{"id":"https://openalex.org/W4411523053","doi":"https://doi.org/10.1145/3728914","title":"Structure-Aware, Diagnosis-Guided ECU Firmware Fuzzing","display_name":"Structure-Aware, Diagnosis-Guided ECU Firmware Fuzzing","publication_year":2025,"publication_date":"2025-06-22","ids":{"openalex":"https://openalex.org/W4411523053","doi":"https://doi.org/10.1145/3728914"},"language":"en","primary_location":{"id":"doi:10.1145/3728914","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728914","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3728914","source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3728914","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5029224382","display_name":"Qing\u2010Quan Chen","orcid":"https://orcid.org/0009-0006-1343-2162"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qicai Chen","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0006-1343-2162","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Kun Hu","orcid":"https://orcid.org/0009-0005-7312-9870"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kun Hu","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0005-7312-9870","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Sichen Gong","orcid":"https://orcid.org/0009-0006-2241-832X"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sichen Gong","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0006-2241-832X","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059253116","display_name":"Bihuan Chen","orcid":"https://orcid.org/0000-0001-7238-7492"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bihuan Chen","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-7238-7492","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5118583200","display_name":"Zikui Kong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zikui Kong","raw_affiliation_strings":["ANHUI GuarDrive Safety Technology, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0003-0770-9960","affiliations":[{"raw_affiliation_string":"ANHUI GuarDrive Safety Technology, Shanghai, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5107935500","display_name":"Haowen Jiang","orcid":null},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haowen Jiang","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0000-1923-3398","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051538796","display_name":"Bingkun Sun","orcid":"https://orcid.org/0000-0002-2264-5729"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bingkun Sun","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-2264-5729","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103544062","display_name":"You Lu","orcid":"https://orcid.org/0009-0008-1634-9721"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"You Lu","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0008-1634-9721","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101854992","display_name":"Xin Peng","orcid":"https://orcid.org/0000-0003-3376-2581"},"institutions":[{"id":"https://openalex.org/I24943067","display_name":"Fudan University","ror":"https://ror.org/013q1eq08","country_code":"CN","type":"education","lineage":["https://openalex.org/I24943067"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Peng","raw_affiliation_strings":["Fudan University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0003-3376-2581","affiliations":[{"raw_affiliation_string":"Fudan University, Shanghai, China","institution_ids":["https://openalex.org/I24943067"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.0029,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.86426894,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"2","issue":"ISSTA","first_page":"871","last_page":"893"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12810","display_name":"Real-time simulation and control systems","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12810","display_name":"Real-time simulation and control systems","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10933","display_name":"Real-Time Systems Scheduling","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11005","display_name":"Radiation Effects in Electronics","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9737035036087036},{"id":"https://openalex.org/keywords/firmware","display_name":"Firmware","score":0.9207227230072021},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7122693061828613},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.6287167072296143},{"id":"https://openalex.org/keywords/automotive-industry","display_name":"Automotive industry","score":0.5522058010101318},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4826412796974182},{"id":"https://openalex.org/keywords/can-bus","display_name":"CAN bus","score":0.47177791595458984},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.33955061435699463},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.25424814224243164},{"id":"https://openalex.org/keywords/computer-hardware","display_name":"Computer hardware","score":0.231056809425354},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.1799280047416687}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9737035036087036},{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.9207227230072021},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7122693061828613},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.6287167072296143},{"id":"https://openalex.org/C526921623","wikidata":"https://www.wikidata.org/wiki/Q190117","display_name":"Automotive industry","level":2,"score":0.5522058010101318},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4826412796974182},{"id":"https://openalex.org/C201762086","wikidata":"https://www.wikidata.org/wiki/Q728183","display_name":"CAN