Iot device vulnerability detection method and system based on simulation and directed fuzz testing

Abstract

The application belongs to the technical field of vulnerability detection, and discloses a kind of based on simulation and directed fuzz testing's Internet of Things equipment vulnerability detection method and system, the present application combines firmware simulation technology and directed fuzz testing technology, realize a can automatically dig Internet of Things equipment network service program vulnerability framework.The framework includes simulation part and directed fuzz testing part.Error handling mechanism is contained in simulation part, after completing firmware extraction, error handling mechanism will be monitored through serial port and error handling, ensure the normal operation of simulation program.Directed fuzz testing part includes static analysis module and dynamic debugging module, static analysis module will generate iCFG for network service program, and mark target block to generate test seed;Dynamic debugging module will mutate seed, and perform vulnerability mining on successfully simulated network service program, while capturing corresponding error for vulnerability identification.

Description

Technical Field

[0001] This invention belongs to the field of vulnerability detection technology, and in particular relates to a method and system for detecting vulnerabilities in Internet of Things (IoT) devices based on simulation and targeted fuzz testing. Background Technology

[0002] Due to the complexity of their architecture and the diversity of hardware types, IoT device security cannot be approached with a uniform method for vulnerability discovery like software security. Firmware emulation technology simulates hardware with different architectures on a specific platform, thereby providing a hardware foundation for the corresponding software and offering feasible solutions for various security techniques such as fuzzing and symbolic execution. Fuzzing, a commonly used vulnerability discovery technique, generates a large number of random inputs through mutation and other methods, continuously testing the program's stability until it crashes, and then identifying the source of the vulnerability based on the cause of the crash. Currently, fuzzing technology is widely used on x86 architecture, and many x86-based software programs use this technology to varying degrees for stability testing. At present, most fuzzing techniques still rely on mutation algorithms to generate a large number of test cases for program testing. However, some fuzzing algorithms still employ targeted fuzzing techniques, which do not test the entire software or program but focus on testing a specific code segment or a sensitive field. The advantage of this technique is that it reduces the overall use of computer resources, allowing resources to be used in areas where vulnerabilities are more likely to be triggered.

[0003] However, even though targeted fuzzing overcomes some of the shortcomings of traditional fuzzing techniques, most efficient targeted fuzzing algorithms still fail to function properly in the complex environments of IoT devices, posing new challenges to fuzzing technology. Therefore, to meet the increasing security demands of IoT devices, fuzzing technology needs to be combined with firmware emulation technology to perform vulnerability discovery. However, this approach exposes some problems: firmware emulation technology lacks a dedicated module for handling program crashes, especially the recurring crashes during fuzzing; or, due to the intervention of emulation technology, the fuzzer may incorrectly identify the emulated module as the test object. Therefore, fuzzers need to design corresponding modules to address the various problems arising from firmware emulation. Furthermore, firmware emulation also needs to allocate space for a dedicated fuzzing module for vulnerability discovery.

[0004] To ensure the proper functioning of the simulation program, a corresponding error handling mechanism is essential. Current industry-proposed simulation solutions include some error handling measures, but some of these solutions prevent the inclusion of a fuzzing module in the simulation. To guarantee the normal operation of both simulation and fuzzing, modifications to the current error handling mechanism are necessary.

[0005] Faced with the increasingly challenging security situation of IoT devices, many security experts have adopted fuzzing methods to uncover vulnerabilities. However, due to the complex architecture and diverse hardware types of IoT devices, most fuzzers cannot operate efficiently. Fuzzers need to clearly define the scope of vulnerability discovery to avoid testing irrelevant programs, especially hardware-related programs that could cause device crashes. Therefore, some traditional fuzzing schemes do not perform well on IoT devices, as a large portion of the crashes they cause originate from hardware program failures. Vulnerability discovery for IoT devices requires fuzzers more adapted to their environment, and targeted fuzzers clearly perform better in the context of IoT devices. Targeted fuzzers use appropriate algorithms and static analysis to obtain program flow graphs, calculating the distance or other metrics to sensitive blocks, thereby guiding the generation of test cases that target the target area. Due to the characteristics of targeted test blocks, targeted fuzzing consumes fewer resources than traditional fuzzing techniques, making it well-suited for IoT devices operating in low-power environments.

[0006] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0007] (1) Current vulnerability discovery solutions for IoT devices are not well integrated with simulation technology;

[0008] (2) Most simulation techniques fail to guarantee the normal operation of fuzz testing when they employ error handling mechanisms;

[0009] (3) Targeted fuzz testing technology has not been well applied to the field of vulnerability discovery in IoT device firmware simulation. Summary of the Invention

[0010] To address the problems existing in the prior art, this invention provides a method and system for detecting vulnerabilities in Internet of Things (IoT) devices based on simulation and targeted fuzz testing.

