Chain Security Public Technology Service Platform,Xiamen,China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00138"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2025.3575691"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3538644"},{"key":"ref4","article-title":"OSS-Fuzz-google\u2019s continuous fuzzing service for open source software","author":"Serebryany","year":"2017"},{"key":"ref5","article-title":"American fuzzy lop","author":"ALEWSKI","year":"2015"},{"key":"ref6","first-page":"5359","article-title":"MultiFuzz: A Multi-Stream fuzzer for testing monolithic firmware","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Chesser"},{"key":"ref7","first-page":"1201","article-title":"HALucinator: Firmware re-hosting through abstraction layer emulation","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Clements"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3582840"},{"key":"ref9","first-page":"1237","article-title":"P2IM: Scalable and hardware-independent firmware testing via automatic peripheral interface modeling","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Feng"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00018"},{"key":"ref11","first-page":"1239","article-title":"Fuzzware: Using precise MMIO modeling for effective firmware fuzzing","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Scharnowski"},{"key":"ref12","article-title":"Sparcs in space: The cobham ut700 leon3ft processor","author":"Shack","year":"2023"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23166"},{"key":"ref14","article-title":"Unicorn engine","year":"2017"},{"key":"ref15","volume-title":"The SPARC Architecture Manual, Version 8","author":"Inc","year":"1992"},{"key":"ref16","volume-title":"ARM\u00aev7-M Architecture Reference Manual","year":"2021"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3423167"},{"issue":"46","key":"ref18","first-page":"10","article-title":"Qemu, a fast and portable dynamic translator","volume-title":"USENIX annual technical conference, FREENIX Track","volume":"41","author":"Bellard"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2843859.2843867"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598039"},{"key":"ref21","first-page":"2007","article-title":"Automatic firmware emulation through invalidity-guided knowledge inference","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Zhou"},{"key":"ref22","article-title":"Hoedur: Embedded firmware fuzzing using multi-stream inputs","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Scharnowski"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23294"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23371"},{"key":"ref26","first-page":"2577","article-title":"GREYONE: Data flow sensitive fuzzing","volume-title":"29th USENIX security symposium (USENIX Security 20)","author":"Gan"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833594"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397372"},{"key":"ref29","article-title":"AFL++: Combining incremental steps of fuzzing research","volume-title":"14th USENIX workshop on offensive technologies (WOOT 20)","author":"Fioraldi"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-51482-1_15"},{"key":"ref31","article-title":"Qemu\u2019s documentation","year":"2025"},{"key":"ref32","doi-asserted-by":"crossref","DOI":"10.1145\/3243734.3243804","article-title":"Evaluating fuzz testing","volume-title":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security","author":"Klees"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00137"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427294"},{"key":"ref36","first-page":"1099","article-title":"FIRM-AFL:High-Throughput greybox fuzzing of IoT firmware via augmented process emulation","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Zheng"},{"key":"ref37","first-page":"2903","article-title":"Forming faster firmware fuzzers","volume-title":"USENIX Security Symposium","author":"Seidel"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23159"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00066"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534414"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.14722\/spacesec.2023.230707"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/AERO58975.2024.10521316"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.14722\/spacesec.2025.23012"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00139"},{"key":"ref45","article-title":"Fuzzbox: Blending fuzzing into emulation for binary-only embedded targets","author":"Cesarano","year":"2025"},{"key":"ref46","article-title":"Tsffs: Target software fuzzer for simics","author":"Hart","year":"2022"},{"key":"ref47","article-title":"Intel simics simulator","year":"2023"}],"event":{"name":"2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN)","location":"Charlotte, NC, USA","start":{"date-parts":[[2026,6,22]]},"end":{"date-parts":[[2026,6,25]]}},"container-title":["2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11593123\/11593173\/11593212.pdf?arnumber=11593212","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T05:12:23Z","timestamp":1783573943000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11593212\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,22]]},"references-count":47,"URL":"https:\/\/doi.org\/10.1109\/dsn69566.2026.00074","relation":{},"subject":[],"published":{"date-parts":[[2026,6,22]]}}}