Fuzzing embedded systems is a challenge. GDBFuzz, an effective fuzzing approach for embedded devices, leverages a generic and widely available hardware breakpoint mechanism. However, its reliance on debugger and debug probes - originally designed for debugging rather than fuzzing - introduces unnecessary dependencies and communication overheads, compromising fuzzing throughput. With the objective of speeding up the fuzzing, we present JDFuzz, a hardware-software approach for accelerating fuzzing in embedded systems. JDFuzz integrates a specialized hardware debugger - built upon the ARM CoreSight architecture - with its fuzzing engine, eliminating conventional debugger bottlenecks and optimizing the execution of debug commands. Experimental results show that JDFuzz achieves an average command speedup exceeding 1000× over GDBFuzz, with over 2500× improvement on the most critical command, and improves end-to-end fuzzing throughput by approximately 100% under identical test conditions.

Fuzzing is a highly effective means of discovering vulnerabilities in traditional software. However, when it comes to fuzzing an embedded system, especially for a smaller microcontroller device with monolithic firmware, the challenges are considerable. The highly constrained resources of the system and the diverse behaviors of peripherals often render software instrumentation or emulation-based fuzzing impractical in many cases. In this work, we introduce TWFuzz, a fuzzing tool designed for effective coverage collection in embedded systems. Specifically, TWFuzz relies on two hardware interfaces (tracing and debugging) and three types of probes (program counter samples, instruction address matchings, hardware breakpoints) as feedback channels for coverage-guided fuzzing. The ARM Single Wire Output (SWO) hardware tracing interface is used for capturing periodic samples of the program counter. The ARM Serial Wire Debug (SWD) debugging interface is used for setting and checking a limited number of instruction address matchings and hardware breakpoints. With these three types of probes, TWFuzz can extract coverage information without costly code instrumentation and hardware emulation, which enables effective fuzzing on embedded systems. To optimize the fuzzing flow, in particular the tracing analysis part, we implement TWFuzz on PYNQ-Z1 FPGA board. We evaluate TWFuzz on two development boards. Compared to the state-of-the-art open-source fuzzer GDBFuzz, TWFuzz's average code coverage rate is 1.24 times that of GDBFuzz.

Accurate and reliable traffic forecasting for complicated transportation networks is of vital importance to modern transportation management. The complicated spatial dependencies of roadway links and the dynamic temporal patterns of traffic states make it particularly challenging. To address these challenges, we propose a new capsule network (CapsNet) to extract the spatial features of traffic networks and utilize a nested LSTM (NLSTM) structure to capture the hierarchical temporal dependencies in traffic sequence data. A framework for network-level traffic forecasting is also proposed by sequentially connecting CapsNet and NLSTM. On the basis of literature review, our study is the first to adopt CapsNet and NLSTM in the field of traffic forecasting. An experiment on a Beijing transportation network with 278 links shows that the proposed framework with the capability of capturing complicated spatiotemporal traffic patterns outperforms multiple state-of-the-art traffic forecasting baseline models. The superiority and feasibility of CapsNet and NLSTM are also demonstrated, respectively, by visualizing and quantitatively evaluating the experimental results.

Embedded networked sensor systems are deeply coupled with the physical world, and the deployed systems are usually difficult to debug. Therefore, it is especially important to thoroughly test and profile the systems before deploying to the real world. Traditional debugging methods are incompetent for detailed tracing on resource constrained devices due to their intrusiveness. This paper proposes a low-cost Hardware Assisted Tracing testBED (HATBED) to enable non-intrusive tracing and profiling for embedded networked sensor systems independent of operating systems and applications. We hope HATBED will foster research on comprehensive testing and profiling of embedded networked systems based on modern 32-bit architecture.

Limited visibility of node states makes debugging deployed sensor networks very difficult. Higher visibility usually implies more resource consumption. As sensor networks are resource-constrained and need to operate unattended for long periods, a balance between a sufficient level of visibility and a tolerable consumption of resources needs to be found so that enough evidence can be collected to analyze the causes of observed problems. We propose a mechanism called visibility levels (vLevels) to manage the trade-off between visibility and resource consumption. Preliminary experimental results show the feasibility of vLevels.