物联网设备固件自动化漏洞挖掘技术研究综述

刘航天; 甘水滔; 张超; 张红旗; 孙文厚; 高子聪; 赵敏; 白雪

doi:10.11959/j.issn.2096-109x.2025014

您当前的位置：

首页 >

文章列表页 >

物联网设备固件自动化漏洞挖掘技术研究综述

综述 | 更新时间：2025-05-14

- 物联网设备固件自动化漏洞挖掘技术研究综述
- Survey on automated vulnerability mining techniques for IoT device firmware
- 网络与信息安全学报 2025年11卷第2期页码：26-49
- 作者机构：
  
  1.信息工程大学，河南郑州 450001
  2.先进计算与智能工程国家级重点实验室，江苏无锡 214084
  3.清华大学，北京 100084
  4.中关村实验室，北京 100190
  5.河南省信息安全重点实验室，河南郑州 450001
- 作者简介：
  
  [ "刘航天（1991- ），男，河南扶沟人，信息工程大学博士生，主要研究方向为物联网设备安全、大模型应用。" ]
  [ "甘水滔（1986- ），男，江西宜春人，先进计算与智能工程国家级重点实验室研究员，主要研究方向为网络安全、人工智能应用。" ]
  [ "张超（1986- ），男，湖北黄冈人，清华大学副教授、博士生导师，主要研究方向为软件与系统安全、人工智能安全。" ]
  [ "张红旗（1962- ），男，河北遵化人，信息工程大学教授、博士生导师，主要研究方向为网络安全、移动目标防御、等级保护和信息安全管理。" ]
  [ "孙文厚（1998- ），男，山东日照人，清华大学硕士生，主要研究方向为嵌入式固件仿真。" ]
  [ "高子聪（1996- ），男，江苏张家港人，信息工程大学博士生，主要研究方向为物联网设备漏洞挖掘。" ]
  [ "赵敏（1992- ），女，陕西咸阳人，先进计算与智能工程国家级重点实验室助理工程师，主要研究方向为信息安全管理。" ]
  [ "白雪（1984- ），女，吉林白山人，信息工程大学硕士生，主要研究方向为大数据安全管理。" ]
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2025014
  中图分类号： TP393
- 收稿：2024-07-30，
  
  修回：2024-11-27，
  
  纸质出版：2025-04-25
- 稿件说明：
移动端阅览
刘航天, 甘水滔, 张超, 等. 物联网设备固件自动化漏洞挖掘技术研究综述[J]. 网络与信息安全学报, 2025, 11(2): 26-49.

LIU H T, GAN S T, ZHANG C, et al. Survey on automated vulnerability mining techniques for IoT device firmware[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 26-49.
刘航天, 甘水滔, 张超, 等. 物联网设备固件自动化漏洞挖掘技术研究综述[J]. 网络与信息安全学报, 2025, 11(2): 26-49. DOI： 10.11959/j.issn.2096-109x.2025014.

LIU H T, GAN S T, ZHANG C, et al. Survey on automated vulnerability mining techniques for IoT device firmware[J]. Chinese Journal of Network and Information Security, 2025, 11(2): 26-49. DOI： 10.11959/j.issn.2096-109x.2025014.

摘要

随着物联网技术的广泛应用，物联网设备爆炸式增长。近年来，物联网设备导致的安全事件频发，使得物联网设备安全研究成为热点。首先，对物联网设备固件的安全特性（包括黑盒特性、网络特性和定制化特性）进行了深入剖析，这些特性给自动化漏洞挖掘带来了新的挑战。固件代码闭源、运行环境封闭、网络交互复杂、软硬件高度定制化，这些都增加了固件安全分析的难度。针对这些挑战，研究人员研发了一系列解决方案。通过对现有文献进行综合分析，从黑盒模糊测试、灰盒模糊测试、静态程序分析和固件重托管4个方面，总结了物联网设备固件自动化漏洞挖掘技术的最新研究进展。在此基础上，分析了尚存在的挑战和不足，并提出了未来的研究方向和思路，包括多种技术有机组合的发展趋势、大语言模型在自动化漏洞挖掘中的应用前景，以及物联网技术演进驱动漏洞挖掘技术的同步升级。通过对物联网设备固件自动化漏洞挖掘技术现状及发展趋势的深入剖析和总结，为业界下一步研究及应用提供有价值的参考。