[0011] This invention is implemented as follows: A method for detecting vulnerabilities in IoT devices based on simulation and targeted fuzz testing includes:

[0012] Step 1: Extract the program from the IoT device firmware and locate the program related to network services;

[0013] Step two: Collect the hardware information required by the network service program and attempt to start the simulation;

[0014] Step 3: Monitor for errors via serial port and resolve them using the error handling mechanism based on the simulation error report;

[0015] Step four, performed concurrently with step two, involves obtaining the call graph (CG) and control flow graph (CFG) from the static analysis module through the network service program, and generating the inter-procedural control flow graph (iCFG) from these graphs. Target blocks are then marked in the graphs based on sensitive fields.

[0016] Step 5: Optimize and prune iCFG based on the target block and generate test seeds;

[0017] Step Six: After the simulation starts normally, the directional fuzz tester will use the test seed provided in Step Five to perform directional fuzz testing according to the corresponding mutation strategy, and finally use the detector to check whether the relevant errors in the program are vulnerabilities.

[0018] Furthermore, in step one, the extractor will identify the corresponding file system by recognizing the header fields in the binary file and extracting the corresponding file system based on the magic word. The analyzer will then analyze the rcS-related scripts to identify the network service programs within the IoT firmware file system.

[0019] In step two, an attempt is made to simulate the network service program using a simulator;

[0020] In step three, errors are monitored via the serial port. If an error is detected, an error handling mechanism is used to process the error during the simulation until the simulation runs normally.

[0021] Furthermore, in step four, which is performed simultaneously with step two, the directional fuzz tester performs static analysis on the network service-related programs to generate a control flow graph (CFG) and a program call graph (CG), and combines the two graphs to generate an inter-program control flow graph (iCFG). After the graph is generated, the sensitive fields of each block in the graph are identified based on the sensitive field database, and the blocks with sensitive fields are marked as target blocks.

[0022] In step five, the inter-program control flow graph (iCFG) marked with the target block is pruned to remove execution paths that cannot reach the target block, and test seeds for fuzz testing are generated from the pruned graph.

[0023] Furthermore, in step six, under normal simulation conditions, the mutation strategy will mutate the seed from step five, generate test cases for targeted fuzz testing, record errors generated during fuzz testing, and finally use a detector to detect whether various errors are vulnerabilities.

[0024] Furthermore, the simulation component needs to include an error handling mechanism to monitor and process simulation errors.

[0025] Furthermore, the directional fuzz tester comprises two modules: a static analysis module and a dynamic debugging module;

[0026] The static analysis module is mainly responsible for generating the inter-program control flow graph (iCFG), marking target blocks, and generating seeds. The generation of the inter-program control flow graph (iCFG) requires the following: control flow graph (CFG) and program call graph (CG). The generation scheme adopts the symbolic execution method.

[0027] The dynamic analysis module is mainly responsible for targeted fuzz testing. It generates multiple test cases from the seed through mutation strategies, records the test results of the test cases, and finally detects and judges vulnerabilities based on the test results.

[0028] Another objective of this invention is to provide an IoT device vulnerability detection system based on simulation and targeted fuzz testing, comprising:

[0029] The extraction and locking module is used to extract programs from the firmware of IoT devices and lock the location of programs related to network services.

[0030] The collection module is used to collect the hardware information required by the network service program and attempt to start the simulation;

[0031] The monitoring module is used to listen for errors via the serial port and resolve the errors through the error handling mechanism based on the simulation errors.

[0032] The static analysis module is used to obtain CG and CFG from the static analysis module through the network service program, and generate iCFG from them. At the same time, it marks the target blocks in the graph according to the sensitive fields.

[0033] The optimization module is used to optimize and prune the iCFG graph based on the target block and generate test seeds;

[0034] The testing module is used to perform directional fuzz testing using test seeds and corresponding mutation strategies after the simulation starts normally. Finally, the detector checks whether the relevant errors in the program are vulnerabilities.

[0035] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the IoT device vulnerability detection method based on simulation and directional fuzz testing.

[0036] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the IoT device vulnerability detection method based on simulation and directional fuzz testing.

[0037] Another objective of this invention is to provide an information data processing terminal for implementing the IoT device vulnerability detection system based on simulation and directional fuzz testing.

