动态超表面天线(dynamic metasurface antenna,DMA)已成为空基平台波达方向(direction of ar rival,DOA)估计的优选技术,但其性能易受平台抖动的影响。针对空基平台在DOA估计中面临的角度随机抖动问题,提出了一种基于DMA异构码本循环卡...动态超表面天线(dynamic metasurface antenna,DMA)已成为空基平台波达方向(direction of ar rival,DOA)估计的优选技术,但其性能易受平台抖动的影响。针对空基平台在DOA估计中面临的角度随机抖动问题,提出了一种基于DMA异构码本循环卡尔曼滤波的抗抖动DOA估计算法。首先,针对角度随机抖动导致的接收端数据非线性问题,提出了一种非线性误差分离方案,将接收数据中的抖动误差转化为易于分离的线性分量,便于后续的抖动分量滤除。其次,为了使接收数据与卡尔曼滤波算法相匹配,提出了一种异构码本循环方案,通过在长时间尺度上构建相同的DMA码字,以支持卡尔曼滤波算法利用累积的时间信息来识别和滤除抖动误差。最后,卡尔曼滤波处理后的数据通过原子范数方法恢复出稀疏信号,并采用基于Han kel矩阵分解的多信号分类(multiple signal classification,MUSIC)方法进行空间谱估计。仿真结果证实,在相同信噪比(signal-to-noise ratio,SNR)条件下,所提方案相较于传统的多次估计平均方案,估计精度提升了48%,估计结果更接近无抖动的理想状态。展开更多
Fuzz testing is a widely adopted technique for uncovering bugs and security vulnerabilities in embedded firmware.However,many embedded systems heavily rely on peripherals,rendering conventional fuzzing techniques inef...Fuzz testing is a widely adopted technique for uncovering bugs and security vulnerabilities in embedded firmware.However,many embedded systems heavily rely on peripherals,rendering conventional fuzzing techniques ineffective.When peripheral responses are missing or incorrect,fuzzing a firmware may crash or exit prematurely,significantly limiting code coverage.While prior re-hosting approaches have made progress in simulating Memory-Mapped Input/Output(MMIO)and interrupt-based peripherals,they either ignore Direct Memory Access(DMA)or handle it oversimplified.In this work,we present ADFEmu,a novel automated firmware re-hosting framework that enables effective fuzzing of DMA-enabled firmware.ADFEmu integrates concolic execution with large language models(LLMs)to semantically emulate DMA operations and synthesize peripheral input sequences intelligently.Specifically,it learns DMA transfer patterns from the firmware’s context and employs guided symbolic execution to explore deeper and more diverse execution paths.This approach allows firmware to operate stably without hardware dependencies while achieving higher fidelity in emulation.Evaluated on real-world embedded firmware samples,ADFEmu achieves a 100%re-hosting success rate,improves total execution path exploration by 5.31%,and triggers more crashes compared to the state-of-the-art.These results highlight ADFEmu’s effectiveness in overcoming long-standing limitations of DMA emulation and its potential to advance automated vulnerability discovery in peripheral-rich embedded environments.展开更多
文摘动态超表面天线(dynamic metasurface antenna,DMA)已成为空基平台波达方向(direction of ar rival,DOA)估计的优选技术,但其性能易受平台抖动的影响。针对空基平台在DOA估计中面临的角度随机抖动问题,提出了一种基于DMA异构码本循环卡尔曼滤波的抗抖动DOA估计算法。首先,针对角度随机抖动导致的接收端数据非线性问题,提出了一种非线性误差分离方案,将接收数据中的抖动误差转化为易于分离的线性分量,便于后续的抖动分量滤除。其次,为了使接收数据与卡尔曼滤波算法相匹配,提出了一种异构码本循环方案,通过在长时间尺度上构建相同的DMA码字,以支持卡尔曼滤波算法利用累积的时间信息来识别和滤除抖动误差。最后,卡尔曼滤波处理后的数据通过原子范数方法恢复出稀疏信号,并采用基于Han kel矩阵分解的多信号分类(multiple signal classification,MUSIC)方法进行空间谱估计。仿真结果证实,在相同信噪比(signal-to-noise ratio,SNR)条件下,所提方案相较于传统的多次估计平均方案,估计精度提升了48%,估计结果更接近无抖动的理想状态。
基金funded by the Science and Technology Project of State Grid Jiangsu Electric Power Company Ltd.,grant number J2024169.
文摘Fuzz testing is a widely adopted technique for uncovering bugs and security vulnerabilities in embedded firmware.However,many embedded systems heavily rely on peripherals,rendering conventional fuzzing techniques ineffective.When peripheral responses are missing or incorrect,fuzzing a firmware may crash or exit prematurely,significantly limiting code coverage.While prior re-hosting approaches have made progress in simulating Memory-Mapped Input/Output(MMIO)and interrupt-based peripherals,they either ignore Direct Memory Access(DMA)or handle it oversimplified.In this work,we present ADFEmu,a novel automated firmware re-hosting framework that enables effective fuzzing of DMA-enabled firmware.ADFEmu integrates concolic execution with large language models(LLMs)to semantically emulate DMA operations and synthesize peripheral input sequences intelligently.Specifically,it learns DMA transfer patterns from the firmware’s context and employs guided symbolic execution to explore deeper and more diverse execution paths.This approach allows firmware to operate stably without hardware dependencies while achieving higher fidelity in emulation.Evaluated on real-world embedded firmware samples,ADFEmu achieves a 100%re-hosting success rate,improves total execution path exploration by 5.31%,and triggers more crashes compared to the state-of-the-art.These results highlight ADFEmu’s effectiveness in overcoming long-standing limitations of DMA emulation and its potential to advance automated vulnerability discovery in peripheral-rich embedded environments.
