Software vulnerabilities pose severe security threats, highlighting the need for effective automated detection. Directed hybrid fuzzing, which combines the rapid exploration of fuzz testing with the precise constraint solving of symbolic execution, has made notable advancements in vulnerability discovery. However, existing directed hybrid fuzzing approaches still face two key challenges: (1) inefficient seed selection, leading to inadequate prioritization of optimal inputs for symbolic execution, and (2) inefficient seed generation, resulting in suboptimal seed generation. To address these issues, we propose TACO-Fuzz, TArget-Centric cOncolic Fuzzing, which introduces a two-phase target-centric seed selection strategy to prioritize under-explored paths and a target-centric seed generation approach based on constructing extended path conditions, thereby improving seed quality. Our evaluation on a selected set of public benchmarks shows that TACO-Fuzz can outperform several representative state-of-the-art directed fuzzing tools, achieving up to an average speedup of nearly 10x in reaching target locations, along with comparable improvements in reproducing real-world vulnerabilities. Moreover, TACO-Fuzz contributed to the discovery of 17 previously unknown vulnerabilities, each assigned a CVE, and demonstrated faster vulnerability discovery and reproduction in most cases.

Incremental symbolic execution aims to address the scalability challenges of traditional symbolic execution by concentrating on behavioural differences between program versions introduced during program evolution. Despite progress in the field, existing techniques often struggle to explore these behaviors both efficiently and accurately. In this paper, we introduceFENSE, a novel approach for incremental symbolic execution that improves efficiency by identifying and eliminating redundant paths.FENSEachieves this by summarizing previously explored paths and monitoring variables that may induce divergent incremental behaviors at each branching point. This summarization process enablesFENSEto detect whether a newly explored path subsumes distinct incremental behaviors compared to prior explorations. By effectively pruning redundant paths that exhibit identical incremental behaviors as those previously explored,FENSEachieves a potentially exponential reduction in the number of explored paths. We implemented a prototype ofFENSEand evaluated it on a diverse set of real-world applications. Experimental results demonstrate thatFENSEoutperforms state-of-the-art techniques by significantly reducing both path exploration and execution time. When applied to real-world commits from the GNU Coreutils project,FENSEachieved an average of 76% reduction in explored paths and a 139× speedup overKLEE.

Rainfall over the ocean strongly influences microwave remote sensing by altering electromagnetic scattering mechanisms, complicating radar backscatter interpretation and its relationship to surface wind. However, in-depth understanding of these effects under different surface and frequency conditions remains limited. In this study, for the first time, coordinated multi-frequency radar observations at C-, X-, and Ku-bands were carried out to investigate scattering from (i) airborne raindrops, (ii) rain perturbed windless water surface, and (iii) wind-driven sea surface agitated by rain. Field measurements combined radar backscatter intensity with Doppler spectral signatures to elucidate the underlying scattering mechanisms. Synchronized radar and optical imaging enabled joint characterization of scattering signatures and geometric features of wind waves and rain-induced ring waves. Results reveal pronounced variations in both airborne raindrop scattering and surface backscattering under different rainfall rates, frequency bands and polarizations. Under low sea-state conditions, Doppler spectra exhibit a distinct dual-peak structure attributable to ring wave backscattering, whereas at higher sea states this feature is masked by the dominant spectral energy of wind waves. Using rain-induced ring wave theory and the small-slope approximation (SSA), Doppler spectra due to ring waves were simulated and validated against experimental measurements. This study clarifies the mechanisms of rain-induced scattering and demonstrate the dominant role of ring waves in shaping the observed Doppler spectral signatures.

It is of great theoretical and practical significance to study the multidimensional statistical characteristics of sea clutter at different range resolutions, such as optimizing clutter modeling and suppression, improving radar system design and remote sensing data interpretation ability. The analysis of the effect of range resolution based on different sea clutter datasets poses a significant challenge in the drawing of reliable conclusions, owing to the variability in radar parameters and sea state conditions. In this paper, a new method is proposed to obtain sea clutter data with different range resolutions based on high resolution radar data by reducing the sampling time of the original intermediate frequency (IF) signal. Base on this method, the statistical characteristics of sea clutter at different range resolutions are analyzed for the first time, including the amplitude distribution, coherence length of sea texture, phase difference distribution, Doppler spectrum, and wave radial velocity of sea clutter at three range resolutions: high (0.75m), moderate (7.5m), and low (25m), while all other environmental parameters and radar parameters remain constant. The results clearly show the effect of range resolution on sea clutter properties and can be used to guide development of clutter models.