Abstract

With the wide application of IoT technology

IoT devices have exploded. In recent years

security incidents caused by IoT devices have occurred frequently

which makes the research of IoT device security become a hot spot. The security analysis of IoT device firmware has been conducted

with a focus on its black-box nature

network characteristics

and customization features. Challenges to automated vulnerability mining have been highlighted

such as the closed-source firmware code

closed operating environment

complex network interactions

and highly customized hardware-software. Researchers have proposed a series of advanced technologies and methods to address these challenges. The existing literature was comprehensively analyzed

and the latest research progress in automated vulnerability mining technology for IoT device firmware was summarized from four aspects: black-box fuzzing

gray-box fuzzing

static program analysis

and firmware re-hosting. Based on the analysis of the current research status

existing challenges and deficiencies were pointed out

and future research directions and ideas were proposed

including the development trend of multi-technology organically combination

the application prospects of large language models in automated vulnerability mining

and the synchronous upgrade of vulnerability mining technology driven by the evolution of IoT technology. An in-depth analysis and summary of the current status and development trends of automated vulnerability mining technology for IoT device firmware were provided

offering valuable references for future research and applications in the industry.

关键词

Keywords

references

ZAHID M , BHARATI T S . Empowering IoT networks [J ] . Artificial Intelligence for Blockchain and Cybersecurity Powered IoT Applications , 2025 , 16 : 99 .

SLOWIK J . Crashoverride: reassessing the 2016 ukraine electric power event as a protection-focused attack [J ] . Dragos , Inc, 2019 .

KOLIAS C , KAMBOURAKIS G , STAVROU A , et al . DDoS in the IoT: Mirai and other botnets [J ] . Computer , 2017 , 50 ( 7 ): 80 - 84 .

于颖超 , 陈左宁 , 甘水滔 , 等 . 嵌入式设备固件安全分析技术研究 [J ] . 计算机学报 , 2021 , 44 ( 5 ): 859 - 881 .

YU Y C , CHEN Z N , GAN S T , et al . Survey on the technologies of security analysis on embedded device firmware [J ] . Chinese Journal of Computers , 2021 , 44 ( 5 ) : 859 - 881 .

郑尧文 , 文辉 , 程凯 , 等 . 物联网设备漏洞挖掘技术研究综述 [J ] . 信息安全学报 , 2019 , 4 ( 5 ): 62 - 75 .

ZHENG Y W , WEN H , CHENG K , et al . A survey of IoT device vulnerability mining techniques [J ] . Journal of Cyber Security , 2019 , 4 ( 5 ) : 62 - 75 .

FENG X T , ZHU X G , HAN Q L , et al . Detecting vulnerability on IoT device firmware: a survey [J ] . IEEE/CAA Journal of Automatica Sinica , 2023 , 10 ( 1 ): 25 - 41 .

WANG Z , ZHANG L , CAO C , et al . The effectiveness of large language models (ChatGPT and CodeBERT) for security-oriented code analysis [J ] . Available at SSRN 4567887 , 2023 .

LEMIEUX C , INALA J P , LAHIRI S K , et al . Codamosa: escaping coverage plateaus in test generation with pre-trained large language models [C ] // Proceedings of 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2023 : 919 - 931 .

KANG S , YOON J , YOO S . Large language models are few-shot testers: exploring LLM-based general bug reproduction [C ] // Proceedings of 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2023 : 2312 - 2323 .

YAN P , TAN S , WANG M , et al . Prompt engineering-assisted malware dynamic analysis using GPT-4 [J ] . Arxiv Preprint Arxiv: 2312.08317 , 2023 .

TAKANEN A . Fuzzing: the past, the present and the future [J ] . AcFondation Robert Schuman , 2009 : 202 - 212 .

CHEN C , CUI B J , MA J X , et al . A systematic review of fuzzing techniques [J ] . Computers & Security , 2018 , 75 : 118 - 137 .