[0038] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0039] First, this invention combines firmware emulation technology and targeted fuzzing technology to realize a framework capable of automatically discovering vulnerabilities in network service programs of IoT devices. This framework includes a simulation component and a targeted fuzzing component. The simulation component includes an error handling mechanism that monitors and processes errors via a serial port after firmware extraction, ensuring the normal operation of the simulation program. The targeted fuzzing component includes a static analysis module and a dynamic debugging module. The static analysis module generates an iCFG graph of the network service program and marks target blocks to generate test seeds. The dynamic debugging module mutates the seeds and performs vulnerability discovery on successfully simulated network service programs, while simultaneously capturing corresponding errors for vulnerability identification.

[0040] This invention uses a proposed framework to extract the file system from the firmware of IoT devices, then identifies network service-related programs and attempts to simulate them. An error handling mechanism is employed during simulation to ensure the normal operation of the simulation program for subsequent fuzzing. When the simulator attempts to simulate, the directed fuzzer performs static analysis on the network service program to obtain an iCFG graph, then simplifies the graph based on the marked target blocks, and generates seeds for the subsequent dynamic debugging phase. During the dynamic debugging phase, the directed fuzzer performs fuzzing using the successfully simulated program, processes the corresponding seeds using a mutation algorithm to generate test cases, records error information in a database, and finally uses a detector to check for errors and whether they constitute vulnerabilities.

[0041] This invention is based on IoT firmware simulation technology and directional fuzzing technology. It uses simulation technology and internal error handling mechanisms to ensure the normal operation of the simulation program, and designs a directional fuzzing algorithm on this basis to improve the efficiency of vulnerability discovery in IoT device network service programs.

[0042] Secondly, this invention provides a method for detecting vulnerabilities in IoT devices based on simulation and targeted fuzzing. Through a series of steps, it achieves in-depth analysis and vulnerability detection of IoT device firmware. The method first extracts the program from the firmware and locates the program related to network services. Then, it collects the necessary hardware information and attempts to start the simulation. During the simulation, errors are monitored via serial port, and error handling mechanisms are used to resolve encountered problems. Simultaneously, the method uses a static analysis module to obtain the CG (Control Flow Graph) and CFG (Data Flow Graph) of the network service program, generating an iCFG (Inter-Program Control Flow Graph), and marking target blocks in the graph. Subsequently, the iCFG graph is optimized and pruned based on the target blocks to generate test seeds. Finally, after the simulation starts normally, a targeted fuzzing tester is used to perform targeted fuzzing on the test seeds, and a detector is used to detect whether the relevant errors in the program constitute vulnerabilities.

[0043] This invention solves a series of problems in the prior art and achieves significant technological progress. First, by constructing a simulation environment and introducing an error handling mechanism, this invention improves the accuracy and efficiency of vulnerability detection, reducing false positives and false negatives. Second, through static analysis and graph optimization pruning, this invention can more accurately locate target blocks, reducing the number and complexity of test seeds and improving the effectiveness and relevance of testing. Finally, by using a targeted fuzz tester, this invention can automate vulnerability detection, reducing the complexity and cost of manual intervention and improving detection efficiency and reliability.

[0044] In summary, the IoT device vulnerability detection method based on simulation and directional fuzz testing provided by this invention not only solves the problems of existing technologies but also achieves significant technological progress, providing effective protection for the security and stability of IoT devices.

[0045] Third, the technical solution of this invention fills a technological gap in the industry both domestically and internationally:

[0046] Currently, neither domestic nor international industry professionals have combined simulation technology and targeted fuzzing technology with IoT device firmware vulnerability discovery, resulting in the lack of a fully automated process for IoT device firmware vulnerability discovery. The technical solution of this invention combines these two technologies, satisfying both the need for IoT device firmware simulation across different architectures and incorporating targeted fuzzing technology for IoT device firmware vulnerability discovery, thus automating the entire process.

[0047] Fourth, the technical problems of existing technologies:

[0048] In the field of IoT device security, common vulnerability detection methods rely on standard static analysis and fuzzing techniques. While these methods are effective in some cases, they face the following technical challenges:

[0049] 1. Difficulty in reproducing the environment: IoT devices often rely on specific hardware and operating systems. Traditional vulnerability detection methods are unable to accurately reproduce the device's operating environment, resulting in an inability to accurately simulate device behavior and potential vulnerabilities.

[0050] 2. Inefficiency: Existing fuzz testing is usually blind and does not specifically test code areas that may have security vulnerabilities, resulting in low testing efficiency.

