{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:30:27Z","timestamp":1777491027576,"version":"3.51.4"},"reference-count":71,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"23","license":[{"start":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T00:00:00Z","timestamp":1701388800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T00:00:00Z","timestamp":1701388800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,12,1]],"date-time":"2023-12-01T00:00:00Z","timestamp":1701388800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62032010"],"award-info":[{"award-number":["62032010"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CNS-2019340"],"award-info":[{"award-number":["CNS-2019340"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Social Science Foundation of China","doi-asserted-by":"publisher","award":["22CTQ029"],"award-info":[{"award-number":["22CTQ029"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Ministry of Education Philosophy and Social Science Research Foundation of China","award":["21JHQ014"],"award-info":[{"award-number":["21JHQ014"]}]},{"name":"Jiangsu Social Science Foundation","award":["21TQC004"],"award-info":[{"award-number":["21TQC004"]}]},{"name":"Jiangsu Province Frontier Leading Technology and Basic Research Project","award":["BK20202001"],"award-info":[{"award-number":["BK20202001"]}]},{"name":"Doctoral of Entrepreneurship and Innovation Doctoral Program of Jiangsu Province","award":["JSSCBS20210032"],"award-info":[{"award-number":["JSSCBS20210032"]}]},{"name":"Science and Technology Innovation Program of Nanjing Scientists Studying Abroad","award":["126"],"award-info":[{"award-number":["126"]}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["17"],"award-info":[{"award-number":["17"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Internet Things J."],"published-print":{"date-parts":[[2023,12,1]]},"DOI":"10.1109\/jiot.2023.3303780","type":"journal-article","created":{"date-parts":[[2023,8,9]],"date-time":"2023-08-09T17:33:31Z","timestamp":1691602411000},"page":"20718-20734","source":"Crossref","is-referenced-by-count":13,"title":["Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware"],"prefix":"10.1109","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7552-6769","authenticated-orcid":false,"given":"Lingyun","family":"Situ","sequence":"first","affiliation":[{"name":"School of Information Management, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2848-6108","authenticated-orcid":false,"given":"Chi","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8205-5616","authenticated-orcid":false,"given":"Le","family":"Guan","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of Georgia, Athens, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7104-9918","authenticated-orcid":false,"given":"Zhiqiang","family":"Zuo","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4794-1652","authenticated-orcid":false,"given":"Linzhang","family":"Wang","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xuandong","family":"Li","sequence":"additional","affiliation":[{"name":"State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5091-8464","authenticated-orcid":false,"given":"Peng","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Inforaiton Science and Technology, Pennsylvania State University, State College, PA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jin","family":"Shi","sequence":"additional","affiliation":[{"name":"School of Information Management, Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.icte.2017.03.004"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jii.2018.01.005"},{"key":"ref3","volume-title":"Over the air: Exploiting broadcom\u2019s Wi-Fi stack (part 1)","author":"Beniamini","year":"2017"},{"key":"ref4","volume-title":"FreeRTOS TCP\/IP stack vulnerabilities\u2014The details","author":"Karliner","year":"2018"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/96267.96279"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-018-0002-y"},{"key":"ref7","volume-title":"AFL","year":"2023"},{"key":"ref8","volume-title":"Libfuzzer: A library for coverage-guided fuzz testing","year":"2017"},{"key":"ref9","volume-title":"Honggfuzz","author":"Swiecki","year":"2016"},{"key":"ref10","volume-title":"Google oss fuzzing","year":"2016"},{"key":"ref11","volume-title":"Microsoft security risk detection","year":"2016"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66332-6_2"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00040"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2009.5070546"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23404"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00046"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23368"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2090147.2094081"},{"key":"ref20","first-page":"745","article-title":"QSYM: A practical concolic execution engine tailored for hybrid fuzzing","volume-title":"Proc. 27th {USENIX} Secur. Symp.","author":"Yun"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213868"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115618"},{"key":"ref23","article-title":"Not