Security Architecture Paper Sharing [论文分享] SpecDoctor: Differential Fuzz Testing to Find Transient Execution Vulnerabilities