[0051] 3. High false positive rate: Although static analysis methods can cover a wide range of code, they often result in a high false positive rate due to the conservative nature of the analysis, which increases the workload of vulnerability screening.

[0052] To address the aforementioned problems, this invention proposes a vulnerability detection method for IoT devices based on simulation and targeted fuzz testing. The specific technical solution includes:

[0053] 1. Firmware Analysis: Automatically extracts programs from the firmware of IoT devices and identifies the locations of programs related to network services. It also extracts the file system by identifying specific magic words in binary files.

[0054] 2. Hardware environment simulation: Collect necessary hardware information and attempt to simulate the network service program using a simulator. Use error handling mechanisms to resolve errors during the simulation process until the simulation environment is stable.

[0055] 3. Static Analysis and Test Preparation: The static analysis module generates the program's call graph and control flow graph, further constructs the inter-program control flow graph (iCFG), and marks and optimizes potentially security-sensitive blocks.

[0056] 4. Targeted Fuzz Testing: Based on the optimized iCFG, generate precise test seeds, use a targeted fuzz tester to execute tests according to a specific mutation strategy, and identify and confirm vulnerabilities through a detector.

[0057] The implementation of this invention will bring about the following significant technological advancements:

[0058] 1. Improved detection accuracy: By combining simulation and targeted fuzz testing, this invention can accurately trigger and observe potential vulnerabilities in a simulated real device environment, greatly improving the accuracy of vulnerability detection.

[0059] 2. Improve testing efficiency: Targeted fuzz testing is highly targeted, testing only code areas that have been pre-analyzed as potentially risky, which significantly improves testing efficiency and effectiveness.

[0060] 3. Reduce false positive rate: Through precise static analysis and targeted generation of test seeds, the false positive rate of vulnerability detection is reduced, thereby reducing the workload of subsequent review and remediation.

[0061] 4. High adaptability: This method is applicable to various IoT devices and different firmware environments, and has good universality and scalability.

[0062] This invention provides an efficient and accurate security vulnerability detection solution for IoT devices through intelligent simulation and directional fuzzy testing technology, significantly improving the security protection capabilities and reliability of IoT devices in the security field. Attached Figure Description

[0063] Figure 1 This is a flowchart of an IoT device vulnerability detection method based on simulation and targeted fuzz testing provided in an embodiment of the present invention.

[0064] Figure 2 This is a structural block diagram of the IoT device vulnerability detection method based on simulation and directional fuzz testing provided in an embodiment of the present invention.

[0065] Figure 3 This is the overall architecture and workflow diagram of the IoT device vulnerability detection method based on simulation and targeted fuzz testing provided in this embodiment of the invention. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0067] Example 1: Vulnerability Detection of IoT Devices in Smart Network Equipment

[0068] 1. Extract the program and lock the location (S101):

[0069] For the firmware of an IoT device in a smart network, such as a home router, first extract its program code and locate the network service program that controls the camera's on / off state.

[0070] 2. Hardware information collection and simulation startup (S102):

[0071] Collect the hardware information required by the home router, such as processor type and memory capacity, and configure the corresponding hardware parameters in the simulation environment to try to start the simulation.

[0072] 3. Error monitoring and handling (S103):

[0073] During simulation startup, error messages are monitored via serial port. If any simulation errors occur, a predefined error handling mechanism is used to diagnose and fix the problems, ensuring the stable operation of the simulation environment.

[0074] 4. Static analysis and test seed generation (S104-S105):

[0075] Static analysis is performed on the network service program to obtain the call graph (CG) and control flow graph (CFG) of control instructions, and then an inter-program control flow graph (iCFG) is generated. Sensitive fields for processing network requests are identified, and these blocks are marked in the iCFG. The iCFG is then optimized and pruned based on the marked target blocks to generate targeted test seeds.

[0076] 5. Oriented Fuzzy Testing (S106):

[0077] After a normal startup in the simulation environment, a directional fuzz tester is used to load the test seed and apply mutation strategies to test the network service program of the home router, monitoring for any abnormal behavior that could indicate potential security vulnerabilities.

[0078] Example 2: Vulnerability Detection of Smart Surveillance Cameras

[0079] 1. Extract the program and lock the location (S101):

[0080] Extract the program from the firmware of the smart surveillance camera, especially the network service part involving video transmission and reception, and locate the relevant program code.

[0081] 2. Hardware information collection and simulation startup (S102):

[0082] Collect hardware information about the camera, such as sensor model and codec information, and configure a simulation environment to simulate the camera's hardware environment.

