IoTvulCode: AI-enabled vulnerability detection in software products designed for IoT applications

Guru Prasad Bhandari,Gebremariam Assres,Nikola Gavric,Andrii Shalaginov,Tor-Morten Grønli

DOI: https://doi.org/10.1007/s10207-024-00848-6

2024-05-11

International Journal of Information Security

Abstract:The proliferation of the Internet of Things (IoT) paradigm has ushered in a new era of connectivity and convenience. Consequently, rapid IoT expansion has introduced unprecedented security challenges , among which source code vulnerabilities present a significant risk. Recently, machine learning (ML) has been increasingly used to detect source code vulnerabilities. However, there has been a lack of attention to IoT-specific frameworks regarding both tools and datasets. This paper addresses potential source code vulnerabilities in some of the most commonly used IoT frameworks. Hence, we introduce IoTvulCode - a novel framework consisting of a dataset-generating tool and ML-enabled methods for detecting source code vulnerabilities and weaknesses as well as the initial release of an IoT vulnerability dataset. Our framework contributes to improving the existing coding practices, leading to a more secure IoT infrastructure. Additionally, IoTvulCode provides a solid basis for the IoT research community to further explore the topic.

computer science, information systems, theory & methods, software engineering

What problem does this paper attempt to address?

The paper focuses on the security issues of Internet of Things (IoT) devices, specifically vulnerabilities in the source code. With the increasing use of IoT devices, security challenges have become more prominent, and vulnerabilities in the source code pose a significant risk. Although machine learning (ML) has been used to detect source code vulnerabilities, there is a relative lack of tools and datasets specific to IoT frameworks.

The paper introduces a new framework called IoTvulCode, which includes a tool for generating datasets and utilizes ML and natural language processing (NLP) methods to detect vulnerabilities in the source code. IoTvulCode aims to improve existing coding practices, enhance the security of IoT infrastructure, and provide a foundation for further exploration of this topic within the IoT research community.

The authors collected source code from commonly used IoT projects and created a labeled dataset consisting of vulnerable and non-vulnerable samples. The vulnerability types in the dataset are categorized according to the Common Weakness Enumeration (CWE). Additionally, IoTvulCode provides an open-source tool that can extract and analyze data incrementally, allowing the process to continue even in the event of system interruptions.

The paper also reviews existing vulnerability detection methods, IoT vulnerability code datasets, and ML models used for detecting IoT code vulnerabilities. The IoTvulCode dataset is much larger than existing IoT-specific source code datasets, covering a wider range of samples and providing binary and multi-class vulnerability type classification.

In summary, the paper aims to develop an AI-driven vulnerability detection framework for IoT applications to enhance the security of IoT software and fill the gap in specialized tools and datasets for IoT frameworks.