{"id":"https://openalex.org/W7129065732","doi":"https://doi.org/10.1002/smr.70085","title":"A State\u2010Aware Fuzzing Method for Trusted Execution Environment Kernels","display_name":"A State\u2010Aware Fuzzing Method for Trusted Execution Environment Kernels","publication_year":2026,"publication_date":"2026-02-01","ids":{"openalex":"https://openalex.org/W7129065732","doi":"https://doi.org/10.1002/smr.70085"},"language":"en","primary_location":{"id":"doi:10.1002/smr.70085","doi":"https://doi.org/10.1002/smr.70085","is_oa":true,"landing_page_url":"https://doi.org/10.1002/smr.70085","pdf_url":"https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/smr.70085","source":{"id":"https://openalex.org/S4210172359","display_name":"Journal of Software Evolution and Process","issn_l":"2047-7473","issn":["2047-7473","2047-7481"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1"],"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Software: Evolution and Process","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/smr.70085","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100381938","display_name":"Qiang Zhang","orcid":"https://orcid.org/0000-0002-7859-019X","observed_orcids":["https://orcid.org/0000-0002-7859-019X"]},"institutions":[{"id":"https://openalex.org/I176808543","display_name":"Liaoning Technical University","ror":"https://ror.org/01n2bd587","country_code":"CN","type":"education","lineage":["https://openalex.org/I176808543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiang Zhang","raw_affiliation_strings":["School of Software Liaoning Technical University  Fuxin China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Software Liaoning Technical University  Fuxin China","institution_ids":["https://openalex.org/I176808543"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5146635350","display_name":"Mengjun Guo","orcid":"https://orcid.org/0009-0001-3102-4844","observed_orcids":["https://orcid.org/0009-0001-3102-4844"]},"institutions":[{"id":"https://openalex.org/I176808543","display_name":"Liaoning Technical University","ror":"https://ror.org/01n2bd587","country_code":"CN","type":"education","lineage":["https://openalex.org/I176808543"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Mengjun Guo","raw_affiliation_strings":["School of Software Liaoning Technical University  Fuxin China"],"raw_orcid":"https://orcid.org/0009-0001-3102-4844","affiliations":[{"raw_affiliation_string":"School of Software Liaoning Technical University  Fuxin China","institution_ids":["https://openalex.org/I176808543"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5113331127","display_name":"Yunfei Qiu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I176808543","display_name":"Liaoning Technical University","ror":"https://ror.org/01n2bd587","country_code":"CN","type":"education","lineage":["https://openalex.org/I176808543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yunfei Qiu","raw_affiliation_strings":["School of Software Liaoning Technical University  Fuxin China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Software Liaoning Technical University  Fuxin China","institution_ids":["https://openalex.org/I176808543"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100891564","display_name":"Qingyang Meng","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I176808543","display_name":"Liaoning Technical University","ror":"https://ror.org/01n2bd587","country_code":"CN","type":"education","lineage":["https://openalex.org/I176808543"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qingyang Meng","raw_affiliation_strings":["School of Software Liaoning Technical University  Fuxin China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Software Liaoning Technical University  Fuxin China","institution_ids":["https://openalex.org/I176808543"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5146635350"],"corresponding_institution_ids":["https://openalex.org/I176808543"],"apc_list":{"value":4480,"currency":"USD","value_usd":4480},"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.06647722,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"38","issue":"2","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9169999957084656,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9169999957084656,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.08179999887943268,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/trusted-execution-environment","display_name":"trusted execution