Abstract:The rapid expansion of the open-source community has shortened the software development cycle, but the spread of vulnerabilities has been accelerated, especially in the field of the Internet of Things. In recent years, the frequency of attacks against connected devices is increasing exponentially; thus, the vulnerabilities are more serious in nature. The state-of-the-art firmware security inspection technologies, such as methods based on machine learning and graph theory, find similar applications depending on the known vulnerabilities but cannot do anything without detailed information about the vulnerabilities. Moreover, model training, which is necessary for the machine learning technologies, requires a significant amount of time and data, resulting in low efficiency and poor extensibility. Aiming at the above shortcomings, a high-efficiency similarity analysis approach for firmware code is proposed in this study. First, the function control flow features and data flow features are extracted from the functions of the firmware and of the vulnerabilities, and the features are used to calculate the SimHash of the functions. The mass storage and fast query capabilities of the SimHash are implemented by the pigeonhole principle. Second, the similarity function pairs are analyzed in detail within and among the basic blocks. Within the basic blocks, the symbolic execution is used to generate the basic block semantic information, and the constraint solver is used to determine the semantic equivalence. Among the basic blocks, the local control flow graphs are analyzed to obtain their similarity. Then, we implemented a prototype and present the evaluation. The evaluation results demonstrate that the proposed approach can implement large-scale firmware function similarity analysis. It can also get the location of the real-world firmware patch without vulnerability function information. Finally, we compare our method with existing methods. The comparison results demonstrate that our method is more efficient and accurate than the Gemini and StagedMethod. More than 90% of the firmware functions can be indexed within 0.1 s, while the search time of 100,000 firmware functions is less than 2 s.

A Component Vulnerability Matching Approach for IoT Firmware.

An architecture-based reliability estimation framework through component composition mechanisms

Rethinking IoT Security: Understanding and Mitigating Out-of-Band Vulnerabilities

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-Party Components in IoT Firmware

A Search-based Firmware Code Analysis Method for IoT Devices

UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware

Staged Method of Code Similarity Analysis for Firmware Vulnerability Detection

One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware

Firmware Vulnerability Detection Algorithm Based on Matching Pattern-Specific Numerical Features With Structural Features

Toward Hybrid Static-Dynamic Detection of Vulnerabilities in IoT Firmware

Faster and Better: Detecting Vulnerabilities in Linux-based IoT Firmware with Optimized Reaching Definition Analysis

Research of Component Composition Technology Based on Software Architecture Connector

Firmware Fuzzing: the State of the Art

Implementing a High-Efficiency Similarity Analysis Approach for Firmware Code

Cyber Vulnerability Intelligence for Internet of Things Binary

Risk assessment method for IoT software supply chain vulnerabilities

An Adaptive Software Architecture Model Based on Component-Mismatches Detection and Elimination

Research on Common-Cause Failures of Web Service Composition

A Survey on IoT Vulnerability Discovery.

Analysis Method of Security Critical Components of Industrial Cyber Physical System Based on SysML.