GODEFROID P , LEVIN MY , MOLNAR D A . SAGE: whitebox fuzzing for security testing [J ] . Communications of the ACM , 2012 , 55 ( 3 ): 40 - 44 .

GANESH V , LEEK T , RINARD M . Taint-based directed whitebox fuzzing [C ] // Proceedings of 2009 IEEE 31st International Conference on Software Engineering . Piscataway : IEEE Press , 2009 : 474 - 484 .

GUTMANN P . Fuzzing code with AFL [J ] . Login USENIX Mag , 2016 , 41 ( 2 ): 11 - 14 .

GAN S , ZHANG C , QIN X , et al . CollAFL: path sensitive fuzzing [C ] // Proceedings of 2018 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2018 : 679 - 696 .

BOHME M , PHAM V T , ROYCHOUDHURY A . Coverage-based greybox fuzzing as markov chain [C ] // Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2016 : 1032 - 1043 .

RAWAT S , JAIN V , KUMAR A , et al . VUzzer: application-aware evolutionary fuzzing [C ] // Proceedings of the 2017 Network and Distributed System Security Symposium (NDSS 2017) . Virginia : the Internet Society , 2017 : 1 - 14 .

FIORALDI A , MAIER D C , ZHANG D , et al . LibAFL: a framework to build modular and reusable fuzzers [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2022 : 1051 - 1065 .

SCHUMILO S , ASCHERMANN C , GAWLIK R , et al . kAFL:hardware-assisted feedback fuzzing for OS kernels [C ] // Proceedings of 26th USENIX security symposium (USENIX Security 2017) . Berkeley : USENIX Association , 2017 : 167 - 182 .

WANG D , ZHANG Z , ZHANG H , et al . SyzVegas: beating kernel fuzzing odds with reinforcement learning [C ] // Proceedings of 30th USENIX Security Symposium (USENIX Security 2021) . Berkeley : USENIX Association , 2021 : 2741 - 2758 .

JUNG J , TONG S , HU H , et al . WINNIE: fuzzing windows applications with harness synthesis and fast cloning [C ] // Proceedings of the 2021 Network and Distributed System Security Symposium (NDSS 2021) . Virginia : the Internet Society , 2021 .

DI B L , MOGHADDAS H , PAYER M . ARMore: pushing love back into binaries [C ] // Proceedings of in the 32nd USENIX Security Symposium (USENIX Security 23) . Berkeley : USENIX Association , 2023 : 6311 - 6328 .

DELIA D C , INVIDIA L , PALMARO F , et al . Evaluating dynamic binary instrumentation systems for conspicuous features and artifacts [J ] . Digital Threats: Research and Practice (DTRAP) , 2022 , 3 ( 2 ): 1 - 3 .

LUK C K , COHN R , MUTH R , et al . Pin: building customized program analysis tools with dynamic instrumentation [C ] // ] Proceedings of the ACM SIGPLAN 2005 Conference on ProgrammingLanguage Design and Implementation ACM Sigplan Notices . New York : ACM Press , 2005 : 190 - 200 .

BOHME M , PHAM V T , NGUYEN M D , et al . Directed greybox fuzzing [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2017 : 2329 - 2344 .

HUANG H , GUO Y , SHI Q , et al . Beacon: directed grey-box fuzzing with provable path pruning [C ] // Proceedings of in 2022 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2022 : 36 - 50 .

CHEN H , XUE Y , LI Y , et al . Hawkeye: towards a desired directed grey-box fuzzer [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2018 : 2095 - 2108 .

LEE G , SHIM W , LEE B . Constraint-guided directed greybox fuzzing [C ] // Proceedings of 30th USENIX Security Symposium (USENIX Security 21) . Berkeley : USENIX Association , 2021 : 3559 - 3576 .

YUE T , WANG P F , TANG Y , et al . EcoFuzz: adaptive energy-saving greybox fuzzing as a variant of the adversarial multi-armed bandit [C ] // Proceedings of 29th USENIX Security Symposium (USENIX Security 20) . Berkeley : USENIX Association , 2020 : 2307 - 2324 .

王蕾 , 李丰 , 李炼 , 等 . 污点分析技术的原理和实践应用 [J ] . 软件学报 , 2017 , 28 ( 4 ): 860 - 882 .