environments","score":0.8820000290870667},{"id":"https://openalex.org/keywords/coverage-guided-fuzzing","display_name":"coverage-guided fuzzing","score":0.8889999985694885},{"id":"https://openalex.org/keywords/seed-conservation","display_name":"seed conservation","score":0.4970000088214874},{"id":"https://openalex.org/keywords/seed-selection","display_name":"seed selection","score":0.9300000071525574},{"id":"https://openalex.org/keywords/n-gram-language-models","display_name":"n-gram language models","score":0.8600000143051147},{"id":"https://openalex.org/keywords/test-case-generation","display_name":"test case generation","score":0.972000002861023},{"id":"https://openalex.org/keywords/vulnerability-detection","display_name":"vulnerability detection","score":0.7889999747276306},{"id":"https://openalex.org/keywords/microkernel","display_name":"microkernel","score":0.7509999871253967},{"id":"https://openalex.org/keywords/fuchsia","display_name":"Fuchsia","score":0.8650000095367432},{"id":"https://openalex.org/keywords/op-tee","display_name":"OP-TEE","score":0.8539999723434448}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9886000156402588},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8729000091552734},{"id":"https://openalex.org/C2777127024","wikidata":"https://www.wikidata.org/wiki/Q726378","display_name":"Microkernel","level":2,"score":0.5386999845504761},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5335000157356262},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.5303000211715698},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.5202999711036682},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.5011000037193298},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.4812000095844269},{"id":"https://openalex.org/C53942775","wikidata":"https://www.wikidata.org/wiki/Q1211721","display_name":"Code coverage","level":3,"score":0.4648999869823456},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.4625999927520752},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.45239999890327454},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.44749999046325684},{"id":"https://openalex.org/C2779639559","wikidata":"https://www.wikidata.org/wiki/Q7661178","display_name":"Symbolic execution","level":3,"score":0.43160000443458557},{"id":"https://openalex.org/C128942645","wikidata":"https://www.wikidata.org/wiki/Q1568346","display_name":"Test case","level":3,"score":0.3984000086784363},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.38499999046325684},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.38199999928474426},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3472000062465668},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.3416000008583069},{"id":"https://openalex.org/C167822520","wikidata":"https://www.wikidata.org/wiki/Q176452","display_name":"Finite-state machine","level":2,"score":0.3361999988555908},{"id":"https://openalex.org/C110251889","wikidata":"https://www.wikidata.org/wiki/Q1569697","display_name":"Model checking","level":2,"score":0.3330000042915344},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.3305000066757202},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.3221000134944916},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.32170000672340393},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3203999996185303},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.310699999332428},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.30730000138282776},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.30329999327659607},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.301800012588501},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2939000129699707},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.2906000018119812},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.2847999930381775},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.27300000190734863},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.2728999853134155}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1002/smr.70085","doi":"https://doi.org/10.1002/smr.70085","is_oa":true,"landing_page_url":"https://doi.org/10.1002/smr.70085","pdf_url":"https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/smr.70085","source":{"id":"https://openalex.org/S4210172359","display_name":"Journal of Software Evolution and Process","issn_l":"2047-7473","issn":["2047-7473","2047-7481"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1"],"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Software: