{"id":"https://openalex.org/W4416873170","doi":"https://doi.org/10.1109/jiot.2025.3638771","title":"HANAMI: Hardware-Assisted Fuzzing for Microcontroller Firmware With Neural Network Assistance","display_name":"HANAMI: Hardware-Assisted Fuzzing for Microcontroller Firmware With Neural Network Assistance","publication_year":2025,"publication_date":"2025-12-01","ids":{"openalex":"https://openalex.org/W4416873170","doi":"https://doi.org/10.1109/jiot.2025.3638771"},"language":null,"primary_location":{"id":"doi:10.1109/jiot.2025.3638771","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3638771","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104307075","display_name":"Yu Li","orcid":"https://orcid.org/0009-0008-7827-5553"},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Yu Li","raw_affiliation_strings":["School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China"],"raw_orcid":"https://orcid.org/0009-0008-7827-5553","affiliations":[{"raw_affiliation_string":"School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]},{"raw_affiliation_string":"School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yu Liu","orcid":"https://orcid.org/0009-0004-8411-1310"},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Liu","raw_affiliation_strings":["School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China"],"raw_orcid":"https://orcid.org/0009-0004-8411-1310","affiliations":[{"raw_affiliation_string":"School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]},{"raw_affiliation_string":"School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120624336","display_name":"Anchen Dai","orcid":"https://orcid.org/0000-0002-0613-8495"},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Anchen Dai","raw_affiliation_strings":["School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-0613-8495","affiliations":[{"raw_affiliation_string":"School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]},{"raw_affiliation_string":"School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020451665","display_name":"H.Q. Li","orcid":"https://orcid.org/0009-0006-6864-1412"},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hangyu Li","raw_affiliation_strings":["School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China"],"raw_orcid":"https://orcid.org/0009-0006-6864-1412","affiliations":[{"raw_affiliation_string":"School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]},{"raw_affiliation_string":"School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101509144","display_name":"Yanlong Shen","orcid":"https://orcid.org/0000-0002-5350-3133"},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanlong Shen","raw_affiliation_strings":["School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-5350-3133","affiliations":[{"raw_affiliation_string":"School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]},{"raw_affiliation_string":"School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101807587","display_name":"Ying Zhou","orcid":"https://orcid.org/0009-0005-4569-3458"},"institutions":[{"id":"https://openalex.org/I157773358","display_name":"Sun Yat-sen University","ror":"https://ror.org/0064kty71","country_code":"CN","type":"education","lineage":["https://openalex.org/I157773358"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ying Zhou","raw_affiliation_strings":["School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China"],"raw_orcid":"https://orcid.org/0009-0005-4569-3458","affiliations":[{"raw_affiliation_string":"School of Electronics and Communication Engineering, Shenzhen Campus of Sun Yat-sen University, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]},{"raw_affiliation_string":"School of Electronics and Communication Engineering, Sun Yat-sen University, Shenzhen Campus, Shenzhen, China","institution_ids":["https://openalex.org/I157773358"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5104307075"],"corresponding_institution_ids":["https://openalex.org/I157773358"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.36077875,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":"3","first_page":"4992","last_page":"5005"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.1860000044107437,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.1860000044107437,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.1590999960899353,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10904","display_name":"Embedded Systems Design Techniques","score":0.10019999742507935,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9854000210762024},{"id":"https://openalex.org/keywords/firmware","display_name":"Firmware","score":0.9277999997138977},{"id":"https://openalex.org/keywords/emulation","display_name":"Emulation","score":0.7652000188827515},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.492900013923645},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.4648999869823456},{"id":"https://openalex.org/keywords/microcontroller","display_name":"Microcontroller","score":0.4438000023365021},{"id":"https://openalex.org/keywords/code-coverage","display_name":"Code