[0083] 3. Error monitoring and handling (S103):

[0084] Monitor serial port error messages during the simulation process, and use error handling mechanisms to resolve problems that arise during the simulation in a timely manner, ensuring the stability of the simulation environment.

[0085] 4. Static analysis and test seed generation (S104-S105):

[0086] Static analysis is performed on the network service program to construct the CG and CFG for data stream processing, and an iCFG is generated. Sensitive blocks for processing data streams are identified and marked on the iCFG, and targeted test seeds are generated after optimization and pruning.

[0087] 5. Oriented Fuzzy Testing (S106):

[0088] After confirming that the simulation environment is running stably, the camera's video processing service is tested using a directional fuzz tester. The prepared test seeds are used to simulate attacks or abnormal data streams to detect potential vulnerabilities or abnormal responses, thereby ensuring the security of the device.

[0089] like Figure 1 As shown in the figure, an IoT device vulnerability detection method based on simulation and targeted fuzz testing provided by an embodiment of the present invention includes the following steps:

[0090] S101, extracts programs from the firmware of IoT devices and locks the location of programs related to network services;

[0091] S102, collects the hardware information required by the network service program and attempts to start the simulation;

[0092] S103 monitors for errors via serial port and resolves errors through an error handling mechanism based on simulation errors.

[0093] S104, performed concurrently with S102, obtains CG and CFG in the static analysis module through the network service program, and generates iCFG from them. At the same time, the target block is marked in the graph according to the sensitive fields.

[0094] S105, Optimize and prune the iCFG graph according to the target block and generate test seeds;

[0095] S106 After the simulation starts normally, the directional fuzz tester will use the test seed provided by S105 to perform directional fuzz testing according to the corresponding mutation strategy, and finally use the detector to check whether the relevant errors in the program are vulnerabilities.

[0096] In S101 of the present invention, the extractor will identify the corresponding file system by recognizing the header field in the binary file and extracting the corresponding file system according to the magic word, and analyze the rcS related scripts by the analyzer, thereby recognizing the network service program in the IoT firmware file system.

[0097] In S102, an emulator is used to attempt to simulate the network service program;

[0098] In S103, errors are monitored via the serial port. If an error is detected, an error handling mechanism is used to process the error during simulation until the simulation runs normally.

[0099] In S104, which is performed simultaneously with S102, the directional fuzz tester performs static analysis on the network service-related programs to generate a control flow graph (CFG) and a program call graph (CG), and combines the two graphs to generate an iCFG graph. After the graph is generated, the sensitive fields of each block in the graph are identified according to the sensitive field database, and the blocks with sensitive fields are marked as target blocks.

[0100] In S105, a pruning operation is performed on the iCFG graph marked with the target block to remove execution paths that cannot reach the target block, and test seeds required for fuzz testing are generated from the pruned graph.

[0101] In S106 of the present invention, under normal simulation conditions, the mutation strategy will mutate the seed in S105, generate test samples for targeted fuzz testing, record the errors generated in the fuzz testing, and finally use a detector to detect whether various errors are vulnerabilities.

[0102] The simulation component provided in this embodiment of the invention needs to include an error handling mechanism to monitor and process simulation errors.

[0103] The directional fuzz tester provided in this embodiment of the invention comprises two modules: a static analysis module and a dynamic debugging module;

[0104] The static analysis module is mainly responsible for the generation of the iCFG graph, the marking of target blocks, and the generation of seeds. The generation of the iCFG graph needs to include: the control flow graph (CFG) and the program call graph (CG). The generation scheme adopts the symbolic execution method.

[0105] The dynamic analysis module is mainly responsible for targeted fuzz testing. It generates multiple test cases from the seed through mutation strategies, records the test results of the test cases, and finally detects and judges vulnerabilities based on the test results.

[0106] like Figure 2 As shown, an embodiment of the present invention provides an IoT device vulnerability detection system based on simulation and targeted fuzz testing, comprising:

[0107] The extraction and locking module is used to extract programs from the firmware of IoT devices and lock the location of programs related to network services.

[0108] The collection module is used to collect the hardware information required by the network service program and attempt to start the simulation;

[0109] The monitoring module is used to listen for errors via the serial port and resolve the errors through the error handling mechanism based on the simulation errors.

[0110] The static analysis module is used to obtain CG and CFG from the static analysis module through the network service program, and generate iCFG from them. At the same time, it marks the target blocks in the graph according to the sensitive fields.

[0111] The optimization module is used to optimize and prune the iCFG graph based on the target block and generate test seeds;

[0112] The testing module is used to perform directional fuzz testing using test seeds and corresponding mutation strategies after the simulation starts normally. Finally, the detector checks whether the relevant errors in the program are vulnerabilities.

