{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T22:12:58Z","timestamp":1784239978997,"version":"3.55.0"},"reference-count":47,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172407"],"award-info":[{"award-number":["62172407"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"Youth Innovation Promotion Association of Chinese Academy of Sciences","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3709126","type":"journal-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:35:32Z","timestamp":1782934532000},"page":"6347-6362","source":"Crossref","is-referenced-by-count":0,"title":["FCovFuzz: Enhancing Processor Fuzzing via Functional-Behavioral Coverage Guidance"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8666-7516","authenticated-orcid":false,"given":"Ruomin","family":"Fang","sequence":"first","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-2746-7331","authenticated-orcid":false,"given":"He","family":"Wang","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-9817-1612","authenticated-orcid":false,"given":"Yanqi","family":"Yang","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-8808-8038","authenticated-orcid":false,"given":"Xu","family":"Chen","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4994-6046","authenticated-orcid":false,"given":"Liwei","family":"Chen","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Miaomiao","family":"Yuan","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Computing Technology, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dan","family":"Tang","sequence":"additional","affiliation":[{"name":"Beijing Institute of Open Source Chip, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-7152-9210","authenticated-orcid":false,"given":"Gang","family":"Shi","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-9868-5353","authenticated-orcid":false,"given":"Dan","family":"Meng","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"12th Generation Intel Core Processor, Specification Update revision 008","year":"2022"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/0-387-21566-2_7"},{"key":"ref3","volume-title":"Revision Guide for AMD Family 10H, Processors Revision 3.92, AMD Corporation","year":"2012"},{"key":"ref4","volume-title":"National Vulnerability Database","year":"2025"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2744769.2747939"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-59418-7_5"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23176"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3650212.3680365"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3650212.3680316"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE55347.2025.00219"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3240765.3240842"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18074.2021.9586289"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3466752.3480092"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00103"},{"key":"ref15","first-page":"1307","article-title":"MorFuzz: Fuzzing processor via runtime instruction morphing enhanced synchronizable co-simulation","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Xu"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD57390.2023.10323819"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2026.3674691"},{"key":"ref18","first-page":"1","article-title":"PathFuzz: Broadening fuzzing horizons with footprint memory for CPUs","volume-title":"Proc. 61st ACM\/IEEE Design Autom. Conf.","author":"Xu"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TVLSI.2019.2926114"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/HOST55118.2023.10133714"},{"key":"ref21","first-page":"5341","article-title":"Cascade: CPU fuzzing via intricate program generation","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Solt"},{"key":"ref22","first-page":"2","article-title":"The rocket chip generator","volume":"4","author":"Asanovic","year":"2016"},{"key":"ref23","article-title":"SonicBOOM: The 3rd generation Berkeley out-of-order machine","volume-title":"Proc. 4th Workshop Comput. Archit. Res. RISC-V","author":"Zhao","year":"2020"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO56248.2022.00080"},{"key":"ref26","volume-title":"VexiiRiscv","year":"2025"},{"key":"ref27","volume-title":"Open Source High-Performance RISC-V Processor. NEMU (NJU Emulator)","author":"OpenXiangShan","year":"2025"},{"key":"ref28","volume-title":"RISC-V Software","year":"2025"},{"key":"ref29","volume-title":"The RISC-V Instruction Set Manual","author":"Waterman","year":"2025"},{"key":"ref30","first-page":"3219","article-title":"TheHuzz: Instruction fuzzing of processors using golden-reference models for finding software-exploitable vulnerabilities","volume-title":"Proc. USENIX Secur. Symp.","author":"Kande"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2020.2996145"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/54.936247"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/HLDVT.2007.4392804"},{"key":"ref34","volume-title":"American Fuzzy Lop","year":"2025"},{"key":"ref35","year":"2020","journal-title":"FCSR \u2018Invalid Operation\u2019 Flag is Not Set"},{"key":"ref37","volume-title":"RVLS: RISC-V Lock Step Simulator","author":"SpinalHDL","year":"2025"},{"key":"ref38","volume-title":"SpinalHDL","year":"2026"},{"key":"ref39","volume-title":"VexRiscv","year":"2025"},{"key":"ref41","first-page":"2577","article-title":"Encarsia: Evaluating CPU fuzzers via automatic bug injection","volume-title":"Proc. 34th USENIX Secur. Symp. (USENIX Secur.)","author":"B\u00f6lcskei"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA68181.2026.11408489"},{"key":"ref43","article-title":"ZynqParrot: A scale-down approach to cycle-accurate, FPGA-accelerated co-emulation","author":"Ruelas-Petrisko","year":"2025","journal-title":"arXiv:2509.20543"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ISCAS51556.2021.9401267"},{"key":"ref45","first-page":"3237","article-title":"Fuzzing hardware like software","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Trippel"},{"key":"ref46","first-page":"1361","article-title":"HyPFuzz: Formal-ASSISTED processor fuzzing","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Chen"},{"key":"ref47","first-page":"1787","article-title":"GenHuzz: An efficient generative hardware fuzzer","volume-title":"Proc. 34th USENIX Secur. Symp. (USENIX Secur.)","author":"Wu"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.23919\/DATE64628.2025.10993080"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAD66269.2025.11240887"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3721133"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11592616.pdf?arnumber=11592616","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T21:49:10Z","timestamp":1784238550000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11592616\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":47,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3709126","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}