Evolution and Process","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1002/smr.70085","doi":"https://doi.org/10.1002/smr.70085","is_oa":true,"landing_page_url":"https://doi.org/10.1002/smr.70085","pdf_url":"https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/smr.70085","source":{"id":"https://openalex.org/S4210172359","display_name":"Journal of Software Evolution and Process","issn_l":"2047-7473","issn":["2047-7473","2047-7481"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","jufo-1","norway-1"],"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Software: Evolution and Process","raw_type":"journal-article"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7129065732.pdf","grobid_xml":"https://content.openalex.org/works/W7129065732.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W2115675703","https://openalex.org/W2757104921","https://openalex.org/W2791061589","https://openalex.org/W2806377938","https://openalex.org/W2924291353","https://openalex.org/W2955835447","https://openalex.org/W3007127028","https://openalex.org/W3019428952","https://openalex.org/W3046946156","https://openalex.org/W3047947484","https://openalex.org/W3104625507","https://openalex.org/W3155065762","https://openalex.org/W3157873250","https://openalex.org/W3207926955","https://openalex.org/W4236786653","https://openalex.org/W4312552479","https://openalex.org/W4323350880","https://openalex.org/W4385080425","https://openalex.org/W4391216237","https://openalex.org/W4399323877","https://openalex.org/W4402263632"],"related_works":[],"abstract_inverted_index":{"ABSTRACT":[0],"Trusted":[1],"execution":[2],"environments":[3],"(TEEs)":[4],"are":[5,137],"widely":[6],"used,":[7],"and":[8,96,134,161,173,184,200,207,218],"their":[9,52,71],"kernel":[10],"security":[11,35],"has":[12,29],"become":[13],"a":[14,20,82,94,116,169],"significant":[15],"area":[16],"of":[17,37,110,128],"focus.":[18],"Fuzzing,":[19],"powerful":[21],"technique":[22],"for":[23,47,88],"detecting":[24,196],"vulnerabilities":[25,206],"in":[26,73,145],"operating":[27,181],"systems,":[28],"increasingly":[30],"been":[31],"applied":[32],"to":[33,51,99,120,140,154],"the":[34,66,101,108,122,126,143,151,156,163,185,224],"analysis":[36],"TEEs.":[38,129],"However,":[39],"conventional":[40],"fuzzing":[41,84],"tools":[42],"cannot":[43],"be":[44],"directly":[45],"used":[46],"TEE":[48,89],"kernels":[49],"due":[50],"isolation.":[53],"Coverage\u2010guided":[54],"fuzzers":[55],"often":[56],"discard":[57],"test":[58,157],"cases":[59],"that":[60,191],"trigger":[61],"new":[62,117,131,198],"states":[63],"but":[64],"cover":[65],"same":[67],"code,":[68],"which":[69],"limits":[70],"effectiveness":[72],"discovering":[74],"vulnerabilities.":[75,147,201,210],"To":[76],"address":[77,121],"these":[78],"challenges,":[79],"we":[80,92,114,149],"propose":[81,115],"state\u2010aware":[83],"method":[85],"specifically":[86],"designed":[87],"kernels.":[90],"Initially,":[91],"develop":[93],"modeling":[95],"tracing":[97],"approach":[98],"represent":[100],"program":[102],"state":[103,221],"through":[104],"state\u2010variable":[105],"values,":[106],"overcoming":[107],"limitations":[109],"coverage\u2010guided":[111],"fuzzers.":[112],"Subsequently,":[113],"communication":[118],"scheme":[119],"issues":[123],"resulting":[124],"from":[125],"isolation":[127],"Additionally,":[130,211],"seed":[132],"preservation":[133],"selection":[135],"algorithms":[136],"put":[138],"forward":[139],"better":[141],"guide":[142],"fuzzer":[144,226],"exploring":[146],"Finally,":[148],"employ":[150],"N\u2010gram":[152],"model":[153],"enhance":[155],"case":[158],"generation":[159],"process":[160],"optimize":[162],"framework's":[164],"performance.":[165],"We":[166],"have":[167],"implemented":[168],"prototype":[170],"called":[171],"Trusty\u2010Statefuzz":[172,192,202],"evaluated":[174],"it":[175,212],"on":[176],"Fuchsia,":[177],"our":[178],"self\u2010developed":[179],"microkernel":[180],"system":[182],"Nebula,":[183],"OP\u2010TEE.":[186],"The":[187],"evaluation":[188],"results":[189],"show":[190],"is":[193],"effective":[194],"at":[195],"both":[197],"code":[199,216],"discovers":[203],"nine":[204],"unknown":[205],"23":[208],"known":[209],"achieves":[213],"13%":[214],"higher":[215,220],"coverage":[217,222],"27%":[219],"than":[223],"state\u2010of\u2010the\u2010art":[225],"Syzkaller.":[227]},"counts_by_year":[],"updated_date":"2026-08-24T07:32:12.397491","created_date":"2026-02-17T00:00:00"}