The Doppler characteristics of the backscattering field of sea surface are related to the motion of sea waves, which can be used for ocean dynamic parameter inversion and marine target detection. In order to study the Doppler characteristics of multiband sea surface echo at low grazing angles, a series of joint observation experiments of L-, S-, and X-band sea surface echo were carried out in Lingshan island located at Qingdao, China. The experimental results show that the Doppler shift and spectrum bandwidth all increased with the frequency of the incident electromagnetic wave. When radar looks along the up-wave direction, the Doppler shift of sea echo of HH-Pol is found to be greater than that of VV-Pol. For Doppler spectrum bandwidth, we also find that HH-Pol is slightly larger than VV-Pol. Moreover, the comparison of the results under different sea states shows that the Doppler shift and spectrum bandwidth all increase with significant wave height (SWH). In order to better understand the Doppler characteristics of sea echo at low grazing angles, a multiband theoretical Doppler model of sea echo at low grazing angles is established, taking into account tilt modulation, hydrodynamic modulation and the shadow effect of sea waves, and wave breaking under moderate-to-high sea states. The comparison results show that the simulated results are more consistent with the measured data after considering the influence of the breaking wave. The experimental and simulation results can provide a reference for the subsequent study of Doppler characteristics of multiband sea surface at low grazing angles.

Ocean wave information is very important for the safety of seaplanes. Generally, wave height inversion from X-band coherent radar images requires high spatial resolution. However, for airborne radar platforms, higher platform altitude often results in lower radar azimuth resolution, even exceeding the scale of the swell. It is well known that the correlation coefficient of coherent radar sea echoes is related to the sea state. Therefore, in this letter, a new method based on correlation coefficient was proposed to invert significant wave height (SWH) from the sea echoes acquired by the airborne coherent X-band radar. First, based on the parameters of aircraft and radar, the influence of system noise, spatial mismatch, angle variation, and sea surface motion on sea surface echoes correlation were discussed and the theoretical formulas were derived. Then, the empirical relationship between the correlation coefficient and the SWH was established based on the shore-based radar data. Finally, based on the empirical relationship between the correlation coefficient and the SWH, the SWH can be estimated by airborne coherent X-band radar images. This method was verified by an airborne X-band coherent radar experiment in the South China Sea. In comparison to the European Centre for Medium-Range Weather Forecasts (ECWMF), the root-mean-square error (RMSE) of the estimated SWH is 0.15 m with a bias of 0.12 m. The results indicate that this method can be used to estimate the SWH from airborne coherent X-band sea surface images.

The assessment of the microwave backscattering characteristics from breaking waves is crucial for ocean remote sensing and ocean target recognition. Nevertheless, due to the tough experimental environment and the complex geometric profile of breaking waves, research on the microwave scattering characteristics of breaking waves is still preliminary. In this study, the echoes from breaking waves near shore were measured by a C-band radar, which was conducted at incident angles from 20° to 60° with both horizontal polarization (HH-Pol) and vertical polarization (VV-Pol), to reveal the properties of the normalized radar cross section (NRCS) and the Doppler spectrum associated with wave breaking. The results show that the radar NRCS increase obviously when water waves are breaking. And the HH-VV polarization ratio of the scattering field from breaking waves is close to 1. On the other hand, the frequency shift and the band width of the Doppler spectrum of the scattered fields from breaking waves are both increasing. And the Doppler spectrum may have multiple spectral peaks due to the stronger scattering intensity and higher velocity of the breaking waves. In this work, an empirical model for the NRCS backscattered from breaking waves is proposed within the incidence angle range from 20° to 60° along different observation directions. The experimental results can provide reference for the subsequent research on microwave scattering characteristics of breaking waves.

The transition of the power system into a low-carbon power system (LCPS) with a high penetration of renewable energy resources addresses several issues related to energy and climate. However, due to the uncertainty associated with renewable power generation (RPG), deriving an accurate effective locational marginal pricing (LMP) for an LCPS remains a challenge. To address this challenge, we propose a novel information theory-based framework for LMP calculation that quantifies the fluctuations in the LMP due to uncertainty associated with RPG and random loads in an LCPS. First, based on the information entropy levelized cost of energy, we introduce the equivalent cost of RPG to ensure that the cost of RPG is not zero under the LMP mechanism so that it can bid reasonably in the market to provide accurate price signals. We, then, design a security-constrained economic dispatch model incorporating the RPG equivalent cost to balance uncertainty and energy demand in the LCPS electricity market. Furthermore, we propose an uncertainty-constrained model of buses and branches in LCPS based on information theory that is developed to clarify the physical significance of the information that reduces generation and load uncertainty within the LMP framework.