WANG L , LI F , LI L , et al . Principle and practice of taint analysis [J ] . Journal of Software , 2017 , 28 ( 4 ): 860 - 882 .

TRIPP O , PISTOIA M , FINK S J , et al . TAJ: effective taint analysis of web applications [J ] . ACM Sigplan Notices , 2009 , 44 ( 6 ): 87 - 97 .

TRIPP O , PISTOIA M , COUSOT P , et al . Andromeda: accurate and scalable security analysis of web applications [C ] // Proceedings of Fundamental Approaches to Software Engineering: 16th International Conference (FASE) . Berlin : Springer , 2013 : 210 - 225 .

ARZT S , RASTHOFER S , FRITZ C , et al . FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps [J ] . ACM Sigplan Notices , 2014 , 49 ( 6 ): 259 - 269 .

ENCK W , GILBERT P , HAN S , et al . TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones [J ] . ACM Transactions on Computer Systems (TOCS) . 2014 , 32 ( 2 ): 1 - 29 .

VENKATARAMANI G , DOUDALIS I , SOLIHIN Y , et al . Flexitaint: a programmable accelerator for dynamic taint propagation [C ] // Proceedings of 2008 IEEE 14th International Symposium on High Performance Computer Architecture . Piscataway : IEEE Press , 2008 : 173 - 184 .

KING J C . Symbolic execution and program testing [J ] . Communications of the ACM , 1976 , 19 ( 7 ): 385 - 394 .

CADAR C , DUNBAR D , ENGLER D R . KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs [C ] // Proceedings of USENIX Symposium on Operating Systems Design and Implementation (OSDI 08) . Berkeley : USENIX Association , 2008 : 209 - 224 .

PASAREANU C S , VISSER W , BUSHNELL D , et al . Symbolic PathFinder: integrating symbolic execution with model checking for Java bytecode analysis [J ] . Automated Software Engineering , 2013 : 391 - 425 .

TILLMANN N , DE H J . Pex-white box test generation for net [C ] // Proceedings of International Conference on Tests and Proofs . Berlin : Springer , 2008 : 134 - 153 .

CHIPOUNOV V , KUZNETSOV V , CANDEA G . S2E: a platform for in-vivo multi-path analysis of software systems [J ] . ACM Sigplan Notices , 2011 , 46 ( 3 ): 265 - 278 .

LOCKHART D , ILBEYI B , BATTEN C . Pydgin: generating fast instruction set simulators from simple architecture descriptions with meta-tracing JIT compilers [C ] // Proceedings of 2015 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS) . Piscataway : IEEE Press , 2015 : 256 - 267 .

GE X Y , CUI W D , JAEGER T . GRIFFIN: guarding control flows using intel processor trace [C ] // Proceedings of the Twenty-Second International Conference on Architectural Support for Programming Languages and Operating Systems . 2017 : 585 - 598 .

NING Z Y , ZHANG F . Ninja: towards transparent tracing and debugging on ARM [C ] // Proceedings of 26th USENIX Security Symposium (USENIX Security 17) . Berkeley : USENIX Association , 2017 : 33 - 49 .

LIU H T , GAN S , ZHANG C , et al . Labrador: response guided directed fuzzing for black-box IoT devices [C ] // Proceedings of 2024 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2024 : 127 - 127 .

AAFER Y , YOU W , SUN Y , et al . Android SmartTVs vulnerability discovery via log-guided fuzzing [C ] // Proceedings of 30th USENIX Security Symposium (USENIX Security 21) . Berkeley : USENIX Association , 2021 : 2759 - 2776 .

FENG X T , SUN R X , ZHU X G , et al . Snipuzz: black-box fuzzing of IoT firmware via message snippet inference [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2021 : 337 - 350 .

NKUBA C K , KIM S , DIETRICH S , et al . Riding the IoT wave with VFuzz: discovering security flaws in smart homes [J ] . IEEE Access , 2021 , 10 : 1775 - 1789 .

ZHANG Y , HUO W , JIAN K P , et al . SRFuzzer: an automatic fuzzing framework for physical SOHO router devices to discover multi-type vulnerabilities [C ] // Proceedings of the 35th Annual Computer Security Applications Conference . New York : ACM Press , 2019 : 544 - 556 .