[0113] An embodiment of the present invention provides a computer device, the computer device including a memory and a processor, the memory storing a computer program, and when the computer program is executed by the processor, the processor performs the steps of the IoT device vulnerability detection method based on simulation and directional fuzz testing.

[0114] This invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor performs the steps of the IoT device vulnerability detection method based on simulation and directional fuzz testing.

[0115] This invention provides an information data processing terminal, which is used to implement the IoT device vulnerability detection system based on simulation and directional fuzz testing.

[0116] Specific implementation of the present invention:

[0117] The technical solution adopted in this invention is:

[0118] A vulnerability detection method for IoT devices based on simulation and targeted fuzz testing includes the following steps:

[0119] Step 1: Extract the program from the IoT device firmware and locate the program related to network services;

[0120] Step two: Collect the hardware information required by the network service program and attempt to start the simulation;

[0121] Step 3: Monitor for errors via serial port and resolve them using the error handling mechanism based on the simulation error report;

[0122] Step four, performed concurrently with step two, involves obtaining CG and CFG from the static analysis module via the network service program, generating iCFG from them, and marking target blocks in the graph based on sensitive fields.

[0123] Step 5: Optimize and prune iCFG based on the target block and generate test seeds;

[0124] Step Six: After the simulation starts normally, the directional fuzz tester will use the test seed provided in Step Five to perform directional fuzz testing according to the corresponding mutation strategy, and finally use the detector to check whether the relevant errors in the program are vulnerabilities.

[0125] In step one of the embodiments of the present invention, the extractor will identify the corresponding file system by recognizing the header field in the binary file and extracting the corresponding file system according to the magic word, and analyze the startup script such as rcS by the analyzer, thereby identifying the network service program in the IoT firmware file system.

[0126] In step two of the embodiments of the present invention, the network service program is simulated using the QEMU emulator.

[0127] In step three of this embodiment of the invention, errors are detected by monitoring the serial port. If an error is detected, an error handling mechanism is used to process the error during simulation until the simulation runs normally.

[0128] In step four of the embodiments of the present invention, which is performed simultaneously with step two, the directional fuzz tester performs static analysis on the network service-related programs to generate a control flow graph (CFG) and a call graph (CG), and combines the above two graphs to generate an inter-procedural control flow graph (iCFG). After the iCFG is generated, the sensitive fields of each block in the iCFG are identified according to the sensitive field database, and the blocks with sensitive fields are marked as target blocks.

[0129] In step five of the embodiments of the present invention, a pruning operation is performed on the iCFG graph marked with the target block to remove the execution path that cannot reach the target block, and the pruned graph generates the test seed required for fuzz testing.

[0130] In step six of the present invention, under normal simulation conditions, the mutation strategy will mutate the seed in step five, generate test samples for targeted fuzz testing, record the errors generated in the fuzz testing, and finally use a detector to detect whether various errors are vulnerabilities.

[0131] It needs to be emphasized that, Figure 3 As shown, one embodiment of the present invention is applied to a computer device and includes the following steps:

[0132] S1, the extractor extracts the root file system from the firmware of the IoT device.

[0133] In step S1 provided in this embodiment of the invention, the extractor will identify the header field in the binary file, extract the corresponding file system according to the magic word, and analyze related scripts such as rcS through the analyzer, thereby identifying the network service program in the IoT firmware file system.

[0134] S2, the analyzer collects the hardware information required by the network service program and attempts to start the simulation.

[0135] In step S2 provided in this embodiment of the invention, the hardware information is collected by the analyzer through corresponding function requests and API applications. After receiving the hardware information, the simulator will attempt to perform hardware virtualization and generate corresponding commands to try to start the simulation.

[0136] S3, the emulator listens for errors via serial port and resolves the errors through the error handling mechanism based on the simulation error.

[0137] S4 obtains CG and CFG in the static analysis module through the network service program, and generates iCFG from them. At the same time, it marks the target blocks in the graph according to the sensitive fields.

[0138] In step S4 of this embodiment of the invention, it is performed simultaneously with step S2. The directional fuzz tester performs static analysis on the network service-related programs, generates a Control Flow Graph (CFG) and a Call Graph (CG) through a symbolic execution scheme, and combines the above two graphs to generate an inter-procedural Control Flow Graph (iCFG). After the iCFG is generated, the sensitive fields of each block in the iCFG are identified according to the sensitive field database, and the blocks with sensitive fields are marked as target blocks. The sensitive field database is provided by the operator.