all bytes are equal: Neural byte sieve for fuzzing","author":"Rajpal","year":"2017","journal-title":"arXiv:1711.04596"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213848"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3203217.3203241"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23166"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/2843859.2843867"},{"key":"ref28","first-page":"46","article-title":"QEMU, a fast and portable dynamic translator","volume-title":"Proc. USENIX Annu. Tech. Conf. FREENIX Track","volume":"41","author":"Bellard"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"ref30","first-page":"1099","article-title":"FIRM-AFL: High-throughput greybox fuzzing of IoT firmware via augmented process emulation","volume-title":"Proc. USENIX Secur. Symp.","author":"Zheng"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23229"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.14722\/bar.2018.23017"},{"key":"ref33","first-page":"279","article-title":"Symdrive: testing drivers without devices","volume-title":"USENIX Symp. Operat. Syst. Design Implement","author":"Renzelmann"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427280"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00018"},{"key":"ref36","first-page":"1","article-title":"HALucinator: Firmware re-hosting through abstraction layer emulation","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Clements"},{"key":"ref37","volume-title":"Sulley","year":"2023"},{"key":"ref38","volume-title":"Peach Fuzzer","year":"2023"},{"key":"ref39","volume-title":"Boofuzz","year":"2023"},{"key":"ref40","volume-title":"Afl++","year":"2023"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/1064978.1065034"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/1273442.1250746"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.3837\/tiis.2013.08.014"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23159"},{"key":"ref45","volume-title":"FreeRTOS","year":"2019"},{"key":"ref46","volume-title":"MbedOS","year":"2019"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2007.41"},{"key":"ref48","volume-title":"Fuzzing: Brute Force Vulnerability Discovery","author":"Sutton","year":"2007"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.02.002"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978428"},{"key":"ref51","article-title":"Fairfuzz: Targeting rare branches to rapidly increase greybox fuzz testing coverage","author":"Lemieux","year":"2017","journal-title":"arXiv:1709.07101"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3182657"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-02658-4_53"},{"key":"ref55","first-page":"209","article-title":"KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs","volume-title":"Proc. OSDI","volume":"8","author":"Cadar"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev.2017.14"},{"key":"ref57","first-page":"167","article-title":"KAFL: Hardware-assisted feedback fuzzing for {OS} Kernels","volume-title":"Proc. 26th {USENIX} Secur. Symp.","author":"Schumilo"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00035"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93025-1_4"},{"key":"ref60","first-page":"1","article-title":"Facedancer USB: Exploiting the magic school bus","volume-title":"Proc. REcon Conf.","author":"Goodspeed"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2012.8"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2013.6693084"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/BF01393824"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.15"},{"key":"ref65","volume-title":"ChibiOS","year":"2019"},{"key":"ref66","first-page":"1237","article-title":"P2IM: Scalable and hardware-independent firmware testing via automatic peripheral interface modeling","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Feng"},{"key":"ref67","first-page":"463","article-title":"{FIE} on firmware: Finding vulnerabilities in embedded systems using symbolic execution","volume-title":"22nd {USENIX} Secur. Symp","author":"Davidson"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23294"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134050"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.7"},{"key":"ref71","first-page":"309","article-title":"Inception: System-wide security testing of real-world embedded systems software","volume-title":"Proc. 27th {USENIX} Secur. Symp.","author":"Corteggiani"}],"container-title":["IEEE Internet of Things Journal"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6488907\/10323344\/10214030.pdf?arnumber=10214030","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,1]],"date-time":"2024-03-01T18:49:10Z","timestamp":1709318950000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10214030\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,12,1]]},"references-count":71,"journal-issue":{"issue":"23"},"URL":"https:\/\/doi.org\/10.1109\/jiot.2023.3303780","relation":{},"ISSN":["2327-4662","2372-2541"],"issn-type":[{"value":"2327-4662","type":"electronic"},{"value":"2372-2541","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,12,1]]}}}