ZHANG Y , HUO W , JIAN K P , et al . ESRFuzzer: an enhanced fuzzing framework for physical SOHO router devices to discover multi-type vulnerabilities [J ] . Cybersecurity , 2021 , 4 ( 1 ): 1 - 22 .

XU H K , YU M , WANG Y H , et al . Trampoline over the air: breaking in IoT devices through MQTT brokers [C ] // Proceedings of 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2022 : 171 - 187 .

ZHANG H W , LU K , ZHOU X , et al . SIoTFuzzer: fuzzing web interface in IoT firmware via stateful message generation [J ] . Applied Sciences , 2021 , 11 ( 7 ): 3120 .

XIE W , CHEN J Y , WANG Z H , et al . Game of hide-and-seek: exposing hidden interfaces in embedded web applications of IoT devices [C ] // Proceedings of the ACM Web Conference . New York : ACM Press , 2022 : 524 - 532 .

CHEN J Y , DIAO W R , ZHAO Q C , et al . IoTFuzzer: discovering memory corruptions in IoT through App-based fuzzing [C ] // Proceedings of the 2018 Network and Distributed System Security Symposium (NDSS 2018) . Virginia : the Internet Society , 2018 .

REDINI N , CONTINELLA A , DAS D , et al . Diane: identifying fuzzing triggers in Apps to generate under-constrained inputs for IoT devices [C ] // /Proceedings of 2021 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2021 : 484 - 500 .

CHEN J Y , ZUO C , DIAO W R , et al . Your IoTs are (not) mine: On the remote binding between IoT devices and users [C ] // Proceedings of the 49th IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2019 : 222 - 233 .

WANG J C , YU L , LUO X P . LLMIF: augmented large language model for fuzzing IoT devices [C ] // Proceedings of 2024 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2024 : 881 - 896 .

ZHENG Y , DAVANIAN A , YIN H , et al . FIRM-AFL: high-throughput greybox fuzzing of IoT firmware via augmented process emulation [C ] // Proceedings of 28th USENIX Security Symposium (USENIX Security 19) . Berkeley : USENIX Association , 2019 : 1099 - 1114 .

ZHENG Y , LI Y , ZHANG C , et al . Efficient greybox fuzzing of applications in Linux-based IoT devices via enhanced user-mode emulation [C ] // Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM Press , 2022 : 417 - 428 .

CHEN L B , CAI Q P , MA Z B , et al . SFuzz: slice-based fuzzing for real-time operating systems [C ] // Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM Press , 2022 : 485 - 498 .

YIN Q D , ZHOU X , ZHANG H W . FirmHunter: state-aware and introspection-driven grey-box fuzzing towards iot firmware [J ] . Applied Sciences , 2021 , 11 ( 19 ): 2076 - 3417 .

KIM J , YU J , KIM H , et al . FIRM-COV: high-coverage greybox fuzzing for IoT firmware via optimized process emulation [J ] . IEEE Access , 2021 , 9 : 101627 - 101642 .

GAO J , XU Y , JIANG Y , et al . EM-Fuzz: augmented firmware fuzzing via memory checking [J ] . IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 2020 , 39 ( 11 ): 3420 - 3432 .

SRIVASTAVA P , PENG H , LI J , et al . FirmFuzz: automated IoT firmware introspection and analysis [C ] // Proceedings of the 2nd International ACM Workshop on Security and Privacy for the Internet-of-Things . New York : ACM Press , 2019 : 15 - 21 .

ZHANG Y , ZHONG N , YOU W , et al . NDFuzz: a non-intrusive coverage-guided fuzzing framework for virtualized network devices [J ] . Cybersecurity , 2022 , 5 ( 1 ): 21 .

LI W Q , SHI J M , LI F J , et al . μAFL: non-intrusive feedback-driven fuzzing for microcontroller firmware [C ] // Proceedings of the 44th International Conference on Software Engineering . New York : ACM Press , 2022 : 1 - 12 .

EISELE M , EBERT D , HUTH C , et al . Fuzzing embedded systems using debug interfaces [C ] // Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM Press , 2023 : 1031 - 1042 .