[0139] S5 optimizes and prunes the iCFG based on the target block and generates a test seed.

[0140] In step S5 provided in this embodiment of the invention, the optimized pruning of iCFG will process the paths that do not pass through the target block. The pruned iCFG will be divided into multiple minimum subgraphs, and the different path variables generated by each subgraph will be recorded in memory.

[0141] S6. After the simulation starts normally, the directional fuzz tester will use the test seed provided in step S5 to perform directional fuzz testing according to the corresponding mutation strategy, and finally use the detector to check whether the relevant errors in the program are vulnerabilities.

[0142] In step S6 of this embodiment, the mutation strategy performs byte-level mutations on the test seed to ensure that the test sample can successfully reach the target block and achieve significant code coverage after the target block. Furthermore, when an error occurs during fuzzing, the targeted fuzzer stores the corresponding error in the database, and the detector determines whether various errors trigger vulnerabilities. The detector can be designed by the operator to match different vulnerability triggering methods.

[0143] Furthermore, the present invention also provides an application-level IoT firmware simulation execution system and system virtualization software, including interconnected microprocessors and memory, wherein the microprocessors are programmed or configured to execute the aforementioned IoT device vulnerability detection method based on simulation and targeted fuzz testing.

[0144] This invention also provides a storage medium storing a computer program that, when run on a computer, causes the computer to execute the above-described method for detecting IoT device vulnerabilities based on simulation and directional fuzz testing.

[0145] This invention also provides a computer device, including a general-purpose memory and a processor. The memory is electrically connected to the processor, and the memory stores a computer program. The processor executes the above-described IoT device vulnerability detection method based on simulation and directional fuzz testing by calling the computer program stored in the memory.

[0146] This invention employs a vulnerability detection method for IoT devices based on simulation and targeted fuzzing, enabling vulnerability discovery in IoT devices. The method involves extracting the file system from the IoT device firmware using an extractor, then analyzing the location of the network service program using an analyzer, and finally simulating the network service program using a QEMU emulator. Error handling mechanisms are used to address any errors encountered during simulation. Simultaneously, a targeted fuzzing module performs static analysis on the network service program, generates an iCFG graph, generates corresponding seeds based on target blocks within the graph, and performs targeted fuzzing based on corresponding mutation strategies. This framework improves the success rate and accuracy of targeted fuzzing in vulnerability discovery on IoT devices, ensuring the stability and reliability of IoT devices.

[0147] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented using hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or using software executed by various types of processors, or using a combination of the above-described hardware circuitry and software, such as firmware.

[0148] II. Application Examples. To demonstrate the inventiveness and technical value of the present invention, this section provides application examples of the technical solution on specific products or related technologies.

[0149] This invention investigates vulnerabilities in the IPC-44AW smart camera. First, the framework proposed in this invention extracts the program from the smart surveillance camera's firmware and uses multiple sensitive bytes, such as the startup script, to pinpoint the location of the relevant program code.

[0150] Then, the present invention will collect the hardware information of the camera, such as sensor model, codec information, etc., and configure a simulation environment to simulate the hardware environment of the camera.

[0151] After the simulation environment is configured and started, the simulator will listen for error messages during the simulation process via serial port and use the error handling mechanism to resolve problems that occur in the simulation in a timely manner, ensuring the stability of the simulation environment.

[0152] Meanwhile, when addressing simulation errors, the directional fuzz tester module performs static analysis on the network service program, constructs the CG and CFG for data stream processing, and generates an iCFG. Sensitive blocks in the processed data stream are identified and marked on the iCFG, and after optimization and pruning, targeted test seeds are generated.

[0153] Finally, after confirming the simulation is stable, the directional fuzz tester will generate test cases based on the test seed to perform vulnerability mining on the relevant program, and transmit the program's crash information or new branch trigger information to the database, where the detector will determine whether the above information is a vulnerability.

[0154] III. Evidence of the Relevant Effects of the Embodiments. The embodiments of the present invention have achieved some positive effects during research and development or use, and indeed possess significant advantages compared to existing technologies. The following description is based on actual circumstances.

[0155] This invention combines the features of firmware emulation and targeted fuzzing to automate the discovery of firmware vulnerabilities in IoT devices. Previously, vulnerability discovery in IoT device firmware typically involved emulation followed by the use of a suitable fuzzer. This process required not only time-consuming operations from technical personnel but also a thorough understanding of both emulation and fuzzing techniques to overcome incompatibility issues. This invention organically integrates the emulation and targeted fuzzing components, eliminating compatibility problems between the two technologies and automating the entire process. This has significant implications for discovering common vulnerabilities in IoT devices.