coverage","score":0.3634999990463257}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9854000210762024},{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.9277999997138977},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8586999773979187},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.7652000188827515},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.5564000010490417},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.492900013923645},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.4648999869823456},{"id":"https://openalex.org/C173018170","wikidata":"https://www.wikidata.org/wiki/Q165678","display_name":"Microcontroller","level":2,"score":0.4438000023365021},{"id":"https://openalex.org/C53942775","wikidata":"https://www.wikidata.org/wiki/Q1211721","display_name":"Code coverage","level":3,"score":0.3634999990463257},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.33410000801086426},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3000999987125397},{"id":"https://openalex.org/C2778565505","wikidata":"https://www.wikidata.org/wiki/Q2207566","display_name":"Spec#","level":2,"score":0.2818000018596649},{"id":"https://openalex.org/C113775141","wikidata":"https://www.wikidata.org/wiki/Q428691","display_name":"Computer engineering","level":1,"score":0.2687999904155731},{"id":"https://openalex.org/C2778514511","wikidata":"https://www.wikidata.org/wiki/Q1374194","display_name":"Programmer","level":2,"score":0.26579999923706055},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.2621999979019165},{"id":"https://openalex.org/C2778119891","wikidata":"https://www.wikidata.org/wiki/Q477690","display_name":"CUDA","level":2,"score":0.2565999925136566},{"id":"https://openalex.org/C153876917","wikidata":"https://www.wikidata.org/wiki/Q899704","display_name":"Traceability","level":2,"score":0.25619998574256897},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2547000050544739},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2524000108242035}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2025.3638771","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3638771","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1273871948","display_name":null,"funder_award_id":"2023B1212060024","funder_id":"https://openalex.org/F4320335795","funder_display_name":"Science and Technology Planning Project of Guangdong Province"},{"id":"https://openalex.org/G2925241620","display_name":null,"funder_award_id":"62101558","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8947151139","display_name":null,"funder_award_id":"62471508","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335795","display_name":"Science and Technology Planning Project of Guangdong Province","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W2043118292","https://openalex.org/W2295532906","https://openalex.org/W2535617737","https://openalex.org/W2811397117","https://openalex.org/W2883395840","https://openalex.org/W2960121311","https://openalex.org/W2963523627","https://openalex.org/W2963674831","https://openalex.org/W3028062294","https://openalex.org/W3037044296","https://openalex.org/W3136918966","https://openalex.org/W3170554148","https://openalex.org/W4323240496","https://openalex.org/W4384154462","https://openalex.org/W4384155638","https://openalex.org/W4384345780","https://openalex.org/W4391724785","https://openalex.org/W4394745802","https://openalex.org/W4402263632","https://openalex.org/W4402443144","https://openalex.org/W4402955721","https://openalex.org/W4407130606"],"related_works":[],"abstract_inverted_index":{"Fuzzing":[0],"for":[1,34,124,177],"the":[2,38,128,137,146,160],"microcontroller":[3],"unit":[4],"(MCU)":[5],"firmware":[6,25,68,150],"presents":[7],"unique":[8],"challenges":[9,33],"compared":[10],"to":[11,17,76,87,108,135,144],"conventional":[12],"program":[13],"code":[14,53,111,151],"fuzzing":[15,36,41,69,178],"due":[16],"hardware":[18],"limitations":[19],"and":[20,27,55,113,156,173],"restricted":[21],"runtime":[22],"visibility.":[23],"While":[24],"emulation":[26],"hardware-assisted":[28],"methods":[29],"mitigate":[30],"execution":[31,91],"environment":[32],"embedded":[35],"tools,":[37],"efficiency":[39],"of":[40,94,148],"MCU":[42],"firmware,":[43],"especially":[44],"peripheral":[45],"driver":[46],"code,":[47],"is":[48,133,142],"still":[49],"limited":[50],"by":[51],"sparse":[52,149],"coverage":[54],"insufficient":[56],"path":[57],"exploration.":[58],"To":[59],"overcome":[60,77],"these":[61,78],"challenges,":[62],"we":[63,118],"propose":[64],"HANAMI,":[65,125],"a":[66,102,120],"coverage-guided":[67],"framework":[70],"that":[71],"incorporates":[72],"reinforcement":[73,104],"learning":[74,105],"(RL)":[75],"limitations.":[79],"HANAMI":[80,100,155],"employs":[81,101],"ARM":[82],"Embedded":[83],"Trace":[84],"Macrocell":[85],"(ETM)":[86],"gather":[88],"real-time":[89],"instruction":[90],"traces.":[92],"Instead":[93],"relying":[95],"on":[96,159],"traditional":[97],"random":[98],"mutators,":[99],"deep":[103],"(DRL)":[106],"agent":[107],"prioritize":[109],"high-value":[110],"regions":[112],"optimize":[114],"mutation":[115],"strategies.":[116],"Additionally,":[117],"design":[119],"new":[121],"reward":[122],"scheme":[123],"in":[126,167],"which":[127],"intrinsic":[129,138],"curiosity":[130],"module":[131],"(ICM)":[132],"introduced":[134],"shape":[136],"reward.":[139],"This":[140],"approach":[141],"aimed":[143],"enhance":[145],"discovery":[147],"paths.":[152],"We":[153],"implement":[154],"evaluate":[157],"it":[158,165],"NXP":[161],"S32K148EVB":[162],"board,":[163],"where":[164],"succeeds":[166],"discovering":[168],"more":[169],"paths":[170],"than":[171],"baseline":[172],"shows":[174],"its":[175],"potential":[176],"real-world":[179],"IoT":[180],"applications.":[181]},"counts_by_year":[],"updated_date":"2026-01-25T23:04:38.658462","created_date":"2025-12-01T00:00:00"}