{"id":"https://openalex.org/W7169863951","doi":"https://doi.org/10.48550/arxiv.2607.16487","title":"Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing","display_name":"Fuzz'EMup: Leveraging EM Side-Channel Emanation to Guide Black-Box Embedded Firmware Fuzzing","publication_year":2026,"publication_date":"2026-07-17","ids":{"openalex":"https://openalex.org/W7169863951","doi":"https://doi.org/10.48550/arxiv.2607.16487"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.16487","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.16487","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.16487","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5140866021","display_name":"Fatemeh Moradihaghighi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Moradihaghighi, Fatemeh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010864491","display_name":"Zihao Zhan","orcid":"https://orcid.org/0000-0002-1467-9056"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhan, Zihao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5141234570","display_name":"Yanan Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Yanan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5141227583","display_name":"Ziming Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Ziming","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023953462","display_name":"Mashrur Chowdhury","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chowdhury, Mashrur","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5141282567","display_name":"Zhenkai Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Zhenkai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6309999823570251,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.6309999823570251,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.21310000121593475,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.052000001072883606,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/firmware","display_name":"Firmware","score":0.9725000262260437},{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9110000133514404},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6244999766349792},{"id":"https://openalex.org/keywords/reboot","display_name":"Reboot","score":0.4957999885082245},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.4032999873161316},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3492000102996826}],"concepts":[{"id":"https://openalex.org/C67212190","wikidata":"https://www.wikidata.org/wiki/Q104851","display_name":"Firmware","level":2,"score":0.9725000262260437},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9110000133514404},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7656000256538391},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6244999766349792},{"id":"https://openalex.org/C120524526","wikidata":"https://www.wikidata.org/wiki/Q1709148","display_name":"Reboot","level":2,"score":0.4957999885082245},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.4302000105381012},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4032999873161316},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3492000102996826},{"id":"https://openalex.org/C134652429","wikidata":"https://www.wikidata.org/wiki/Q1052698","display_name":"Jitter","level":2,"score":0.34450000524520874},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.31520000100135803},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.28780001401901245},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2809999883174896},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.27469998598098755},{"id":"https://openalex.org/C113174947","wikidata":"https://www.wikidata.org/wiki/Q2859736","display_name":"Tree (set theory)","level":2,"score":0.26919999718666077}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.16487","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.16487","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.16487","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.16487","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6152788400650024,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"As":[0],"IoT":[1],"and":[2,25,98,134,162],"embedded":[3],"devices":[4,37],"proliferate":[5],"across":[6],"various":[7],"domains,":[8],"securing":[9],"their":[10,150],"firmware":[11,46,78,160],"has":[12],"become":[13],"critical.":[14],"Fuzzing":[15],"offers":[16],"a":[17,145],"systematic":[18],"approach":[19,69,156],"to":[20,42,76,107,130],"uncovering":[21],"vulnerabilities":[22],"in":[23,52,80,104,109,144],"firmware,":[24],"coverage":[26,39,173],"feedback":[27,166],"can":[28],"improve":[29],"its":[30],"effectiveness":[31],"by":[32,44,115,141],"guiding":[33],"exploration.":[34],"However,":[35,84],"many":[36],"make":[38],"information":[40],"impossible":[41],"obtain":[43],"preventing":[45],"extraction,":[47],"instrumentation,":[48],"or":[49],"accurate":[50],"emulation;":[51],"such":[53],"cases,":[54],"testers":[55],"are":[56,96],"left":[57],"with":[58,126],"only":[59],"inefficient":[60],"black-box":[61,82],"fuzzing.":[62,176],"In":[63],"this":[64],"paper,":[65],"we":[66],"present":[67],"an":[68],"that":[70,164],"leverages":[71],"electromagnetic":[72],"(EM)":[73],"side-channel":[74],"emanations":[75],"guide":[77],"fuzzing":[79],"purely":[81],"settings.":[83],"turning":[85],"raw":[86],"EM":[87,94],"measurements":[88],"into":[89],"reliable":[90],"guidance":[91],"is":[92],"challenging:":[93],"traces":[95,106,133],"noisy,":[97],"timing":[99],"jitter":[100],"causes":[101],"corresponding":[102],"features":[103],"different":[105],"shift":[108],"time.":[110],"We":[111,153],"address":[112],"these":[113],"challenges":[114],"combining":[116],"frequency":[117],"band":[118],"selection":[119],"based":[120,148],"on":[121,149,157],"the":[122],"activity-to-idle":[123],"signal":[124],"contrast":[125],"dynamic":[127],"time":[128],"warping":[129],"align":[131],"per-input":[132],"detect":[135],"sustained":[136],"divergence,":[137],"while":[138],"maintaining":[139],"scalability":[140],"organizing":[142],"executions":[143],"tree":[146],"structure":[147],"divergence":[151],"times.":[152],"evaluate":[154],"our":[155],"four":[158],"real":[159],"targets":[161],"demonstrate":[163],"EM-derived":[165],"enhances":[167],"path":[168],"exploration,":[169],"yielding":[170],"higher":[171],"code":[172],"than":[174],"unguided":[175]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-22T00:00:00"}