[0156] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting vulnerabilities in Internet of Things (IoT) devices based on simulation and targeted fuzz testing, characterized in that, The detection method includes the following steps: Step 1: Extract the program from the IoT device firmware and locate the program related to network services; Step two: Collect the hardware information required by the network service program and attempt to start the simulation; Step 3: Monitor for errors via serial port and resolve them using the error handling mechanism based on the simulation error report; Step four is performed simultaneously with step two. The program call graph (CG) and control flow graph (CFG) are obtained from the static analysis module through the network service program, and the inter-program control flow graph (iCFG) is generated from them. At the same time, target blocks are marked in the graph according to sensitive fields. Step 5: Optimize and prune the iCFG graph based on the target block and generate test seeds; Step 6: After the simulation starts normally, the directional fuzz tester will use the test seed provided in Step 5 to perform directional fuzz testing according to the corresponding mutation strategy, and finally use the detector to check whether the relevant errors in the program are vulnerabilities. In step one, the extractor will identify the corresponding file system by recognizing the header fields in the binary file and extracting the corresponding file system based on the magic word. The analyzer will then analyze the rcS startup script to identify the network service program within the IoT firmware file system. In step two, an attempt is made to simulate the network service program using a simulator; In step three, errors are monitored via the serial port. If an error is detected, an error handling mechanism is used to process the simulation error until the simulation runs normally. In step four, which is performed simultaneously with step two, the directional fuzz tester performs static analysis on the network service-related programs to generate a control flow graph (CFG) and a program call graph (CG), and combines the two graphs to generate an inter-program control flow graph (iCFG). After the graph is generated, the sensitive fields of each block in the graph are identified based on the sensitive field database, and the blocks with sensitive fields are marked as target blocks. In step five, the inter-program control flow graph (iCFG) marked with the target block is pruned to remove execution paths that cannot reach the target block, and test seeds for fuzz testing are generated from the pruned graph.

2. The IoT device vulnerability detection method based on simulation and targeted fuzz testing according to claim 1, characterized in that, In step six, if the simulation is running normally, the mutation strategy will mutate the seed from step five, generate test cases for targeted fuzz testing, record the errors generated during fuzz testing, and finally use a detector to detect whether various errors are vulnerabilities.

3. The IoT device vulnerability detection method based on simulation and targeted fuzz testing according to claim 1, characterized in that, The simulator needs to include an error handling mechanism to monitor and process simulation errors.

4. The IoT device vulnerability detection method based on simulation and targeted fuzz testing according to claim 1, characterized in that, The directional fuzz tester comprises two modules: a static analysis module and a dynamic debugging module; The static analysis module is mainly responsible for generating the inter-program control flow graph (iCFG), marking target blocks, and generating seeds. The generation of the inter-program control flow graph (iCFG) requires the following: control flow graph (CFG) and program call graph (CG). The generation scheme adopts the symbolic execution method. The dynamic analysis module is mainly responsible for targeted fuzz testing. It generates multiple test cases from the seed through mutation strategies, records the test results of the test cases, and finally detects and judges vulnerabilities based on the test results.

5. A system for detecting IoT device vulnerabilities based on simulation and directed fuzzing, implementing the IoT device vulnerability detection method based on simulation and directed fuzzing as described in any one of claims 1-4, characterized in that, The system includes: The extraction and locking module is used to extract programs from the firmware of IoT devices and lock the location of programs related to network services. The collection module is used to collect the hardware information required by the network service program and attempt to start the simulation; The monitoring module is used to listen for errors via the serial port and resolve the errors through the error handling mechanism based on the simulation errors. The static analysis module is used to obtain the program call graph (CG) and control flow graph (CFG) from the network service program, and generate the inter-program control flow graph (iCFG) and mark the target blocks in the graph according to the sensitive fields. The optimization module is used to optimize and prune the inter-program control flow graph (iCFG) based on the target block and generate test seeds. The testing module is used to perform directional fuzz testing using test seeds and corresponding mutation strategies after the simulation starts normally. Finally, the detector checks whether the relevant errors in the program are vulnerabilities.

6. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, causes the processor to perform the steps of the IoT device vulnerability detection method based on simulation and directional fuzz testing as described in any one of claims 1-4.

7. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the IoT device vulnerability detection method based on simulation and directional fuzz testing as described in any one of claims 1-4.

8. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the IoT device vulnerability detection system based on simulation and directional fuzz testing as described in claim 5.

Images