SoK：你找到你所寻求的：重新思考硬件模糊测试中的预言机、引导和输入生成
SoK: You Find What You Seek: Rethinking Oracles, Guidance, and Input Generation in Hardware Fuzzing
浏览论文内容
中文总结 AI 辅助
本文通过分析52个硬件模糊测试器，提出有界搜索框架，区分增强CRV与定向对抗测试两种角色，指出主流采用需可重用接口、目标特定资产、可复现评估和透明报告。
中文摘要 AI 辅助
硬件模糊测试是安全验证研究中的一个活跃领域，然而其在工业界的应用仍处于早期阶段。本SoK考察了软件模糊测试中的哪些经验教训可以迁移到硬件，以及哪些地方需要独特的方法。通过分析涵盖RTL/IP、CPU、NoC和SoC设计的52个模糊测试器，我们引入了一个分析框架，将验证视为有界搜索。该搜索由其目标、预言机、引导、输入生成、目标抽象和预算定义。因此，一次测试活动只能在其资源耗尽之前，发现其能够有效达到、识别并优先排序的故障。我们区分了硬件模糊测试的两个角色：（1）通过反馈引导的覆盖率增强约束随机验证（CRV），以及（2）基于威胁模型和安全规范的定向对抗性测试。通过我们的框架，我们识别了每次活动能够观察和生成的内容，为评估报告结果背后的证据提供了基础。我们的分析表明，硬件模糊测试的主流采用将需要可重用的接口、目标特定的验证资产、可复现的评估以及成本和用户努力的透明报告。
英文摘要
Hardware fuzzing is an active area in security verification research, yet its industrial adoption remains in its early stages. This SoK examines which lessons from software fuzzing carry over to hardware and where unique approaches are needed. By analyzing 52 fuzzers across RTL/IP, CPU, NoC, and SoC designs, we introduce an analytical framework that frames verification as a bounded search. This search is defined by its objective, oracle, guidance, input generation, target abstraction, and budget. Consequently, a campaign only uncovers failures it can effectively reach, recognize, and prioritize before exhausting its resources. We distinguish two roles for hardware fuzzing: (1) augmenting constrained-random verification (CRV) via feedback-guided coverage and (2) directed adversarial testing based on threat models and security specifications. Through our framework, we identify what each campaign can observe and generate, providing a basis for assessing the evidence behind reported results. Our analysis suggests that mainstream adoption of hardware fuzzing will require reusable interfaces, target-specific verification assets, reproducible evaluations, and transparent reporting of cost and user effort.
发表机构
- UC San Diego（加州大学圣迭戈分校）
机构由 AI 辅助整理，请以论文原文为准。