bus","level":2,"score":0.47177791595458984},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.33955061435699463},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.25424814224243164},{"id":"https://openalex.org/C9390403","wikidata":"https://www.wikidata.org/wiki/Q3966","display_name":"Computer hardware","level":1,"score":0.231056809425354},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.1799280047416687},{"id":"https://openalex.org/C146978453","wikidata":"https://www.wikidata.org/wiki/Q3798668","display_name":"Aerospace engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3728914","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728914","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3728914","source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3728914","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3728914","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3728914","source":{"id":"https://openalex.org/S4404663975","display_name":"Proceedings of the ACM on software engineering.","issn_l":"2994-970X","issn":["2994-970X"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2575074992","display_name":null,"funder_award_id":"Grant No. 62332005 and 62372114","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5070653614","display_name":null,"funder_award_id":"62332005","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8656946690","display_name":null,"funder_award_id":"62372114","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4411523053.pdf","grobid_xml":"https://content.openalex.org/works/W4411523053.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W21094599","https://openalex.org/W220935706","https://openalex.org/W1976960194","https://openalex.org/W1993180463","https://openalex.org/W2031584711","https://openalex.org/W2066303853","https://openalex.org/W2620084289","https://openalex.org/W2913402274","https://openalex.org/W2914982603","https://openalex.org/W3005411567","https://openalex.org/W3012800479","https://openalex.org/W3080908369","https://openalex.org/W3092927885","https://openalex.org/W3111979766","https://openalex.org/W3118403981","https://openalex.org/W3138933903","https://openalex.org/W3214767902","https://openalex.org/W4213105844","https://openalex.org/W4220806723","https://openalex.org/W4238996902","https://openalex.org/W4288084466","https://openalex.org/W4300470068","https://openalex.org/W4384155563","https://openalex.org/W4384921664","https://openalex.org/W4386415974","https://openalex.org/W4401325622","https://openalex.org/W6756301311"],"related_works":["https://openalex.org/W4391761545","https://openalex.org/W4378373752","https://openalex.org/W1526521547","https://openalex.org/W4385624297","https://openalex.org/W3180981818","https://openalex.org/W4247881240","https://openalex.org/W2007388836","https://openalex.org/W2138026378","https://openalex.org/W4388023871","https://openalex.org/W2356515587"],"abstract_inverted_index":{"Electronic":[0],"Control":[1],"Units":[2],"(ECUs),":[3],"providing":[4],"a":[5,18,116,158,171],"wide":[6],"range":[7],"of":[8,39,144],"functions":[9,13],"from":[10,50,62,204,245],"basic":[11],"control":[12],"to":[14,31,71,79,121,148,163,175,185],"safety-critical":[15,237],"functions,":[16],"play":[17],"critical":[19],"role":[20],"in":[21],"modern":[22],"vehicles.":[23],"Fuzzing":[24],"has":[25,211,228],"emerged":[26],"as":[27],"an":[28],"effective":[29],"approach":[30],"ensure":[32],"the":[33,48,60,72,142,177,246],"functional":[34],"safety":[35],"and":[36,123,135,146,153,156,195],"automotive":[37,182,209],"security":[38],"ECU":[40,82,92,126],"firmware.":[41,83,127],"However,":[42],"existing":[43,85],"fuzzing":[44,86,178],"approaches":[45,87],"focus":[46],"on":[47,98,201,224],"inputs":[49,61],"other":[51],"ECUs":[52,203,227],"through":[53,65],"external":[54,131],"buses":[55,67,132,137],"(e.g.,":[56,68,101],"CAN),":[57],"but":[58,96],"neglect":[59],"internal":[63,94,188],"peripherals":[64],"on-board":[66,136],"SPI).":[69,139],"Due":[70],"restricted":[73],"input":[74],"space":[75],"exploration,":[76],"they":[77],"fail":[78],"comprehensively":[80,122],"fuzz":[81,125],"Moreover,":[84],"often":[88],"lack":[89],"visibility":[90],"into":[91],"firmware\u2019":[93],"states":[95],"rely":[97],"limited":[99],"feedback":[100,173],"message":[102],"timeouts":[103],"or":[104],"hardware":[105],"indicators),":[106],"hindering":[107],"their":[108],"effectiveness.":[109],"To":[110],"address":[111],"these":[112],"limitations,":[113],"we":[114],"propose":[115],"structure-aware,":[117],"diagnosis-guided":[118],"framework,":[119],"EcuFuzz,":[120],"effectively":[124,149],"Specifically,":[128],"EcuFuzzsimultaneously":[129],"considers":[130],"(i.e.,":[133,138],"CAN)":[134],"It":[140,180],"leverages":[141,181],"structure":[143],"CAN":[145,151],"SPI":[147,154,166],"mutate":[150],"messages":[152],"sequences,":[155],"incorporates":[157],"dual-core":[159],"microcontroller-based":[160],"peripheral":[161],"emulator":[162],"handle":[164],"real-time":[165],"communication.":[167],"In":[168],"addition,":[169],"EcuFuzzimplements":[170],"new":[172],"mechanism":[174],"guide":[176],"process.":[179],"diagnostic":[183],"protocols":[184],"collect":[186],"ECUs\u2019":[187],"states,":[189],"i.e.,":[190],"error-related":[191],"variables,":[192],"trouble":[193],"codes,":[194],"exception":[196],"contexts.":[197],"Our":[198,221],"compatibility":[199],"evaluation":[200,223],"ten":[202],"three":[205,225],"major":[206],"Tier":[207],"1":[208],"suppliers":[210],"indicated":[212],"that":[213,230],"our":[214,231],"framework":[215,232],"is":[216],"compatible":[217],"with":[218],"nine":[219,234],"ECUs.":[220],"effectiveness":[222],"representative":[226],"demonstrated":[229],"detects":[233],"previously":[235],"unknown":[236],"faults,":[238],"which":[239],"have":[240],"been":[241],"patched":[242],"by":[243],"technicians":[244],"suppliers.":[247]},"counts_by_year":[{"year":2026,"cited_by_count":4}],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2025-10-10T00:00:00"}