MENG R , MICHEV M , BOHME M , et al . Large language model guided protocol fuzzing [C ] // Proceedings of the 31st Annual Network and Distributed System Security Symposium (NDSS 2024). 2024 .

ASMITA , YAROSLAR O , MICHAEL S , et al . Fuzzing busybox: leveraging LLM and crash reuse for embedded bug unearthing [C ] // Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24) . Berkeley : USENIX Association , 2024 : 883 - 900 .

GAO Z C , ZHANG C , LIU H T , et al . Faster and better: detecting vulnerabilities in Linux-based IoT firmware with optimized reaching definition analysis [C ] // Proceedings of the 31st Annual Network and Distributed System Security Symposium (NDSS) . 2024 .

CHEN L , WANG Y , CAI Q , et al . Sharing more and checking less: leveraging common input keywords to detect bugs in embedded systems [C ] // Proceedings of 30th USENIX Security Symposium (USENIX Security 21) . Berkeley : USENIX Association , 2021 : 303 - 319 .

REDINI N , MACHIRY A , WANG R Y , et al . Karonte: detecting insecure multi-binary interactions in embedded firmware [C ] // Proceedings of 2020 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2020 : 1544 - 1561 .

CHENG K , LI Q , WANG L , et al . DTaint: detecting the taint-style vulnerability in embedded device firmware [C ] // 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . Piscataway : IEEE Press , 2018 : 430 - 441 .

CHENG K , ZHENG Y W , LIU T , et al . Detecting vulnerabilities in Linux-based embedded firmware with SSE-based on-demand alias analysis [C ] // Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM Press , 2023 : 360 - 372 .

CHENG K , FANG D L , QIN C , et al . Automatic inference of taint sources to discover vulnerabilities in SOHO router firmware [C ] // Proceedings of IFIP International Conference on ICT Systems Security and Privacy Protection . Berlin : Springer , 2021 : 83 - 99 .

LIU P , ZHENG Y , SUN C , et al . FITS: inferring intermediate taint sources for effective vulnerability analysis of IoT device firmware [C ] // Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems . New York : ACM Press , 2023 : 138 - 152 .

SHOSHITAISHVILI Y , WANG R , HAUSER C , et al . Firmalice: automatic detection of authentication bypass vulnerabilities in binary firmware [C ] // Proceedings of the 2015 Network and Distributed System Security Symposium (NDSS 2015) . Virginia : the Internet Society , 2015 .

YUAN B , SONG Z , JIA Y , et al . MQTTactic: Security analysis and verification for logic flaws in MQTT implementations [C ] // Proceedings of 2024 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2023 : 13 .

ZHANG L , CHEN J , DIAO W , et al . CryptoREX: large-scale analysis of cryptographic misuse in IoT devices [C ] // Proceedings of 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019) . 2019 : 151 - 164 .

WANG J N , GUO S Q , DIAO W R , et al . CrypTody: cryptographic misuse analysis of the IoT firmware via data-flow reasoning [C ] // Proceedings of 27th International Symposium on Research in Attacks, Intrusions and Defenses (RAID '24) . New York : ACM Press , 2024 : 579 - 593 .

CHENG Y , CUI B J , CHEN C , THAR B , TAO Q . Static vulnerability mining of IoT devices based on control flow graph construction and graph embedding network [J ] . Computer Communications , 2023 , 197 : 267 - 275 .

ABU-MAHFOUZ A , ALRABAEE S , KHASAWNEH M , et al . A deep learning approach to discover router firmware vulnerabilities [J ] . IEEE Transactions on Industrial Informatics , 2024 , 20 ( 1 ): 691 - 702 .

LI H N , YU H , ZHAI Y Z , et al . Enhancing static analysis for practical bug detection: an LLM-integrated approach [C ] // Proceedings of the ACM on Programming Languages . New York : ACM Press , 2024 : 474 - 499 .

ZHAO J X , LI Y K , ZOU Y Y , et al . Leveraging semantic relations in code and data to enhance taint analysis of embedded systems [C ] // Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24) . Berkeley : USENIX Association , 2024 : 7067 - 7084 .

