Jiangtao Li

As software systems continue to grow in scale and complexity, fuzzing has become an indispensable automated technique for vulnerability discovery. Compared with coverage-guided fuzzing, directed greybox fuzzing (DGF) focuses execution toward specific basic blocks or functions, making it widely used in scenarios such as patch testing and vulnerability reproduction. Recent studies have combined fuzzing with symbolic execution (SE) to generate inputs that are difficult to obtain through mutation alone. However, applying SE to all branch conditions along an execution path may explore many paths unrelated to the target, leading to substantial overhead in directed fuzzing. Meanwhile, existing distance metrics still have limitations in guiding seeds toward targets: AFLGo relies on structural control-flow distances, which may not precisely reflect target reachability, while existing probability-based metrics often simplify complex control-flow structures such as loops and back-edges. To address these limitations, we propose TriFuzz, a probabilistic distance-guided hybrid directed fuzzing framework that integrates a loop-aware reachability distance model, target-related selective symbolic instrumentation, and a tightly coupled AFLGo–SymCC coordination mechanism. TriFuzz uses the probability-based distance model as the primary guidance signal and applies selective symbolic instrumentation to prune irrelevant basic blocks and concentrate exploration on target-relevant code regions. Our evaluation on the AFLGo testsuite and UniBench shows that TriFuzz improves both time-to-target and time-to-exposure on most evaluated benchmarks, demonstrating the effectiveness of combining fine-grained probabilistic distance guidance with selective symbolic reasoning and tightly integrated hybrid execution.

The vehicular network primarily relies on the Controller Area Network (CAN) because it meets the requirements of vehicular networks in terms of high reliability and real-time performance. However, the absence of robust security measures on the CAN bus exposes vulnerabilities, enabling attackers to potentially compromise vehicles remotely. Many cryptography based methods are proposed to enhance the security of CAN bus, but they rarely involve key management issues. In this paper, we propose a lightweight group key management scheme that innovatively utilizes the residual part of the Message Authentication Code (MAC) of data stream to maintain a synchronized fields between Electronic Control Units (ECUs), which is called hippocampus. Each ECU executes the refresh process by applying the XOR operation between hippocampus and old key. Moreover, we provide formal security proofs and informal analyses for the robustness of the proposed scheme. Afterwards, a series of evaluations on three typical hardware platforms are detailed. The results demonstrate that the additional time overhead introduced by our scheme remains within acceptable limits and validate its advantage, efficiency, and flexibility by comparing it with other methods.

As the Internet of Vehicles (IoV) evolves, integrating Location-Based Services (LBS) into in-vehicle software has become increasingly common. Consequently, protecting users' location privacy has emerged as a critical concern. Vehicles face the challenge of sending query requests to untrusted Location Service Providers (LSP) through untrusted Roadside Units (RSU) to obtain relevant results. This situation presents two primary risks: (1) the involvement of untrusted RSU increases the likelihood of monitoring vehicle communications with the LSP, and (2) repeated queries to the untrusted LSP increase the risk of privacy breaches during interactions. This paper proposes an innovative location privacy protection scheme for continuous LBS in the IoV, called LPPS-IKHC, which combines improved $k$-anonymity with hybrid cache. The scheme utilizes anonymous techniques and hybrid cache to mitigate the risk of exposing sensitive information to untrusted entities. To protect against adversaries, LPPS-IKHC generates specific anonymous sets in the presence of untrusted RSU. Additionally, an anonymous algorithm incorporating trajectory similarity is introduced to protect trajectory privacy, further enhancing user location privacy. Furthermore, by reducing the number of interactions between vehicles and untrusted LSP, hybrid caching helps diminish the risk of privacy disclosure. Extensive experimental results demonstrate that the LPPS-IKHC method provides superior privacy protection and lower system overhead compared to existing schemes.

As one of the most critical aspects of mobile ad hoc networks, vehicular ad hoc networks (VANETs) have attracted increasing attention with the growing demand for safety in transportation systems. Trust assessment is crucial in VANETs, as it can effectively identify and mitigate the impact of malicious vehicles, thereby ensuring the reliability and security of network communication. However, the models in most existing trust schemes cannot be dynamically updated over time, failing to adapt to the high dynamics of VANETs. Moreover, they lack protection for data privacy, increasing the risk of information tampering and leakage. To solve the above problems, this paper proposes a new Dynamic Model Update-based Trust Assessment Strategy for VANETs Considering Blockchain (DMTAS-VB). Specifically, DMTAS-VB addresses two primary aspects. Firstly, with respect to the dynamic model, the trust framework proposed in this study incorporates both direct trust and recommended trust models that are dynamically updated as interactions progress. Secondly, regarding privacy protection, blockchain is introduced into the trust model of this scheme. The innovative three-chain structure (MainBC, MesBC, and RepBC) is adopted to achieve functional separation, and core identity authentication, high-frequency message exchange, and reputation management are handled independently. The system can more flexibly optimize the performance parameters of each chain while enhancing data security and privacy protection. Simulation results demonstrate that the proposed scheme outperforms comparative approaches in detection performance under various conditions (vehicle number, vehicle speed, proportion of malicious vehicles) and different attack modes (SA, ZA, BMA, BA, and CA).

The security and privacy challenges faced by Vehicular Ad hoc Networks (VANETs) have led to the development of conditional privacy-preserving authentication (CPPA) schemes. Hardware security modules (HSMs) are seen as a promising solution for implementing these schemes while minimizing the burden on certificate storage. However, existing HSM-based CPPA schemes still have high computation overhead and do not meet the forward security requirements for system secret key (SSK) updates. To address these challenges, we propose an HSM-based lightweight CPPA scheme for VANETs that enjoy low computation costs. Most operations could be performed within the HSM before the message is ready to be signed, reducing real-time computation delay. The scheme also supports SSK updating using an identity-based batch multi-signature algorithm, which helps to provide forward security and vehicle revocation. Especially, the proposed SSK update scheme does not rely on any single trusted authority. Formal proof demonstrates that the proposed scheme satisfies the desired security notions. Our analysis shows that this scheme surpasses other similar ones in terms of efficiency when it comes to generating signatures.

Edge computing provides higher computational power and lower transmission latency by offloading tasks to nearby edge nodes with available computational resources to meet the requirements of time-sensitive tasks and computationally complex tasks. Resource allocation schemes are essential to this process. To allocate resources effectively, it is necessary to attach metadata to a task to indicate what kind of resources are needed and how many computation resources are required. However, these metadata are sensitive and can be exposed to eavesdroppers, which can lead to privacy breaches. In addition, edge nodes are vulnerable to corruption because of their limited cybersecurity defenses. Attackers can easily obtain end-device privacy through unprotected metadata or corrupted edge nodes. To address this problem, we propose a metadata privacy resource allocation scheme that uses searchable encryption to protect metadata privacy and zero-knowledge proofs to resist semi-malicious edge nodes. We have formally proven that our proposed scheme satisfies the required security concepts and experimentally demonstrated the effectiveness of the scheme.