ZHAO D D , LIN H , RAN L J , et al . CVSkSA: cross-architecture vulnerability search in firmware based on KNN-SVM and attributed control flow graph [J ] . Software Qual , 2019 , 7 ( 3 ): 1045 - 1068 .

SHIRANI P , COLLARD L , Agba B L , et al . BINARM: scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices [C ] // Proceedings of in Detection of Intrusions and Malware , and Vulnerability Assessment : 15th International Conference. Berlin:Springer , 2018 : 114 - 138 .

CHEN D D , WOO M , BRUMLEY D , et al . Towards automated dynamic analysis for Linux-based embedded firmware [C ] // Proceedings of the 2016 Network and Distributed System Security Symposium (NDSS 2016) . Virginia : the Internet Society , 2016 .

KIM M , KIM D , KIM E , et al . Firmae: towards large-scale emulation of iot firmware for dynamic analysis [C ] // Proceedings of the 36th Annual Computer Security Applications Conference . 2020 : 733 - 745 .

TAY H J , ZENG K , VADAYATH J M , et al . Greenhouse:single-service re-hosting of Linux-based firmware binaries in user-space emulation [C ] // Proceedings of 32nd USENIX Security Symposium (USENIX Security 23) . Berkeley : USENIX Association , 2023 : 5791 - 5808 .

ZADDACH J , BRUNO L , FRANCILLON A , et al . Avatar: a framework to support dynamic security analysis of embedded systems' firmwares [C ] // Proceedings of the 2014 Network and Distributed System Security Symposium (NDSS) . Virginia : the Internet Society , 2014 : 1 - 16 .

MUENCH M , NISI D , FRANCILLON A , et al . Avatar 2: a multi-target orchestration platform [C ] // Proceedings of Workshop Binary Anal . Res . ( NDSS 2018 ). Virginia : the Internet Society , 2018 : 1 - 11 .

FENG B , MERA A , LU L . P2IM: scalable and hardware-independent firmware testing via automatic peripheral interface modeling [C ] // Proceedings of the 29th USENIX Security Symposium (USENIX Security 20) . Berkeley : USENIX Association , 2020 : 1237 - 1254 .

ZHOU W , GUAN L , LIU P , et al . Automatic firmware emulation through invalidity-guided knowledge inference [C ] // Proceedings of the 30th USENIX Security Symposium (USENIX Security 2021) . Berkeley : USENIX Association , 2021 : 2007 - 2024 .

SCHARNOWSKI T , BARS N , SCHLOEGEL M , et al . Fuzzware: using precise MMIO modeling for effective firmware fuzzing [C ] // Proceedings of the 31st USENIX Security Symposium (USENIX Security 22) . Berkeley : USENIX Association , 2022 : 1239 - 1256 .

GUSTAFSON E , MUENCH M , SPENSKY C , et al . Toward the analysis of embedded firmware through automated re-hosting [C ] // Proceedings of the 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2019) . New York : ACM Press , 2019 : 135 - 150 .

CLEMENTS A , GUSTAFSON E , SCHARNOWSKI T , et al . HALucinator: firmware re-hosting through abstraction layer emulation [C ] // Proceedings of 29th USENIX Security Symposium (USENIX Security 2020) . Berkeley : USENIX Association , 2020 : 1201 - 1218 .

SRINIVASAN J , TANKSALKAR S R , AMUSUO P C , et al . Towards re-hosting embedded applications as Linux applications [C ] // Proceedings of the 53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks-Supplemental Volume (DSN-S) . Piscataway : IEEE Press , 2023 : 94 - 99 .

SEIDEL L , MAIER D C , MUENCH M . Forming faster firmware fuzzers [C ] // Proceedings of in 32nd USENIX Security Symposium (USENIX Security 23) . Berkeley : USENIX Association , 2023 : 2903 - 2920 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

AutoVulnFix: 大语言模型驱动的智能搜索自适应漏洞修复系统

基于隐私集合求交的大模型双向隐私授权

mmDefender: 基于多模态多语言对抗训练的大语言模型增强方法

“最小必要”原则视角检测移动应用程序的隐私合规性

基于指令与描述的文本数据安全业务属性生成机制